joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140003b10
Capabilities:
Find taskbar

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x1400731a0]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbp, rcx
mov rbx, rdx
lea rcx, str.Shell_TrayWnd
xor edx, edx
call qword [sym.imp.USER32.dll_FindWindowW]
xor esi, esi
xor edi, edi
test rax, rax
je 0x140003b75
xorps xmm0, xmm0
lea rdx, [rsp + 0x30]
mov rcx, rax
movdqu xmmword [rsp + 0x30], xmm0
call qword [sym.imp.USER32.dll_GetWindowRect]
mov esi, dword [rsp + 0x3c]
mov edi, dword [rsp + 0x38]
sub esi, dword [rsp + 0x34]
sub edi, dword [rsp + 0x30]
call fcn.140013580
mov rcx, qword [rbp + 0x10]
xorps xmm0, xmm0
lea rdx, [rsp + 0x40]
movdqu xmmword [rsp + 0x40], xmm0
call qword [sym.imp.USER32.dll_GetWindowRect]
mov dword [rbx], 0
xor eax, eax
mov rdx, rbx
mov qword [rbx + 4], rax
mov dword [rbx + 0xc], eax
mov rax, qword [rbp + 0x28]
mov ecx, dword [rax]
call fcn.14000e130
test eax, eax
jne 0x140003be4
call fcn.14001c090
lea r9, str.CNviewToolbar.cpp
lea r8, str.CNviewToolbar::updatedToolbarRect
mov rcx, rax
lea rax, str.failed_to_get_monitor_rect
mov edx, 1
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x1b6
call fcn.14001c7d0
jmp 0x140003c1b
mov ecx, dword [rbp + 0x40]
test ecx, ecx
je 0x140003c14
dec ecx
je 0x140003c0a
dec ecx
je 0x140003c01
dec ecx
jne 0x140003c1b
mov eax, dword [rbx + 0xc]
sub eax, esi
mov dword [rbx + 4], eax
jmp 0x140003c1b
mov eax, dword [rbx + 8]
sub eax, edi
mov dword [rbx], eax
jmp 0x140003c1b
mov ecx, dword [rbx + 4]
add ecx, esi
mov dword [rbx + 0xc], ecx
jmp 0x140003c1b
mov ecx, dword [rbx]
add ecx, edi
mov dword [rbx + 8], ecx
mov rax, rbx
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140020e30
mov rbx, qword [rsp + 0x90]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret

Function at 0x140003ec0
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x110
mov rax, qword [0x1400731a0]
xor rax, rsp
mov qword [rsp + 0x100], rax
mov rsi, rcx
mov edi, r8d
mov rbx, rdx
lea rcx, [rsp + 0x42]
xor ebp, ebp
xor edx, edx
mov r8d, 0xb0
mov word [rsp + 0x40], bp
call fcn.140020fe0
lea r8d, [rbp + 0x59]
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov rcx, rbx
call fcn.14000e280
mov rcx, qword [rsi + 0x28]
or edx, 0xffffffff
mov r8, rax
mov rbx, rax
call qword [sym.imp.COMCTL32.dll_ImageList_ReplaceIcon]
mov rcx, rbx
call qword [sym.imp.USER32.dll_DestroyIcon]
mov rcx, qword [rsi + 0x20]
lea eax, [rdi + 0x400]
mov dword [rsp + 0x24], eax
xor eax, eax
lea r8d, [rbp + 0x20]
mov dword [rsp + 0x2b], eax
mov byte [rsp + 0x2f], al
lea rax, [rsp + 0x40]
xor r9d, r9d
mov edx, 0x41e
mov dword [rsp + 0x20], edi
mov qword [rsp + 0x38], rax
mov word [rsp + 0x28], 4
mov byte [rsp + 0x2a], bpl
mov qword [rsp + 0x30], rbp
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rsi + 0x20]
lea r9, [rsp + 0x20]
lea r8d, [rbp + 1]
mov edx, 0x444
call qword [sym.imp.USER32.dll_SendMessageW]
mov al, 1
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.140020e30
mov rbx, qword [rsp + 0x148]
add rsp, 0x110
pop rdi
pop rsi
pop rbp
ret
Function at 0x140004540
Capabilities:
Check for foreground window switch

Disassembly:
push rbx
sub rsp, 0x20
mov eax, dword [rdx + 0x18]
xor ebx, ebx
cmp eax, 0x10001
ja 0x14000426c
je 0x14000425a
dec eax
je 0x14000427b
dec eax
jne 0x140004277
call fcn.140004340
mov rax, rbx
add rsp, 0x20
pop rbx
ret
mov ebx, 0x20
call fcn.140004340
mov eax, ebx
add rsp, 0x20
pop rbx
ret
sub eax, 0x10002
je 0x14000424c
dec eax
je 0x14000427b
dec eax
jne 0x140004251
mov ebx, 0x20
mov eax, ebx
add rsp, 0x20
pop rbx
ret
push rsi
push rdi
sub rsp, 0x28
mov eax, dword [rdx + 0x10]
mov rsi, rdx
mov rdi, rcx
cmp eax, 0xfffffff4
je 0x140004686
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x20], rbp
cmp eax, 0xfffffffb
je 0x1400045d9
cmp eax, 0xfffffffe
jne 0x140004673
mov eax, dword [rdx + 0x2c]
cmp eax, dword [rcx + 0x38]
jl 0x140004673
cmp eax, dword [rcx + 0x40]
jg 0x140004673
mov eax, dword [rdx + 0x28]
cmp eax, dword [rcx + 0x34]
jl 0x140004673
cmp eax, dword [rcx + 0x3c]
jg 0x140004673
mov eax, dword [rdx + 0x18]
xor r9d, r9d
xor r8d, r8d
sub eax, 0x400
movsxd rdx, eax
mov rax, qword [rcx + 0x48]
mov rcx, qword [rax + 0x208]
mov rbx, qword [rcx + rdx*8]
lea edx, [r9 + 0x10]
mov rcx, rbx
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rdi + 0x48]
mov rdx, rbx
call fcn.14000dd90
jmp 0x140004673
mov eax, dword [rdx + 0x18]
sub eax, 0x400
movsxd rdx, eax
mov rax, qword [rcx + 0x48]
mov rcx, qword [rax + 0x208]
mov rbp, qword [rcx + rdx*8]
mov rcx, rbp
call qword [sym.imp.USER32.dll_SetForegroundWindow]
xor ebx, ebx
call qword [sym.imp.USER32.dll_GetForegroundWindow]
cmp rbp, rax
je 0x14000462d
nop dword [rax]
mov ecx, 0x19
call qword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
cmp ebx, 0x28
ja 0x140004673
call qword [sym.imp.USER32.dll_GetForegroundWindow]
cmp rbp, rax
jne 0x140004610
mov eax, dword [rsi + 0x28]
mov rcx, qword [rdi + 0x20]
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x50], eax
mov eax, dword [rsi + 0x2c]
mov dword [rsp + 0x54], eax
call qword [sym.imp.USER32.dll_ClientToScreen]
movzx eax, word [rsp + 0x50]
mov word [rsp + 0x48], ax
movzx eax, word [rsp + 0x54]
mov word [rsp + 0x4a], ax
call fcn.1400043e0
mov r8d, dword [rsp + 0x48]
mov rcx, rax
mov rdx, rbp
call fcn.14000d3a0
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x20]
xor eax, eax
add rsp, 0x28
pop rdi
pop rsi
ret
add rsp, 0x28
pop rdi
pop rsi
jmp 0x140004230

Function at 0x140005910
Capabilities:
Find taskbar

Disassembly:
sub rsp, 0x28
lea rcx, str.Shell_TrayWnd
xor edx, edx
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
je 0x140005942
lea r8, str.ReBarWindow32
xor r9d, r9d
xor edx, edx
mov rcx, rax
add rsp, 0x28
jmp qword [sym.imp.USER32.dll_FindWindowExW]
add rsp, 0x28
ret
Function at 0x1400077b0
Capabilities:
Check for foreground window switch

Disassembly:
push rbp
push rsi
push r14
push r15
sub rsp, 0x28
mov rsi, rcx
mov rcx, qword [rcx + 0x10]
mov r15d, edx
mov dword [rsp + 0x50], edx
lea rdx, [rsp + 0x50]
mov r14d, r8d
mov dword [rsp + 0x54], r8d
call qword [sym.imp.USER32.dll_ScreenToClient]
mov rcx, qword [rsi + 0x10]
lea r9, [rsp + 0x50]
xor r8d, r8d
mov edx, 0x445
call qword [sym.imp.USER32.dll_SendMessageW]
mov rbp, rax
test eax, eax
jns 0x140007807
xor eax, eax
add rsp, 0x28
pop r15
pop r14
pop rsi
pop rbp
ret
mov edx, eax
mov rcx, rsi
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x20], rdi
call fcn.1400087a0
mov rcx, rax
mov rdi, rax
call qword [sym.imp.USER32.dll_SetForegroundWindow]
xor ebx, ebx
call qword [sym.imp.USER32.dll_GetForegroundWindow]
cmp rdi, rax
je 0x140007851
mov ecx, 0x19
call qword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
cmp ebx, 0x28
ja 0x1400078a1
call qword [sym.imp.USER32.dll_GetForegroundWindow]
cmp rdi, rax
jne 0x140007834
mov r8d, ebp
mov rdx, rdi
mov rcx, rsi
call fcn.140008d30
cmp qword [rsi + 0x78], 0
jne 0x140007887
mov word [rsp + 0x58], r15w
mov word [rsp + 0x5a], r14w
call fcn.1400043e0
mov r8d, dword [rsp + 0x58]
mov rdx, rdi
mov rcx, rax
call fcn.14000d3a0
mov eax, 1
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x20]
add rsp, 0x28
pop r15
pop r14
pop rsi
pop rbp
ret
xor eax, eax
jmp 0x14000788c

Function at 0x140007ea0
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x180]
sub rsp, 0x280
mov rax, qword [0x1400731a0]
xor rax, rsp
mov qword [rbp + 0x170], rax
xor eax, eax
movsxd rdi, edx
mov rbx, rcx
mov rcx, qword [rcx + 0x10]
lea r9, [rsp + 0x50]
xor esi, esi
mov r8, rdi
mov edx, 0x417
mov dword [rsp + 0x50], esi
mov qword [rsp + 0x54], rax
mov qword [rsp + 0x5c], rax
mov qword [rsp + 0x64], rax
mov dword [rsp + 0x6c], eax
call qword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x140007fc2
lea rcx, [rsp + 0x72]
xor edx, edx
mov r8d, 0x1fe
mov word [rsp + 0x70], si
call fcn.140020fe0
mov rax, qword [rbx + 0x80]
mov rcx, qword [rax + rdi*8]
lea r9, [rsp + 0x70]
lea edx, [rsi + 0xd]
mov rcx, qword [rcx + 0x208]
mov r8d, 0xff
mov rcx, qword [rcx]
call qword [sym.imp.USER32.dll_SendMessageW]
movsxd r8, dword [rsp + 0x54]
mov rcx, qword [rbx + 0x10]
xor eax, eax
lea r9, [rsp + 0x20]
mov edx, 0x43f
mov qword [rsp + 0x24], rax
mov qword [rsp + 0x2c], rax
mov qword [rsp + 0x34], rax
mov qword [rsp + 0x3c], rax
mov qword [rsp + 0x44], rax
mov dword [rsp + 0x4c], eax
mov dword [rsp + 0x20], 0x30
mov dword [rsp + 0x24], 2
call qword [sym.imp.USER32.dll_SendMessageW]
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd r8, dword [rsp + 0x54]
mov rcx, qword [rbx + 0x10]
mov dword [rsp + 0x48], eax
lea rax, [rsp + 0x70]
lea r9, [rsp + 0x20]
mov edx, 0x440
mov qword [rsp + 0x40], rax
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, rbx
call fcn.140005570
mov eax, 1
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.140020e30
mov rbx, qword [rsp + 0x2b0]
add rsp, 0x280
pop rdi
pop rsi
pop rbp
ret
Function at 0x140008750
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ebx, r9d
mov rdi, r8
call fcn.1400087a0
test rax, rax
jne 0x140008775
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov r8d, ebx
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov rbx, qword [rsp + 0x30]
mov eax, 1
add rsp, 0x20
pop rdi
ret

Function at 0x14000a920
Capabilities:
Find taskbar

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rsi
mov rdi, rcx
xor edx, edx
lea rcx, str.Shell_TrayWnd
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
je 0x14000a95d
lea rdx, [rdi + 0x60]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowRect]
cmp qword [rdi + 8], 0
jne 0x14000a96c
mov rcx, rdi
call fcn.14000c0b0
mov dword [rsp + 0x40], 1
mov rax, qword [0x1400751f0]
test rax, rax
jne 0x14000a9a2
lea ecx, [rax + 4]
call fcn.14001f994
mov qword [rsp + 0x48], rax
test rax, rax
je 0x14000a99b
mov rcx, rax
call fcn.14000d380
nop
mov qword [0x1400751f0], rax
lea r9, [rsp + 0x40]
mov edx, 2
lea r8d, [rdx + 2]
mov rcx, rax
call fcn.14000d3f0
mov rcx, rdi
call fcn.14000aa10
mov esi, eax
test eax, eax
je 0x14000a9f9
call fcn.1400118b0
mov rbx, rax
mov rcx, rax
call fcn.140011e80
mov rdx, rbx
mov rcx, rdi
call fcn.14000ca70
mov rdx, rbx
mov rcx, rdi
call fcn.14000cd20
mov rdx, rbx
mov rcx, rdi
call fcn.14000d250
mov eax, esi
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret

Function at 0x14000b120
Capabilities:
Find taskbar

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x1400731a0]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, rcx
lea rcx, str.Shell_TrayWnd
xor edx, edx
call qword [sym.imp.USER32.dll_FindWindowW]
lea rdx, [rsp + 0x20]
xorps xmm0, xmm0
mov rcx, rax
movdqu xmmword [rsp + 0x20], xmm0
call qword [sym.imp.USER32.dll_GetWindowRect]
lea rdx, [rbx + 0x60]
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_EqualRect]
xor ecx, ecx
test eax, eax
sete cl
mov eax, ecx
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140020e30
add rsp, 0x40
pop rbx
ret

Function at 0x14000b1a0
Capabilities:
Find taskbar

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov dword [rcx + 0x10], 1
lea rcx, str.Shell_TrayWnd
xor edx, edx
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
je 0x14000b1d5
lea rdx, [rdi + 0x60]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowRect]
mov rcx, rdi
call fcn.14000ac40
mov rcx, rdi
call fcn.14000aa10
call fcn.1400118b0
mov rcx, rax
mov rbx, rax
call fcn.140011e80
mov rdx, rbx
mov rcx, rdi
call fcn.14000ca70
mov rdx, rbx
mov rcx, rdi
call fcn.14000cd20
mov rdx, rbx
mov rcx, rdi
call fcn.14000d250
mov rbx, qword [rsp + 0x30]
mov dword [rdi + 0x10], 0
add rsp, 0x20
pop rdi
ret
Function at 0x140011e80
Capabilities:
Enumerate gui resources

Disassembly:
push rbx
push rbp
push rsi
sub rsp, 0x3b0
mov rax, qword [0x1400731a0]
xor rax, rsp
mov qword [rsp + 0x3a0], rax
mov rbp, rcx
mov rcx, qword [rcx + 0x28]
mov rax, qword [rbp + 0x20]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rax
call fcn.140010ff0
lea rcx, [rsp + 0x54]
xor edx, edx
mov r8d, 0x344
xor esi, esi
call fcn.140020fe0
mov rax, qword [rbp + 0x48]
lea r8, [rsp + 0x50]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x38], xmm0
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov qword [rbp + 0x50], rax
mov dword [rsp + 0x50], 0x348
call qword [sym.imp.USER32.dll_EnumDisplayDevicesW]
test eax, eax
je 0x14001200e
mov qword [rsp + 0x3e0], r14
movabs r14, 0x6666666666666667
mov qword [rsp + 0x3d8], rdi
nop word [rax + rax]
lea rdx, [rsp + 0x38]
mov ecx, esi
call fcn.14000e130
test eax, eax
je 0x140011fe2
movups xmm0, xmmword [rsp + 0x38]
mov r8, qword [rbp + 0x50]
lea rax, [rsp + 0x20]
mov dword [rsp + 0x20], esi
movups xmmword [rsp + 0x24], xmm0
cmp rax, r8
jae 0x140011fb1
mov rax, qword [rbp + 0x48]
lea rcx, [rsp + 0x20]
cmp rax, rcx
ja 0x140011fb1
lea rcx, [rsp + 0x20]
sub rcx, rax
mov rax, r14
imul rcx
mov rdi, rdx
sar rdi, 3
mov rax, rdi
shr rax, 0x3f
add rdi, rax
cmp r8, qword [rbp + 0x58]
jne 0x140011f91
lea rcx, [rbp + 0x48]
mov edx, 1
call fcn.140010650
mov rax, qword [rbp + 0x48]
lea rcx, [rdi + rdi*4]
lea rdx, [rax + rcx*4]
mov rcx, qword [rbp + 0x50]
test rcx, rcx
je 0x140011fdd
movups xmm0, xmmword [rdx]
movups xmmword [rcx], xmm0
mov eax, dword [rdx + 0x10]
jmp 0x140011fda
cmp r8, qword [rbp + 0x58]
jne 0x140011fc5
lea rcx, [rbp + 0x48]
mov edx, 1
call fcn.140010650
mov rcx, qword [rbp + 0x50]
test rcx, rcx
je 0x140011fdd
movups xmm0, xmmword [rsp + 0x20]
mov eax, dword [rsp + 0x30]
movups xmmword [rcx], xmm0
mov dword [rcx + 0x10], eax
add qword [rbp + 0x50], 0x14
inc esi
lea r8, [rsp + 0x50]
xor r9d, r9d
mov edx, esi
xor ecx, ecx
call qword [sym.imp.USER32.dll_EnumDisplayDevicesW]
test eax, eax
jne 0x140011f20
mov r14, qword [rsp + 0x3e0]
mov rdi, qword [rsp + 0x3d8]
lea rcx, [0x140012110]
mov rdx, rbp
call qword [sym.imp.USER32.dll_EnumWindows]
mov rcx, rbp
call fcn.140010ba0
mov rcx, rbp
call fcn.140011100
mov al, 1
mov rcx, qword [rsp + 0x3a0]
xor rcx, rsp
call fcn.140020e30
add rsp, 0x3b0
pop rsi
pop rbp
pop rbx
ret
Function at 0x140012050
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
lea rdx, [rcx + 0x20]
mov rcx, qword [rcx + 0x10]
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r8d, dword [rsi + 0x20]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
jne 0x1400120b2
mov r8d, dword [rsi + 0x20]
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
jne 0x1400120b2
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
xor eax, eax
lea r9, [rsp + 0x30]
lea rdx, [rsp + 0x38]
lea r8d, [rax + 8]
mov rcx, rbx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x38], rax
call sub.KERNEL32.dll_K32EnumProcessModules
mov rdx, qword [rsp + 0x38]
lea r8, [rsi + 0x24]
mov r9d, 0x104
mov rcx, rbx
call sub.KERNEL32.dll_K32GetModuleBaseNameW
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov al, 1
add rsp, 0x20
pop rdi
ret

Function at 0x140012b80
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x30
lea rax, [rsp + 0x58]
lea r9, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdx
mov rdx, rcx
mov rcx, qword [0x140075290]
xor ebx, ebx
mov dword [rsp + 0x50], 4
mov dword [rsp + 0x58], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140012bd0
cmp dword [rsp + 0x50], 4
mov eax, 1
cmove ebx, eax
mov eax, ebx
add rsp, 0x30
pop rbx
ret
Function at 0x140013e80
Capabilities:
Check for unmoving mouse cursor

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x1400731a0]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rdi, qword [0x1400752c0]
mov rbx, rcx
test rdi, rdi
je 0x140013fd0
dec edx
je 0x140013f43
dec edx
je 0x140013ed0
dec edx
jne 0x140013fd0
mov edx, 3
call qword [sym.imp.USER32.dll_KillTimer]
jmp 0x140013fd0
mov edx, 2
call qword [sym.imp.USER32.dll_KillTimer]
lea rdx, [rsp + 0x28]
mov rcx, rbx
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x28], xmm0
call qword [sym.imp.USER32.dll_GetWindowRect]
cmp dword [rdi + 0x18], 0
je 0x140013fd0
cmp dword [rdi + 0x24], 0
je 0x140013fd0
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], 0
call qword [sym.imp.USER32.dll_GetCursorPos]
mov rdx, qword [rsp + 0x20]
lea rcx, [rsp + 0x28]
call qword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x140013fd0
mov rcx, qword [0x1400752c0]
call fcn.140002170
jmp 0x140013fd0
cmp dword [rdi + 0x18], 0
je 0x140013fd0
cmp dword [rdi + 0x24], 0
jne 0x140013fd0
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], 0
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rdx, [rsp + 0x28]
mov rcx, rbx
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x28], xmm0
call qword [sym.imp.USER32.dll_GetWindowRect]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rdx, qword [rsp + 0x20]
lea rcx, [rsp + 0x28]
mov rdi, rax
call qword [sym.imp.USER32.dll_PtInRect]
test eax, eax
jne 0x140013fd0
cmp rdi, rbx
je 0x140013fd0
test rdi, rdi
je 0x140013fd0
lea edx, [rax + 4]
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindow]
cmp rax, rbx
je 0x140013fd0
mov edx, 1
mov rcx, rbx
call qword [sym.imp.USER32.dll_KillTimer]
mov rcx, qword [0x1400752c0]
call fcn.140001b30
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140020e30
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x140015290
Capabilities:
Check os version

Disassembly:
sub rsp, 0x158
mov rax, qword [0x1400731a0]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov ecx, dword [0x140075324]
test ecx, ecx
jne 0x140015391
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rsp + 0x30], 2
jne 0x14001538b
mov edx, dword [rsp + 0x24]
cmp edx, 5
jne 0x1400152f4
xor ecx, ecx
cmp dword [rsp + 0x28], ecx
seta cl
inc ecx
mov dword [0x140075324], ecx
jmp 0x140015391
cmp edx, 6
jne 0x140015356
mov eax, dword [rsp + 0x28]
test eax, eax
jne 0x140015311
mov ecx, 3
mov dword [0x140075324], ecx
jmp 0x140015391
cmp eax, 1
jne 0x140015323
mov ecx, 4
mov dword [0x140075324], ecx
jmp 0x140015391
cmp eax, 2
jne 0x140015335
mov ecx, 5
mov dword [0x140075324], ecx
jmp 0x140015391
cmp eax, 3
jne 0x140015347
mov ecx, 6
mov dword [0x140075324], ecx
jmp 0x140015391
jbe 0x14001538b
mov ecx, 8
mov dword [0x140075324], ecx
jmp 0x140015391
cmp edx, 0xa
jne 0x140015370
mov eax, dword [rsp + 0x28]
test eax, eax
jne 0x140015349
mov ecx, 7
mov dword [0x140075324], ecx
jmp 0x140015391
mov eax, dword [0x140075324]
mov ecx, 8
cmp edx, 0xa
cmova eax, ecx
mov ecx, eax
mov dword [0x140075324], eax
jmp 0x140015391
mov ecx, dword [0x140075324]
mov eax, ecx
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.140020e30
add rsp, 0x158
ret
Function at 0x14001c240
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x280
mov rax, qword [0x1400731a0]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rdx, [rsp + 0x60]
mov ecx, 0x104
mov esi, eax
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea rbx, [rdi + 0x4010]
cmp word [rbx], 0
jne 0x14001c29d
mov r8d, 0x104
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rax, [rsp + 0x60]
mov dword [rsp + 0x30], esi
lea r9, str._snw__s__d.log
lea rcx, [rsp + 0x60]
or r8, 0xffffffffffffffff
mov edx, 0x104
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rax
call fcn.140023da4
lea r8, [0x14005bd18]
lea rdx, [rsp + 0x60]
lea rcx, [rdi + 0x4218]
call fcn.14002433c
mov ebx, eax
test eax, eax
jne 0x14001c343
call fcn.14001c090
lea r9, str.Logger.cpp
lea r8, str.Logger::openLogFile
mov rcx, rax
lea rax, str.05:27:28
lea edx, [rbx + 3]
mov qword [rsp + 0x40], rax
lea rax, str.Jul__4_2018
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x30], rax
lea rax, str.logging_to_file__s__logger_build__s__s_
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x160
call fcn.14001c7d0
mov al, 1
jmp 0x14001c402
xor eax, eax
mov r9d, 0x400
mov r8d, ebx
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], eax
mov qword [rdi + 0x4218], rax
lea rax, [rsp + 0x50]
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
call fcn.14001c090
mov rcx, rax
mov rax, qword [rsp + 0x50]
lea r9, str.Logger.cpp
mov qword [rsp + 0x38], rax
lea rax, str.API_function_failed_with__d:__s
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x28], rax
lea r8, str.Logger::openLogFile
mov edx, 1
mov dword [rsp + 0x20], 0x166
call fcn.14001c7d0
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_LocalFree]
call fcn.14001c090
lea r9, str.Logger.cpp
mov rcx, rax
lea rax, [rsp + 0x60]
lea r8, str.Logger::openLogFile
mov qword [rsp + 0x30], rax
lea rax, str.failed_to_open_log_file__s_
mov edx, 2
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x167
call fcn.14001c7d0
xor al, al
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140020e30
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x14001cce0
Capabilities:
Access the windows event log

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x50
xor r14d, r14d
mov rsi, r8
lea ebp, [r14 + 1]
movzx ebx, r14w
dec edx
je 0x14001cd20
dec edx
je 0x14001cd19
dec edx
jne 0x14001cd23
lea ebx, [rbp + 3]
jmp 0x14001cd23
mov ebx, 2
jmp 0x14001cd23
movzx ebx, bp
lea rdx, str.nview
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov rdi, rax
test rax, rax
je 0x14001cd6e
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x38], rsi
mov dword [rsp + 0x30], r14d
xor r8d, r8d
mov r9d, ebp
movzx edx, bx
mov rcx, rax
mov word [rsp + 0x28], bp
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r14
ret

Function at 0x14001d410
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x30
mov r9d, dword [0x14007589c]
xor eax, eax
xor bl, bl
mov rdi, rdx
mov rsi, rcx
mov dword [rsp + 0x58], edx
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x50], eax
test r9d, r9d
jne 0x14001d480
mov dword [0x14007589c], 0x20019
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rdx, [rsp + 0x50]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
je 0x14001d479
cmp dword [rsp + 0x50], 0
je 0x14001d479
mov r9d, dword [0x14007589c]
bts r9d, 8
mov dword [0x14007589c], r9d
jmp 0x14001d480
mov r9d, dword [0x14007589c]
test rsi, rsi
je 0x14001d555
test rdi, rdi
je 0x14001d555
lea rax, [rsp + 0x60]
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallNVIDIA_nView_Desktop_Manager
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001d4f2
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x58]
lea rdx, str.InstallLocation
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x60]
test eax, eax
sete bl
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
jne 0x14001d555
mov r9d, dword [0x14007589c]
lea rax, [rsp + 0x60]
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallB2FE1952_0186_46C3_BAEC_A80AA35AC5B8_Display.NView
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001d555
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x58]
lea rdx, str.InstallLocation
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x60]
test eax, eax
sete bl
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, bl
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret