joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400c17c0
Capabilities:
Create process on windows

Disassembly:
test rcx, rcx
je 0x1400c19e2
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x90]
sub rsp, 0x190
mov rax, qword [0x1401e7e78]
xor rax, rsp
mov qword [rbp + 0x80], rax
cmp qword [rcx + 0x28], 0
je 0x1400c181b
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
or edx, 0xffffffff
lea rcx, str.ChildGui_unfastening_is_not_working_yet
call fcn.14011f550
jmp 0x1400c19bf
mov edi, dword [rcx + 0x644]
test edi, edi
je 0x1400c19bf
xor r9d, r9d
xor r8d, r8d
mov dl, 1
call fcn.1400ad6f8
test al, al
je 0x1400c19bf
lea rcx, [rsp + 0x78]
call fcn.140120d54
nop
xor r8d, r8d
lea rdx, [rsp + 0x78]
mov rcx, qword [0x14021c5d8]
call fcn.140017028
mov rbx, rax
mov r8d, edi
lea rdx, str._GuiMacro__Attach__u_
lea rcx, [rbp]
call fcn.14000d060
mov rcx, rbx
lea rax, [0x140168a9c]
neg rcx
sbb rdx, rdx
and rdx, rax
mov r8, qword [0x14021c5d8]
add r8, 0xaf0
and qword [rsp + 0x48], 0
and qword [rsp + 0x40], 0
and qword [rsp + 0x38], 0
lea rax, [rbp]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rbx
lea r9, str.___Detached
lea rdx, [0x14016b508]
lea rcx, [rsp + 0x68]
call fcn.140120be0
nop
xor edx, edx
lea r8d, [rdx + 0x64]
lea rcx, [rbp - 0x6c]
call fcn.14013b230
mov dword [rbp - 0x70], 0x68
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x40], rax
and qword [rsp + 0x38], 0
and qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x20
and dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x68]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x1400c1967
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rax, qword [0x14021c5e0]
mov qword [rsp + 0x20], rax
lea r9, str.Failed_to_start_new_ConEmu_instance
mov r8d, 0x10
mov rcx, qword [rsp + 0x68]
call fcn.14011f550
jmp 0x1400c19aa
mov rcx, qword [rsp + 0x50]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x1400c1988
and qword [rsp + 0x50], 0
cmp rcx, 0xffffffffffffffff
je 0x1400c1988
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x1400c19aa
and qword [rsp + 0x58], 0
cmp rcx, 0xffffffffffffffff
je 0x1400c19aa
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0x68]
call fcn.140120ddc
nop
lea rcx, [rsp + 0x78]
call fcn.140120ddc
mov rcx, qword [rbp + 0x80]
xor rcx, rsp
call fcn.140139b10
lea r11, [rsp + 0x190]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x1400c2ccc
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp byte [rcx + 0x10], 0
mov rbx, rcx
jne 0x1400c2ce8
call fcn.1400b5a28
test al, al
je 0x1400c2d5e
cmp byte [rbx + 0x11], 0
je 0x1400c2d5e
cmp byte [rbx + 0x12], 0
jne 0x1400c2d5e
lea rdi, [rbx + 0x20]
cmp byte [rbx + 0x13], 0
jne 0x1400c2d27
lea rcx, [rbx + 0x24]
mov byte [rbx + 0x13], 1
xor edx, edx
mov r8d, 0x234
call fcn.14013b230
mov rcx, qword [rbx + 0x18]
mov rdx, rdi
mov dword [rdi], 0x238
call sub.KERNEL32.dll_Process32FirstW
jmp 0x1400c2d33
mov rcx, qword [rbx + 0x18]
mov rdx, rdi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x1400c2d5a
mov r8, qword [rbx]
mov rdx, rdi
mov rcx, rbx
call qword [r8]
test al, al
je 0x1400c2cf8
lea rcx, [rbx + 0x258]
mov rdx, rdi
call fcn.1400a8764
mov al, 1
jmp 0x1400c2d60
mov byte [rbx + 0x12], 1
xor al, al
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1400c2ff4
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x230
mov rax, qword [0x1401e7e78]
xor rax, rsp
mov qword [rsp + 0x220], rax
mov rbx, rcx
mov rdx, rcx
mov rcx, qword [rcx + 8]
call fcn.140027e2c
test al, al
je 0x1400c308f
mov eax, dword [rbx + 0x4290]
test eax, eax
je 0x1400c30aa
cmp eax, dword [rbx + 0x644]
jne 0x1400c30aa
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [rbx + 0x4294]
cmp eax, 0x7d0
jb 0x1400c30aa
mov rcx, rbx
call fcn.1400c3b00
test al, al
je 0x1400c308f
mov r8d, dword [rbx + 0x644]
lea rdx, str.Server_PID_u_hangs_during_termination._Force_kill_triggered_
lea rcx, [rsp + 0x20]
call fcn.14000d13c
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.1400b2d14
mov rcx, qword [rbx + 0x648]
test rcx, rcx
je 0x1400c308f
mov edx, 0x64
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov al, 1
mov rcx, qword [rsp + 0x220]
xor rcx, rsp
call fcn.140139b10
add rsp, 0x230
pop rbx
ret
cmp qword [rbx + 0x18], 0
je 0x1400c308f
cmp byte [rbx + 0x4b06], 0
jne 0x1400c308f
xor al, al
jmp 0x1400c3091

Function at 0x1400c4fbc
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp dword [0x14021f400], 0
mov rbx, r8
mov rdi, rcx
je 0x1400c4ff9
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x14021f400]
cmp eax, 0x3e8
jae 0x1400c4ff9
mov rcx, qword [rdi]
lea rdx, str.CECMD_FLASHWINDOW_skipped__too_rapid_call
call fcn.1400b2d14
jmp 0x1400c500c
mov rcx, qword [0x14021c5d8]
lea rdx, [rbx + 0x30]
xor r8d, r8d
call fcn.140013638
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [rbx + 0xc]
mov edx, 0x30
mov dword [0x14021f400], eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.140126094
Function at 0x1400c8ce0
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rsi, rcx
lea rcx, [rbp - 0x30]
call fcn.140128da8
nop
or r8d, 0xffffffff
mov rdx, qword [rsi + 0x50]
lea rcx, [rbp - 0x30]
call fcn.140128e50
xor ebx, ebx
mov rax, qword [rsi + 0x20]
mov rcx, qword [rsi + 0x28]
cmp rax, rcx
je 0x1400c8d62
mov rbx, rcx
sub rbx, rax
sar rbx, 3
mov rbx, qword [rax + rbx*8 - 8]
mov qword [rbp + 0x10], rbx
lea rax, [rcx - 8]
mov qword [rsi + 0x28], rax
lea rcx, [rsi + 0x38]
mov rdx, qword [rcx + 8]
cmp rdx, qword [rcx + 0x10]
je 0x1400c8d57
mov qword [rdx], rbx
add qword [rcx + 8], 8
jmp 0x1400c8d17
lea r8, [rbp + 0x10]
call fcn.140007944
jmp 0x1400c8d17
lea rcx, [rbp - 0x30]
call fcn.140128f84
jmp 0x1400c8e3e
mov rax, qword [rsi + 0x38]
mov rcx, qword [rsi + 0x40]
cmp rax, rcx
jne 0x1400c8d81
xor al, al
jmp 0x1400c8d9a
mov rbx, rcx
sub rbx, rax
sar rbx, 3
mov rbx, qword [rax + rbx*8 - 8]
lea rax, [rcx - 8]
mov qword [rsi + 0x40], rax
mov al, 1
test al, al
je 0x1400c8e48
mov rdx, rbx
mov rcx, qword [0x14021c5d8]
call fcn.140027e34
test al, al
je 0x1400c8e3e
mov rdx, rbx
lea rcx, [rbp - 0x20]
call fcn.140114b28
nop
cmp qword [rbp - 0x18], 0
je 0x1400c8e35
cmp dword [rsi + 0x5c], 0
je 0x1400c8df5
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [rsi + 0x5c]
mov rcx, qword [0x14021c740]
mov ecx, dword [rcx + 0xf3c]
cmp eax, ecx
jae 0x1400c8df5
sub ecx, eax
call qword [sym.imp.KERNEL32.dll_Sleep]
mov byte [rsi + 0x58], 1
mov rcx, qword [0x14021c5d8]
call fcn.140013a50
mov dil, al
mov rcx, qword [rbp - 0x18]
call fcn.14011bab8
mov rcx, rax
call fcn.1400b54e0
mov dl, dil
mov rcx, qword [0x14021c5d8]
call fcn.140003df4
mov byte [rsi + 0x58], 0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rsi + 0x5c], eax
lea rcx, [rbp - 0x20]
call fcn.140114c28
cmp byte [rsi + 0x18], 0
je 0x1400c8d70
lea rcx, [rbp - 0x30]
call fcn.140128dec
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop rbp
ret
Function at 0x1400cce6c
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x3f0]
sub rsp, 0x4f0
mov rax, qword [0x1401e7e78]
xor rax, rsp
mov qword [rbp + 0x3e0], rax
mov r9d, 0x104
lea r8, [rbp + 0x1d0]
mov edx, 0x6a1
mov rsi, rcx
call qword [sym.imp.USER32.dll_GetDlgItemTextW]
xor r14d, r14d
test eax, eax
jne 0x1400ccec8
mov word [rbp + 0x1d0], r14w
mov r8d, 0x104
lea rdx, [rbp - 0x40]
lea rcx, [rbp + 0x1d0]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov ebx, reloc.SHELL32.dll_ILGetSize
lea rcx, [rsp + 0x20]
mov r8d, ebx
xor edx, edx
call fcn.14013b230
mov rax, qword [0x14021d130]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov r12d, 1
lea rax, str.All_images__.bmp_.jpg_.png_
mov dword [rsp + 0x20], ebx
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x50], rax
lea rax, str.Choose_background_image
mov qword [rsp + 0x78], rax
mov dword [rsp + 0x4c], r12d
mov dword [rsp + 0x58], 0x104
mov dword [rbp - 0x80], 0x88180c
call qword [sym.imp.COMDLG32.dll_GetOpenFileNameW]
test eax, eax
je 0x1400cd07f
mov rcx, qword [0x14021c748]
lea rdx, [rbp - 0x40]
mov r8b, r12b
call fcn.14008c43c
test al, al
je 0x1400cd07f
mov rdx, qword [0x14021c5d8]
add rdx, 0xcfa
or rbx, 0xffffffffffffffff
mov rax, rbx
inc rax
cmp word [rdx + rax*2], r14w
jne 0x1400ccf81
lea r8, [rbp - 0x40]
mov rcx, rbx
inc rcx
cmp word [r8 + rcx*2], r14w
jne 0x1400ccf92
cmp rcx, rax
jbe 0x1400cd03d
lea rdi, [rax + rax]
mov r15d, 0x5c
cmp word [rbp + rdi - 0x40], r15w
jne 0x1400cd03d
cmp rdi, 0x208
jae 0x1400cd0aa
lea rcx, [rbp - 0x40]
mov word [rbp + rdi - 0x40], r14w
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
movzx ecx, r14b
mov word [rbp + rdi - 0x40], r15w
cmove ecx, r12d
test cl, cl
je 0x1400cd03d
mov rcx, qword [0x14021c740]
lea rdx, str._ConEmuDir_
add rcx, 0xce4
call fcn.140004ad0
mov rax, qword [0x14021c5d8]
inc rbx
cmp word [rax + rbx*2 + 0xcfa], r14w
jne 0x1400cd00d
mov rcx, qword [0x14021c740]
lea r8, [rbp - 0x40]
lea r8, [r8 + rbx*2]
add rcx, 0xce4
mov edx, 0x104
call fcn.140001f38
jmp 0x1400cd054
mov rcx, qword [0x14021c740]
lea rdx, [rbp - 0x40]
add rcx, 0xce4
call fcn.140004ad0
mov r8, qword [0x14021c740]
mov edx, 0x6a1
add r8, 0xce4
mov rcx, rsi
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
mov rcx, qword [0x14021c5d8]
mov dl, r12b
call fcn.1400243ac
mov rcx, qword [rbp + 0x3e0]
xor rcx, rsp
call fcn.140139b10
lea r11, [rsp + 0x4f0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
call fcn.14013a21c
int3

Function at 0x1400cd3dc
Capabilities:
Create process on windows

Disassembly:
sub rsp, 0x38
mov dword [rsp + 0x28], 1
lea r8, str.https:__chrisant996.github.io_clink_
and qword [rsp + 0x20], 0
lea rdx, str.open
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
add rsp, 0x38
ret
Function at 0x1400ce950
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
lea rbp, [rax - 0x3f8]
sub rsp, 0x4f0
mov rax, qword [0x1401e7e78]
xor rax, rsp
mov qword [rbp + 0x3e0], rax
mov r9d, 0x104
lea r8, [rbp + 0x1d0]
mov edx, 0x868
mov rdi, rcx
call qword [sym.imp.USER32.dll_GetDlgItemTextW]
xor esi, esi
test eax, eax
jne 0x1400ce9a7
mov word [rbp + 0x1d0], si
mov r8d, 0x104
lea rdx, [rbp - 0x40]
lea rcx, [rbp + 0x1d0]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov ebx, reloc.SHELL32.dll_ILGetSize
lea rcx, [rsp + 0x20]
mov r8d, ebx
xor edx, edx
call fcn.14013b230
mov rax, qword [0x14021d130]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x28], rax
lea rax, str.Processors__cmd.exe_tcc.exe_
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x50], rax
lea rax, str.Choose_command_processor
mov qword [rsp + 0x78], rax
mov dword [rsp + 0x20], ebx
mov dword [rsp + 0x4c], 1
mov dword [rsp + 0x58], 0x104
mov dword [rbp - 0x80], 0x88180c
call qword [sym.imp.COMDLG32.dll_GetOpenFileNameW]
test eax, eax
je 0x1400cea99
mov rcx, qword [0x14021c740]
lea rdx, [rbp - 0x40]
add rcx, 0x2e
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
lea r8, [rbp - 0x40]
mov edx, 0x868
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
test ebx, ebx
je 0x1400cea99
mov rcx, qword [0x14021c740]
lea rdx, [rbp - 0x40]
add rcx, 0x2e
call fcn.140004ad0
mov rax, qword [0x14021c740]
mov r8d, 0x867
mov r9d, r8d
mov rcx, rdi
lea edx, [r8 - 3]
mov dword [rax + 0x1a], 3
call fcn.140047248
mov rcx, qword [0x14021c5d8]
call fcn.140018acc
mov rcx, qword [rbp + 0x3e0]
xor rcx, rsp
call fcn.140139b10
lea r11, [rsp + 0x4f0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x1400cf270
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x430]
sub rsp, 0x530
mov rax, qword [0x1401e7e78]
xor rax, rsp
mov qword [rbp + 0x420], rax
mov rdi, rcx
xor edx, edx
mov r8d, 0x20a
lea rcx, [rbp]
call fcn.14013b230
lea rdx, [rbp + 0x210]
mov ecx, 0x105
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov rax, qword [0x14021c740]
mov rbx, qword [rax + 0x11040]
lea rcx, [rsp + 0x30]
call fcn.1401286a8
nop
xor r8d, r8d
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.14012571c
mov rbx, rax
test rax, rax
je 0x1400cf30f
lea rcx, [rsp + 0x30]
call fcn.140058574
mov rdx, rax
mov r8d, 0x105
lea rcx, [rbp]
call qword [sym.imp.KERNEL32.dll_lstrcpynW]
mov dword [rsp + 0x60], reloc.SHELL32.dll_ILGetSize
xor edx, edx
mov r8d, 0x90
lea rcx, [rsp + 0x68]
call fcn.14013b230
mov rax, qword [0x14021d130]
mov qword [rsp + 0x68], rax
lea rax, str.Executables__.exe_
mov qword [rsp + 0x78], rax
mov dword [rbp - 0x74], 1
lea rax, [rbp]
mov qword [rbp - 0x70], rax
mov dword [rbp - 0x68], 0x105
lea rax, [rbp + 0x210]
mov qword [rbp - 0x50], rax
lea rax, str.Choose_file_editor
mov qword [rbp - 0x48], rax
lea rax, [0x1401a5bf0]
mov qword [rbp - 0x38], rax
mov dword [rbp - 0x40], 0x88080c
lea rcx, [rsp + 0x60]
call qword [sym.imp.COMDLG32.dll_GetSaveFileNameW]
test eax, eax
je 0x1400cf417
mov r8, rbx
lea rdx, [rbp]
lea rcx, [rsp + 0x20]
call fcn.140125604
nop
lea rcx, [rsp + 0x20]
call fcn.140120ef0
test al, al
je 0x1400cf40c
lea rcx, [rsp + 0x20]
call fcn.140058574
mov r8, rax
mov edx, 0x8cf
mov rcx, rdi
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
mov rax, qword [0x14021c740]
mov rcx, qword [rax + 0x11040]
test rcx, rcx
je 0x1400cf3f4
call fcn.14012008c
mov rax, qword [0x14021c740]
and qword [rax + 0x11040], 0
lea rcx, [rsp + 0x20]
call fcn.140121210
mov rcx, qword [0x14021c740]
mov qword [rcx + 0x11040], rax
lea rcx, [rsp + 0x20]
call fcn.140120ddc
nop
lea rcx, [rsp + 0x30]
call fcn.1401286cc
mov rcx, qword [rbp + 0x420]
xor rcx, rsp
call fcn.140139b10
lea r11, [rsp + 0x530]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret

Function at 0x1400cf6cc
Capabilities:
Log keystrokes via application hook

Disassembly:
sub rsp, 0x28
movzx ecx, r8b
test r8b, r8b
je 0x1400cf71c
sub ecx, 1
je 0x1400cf6f6
cmp ecx, 1
jne 0x1400cf740
mov rax, qword [0x14021c740]
mov byte [rax + 0x1104a], 0
add rsp, 0x28
ret
mov rax, qword [0x14021c740]
mov byte [rax + 0x1104a], 1
mov rcx, qword [0x14021c5d8]
call fcn.140014138
mov rcx, rax
add rsp, 0x28
jmp fcn.14005aeb8
mov rax, qword [0x14021c740]
mov byte [rax + 0x1104a], 2
mov rcx, qword [0x14021c5d8]
call fcn.140014138
mov rcx, rax
xor edx, edx
call fcn.14005b5f8
add rsp, 0x28
ret
Function at 0x1400d0840
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x3f0]
sub rsp, 0x4f0
mov rax, qword [0x1401e7e78]
xor rax, rsp
mov qword [rbp + 0x3e0], rax
mov rbx, rcx
xor edx, edx
lea rcx, [rbp - 0x40]
mov r8d, 0x208
call fcn.14013b230
mov rcx, qword [0x14021c740]
lea rdx, [rbp + 0x1d0]
mov r8d, 0x105
mov rcx, qword [rcx + 0x11708]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
xor edx, edx
mov dword [rsp + 0x20], reloc.SHELL32.dll_ILGetSize
mov r8d, 0x90
lea rcx, [rsp + 0x28]
call fcn.14013b230
mov rax, qword [0x14021d130]
lea rdx, str.ConEmuSetup.exe
mov qword [rsp + 0x28], rax
lea rcx, [rbp - 0x40]
lea rax, str.Packages
mov dword [rsp + 0x4c], 1
mov qword [rsp + 0x38], rax
call fcn.140004ad0
lea rax, [rbp - 0x40]
mov dword [rsp + 0x58], 0x104
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x20]
lea rax, [rbp + 0x1d0]
mov dword [rbp - 0x80], 0x88080c
mov qword [rsp + 0x70], rax
lea rax, str.Choose_download_path
mov qword [rsp + 0x78], rax
lea rax, [0x14015a140]
mov qword [rbp - 0x78], rax
call qword [sym.imp.COMDLG32.dll_GetSaveFileNameW]
xor edi, edi
test eax, eax
je 0x1400d095c
lea edx, [rdi + 0x5c]
lea rcx, [rbp - 0x40]
call fcn.14013bd50
test rax, rax
je 0x1400d095c
lea r8, [rbp - 0x40]
mov word [rax], di
mov edx, 0x80f
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
mov rcx, qword [rbp + 0x3e0]
xor rcx, rsp
call fcn.140139b10
lea r11, [rsp + 0x4f0]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x1400d5124
Capabilities:
Hide graphical window

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1401e7e78]
xor rax, rsp
mov qword [rbp - 8], rax
mov rsi, rcx
mov rcx, qword [rcx + 0x58]
test rcx, rcx
je 0x1400d5164
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x1400d5164
and qword [rsi + 0x58], 0
mov rax, qword [rsi + 0x58]
test rax, rax
jne 0x1400d530b
mov r8b, 1
lea rcx, str.Creating_child_dialog_IDD_SPG_APPDISTINCT2
mov dl, r8b
call fcn.14002b004
lea rdi, [rsi + 0x48]
mov rcx, rdi
call fcn.140004868
mov rdx, qword [rsi + 8]
lea r8, [fcn.1400d6a7c]
mov ebx, 0xa2
xor r9d, r9d
mov ecx, ebx
call fcn.140050068
mov qword [rdi], rax
test rax, rax
je 0x1400d5330
mov rcx, qword [rax + 8]
mov qword [rsi + 0x58], rcx
test rcx, rcx
je 0x1400d5335
mov r8d, ebx
mov edx, 0xfffffff4
call qword [sym.imp.USER32.dll_SetWindowLongPtrW]
lea rbx, [rsi + 0x50]
cmp qword [rbx], 0
jne 0x1400d5200
cmp qword [rsi + 0x30], 0
je 0x1400d5200
mov rcx, rbx
call fcn.140047a44
mov r9, qword [rdi]
mov r8, qword [rsi + 8]
mov rdx, qword [rsi + 0x58]
mov rcx, qword [rbx]
call fcn.1400476cc
mov rcx, qword [rsi + 8]
mov edx, 0x931
call qword [sym.imp.USER32.dll_GetDlgItem]
xorps xmm0, xmm0
lea rdx, [rbp - 0x48]
mov rcx, rax
mov rdi, rax
movups xmmword [rbp - 0x48], xmm0
call qword [sym.imp.USER32.dll_GetWindowRect]
mov rdx, qword [rsi + 8]
lea r8, [rbp - 0x48]
mov r9d, 2
xor ecx, ecx
call qword [sym.imp.USER32.dll_MapWindowPoints]
mov rcx, qword [rsi + 0x58]
mov edx, 0x935
and qword [rbp - 0x50], 0
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rdx, qword [rsi + 0x58]
lea r8, [rbp - 0x50]
mov rcx, rax
mov r9d, 1
mov rbx, rax
call qword [sym.imp.USER32.dll_MapWindowPoints]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [rbp - 0x44]
xorps xmm0, xmm0
sub eax, dword [rbp - 0x3c]
add eax, dword [rbp - 0x4c]
mov edx, dword [0x1401e7154]
mov rcx, qword [rsi + 0x58]
and dword [rbp - 0x20], 0
and qword [rbp - 0x14], 0
mov dword [rbp - 0x1c], eax
mov dword [rbp - 0x28], 0x1c
mov dword [rbp - 0x24], 0x17
movups xmmword [rbp - 0x38], xmm0
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
lea rdx, [rbp - 0x38]
call qword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [rbp - 0x2c]
lea r8, [rbp - 0x28]
sub eax, dword [rbp - 0x34]
xor r9d, r9d
mov rcx, qword [rsi + 0x58]
mov dword [rbp - 0x18], eax
lea edx, [r9 + 1]
call qword [sym.imp.USER32.dll_SetScrollInfo]
mov rcx, qword [rsi + 0x58]
lea rdx, [rbp - 0x48]
xor r8d, r8d
call fcn.14002b06c
xor edx, edx
mov rcx, rdi
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [rsi + 0x58]
mov edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
mov rax, qword [rsi + 0x58]
test rax, rax
setne al
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140139b10
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
and qword [rsi + 0x58], 0
mov rcx, qword [rsi + 8]
xor edx, edx
call qword [sym.imp.USER32.dll_EnableWindow]
xor al, al
jmp 0x1400d530e
Function at 0x1400d81dc
Capabilities:
Get graphical window text

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rsi, rcx
movzx r14d, dx
mov rcx, qword [rcx + 8]
test rcx, rcx
je 0x1400d82c3
mov edx, 0x612
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
mov rbp, rax
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
