joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140011310
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov rax, rsp
mov byte [rax + 0x20], r9b
mov word [rax + 0x10], dx
push rbx
push rdi
sub rsp, 0x98
mov qword [rax - 0x18], rsi
movzx ebx, r9b
mov qword [rax - 0x20], r12
movzx esi, cl
mov qword [rax - 0x30], r14
movzx r12d, r8b
mov qword [rax - 0x38], r15
or r12b, r9b
lea eax, [rsi - 1]
cmp al, 5
ja 0x14001134e
cmp cl, 3
jne 0x140011355
lea eax, [rsi + 0x66]
cmp al, 5
ja 0x14001135a
mov r14b, 1
jmp 0x14001135d
xor r14b, r14b
mov eax, dword [rsp + 0xd0]
mov rdi, qword [rsp + 0xe8]
movzx r15d, byte [rsp + 0xe0]
test eax, eax
jle 0x140011502
mov qword [rsp + 0xb0], rbp
xor ebx, ebx
mov qword [rsp + 0x80], r13
mov ebp, eax
mov r13d, dword [rsp + 0xd8]
nop dword [rax]
cmp dword [0x140104da4], 0
jne 0x140011408
call qword [sym.imp.KERNEL32.DLL_GetTickCount]
mov rcx, qword [0x1400fda58]
sub eax, dword [0x140106f5c]
cmp eax, dword [rcx + 0x118]
jbe 0x14001140f
xor r9d, r9d
mov dword [rsp + 0x20], ebx
xor r8d, r8d
lea rcx, [rsp + 0x40]
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x1400113fc
mov edx, 1
mov dword [0x1400fda50], ebx
or ecx, 0xffffffff
call fcn.140001700
mov dword [0x1400fda50], 1
call qword [sym.imp.KERNEL32.DLL_GetTickCount]
mov dword [0x140106f5c], eax
mov rcx, qword [0x1400fda58]
test r15b, r15b
jne 0x14001146d
movzx eax, byte [rcx + 0x136]
test al, al
je 0x14001142b
movzx eax, al
mov ebx, 0xffc3d44d
sub ebx, eax
jmp 0x140011430
mov ebx, 0xffc3d44f
cmp dword [0x140104da4], 0
je 0x140011442
movzx eax, byte [0x1401071f5]
jmp 0x140011449
xor ecx, ecx
call fcn.1400144d0
mov dword [rsp + 0x28], ebx
xor r9d, r9d
mov r8, rdi
mov byte [rsp + 0x20], 1
movzx edx, al
movzx ecx, r12b
call fcn.140013dd0
mov rcx, qword [0x1400fda58]
xor ebx, ebx
test r14b, r14b
je 0x1400114b1
test rdi, rdi
jne 0x1400114b1
movzx eax, byte [rcx + 0x12f]
lea r9d, [rdi + 1]
movzx ecx, byte [rsp + 0x100]
mov r8d, dword [rsp + 0xf8]
mov edx, dword [rsp + 0xf0]
mov byte [rsp + 0x30], cl
movzx ecx, sil
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], eax
call fcn.140012d90
jmp 0x1400114e0
movzx eax, byte [rcx + 0x136]
mov r9, rdi
movzx r8d, word [rsp + 0xb8]
mov ecx, 0xffc3d44d
sub ecx, eax
movzx edx, sil
mov dword [rsp + 0x28], ecx
mov ecx, r13d
mov byte [rsp + 0x20], 1
call fcn.140011a90
sub rbp, 1
jne 0x1400113a0
movzx ebx, byte [rsp + 0xc8]
mov r13, qword [rsp + 0x80]
mov rbp, qword [rsp + 0xb0]
mov r14, qword [rsp + 0x78]
test r15b, r15b
mov r15, qword [rsp + 0x70]
mov r12, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x90]
jne 0x140011565
cmp dword [0x140104da4], 0
je 0x140011533
movzx eax, byte [0x1401071f5]
jmp 0x14001153a
xor ecx, ecx
call fcn.1400144d0
movzx ecx, al
xor cl, bl
and cl, al
and cl, 0xcc
je 0x140011565
not cl
mov dword [rsp + 0x28], 0xffc3d44d
and cl, al
mov byte [rsp + 0x20], 0
mov r9b, 1
mov r8, rdi
movzx edx, al
call fcn.140013dd0
add rsp, 0x98
pop rdi
pop rbx
ret
Function at 0x140011570
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push r14
sub rsp, 0x80
cmp dword [0x140104da4], 2
movzx r14d, r8b
mov ebx, edx
movzx esi, cx
sete bpl
test bpl, bpl
je 0x1400115cb
movzx ecx, cx
lea rdx, [rsp + 0x30]
test ecx, 0xffffff80
je 0x1400115b8
mov eax, gethostbyname
lea rdx, [rsp + 0x32]
mov word [rsp + 0x30], ax
mov r8d, 0xa
call fcn.1400a8f58
movzx esi, word [rsp + 0xa8]
test ebx, ebx
jle 0x14001174c
mov qword [rsp + 0xa0], rdi
mov rdi, rbx
mov qword [rsp + 0xb0], r15
xor r15d, r15d
nop dword [rax]
cmp dword [0x140104da4], r15d
jne 0x14001165a
call qword [sym.imp.KERNEL32.DLL_GetTickCount]
mov rcx, qword [0x1400fda58]
sub eax, dword [0x140106f5c]
cmp eax, dword [rcx + 0x118]
jbe 0x14001165a
xor r9d, r9d
mov dword [rsp + 0x20], r15d
xor r8d, r8d
lea rcx, [rsp + 0x50]
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x14001164e
mov edx, 1
mov dword [0x1400fda50], r15d
or ecx, 0xffffffff
call fcn.140001700
mov dword [0x1400fda50], 1
call qword [sym.imp.KERNEL32.DLL_GetTickCount]
mov dword [0x140106f5c], eax
test bpl, bpl
je 0x140011706
cmp dword [0x140104da4], r15d
je 0x140011675
movzx eax, byte [0x1401071f5]
jmp 0x14001167c
xor ecx, ecx
call fcn.1400144d0
movzx ecx, al
mov dword [rsp + 0x28], 0xffc3d44f
and cl, 0xc4
mov byte [rsp + 0x20], 1
or cl, 4
xor r9d, r9d
xor r8d, r8d
movzx edx, al
call fcn.140013dd0
movzx eax, word [rsp + 0x30]
lea rbx, [rsp + 0x30]
cmp ax, 0x30
jb 0x1400116e6
cmp ax, 0x39
ja 0x1400116e6
movzx edx, byte [rbx]
xor r8d, r8d
add dl, 0x30
mov dword [rsp + 0x28], 0xffc3d44d
xor r9d, r9d
mov byte [rsp + 0x20], r8b
lea ecx, [r8 + 2]
call fcn.140011a90
movzx eax, word [rbx + 2]
add rbx, 2
cmp ax, 0x30
jae 0x1400116b0
xor r8d, r8d
mov dword [rsp + 0x28], 0xffc3d44d
xor r9d, r9d
mov byte [rsp + 0x20], r8b
mov dl, reloc.OLEAUT32.dll_SafeArrayGetUBound
lea ecx, [r8 + 1]
call fcn.140011a90
jmp 0x140011712
movzx edx, r14b
movzx ecx, si
call fcn.14000fa40
cmp dword [0x140104da4], 2
mov rax, qword [0x1400fda58]
jne 0x14001172a
mov ecx, dword [rax + 0x80]
jmp 0x14001172d
mov ecx, dword [rax + 0x7c]
call fcn.140013930
sub rdi, 1
jne 0x1400115f0
mov r15, qword [rsp + 0xb0]
mov rdi, qword [rsp + 0xa0]
mov rbx, qword [rsp + 0xb8]
add rsp, 0x80
pop r14
pop rsi
pop rbp
ret
Function at 0x140013b40
Capabilities:
Get graphical window text

Disassembly:
sub rsp, 0x28
mov r10, qword [0x140101f08]
test r10, r10
je 0x140013c77
movsxd rax, dword [0x140101f68]
imul r9, rax, 0xd4
mov eax, 0x69
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x20], rdi
mov byte [r9 + r10 + 6], cl
mov byte [r9 + r10], dl
mov word [r9 + r10 + 2], r8w
mov word [r9 + r10 + 4], ax
call qword [sym.imp.KERNEL32.DLL_GetTickCount]
mov ecx, eax
mov dword [0x140101f24], eax
sub ecx, dword [0x140106348]
xorps xmm0, xmm0
mov dword [0x140106348], eax
cvtsi2ss xmm0, rcx
movsxd rcx, dword [0x140101f68]
imul rdx, rcx, 0xd4
divss xmm0, dword [0x1400eb898]
mov rcx, qword [0x140101f08]
movss dword [rdx + rcx + 8], xmm0
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor edi, edi
mov rbx, rax
test rax, rax
je 0x140013c31
cmp rax, qword [0x140101f60]
je 0x140013c15
movsxd rcx, dword [0x140101f68]
lea r8d, [rdi + 0x64]
imul rdx, rcx, 0xd4
mov rcx, qword [0x140101f08]
add rcx, 0xc
add rdx, rcx
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov edx, dword [0x140101f68]
jmp 0x140013c55
movsxd rdx, dword [0x140101f68]
mov rax, qword [0x140101f08]
imul rcx, rdx, 0xd4
mov word [rcx + rax + 0xc], di
jmp 0x140013c55
movsxd rdx, dword [0x140101f68]
movabs r8, 0x41002f004e
mov rax, qword [0x140101f08]
imul rcx, rdx, 0xd4
mov qword [rcx + rax + 0xc], r8
inc edx
mov qword [0x140101f60], rbx
cmp edx, dword [0x1400fda60]
mov rbx, qword [rsp + 0x30]
cmovge edx, edi
mov rdi, qword [rsp + 0x20]
mov dword [0x140101f68], edx
add rsp, 0x28
ret

Function at 0x140013c80
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
movzx edi, cl
mov esi, edx
mov ecx, edi
mov ebp, edi
call qword [sym.imp.USER32.dll_GetKeyState]
and al, 1
lea r8d, [rsi - 1]
neg al
sbb ebx, ebx
add ebx, 2
cmp r8d, 1
ja 0x140013dad
cmp ebx, esi
je 0x140013dad
mov ecx, edi
call qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
je 0x140013cf4
xor r8d, r8d
mov dword [rsp + 0x28], 0xffc3d44d
xor r9d, r9d
mov byte [rsp + 0x20], r8b
movzx edx, dil
lea ecx, [r8 + 1]
call fcn.140011a90
xor r8d, r8d
mov dword [rsp + 0x28], 0xffc3d44d
xor r9d, r9d
mov byte [rsp + 0x20], r8b
movzx edx, dil
lea ecx, [r8 + 2]
call fcn.140011a90
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp eax, dword [0x140106328]
sete bpl
test bpl, bpl
je 0x140013d55
mov edx, 1
mov dword [0x1400fda50], 0
or ecx, 0xffffffff
call fcn.140001700
mov dword [0x1400fda50], 1
cmp dil, 0x14
jne 0x140013dad
cmp esi, 2
jne 0x140013dad
lea ecx, [rsi + 0x12]
call qword [sym.imp.USER32.dll_GetKeyState]
test al, 1
je 0x140013dad
xor r8d, r8d
mov dword [rsp + 0x28], 0xffc3d44d
xor r9d, r9d
mov byte [rsp + 0x20], r8b
mov dl, reloc.OLEAUT32.dll_SafeArrayGetDim
mov ecx, esi
call fcn.140011a90
test bpl, bpl
je 0x140013dad
lea edx, [rsi - 1]
mov dword [0x1400fda50], 0
or ecx, 0xffffffff
call fcn.140001700
mov dword [0x1400fda50], 1
mov rbp, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x140014aa0
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x2c0
xor edx, edx
mov rbp, rcx
xor edi, edi
call qword [sym.imp.USER32.dll_ActivateKeyboardLayout]
mov rsi, rax
test rax, rax
je 0x140014c3c
movaps xmm0, xmmword [str.SYSTEMCurrentControlSetControlKeyboard_Layouts_]
lea rcx, [rsp + 0x94]
movaps xmm1, xmmword [0x1400e0ff0]
mov eax, dword [0x1400e1040]
movaps xmmword [rsp + 0x30], xmm0
movaps xmm0, xmmword [0x1400e1000]
movaps xmmword [rsp + 0x40], xmm1
movaps xmm1, xmmword [0x1400e1010]
movaps xmmword [rsp + 0x50], xmm0
movaps xmm0, xmmword [0x1400e1020]
movaps xmmword [rsp + 0x60], xmm1
movaps xmm1, xmmword [0x1400e1030]
mov dword [rsp + 0x90], eax
movzx eax, word [0x1400e1044]
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x80], xmm1
mov word [rsp + 0x94], ax
call qword [sym.imp.USER32.dll_GetKeyboardLayoutNameW]
test eax, eax
je 0x140014c2c
lea rax, [rsp + 0x2f0]
xor r8d, r8d
lea r9d, [rdi + 1]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x30]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140014c2c
mov rcx, qword [rsp + 0x2f0]
lea rax, [rsp + 0x2e8]
mov qword [rsp + 0x28], rax
lea rdx, str.Layout_File
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x2e0], rbx
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x2e8], 0x208
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x2f0]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
mov rbx, qword [rsp + 0x2e0]
jne 0x140014c2c
mov ecx, dword [rsp + 0x2e8]
test ecx, ecx
je 0x140014c2c
shr ecx, 1
dec ecx
cmp word [rsp + rcx*2 + 0xb0], di
jne 0x140014c05
test ecx, ecx
je 0x140014c2c
lea edx, [rcx - 1]
cmp word [rsp + rdx*2 + 0xb0], di
jne 0x140014c17
mov ecx, edx
test edx, edx
jne 0x140014bf0
jmp 0x140014c2c
inc ecx
cmp ecx, 0x104
jae 0x140014c2c
mov word [rsp + rcx*2 + 0xb0], di
test ecx, ecx
je 0x140014c2c
lea rcx, [rsp + 0xb0]
call qword [sym.imp.KERNEL32.DLL_LoadLibraryW]
mov rdi, rax
cmp rbp, rsi
je 0x140014c3c
xor edx, edx
mov rcx, rsi
call qword [sym.imp.USER32.dll_ActivateKeyboardLayout]
mov rax, rdi
add rsp, 0x2c0
pop rdi
pop rsi
pop rbp
ret
Function at 0x140015e60
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [0x140104e54], 0
lea rbx, [0x140107240]
jne 0x140015ebf
call qword [sym.imp.KERNEL32.DLL_GetTickCount]
mov dword [0x140107240], eax
mov edx, 1
lea r8, [0x140107244]
nop
mov ecx, dword [r8 - 4]
lea r8, [r8 + 4]
shr ecx, 0x1e
xor ecx, dword [r8 - 8]
imul eax, ecx, 0x6c078965
add eax, edx
inc edx
mov dword [r8 - 4], eax
cmp edx, 0x270
jl 0x140015e90
mov dword [0x140104e54], 1
mov dword [0x1400ff3f4], 0x270
mov r8d, 0xe3
mov qword [0x140107238], rbx
nop word [rax + rax]
mov eax, dword [rbx + 4]
mov ecx, eax
xor ecx, dword [rbx]
and al, 1
and ecx, 0x7ffffffe
xor ecx, dword [rbx]
shr ecx, 1
neg al
sbb eax, eax
and eax, 0x9908b0df
xor ecx, eax
xor ecx, dword [rbx + 0x634]
mov dword [rbx], ecx
add rbx, 4
sub r8d, 1
jne 0x140015ee0
mov r8d, 0x18c
nop word [rax + rax]
mov eax, dword [rbx + 4]
lea rdx, [rbx + 4]
mov ecx, eax
and al, 1
xor ecx, dword [rbx]
and ecx, 0x7ffffffe
xor ecx, dword [rbx]
shr ecx, 1
neg al
sbb eax, eax
and eax, 0x9908b0df
xor ecx, eax
xor ecx, dword [rbx - 0x38c]
mov dword [rbx], ecx
lea rbx, [rdx]
sub r8d, 1
jne 0x140015f20
mov eax, dword [0x140107240]
mov ecx, dword [rdx]
xor ecx, eax
and al, 1
and ecx, 0x7ffffffe
xor ecx, dword [rdx]
shr ecx, 1
neg al
sbb eax, eax
and eax, 0x9908b0df
xor ecx, eax
xor ecx, dword [rdx - 0x38c]
mov dword [rdx], ecx
add rsp, 0x20
pop rbx
ret
Function at 0x140033140
Capabilities:
Check http status code

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [0x1400fda58]
mov rbx, rcx
mov qword [0x140106a48], rcx
cmp byte [rax + 0x139], 0
je 0x1400331a7
movsxd rax, dword [0x140104e5c]
mov qword [rsp + 0x30], rdi
lea rdi, [0x140000000]
mov qword [rdi + rax*8 + 0x1054b0], rcx
call qword [sym.imp.KERNEL32.DLL_GetTickCount]
movsxd rdx, dword [0x140104e5c]
mov dword [rdi + rdx*4 + 0x104e70], eax
inc edx
mov rdi, qword [rsp + 0x30]
xor eax, eax
cmp edx, 0x190
cmovge edx, eax
mov dword [0x140104e5c], edx
xor r9d, r9d
or r8, 0xffffffffffffffff
xor edx, edx
mov rcx, rbx
call fcn.140069a70
cmp eax, 1
jne 0x1400331ca
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.140030a10
add rsp, 0x20
pop rbx
ret
Function at 0x140035a20
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
lea r8, str.Script_lines_most_recently_executed__oldest_first_.__Press__F5__to_refresh.__The_seconds_elapsed_between_a_line_and_the_one_after_it_is_in_parentheses_to_the_right__if_not_0_.__The_bottommost_lines_elapsed_time_is_the_number_of_seconds_since_it_executed._r_n_r_n
mov qword [rsp + 0x70], rcx
mov edx, 0xfffe
mov r14, rcx
call fcn.140089190
mov r8d, dword [0x140104e5c]
lea r9, [0x140000000]
movsxd rdx, eax
mov ebp, 0x190
mov edi, r8d
lea rax, [r14 + rdx*2]
mov qword [rsp + 0x80], rax
xor r15b, r15b
mov r13, rax
test ebp, ebp
jle 0x140035b9c
movsxd rbx, edi
mov esi, 2
mov r12d, ebp
nop dword [rax + rax]
cmp edi, 0x190
jl 0x140035aa5
sub edi, 0x190
sub rbx, 0x190
cmp qword [r9 + rbx*8 + 0x1054b0], 0
je 0x140035b7f
movzx r14d, r15b
lea eax, [rsi - 1]
xor r15b, r15b
cmp eax, ebp
jge 0x140035bd1
test r14b, r14b
jne 0x140035b7f
mov edx, dword [r9 + rbx*4 + 0x104e70]
lea rax, [rbx + 1]
xor ecx, ecx
cmp edi, 0x18f
cmovl rcx, rax
mov eax, dword [r9 + rcx*4 + 0x104e70]
sub eax, edx
cmp eax, 0x7fffffff
jbe 0x140035b31
mov r15b, 1
cmp esi, ebp
jne 0x140035b15
call qword [sym.imp.KERNEL32.DLL_GetTickCount]
lea rcx, [0x140000000]
sub eax, dword [rcx + rbx*4 + 0x104e70]
jmp 0x140035b38
lea rax, [rbx + 2]
cmp rax, 0x190
jl 0x140035b27
add rax, 0xfffffffffffffe70
mov eax, dword [r9 + rax*4 + 0x104e70]
sub eax, edx
lea rcx, [0x140000000]
mov rcx, qword [rcx + rbx*8 + 0x1054b0]
mov r9d, 0xfffe
mov r8, r13
mov byte [rsp + 0x28], r14b
sub r8, qword [rsp + 0x70]
mov rdx, r13
sar r8, 1
sub r9d, r8d
mov dword [rsp + 0x20], eax
mov r8d, 0xc8
cmp r9d, r8d
cmovl r8d, r9d
mov r9b, 1
call fcn.140035d60
mov r13, rax
lea r9, [0x140000000]
inc esi
inc edi
inc rbx
sub r12, 1
jne 0x140035a90
mov r8d, dword [0x140104e5c]
mov r14, qword [rsp + 0x70]
mov rax, r13
mov edx, 0xfffe
sub rax, r14
sar rax, 1
sub edx, eax
cmp edx, 0x18
jg 0x140035bea
cmp ebp, 0x78
jl 0x140035bea
mov rax, qword [rsp + 0x80]
sub ebp, 0x64
mov edi, r8d
sub edi, ebp
add edi, 0x190
jmp 0x140035a72
call qword [sym.imp.KERNEL32.DLL_GetTickCount]
lea rcx, [0x140000000]
sub eax, dword [rcx + rbx*4 + 0x104e70]
jmp 0x140035b38
lea r8, str._r_nPress__F5__to_refresh.
mov rcx, r13
call fcn.140089190
mov rbx, qword [rsp + 0x78]
movsxd rcx, eax
lea rax, [rcx*2]
add rax, r13
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140037350
Capabilities:
Print debug messages

Disassembly:
test edx, edx
je 0x140037499
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
mov eax, 0x4030
call fcn.1400be2f0
sub rsp, rax
mov qword [rsp + 0x4050], rbx
mov rbp, r9
mov rbx, qword [rsp + 0x4070]
mov r14, r8
mov qword [rsp + 0x4058], r15
mov esi, edx
mov rdi, rcx
test rbx, rbx
jne 0x1400373b1
mov rbx, qword [rcx + 0x698]
test rbx, rbx
jne 0x1400373b1
mov ecx, dword [rcx + 0x2c0]
movzx eax, word [rdi + 0x2c4]
jmp 0x1400373b9
movzx ecx, word [rbx + 2]
movzx eax, word [rbx + 4]
movsxd r9, ecx
lea r8, str._s___d__:___Warning:__s_n
lea rcx, [0x1401061d0]
movzx eax, ax
mov r15d, 0x2000
mov qword [rsp + 0x28], r14
mov edx, r15d
mov dword [rsp + 0x20], eax
mov r9, qword [rcx + r9*8]
lea rcx, [rsp + 0x30]
call fcn.140089190
cmp word [rbp], 0
movsxd rcx, eax
je 0x140037415
sub r15d, ecx
lea rax, [rsp + 0x30]
lea rcx, [rax + rcx*2]
mov edx, r15d
mov r9, rbp
lea r8, str._____Specifically:__s_n
call fcn.140089190
mov r15, qword [rsp + 0x4058]
cmp esi, 3
jne 0x140037439
lea ecx, [rsi - 2]
call fcn.1400ab5c0
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.1400b12cc
jmp 0x14003747e
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.DLL_OutputDebugStringW]
cmp esi, 2
jne 0x14003747e
test rbx, rbx
jne 0x14003746a
mov rbx, qword [rdi + 0x698]
test rbx, rbx
jne 0x14003746a
mov r8, rbp
mov rdx, r14
mov rcx, rdi
call fcn.140036a60
jmp 0x14003747e
mov r9, rbp
mov r8d, 1
mov rdx, r14
mov rcx, rbx
call fcn.1400366e0
mov rbx, qword [rsp + 0x4050]
mov rbp, qword [rsp + 0x4060]
add rsp, 0x4030
pop r14
pop rdi
pop rsi
ret
Function at 0x14003f470
Capabilities:
Log keystrokes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rax, qword [rsp + 0x68]
mov r10, r9
mov r9, qword [rsp + 0x60]
mov r11, r8
mov rbx, rdx
mov qword [rsp + 0x20], rax
mov r8, r10
mov rdx, r11
mov rsi, rcx
call fcn.14004eaa0
mov rdi, rax
test rax, rax
je 0x14003f572
mov rdx, rbx
mov rcx, rax
call fcn.14008e630
mov rbp, rax
test rax, rax
je 0x14003f572
xor edx, edx
mov rcx, rdi
xor sil, sil
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ebx, eax
test eax, eax
je 0x14003f50f
cmp eax, dword [0x140106328]
je 0x14003f50f
mov rcx, rdi
call fcn.14008ec50
test al, al
jne 0x14003f50f
mov ecx, dword [0x140106328]
mov r8d, 1
mov edx, ebx
call qword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
setne sil
mov rcx, rbp
call qword [sym.imp.USER32.dll_SetFocus]
test rax, rax
je 0x14003f555
mov rcx, qword [0x140101ed0]
lea rdx, [0x1400cd074]
xor r9d, r9d
mov byte [rsp + 0x20], 1
or r8, 0xffffffffffffffff
call fcn.14008c660
mov rax, qword [0x1400fda58]
mov ecx, dword [rax + 0x78]
cmp ecx, 0xffffffff
jle 0x14003f555
mov edx, 1
call fcn.140001700
test sil, sil
je 0x14003f56b
mov ecx, dword [0x140106328]
xor r8d, r8d
mov edx, ebx
call qword [sym.imp.USER32.dll_AttachThreadInput]
mov eax, 1
jmp 0x14003f5b5
mov rax, qword [0x1400fda58]
lea rdx, [0x1400e07c8]
cmp byte [rax + 0x150], 0
jne 0x14003f5a3
mov rcx, qword [0x140101ed0]
xor r9d, r9d
or r8, 0xffffffffffffffff
mov byte [rsp + 0x20], 1
call fcn.14008c660
jmp 0x14003f5b5
lea r9, [0x1400ccf5c]
xor r8d, r8d
mov rcx, rsi
call fcn.140036400
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x1400401b0
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rax, qword [rsp + 0x68]
mov r10, r9
mov r9, qword [rsp + 0x60]
mov r11, r8
mov rbx, rdx
mov qword [rsp + 0x20], rax
mov r8, r10
mov rdx, r11
call fcn.14004eaa0
test rax, rax
je 0x1400401f6
lea rdx, str.msctls_statusbar321
mov rcx, rax
call fcn.14008e630
mov rdi, rax
jmp 0x1400401f8
xor edi, edi
mov rcx, rbx
call fcn.14000f750
mov rcx, rbx
test al, al
je 0x140040214
xor edx, edx
lea r8d, [rdx + 0x10]
call fcn.1400ad12c
jmp 0x140040219
call fcn.1400acc28
mov rcx, qword [0x140106130]
lea r9, [0x1400ccf5c]
mov dword [rsp + 0x68], gethostname
mov r8d, eax
mov rdx, rdi
mov dword [rsp + 0x60], 0xffffffff
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp fcn.14008e2c0
Function at 0x140042640
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
mov eax, 0x10030
call fcn.1400be2f0
sub rsp, rax
mov rbx, qword [0x140106130]
mov rbp, rdx
mov rcx, rbp
lea rdx, [rsp + 0x30]
mov r8d, 0x7fff
call qword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableW]
mov esi, eax
mov byte [rsp + 0x20], 1
cmp eax, 0x7fff
jb 0x1400427b3
lea r8d, [rsi - 1]
mov r9b, 1
xor edx, edx
mov rcx, rbx
call fcn.14008c660
test eax, eax
je 0x1400427d3
cmp byte [rbx + 0x23], 0
mov qword [rsp + 0x10040], rdi
jne 0x1400426b5
mov rdi, qword [rbx + 0x10]
jmp 0x1400426b8
mov rdi, rbx
test byte [rdi + 0x21], 8
je 0x1400426c6
mov rcx, rdi
call fcn.140001340
movzx eax, byte [rdi + 0x23]
cmp al, 1
jne 0x1400426e2
test byte [rdi + 0x21], 4
je 0x1400426dc
mov rdx, rdi
call fcn.1400374a0
mov rcx, qword [rdi + 8]
jmp 0x140042747
cmp al, 2
jne 0x140042740
mov rcx, qword [0x140106ff8]
test rcx, rcx
jne 0x140042747
mov ecx, SafeArrayGetElemsize
call qword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
jne 0x140042720
lea ecx, [rax + 0xf]
call qword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
lea rdx, [0x1400ccf50]
lea rcx, [0x1400ccf5c]
cmovne rcx, rdx
jmp 0x140042747
xor edx, edx
call fcn.140004b80
mov edx, 0xffffffff
lea rcx, [0x1400ccf5c]
cmp rax, rdx
cmovne rcx, qword [0x140106ff0]
jmp 0x140042747
lea rcx, [0x1401062b4]
mov rdx, rcx
mov r8d, esi
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableW]
mov edi, 1
test eax, eax
jne 0x140042771
xor r8d, r8d
mov edx, edi
mov rcx, rbx
call fcn.140001470
xor ecx, ecx
mov word [rax], cx
cmp byte [rbx + 0x23], 0
jne 0x14004277b
mov rbx, qword [rbx + 0x10]
cmp byte [rbx + 0x23], 2
jne 0x1400427a3
cmp qword [0x140106ff8], 0
je 0x1400427a3
lea rcx, [0x140106fe0]
call fcn.140004f50
mov edi, eax
mov rdi, qword [rsp + 0x10040]
jmp 0x1400427d3
and byte [rbx + 0x21], 0x86
mov eax, edi
mov rdi, qword [rsp + 0x10040]
jmp 0x1400427d3
test eax, eax
lea rcx, [0x1400ccf5c]
lea rdx, [rsp + 0x30]
mov r8, rsi
cmove rdx, rcx
xor r9d, r9d
mov rcx, rbx
call fcn.14008c660
lea r11, [rsp + 0x10030]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsp, r11
pop rsi
ret
Function at 0x1400452d0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
mov eax, 0x2260
call fcn.1400be2f0
sub rsp, rax
mov r9, qword [0x140106f30]
lea r8, str.__s_s
movzx ebp, dl
mov qword [rsp + 0x20], rcx
mov rdi, rcx
lea r14, [rsp + 0x260]
mov edx, 0x800
lea rcx, [rsp + 0x260]
lea r15, [0x1400ccf5c]
call fcn.140089190
movsxd rbx, eax
lea esi, [rbx + 1]
cmp esi, 0x800
jg 0x140045355
lea rcx, [rsp + 0x262]
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140045355
mov r9, qword [0x140106f30]
jmp 0x1400453b8
lea rcx, [rsp + 0x50]
call fcn.140045a00
test eax, eax
je 0x14004547a
lea r9, [rsp + 0x50]
mov qword [rsp + 0x20], rdi
lea r8, str.__s_s
mov edx, 0x800
lea rcx, [rsp + 0x260]
call fcn.140089190
movsxd rbx, eax
lea esi, [rbx + 1]
cmp esi, 0x800
jg 0x14004547a
lea rcx, [rsp + 0x262]
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14004547a
lea r9, [rsp + 0x50]
mov edi, SafeArrayAllocDescriptor
movsxd rax, esi
mov word [rsp + rbx*2 + 0x260], di
xor ebx, ebx
mov word [rsp + rax*2 + 0x260], bx
test bpl, bpl
je 0x140045440
lea rax, [0x1400e72e8]
mov edx, 0x800
lea r8, str.__s_s
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x1260]
call fcn.140089190
movsxd rsi, eax
lea ebp, [rsi + 1]
cmp ebp, 0x800
jg 0x140045440
lea rcx, [rsp + 0x1262]
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140045440
movsxd rax, ebp
lea r14, [rsp + 0x1260]
mov word [rsp + rsi*2 + 0x1260], di
lea r15, [rsp + 0x260]
mov word [rsp + rax*2 + 0x1260], bx
mov qword [rsp + 0x48], rbx
lea rcx, [0x1401063b0]
mov byte [rsp + 0x40], 0
xor r9d, r9d
mov byte [rsp + 0x38], 0
mov r8, r15
mov qword [rsp + 0x30], rbx
mov rdx, r14
mov qword [rsp + 0x28], rbx
mov byte [rsp + 0x20], 0
call fcn.140037d00
test eax, eax
setne al
jmp 0x14004547c
xor al, al
lea r11, [rsp + 0x2260]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret