joyce8/EMBER2024-capa huggingface dataset:
Function at 0x171b054bc
Capabilities:
Read file via mapping

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx + 8], 0
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
jne 0x171b2bdfe
cmp qword [rcx + 0x18], 0
jne 0x171b2bdfe
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rcx, rsi
lea edx, [r9 + 4]
call qword [sym.imp.api_ms_win_core_memory_l1_1_0.dll_MapViewOfFile]
nop dword [rax + rax]
mov qword [rbx + 8], rax
test rax, rax
je 0x171b05563
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov qword [rbx + 0x10], rsi
mov rcx, rdi
lea edx, [r9 + 4]
call qword [sym.imp.api_ms_win_core_memory_l1_1_0.dll_MapViewOfFile]
nop dword [rax + rax]
mov qword [rbx + 0x18], rax
test rax, rax
je 0x171b05563
mov rcx, rbx
mov qword [rbx + 0x20], rdi
call fcn.171b05574
test eax, eax
js 0x171b2be09
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
call fcn.171b53970
nop
jmp 0x171b2be20
call fcn.171b1d3bc
nop
jmp 0x171b054ea
and qword [rbx + 0x10], 0
mov rcx, rbx
and qword [rbx + 0x20], 0
call fcn.171b1d3bc
mov eax, 0x8007000b
test eax, eax
jns 0x171b05552
and qword [rbx + 8], 0
and qword [rbx + 0x10], 0
and qword [rbx + 0x18], 0
and qword [rbx + 0x20], 0
jmp 0x171b05552
Function at 0x171b056d4
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x5d0]
sub rsp, 0x6d0
mov rax, qword [0x171b91788]
xor rax, rsp
mov qword [rbp + 0x5c0], rax
xor r15d, r15d
mov r14, rdx
mov qword [rcx], r15
mov rsi, rcx
mov qword [rdx], r15
lea rcx, [rbp + 0x390]
mov rax, qword gs:[0x60]
lea ebx, [r15 + 4]
mov qword [rsp + 0x20], r15
mov r9d, ebx
mov r8d, ebx
mov edx, dword [rax + 0x2c0]
call fcn.171b058e0
xorps xmm0, xmm0
mov dword [rbp + 0x384], ebx
lea r12, [0x171b5f048]
movdqa xmmword [rbp + 0x370], xmm0
lea rdx, [rsp + 0x20]
movdqa xmmword [rbp + 0x140], xmm0
lea rcx, [rbp + 0x390]
mov dword [rbp + 0x388], ebx
mov word [rbp + 0x168], r15w
mov qword [rbp + 0x160], r12
mov dword [rbp + 0x154], ebx
mov dword [rbp + 0x158], ebx
mov word [rsp + 0x38], r15w
mov qword [rsp + 0x30], r12
call fcn.171b06108
mov ebx, eax
test eax, eax
js 0x171b0580f
mov rdx, qword [rsp + 0x20]
cmp word [rdx], r15w
je 0x171b05879
lea rdi, [rdx + 0x208]
cmp word [rdi], r15w
je 0x171b05879
xor r8d, r8d
lea rcx, [rbp + 0x160]
call fcn.171b07008
mov ebx, eax
test eax, eax
js 0x171b0580f
xor r8d, r8d
lea rcx, [rsp + 0x30]
mov rdx, rdi
call fcn.171b07008
mov ebx, eax
test eax, eax
js 0x171b0580f
mov rax, qword [rbp + 0x370]
mov qword [rsi], rax
mov rax, qword [rbp + 0x140]
mov qword [r14], rax
mov qword [rbp + 0x370], r15
mov qword [rbp + 0x140], r15
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x30], r12
call fcn.171b05888
lea rcx, [rbp + 0x160]
mov qword [rbp + 0x160], r12
call fcn.171b05888
lea rax, [0x171b5f048]
lea rcx, [rbp + 0x390]
mov qword [rbp + 0x390], rax
call fcn.171b05888
mov eax, ebx
mov rcx, qword [rbp + 0x5c0]
xor rcx, rsp
call fcn.171b28ea0
lea r11, [rsp + 0x6d0]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
mov ebx, 0x80070490
jmp 0x171b0580f
Function at 0x171b083cc
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x40
movsxd rbx, ecx
mov rdi, rdx
test ecx, ecx
js 0x171b2c4d6
cmp ebx, 7
jg 0x171b2c4dd
and qword [rax + 0x18], 0
lea rcx, [rax + 0x18]
mov r8b, 1
xor edx, edx
call fcn.171b084cc
mov eax, dword [rsp + 0x64]
lea rsi, [0x171b92e90]
cmp eax, dword [0x171b917a8]
mov dword [0x171b917a8], eax
sete cl
mov byte [0x171b92d00], cl
test cl, cl
je 0x171b08442
mov eax, dword [rsi + rbx*4]
mov dword [rdi], eax
xor eax, eax
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
lea rax, [rsp + 0x50]
mov dword [rsp + 0x50], 0x20
mov qword [rsp + 0x30], rax
lea r8, str.AccentPalette
mov qword [rsp + 0x28], rsi
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerAccent
and qword [rsp + 0x20], 0
mov r9d, 8
mov rcx, 0xffffffff80000001
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
test eax, eax
jg 0x171b2c502
js 0x171b2c511
cmp dword [rsp + 0x50], 0x20
jne 0x171b2c511
mov byte [0x171b92d00], 1
jmp 0x171b0842a
mov edx, 0x230
jmp 0x171b2c4e2
mov edx, 0x231
mov rcx, qword [rsp + 0x48]
lea r8, str.shell_themes_accentcolors_accentcolors.cpp
mov ebx, 0x80070057
mov r9d, ebx
call fcn.171b36d04
mov eax, ebx
jmp 0x171b08431
movzx eax, ax
or eax, 0x80070000
test eax, eax
jmp 0x171b0848e
xor r8d, r8d
mov rdx, 0xffffffff80000001
mov ecx, 0xd77800
call fcn.171b25b14
test eax, eax
jns 0x171b0849f
mov rcx, qword [rsp + 0x48]
mov r9d, eax
call fcn.171b5d424
nop
jmp 0x171b0849f
Function at 0x171b08568
Capabilities:
Read file via mapping

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rdi
sub rsp, 0x30
mov al, byte [0x171b92a79]
xor ebx, ebx
test al, al
je 0x171b08596
mov rbp, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
call fcn.171b22020
mov ebx, eax
test eax, eax
js 0x171b08583
mov cl, byte [0x171b92a79]
test cl, cl
jne 0x171b0866f
lea rbp, str.LocalSessionImmersiveColorPreference
mov edx, 1
mov r8, rbp
mov ecx, 0xf001f
mov bl, 1
xor dil, dil
call qword [sym.imp.api_ms_win_core_memory_l1_1_0.dll_OpenFileMappingW]
nop dword [rax + rax]
test rax, rax
je 0x171b08679
mov qword [0x171b92a70], rax
mov byte [0x171b92a78], bl
mov al, byte [0x171b92a78]
mov rcx, qword [0x171b92a70]
neg al
mov qword [rsp + 0x20], 8
sbb edx, edx
xor r9d, r9d
and edx, 0xf001b
xor r8d, r8d
add edx, 4
call qword [sym.imp.api_ms_win_core_memory_l1_1_0.dll_MapViewOfFile]
nop dword [rax + rax]
mov qword [0x171b92a80], rax
mov rax, qword [0x171b92a80]
test rax, rax
je 0x171b2c5d8
xor ebx, ebx
test dil, dil
jne 0x171b086d4
call fcn.171b229ac
mov rcx, qword [0x171b929e8]
test eax, eax
cmovne rcx, qword [0x171b929e0]
mov qword [0x171b929e8], rcx
call fcn.171b1e234
call sym.UxTheme.dll_Ordinal_104
mov byte [0x171b92a79], 1
call fcn.171b22d38
jmp 0x171b08583
mov edx, 1
mov r8, rbp
lea ecx, [rdx + 3]
call qword [sym.imp.api_ms_win_core_memory_l1_1_0.dll_OpenFileMappingW]
nop dword [rax + rax]
xor bl, bl
test rax, rax
jne 0x171b085dd
mov qword [rsp + 0x28], rbp
lea r8d, [rax + 4]
xor r9d, r9d
mov dword [rsp + 0x20], 8
xor edx, edx
or rcx, 0xffffffffffffffff
call qword [sym.imp.api_ms_win_core_memory_l1_1_0.dll_CreateFileMappingW]
nop dword [rax + rax]
mov bl, 1
mov dil, bl
test rax, rax
jne 0x171b085dd
jmp 0x171b2c5d8
mov rcx, qword [0x171b92a80]
call fcn.171b1e058
call fcn.171b22c64
test al, al
jne 0x171b08641
lea rcx, [rsp + 0x48]
call fcn.171b21e28
test eax, eax
js 0x171b08641
mov rcx, qword [rsp + 0x48]
lea rdx, [rsp + 0x40]
call qword [sym.imp.api_ms_win_security_sddl_l1_1_0.dll_ConvertSidToStringSidW]
nop dword [rax + rax]
test eax, eax
je 0x171b08734
mov rcx, qword [rsp + 0x40]
call fcn.171b22518
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
jmp 0x171b08641
mov ebx, 0x80004005
jmp 0x171b0866f
Function at 0x171b087a8
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
push rdi
sub rsp, 0x50
movzx ebx, cl
mov dil, dl
mov edx, 0x20019
mov dword [rax + 8], ebx
lea rcx, [rax - 0x18]
mov dword [rax + 0x18], 4
call fcn.171b088b4
mov rcx, qword [rsp + 0x40]
lea rax, str.SystemUsesLightTheme
test bl, bl
lea r8, str.AppsUseLightTheme
mov r9d, 0x10
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionThemesPersonalize
cmove r8, rax
mov rax, qword [0x171b934f8]
test rax, rax
cmovne rcx, rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
mov eax, dword [rsp + 0x60]
test bl, bl
je 0x171b0885b
test dil, dil
jne 0x171b08870
neg eax
sbb ebx, ebx
add ebx, 0xd4
lea rcx, [rsp + 0x40]
call fcn.171b08884
mov eax, ebx
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
test dil, dil
jne 0x171b2c5e2
neg eax
sbb ebx, ebx
add ebx, 0xd9
jmp 0x171b08843
neg eax
sbb ebx, ebx
add ebx, 0xd6
jmp 0x171b08843
neg eax
sbb ebx, ebx
add ebx, 0xdb
jmp 0x171b08843

Function at 0x171b16db0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov rdi, qword [rsp + 0xa0]
xor ebx, ebx
mov rsi, r9
mov ebp, r8d
mov r14, rdx
mov r15, rcx
test rdi, rdi
je 0x171b16e84
mov qword [rdi], rbx
mov ecx, dword [0x171b92280]
mov byte [rsp + 0xa0], bl
cmp ecx, 0xffffffff
je 0x171b16e9c
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsGetValue]
nop dword [rax + rax]
test rax, rax
je 0x171b16e9c
inc dword [rax + 8]
mov ecx, dword [0x171b92280]
cmp ecx, 0xffffffff
je 0x171b16f18
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsGetValue]
nop dword [rax + rax]
test rax, rax
je 0x171b16f18
mov rcx, qword [rax]
test rcx, rcx
je 0x171b16f18
mov rcx, qword [rcx]
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x40], rdi
mov r9, r14
mov qword [rsp + 0x38], rax
mov r8, r15
mov qword [rsp + 0x30], rbx
xor edx, edx
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], ebp
mov qword [rsp + 0xa0], rbx
call fcn.171b18790
mov rbx, rax
test rax, rax
je 0x171b16f18
mov rax, rbx
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov qword [rsp + 0x80], r12
call fcn.171b1df74
call fcn.171b1b730
mov r12, rax
test rax, rax
je 0x171b16f0b
mov rcx, qword [0x171b92ce0]
xor edx, edx
mov qword [rsp + 0x88], r13
lea r8d, [rdx + 8]
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
nop dword [rax + rax]
mov r13, rax
test rax, rax
je 0x171b3173a
mov rcx, rax
mov qword [rax], rbx
call fcn.171b1df20
test al, al
je 0x171b31732
mov qword [r12], r13
mov dword [r12 + 8], 1
mov r13, qword [rsp + 0x88]
mov r12, qword [rsp + 0x80]
jmp 0x171b16e10
call fcn.171b1b538
jmp 0x171b16e84
mov rcx, r13
call fcn.171b1ad60
lea rcx, [rsp + 0xa0]
mov dword [r12 + 8], ebx
call fcn.171b1e2c0
cmp byte [rsp + 0xa0], bl
je 0x171b16f03
call fcn.171b19e50
nop
jmp 0x171b16f03
Function at 0x171b17b8c
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov ecx, dword [0x171b92280]
xor ebx, ebx
cmp ecx, 0xffffffff
je 0x171b17bb3
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsGetValue]
nop dword [rax + rax]
test rax, rax
je 0x171b17bb3
mov rbx, qword [rax]
mov rax, rbx
add rsp, 0x20
pop rbx
ret

Function at 0x171b17c78
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1e0
mov rax, qword [0x171b91788]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
call fcn.171b17e00
test eax, eax
jne 0x171b17ce4
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.171b28ea0
lea r11, [rsp + 0x1e0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
test byte [0x171b93540], 1
jne 0x171b3185a
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount]
nop dword [rax + rax]
lea rcx, [0x171b92ec8]
xor ebp, ebp
mov r13d, eax
call qword [sym.imp.ntdll.dll_RtlAcquireSRWLockExclusive]
nop dword [rax + rax]
mov rbx, qword [0x171b92a00]
xor edi, edi
cmp dword [rbx + 8], edi
jle 0x171b17dbc
lea esi, [rbp + 1]
xor r14d, r14d
lea r12, [rsp + 0x40]
mov rax, qword [rbx]
mov r15, qword [r14 + rax]
cmp dword [r15 + 0x20], 0
jne 0x171b17dab
mov eax, r13d
sub eax, dword [r15 + 0x58]
cmp eax, 0x3e8
jb 0x171b17dab
test edi, edi
js 0x171b17d82
mov edx, dword [rbx + 8]
cmp esi, edx
je 0x171b17d7c
jg 0x171b17d82
mov rax, qword [rbx]
sub edx, edi
dec edx
movsxd rcx, edi
movsxd r8, edx
shl r8, 3
lea rcx, [rax + rcx*8]
lea rdx, [rcx + 8]
call sub.msvcrt.dll_memmove
mov edx, dword [rbx + 8]
lea eax, [rdx - 1]
mov dword [rbx + 8], eax
lock dec dword [0x171b92a08]
dec edi
dec esi
sub r14, 8
cmp ebp, 0x32
jae 0x171b31883
inc ebp
mov qword [r12], r15
add r12, 8
mov rbx, qword [0x171b92a00]
inc edi
inc esi
add r14, 8
cmp edi, dword [rbx + 8]
jl 0x171b17d32
lea rcx, [0x171b92ec8]
call qword [sym.imp.ntdll.dll_RtlReleaseSRWLockExclusive]
nop dword [rax + rax]
movsxd rdi, ebp
test ebp, ebp
jle 0x171b17cb2
xor ebx, ebx
mov rcx, qword [rsp + rbx*8 + 0x40]
test rcx, rcx
je 0x171b17deb
call fcn.171b19918
inc rbx
cmp rbx, rdi
jge 0x171b17cb2
jmp 0x171b17ddc
lea rax, [rsp + 0x30]
mov r9d, 1
lea rdx, [0x171b68bf8]
mov qword [rsp + 0x20], rax
lea rcx, [0x171b91320]
call fcn.171b38688
nop
jmp 0x171b17cf1
mov rcx, r15
call fcn.171b19918
nop
jmp 0x171b17da4

Function at 0x171b1b730
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x171b92280]
xor eax, eax
cmp ecx, 0xffffffff
je 0x171b1b74d
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsGetValue]
nop dword [rax + rax]
add rsp, 0x28
ret
Function at 0x171b1b9e4
Capabilities:
Check for time delay via gettickcount

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [rcx + 0x20], 3
mov rbx, rcx
je 0x171b3200c
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount]
nop dword [rax + rax]
and dword [rbx + 0x20], 0
mov dword [rbx + 0x58], eax
lock inc dword [0x171b92a08]
add rsp, 0x20
pop rbx
ret
call fcn.171b23b78
and qword [rbx + 0x110], 0
jmp 0x171b1b9f7
Function at 0x171b1c910
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov rdi, rcx
xor ebx, ebx
test rcx, rcx
je 0x171b1c978
call qword [sym.imp.USER32.dll_IsWindow]
nop dword [rax + rax]
test eax, eax
je 0x171b1c978
xor edx, edx
mov r8d, 0x208
mov rcx, qword [0x171b92ce0]
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
nop dword [rax + rax]
mov rbx, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x171b1c978
mov r8d, 0x104
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.USER32.dll_InternalGetWindowText]
nop dword [rax + rax]
test eax, eax
jle 0x171b1c987
mov rax, rbx
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov r8d, 0x104
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindowTextW]
nop dword [rax + rax]
mov dword [rsp + 0x20], eax
jmp 0x171b1c9b0
test eax, eax
jne 0x171b1c978
mov r8, rbx
xor edx, edx
mov rcx, qword [0x171b92ce0]
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
nop dword [rax + rax]
xor ebx, ebx
jmp 0x171b1c978

Function at 0x171b1df74
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
or ebx, 0xffffffff
cmp dword [0x171b92280], ebx
je 0x171b1dfd6
mov rcx, qword [0x171b92ce0]
xor edx, edx
lea r8d, [rdx + 0x10]
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
je 0x171b1dfcf
mov ecx, dword [0x171b92280]
mov rdx, rax
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsSetValue]
nop dword [rax + rax]
test eax, eax
je 0x171b324d2
test rbx, rbx
je 0x171b1dfcf
lock inc dword [0x171b92ec0]
add rsp, 0x20
pop rbx
ret
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsAlloc]
nop dword [rax + rax]
mov ecx, eax
or eax, 0xffffffff
lock cmpxchg dword [0x171b92280], ecx
cmp eax, ebx
jne 0x171b324c0
cmp dword [0x171b92280], ebx
jne 0x171b1df85
jmp 0x171b1dfcf
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsFree]
nop dword [rax + rax]
nop
jmp 0x171b1dff7
mov rcx, qword [0x171b92ce0]
mov r8, rbx
xor edx, edx
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
nop dword [rax + rax]
xor ebx, ebx
jmp 0x171b1dfc3
Function at 0x171b1e234
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 8], rcx
push rsi
sub rsp, 0x40
lea rax, [r11 + 8]
mov dword [rsp + 0x50], 4
mov qword [r11 - 0x18], rax
lea rsi, [0x171b929e8]
mov qword [r11 - 0x20], rsi
lea r8, str.DefaultStartColor
and qword [r11 - 0x28], 0
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerAccent
mov r9d, 0x10
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jle 0x171b1e29a
movzx ebx, ax
or ebx, 0x80070000
test ebx, ebx
jns 0x171b3272e
mov rcx, rsi
call sym.UxTheme.dll_Ordinal_119
mov eax, ebx
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rsi
ret
lea rax, [rsp + 0x50]
mov r9d, 0x10
mov qword [rsp + 0x30], rax
lea r8, str.DefaultAccentColor
lea rax, [0x171b929ec]
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x28], rax
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerAccent
and qword [rsp + 0x20], 0
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jle 0x171b32780
movzx ebx, ax
or ebx, 0x80070000
test ebx, ebx
jns 0x171b1e2aa
jmp 0x171b1e2a2

Function at 0x171b1e2c0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, dword [0x171b92280]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsGetValue]
nop dword [rax + rax]
mov rcx, qword [0x171b92ce0]
xor edx, edx
mov r8, rax
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
nop dword [rax + rax]
mov ecx, dword [0x171b92280]
xor edx, edx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsSetValue]
nop dword [rax + rax]
or eax, 0xffffffff
lock xadd dword [0x171b92ec0], eax
cmp eax, 1
jne 0x171b1e31e
test rbx, rbx
je 0x171b1e31e
mov byte [rbx], al
add rsp, 0x20
pop rbx
ret

Function at 0x171b219b8
Capabilities:
Find taskbar

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov r14, rdx
mov rdi, rcx
xor ebx, ebx
call qword [sym.imp.USER32.dll_IsWindow]
nop dword [rax + rax]
test eax, eax
je 0x171b21a0c
lea rdx, [0x171b680f8]
lea rcx, str.Shell_TrayWnd
call qword [sym.imp.USER32.dll_FindWindowW]
nop dword [rax + rax]
cmp rdi, rax
jne 0x171b33c04
test r14, r14
je 0x171b21a15
or qword [r14], 0xffffffffffffffff
mov rbp, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
call qword [sym.imp.USER32.dll_GetShellWindow]
nop dword [rax + rax]
cmp rdi, rax
je 0x171b21a0c
mov edx, 0xffffffec
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindowLongW]
nop dword [rax + rax]
mov edx, 4
mov rcx, rdi
mov esi, eax
mov ebp, eax
and esi, 0x40000
call qword [sym.imp.USER32.dll_GetWindow]
nop dword [rax + rax]
test rax, rax
je 0x171b33c58
test esi, esi
je 0x171b21a0c
test bpl, bpl
js 0x171b33c67
mov ebx, 1
jmp 0x171b21a15
test esi, esi
jne 0x171b21a15
jmp 0x171b21a0c
Function at 0x171b22020
Capabilities:
Check mutex on windows

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [0x171b932d8]
mov ebx, 0x80004005
test rax, rax
jne 0x171b22067
lea r8, str.LocalSessionImmersiveColorMutex
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_CreateMutexW]
nop dword [rax + rax]
mov rcx, rax
test rax, rax
je 0x171b22067
xor eax, eax
lock cmpxchg qword [0x171b932d8], rcx
jne 0x171b33dc4
mov rax, qword [0x171b932d8]
test rax, rax
je 0x171b22093
mov rcx, qword [0x171b932d8]
or edx, 0xffffffff
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
nop dword [rax + rax]
btr eax, 7
neg eax
sbb ecx, ecx
and ebx, ecx
mov eax, ebx
add rsp, 0x20
pop rbx
ret
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
nop
jmp 0x171b22067

Function at 0x171b22c64
Capabilities:
Get token membership

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x171b91788]
xor rax, rsp
mov qword [rbp - 8], rax
lea r8, [rbp - 0x20]
mov dword [rbp - 0x18], 0x101
lea rdx, [rbp - 0x18]
mov dword [rbp - 0x14], 0x5000000
xor ecx, ecx
mov dword [rbp - 0x10], 0x12
mov bl, 1
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_CheckTokenMembership]
nop dword [rax + rax]
test eax, eax
je 0x171b22cb6
cmp dword [rbp - 0x20], 0
jne 0x171b22cb8
xor bl, bl
mov al, bl
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.171b28ea0
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x171b243c8
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov edi, dword [rcx + 0x4ec]
xor esi, esi
mov rbx, rcx
mov dword [rcx + 0x4ec], 0xfffffffe
lea eax, [rdi - 8]
cmp eax, 1
jbe 0x171b243fc
lea eax, [rdi - 0x14]
cmp eax, 1
ja 0x171b24427
test byte [rcx + 0x28], 1
je 0x171b24427
mov edx, edi
call fcn.171b24d60
test eax, eax
je 0x171b24427
mov rdx, qword [rbx + 0x10]
xor r9d, r9d
mov r8d, edi
mov dword [rsp + 0x20], 1
mov rcx, rbx
call fcn.171b24f74
lea eax, [rdi - 6]
cmp eax, 1
ja 0x171b244c4
test byte [rbx + 0x28], 2
je 0x171b244c4
call fcn.171b09734
test eax, eax
js 0x171b244c4
mov dword [rsp + 0x40], 1
call qword [sym.imp.USER32.dll_GetMessagePos]
nop dword [rax + rax]
mov r8d, eax
lea r9, [rsp + 0x40]
mov rcx, rbx
call fcn.171b29c24
cmp eax, edi
jne 0x171b244a7
call qword [sym.imp.USER32.dll_GetCapture]
nop dword [rax + rax]
test rax, rax
je 0x171b244c4
call qword [sym.imp.USER32.dll_GetCapture]
nop dword [rax + rax]
cmp rax, qword [rbx + 0x10]
jne 0x171b244a7
mov ecx, 1
call qword [sym.imp.USER32.dll_GetKeyState]
nop dword [rax + rax]
test ax, ax
js 0x171b244c4
mov rcx, qword [rbx + 0x10]
cmp edi, 7
mov rax, qword [0x171b92998]
sete sil
xor edx, edx
mov r8d, esi
call qword [0x171b66fd8]
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x171b253b4
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x171b91788]
xor rax, rsp
mov qword [rsp + 0x58], rax
lea rax, [r11 - 0x28]
mov dword [rsp + 0x40], 0x10
mov qword [r11 - 0x38], rax
mov rdi, rdx
lea rax, [r11 - 0x20]
mov r8, rcx
mov qword [r11 - 0x40], rax
lea rdx, str.SoftwarePoliciesMicrosoftWindowsPersonalization
and qword [r11 - 0x48], 0
mov r9d, 2
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jle 0x171b25421
movzx ebx, ax
or ebx, 0x80070000
test ebx, ebx
jns 0x171b2b1cc
mov eax, ebx
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.171b28ea0
mov rbx, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret
cmp word [rsp + 0x48], 0x23
jne 0x171b2b212
xor edx, edx
lea rcx, [rsp + 0x4a]
lea r8d, [rdx + 0x10]
call qword [sym.imp.msvcrt.dll_wcstol]
nop dword [rax + rax]
mov ecx, eax
sar eax, 8
movzx edx, al
movzx eax, cl
or eax, 0xffffff00
shl edx, 8
shl eax, 0x10
sar ecx, 0x10
or edx, eax
movzx eax, cl
or edx, eax
mov dword [rdi], edx
jmp 0x171b25429
mov ebx, 0x80070057
jmp 0x171b25429