joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140170060
Capabilities:
Get graphical window text

Disassembly:
sub rsp, 0x28
mov rdx, qword [0x1403c44c0]
mov rcx, qword [rcx + 0xb0]
mov r8d, reloc.mfc100.dll_Ordinal_300
call qword [sym.imp.USER32.dll_GetWindowTextA]
mov rax, qword [0x1403c44c0]
add rsp, 0x28
ret

Function at 0x140170090
Capabilities:
Get graphical window text

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
lea rbp, [rsp - 0xa0]
sub rsp, 0x1a0
mov rax, qword [0x1403c2c80]
xor rax, rsp
mov qword [rbp + 0x90], rax
mov rax, qword [rcx]
mov edi, r8d
mov esi, edx
lea r8, [rsp + 0x54]
lea rdx, [rsp + 0x50]
mov rbx, rcx
mov dword [rsp + 0x40], r9d
call qword [rax + Ordinal_305]
mov r11d, dword [rbp + 0xf8]
cmp esi, 0xffffffff
je 0x1401700e9
test r11b, 4
je 0x1401700ed
mov esi, dword [rsp + 0x50]
cmp edi, 0xffffffff
je 0x1401700f8
test r11b, 4
je 0x1401700fc
mov edi, dword [rsp + 0x54]
cmp dword [rsp + 0x40], 0xffffffff
jne 0x14017012e
cmp dword [rbp + 0xf0], 0xffffffff
jne 0x14017012e
and r11d, 3
cmp r11b, 3
je 0x14017012e
mov rax, qword [rbx]
lea r8, [rbp + 0xf0]
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [rax + Ordinal_300]
mov r12, qword [rbx + 0xb0]
mov r9, qword [rbx + 0x138]
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x44]
mov rcx, r12
call fcn.14017f390
lea rdx, [rsp + 0x60]
mov r8d, reloc.mfc100.dll_Ordinal_300
mov rcx, r12
call qword [sym.imp.USER32.dll_GetWindowTextA]
mov rax, qword [rbx + 0x138]
mov r11, qword [rbx]
xor ecx, ecx
lea r9, [rsp + 0x4c]
lea r8, [rsp + 0x48]
mov dword [rsp + 0x38], ecx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rcx
lea rdx, [rsp + 0x60]
mov rcx, rbx
call qword [r11 + 0x200]
mov r9d, dword [rsp + 0x40]
test r9d, r9d
jns 0x1401701c2
mov eax, dword [rsp + 0x44]
lea ecx, [rax + rax*2]
movd xmm0, ecx
cvtdq2ps xmm0, xmm0
addss xmm0, dword [rsp + 0x48]
cvttss2si r9d, xmm0
mov dword [rsp + 0x40], r9d
mov eax, dword [rbp + 0xf0]
test eax, eax
jns 0x1401701e7
movd xmm0, dword [rsp + 0x4c]
cvtps2pd xmm0, xmm0
mulsd xmm0, qword [0x1402d7ed0]
cvttsd2si eax, xmm0
mov dword [rbp + 0xf0], eax
mov r8d, edi
mov edx, esi
mov rcx, r12
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_MoveWindow]
mov r11, qword [rbx]
mov rcx, rbx
call qword [r11 + 0x2f0]
mov r8d, dword [rbp + 0xf0]
mov edx, dword [rsp + 0x40]
mov r9, qword [rax]
mov rcx, rax
call qword [r9 + 0x60]
mov rcx, qword [rbp + 0x90]
xor rcx, rsp
call fcn.1402912a0
add rsp, 0x1a0
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140171b00
Capabilities:
Get graphical window text

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx + 0x200]
test rcx, rcx
je 0x140171b2f
mov rdx, qword [0x1403c44c0]
mov r8d, reloc.mfc100.dll_Ordinal_300
call qword [sym.imp.USER32.dll_GetWindowTextA]
mov rax, qword [0x1403c44c0]
add rsp, 0x28
ret
xor eax, eax
add rsp, 0x28
ret

Function at 0x140173d40
Capabilities:
Get graphical window text

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r15
sub rsp, 0x1a0
mov rax, qword [0x1403c2c80]
xor rax, rsp
mov qword [rsp + 0x190], rax
mov rax, qword [rcx]
mov r12d, r8d
mov r13d, edx
lea r8, [rsp + 0x54]
lea rdx, [rsp + 0x44]
mov r15d, r9d
mov rbx, rcx
call qword [rax + Ordinal_305]
mov edi, dword [rsp + 0x208]
cmp r13d, 0xffffffff
je 0x140173d96
test dil, 4
je 0x140173d9b
mov r13d, dword [rsp + 0x44]
cmp r12d, 0xffffffff
je 0x140173da7
test dil, 4
je 0x140173dac
mov r12d, dword [rsp + 0x54]
mov rcx, qword [rbx + 0xb0]
mov esi, dword [rsp + 0x200]
lea rdx, [rsp + 0x60]
mov r8d, reloc.mfc100.dll_Ordinal_300
mov ebp, r15d
call qword [sym.imp.USER32.dll_GetWindowTextA]
mov rax, qword [rbx + 0x140]
mov r10, qword [rbx]
xor ecx, ecx
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x40]
mov dword [rsp + 0x38], ecx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rcx
lea rdx, [rsp + 0x60]
mov rcx, rbx
call qword [r10 + 0x200]
mov r11, qword [rbx]
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x4c]
mov rcx, rbx
call qword [r11 + Ordinal_300]
cmp r15d, 0xffffffff
jne 0x140173e5f
test dil, 1
jne 0x140173e2f
mov ebp, dword [rsp + 0x4c]
jmp 0x140173e5f
mov r9, qword [rbx + 0x140]
mov rcx, qword [rbx + 0xb0]
lea r8, [rsp + 0x5c]
lea rdx, [rsp + 0x58]
call fcn.14017f390
movd xmm5, dword [rsp + 0x58]
cvtdq2ps xmm5, xmm5
addss xmm5, dword [rsp + 0x40]
cvttss2si ebp, xmm5
cmp esi, 0xffffffff
jne 0x140173e74
mov esi, dword [rsp + 0x48]
test dil, 2
je 0x140173e74
cvttss2si esi, dword [rsp + 0x50]
mov rcx, qword [rbx + 0xb0]
mov r9d, ebp
mov r8d, r12d
mov edx, r13d
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], esi
call qword [sym.imp.USER32.dll_MoveWindow]
cmp r15d, 0xffffffff
jne 0x140173ea6
cmp dword [rsp + 0x200], r15d
je 0x140173ec1
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x2f0]
mov r8d, esi
mov edx, ebp
mov r9, qword [rax]
mov rcx, rax
call qword [r9 + 0x60]
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.1402912a0
add rsp, 0x1a0
pop r15
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x140174880
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0xb0]
call qword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov rcx, qword [0x1403c69a0]
movsxd rdi, eax
test rcx, rcx
je 0x1401748ae
call fcn.140290ef0
lea edx, [rdi + 2]
movsxd rcx, edx
call sub.mfc100.dll_Ordinal_265
lea ecx, [rdi + 1]
mov edx, 0xd
movsxd r8, ecx
mov rcx, qword [rbx + 0xb0]
mov r9, rax
mov qword [0x1403c69a0], rax
call qword [sym.imp.USER32.dll_SendMessageA]
mov rax, qword [0x1403c69a0]
mov rbx, qword [rsp + 0x30]
mov byte [rdi + rax], 0
add rsp, 0x20
pop rdi
ret
Function at 0x140174900
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [rcx + 0xb0]
mov esi, r8d
mov rbp, rdx
call qword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov rcx, qword [rdi + 0xb0]
mov ebx, eax
mov eax, 0x7ffe
mov rdx, rbp
cmp esi, eax
cmovg esi, eax
cmp ebx, esi
cmovg ebx, esi
mov r8d, ebx
call qword [sym.imp.USER32.dll_GetWindowTextA]
cmp ebx, esi
jne 0x140174959
movsxd rax, esi
mov byte [rax + rbp], 0
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140176460
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
xor ebx, ebx
mov rbp, rdx
mov rsi, rcx
cmp dword [rcx + 0x210], ebx
jle 0x1401764e5
mov r9, qword [0x1403c44c0]
mov edi, ebx
nop dword [rax]
mov rcx, qword [rsi + 0x228]
mov r8d, 0x3e8
mov rdx, r9
mov rcx, qword [rcx + rdi]
call qword [sym.imp.USER32.dll_GetWindowTextA]
mov r9, qword [0x1403c44c0]
mov r8, rbp
mov rax, r9
sub r8, r9
nop word [rax + rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x1401764d3
inc rax
test ecx, ecx
jne 0x1401764c0
test edx, edx
je 0x1401764fd
inc ebx
add rdi, 8
cmp ebx, dword [rsi + 0x210]
jl 0x140176490
or eax, 0xffffffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov eax, ebx
jmp 0x1401764e8

