joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400180e0
Capabilities:
Get keyboard layout

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x198]
sub rsp, 0x298
mov rax, qword [0x1401f5698]
xor rax, rsp
mov qword [rbp + 0x180], rax
mov rsi, r9
mov r12, r8
mov r14d, edx
mov rdi, rcx
mov eax, dword [rcx + 0x5728]
mov dword [rsp + 0x30], eax
mov r15, qword [rcx + 0x5730]
mov edx, 2
mov rcx, qword [0x14022ab50]
call fcn.14007f158
xor ebx, ebx
test eax, eax
je 0x14001818f
lea rax, str.WM_INPUTLANGCHANGE
lea r8, str.WM_INPUTLANGCHANGEREQUEST
cmp r14d, 0x51
cmove r8, rax
mov qword [rsp + 0x20], rsi
mov r9d, r12d
lea rdx, str.CConEmuMain::OnLangChange:__s_CP:_i__HKL:0x_08I64X_
lea rcx, [rbp - 0x80]
call fcn.14000c8e8
mov rcx, qword [rdi + 0x3e70]
test rcx, rcx
je 0x14001818f
mov byte [rsp + 0x20], 1
xor r9d, r9d
mov r8b, 1
lea rdx, [rbp - 0x80]
call fcn.14011c0a8
mov dword [rdi + 0x5728], r14d
mov qword [rdi + 0x5730], rsi
mov r9, rsi
mov r8, r12
mov edx, r14d
mov rcx, qword [0x14022a9e8]
call qword [sym.imp.USER32.dll_DefWindowProcW]
mov r13, rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x60], xmm0
mov word [rsp + 0x70], ax
lea rcx, [rsp + 0x60]
call qword [sym.imp.USER32.dll_GetKeyboardLayoutNameW]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov r8d, 0x10
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x60]
call fcn.1401358d0
or edx, 0xffffffff
mov r9d, ebx
lea r8, [rdi + 0x573c]
cmp dword [r8 - 4], ebx
jne 0x14001820f
mov ecx, r9d
cmp edx, 0xffffffff
cmovne ecx, edx
mov edx, ecx
jmp 0x140018214
cmp dword [r8], eax
je 0x140018234
inc r9d
add r8, 0x10
cmp r9d, 0x14
jl 0x1400181fc
cmp edx, 0xffffffff
je 0x140018234
mov r9, rsi
mov r8d, eax
mov rcx, rdi
call fcn.1400227e4
lea eax, [r14 - 0x50]
cmp eax, 1
ja 0x14001829f
lea rcx, [rsp + 0x40]
call fcn.1401086e4
nop
xor edx, edx
lea rcx, [rsp + 0x40]
call fcn.140102fa8
test eax, eax
js 0x140018295
mov rcx, qword [rsp + 0x48]
call fcn.14010f780
test rax, rax
je 0x140018295
cmp dword [rsp + 0x30], 0x50
jne 0x14001827e
cmp r14d, 0x51
jne 0x14001827e
cmp r15, rsi
je 0x140018295
test r15, r15
je 0x140018295
cmp r14d, 0x50
cmove rbx, r12
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.1400b77ec
nop
lea rcx, [rsp + 0x40]
call fcn.14010878c
mov qword [rdi + 0x5720], rsi
mov rcx, qword [rdi + 0x3e60]
call fcn.1400e5944
mov rax, r13
mov rcx, qword [rbp + 0x180]
xor rcx, rsp
call fcn.14012bda0
add rsp, 0x298
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140022924
Capabilities:
Get common file path
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
lea rbp, [rax - 0x778]
sub rsp, 0x870
mov rax, qword [0x1401f5698]
xor rax, rsp
mov qword [rbp + 0x760], rax
xor esi, esi
mov rbx, rcx
test rdx, rdx
je 0x14002298f
cmp word [rdx], 0x3a
je 0x14002298f
lea rdi, [rcx + 0x10fe]
cmp word [rdx], si
je 0x140022ad0
mov byte [rcx + 0x1358], 1
mov rcx, rdi
call fcn.14000c940
mov rcx, rdi
call fcn.1401136b0
jmp 0x140022ad0
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x20a
call fcn.14012d4b0
lea rdx, [rsp + 0x20]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
dec eax
cmp eax, 0x103
ja 0x1400229c6
lea rcx, [rsp + 0x20]
call fcn.1401136b0
jmp 0x1400229cb
mov word [rsp + 0x20], si
cmp byte [rbx + 0x7c8], sil
jne 0x140022abc
xor edx, edx
lea rcx, [rbp + 0x130]
mov r8d, 0x208
call fcn.14012d4b0
mov edx, 0xfa
lea rcx, [rbp + 0x130]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x140022a0e
lea rcx, [rbp + 0x130]
call fcn.1401136b0
lea rdx, [rbp + 0x130]
lea rcx, [rbp + 0x340]
call fcn.1400047d8
lea r8, str._system32
mov edx, 0x104
lea rcx, [rbp + 0x340]
call fcn.140001e48
cmp word [rsp + 0x20], si
je 0x140022a82
lea rdx, [rbp + 0x130]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140022a82
lea rdx, [rbp + 0x340]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140022a82
lea rdx, [rbx + 0xcea]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x140022abc
xor r9d, r9d
lea rdx, [rsp + 0x20]
xor ecx, ecx
lea r8d, [r9 + 0x28]
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x140022aa4
lea rcx, [rsp + 0x20]
call fcn.1401136b0
cmp word [rsp + 0x20], si
jne 0x140022abc
lea rdx, [rbx + 0xcea]
lea rcx, [rsp + 0x20]
call fcn.14000c940
lea rdi, [rbx + 0x10fe]
mov rcx, rdi
lea rdx, [rsp + 0x20]
call fcn.14000c940
mov r8d, 0x104
lea rdx, [rbp + 0x550]
mov rcx, rdi
call fcn.1401175e8
mov rdx, rax
lea rcx, str.ConEmuWorkDrive
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, qword [rbp + 0x760]
xor rcx, rsp
call fcn.14012bda0
lea r11, [rsp + 0x870]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x140022bc8
Capabilities:
Get keyboard layout

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x2e0
mov rax, qword [0x1401f5698]
xor rax, rsp
mov qword [rsp + 0x2d0], rax
mov rdi, rcx
mov esi, 1
mov rcx, qword [0x14022ab50]
mov rbx, rdx
test byte [rcx + 0x11451], sil
jne 0x140022c3c
lea edx, [rsi + 1]
call fcn.14007f158
test eax, eax
je 0x140022d8b
test rdi, rdi
je 0x140022d8b
mov rcx, qword [rdi + 0x3e70]
test rcx, rcx
je 0x140022d8b
lea rdx, str.CConEmuMain::SwitchKeyboardLayout_skipped__cause_of_isMonitorConsoleLang0
jmp 0x140022d7b
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0xa0
call fcn.14012d4b0
lea rdx, [rsp + 0x30]
mov ecx, 0x14
call qword [sym.imp.USER32.dll_GetKeyboardLayoutList]
mov r9d, eax
xor edx, edx
cmp edx, r9d
jae 0x140022c73
cmp qword [rsp + rdx*8 + 0x30], rbx
je 0x140022cb6
add edx, esi
jmp 0x140022c63
xor r8d, r8d
xor r10d, r10d
mov rcx, rbx
cmp r8d, r9d
jae 0x140022ca7
mov rdx, qword [rsp + r8*8 + 0x30]
movzx ecx, dx
movzx eax, bx
cmp rcx, rax
cmove r10d, esi
add r8d, esi
cmp rcx, rax
cmovne rdx, rbx
mov rbx, rdx
test r10d, r10d
je 0x140022c79
jmp 0x140022cb6
movzx eax, cx
cmp rcx, rax
jne 0x140022cb6
shl rbx, 0x10
or rbx, rcx
mov ecx, dword [rdi + 0x7af8]
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
mov rcx, qword [0x14022ab50]
mov edx, 2
cmp rbx, rax
je 0x140022d47
call fcn.14007f158
test eax, eax
je 0x140022d17
mov r8d, ebx
lea rdx, str.CConEmuMain::SwitchKeyboardLayout__posting_WM_INPUTLANGCHANGEREQUEST__WM_INPUTLANGCHANGE_for_0x_08X
lea rcx, [rsp + 0xd0]
call fcn.14000c8e8
mov rcx, qword [rdi + 0x3e70]
test rcx, rcx
je 0x140022d17
xor r9d, r9d
mov byte [rsp + 0x20], sil
mov r8b, sil
lea rdx, [rsp + 0xd0]
call fcn.14011c0a8
mov rcx, qword [0x14022a9e8]
xor r8d, r8d
mov r9, rbx
lea edx, [r8 + 0x50]
call qword [sym.imp.USER32.dll_PostMessageW]
mov rcx, qword [0x14022a9e8]
xor r8d, r8d
mov r9, rbx
lea edx, [r8 + 0x51]
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x140022d8b
call fcn.14007f158
test eax, eax
je 0x140022d8b
mov r8d, ebx
lea rdx, str.CConEmuMain::SwitchKeyboardLayout_skipped__cause_of_GetActiveKeyboardLayout__0x_08X
lea rcx, [rsp + 0xd0]
call fcn.14000c8e8
mov rcx, qword [rdi + 0x3e70]
test rcx, rcx
je 0x140022d8b
lea rdx, [rsp + 0xd0]
xor r9d, r9d
mov byte [rsp + 0x20], sil
mov r8b, sil
call fcn.14011c0a8
mov rcx, qword [rsp + 0x2d0]
xor rcx, rsp
call fcn.14012bda0
lea r11, [rsp + 0x2e0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140022de0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x150
mov rax, qword [0x1401f5698]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rbx, rcx
mov rax, qword [0x14022ab50]
cmp byte [rax + 0x11478], 0
je 0x140022f4e
lea rcx, [rsp + 0x30]
call fcn.140116c08
nop
or r8d, 0xffffffff
mov rdx, qword [rbx + 0x7c30]
lea rcx, [rsp + 0x30]
call fcn.14011b6fc
xor esi, esi
mov rcx, qword [rbx + 0x7c18]
mov rax, qword [rbx + 0x7c20]
sub rax, rcx
sar rax, 4
test rax, rax
jle 0x140022f44
xor edi, edi
mov rcx, qword [rdi + rcx]
test rcx, rcx
je 0x140022f1f
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbx + 0x7c18]
test eax, eax
jne 0x140022eb2
lea rdx, [rcx + 0xc]
add rdx, rdi
mov rcx, qword [rdi + rcx]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov rax, qword [rbx + 0x7c18]
mov r9d, dword [rax + rdi + 0xc]
mov r8d, dword [rax + rdi + 8]
lea rdx, str.ssh_agent.exe_with_PID__u_has_been_already_terminated_with_code__u
lea rcx, [rsp + 0x40]
call fcn.1400011f8
jmp 0x140022ede
mov edx, 1
mov rcx, qword [rdi + rcx]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rax, qword [rbx + 0x7c18]
mov r8d, dword [rdi + rax + 8]
lea rdx, str.ssh_agent.exe_with_PID__u_was_killed_on_ConEmu_termination
lea rcx, [rsp + 0x40]
call fcn.1400011f8
mov rcx, qword [rbx + 0x3e70]
test rcx, rcx
je 0x140022eff
mov byte [rsp + 0x20], 1
xor r9d, r9d
mov r8b, 1
lea rdx, [rsp + 0x40]
call fcn.14011c0a8
mov rdx, qword [rbx + 0x7c18]
mov rcx, qword [rdx + rdi]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140022f1f
and qword [rdx + rdi], 0
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc rsi
add rdi, 0x10
mov rcx, qword [rbx + 0x7c18]
mov rax, qword [rbx + 0x7c20]
sub rax, rcx
sar rax, 4
cmp rsi, rax
jl 0x140022e5d
lea rcx, [rsp + 0x30]
call fcn.14011b698
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.14012bda0
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140024318
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp eax, dword [rbx + 0x7af8]
je 0x14002435b
xor r9d, r9d
xor r8d, r8d
mov edx, dword [rbx + 0x7b38]
mov rcx, qword [0x14022a9e8]
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x14002443b
xor ebp, ebp
mov edi, ebp
lea rcx, [rbx + 0x55e8]
cmp word [rcx], bp
je 0x140024396
lea rdi, [rbx + 0x4c68]
mov r8d, 0x4c0
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
dec eax
cmp eax, 0x4be
jbe 0x140024391
lea rdi, [rbx + 0xa80]
test rdi, rdi
jne 0x1400243e1
lea rcx, [rsp + 0x20]
call fcn.1401086e4
nop
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.140102fa8
test eax, eax
js 0x1400243d7
mov rcx, qword [rsp + 0x28]
call fcn.14010f780
test rax, rax
je 0x1400243d7
mov rcx, qword [rsp + 0x28]
call fcn.14010f780
mov rcx, rax
mov dl, 1
call fcn.1400a7ad0
mov rdi, rax
lea rcx, [rsp + 0x20]
call fcn.14010878c
lea rsi, [rbx + 0xa80]
test rdi, rdi
cmovne rsi, rdi
test rsi, rsi
je 0x140024422
lea rdi, [rbx + 0x4c68]
cmp rsi, rdi
je 0x140024422
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140024422
mov r8d, 0x4c0
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcpynW]
mov rcx, rbx
call fcn.140023de4
lea rcx, [0x14022da90]
call fcn.1400f6c18
call fcn.1401010c4
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x1400275a0
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0xa0]
sub rsp, 0x1a0
mov rax, qword [0x1401f5698]
xor rax, rsp
mov qword [rbp + 0x90], rax
mov r14, rcx
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1400275e2
xor eax, eax
jmp 0x14002775a
xor ebx, ebx
mov rsi, r14
lea rcx, [rsp + 0x60]
call fcn.1401170c0
nop
xor edi, edi
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, rsi
call fcn.1401188b8
mov rsi, rax
test rax, rax
je 0x14002774e
mov rax, qword [rsp + 0x60]
cmp word [rax], 0x2f
jne 0x140027623
mov ecx, 0x2d
mov word [rax], cx
lea rcx, [rsp + 0x60]
call fcn.140054ee8
mov rcx, rax
lea rdx, str._debug
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x1400276af
lea rcx, [rsp + 0x60]
call fcn.140054ee8
mov rcx, rax
lea rdx, str._debugi
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x1400276a2
lea rcx, [rsp + 0x60]
call fcn.140054ee8
mov rcx, rax
lea rdx, str._debugw
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140027698
inc edi
cmp edi, 1
jle 0x1400275f4
jmp 0x14002774e
mov ecx, 0xfa
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x14002768d
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov ebx, eax
jmp 0x14002773e
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
lea rdx, str.Conemu_started__PID_i
lea rcx, [rbp - 0x70]
call fcn.1400011f8
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov r8, rax
and qword [rsp + 0x48], 0
and qword [rsp + 0x40], 0
and qword [rsp + 0x38], 0
and qword [rsp + 0x30], 0
and qword [rsp + 0x28], 0
mov qword [rsp + 0x20], r14
lea r9, str._n_n_nlpCmdLine_n
lea rdx, str.GetCommandLineW___n
lea rcx, [rsp + 0x50]
call fcn.140114ba8
nop
lea rcx, [rsp + 0x50]
call fcn.140054ee8
mov rdx, rax
mov r9d, 0x11040
lea r8, [rbp - 0x70]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov ebx, eax
lea rcx, [rsp + 0x50]
call fcn.140114ca4
test ebx, ebx
je 0x14002774e
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
lea rcx, [rsp + 0x60]
call fcn.1401170e4
mov eax, ebx
mov rcx, qword [rbp + 0x90]
xor rcx, rsp
call fcn.14012bda0
lea r11, [rsp + 0x1a0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x140027c04
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xd0
mov rax, qword [0x1401f5698]
xor rax, rsp
mov qword [rbp + 0x27], rax
and qword [rbp - 0x61], 0
and qword [rbp - 0x69], 0
call fcn.1400292fc
mov rsi, rax
test rax, rax
je 0x140027c57
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
movsxd r12, eax
call fcn.140028fdc
mov rdi, rax
test rax, rax
je 0x140027c72
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
movsxd r13, eax
lea r8, [rbp - 0x69]
lea rdx, [rbp - 0x61]
lea rcx, [r12 + r13]
add rcx, rcx
call fcn.1400289a4
mov r14, qword [rbp - 0x61]
test al, al
je 0x140027e03
mov r15, qword [rbp - 0x69]
lea r8, [0x140029580]
and dword [r14 + 0x23c], 0
mov r9, r14
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_EnumDisplayMonitors]
xor ecx, ecx
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov rcx, rax
mov edx, 0xc
mov rbx, rax
call qword [sym.imp.GDI32.dll_GetDeviceCaps]
mov rcx, rbx
mov dword [r14 + 0x214], eax
call qword [sym.imp.GDI32.dll_DeleteDC]
call fcn.1401168b4
xor ecx, ecx
test al, al
setne cl
mov dword [r14 + 0x218], ecx
call fcn.1401166cc
xor ecx, ecx
test al, al
setne cl
mov dword [r14 + 0x21c], ecx
call fcn.14011e4a8
xor ecx, ecx
test al, al
setne cl
mov dword [r14 + 0x220], ecx
cmp dword [r14 + 0x224], 0
jne 0x140027dcb
cmp dword [r14 + 0x8c], 5
jne 0x140027dcb
xor edx, edx
lea rcx, [rbp - 0x59]
mov r8d, 0x80
call fcn.14012d4b0
lea rax, [rbp - 0x69]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140027dcb
mov rcx, qword [rbp - 0x69]
lea rax, [rbp - 0x61]
mov qword [rsp + 0x28], rax
lea rdx, [0x14017f768]
lea rax, [rbp - 0x59]
mov dword [rbp - 0x61], 0x7e
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140027dc1
lea rdx, str.ReactOS
lea rcx, [rbp - 0x59]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
xor ecx, ecx
test eax, eax
sete cl
mov dword [r14 + 0x224], ecx
mov rcx, qword [rbp - 0x69]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test rsi, rsi
je 0x140027de9
mov r8, rsi
mov rdx, r12
mov rcx, r15
call fcn.14000a8a0
mov qword [r14 + 0xb40], r15
lea r15, [r15 + r12*2]
test rdi, rdi
je 0x140027e03
mov r8, rdi
mov rdx, r13
mov rcx, r15
call fcn.14000a8a0
mov qword [r14 + 0xb48], r15
test rsi, rsi
je 0x140027e10
mov rcx, rsi
call fcn.140113e18
test rdi, rdi
je 0x140027e1d
mov rcx, rdi
call fcn.140113e18
mov rax, r14
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.14012bda0
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x140028520
Capabilities:
Enumerate gui resources

Disassembly:
sub rsp, 0x38
and qword [rsp + 0x20], 0
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x28], ecx
lea rcx, [0x14002854c]
call qword [sym.imp.USER32.dll_EnumWindows]
mov rax, qword [rsp + 0x20]
add rsp, 0x38
ret
Function at 0x1400292fc
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0xb8]
sub rsp, 0x190
mov rax, qword [0x1401f5698]
xor rax, rsp
mov qword [rbp + 0x80], rax
mov esi, 0x800
mov edx, 2
mov ecx, esi
call fcn.140113de8
xor r15d, r15d
mov rdi, rax
test rax, rax
je 0x140029546
lea rax, [rsp + 0x50]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionConsoleTrueTypeFont
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140029546
call fcn.140116698
mov rcx, qword [rsp + 0x50]
lea r12d, [r15 + 0x7e]
mov byte [rsp + 0x40], al
lea r9, [rsp + 0x48]
lea rax, [rsp + 0x44]
mov dword [rsp + 0x48], 0x40
mov qword [rsp + 0x38], rax
lea r8, [rbp - 0x80]
lea rax, [rbp]
mov dword [rsp + 0x44], r12d
mov qword [rsp + 0x30], rax
xor edx, edx
lea rax, [rsp + 0x4c]
mov r14d, r15d
mov qword [rsp + 0x28], rax
mov rbx, rdi
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x14002953b
mov qword [rsp + 0x60], 0x3f
mov eax, dword [rsp + 0x48]
inc r14d
cmp rax, 0x3f
jae 0x140029409
add rax, rax
cmp rax, 0x80
jae 0x140029579
jmp 0x14002940c
mov rax, r12
mov word [rbp + rax - 0x80], r15w
mov eax, dword [rsp + 0x44]
shr rax, 1
mov qword [rsp + 0x78], 0x3f
cmp rax, 0x3f
jae 0x140029439
add rax, rax
cmp rax, 0x80
jae 0x140029579
jmp 0x14002943c
mov rax, r12
lea rcx, [rbp - 0x80]
mov word [rbp + rax], r15w
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rcx, [rbp]
movsxd r12, eax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
and qword [rsp + 0x58], 0
lea r15d, [r12 + 3]
movsxd r13, eax
lea rdx, [rsp + 0x58]
mov r8d, 0xa
lea rcx, [rbp - 0x80]
add r15d, r13d
call fcn.1401358a4
xor ecx, ecx
test eax, eax
je 0x14002948a
cmp byte [rsp + 0x40], cl
je 0x1400294e4
cmp eax, 0xffffffff
je 0x1400294e4
cmp r15d, esi
jge 0x1400294e4
lfence
mov r15, rbx
cmp word [rdi], cx
je 0x1400294ab
mov eax, 9
mov word [rbx], ax
add rbx, 2
lea rdx, [rbp - 0x80]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov eax, 9
lea rbx, [rbx + r12*2]
mov word [rbx], ax
lea rdx, [rbp]
add rbx, 2
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rbx, [rbx + r13*2]
mov rax, rbx
sub rax, r15
sar rax, 1
sub esi, eax
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x44]
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x48]
lea rax, [rbp]
mov dword [rsp + 0x48], 0x40
mov qword [rsp + 0x30], rax
lea r8, [rbp - 0x80]
lea rax, [rsp + 0x4c]
mov r12d, 0x7e
mov qword [rsp + 0x28], rax
xor r15d, r15d
mov edx, r14d
mov qword [rsp + 0x20], r15
mov dword [rsp + 0x44], r12d
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
je 0x1400293eb
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, rdi
mov rcx, qword [rbp + 0x80]
xor rcx, rsp
call fcn.14012bda0
lea r11, [rsp + 0x190]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.14012c3e0
int3
Function at 0x140029954
Capabilities:
Get graphical window text

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
xor ebp, ebp
mov rsi, r9
mov r14, r8
mov rdi, rcx
test dx, dx
je 0x140029989
movzx edx, dx
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rdi, rax
test rdi, rdi
jne 0x140029992
xor eax, eax
jmp 0x1400299fc
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov ebx, eax
mov rax, qword [rsi]
test ebx, ebx
jle 0x1400299ef
test rax, rax
je 0x1400299b9
cmp rbx, qword [r14]
jb 0x1400299d4
mov rcx, rax
call fcn.140113e18
mov qword [rsi], rbp
lea eax, [rbx + 0x20]
mov edx, 2
movsxd rcx, eax
mov qword [r14], rcx
call fcn.140113de8
mov qword [rsi], rax
test rax, rax
je 0x1400299f9
lfence
mov rax, qword [rsi]
lea r8d, [rbx + 1]
mov rcx, rdi
mov word [rax], bp
mov rdx, qword [rsi]
call qword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x1400299f9
mov ebx, ebp
test rax, rax
je 0x1400299f9
mov word [rax], bp
movsxd rax, ebx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x140029fdc
Capabilities:
Set environment variable

Disassembly:
sub rsp, 0x28
xor edx, edx
lea rcx, str.ConEmuFakeDT
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
xor edx, edx
lea rcx, str.ConEmuHooks
add rsp, 0x28
jmp qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
Function at 0x14002e2c8
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, 0x14
call qword [sym.imp.USER32.dll_GetKeyState]
and al, 1
mov ecx, 0x90
mov byte [rbx + 0x1a], al
call qword [sym.imp.USER32.dll_GetKeyState]
and al, 1
mov ecx, 0x91
mov byte [rbx + 0x1b], al
call qword [sym.imp.USER32.dll_GetKeyState]
and al, 1
mov ecx, 0x5b
mov byte [rbx + 0x1c], al
call fcn.140116c84
test al, al
jne 0x14002e31d
mov ecx, 0x5c
call fcn.140116c84
test al, al
je 0x14002e31f
mov al, 1
mov ecx, 0x5d
mov byte [rbx + 0x18], al
call fcn.140116c84
mov ecx, 0xa4
mov byte [rbx + 0x19], al
call fcn.140116c84
mov ecx, 0xa5
mov byte [rbx + 0x1d], al
call fcn.140116c84
mov ecx, 0xa2
mov byte [rbx + 0x1e], al
call fcn.140116c84
mov ecx, 0xa3
mov byte [rbx + 0x1f], al
call fcn.140116c84
mov ecx, 0xa0
mov byte [rbx + 0x20], al
call fcn.140116c84
mov ecx, 0xa1
mov byte [rbx + 0x21], al
call fcn.140116c84
mov cl, byte [rbx + 0x1a]
mov r8b, al
neg cl
mov byte [rbx + 0x22], al
sbb edx, edx
and edx, 0x80
mov ecx, edx
or ecx, 0x20
cmp byte [rbx + 0x1b], 0
cmove ecx, edx
mov eax, ecx
or eax, 0x40
cmp byte [rbx + 0x1c], 0
cmove eax, ecx
mov ecx, eax
or ecx, 2
cmp byte [rbx + 0x1d], 0
cmove ecx, eax
mov eax, ecx
or eax, 1
cmp byte [rbx + 0x1e], 0
cmove eax, ecx
mov ecx, eax
or ecx, 8
cmp byte [rbx + 0x1f], 0
cmove ecx, eax
mov eax, ecx
or eax, 4
cmp byte [rbx + 0x20], 0
cmove eax, ecx
cmp byte [rbx + 0x21], 0
jne 0x14002e3e0
test r8b, r8b
je 0x14002e3e3
or eax, 0x10
mov dword [rbx + 0x14], eax
add rsp, 0x20
pop rbx
ret