joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140101790
Capabilities:
Hide graphical window

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
lea rcx, str.ui_close_n
call fcn.1400b3e90
mov rcx, rbx
call fcn.1400fcf30
mov rcx, qword [rbx + 0x78]
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, rbx
call fcn.1400f8ed0
cmp dword [rbx + 0x5b0], 0
jne 0x14010184e
cmp byte [0x14020ddc6], 0
je 0x1401017e1
mov rcx, rbx
call fcn.14015e6a0
jmp 0x14010184e
cmp qword [0x14020e488], rbx
mov rax, qword [rbx + 0x1b0]
mov dword [rbx + 0x5b0], 1
jne 0x140101804
mov qword [0x14020e488], rax
jmp 0x140101812
mov rcx, qword [rbx + 0x1b8]
mov qword [rcx + 0x1b0], rax
cmp qword [0x14020e490], rbx
mov rax, qword [rbx + 0x1b8]
jne 0x14010182b
mov qword [0x14020e490], rax
jmp 0x140101839
mov rcx, qword [rbx + 0x1b0]
mov qword [rcx + 0x1b8], rax
mov rax, qword [0x14020e460]
mov qword [0x14020e460], rbx
mov qword [rbx + 0x1b0], rax
cmp byte [reloc.WS2_32.dll_accept], 0
jne 0x14010186b
cmp qword [0x14020e488], 0
jne 0x14010186b
add rsp, 0x20
pop rbx
jmp fcn.1400f38e0
call fcn.1400e6cf0
xor ecx, ecx
add rsp, 0x20
pop rbx
jmp fcn.14000d390

Function at 0x140102b40
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push rbx
sub rsp, 0x20
cmp byte [reloc.WS2_32.dll_accept], 0
mov rbx, rcx
je 0x140102cac
call fcn.14015f660
test eax, eax
je 0x140102c9d
mov rcx, qword [rbx + 0x228]
mov qword [rsp + 0x30], rdi
call fcn.1400e8380
mov rcx, rbx
call fcn.140100cc0
mov r8d, dword [rbx + 0x3c0]
lea rdx, str.CUT_isviewing__d_n
or ecx, 0xffffffff
call fcn.1400b3ec0
xor edi, edi
cmp dword [rbx + 0x3c0], edi
je 0x140102bb3
mov rdx, qword [rbx + 0x3c8]
mov rcx, qword [rbx + 0x78]
call qword [sym.imp.USER32.dll_ChangeClipboardChain]
mov dword [rbx + 0x3c0], edi
mov rcx, qword [rbx + 0x78]
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x140102c2b
call qword [sym.imp.USER32.dll_EmptyClipboard]
mov rcx, rbx
call fcn.1400f6a60
test rax, rax
je 0x140102c25
mov rdx, rax
mov ecx, reloc.WS2_32.dll_ntohs
call qword [sym.imp.USER32.dll_SetClipboardData]
mov ecx, 2
call fcn.1400f69f0
test rax, rax
mov rdi, rax
je 0x140102c20
mov ax, word [0x14020e438]
test ax, ax
jne 0x140102c14
lea rcx, str.Preferred_DropEffect
call qword [sym.imp.USER32.dll_RegisterClipboardFormatW]
mov word [0x14020e438], ax
movzx ecx, ax
mov rdx, rdi
call qword [sym.imp.USER32.dll_SetClipboardData]
mov edi, 1
call qword [sym.imp.USER32.dll_CloseClipboard]
lea rdx, str.iscut__d_n
mov r8d, edi
or ecx, 0xffffffff
call fcn.1400b3ec0
test edi, edi
je 0x140102c92
lea rdx, str.ghost_selection_n
or ecx, 0xffffffff
call fcn.1400b3ec0
mov rcx, rbx
call fcn.140134340
mov r8d, dword [rbx + 0x3c0]
lea rdx, str.viewing__d_n
or ecx, 0xffffffff
call fcn.1400b3ec0
cmp dword [rbx + 0x3c0], 0
jne 0x140102c92
mov rcx, qword [rbx + 0x78]
call qword [sym.imp.USER32.dll_SetClipboardViewer]
mov dword [rbx + 0x3c0], 1
mov qword [rbx + 0x3c8], rax
mov dword [rbx + 0x3bc], edi
mov rdi, qword [rsp + 0x30]
lea rdx, str.is_cut_done_n
or ecx, 0xffffffff
call fcn.1400b3ec0
add rsp, 0x20
pop rbx
ret
Function at 0x140102cc0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push rbx
sub rsp, 0x20
cmp byte [reloc.WS2_32.dll_accept], 0
mov rbx, rcx
je 0x140102dee
call fcn.14015f660
test eax, eax
je 0x140102dee
mov rcx, qword [rbx + 0x228]
call fcn.1400e8380
mov rcx, rbx
call fcn.140100cc0
mov rcx, qword [rbx + 0x78]
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x140102dee
call qword [sym.imp.USER32.dll_EmptyClipboard]
mov rcx, rbx
call fcn.1400f6a60
test rax, rax
je 0x140102d2a
mov rdx, rax
mov ecx, reloc.WS2_32.dll_ntohs
call qword [sym.imp.USER32.dll_SetClipboardData]
mov rcx, rbx
call fcn.1400f6da0
test rax, rax
mov rbx, rax
je 0x140102d66
mov ax, word [0x14020e430]
test ax, ax
jne 0x140102d5a
lea rcx, str.Shell_IDList_Array
call qword [sym.imp.USER32.dll_RegisterClipboardFormatW]
mov word [0x14020e430], ax
movzx ecx, ax
mov rdx, rbx
call qword [sym.imp.USER32.dll_SetClipboardData]
mov edx, 4
lea ecx, [rdx - 2]
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
test rax, rax
mov rbx, rax
je 0x140102de8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
test rax, rax
je 0x140102ddf
mov rcx, rbx
mov dword [rax], 5
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
test eax, eax
jne 0x140102ddf
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x140102ddf
mov ax, word [0x14020e438]
test ax, ax
jne 0x140102dc7
lea rcx, str.Preferred_DropEffect
call qword [sym.imp.USER32.dll_RegisterClipboardFormatW]
mov word [0x14020e438], ax
movzx ecx, ax
mov rdx, rbx
call qword [sym.imp.USER32.dll_SetClipboardData]
add rsp, 0x20
pop rbx
jmp qword [sym.imp.USER32.dll_CloseClipboard]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalFree]
call qword [sym.imp.USER32.dll_CloseClipboard]
add rsp, 0x20
pop rbx
ret

Function at 0x140102e60
Capabilities:
Enumerate gui resources

Disassembly:
sub rsp, 0x28
lea rdx, [rsp + 0x30]
lea rcx, [0x1400f68d0]
mov qword [rsp + 0x30], 0
call qword [sym.imp.USER32.dll_EnumWindows]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140102e98
call fcn.140101790
mov eax, 1
add rsp, 0x28
ret
xor eax, eax
add rsp, 0x28
ret
Function at 0x14010ec10
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x250
mov rax, qword [0x14020cc08]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbx, rdx
mov rdi, rcx
lea r8, [rsp + 0x30]
mov r9d, 0x104
mov edx, 0x21
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x14010ec83
movzx eax, word [rsp + 0x30]
sub eax, 0x30
je 0x14010ec6d
cmp eax, 2
jne 0x14010ec83
movzx eax, word [rbx + 6]
movzx r8d, word [rbx]
jmp 0x14010ec8b
movzx eax, word [rbx]
movzx r9d, word [rbx + 6]
movzx r8d, word [rbx + 2]
lea rdx, str._02d__d__d
jmp 0x14010ec97
movzx eax, word [rbx]
movzx r8d, word [rbx + 6]
movzx r9d, word [rbx + 2]
lea rdx, str._d__02d__d
mov rcx, rdi
mov dword [rsp + 0x20], eax
call fcn.140178e90
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1401a8fd0
mov rbx, qword [rsp + 0x270]
add rsp, 0x250
pop rdi
ret
Function at 0x14010ecd0
Capabilities:
Get geographical location

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x278
mov rax, qword [0x14020cc08]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rbx, rcx
mov rcx, qword [rcx + 0x10]
mov rsi, r8
mov rdi, rdx
lea r8, [rsp + 0x30]
mov edx, r9d
call fcn.1400dc060
mov edx, dword [rsp + 0x2c0]
mov rcx, qword [rbx + 0x10]
lea r8, [rsp + 0x40]
mov ebp, eax
call fcn.1400dc060
test ebp, ebp
mov ebx, eax
jne 0x14010ed2d
test eax, eax
je 0x14010ef2e
mov rcx, qword [rdi + 8]
cmp byte [rcx], 0
je 0x14010ed40
mov dl, 0x20
mov rcx, rdi
call fcn.140177700
test rsi, rsi
je 0x14010ed50
mov rdx, rsi
mov rcx, rdi
call fcn.1401777b0
test ebp, ebp
je 0x14010eefe
test ebx, ebx
je 0x14010ee81
movzx eax, word [rsp + 0x46]
cmp word [rsp + 0x36], ax
jne 0x14010ed96
movzx eax, word [rsp + 0x42]
cmp word [rsp + 0x32], ax
jne 0x14010ed96
movzx eax, word [rsp + 0x40]
cmp word [rsp + 0x30], ax
jne 0x14010ed96
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.14010ec10
jmp 0x14010ef2e
lea r8, [rsp + 0x50]
mov r9d, 0x104
mov edx, 0x21
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x14010edeb
movzx eax, word [rsp + 0x50]
sub eax, 0x30
je 0x14010edd1
cmp eax, 2
jne 0x14010edeb
movzx eax, word [rsp + 0x36]
movzx r8d, word [rsp + 0x30]
jmp 0x14010edf6
movzx eax, word [rsp + 0x30]
movzx r9d, word [rsp + 0x36]
movzx r8d, word [rsp + 0x32]
lea rdx, str._02d__d__d
jmp 0x14010ee03
movzx eax, word [rsp + 0x30]
movzx r8d, word [rsp + 0x36]
movzx r9d, word [rsp + 0x32]
lea rdx, str._d__02d__d
mov rcx, rdi
mov dword [rsp + 0x20], eax
call fcn.140178e90
lea rdx, [0x1401b7db0]
mov rcx, rdi
call fcn.1401777b0
lea r8, [rsp + 0x50]
mov r9d, 0x104
mov edx, 0x21
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x14010ef0a
movzx eax, word [rsp + 0x50]
sub eax, 0x30
je 0x14010ee64
cmp eax, 2
jne 0x14010ef0a
movzx eax, word [rsp + 0x46]
movzx r8d, word [rsp + 0x40]
jmp 0x14010ef15
movzx eax, word [rsp + 0x40]
movzx r9d, word [rsp + 0x46]
movzx r8d, word [rsp + 0x42]
lea rdx, str._02d__d__d
jmp 0x14010ef22
lea rdx, [0x1401d2b00]
mov rcx, rdi
call fcn.1401777b0
lea r8, [rsp + 0x50]
mov r9d, 0x104
mov edx, 0x21
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x14010eeeb
movzx eax, word [rsp + 0x50]
sub eax, 0x30
je 0x14010eed1
cmp eax, 2
jne 0x14010eeeb
movzx eax, word [rsp + 0x36]
movzx r9d, word [rsp + 0x32]
movzx r8d, word [rsp + 0x30]
jmp 0x14010ef1b
movzx eax, word [rsp + 0x30]
movzx r9d, word [rsp + 0x36]
movzx r8d, word [rsp + 0x32]
lea rdx, str._02d__d__d
jmp 0x14010ef22
movzx eax, word [rsp + 0x30]
movzx r9d, word [rsp + 0x32]
movzx r8d, word [rsp + 0x36]
jmp 0x14010ef1b
lea rdx, [0x1401d2afc]
jmp 0x14010ee16
movzx r8d, word [rsp + 0x46]
movzx eax, word [rsp + 0x40]
movzx r9d, word [rsp + 0x42]
lea rdx, str._d__02d__d
mov rcx, rdi
mov dword [rsp + 0x20], eax
call fcn.140178e90
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1401a8fd0
add rsp, 0x278
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1401107f0
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x240
mov rax, qword [0x14020cc08]
xor rax, rsp
mov qword [rsp + 0x230], rax
xor eax, eax
mov rbx, rdx
mov rsi, rcx
mov qword [rdx], rax
mov qword [rdx + 8], rax
lea r8, [rsp + 0x20]
lea edx, [rax + 0x21]
mov r9d, 0x104
mov ecx, 0x400
lea edi, [rax + 1]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x14011084b
movzx edi, word [rsp + 0x20]
sub edi, 0x30
mov rdx, qword [rsi]
movzx eax, byte [rdx]
cmp al, 0x30
jb 0x140110968
cmp al, 0x39
ja 0x140110968
xor r11d, r11d
test al, al
mov r10, r11
je 0x140110894
nop
nop
cmp al, 0x30
jb 0x140110894
cmp al, 0x39
ja 0x140110894
movzx eax, al
add rdx, 1
sub eax, 0x30
movsxd rcx, eax
lea rax, [r10 + r10*4]
lea r10, [rcx + rax*2]
movzx eax, byte [rdx]
test al, al
jne 0x140110870
lea r8, str._.:t
mov qword [rsi], rdx
mov al, 0x2f
mov rcx, r8
sub rcx, rdx
cmp byte [rdx], al
jne 0x140110968
movzx eax, byte [rcx + rdx + 1]
add rdx, 1
test al, al
jne 0x1401108a6
mov qword [rsi], rdx
movzx eax, byte [rdx]
cmp al, 0x30
jb 0x140110968
cmp al, 0x39
ja 0x140110968
test al, al
je 0x1401108f8
cmp al, 0x30
jb 0x1401108f8
cmp al, 0x39
ja 0x1401108f8
movzx eax, al
add rdx, 1
sub eax, 0x30
movsxd rcx, eax
lea rax, [r11 + r11*4]
lea r11, [rcx + rax*2]
mov al, byte [rdx]
test al, al
jne 0x1401108d5
mov qword [rsi], rdx
mov al, 0x2f
sub r8, rdx
cmp byte [rdx], al
jne 0x140110968
movzx eax, byte [r8 + rdx + 1]
add rdx, 1
test al, al
jne 0x140110900
mov qword [rsi], rdx
movzx eax, byte [rdx]
cmp al, 0x30
jb 0x140110968
cmp al, 0x39
ja 0x140110968
mov rcx, rsi
call fcn.1401107b0
test edi, edi
je 0x140110954
cmp edi, 2
mov word [rbx + 2], r11w
je 0x140110945
mov word [rbx], ax
mov word [rbx + 6], r10w
mov eax, 1
jmp 0x14011096a
mov word [rbx + 6], ax
mov word [rbx], r10w
mov eax, 1
jmp 0x14011096a
mov word [rbx], ax
mov word [rbx + 2], r10w
mov word [rbx + 6], r11w
mov eax, 1
jmp 0x14011096a
xor eax, eax
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1401a8fd0
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14013bd40
Capabilities:
Move file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp byte [rcx + 0x400], 0
mov edi, r8d
mov esi, edx
mov rbx, rcx
je 0x14013bd79
mov rcx, qword [rcx + 0x3d8]
mov edx, 1
call qword [sym.imp.USER32.dll_KillTimer]
mov byte [rbx + 0x400], 0
xor r9d, r9d
mov r8d, edi
mov edx, esi
mov rcx, rbx
call fcn.140138cc0
cmp eax, 0xffffffff
je 0x14013bdd0
mov ecx, send
call fcn.1400da600
mov rcx, rbx
test eax, eax
je 0x14013bdb8
mov edx, 0xa031
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp fcn.140108b70
movsx eax, byte [0x14020ddb5]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], eax
call fcn.1401032d0
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x14013c160
Capabilities:
Move file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rax, rdx
movsx esi, dx
mov rbx, rcx
shr rax, 0x10
mov edx, esi
movsx edi, ax
mov r8d, edi
call fcn.140139420
test eax, eax
jne 0x14013c272
movsx ecx, byte [0x14020dd93]
sub ecx, 1
je 0x14013c272
cmp ecx, 1
je 0x14013c1f9
cmp dword [rbx + 0x46c], 0xffffffff
jne 0x14013c1f0
mov dword [rbx + 0x46c], eax
mov rax, qword [0x14020e310]
test rax, rax
je 0x14013c1de
lea rcx, [rsp + 0x48]
mov edx, 0x80
call rax
test byte [rsp + 0x48], 0x20
jne 0x14013c1de
mov dword [rbx + 0x46c], 1
mov edx, dword [rbx + 0x46c]
lea rcx, str.cached_oneclickactivate__d_n
call fcn.1400b3e90
cmp dword [rbx + 0x46c], 0
jne 0x14013c272
cmp byte [rbx + 0x400], 0
je 0x14013c21b
mov rcx, qword [rbx + 0x3d8]
mov edx, 1
call qword [sym.imp.USER32.dll_KillTimer]
mov byte [rbx + 0x400], 0
xor r9d, r9d
mov r8d, edi
mov edx, esi
mov rcx, rbx
call fcn.140138cc0
cmp eax, 0xffffffff
je 0x14013c272
mov ecx, send
call fcn.1400da600
mov rcx, rbx
test eax, eax
je 0x14013c25a
mov edx, 0xa031
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
jmp fcn.140108b70
movsx eax, byte [0x14020ddb5]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], eax
call fcn.1401032d0
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x14013ca00
Capabilities:
Change the wallpaper

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
movsxd rbx, edx
mov rdi, rcx
call fcn.14015fa40
test eax, eax
je 0x14013ca36
xor r9d, r9d
mov r8, rbx
mov rcx, rdi
lea edx, [r9 + 5]
call fcn.1400f9790
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
imul ebx, ebx, 0xfffffffb
mov eax, 0x88888889
add dword [rdi + 0x428], ebx
mov ecx, dword [rdi + 0x428]
imul ecx
lea ebx, [rcx + rdx]
sar ebx, 6
mov eax, ebx
shr eax, 0x1f
add ebx, eax
je 0x14013cb88
mov eax, ebx
xor edx, edx
lea r8, [rsp + 0x80]
xor r9d, r9d
imul eax, eax, 0x78
sub ecx, eax
mov dword [rdi + 0x428], ecx
lea ecx, [rdx + 0x68]
call qword [sym.imp.USER32.dll_SystemParametersInfoW]
mov r11d, dword [rsp + 0x80]
mov rcx, qword [rdi + 0x3d8]
cmp r11d, 1
mov eax, 3
cmovb r11d, eax
mov dword [rsp + 0x80], r11d
call fcn.1400d8b20
bt eax, 0x14
jae 0x14013cb88
mov rcx, qword [rdi + 0x3d8]
xor eax, eax
lea r8, [rsp + 0x20]
mov qword [rsp + 0x20], rax
xor edx, edx
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x20], 0x1c
mov dword [rsp + 0x24], 2
call qword [sym.imp.USER32.dll_GetScrollInfo]
mov esi, dword [rsp + 0x80]
mov eax, dword [rsp + 0x30]
cmp esi, eax
cmova esi, eax
cmp byte [rdi + 0x230], 0
mov dword [rsp + 0x80], esi
je 0x14013cb15
neg ebx
mov rcx, qword [rdi + 0x3d8]
imul esi, ebx
call fcn.1400d8b20
bt eax, 0x14
jae 0x14013cb6d
mov rcx, qword [rdi + 0x3d8]
xor eax, eax
lea r8, [rsp + 0x40]
mov qword [rsp + 0x40], rax
xor edx, edx
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x58], eax
mov dword [rsp + 0x40], 0x1c
mov dword [rsp + 0x44], 4
call qword [sym.imp.USER32.dll_GetScrollInfo]
test eax, eax
je 0x14013cb6d
mov eax, dword [rsp + 0x54]
jmp 0x14013cb6f
xor eax, eax
mov r9d, 1
lea edx, [rax + rsi]
mov rcx, rdi
mov r8d, r9d
call fcn.14013c290
mov rsi, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
Function at 0x140141f50
Capabilities:
Capture webcam image

Disassembly:
push rbx
sub rsp, 0x20
call qword [sym.imp.USER32.dll_GetDlgItem]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
mov edx, 0x188
mov rbx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0xffffffff
jne 0x1400d6adc
xor r9d, r9d
xor r8d, r8d
mov edx, 0x186
mov rcx, rbx
call qword [sym.imp.USER32.dll_SendMessageW]
add rsp, 0x20
pop rbx
ret
push rbx
sub rsp, 0x20
mov rbx, qword [rcx + 0x90]
mov edx, 0x40e
mov rcx, rbx
call qword [sym.imp.USER32.dll_IsDlgButtonChecked]
mov edx, 0x411
mov rcx, rbx
cmp eax, 1
jne 0x140142052
call fcn.1400d6080
mov edx, 0x412
mov rcx, rbx
call fcn.1400d6080
mov edx, 0x413
mov rcx, rbx
call fcn.1400d6080
mov edx, 0x414
mov rcx, rbx
call fcn.1400d6080
mov edx, 0x415
mov rcx, rbx
call fcn.1400d6080
mov edx, 0x416
mov rcx, rbx
call fcn.1400d6080
mov edx, 0x417
mov rcx, rbx
call fcn.1400d6080
mov edx, 0x418
mov rcx, rbx
call fcn.1400d6080
mov edx, 0x412
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetDlgItem]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
mov edx, 0x18b
call qword [sym.imp.USER32.dll_SendMessageW]
mov edx, 0x419
mov rcx, rbx
test eax, eax
je 0x14014202e
call fcn.1400d6080
mov edx, 0x41a
mov rcx, rbx
call fcn.1400d6080
mov edx, 0x412
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp 0x1400d6aa0
call fcn.1400d5fe0
mov edx, 0x41a
mov rcx, rbx
call fcn.1400d5fe0
mov edx, 0x412
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp 0x1400d6aa0
call fcn.1400d5fe0
mov edx, 0x412
mov rcx, rbx
call fcn.1400d5fe0
mov edx, 0x413
mov rcx, rbx
call fcn.1400d5fe0
mov edx, 0x414
mov rcx, rbx
call fcn.1400d5fe0
mov edx, 0x415
mov rcx, rbx
call fcn.1400d5fe0
mov edx, 0x416
mov rcx, rbx
call fcn.1400d5fe0
mov edx, 0x417
mov rcx, rbx
call fcn.1400d5fe0
mov edx, 0x418
mov rcx, rbx
call fcn.1400d5fe0
mov edx, 0x419
mov rcx, rbx
call fcn.1400d5fe0
mov edx, 0x41a
mov rcx, rbx
call fcn.1400d5fe0
mov edx, 0x412
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetDlgItem]
xor r9d, r9d
or r8, 0xffffffffffffffff
mov rcx, rax
mov edx, 0x186
add rsp, 0x20
pop rbx
jmp qword [sym.imp.USER32.dll_SendMessageW]
Function at 0x1401438b0
Capabilities:
Persist via run registry key

Disassembly:
push rbx
sub rsp, 0x390
mov rax, qword [0x14020cc08]
xor rax, rsp
mov qword [rsp + 0x380], rax
lea rcx, [rsp + 0x140]
call fcn.1400012c0
lea r9, [rsp + 0x140]
lea r8, [0x1401b4900]
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov rcx, 0xffffffff80000002
xor ebx, ebx
call fcn.1400daa10
test eax, eax
je 0x140143a03
lea rcx, [rsp + 0x20]
call fcn.1400012c0
lea rcx, [rsp + 0x260]
mov ebx, 2
call fcn.1400012c0
lea rcx, [rsp + 0x260]
xor edx, edx
call fcn.1400d9a90
mov r8, qword [rsp + 0x268]
lea rdx, str.__s___startup
lea rcx, [rsp + 0x20]
call fcn.140178c40
call fcn.1400ce2b0
test rax, rax
je 0x14014396b
call fcn.1400ce2b0
lea rdx, str.__instance___s_
lea rcx, [rsp + 0x20]
mov r8, rax
call fcn.140178e90
mov r8, qword [0x14020e198]
cmp qword [r8 + 0x18], 0
je 0x14014398e
mov r8, qword [r8 + 0x18]
lea rdx, str.__config___s_
lea rcx, [rsp + 0x20]
call fcn.140178e90
lea rcx, [rsp + 0x260]
call fcn.140177510
mov rdx, qword [rsp + 0x148]
lea rcx, str.reg:__s_n
call fcn.1400b3e90
mov rdx, qword [rsp + 0x28]
lea rcx, str.set:__s_n
call fcn.1400b3e90
mov r11, qword [rsp + 0x28]
mov rax, qword [rsp + 0x148]
movzx ecx, byte [r11]
cmp cl, byte [rax]
jne 0x1401439e9
test cl, cl
je 0x1401439f4
mov cl, byte [r11 + 1]
add r11, 1
add rax, 1
cmp cl, byte [rax]
je 0x1401439d5
movzx eax, byte [rax]
movzx ecx, byte [r11]
cmp ecx, eax
jne 0x1401439f9
mov ebx, 1
lea rcx, [rsp + 0x20]
call fcn.140177510
lea rcx, [rsp + 0x140]
call fcn.140177510
mov eax, ebx
mov rcx, qword [rsp + 0x380]
xor rcx, rsp
call fcn.1401a8fd0
add rsp, 0x390
pop rbx
ret

Function at 0x140148c80
Capabilities:
Persist via run registry key

Disassembly:
sub rsp, 0x38
lea r8, [0x1401b4900]
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov rcx, 0xffffffff80000002
call fcn.1400e22d0
call fcn.1400ce2b0
test rax, rax
jne 0x140148d03
call fcn.1400db600
test eax, eax
je 0x140148d03
lea rax, [rsp + 0x40]
lea rdx, str.Software_voidtoolsEverything
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call fcn.1400da960
test eax, eax
je 0x140148d03
lea r8, str.InstallRunOnStartup
lea rdx, str.Software_voidtoolsEverything
xor r9d, r9d
mov rcx, 0xffffffff80000002
call fcn.1400e21c0
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x38
ret
Function at 0x14014ca20
Capabilities:
Persist via run registry key

Disassembly:
sub rsp, 0x298
mov rax, qword [0x14020cc08]
xor rax, rsp
mov qword [rsp + 0x280], rax
lea r8, [0x1401b4900]
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov rcx, 0xffffffff80000002
call fcn.1400e22d0
call fcn.1400ce2b0
test rax, rax
jne 0x14014cab8
call fcn.1400db600
test eax, eax
je 0x14014cab8
lea rax, [rsp + 0x30]
lea rdx, str.Software_voidtoolsEverything
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call fcn.1400da960
test eax, eax
je 0x14014cab8
lea r8, str.InstallRunOnStartup
lea rdx, str.Software_voidtoolsEverything
xor r9d, r9d
mov rcx, 0xffffffff80000002
call fcn.1400e21c0
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [rsp + 0x40]
call fcn.1400012c0
lea rcx, [rsp + 0x160]
call fcn.1400012c0
lea rcx, [rsp + 0x160]
xor edx, edx
call fcn.1400d9a90
mov r8, qword [rsp + 0x168]
lea rdx, str.__s___startup
lea rcx, [rsp + 0x40]
call fcn.140178c40
call fcn.1400ce2b0
test rax, rax
je 0x14014cb1a
call fcn.1400ce2b0
lea rdx, str.__instance___s_
lea rcx, [rsp + 0x40]
mov r8, rax
call fcn.140178e90
mov r8, qword [0x14020e198]
cmp qword [r8 + 0x18], 0
je 0x14014cb3d
mov r8, qword [r8 + 0x18]
lea rdx, str.__config___s_
lea rcx, [rsp + 0x40]
call fcn.140178e90
lea rcx, [rsp + 0x160]
call fcn.140177510
mov r9, qword [rsp + 0x48]
lea r8, [0x1401b4900]
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov rcx, 0xffffffff80000002
call fcn.1400e2080
call fcn.1400ce2b0
test rax, rax
jne 0x14014cbd1
call fcn.1400db600
test eax, eax
je 0x14014cbd1
lea rax, [rsp + 0x30]
lea rdx, str.Software_voidtoolsEverything
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call fcn.1400da960
test eax, eax
je 0x14014cbd1
lea r8, str.InstallRunOnStartup
lea rdx, str.Software_voidtoolsEverything
mov r9d, 1
mov rcx, 0xffffffff80000002
call fcn.1400e21c0
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [rsp + 0x40]
call fcn.140177510
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.1401a8fd0
add rsp, 0x298
ret