Function at 0x1401765c0
Capabilities:
Get graphical window text

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx + 0x228]
movsxd rax, edx
mov rdx, qword [0x1403c44c0]
mov rcx, qword [rcx + rax*8]
mov r8d, 0x3e8
call qword [sym.imp.USER32.dll_GetWindowTextA]
mov rax, qword [0x1403c44c0]
add rsp, 0x28
ret
Function at 0x140176c70
Capabilities:
Get graphical window text

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx + 0xb0]
test rcx, rcx
je 0x140176c9f
mov rdx, qword [0x1403c44c0]
mov r8d, reloc.mfc100.dll_Ordinal_300
call qword [sym.imp.USER32.dll_GetWindowTextA]
mov rax, qword [0x1403c44c0]
add rsp, 0x28
ret
xor eax, eax
add rsp, 0x28
ret
Function at 0x140179840
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
call fcn.1401792c0
test dword [rsi + 0x2c], 0x1000000
je 0x1401798a1
mov rcx, qword [rsi + 0xb0]
call qword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea edi, [rax + 1]
movsxd rcx, edi
call sub.mfc100.dll_Ordinal_265
mov rcx, qword [rsi + 0xb0]
mov r8d, edi
mov rdx, rax
mov rbx, rax
call qword [sym.imp.USER32.dll_GetWindowTextA]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsi + 0x90]
xor r8d, r8d
mov rdx, qword [rbx + 0xc8]
test rdx, rdx
je 0x1401798db
nop word [rax + rax]
mov rdi, qword [rdx + 0x10]
mov rdx, qword [rdx + 0x18]
or rcx, 0xffffffffffffffff
xor eax, eax
repne scasb al, byte [rdi]
not rcx
add r8d, ecx
test rdx, rdx
jne 0x1401798c0
lea eax, [r8 + 1]
movsxd rcx, eax
call sub.mfc100.dll_Ordinal_265
mov r10, qword [rbx + 0xc8]
xor r9d, r9d
xor edx, edx
mov r11, rax
test r10, r10
je 0x140179949
nop dword [rax + rax]
mov rbx, qword [r10 + 0x10]
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasb al, byte [rdi]
xor edi, edi
not rcx
dec rcx
movsxd r8, ecx
test ecx, ecx
jle 0x140179935
add r9d, r8d
movzx eax, byte [rdi + rbx]
inc rdi
inc rdx
mov byte [rdx + r11 - 1], al
cmp rdi, r8
jl 0x140179921
mov byte [rdx + r11], 0xa
mov r10, qword [r10 + 0x18]
inc r9d
inc rdx
test r10, r10
jne 0x140179900
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
movsxd rax, r9d
mov byte [rax + r11], 0
mov rax, r11
add rsp, 0x20
pop rdi
ret
Function at 0x14017aa10
Capabilities:
Get graphical window text

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x150
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov rbx, rdx
mov rdi, rcx
test rdx, rdx
jne 0x14017aa47
mov rbx, qword [rcx + 0x128]
test rbx, rbx
je 0x14017aaf4
mov rcx, qword [rcx + 0x128]
test rcx, rcx
je 0x14017aa58
call fcn.140290ef0
mov rcx, rbx
call fcn.140181940
mov qword [rdi + 0x128], rax
mov dword [rsp + 0x20], 1
mov r9d, 0x40
lea r8d, [r9 - 0x3e]
mov rdx, rbx
lea rcx, [rsp + 0x40]
call fcn.14000cdc0
nop
mov rax, qword [rsp + 0x40]
movsxd rcx, dword [rax + 4]
mov eax, dword [rsp + rcx + 0x50]
shr eax, 2
test al, 1
je 0x14017aafb
lea rax, [rsp + 0xe8]
mov qword [rsp + 0x168], rax
lea rax, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rsp + rcx + 0x40], rax
lea rcx, [rsp + 0x48]
call fcn.140007090
nop
mov rax, qword [rsp + 0x40]
movsxd rcx, dword [rax + 4]
mov rax, qword [sym.imp.MSVCP100.dll_const_std::basic_ostream_char__struct_std::char_traits_char__::vftable]
mov qword [rsp + rcx + 0x40], rax
mov rax, qword [sym.imp.MSVCP100.dll_const_std::ios_base::vftable]
mov qword [rsp + 0xe8], rax
lea rcx, [rsp + 0xe8]
call qword [sym.imp.MSVCP100.dll_private:_static_void___cdecl_std::ios_base::_Ios_base_dtor_class_std::ios_base____ptr64_]
xor eax, eax
jmp 0x14017abdb
test dword [rdi + 0x2c], 0x1000000
je 0x14017ab8e
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0xe]
mov rcx, qword [rdi + 0xb0]
call qword [sym.imp.USER32.dll_SendMessageA]
inc eax
mov ebx, eax
mov ecx, eax
call qword [sym.imp.MSVCR100.dll_malloc]
mov rsi, rax
mov r9, rax
mov r8d, ebx
mov edx, 0xd
mov rcx, qword [rdi + 0xb0]
call qword [sym.imp.USER32.dll_SendMessageA]
mov rbx, rsi
cmp byte [rsi], 0
je 0x14017ab6a
nop
movzx edx, byte [rbx]
cmp dl, 0xd
je 0x14017ab62
lea rcx, [rsp + 0x40]
call fcn.14000fe74
inc rbx
cmp byte [rbx], 0
jne 0x14017ab50
mov rcx, rsi
call qword [sym.imp.MSVCR100.dll_free]
xor r9d, r9d
xor r8d, r8d
mov edx, 0xb9
mov rcx, qword [rdi + 0xb0]
call qword [sym.imp.USER32.dll_SendMessageA]
nop
jmp 0x14017abcc
mov rax, qword [rdi + 0x90]
mov rbx, qword [rax + 0xc8]
test rbx, rbx
je 0x14017abcc
mov rdx, qword [rbx + 0x10]
test rdx, rdx
je 0x14017abc3
lea rcx, [rsp + 0x40]
call fcn.1400090e0
mov rcx, rax
lea rdx, [0x140328168]
call fcn.1400090e0
mov rbx, qword [rbx + 0x18]
test rbx, rbx
jne 0x14017aba1
lea rcx, [rsp + 0x40]
call fcn.140003f20
mov eax, 1
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x14017b2d0
Capabilities:
Get graphical window text

Disassembly:
sub rsp, 0x28
mov rdx, qword [0x1403c44c0]
mov rcx, qword [rcx + 0xb0]
mov r8d, 0x3e7
call qword [sym.imp.USER32.dll_GetWindowTextA]
mov rax, qword [0x1403c44c0]
add rsp, 0x28
ret
Function at 0x140180950
Capabilities:
Log keystrokes via polling

Disassembly:
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xb0
mov qword [rbp + 0x27], 0xfffffffffffffffe
mov qword [rsp + 0xe0], rbx
mov rax, qword [0x1403c2c80]
xor rax, rsp
mov qword [rbp + 0x3f], rax
mov rsi, r8
mov rdi, rcx
test r9d, r9d
je 0x1401809be
movzx ebx, dx
lea eax, [rbx - 1]
cmp eax, 0x19
ja 0x1401809d0
mov ecx, ebx
sub ecx, 8
je 0x1401809b7
dec ecx
je 0x1401809b0
cmp ecx, 4
je 0x1401809a9
add ebx, 0x60
jmp 0x1401809d0
mov ebx, 0xd
jmp 0x1401809d9
mov ebx, 9
jmp 0x1401809d9
mov ebx, 8
jmp 0x1401809d9
movzx ecx, dx
call fcn.14017f480
mov ebx, eax
test eax, eax
je 0x140180b0c
cmp ebx, 0xffffffff
jle 0x140180b0c
cmp qword [rdi + 0xa0], 0
je 0x140180b0c
mov edx, Ordinal_10054
lea rcx, [rbp - 0x29]
call fcn.1401650f0
nop
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetKeyState]
movzx r11d, ax
and r11d, 0x100
shr r11d, 8
mov dword [rbp + 0x17], r11d
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
movzx r11d, ax
and r11d, 0x100
shr r11d, 8
mov dword [rbp + 0x13], r11d
shr rsi, 0x10
mov edx, 0x2000
and si, dx
mov eax, dword [rbp + 0x1b]
mov ecx, 1
cmp si, dx
cmove eax, ecx
mov dword [rbp + 0x1b], eax
mov rax, qword [rdi + 0xa0]
mov qword [rbp - 9], rax
mov dword [rbp + 0xf], ebx
mov edx, dword [0x1403c6948]
lea rcx, [rbp - 0x29]
call fcn.1401456e0
lea rcx, [rbp - 0x31]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rdx, [rbp + 0x2f]
mov rcx, qword [rdi + 0x60]
call qword [sym.imp.USER32.dll_GetWindowRect]
mov r11d, dword [rbp - 0x31]
sub r11d, dword [rbp + 0x2f]
mov dword [rbp - 0x31], r11d
mov eax, dword [rbp - 0x2d]
sub eax, dword [rbp + 0x33]
mov dword [rbp - 0x2d], eax
movd xmm0, r11d
cvtdq2ps xmm0, xmm0
movss dword [rbp - 0x35], xmm0
movd xmm1, eax
cvtdq2ps xmm1, xmm1
movss dword [rbp - 0x39], xmm1
lea r8, [rbp - 0x39]
lea rdx, [rbp - 0x35]
mov rcx, rdi
call fcn.140146560
mov r11, qword [rdi]
cvttss2si r8d, dword [rbp - 0x39]
cvttss2si edx, dword [rbp - 0x35]
lea rax, [rbp + 0xb]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 7]
mov rcx, rdi
call qword [r11 + 0x30]
mov rcx, qword [rdi + 0xa0]
mov rax, qword [rcx]
call qword [rax + 0x2f0]
mov r8, qword [rax]
lea rdx, [rbp - 0x29]
mov rcx, rax
call qword [r8 + 0x78]
nop
lea rcx, [rbp - 0x29]
call fcn.140183b50
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.1402912a0
mov rbx, qword [rsp + 0xe0]
add rsp, 0xb0
pop rdi
pop rsi
pop rbp
ret
Function at 0x140181de0
Capabilities:
Move file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rbx, rcx
call qword [sym.imp.MSVCR100.dll_rename]
test eax, eax
je 0x140181e11
mov rdx, rdi
mov rcx, rbx
call fcn.140181d40
test eax, eax
je 0x140181e21
mov rcx, rbx
call fcn.1401820f0
mov eax, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140181ff0
Capabilities:
Get hostname

Disassembly:
sub rsp, 0x28
mov dword [rsp + 0x38], edx
lea rdx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetComputerNameA]
add rsp, 0x28
ret

Function at 0x140182010
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, rcx
lea rcx, str.USER
mov edi, edx
call qword [sym.imp.MSVCR100.dll_getenv]
mov rdx, rax
test rax, rax
jne 0x140182080
lea rcx, str.LOGNAME
call qword [sym.imp.MSVCR100.dll_getenv]
mov rdx, rax
test rax, rax
jne 0x140182080
lea eax, [rdi - 1]
lea r8, str.anonymous
lea rdx, str.UserId
lea rcx, str.wxWindows
mov r9, rbx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_GetProfileStringA]
xor eax, eax
cmp byte [rbx], al
setne al
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
lea eax, [rdi - 1]
mov rcx, rbx
movsxd r8, eax
call qword [sym.imp.MSVCR100.dll_strncpy]
xor eax, eax
cmp byte [rbx], al
mov rbx, qword [rsp + 0x40]
setne al
add rsp, 0x30
pop rdi
ret

Function at 0x140182110
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x250
mov rax, qword [0x1403c2c80]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rdi, rdx
mov rbx, rcx
lea rdx, [rsp + 0x130]
mov ecx, Ordinal_262
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
lea r9, [rsp + 0x20]
lea rcx, [rsp + 0x130]
xor r8d, r8d
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test rdi, rdi
je 0x140182194
lea rax, [rsp + 0x20]
mov r8, rdi
lea rdx, [rsp + 0x20]
sub r8, rax
nop word [rax + rax]
movzx ecx, byte [rdx]
inc rdx
mov byte [r8 + rdx - 1], cl
test cl, cl
jne 0x140182180
mov rax, rdi
jmp 0x14018219e
lea rcx, [rsp + 0x20]
call fcn.140181940
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1402912a0
mov rbx, qword [rsp + 0x270]
add rsp, 0x250
pop rdi
ret

Function at 0x1401821c0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov rax, qword [0x1403d7898]
cmp dword [rax + 0x10], 0
je 0x140182207
mov rdx, rcx
lea r8, [rsp + 0x38]
lea rcx, [0x1403d72c0]
call qword [sym.imp.USER32.dll_wvsprintfA]
lea rcx, [0x1403d72c0]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add rsp, 0x28
ret
Function at 0x140182390
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
lea rbx, str.__default
mov rdi, r8
mov r8, rbx
test r9, r9
je 0x140182403
mov qword [rsp + 0x28], r9
mov r9, qword [0x1403c44c0]
mov dword [rsp + 0x20], 0x3e8
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x1401823f6
mov r8, qword [0x1403c44c0]
mov rax, r8
sub rbx, r8
nop word [rax + rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + rbx]
sub edx, ecx
jne 0x1401823f2
inc rax
test ecx, ecx
jne 0x1401823e0
test edx, edx
jne 0x140182446
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov r9, qword [0x1403c44c0]
mov dword [rsp + 0x20], 0x3e8
call qword [sym.imp.KERNEL32.dll_GetProfileStringA]
test eax, eax
je 0x1401823f6
mov r8, qword [0x1403c44c0]
mov rax, r8
sub rbx, r8
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + rbx]
sub edx, ecx
jne 0x140182442
inc rax
test ecx, ecx
jne 0x140182430
test edx, edx
je 0x1401823f6
mov rcx, qword [rdi]
test rcx, rcx
je 0x14018245a
call fcn.140290ef0
mov r8, qword [0x1403c44c0]
mov rcx, r8
call fcn.140181940
mov rbx, qword [rsp + 0x40]
mov qword [rdi], rax
mov eax, 1
add rsp, 0x30
pop rdi
ret

Function at 0x140186d10
Capabilities:
Get graphical window text

Disassembly:
sub rsp, 0x28
mov rax, qword [rcx + 0x200]
test rax, rax
je 0x140186d25
mov rcx, rax
jmp 0x140186d31
mov rcx, qword [rcx + 0xb0]
test rcx, rcx
je 0x140186d50
mov rdx, qword [0x1403c44c0]
mov r8d, 0x3e8
call qword [sym.imp.USER32.dll_GetWindowTextA]
mov rax, qword [0x1403c44c0]
add rsp, 0x28
ret
xor eax, eax
add rsp, 0x28
ret
Function at 0x140192d10
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov r8, qword [0x1403d9000]
movzx eax, byte [0x1403d8fb0]
mov r10, qword [0x1403d8fc0]
mov byte [r8], al
mov rbx, qword [r10 + 8]
mov r11, rdx
lea rax, [rbx + 2]
movzx edi, cl
cmp r8, rax
jae 0x140192ddb
mov eax, dword [r10 + 0x18]
add eax, 2
movsxd r9, eax
mov eax, dword [0x1403d8fc8]
add eax, 2
add r9, rbx
movsxd rcx, eax
add rcx, rbx
cmp rcx, rbx
jbe 0x140192d83
nop word [rax + rax]
movzx eax, byte [rcx - 1]
dec rcx
dec r9
mov byte [r9], al
cmp rcx, qword [r10 + 8]
ja 0x140192d70
mov eax, dword [r10 + 0x18]
sub r9, rcx
mov dword [0x1403d8fc8], eax
mov rax, qword [r10 + 8]
add r8, r9
add rax, 2
add r11, r9
cmp r8, rax
jae 0x140192ddb
call qword [sym.imp.MSVCR100.dll___iob_func]
lea rcx, str.flex_scanner_push_back_overflow
lea rdx, [rax + 0x60]
call qword [sym.imp.MSVCR100.dll_fputs]
call qword [sym.imp.MSVCR100.dll___iob_func]
mov ecx, 0xa
lea rdx, [rax + 0x60]
call qword [sym.imp.MSVCR100.dll_putc]
mov ecx, 1
call qword [sym.imp.MSVCR100.dll_exit]
int3
cmp r8, r11
jbe 0x140192dec
cmp byte [r8 - 1], 0xa
jne 0x140192dec
mov byte [r8 - 2], 0xa
mov rbx, qword [rsp + 0x30]
dec r8
mov byte [r8], dil
mov qword [0x140408f00], r11
mov eax, r8d
sub eax, r11d
mov qword [0x1403d9000], r8
mov dword [0x140408f14], eax
movzx eax, byte [r8]
mov byte [r8], 0
mov byte [0x1403d8fb0], al
add rsp, 0x20
pop rdi
ret

Function at 0x140192f10
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
movzx eax, byte [0x1403d8fb0]
mov rcx, qword [0x1403d9000]
mov byte [rcx], al
test al, al
jne 0x14019301a
mov r9, qword [0x1403d8fc0]
nop word [rax + rax]
movsxd rax, dword [0x1403d8fc8]
add rax, qword [r9 + 8]
cmp rcx, rax
jb 0x140193017
mov qword [0x140408f00], rcx
inc rcx
mov qword [0x1403d9000], rcx
call fcn.140193160
test eax, eax
je 0x14019300e
dec eax
jne 0x140192fc9
call fcn.14017df50
test eax, eax
jne 0x140192fb3
mov r9, qword [0x1403d8fc0]
mov rdx, qword [0x1403d8ff0]
mov rcx, r9
call fcn.140192e70
call fcn.140192e30
movzx r8d, byte [0x1403d8fb0]
mov rcx, qword [0x1403d9000]
mov byte [rcx], r8b
test r8b, r8b
je 0x140192f40
jmp 0x14019301a
mov rax, qword [0x140408f00]
mov qword [0x1403d9000], rax
or eax, 0xffffffff
add rsp, 0x28
ret
dec eax
je 0x140192fd6
mov rcx, qword [0x1403d9000]
jmp 0x14019301a
call qword [sym.imp.MSVCR100.dll___iob_func]
lea rcx, str.unexpected_last_match_in_input__
lea rdx, [rax + 0x60]
call qword [sym.imp.MSVCR100.dll_fputs]
call qword [sym.imp.MSVCR100.dll___iob_func]
mov ecx, 0xa
lea rdx, [rax + 0x60]
call qword [sym.imp.MSVCR100.dll_putc]
mov ecx, 1
call qword [sym.imp.MSVCR100.dll_exit]
int3
mov rcx, qword [0x140408f00]
jmp 0x14019301a
mov byte [rcx], 0
movzx eax, byte [rcx]
inc rcx
mov qword [0x1403d9000], rcx
movzx ecx, byte [rcx]
mov byte [0x1403d8fb0], cl
add rsp, 0x28
ret
Function at 0x140193040
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov ecx, 0x28
mov edi, edx
call qword [sym.imp.MSVCR100.dll_malloc]
mov rbx, rax
test rax, rax
jne 0x14019309b
call qword [sym.imp.MSVCR100.dll___iob_func]
lea rcx, str.out_of_dynamic_memory_in_yy_create_buffer__
lea rdx, [rax + 0x60]
call qword [sym.imp.MSVCR100.dll_fputs]
call qword [sym.imp.MSVCR100.dll___iob_func]
lea ecx, [rbx + 0xa]
lea rdx, [rax + 0x60]
call qword [sym.imp.MSVCR100.dll_putc]
lea ecx, [rbx + 1]
call qword [sym.imp.MSVCR100.dll_exit]
int3
lea ecx, [rdi + 2]
mov dword [rax + 0x18], edi
call qword [sym.imp.MSVCR100.dll_malloc]
mov qword [rbx + 8], rax
test rax, rax
jne 0x1401930e8
call qword [sym.imp.MSVCR100.dll___iob_func]
lea rcx, str.out_of_dynamic_memory_in_yy_create_buffer__
lea rdx, [rax + 0x60]
call qword [sym.imp.MSVCR100.dll_fputs]
call qword [sym.imp.MSVCR100.dll___iob_func]
mov ecx, 0xa
lea rdx, [rax + 0x60]
call qword [sym.imp.MSVCR100.dll_putc]
mov ecx, 1
call qword [sym.imp.MSVCR100.dll_exit]
int3
mov rdx, rsi
mov rcx, rbx
call fcn.140192e70
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140193120
Capabilities:
Terminate process

Disassembly:
jmp fcn.140192f10
cmp dword [0x1403d8fd4], 0
je 0x140193153
mov rdx, qword [0x1403d8fe8]
cmp rdx, qword [0x1403d8fd8]
jne 0x14019313c
xor eax, eax
ret
mov rax, qword [0x1403d8fe0]
inc rdx
movsx eax, byte [rax + rdx - 1]
mov qword [0x1403d8fe8], rdx
ret
jmp 0x140193110