joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14017ff60
Capabilities:
Get common file path

Disassembly:
push rbx
mov eax, 0x2460
call fcn.1400db290
sub rsp, rax
mov rax, qword [0x14041d440]
xor rax, rsp
mov qword [rsp + 0x2450], rax
mov rbx, rcx
mov qword [rsp + 0x20], rcx
xor r8d, r8d
cmp edx, 0x11
ja case.default.0x14017ffa9
movsxd rax, edx
lea rdx, [0x140000000]
mov ecx, dword [rdx + rax*4 + 0x18015c]
add rcx, rdx
jmp rcx
mov r8d, 0x28
jmp case.0x14017ffa9.2
mov r8d, 5
jmp case.0x14017ffa9.2
mov r8d, reloc.OLEAUT32.dll_SafeArrayCopy
jmp case.0x14017ffa9.2
mov r8d, 0x23
jmp case.0x14017ffa9.2
mov r8d, 0x2e
jmp case.0x14017ffa9.2
mov r8d, 0x26
jmp case.0x14017ffa9.2
mov r8d, 0x2a
jmp case.0x14017ffa9.2
mov r8d, 0x1c
jmp case.0x14017ffa9.2
mov r8d, SafeArrayGetDim
jmp case.0x14017ffa9.2
mov r8d, SafeArrayGetDim
jmp case.0x14017ffa9.2
mov r8d, 0x27
xor r9d, r9d
lea rdx, [rsp + 0x40]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je case.default.0x14017ffa9
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x28]
call fcn.140019cf0
nop
lea rdx, [rsp + 0x28]
mov rcx, rbx
call fcn.14017abe0
nop
mov rcx, qword [rsp + 0x28]
add rcx, 0xfffffffffffffff0
mov eax, dword [rcx]
nop
test eax, 0x30000000
jne 0x14018013f
mov eax, 0xffffffff
lock xadd dword [rcx], eax
dec eax
cmp eax, 0xffffffff
jne 0x14018013f
call fcn.1400daaa8
jmp 0x14018013f
mov word [rsp + 0x450], r8w
lea rdx, [rsp + 0x450]
mov ecx, 0x800
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea rdx, [rsp + 0x450]
lea rcx, [rsp + 0x30]
call fcn.140019cf0
nop
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.14017abe0
nop
mov rcx, qword [rsp + 0x30]
jmp 0x1401800f2
mov word [rsp + 0x1450], r8w
mov edx, 0x800
lea rcx, [rsp + 0x1450]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea rdx, [rsp + 0x1450]
lea rcx, [rsp + 0x20]
call fcn.140019cf0
nop
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.14017abe0
nop
mov rcx, qword [rsp + 0x20]
add rcx, 0xfffffffffffffff0
mov eax, dword [rcx]
test eax, 0x30000000
nop
jne 0x14018013f
mov eax, 0xffffffff
lock xadd dword [rcx], eax
dec eax
cmp eax, 0xffffffff
jne 0x14018013f
call fcn.1400daaa8
jmp 0x14018013f
call fcn.14017de70
mov rdx, rax
mov rcx, rbx
call fcn.14014fa00
jmp 0x14018013f
xor edx, edx
mov rcx, rbx
call fcn.14014fa00
jmp 0x14018013f
lea rax, [0x140370a58]
mov qword [rbx], rax
mov rax, rbx
mov rcx, qword [rsp + 0x2450]
xor rcx, rsp
call fcn.1400da5a0
add rsp, 0x2460
pop rbx
ret
Function at 0x140181f10
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xd0
mov rbx, rcx
call fcn.140183340
mov qword [rbp - 1], rax
test rax, rax
je 0x140181f3e
cmp byte [rax + 8], 0
jne 0x140181f3e
xor bl, bl
jmp 0x1401820a1
lea rdx, [rbx + 0xc0]
lea rcx, [rbp + 7]
call fcn.140177110
nop
mov r8d, 0x4000
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x59]
call fcn.140177aa0
nop
mov rax, qword [rbp - 0x39]
cmp byte [rax], 0
jne 0x14018208c
mov r8d, 4
lea rdx, [rbp + 0x6f]
lea rcx, [rbp - 0x59]
mov rax, qword [rbp - 0x59]
cmp dword [rbx + 0xf0], 1
jne 0x1401820c0
mov dword [rbp + 0x6f], 0x50525043
call qword [rax + 0x20]
mov edi, 0xffffffff
mov rax, qword [rbp - 0x21]
mov rcx, qword [rbp - 0x41]
test rax, rax
je 0x14018201b
mov dword [rbp + 0x77], 0
test rcx, rcx
je 0x140182013
mov qword [rsp + 0x20], 0
lea r9, [rbp + 0x77]
mov r8d, eax
mov rdx, qword [rbp - 0x19]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x14018200f
lea rcx, [rbp + 0x7f]
call fcn.14014f920
mov rcx, qword [rbp - 0x39]
mov rdx, qword [rax]
mov qword [rbp - 0x39], rdx
mov qword [rax], rcx
mov rcx, qword [rbp + 0x7f]
add rcx, 0xfffffffffffffff0
mov eax, dword [rcx]
nop
test eax, 0x30000000
jne 0x14018200f
mov eax, edi
lock xadd dword [rcx], eax
dec eax
cmp eax, edi
jne 0x14018200f
call fcn.1400daaa8
mov rcx, qword [rbp - 0x41]
mov qword [rbp - 0x21], 0
test rcx, rcx
je 0x140182063
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
test eax, eax
jne 0x140182063
lea rcx, [rbp - 9]
call fcn.14014f920
mov rcx, qword [rbp - 0x39]
mov rdx, qword [rax]
mov qword [rbp - 0x39], rdx
mov qword [rax], rcx
mov rcx, qword [rbp - 9]
add rcx, 0xfffffffffffffff0
mov eax, dword [rcx]
nop
test eax, 0x30000000
jne 0x140182063
lock xadd dword [rcx], edi
dec edi
cmp edi, 0xffffffff
jne 0x140182063
call fcn.1400daaa8
lea rdx, [rbp - 0x59]
lea rcx, [rbp + 0x17]
call fcn.140150970
nop
lea rdx, [rbp + 0x17]
mov rcx, rbx
call fcn.140181df0
nop
lea rcx, [rbp + 0x17]
test al, al
jne 0x1401820b8
call fcn.1401507c0
nop
lea rcx, [rbp - 0x59]
call fcn.1401779d0
xor bl, bl
lea rcx, [rbp + 7]
call fcn.140177050
nop
lea rcx, [rbp - 1]
call fcn.14001dfc0
movzx eax, bl
add rsp, 0xd0
pop rdi
pop rbx
pop rbp
ret
call fcn.1401507c0
nop
jmp 0x1401820da
mov dword [rbp + 0x6f], 0x504f5250
call qword [rax + 0x20]
lea rdx, [rbp - 0x59]
mov rcx, rbx
call fcn.140181df0
test al, al
je 0x14018208c
lea rcx, [rbp - 0x59]
call fcn.1401779d0
lea rcx, [rbp + 7]
call fcn.140176fc0
test al, al
je 0x140182095
mov byte [rbx + 0x101], 0
mov bl, 1
jmp 0x140182097
Function at 0x1401834c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
call fcn.140183340
mov qword [rsp + 0x38], rax
test rax, rax
je 0x1401834e6
cmp byte [rax + 8], 0
jne 0x1401834e6
xor bl, bl
jmp 0x140183532
lea rdx, [rdi + 0xc0]
mov rax, qword [rdx]
cmp byte [rax], 0
je 0x14018352a
lea rcx, [rsp + 0x40]
call fcn.140014d10
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop
cmp eax, 0xffffffff
je 0x14018352a
mov rcx, rdi
call fcn.140182460
test al, al
jne 0x14018352a
mov rcx, rdi
call fcn.140182c40
test al, al
jne 0x14018352a
xor bl, bl
jmp 0x14018352c
mov bl, 1
mov byte [rdi + 0x100], bl
lea rcx, [rsp + 0x38]
call fcn.14001dfc0
movzx eax, bl
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1401867e0
Capabilities:
Get file attributes

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov rdi, rcx
xor ebx, ebx
mov dword [rsp + 0x60], ebx
lea r14, [rcx + 0x38]
mov qword [rsp + 0x20], r14
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rcx, [rdi + 0xa8]
call fcn.14018b960
cmp byte [rdi + 0xea], bl
jne 0x1401868ae
lea rdx, [0x140370a58]
mov qword [rsp + 0x78], rdx
mov ebx, 1
mov dword [rsp + 0x60], ebx
cmp qword [rdi + 0xc0], rdx
je 0x1401868ae
mov rcx, qword [rdi + 0xc0]
call fcn.140018f90
test eax, eax
je 0x1401868ae
lea rdx, [rdi + 0xc0]
lea rcx, [rsp + 0x28]
call fcn.140014d10
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop
test al, 0x10
je 0x140186871
cmp eax, 0xffffffff
jne 0x1401868ae
lea rdx, [rsp + 0x70]
lea rcx, [rdi + 0xc0]
call fcn.14017a620
nop
mov dword [rsp + 0x60], 3
lea rdx, [rsp + 0x68]
mov rcx, rax
call fcn.14017df80
mov ebx, 7
mov dword [rsp + 0x60], ebx
mov rax, qword [rax]
cmp byte [rax], 0
jne 0x1401868ae
xor bpl, bpl
jmp 0x1401868b1
mov bpl, 1
mov esi, 0xffffffff
test bl, 4
je 0x1401868ea
and ebx, 0xfffffffb
mov dword [rsp + 0x60], ebx
mov rcx, qword [rsp + 0x68]
add rcx, 0xfffffffffffffff0
mov eax, dword [rcx]
nop
test eax, 0x30000000
jne 0x1401868e6
mov eax, esi
lock xadd dword [rcx], eax
dec eax
cmp eax, esi
jne 0x1401868e6
call fcn.1400daaa8
mov ebx, dword [rsp + 0x60]
test bl, 2
je 0x14018691f
and ebx, 0xfffffffd
mov dword [rsp + 0x60], ebx
mov rcx, qword [rsp + 0x70]
add rcx, 0xfffffffffffffff0
mov eax, dword [rcx]
nop
test eax, 0x30000000
jne 0x14018691b
mov eax, esi
lock xadd dword [rcx], eax
dec eax
cmp eax, 0xffffffff
jne 0x14018691b
call fcn.1400daaa8
mov ebx, dword [rsp + 0x60]
test bl, 1
je 0x140186947
mov rcx, qword [rsp + 0x78]
add rcx, 0xfffffffffffffff0
mov eax, dword [rcx]
nop
test eax, 0x30000000
jne 0x140186947
lock xadd dword [rcx], esi
dec esi
cmp esi, 0xffffffff
jne 0x140186947
call fcn.1400daaa8
test bpl, bpl
je 0x140186950
xor bl, bl
jmp 0x14018696b
mov rcx, rdi
cmp dword [rdi + 0xf0], 2
jne 0x140186963
call fcn.140182680
jmp 0x140186968
call fcn.140181f10
movzx ebx, al
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
movzx eax, bl
add rsp, 0x30
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140188d20
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov r14, rdx
mov rbp, rcx
mov eax, dword [rcx + 0x194]
mov dword [rsp + 0x70], eax
mov eax, dword [rdx + 8]
mov dword [rsp + 0x74], eax
mov rbx, qword [rdx + 8]
add rbx, 8
mov esi, 0
mov edi, esi
mov qword [rsp + 0x20], rsi
je 0x140188d86
mov qword [rsp + 0x28], rbx
xor ecx, ecx
call fcn.1400e1bf4
mov rcx, rbx
call fcn.1400e2094
mov rdi, rax
mov qword [rsp + 0x20], rax
test rax, rax
je 0x140188e7e
jmp 0x140188d8e
mov rbx, rsi
mov qword [rsp + 0x28], rbx
mov r8d, 8
cmp rbx, r8
jae 0x140188da1
mov r8, rbx
test rbx, rbx
je 0x140188dae
lea rdx, [rsp + 0x70]
mov rcx, rdi
call fcn.1400dd3e0
mov r8, qword [r14 + 8]
lea rax, [r8 + 8]
cmp rax, rbx
jbe 0x140188dbf
lea r8, [rbx - 8]
test r8, r8
je 0x140188dd0
lea rcx, [rdi + 8]
mov rdx, qword [r14]
call fcn.1400dd3e0
lea rdx, [rbp + 8]
lea rcx, [rsp + 0x70]
call fcn.14000ebe0
nop
mov rcx, qword [rbp + 0x180]
test rcx, rcx
je 0x140188e2e
movzx eax, byte [rcx + 0x11]
nop
test al, al
jne 0x140188e1d
movzx eax, byte [rcx + 0x10]
nop
test al, al
je 0x140188e1d
movsxd rcx, dword [rcx + 0xc]
nop
xor r9d, r9d
mov rbx, qword [rsp + 0x28]
mov r8d, ebx
mov rdi, qword [rsp + 0x20]
mov rdx, rdi
call qword [sym.imp.WS2_32.dll_send]
jmp 0x140188e4c
mov esi, 0xffffffff
mov rbx, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x20]
jmp 0x140188e4e
mov rcx, qword [rbp + 0x188]
test rcx, rcx
je 0x140188e4e
mov r9d, dword [rbp + 0x198]
mov r8d, ebx
mov rdx, rdi
call fcn.14014ddc0
mov esi, eax
mov rcx, qword [rsp + 0x70]
call fcn.140164960
cmp esi, ebx
sete bl
mov rcx, rdi
call fcn.1400e1bf4
movzx eax, bl
mov rbx, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x80]
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret
lea rcx, [rsp + 0x30]
call fcn.14000d210
lea rdx, [0x140417238]
lea rcx, [rsp + 0x30]
call fcn.1400dd30c
int3

Function at 0x14018b290
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x30
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rdx, rax
lea r9, [0x140373634]
lea r8, [0x140373638]
lea rcx, [rsp + 0x50]
call fcn.1400213d0
mov esi, 0xdc00
mov ebp, 0xdfff
mov r14d, 0xd800
mov rbx, qword [rax]
nop
movzx eax, word [rbx]
lea ecx, [rax - 0xd800]
cmp ecx, 0x7ff
ja 0x14018b303
movzx edx, word [rbx + 2]
cmp dx, si
jb 0x14018b303
mov eax, edx
shl ecx, 0xa
sub eax, esi
or eax, ecx
movzx ecx, ax
call fcn.1400eb330
test eax, eax
je 0x14018b32c
movzx eax, word [rbx]
add rbx, 2
cmp ax, r14w
jb 0x14018b2e0
cmp ax, bp
ja 0x14018b2e0
cmp word [rbx], si
jb 0x14018b2e0
add rbx, 2
jmp 0x14018b2e0
mov rdx, rbx
mov rcx, rdi
call fcn.140019cf0
mov rbx, qword [rsp + 0x58]
mov rax, rdi
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x1401d2a40
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x78
movaps xmmword [rsp + 0x60], xmm6
movaps xmm6, xmm1
mov rcx, qword [rcx]
test rcx, rcx
jne 0x1401d2a5a
xor eax, eax
xor edx, edx
jmp 0x1401d2a60
mov eax, dword [rcx + 0x18]
mov edx, dword [rcx + 0x14]
mov dword [rsp + 0x4c], edx
mov dword [rsp + 0x50], eax
mov qword [rsp + 0x58], 0
mov rax, qword [rcx]
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x30]
call qword [rax + 0x20]
nop
mov ecx, dword [rsp + 0x40]
test ecx, ecx
je 0x1401d2bce
sub ecx, 1
je 0x1401d2bce
sub ecx, 1
je 0x1401d2b1a
cmp ecx, 1
jne 0x1401d2bce
xor r9d, r9d
mov r10d, dword [rsp + 0x50]
test r10d, r10d
jle 0x1401d2bce
mov r8d, dword [rsp + 0x4c]
movsxd rcx, dword [rsp + 0x44]
movsxd rax, r9d
imul rcx, rax
add rcx, qword [rsp + 0x30]
xor edx, edx
test r8d, r8d
jle 0x1401d2b0d
nop dword [rax]
movzx eax, byte [rcx]
movd xmm0, eax
cvtdq2ps xmm0, xmm0
mulss xmm0, xmm6
cvttss2si eax, xmm0
mov byte [rcx], al
movsxd rax, dword [rsp + 0x48]
add rcx, rax
inc edx
mov r8d, dword [rsp + 0x4c]
cmp edx, r8d
jl 0x1401d2ae0
mov r10d, dword [rsp + 0x50]
inc r9d
cmp r9d, r10d
jl 0x1401d2ac4
jmp 0x1401d2bce
xor r10d, r10d
mov ecx, dword [rsp + 0x50]
test ecx, ecx
jle 0x1401d2bce
movss xmm1, dword [0x1403acb98]
mov edx, dword [rsp + 0x4c]
nop word [rax + rax]
movsxd r8, dword [rsp + 0x44]
movsxd rax, r10d
imul r8, rax
add r8, qword [rsp + 0x30]
xor r11d, r11d
test edx, edx
jle 0x1401d2bc2
movaps xmm0, xmm6
mulss xmm0, xmm1
cvttss2si eax, xmm0
mov r9d, 1
sub r9d, eax
nop dword [rax]
mov ecx, dword [r8]
mov edx, ecx
and edx, 0xff00ff
imul edx, r9d
shr edx, 8
mov eax, ecx
shr eax, 8
and eax, 0xffff00ff
imul eax, r9d
xor edx, eax
and edx, 0xff00ff
shr ecx, 8
and ecx, 0xff00ff
imul ecx, r9d
xor edx, ecx
mov dword [r8], edx
movsxd rax, dword [rsp + 0x48]
add r8, rax
inc r11d
mov edx, dword [rsp + 0x4c]
cmp r11d, edx
jl 0x1401d2b70
mov ecx, dword [rsp + 0x50]
inc r10d
cmp r10d, ecx
jl 0x1401d2b40
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x1401d2be2
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
movaps xmm6, xmmword [rsp + 0x60]
add rsp, 0x78
ret
Function at 0x1401e0d40
Capabilities:
Encode data using xor

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov rdi, qword [rcx + 0x18]
mov r10d, r8d
mov qword [rsp + 0x18], r13
mov r13, rcx
mov qword [rsp + 8], r15
mov r9d, dword [rdi + 8]
mov eax, r9d
shr eax, 0x18
mov dword [rsp + 0x68], r9d
cmp al, 0xff
jae 0x1401e0dc8
test al, al
jne 0x1401e0d8c
mov word [rsp + 0x68], 0
mov byte [rsp + 0x6a], al
jmp 0x1401e0dc3
mov ecx, eax
movzx eax, r9b
imul eax, ecx
add eax, 0x7f
shr eax, 8
mov byte [rsp + 0x68], al
movzx eax, byte [rsp + 0x69]
imul eax, ecx
add eax, 0x7f
shr eax, 8
mov byte [rsp + 0x69], al
movzx eax, byte [rsp + 0x6a]
imul eax, ecx
add eax, 0x7f
shr eax, 8
mov byte [rsp + 0x6a], al
mov r9d, dword [rsp + 0x68]
xor r8d, r8d
mov r15d, 1
cmp dword [r13 + 0x24], r15d
jle 0x1401e0f6f
movsd xmm2, qword [0x1403aca18]
lea eax, [r10 - 1]
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], r12
xor r12d, r12d
movd xmm1, eax
mov qword [rsp + 0x10], r14
mov r14d, reloc.OLEAUT32.dll_SafeArrayGetDim
cvtdq2pd xmm1, xmm1
nop dword [rax]
nop word [rax + rax]
mov ecx, dword [r14 + rdi + 8]
movaps xmm0, xmm1
mulsd xmm0, qword [r14 + rdi]
mov eax, ecx
shr eax, 0x18
addsd xmm0, xmm2
movsd qword [rsp + 0x68], xmm0
mov r10d, dword [rsp + 0x68]
sub r10d, r8d
mov dword [rsp + 0x68], ecx
cmp al, 0xff
jae 0x1401e0e98
test al, al
jne 0x1401e0e5e
mov word [rsp + 0x68], 0
mov byte [rsp + 0x6a], al
jmp 0x1401e0e94
mov edx, eax
movzx eax, cl
imul eax, edx
add eax, 0x7f
shr eax, 8
mov byte [rsp + 0x68], al
movzx eax, byte [rsp + 0x69]
imul eax, edx
add eax, 0x7f
shr eax, 8
mov byte [rsp + 0x69], al
movzx eax, byte [rsp + 0x6a]
imul eax, edx
add eax, 0x7f
shr eax, 8
mov byte [rsp + 0x6a], al
mov ecx, dword [rsp + 0x68]
xor ebx, ebx
test r10d, r10d
jle 0x1401e0f38
mov r13, qword [rsp + 0x58]
mov ebp, r9d
shr r9d, 8
and ebp, 0xff00ff
and r9d, 0xff00ff
mov r11d, ecx
shr r11d, 8
mov esi, ecx
and r11d, 0xff00ff
and esi, 0xff00ff
sub r11d, r9d
sub esi, ebp
shl r9d, 8
add r8d, r10d
mov dword [rsp + 0x68], r8d
mov eax, ebx
mov r8d, esi
shl eax, 8
inc ebx
cdq
idiv r10d
mov edx, r11d
imul r8d, eax
mov edi, eax
imul edx, eax
mov eax, r11d
imul eax, edi
shr r8d, 8
add r8d, ebp
add edx, r9d
xor r8d, edx
add eax, r9d
and r8d, 0xff00ff
xor r8d, eax
mov dword [r13 + r12*4], r8d
inc r12
cmp ebx, r10d
jl 0x1401e0ee3
mov r13, qword [rsp + 0x50]
mov r8d, dword [rsp + 0x68]
mov rdi, qword [r13 + 0x18]
inc r15d
add r14, 0x10
mov r9d, ecx
cmp r15d, dword [r13 + 0x24]
jl 0x1401e0e20
mov r14, qword [rsp + 0x10]
mov r12, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x58]
mov r10d, dword [rsp + 0x60]
mov r15, qword [rsp + 8]
mov r13, qword [rsp + 0x18]
cmp r8d, r10d
jge 0x1401e0f90
movsxd rax, r8d
sub r10d, r8d
movsxd rcx, r10d
lea rdi, [rdx + rax*4]
mov eax, r9d
rep stosd dword [rdi], eax
add rsp, 0x40
pop rdi
ret
Function at 0x1401ecca0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov rbx, rcx
mov dword [rsp + 0x20], 0
lea rax, [0x140370a58]
mov qword [rcx], rax
mov dword [rsp + 0x20], 1
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x1401ecd5a
mov ecx, SafeArrayGetDim
call qword [sym.imp.USER32.dll_GetClipboardData]
mov rdi, rax
test rax, rax
je 0x1401ecd54
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rsi, rax
test rax, rax
je 0x1401ecd54
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalSize]
shr rax, 1
mov r8, rax
mov rdx, rsi
lea rcx, [rsp + 0x48]
call fcn.14001a120
mov rax, qword [rbx]
mov rcx, qword [rsp + 0x48]
mov qword [rbx], rcx
lea rcx, [rax - 0x10]
mov eax, dword [rcx]
nop
test eax, 0x30000000
jne 0x1401ecd4b
mov eax, 0xffffffff
lock xadd dword [rcx], eax
dec eax
cmp eax, 0xffffffff
jne 0x1401ecd4b
call fcn.1400daaa8
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rax, rbx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret

Function at 0x1401ecd80
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x1401ece1e
call qword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
je 0x1401ece12
mov rcx, qword [rsi]
mov qword [rsp + 0x30], rbx
call fcn.14001a9c0
mov rbx, rax
add rbx, 4
je 0x1401ece0d
lea rdx, [rbx + 2]
mov qword [rsp + 0x38], rdi
mov ecx, 0x2042
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rdi, rax
test rax, rax
je 0x1401ece08
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
test rax, rax
je 0x1401ece08
mov r8, rbx
mov rdx, rax
mov rcx, rsi
call fcn.1401805a0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rdx, rdi
mov ecx, SafeArrayGetDim
call qword [sym.imp.USER32.dll_SetClipboardData]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rsi
jmp qword [sym.imp.USER32.dll_CloseClipboard]
add rsp, 0x20
pop rsi
ret
Function at 0x1401ed3c0
Capabilities:
Enumerate gui resources

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], r8
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
mov r15, r8
mov r14, rdx
mov rbx, rcx
cmp qword [r8], 0
je 0x1401ed489
call fcn.140180790
cmp eax, 0x203
jl 0x1401ed489
cmp byte [0x140442c58], 0
jne 0x1401ed446
mov byte [0x140442c58], 1
lea rcx, str.Comctl32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rcx, str.Comctl32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x1401ed446
lea rdx, str.TaskDialogIndirect
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140441f28], rax
jmp 0x1401ed44d
mov rax, qword [0x140441f28]
test rax, rax
je 0x1401ed489
mov ecx, 0x50
call fcn.1400daadc
mov qword [rsp + 0x78], rax
mov r8, r15
mov rdx, r14
mov rcx, rax
call fcn.140091630
nop
mov qword [rbx], rax
mov rcx, qword [r15]
test rcx, rcx
je 0x1401ed5f6
mov edx, 1
jmp 0x1401ed5f1
mov eax, dword [r14 + 0x24]
mov r12d, 1
cmp eax, 3
jne 0x1401ed49c
mov ebp, eax
jmp 0x1401ed4fd
cmp eax, 2
jne 0x1401ed4fb
lea rcx, [r14 + 0x18]
xor edx, edx
call fcn.140180e50
mov rcx, qword [rax]
lea rdi, [rcx - 0x10]
mov eax, dword [rdi]
nop
test eax, 0x30000000
jne 0x1401ed4c0
lock inc dword [rdi]
lea rdx, [0x14038ff7c]
call fcn.14001b9a0
mov ebp, 4
test eax, eax
cmove ebp, r12d
mov eax, dword [rdi]
nop
test eax, 0x30000000
jne 0x1401ed4fd
mov eax, 0xffffffff
lock xadd dword [rdi], eax
dec eax
cmp eax, 0xffffffff
jne 0x1401ed4fd
mov rcx, rdi
call fcn.1400daaa8
jmp 0x1401ed4fd
xor ebp, ebp
mov ecx, 0x38
call fcn.1400daadc
mov rdi, rax
mov qword [rsp + 0x78], rax
mov rax, qword [r14 + 0x28]
test rax, rax
je 0x1401ed51e
mov rsi, qword [rax + 0x10]
jmp 0x1401ed520
xor esi, esi
mov rcx, rdi
call fcn.14018b5a0
nop
lea rax, vtable.juce::WindowsMessageBoxBase.0
mov qword [rdi], rax
lea rcx, [rdi + 0x10]
mov qword [rsp + 0x28], rcx
mov rdx, rsi
call fcn.14009a8e0
mov rax, qword [r15]
mov qword [r15], 0
mov qword [rdi + 0x18], rax
lea rax, vtable.juce::PreVistaMessageBox.0
mov qword [rdi], rax
mov esi, dword [r14]
mov byte [rsp + 0x70], 0
lea rdx, [rsp + 0x70]
lea rcx, [0x1401ed650]
call qword [sym.imp.USER32.dll_EnumWindows]
movzx eax, byte [rsp + 0x70]
neg al
sbb ecx, ecx
and ecx, 0x40000
sub esi, 1
je 0x1401ed5a9
sub esi, 1
je 0x1401ed5a2
cmp esi, 1
je 0x1401ed59b
mov eax, 0x12000
jmp 0x1401ed5ae
mov eax, 0x12040
jmp 0x1401ed5ae
mov eax, 0x12030
jmp 0x1401ed5ae
mov eax, 0x12020
or ecx, eax
or ecx, ebp
mov dword [rdi + 0x20], ecx
mov rcx, qword [r14 + 8]
mov qword [rdi + 0x28], rcx
mov eax, dword [rcx - 0x10]
nop
test eax, 0x30000000
jne 0x1401ed5cc
lock inc dword [rcx - 0x10]
mov rcx, qword [r14 + 0x10]
mov qword [rdi + 0x30], rcx
mov eax, dword [rcx - 0x10]
nop
test eax, 0x30000000
jne 0x1401ed5e3
lock inc dword [rcx - 0x10]
mov qword [rbx], rdi
mov rcx, qword [r15]
test rcx, rcx
je 0x1401ed5f6
mov edx, r12d
mov rax, qword [rcx]
call qword [rax]
mov rax, rbx
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x1401ed830
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x58
mov rax, qword [0x14041d440]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov r8d, ecx
bt ecx, 0x10
jb 0x1401ed8a8
movdqa xmm0, xmmword [str.__._:__]
lea edx, [r8 - 0x20]
movdqa xmm1, xmmword [0x1403accd0]
xor eax, eax
add ecx, 0xffffff9f
mov dword [rsp + 0x40], 0xdb005b
cmp cx, 0x19
mov dword [rsp + 0x44], 0xdd005d
movdqu xmmword [rsp + 0x20], xmm0
cmova dx, r8w
movzx r8d, dx
movdqu xmmword [rsp + 0x30], xmm1
nop
cmp r8w, word [rsp + rax*2 + 0x20]
jne 0x1401ed89e
movzx r8d, word [rsp + rax*2 + 0x22]
add rax, 2
cmp rax, 0x14
jl 0x1401ed890
movsx ecx, r8w
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
and al, 1
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400da5a0
add rsp, 0x58
ret