cmp eax, 1
jl 0x1400d82c3
lea ebx, [rax + 1]
movsxd rcx, ebx
add rcx, rcx
call fcn.140120104
mov r8d, ebx
mov rdx, rax
mov rcx, rbp
mov rdi, rax
call qword [sym.imp.USER32.dll_GetWindowTextW]
cmp word [rdi], 0x3c
je 0x1400d8270
mov rcx, qword [0x14021c740]
mov eax, 0x84b
mov rdx, rdi
cmp r14w, ax
jne 0x1400d826b
call fcn.1400835a4
jmp 0x1400d8270
call fcn.140083274
mov rcx, rbp
call qword [sym.imp.USER32.dll_SetFocus]
mov rcx, qword [rsi + 8]
mov edx, r14d
call qword [sym.imp.USER32.dll_GetDlgItem]
mov ebp, 0xfffffff0
mov rcx, rax
mov edx, ebp
mov rbx, rax
call qword [sym.imp.USER32.dll_GetWindowLongPtrW]
mov edx, ebp
mov rcx, rbx
and rax, 0xfffffffffffffffe
mov r8, rax
call qword [sym.imp.USER32.dll_SetWindowLongPtrW]
mov rax, qword [rsi]
xor r8d, r8d
mov rdx, qword [rsi + 8]
mov rcx, rsi
call qword [rax + 0x10]
mov rcx, rdi
call fcn.14012008c
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x1400d8af4
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x70
mov dil, r9b
mov rsi, r8
mov r14, rdx
lea rcx, [rax - 0x30]
call fcn.140120d54
nop
mov edx, 0xffff
lea rcx, [rsp + 0x58]
call fcn.140121228
mov rbx, rax
xor r15d, r15d
xor r9d, r9d
xor r8d, r8d
test rax, rax
jne 0x1400d8b71
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
xor edx, edx
mov rcx, r14
call fcn.140120be0
jmp 0x1400d8ccd
mov dword [rsp + 0x50], 0x1fffa
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea rdx, [0x140171908]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400d8cb1
mov eax, dword [rsp + 0x50]
shr rax, 1
mov word [rbx + rax*2], r15w
test dil, dil
je 0x1400d8c67
cmp word [rbx], r15w
je 0x1400d8c67
lea rdx, str.ConEmuCmd_Autorun.cmd
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
mov rsi, rax
test rax, rax
je 0x1400d8c67
mov rdi, rax
mov r12d, 0x26
cmp rax, rbx
jbe 0x1400d8bfb
lea rax, [rdi - 2]
cmp word [rax], r12w
je 0x1400d8bfb
mov rdi, rax
cmp rax, rbx
ja 0x1400d8be9
mov edx, r12d
mov rcx, rsi
call fcn.14013a9b0
or rbp, 0xffffffffffffffff
test rax, rax
jne 0x1400d8c26
mov rax, rbp
inc rax
cmp word [rsi + rax*2], r15w
jne 0x1400d8c12
lea rax, [rsi + rax*2]
jmp 0x1400d8c2c
add rax, 2
cmp word [rax], r12w
je 0x1400d8c22
cmp rdi, rbx
ja 0x1400d8c7f
cmp word [rax], r15w
jne 0x1400d8c3d
mov word [rbx], r15w
jmp 0x1400d8c67
cmp rdi, rbx
jne 0x1400d8c4a
mov rcx, rax
call fcn.140125c74
inc rbp
cmp word [rax + rbp*2], r15w
jne 0x1400d8c4a
lea r8, [rbp*2 + 2]
mov rdx, rax
mov rcx, rdi
call fcn.14013b6b0
mov rcx, rbx
call fcn.140125c74
test rax, rax
je 0x1400d8ca3
cmp word [rax], r15w
je 0x1400d8ca3
movzx eax, word [rbx]
jmp 0x1400d8caa
cmp word [rax], r15w
jne 0x1400d8c4a
lea rax, [rdi - 2]
cmp word [rax], r12w
je 0x1400d8c95
cmp word [rax], 0x20
jne 0x1400d8c9d
mov rdi, rax
cmp rax, rbx
ja 0x1400d8c85
mov word [rdi], r15w
jmp 0x1400d8c67
mov word [rbx], r15w
mov eax, r15d
test ax, ax
jne 0x1400d8cbf
jmp 0x1400d8cb5
mov word [rbx], r15w
lea rcx, [rsp + 0x58]
call fcn.1401214e4
lea rdx, [rsp + 0x58]
mov rcx, r14
call fcn.140120b90
nop
lea rcx, [rsp + 0x58]
call fcn.140120ddc
mov rax, r14
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret