joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140051e90
Capabilities:
Find taskbar
Get keyboard layout

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rdi
sub rsp, 0x140
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rbx, rcx
mov dword [rcx + 8], 2
lea rax, vtable.CPluginAction.0
mov qword [rcx], rax
add rcx, 0x68
mov edx, 0x200
call fcn.14005f420
nop
mov dword [rbx + 0xa4], 4
call fcn.140004fc0
mov rdx, rax
xor esi, esi
mov ecx, esi
test rax, rax
setne cl
test ecx, ecx
jne 0x140051efe
mov ecx, 0x80004005
call fcn.140004f70
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbx + 0xc0], rax
lea rax, vtable.CSynList_class_CPluginAction::CActionTracker_.0
mov qword [rbx + 0xc8], rax
lea rcx, [rbx + 0xe8]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [rbx + 0xe4], 1
mov qword [rbx + 0xd0], rsi
mov qword [rbx + 0xd8], rsi
mov dword [rbx + 0xe0], esi
lea rax, vtable.CPluginAction::CActionTrackerList.0
mov qword [rbx + 0xc8], rax
lea rcx, [rbx + 0x110]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
nop
lea rcx, [rbx + 0x138]
call fcn.140041a90
nop
xor edx, edx
lea rcx, str.Shell_TrayWnd
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
je 0x140052010
mov edx, 5
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindow]
mov qword [rbx + 0x18], rax
mov r8d, 0x80
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetClassNameW]
mov rax, rsi
lea rdx, [rsp + 0x40]
lea r8, str.Button
movzx ecx, word [rdx + rax*2]
inc rax
cmp cx, word [r8 + rax*2 - 2]
jne 0x140051fdc
cmp rax, 7
jne 0x140051fc1
cmp cx, word [r8 + rax*2 - 2]
mov eax, esi
sete al
test eax, eax
jne 0x140051fe9
mov qword [rbx + 0x18], rsi
test byte [0x1402d741c], 4
je 0x140052014
mov r9, qword [rbx + 0x18]
lea r8, str.m_hwndStartButton0x_08X_n
mov edx, 3
lea rcx, str.CPluginAction::CPluginAction
call fcn.14011a490
jmp 0x140052014
mov qword [rbx + 0x18], rsi
mov qword [rbx + 0x20], rsi
mov qword [rbx + 0x28], rsi
mov qword [rbx + 0x30], rsi
mov qword [rbx + 0x10], rsi
mov rcx, rbx
call fcn.140059420
mov qword [rbx + 0x60], rsi
mov dword [rbx + 0x50], 0x4b
mov dword [rbx + 0x4c], 0x1f4
mov dword [rbx + 0x54], esi
mov qword [rbx + 0x38], rsi
mov qword [rbx + 0x44], rsi
mov qword [rbx + 0x78], rsi
mov qword [rbx + 0x90], rsi
mov dword [rbx + 0x40], esi
mov dword [rbx + 0x98], 0x3e89374c
mov dword [rbx + 0xa0], reloc.OLEAUT32.dll_VariantTimeToDosDateTime
mov qword [rbx + 0xb0], rsi
mov qword [rbx + 0xb8], rsi
mov qword [rbx + 0x58], rsi
xor r8d, r8d
mov dword [rsp + 0x20], esi
xor r9d, r9d
mov edx, 0x53e
lea rcx, [rsp + 0x158]
call fcn.1400dc6c0
nop
mov rdx, rax
lea rcx, [rbx + 0xc0]
call fcn.140010dc0
nop
mov rdx, qword [rsp + 0x158]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x1400520c6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
mov qword [rbx + 0xa8], rax
mov rax, rbx
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14005edb0
Capabilities:
Get keyboard layout

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
push rdi
sub rsp, 0x70
xor eax, eax
mov ebx, edx
mov rsi, rcx
mov qword [r11 - 0x58], rax
mov qword [r11 - 0x50], rax
mov qword [r11 - 0x48], rax
mov qword [r11 - 0x40], rax
mov qword [r11 - 0x38], rax
mov qword [r11 - 0x30], rax
mov qword [r11 - 0x28], rax
mov qword [r11 - 0x20], rax
mov qword [r11 - 0x18], rax
lea rdx, [r11 - 0x58]
xor ecx, ecx
mov dword [rsp + 0x20], 0x48
call qword [sym.imp.USER32.dll_GetGUIThreadInfo]
mov rcx, qword [rsp + 0x28]
xor edx, edx
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ecx, eax
mov ebp, eax
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
mov rdi, rax
test ebx, ebx
je 0x14005ee64
mov rcx, rax
call sub.IMM32.dll_ImmIsIME
test eax, eax
je 0x14005ee93
lea rcx, str.00000409
mov edx, 1
call qword [sym.imp.USER32.dll_LoadKeyboardLayoutW]
test rax, rax
je 0x14005ee93
mov rcx, qword [rsp + 0x28]
mov edx, 0x50
mov r9, rax
lea r8d, [rdx - 0x4f]
call qword [sym.imp.USER32.dll_SendMessageW]
mov qword [rsi + 0xa8], rdi
jmp 0x14005ee93
mov r9, qword [rsi + 0xa8]
cmp rax, r9
je 0x14005ee93
mov rcx, qword [rsp + 0x28]
mov edx, 0x50
lea r8d, [rdx - 0x4f]
call qword [sym.imp.USER32.dll_SendMessageW]
mov ecx, ebp
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
mov qword [rsi + 0xa8], rax
lea r11, [rsp + 0x70]
mov eax, 1
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x14005eff0
Capabilities:
Get graphical window text

Disassembly:
sub rsp, 0x428
call qword [sym.imp.USER32.dll_GetForegroundWindow]
test rax, rax
je 0x14005f112
lea rdx, [rsp + 0x20]
mov r8d, 0x200
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
je 0x14005f112
lea rdx, str.Netscape
lea rcx, [rsp + 0x20]
call fcn.140122ad0
test rax, rax
je 0x14005f045
mov eax, 1
add rsp, 0x428
ret
lea rdx, str.Internet_Explorer
lea rcx, [rsp + 0x20]
call fcn.140122ad0
test rax, rax
jne 0x14005f038
lea rdx, str.Mozilla
lea rcx, [rsp + 0x20]
call fcn.140122ad0
test rax, rax
jne 0x14005f038
lea rdx, str.Opera
lea rcx, [rsp + 0x20]
call fcn.140122ad0
test rax, rax
jne 0x14005f038
lea rdx, str.Google_Chrome
lea rcx, [rsp + 0x20]
call fcn.140122ad0
test rax, rax
jne 0x14005f038
lea rdx, str.Microsoft_Edge
lea rcx, [rsp + 0x20]
call fcn.140122ad0
test rax, rax
jne 0x14005f038
call fcn.140114a30
test rax, rax
je 0x14005f112
lea rdx, [rsp + 0x20]
mov r8d, 0x200
mov rcx, rax
call qword [sym.imp.USER32.dll_GetClassNameW]
test eax, eax
je 0x14005f112
lea rdx, str.Internet_Explorer
lea rcx, [rsp + 0x20]
call fcn.140122ad0
test rax, rax
jne 0x14005f038
lea rdx, str.Mozilla
lea rcx, [rsp + 0x20]
call fcn.140122ad0
xor ecx, ecx
test rax, rax
setne cl
mov eax, ecx
add rsp, 0x428
ret
xor eax, eax
add rsp, 0x428
ret
Function at 0x140061ef0
Capabilities:
Log keystrokes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ebx, edx
xor edx, edx
xor edi, edi
mov ecx, ebx
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov ecx, eax
test eax, eax
je 0x140061f4a
cmp ebx, 0xa3
je 0x140061f33
cmp ebx, 0xa5
je 0x140061f33
cmp ebx, 0x2e
ja 0x140061f38
movabs rdx, 0x61fe00000000
bt rdx, rbx
jae 0x140061f38
mov edi, 0x1000000
shl ecx, 0x10
or ecx, edi
mov eax, ecx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov eax, edi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140062800
Capabilities:
Get graphical window text

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x110
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rsi, rcx
mov edx, 0x414
mov rcx, qword [rcx + 0x10]
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
mov r8d, 0x40
lea rdx, [rsp + 0x80]
call qword [sym.imp.USER32.dll_GetWindowTextW]
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x30]
call fcn.140062bd0
nop
mov edx, dword [rsi + 0x28f0]
test edx, edx
jne 0x140062898
lea rcx, [rsp + 0x30]
mov r9, qword [rsp + 0x30]
mov r8, qword [rsp + 0x48]
cmp r8, 8
cmovae rcx, r9
lea rdx, [rsi + 0x28f4]
movzx eax, word [rcx]
mov word [rdx], ax
lea rcx, [rcx + 2]
lea rdx, [rdx + 2]
test ax, ax
jne 0x140062880
jmp 0x140062963
xor r8d, r8d
mov dword [rsp + 0x20], r8d
mov r9, qword [rsi + 8]
lea rcx, [rsp + 0x120]
call fcn.1400dc6c0
mov rbx, qword [rax]
mov rdx, qword [rsp + 0x120]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x1400628d0
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdi, [rsi + 0x28f4]
mov rdx, rdi
lea rcx, [rsp + 0x58]
call fcn.140048ea0
mov rdx, rax
cmp qword [rax + 0x18], 8
jb 0x1400628f1
mov rdx, qword [rax]
sub rdx, rbx
movzx ecx, word [rbx]
movzx eax, word [rbx + rdx]
sub ecx, eax
jne 0x140062907
add rbx, 2
test eax, eax
jne 0x1400628f4
test ecx, ecx
setne bl
cmp qword [rsp + 0x70], 8
jb 0x14006291e
mov rcx, qword [rsp + 0x58]
call fcn.14011f898
mov r9, qword [rsp + 0x30]
mov r8, qword [rsp + 0x48]
test bl, bl
je 0x140062963
mov dword [rsi + 0x28f0], 0
lea rcx, [rsp + 0x30]
cmp r8, 8
cmovae rcx, r9
nop dword [rax]
nop word [rax + rax]
movzx eax, word [rcx]
mov word [rdi], ax
lea rcx, [rcx + 2]
lea rdi, [rdi + 2]
test ax, ax
jne 0x140062950
cmp r8, 8
jb 0x140062971
mov rcx, r9
call fcn.14011f898
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140062990
Capabilities:
Get graphical window text

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x110
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rsi, rcx
mov edx, 0x414
mov rcx, qword [rcx + 0x10]
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
mov r8d, 0x40
lea rdx, [rsp + 0x80]
call qword [sym.imp.USER32.dll_GetWindowTextW]
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x30]
call fcn.140062bd0
nop
mov edx, dword [rsi + 0x28f0]
test edx, edx
jne 0x140062a28
lea rcx, [rsp + 0x30]
mov r9, qword [rsp + 0x30]
mov r8, qword [rsp + 0x48]
cmp r8, 8
cmovae rcx, r9
lea rdx, [rsi + 0x28f4]
movzx eax, word [rcx]
mov word [rdx], ax
lea rcx, [rcx + 2]
lea rdx, [rdx + 2]
test ax, ax
jne 0x140062a10
jmp 0x140062af3
xor r8d, r8d
mov dword [rsp + 0x20], r8d
mov r9, qword [rsi + 8]
lea rcx, [rsp + 0x120]
call fcn.1400dc6c0
mov rbx, qword [rax]
mov rdx, qword [rsp + 0x120]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140062a60
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdi, [rsi + 0x28f4]
mov rdx, rdi
lea rcx, [rsp + 0x58]
call fcn.140048ea0
mov rdx, rax
cmp qword [rax + 0x18], 8
jb 0x140062a81
mov rdx, qword [rax]
sub rdx, rbx
movzx ecx, word [rbx]
movzx eax, word [rbx + rdx]
sub ecx, eax
jne 0x140062a97
add rbx, 2
test eax, eax
jne 0x140062a84
test ecx, ecx
setne bl
cmp qword [rsp + 0x70], 8
jb 0x140062aae
mov rcx, qword [rsp + 0x58]
call fcn.14011f898
mov r9, qword [rsp + 0x30]
mov r8, qword [rsp + 0x48]
test bl, bl
je 0x140062af3
mov dword [rsi + 0x28f0], 0
lea rcx, [rsp + 0x30]
cmp r8, 8
cmovae rcx, r9
nop dword [rax]
nop word [rax + rax]
movzx eax, word [rcx]
mov word [rdi], ax
lea rcx, [rcx + 2]
lea rdi, [rdi + 2]
test ax, ax
jne 0x140062ae0
cmp r8, 8
jb 0x140062b01
mov rcx, r9
call fcn.14011f898
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x14006f9b0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov rbx, rcx
mov rcx, qword [r9]
xor esi, esi
mov r14, r9
mov ebp, r8d
mov rdi, rdx
test rcx, rcx
je 0x14006fa12
mov rax, qword [rcx]
lea r8, [rsp + 0x58]
mov edx, 0x10000302
call qword [rax + 0x18]
cmp dword [rsp + 0x58], esi
je 0x14006fa12
mov rcx, qword [r14]
test rcx, rcx
je 0x14006fa0a
mov rax, qword [rcx]
lea r8, [rsp + 0x58]
mov edx, 0x10000313
call qword [rax + 0x18]
mov esi, dword [rsp + 0x58]
shr esi, 0x16
and esi, 1
jmp 0x14006fa2c
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x8000
test cx, ax
je 0x14006fa2c
mov esi, 1
test rdi, rdi
je 0x14006fbbd
cmp dword [rbx + 0x90], 0
je 0x14006fbbd
mov eax, dword [rbx + 0x54]
test al, al
js 0x14006fbbd
bt eax, 0xe
jb 0x14006fbbd
mov rcx, rdi
call fcn.1400d3280
test eax, eax
je 0x14006fbbd
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call fcn.1400d26a0
bt eax, 0xa
jb 0x14006fbbd
test ebp, ebp
je 0x14006fbbd
test esi, esi
je 0x14006fb20
cmp dword [rbx + 0xe4], 0
jne 0x14006fbbd
lea rcx, [0x1402dd4a8]
mov r8d, 1
mov rdx, rdi
call fcn.14000e3d0
mov ecx, dword [rbx + 0x10]
lea eax, [rcx - 1]
test eax, 0xfffffffa
jne 0x14006fbbd
cmp ecx, 2
je 0x14006fbbd
mov rcx, rdi
call fcn.140005df0
mov rdx, qword [rax + 0xf88]
mov rax, qword [rdx]
cmp rax, rdx
je 0x14006faf3
test byte [rax + 0x10], 0x10
jne 0x14006fbbd
mov rax, qword [rax]
cmp rax, rdx
jne 0x14006fae1
mov r8d, dword [rbx + 0x54]
lea rcx, [0x1402dd4a8]
mov r9d, 6
mov rdx, rdi
mov qword [rsp + 0x20], rdi
call fcn.14000dfb0
mov dword [rbx + 0xe4], 1
jmp 0x14006fbbd
cmp dword [rbx + 0xe4], 0
je 0x14006fbbd
lea rcx, [0x1402dd4a8]
mov r8d, 1
mov rdx, rdi
call fcn.14000e3d0
mov eax, dword [rbx + 0x10]
cmp eax, 1
jne 0x14006fb9a
mov rcx, rdi
call fcn.1400d2e60
mov rcx, rdi
mov esi, eax
call fcn.140005df0
mov rdx, qword [rax + 0xf88]
mov rcx, qword [rdx]
cmp rcx, rdx
je 0x14006fb7d
nop dword [rax + rax]
test dword [rcx + 0x10], esi
jne 0x14006fbbd
mov rcx, qword [rcx]
cmp rcx, rdx
jne 0x14006fb70
mov r8d, dword [rbx + 0x54]
lea rcx, [0x1402dd4a8]
xor r9d, r9d
mov rdx, rdi
mov qword [rsp + 0x20], rdi
call fcn.14000dfb0
jmp 0x14006fbb3
add eax, 0xfffffffb
cmp eax, 1
ja 0x14006fbbd
mov r9d, ebp
mov r8, r14
mov rdx, rdi
mov rcx, rbx
call fcn.14006fdd0
mov dword [rbx + 0xe4], 0
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x1400774f0
Capabilities:
Find taskbar

Disassembly:
push rdi
sub rsp, 0x70
mov rdi, rcx
mov rcx, qword [rcx + 0x9f8]
test rcx, rcx
je 0x1400775f8
lea rdx, [rsp + 0x60]
call qword [sym.imp.USER32.dll_GetWindowRect]
lea rcx, [rdi + 0x1800]
call qword [sym.imp.USER32.dll_IsRectEmpty]
test eax, eax
je 0x1400775f8
mov ecx, 0x4f
mov qword [rsp + 0x80], rbx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
xor edx, edx
lea r8, [rsp + 0x40]
lea ecx, [rdx + 0x30]
xor r9d, r9d
mov ebx, eax
call qword [sym.imp.USER32.dll_SystemParametersInfoW]
mov ecx, dword [rsp + 0x4c]
mov r9d, dword [rsp + 0x44]
sub ecx, r9d
cmp ebx, ecx
mov rbx, qword [rsp + 0x80]
jne 0x1400775b7
lea rcx, str.Shell_TrayWnd
xor edx, edx
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
je 0x1400775b2
lea rdx, [rsp + 0x50]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowRect]
mov ecx, dword [rsp + 0x54]
mov r9d, dword [rsp + 0x44]
test ecx, ecx
jns 0x1400775a8
mov eax, dword [rsp + 0x5c]
sub eax, ecx
add r9d, eax
mov dword [rsp + 0x44], r9d
jmp 0x1400775b7
sub ecx, dword [rsp + 0x5c]
add dword [rsp + 0x4c], ecx
jmp 0x1400775b7
mov r9d, dword [rsp + 0x44]
mov r8d, dword [rsp + 0x48]
mov rcx, qword [rdi + 0x9f8]
xor eax, eax
mov dword [rsp + 0x30], 1
xor edx, edx
add r8d, 0xffffff06
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
test r9d, r9d
jne 0x1400775f2
mov r9d, dword [rsp + 0x64]
sub r9d, dword [rsp + 0x6c]
add r9d, dword [rsp + 0x4c]
call qword [sym.imp.USER32.dll_SetWindowPos]
add rsp, 0x70
pop rdi
ret

Function at 0x1400812a0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
cmp qword [rcx + 0x38], 0
mov edi, edx
mov rbx, rcx
jne 0x1400812cf
lea rdx, str.g:checkpoints_tpdrvheadgit1_syntpenhCZone.h
lea rcx, str.m_pManagedPointingDevice
mov r8d, 0x1c1
call fcn.14000cb10
mov rcx, qword [rbx + 0x38]
call fcn.14002c4b0
test al, 0x40
jne 0x14008135b
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x8000
test cx, ax
je 0x140081307
mov rcx, rbx
call fcn.1400d8a40
mov edx, 1
mov rcx, qword [rax + 0x30]
call fcn.1400e4b10
mov rax, qword [rbx]
mov edx, edi
mov rcx, rbx
call qword [rax + 0x1a8]
cmp qword [rbx + 0x38], 0
jne 0x140081335
lea rdx, str.g:checkpoints_tpdrvheadgit1_syntpenhCZone.h
lea rcx, str.m_pManagedPointingDevice
mov r8d, 0x1c1
call fcn.14000cb10
mov rdx, qword [rbx + 0x40]
mov rcx, qword [rbx + 0x38]
xor eax, eax
mov dword [rsp + 0x30], eax
lea r9d, [rax + 3]
xor r8d, r8d
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], eax
call fcn.1400327c0
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x140093150
Capabilities:
Hide graphical window

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [rcx + 0x2b8], 2
mov r9, rdx
mov rbx, rcx
jne 0x1400931b4
test r8, r8
je 0x14009316f
mov rdx, r8
jmp 0x140093175
lea edx, [rcx + 0x718]
mov rcx, r9
call qword [sym.imp.USER32.dll_KillTimer]
mov dword [rbx + 0x38], 0
mov dword [rbx + 0x2b8], 1
mov rcx, qword [0x1402dd258]
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov qword [0x1402dc748], 0
mov qword [0x1402dc750], 0
add rsp, 0x20
pop rbx
ret
Function at 0x1400953e0
Capabilities:
Get graphical window text

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rdx
push rdi
sub rsp, 0x240
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov rbx, r8
mov rdi, rdx
xor esi, esi
mov dword [rsp + 0x20], esi
lea rdx, [0x140165848]
mov rcx, rdi
call fcn.140010c50
mov dword [rsp + 0x20], 1
mov word [rsp + 0x30], si
mov r8d, 0x104
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
je 0x14009545c
lea rcx, [rsp + 0x30]
or rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140095450
jmp 0x14009548d
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, rax
mov r8d, 0x104
lea rdx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
je 0x14009549d
lea rcx, [rsp + 0x30]
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], 0
jne 0x140095483
mov r8d, eax
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.140011790
mov rax, qword [rdi]
cmp dword [rax - 0x10], 0
je 0x1400954cc
test byte [0x1402d741c], 4
je 0x1400954cc
lea r9, [rsp + 0x30]
lea r8, str.TitleName__s_n
mov edx, 3
lea rcx, str.CSynOSD::GetAppTitleName
call fcn.14011a590
mov rax, rdi
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1400954f0
Capabilities:
Enumerate process modules
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x2bc0]
mov eax, 0x2cc0
call fcn.140121190
sub rsp, rax
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x2cf0], rbx
mov rbx, r8
mov rsi, rdx
mov r15, rcx
xor edi, edi
mov dword [rsp + 0x20], edi
lea rdx, [0x140165848]
mov rcx, rsi
call fcn.140010c50
mov dword [rsp + 0x20], 1
xor edx, edx
lea ecx, [rdi + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov r14, rax
mov dword [rbp + 0x2c08], edi
lea rdx, [rbp + 0x2c08]
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov dword [rsp + 0x40], 0x238
cmp r14, 0xffffffffffffffff
je 0x140095708
lea rdx, [rsp + 0x40]
mov rcx, r14
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x1400956ff
mov eax, dword [rbp + 0x2c08]
cmp dword [rsp + 0x48], eax
je 0x1400955ad
lea rdx, [rsp + 0x40]
mov rcx, r14
call sub.KERNEL32.dll_Process32NextW
jmp 0x14009558a
lea rcx, [rsp + 0x6c]
or rbx, 0xffffffffffffffff
mov rax, rbx
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400955c0
mov r8d, eax
lea rdx, [rsp + 0x6c]
mov rcx, rsi
call fcn.140011790
nop word [rax + rax]
movzx eax, word [rsp + rdi + 0x6c]
mov word [rbp + rdi + 0x180], ax
lea rdi, [rdi + 2]
test ax, ax
jne 0x1400955e0
mov r8d, dword [rbp + 0x2c08]
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x140095674
lea r9, [rsp + 0x24]
mov r8d, 8
lea rdx, [rsp + 0x28]
mov rcx, rax
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x14009566c
mov r9d, 0x104
lea r8, [rbp + 0x180]
mov rdx, qword [rsp + 0x28]
mov rcx, rdi
call sub.PSAPI.DLL_GetModuleFileNameExW
lea rax, [rbp + 0x180]
nop
inc rbx
cmp word [rax + rbx*2], 0
jne 0x140095650
mov r8d, ebx
lea rdx, [rbp + 0x180]
mov rcx, rsi
call fcn.140011790
mov rcx, rdi
jmp 0x1400956f9
lea rcx, [0x1402dc840]
call fcn.1400aaad0
test eax, eax
je 0x1400956ff
mov dword [rbp + 0x390], 0xe
mov eax, dword [rbp + 0x2c08]
mov dword [rbp + 0x398], eax
mov rax, qword [0x1402dd258]
mov qword [rbp + 0x3a0], rax
lea r9, str.SynGetModulePathNameEvent
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rbx, rax
test rax, rax
je 0x1400956ff
lea rdx, [rbp + 0x390]
lea rcx, [0x1402dc840]
call fcn.1400aadd0
test rax, rax
je 0x1400956f6
mov edx, 0x2710
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rdx, [r15 + 0x28]
mov rcx, rsi
call fcn.140010dc0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r9, qword [rsi]
cmp dword [r9 - 0x10], 0
je 0x140095733
test byte [0x1402d741c], 4
je 0x140095733
lea r8, str.App_Path__s_n
mov edx, 3
lea rcx, str.CSynOSD::GetAppPath
call fcn.14011a590
mov rax, rsi
mov rbx, qword [rsp + 0x2cf0]
add rsp, 0x2cc0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140099120
Capabilities:
Hide graphical window

Disassembly:
push rbx
sub rsp, 0x20
movss xmm0, dword [r8 + 0x2ef]
xorps xmm1, xmm1
mov rbx, r8
comiss xmm0, xmm1
jbe 0x1400991ed
cmp dword [r8 + 0x2f7], 0
je 0x140099152
addss xmm0, dword [0x14017a444]
jmp 0x14009915a
subss xmm0, dword [0x14017a444]
ucomiss xmm0, xmm1
movss dword [r8 + 0x2ef], xmm0
jp 0x14009916a
je 0x1400991ca
lea rcx, [0x1402dc840]
call fcn.1400ab000
test eax, eax
je 0x1400991bd
movzx eax, byte [rbx + 0xa3]
cmp al, 0xff
je 0x1400991bd
mov edx, dword [rbx + 0x87]
mov rcx, qword [0x1402dd258]
movzx eax, al
movd xmm0, eax
mov r9d, 3
cvtdq2ps xmm0, xmm0
mulss xmm0, dword [rbx + 0x2ef]
divss xmm0, dword [rbx + 0x2f3]
cvttss2si r8, xmm0
call qword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
mov rcx, qword [0x1402dd258]
call qword [sym.imp.USER32.dll_BringWindowToTop]
movss xmm0, dword [rbx + 0x2ef]
ucomiss xmm0, dword [rbx + 0x2f3]
jp 0x140099244
jne 0x140099244
mov dword [rbx + 0x2f7], 0
add rsp, 0x20
pop rbx
ret
cmp dword [r8 + 0x2b7], 2
jne 0x140099244
test rbx, rbx
je 0x140099201
mov rdx, rbx
jmp 0x140099208
lea edx, [r8 + 0x717]
call qword [sym.imp.USER32.dll_KillTimer]
mov dword [rbx + 0x37], 0
mov dword [rbx + 0x2b7], 1
mov rcx, qword [0x1402dd258]
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov qword [0x1402dc748], 0
mov qword [0x1402dc750], 0
add rsp, 0x20
pop rbx
ret
Function at 0x14009bed0
Capabilities:
Delete file

Disassembly:
sub rsp, 0x48
lea rdx, [rcx + 0x48]
lea r8, str..syn
lea rcx, [rsp + 0x20]
call fcn.14003a210
cmp qword [rax + 0x18], 8
jb 0x14009bef3
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp qword [rsp + 0x38], 8
jb 0x14009bf0e
mov rcx, qword [rsp + 0x20]
call fcn.14011f898
add rsp, 0x48
ret

Function at 0x14009bf20
Capabilities:
Check if file exists

Disassembly:
push rbx
sub rsp, 0x50
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x40], 7
xor eax, eax
mov qword [rsp + 0x38], rax
mov word [rsp + 0x28], ax
lea rdx, [rcx + 0x48]
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rcx, [rsp + 0x28]
call fcn.14000d1f0
nop
movzx eax, word [str..syn]
neg ax
sbb r8, r8
and r8d, 4
lea rdx, str..syn
lea rcx, [rsp + 0x28]
call fcn.140041570
lea rcx, [rsp + 0x28]
cmp qword [rsp + 0x40], 8
cmovae rcx, qword [rsp + 0x28]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ebx, eax
cmp qword [rsp + 0x40], 8
jb 0x14009bfa9
mov rcx, qword [rsp + 0x28]
call fcn.14011f898
mov eax, ebx
add rsp, 0x50
pop rbx
ret
Function at 0x14009dbc0
Capabilities:
Check if file exists

Disassembly:
push rbx
sub rsp, 0x50
mov qword [rsp + 0x20], 0xfffffffffffffffe
cmp dword [rcx + 4], 0
je 0x14009dc70
cmp dword [rcx + 0xc], 0
je 0x14009dc70
lea rbx, [rcx + 0x30]
cmp qword [rbx + 0x18], 8
jb 0x14009dbf3
mov rcx, qword [rbx]
jmp 0x14009dbf6
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x14009dc70
cmp qword [rbx + 0x18], 8
jb 0x14009dc0a
mov rbx, qword [rbx]
mov qword [rsp + 0x40], 7
xor r8d, r8d
mov qword [rsp + 0x38], r8
mov word [rsp + 0x28], r8w
cmp word [rbx], r8w
je 0x14009dc3b
or r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp word [rbx + r8*2], 0
jne 0x14009dc30
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.14000d340
nop
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x28]
call fcn.140114290
mov ebx, eax
cmp qword [rsp + 0x40], 8
jb 0x14009dc6c
mov rcx, qword [rsp + 0x28]
call fcn.14011f898
mov eax, ebx
jmp 0x14009dc75
mov eax, 1
add rsp, 0x50
pop rbx
ret