joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003a8a0
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov rbx, rcx
xor ecx, ecx
mov rsi, r9
mov edi, r8d
mov r15, rdx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
mov r8d, 0xfff
movzx r10d, ax
movzx r14d, ax
mov eax, 0x412
and r10w, r8w
mov rcx, rbp
cmp r10w, ax
sete dl
and rcx, r8
cmp rcx, rax
sete cl
cmp edi, 0x100
ja 0x14003a934
je 0x14003a964
mov eax, edi
sub eax, 0x7b
je 0x14003a9a9
cmp eax, 0xc
jne 0x14003aa94
mov eax, dword [rbx + 0x59a0]
neg eax
sbb rax, rax
and eax, 4
or rax, 3
jmp 0x14003aa07
cmp edi, 0x105
ja 0x14003aa77
je 0x14003aa2b
mov eax, edi
sub eax, 0x101
je 0x14003aa2b
dec eax
je 0x14003aa02
cmp eax, 2
jne 0x14003aa94
cmp dword [rbx + 0x59a0], 0
jne 0x14003a9ad
lea rax, [rsi - 9]
test rax, 0xfffffffffffffffb
jne 0x14003a9ad
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetKeyState]
mov rcx, r15
shr eax, 0xf
and eax, 1
movsxd rbx, eax
call qword [sym.imp.USER32.dll_GetParent]
xor r9d, r9d
lea edx, [r9 + 0x28]
mov rcx, rax
mov r8, rbx
call qword [sym.imp.USER32.dll_PostMessageW]
xor eax, eax
jmp 0x14003aa07
mov r8d, 1
movzx edx, si
mov rcx, rbx
call fcn.14003a2f0
test eax, eax
je 0x14003aa02
mov r8, qword [rsp + 0x70]
mov r9d, 1
movzx edx, si
mov rcx, rbx
mov word [rsp + 0x28], r14w
mov qword [rsp + 0x20], rbp
call fcn.14003a3b0
test eax, eax
je 0x14003aa20
mov r9d, dword [rbx + 0x28e0]
mov r8d, 1
dec r9d
movzx edx, si
mov rcx, rbx
call fcn.14003ab70
mov eax, 1
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
or ecx, 0xffffffff
call qword [sym.imp.USER32.dll_MessageBeep]
jmp 0x14003aa02
mov r8, qword [rsp + 0x70]
test cl, cl
jne 0x14003aa38
test dl, dl
je 0x14003aa4b
cmp rsi, 0xe5
jne 0x14003aa4b
mov eax, 0x80000000
test rax, r8
jne 0x14003aa02
xor r9d, r9d
movzx edx, si
mov rcx, rbx
mov word [rsp + 0x28], r14w
mov qword [rsp + 0x20], rbp
call fcn.14003a3b0
test eax, eax
je 0x14003aa20
mov r9d, dword [rbx + 0x28e0]
dec r9d
xor r8d, r8d
jmp 0x14003a9f7
mov eax, edi
sub eax, 0x106
je 0x14003aa02
sub eax, 0xb
je 0x14003aa02
cmp eax, 0xf4
je 0x14003a9a9
mov rax, qword [rsp + 0x70]
mov rcx, qword [rbx + 0x5998]
mov r9, rsi
mov r8d, edi
mov rdx, r15
mov qword [rsp + 0x20], rax
call qword [sym.imp.USER32.dll_CallWindowProcW]
jmp 0x14003aa07
Function at 0x14003ab70
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x240
lea rbp, [rcx + 0x28c0]
mov rbx, rcx
mov edi, r9d
mov rcx, rbp
mov r14d, r8d
movzx esi, dx
call fcn.140039700
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, 0x208
mov r15d, eax
call fcn.1400e5ee0
lea rcx, [rdi + 0xde]
lea rdx, [rsp + 0x30]
lea r9, [rcx + rcx*2]
mov r8d, 0x104
add r9, r9
mov ecx, dword [rbx + r9*8]
call qword [sym.imp.USER32.dll_GetKeyNameTextW]
movzx edx, si
mov rcx, rbp
call fcn.140039700
test eax, eax
jle 0x14003ac00
test r14d, r14d
je 0x14003abfa
inc dword [rbp + 0x30c8]
jmp 0x14003ac00
dec dword [rbp + 0x30c8]
test r15d, r15d
je 0x14003acbe
cmp word [rsp + 0x30], 0
je 0x14003ad0e
lea rsi, [0x14012b6a4]
mov eax, 0x7b
xor edi, edi
nop dword [rax]
nop word [rax + rax]
mov rdx, qword [rbx + 0x5990]
mov rcx, qword [rbx + 0x5998]
movsxd r9, eax
mov r8d, 0x102
mov qword [rsp + 0x20], rdi
call qword [sym.imp.USER32.dll_CallWindowProcW]
movzx eax, word [rsi + 2]
lea rsi, [rsi + 2]
test eax, eax
jne 0x14003ac30
movzx eax, word [rsp + 0x30]
lea rsi, [rsp + 0x30]
test eax, eax
je 0x14003ac9e
nop dword [rax]
mov rdx, qword [rbx + 0x5990]
mov rcx, qword [rbx + 0x5998]
movsxd r9, eax
mov r8d, 0x102
mov qword [rsp + 0x20], rdi
call qword [sym.imp.USER32.dll_CallWindowProcW]
movzx eax, word [rsi + 2]
lea rsi, [rsi + 2]
test eax, eax
jne 0x14003ac70
lea rax, [0x14012b6a8]
cmp r14d, 1
lea rdx, str._UP
cmove rdx, rax
mov rcx, rbx
call fcn.14003ad40
jmp 0x14003ad0e
cmp r14d, 1
jne 0x14003ad0e
movzx eax, word [rsp + 0x30]
lea rsi, [rsp + 0x30]
test eax, eax
je 0x14003ad0e
xor edi, edi
nop dword [rax]
nop dword [rax + rax]
mov rdx, qword [rbx + 0x5990]
mov rcx, qword [rbx + 0x5998]
movsxd r9, eax
mov r8d, 0x102
mov qword [rsp + 0x20], rdi
call qword [sym.imp.USER32.dll_CallWindowProcW]
movzx eax, word [rsi + 2]
lea rsi, [rsi + 2]
test eax, eax
jne 0x14003ace0
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x14003d090
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x10]
mov rdi, rdx
test rcx, rcx
je 0x14003d0be
mov r8, rdx
mov rdx, qword [rbx]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x14003d4f0
cmp byte [0x140270520], 0
jne 0x14003d109
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14003d0f9
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov byte [0x140270520], 1
mov qword [0x140270518], rax
jmp 0x14003d110
mov rax, qword [0x140270518]
mov byte [0x140270520], 1
jmp 0x14003d110
mov rax, qword [0x140270518]
mov rcx, qword [rbx]
mov rdx, rdi
test rax, rax
je 0x14003d12f
mov r8d, dword [rbx + 8]
xor r9d, r9d
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx], 0
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
je 0x14003d564
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je case.default.0x14003d57f
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je case.default.0x14003d57f
mov rcx, qword [rbx]
mov qword [rsp + 0x28], 0
xor r9d, r9d
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call rax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp dword [rcx + 8], 0
je case.default.0x14003d57f
mov rdx, r8
mov rcx, rsi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov eax, 1
add rsp, 0x30
pop rdi
ret
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
Function at 0x14003d3b0
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0x260
mov r9d, dword [rcx + 8]
xor ebp, ebp
mov rsi, rdx
mov r8, rdx
mov rdx, qword [rcx]
mov rdi, rcx
lea rcx, [rsp + 0x40]
or r9d, 0x2001f
mov qword [rsp + 0x40], rbp
mov dword [rsp + 0x48], ebp
mov qword [rsp + 0x50], rbp
call fcn.14003d2b0
mov ebx, eax
test eax, eax
jne 0x14003d4c0
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x290]
lea r9, [rsp + 0x280]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
lea r8, [rsp + 0x60]
xor edx, edx
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x280], 0x100
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x14003d49a
nop
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x40]
call fcn.14003d3b0
mov ebx, eax
test eax, eax
jne 0x14003d4c0
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x290]
lea r9, [rsp + 0x280]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
lea r8, [rsp + 0x60]
xor edx, edx
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x280], 0x100
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x14003d440
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14003d4af
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], rbp
mov rdx, rsi
mov rcx, rdi
mov dword [rsp + 0x48], ebp
call fcn.14003d090
mov ebx, eax
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14003d4d0
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rbx, qword [rsp + 0x288]
add rsp, 0x260
pop rdi
pop rsi
pop rbp
ret
Function at 0x14003d4f0
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x10]
mov rdi, rdx
test rcx, rcx
je 0x14003d0be
mov r8, rdx
mov rdx, qword [rbx]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x14003d4f0
cmp byte [0x140270520], 0
jne 0x14003d109
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14003d0f9
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov byte [0x140270520], 1
mov qword [0x140270518], rax
jmp 0x14003d110
mov rax, qword [0x140270518]
mov byte [0x140270520], 1
jmp 0x14003d110
mov rax, qword [0x140270518]
mov rcx, qword [rbx]
mov rdx, rdi
test rax, rax
je 0x14003d12f
mov r8d, dword [rbx + 8]
xor r9d, r9d
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx], 0
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
je 0x14003d564
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je case.default.0x14003d57f
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je case.default.0x14003d57f
mov rcx, qword [rbx]
mov qword [rsp + 0x28], 0
xor r9d, r9d
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call rax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp dword [rcx + 8], 0
je case.default.0x14003d57f
mov rdx, r8
mov rcx, rsi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov eax, 1
add rsp, 0x30
pop rdi
ret
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
Function at 0x140042810
Capabilities:
Find taskbar
Get keyboard layout

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x130
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x148], rbx
mov rbx, rcx
mov dword [rcx + 8], 2
lea rax, vtable.CPluginAction.0
mov qword [rcx], rax
add rcx, 0x68
mov edx, 0x200
call fcn.14004e4d0
nop
mov dword [rbx + 0x98], 4
lea rax, vtable.CSynList_class_CPluginAction::CActionTracker_.0
mov qword [rbx + 0xb8], rax
lea rcx, [rbx + 0xd8]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [rbx + 0xd4], 1
xor edi, edi
mov qword [rbx + 0xc0], rdi
mov qword [rbx + 0xc8], rdi
mov dword [rbx + 0xd0], edi
lea rax, vtable.CPluginAction::CActionTrackerList.0
mov qword [rbx + 0xb8], rax
lea rcx, [rbx + 0x100]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
nop
lea rcx, [rbx + 0x128]
call fcn.140034b60
xor edx, edx
lea rcx, str.Shell_TrayWnd
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
je 0x140042927
lea edx, [rdi + 5]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindow]
mov qword [rbx + 0x18], rax
mov r8d, 0x80
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetClassNameW]
mov eax, edi
lea rdx, [rsp + 0x30]
lea r8, str.Button
nop dword [rax]
nop dword [rax + rax]
movzx ecx, word [rdx + rax*2]
inc rax
cmp cx, word [r8 + rax*2 - 2]
jne 0x140042927
cmp rax, 7
jne 0x140042910
jmp 0x14004292b
mov qword [rbx + 0x18], rdi
mov qword [rbx + 0x20], rdi
mov qword [rbx + 0x28], rdi
mov qword [rbx + 0x30], rdi
mov qword [rbx + 0x10], rdi
mov rcx, rbx
call fcn.140049030
mov qword [rbx + 0x60], rdi
mov dword [rbx + 0x50], 0x4b
mov dword [rbx + 0x4c], 0x1f4
mov dword [rbx + 0x54], edi
mov qword [rbx + 0x38], rdi
mov qword [rbx + 0x44], rdi
mov qword [rbx + 0x78], rdi
mov dword [rbx + 0x90], edi
mov dword [rbx + 0x40], edi
mov dword [rbx + 0x94], 0xc
mov qword [rbx + 0xa8], rdi
mov qword [rbx + 0xb0], rdi
mov qword [rbx + 0x58], rdi
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
mov qword [rbx + 0xa0], rax
mov rax, rbx
mov rbx, qword [rsp + 0x148]
add rsp, 0x130
pop rdi
ret
Function at 0x14004df30
Capabilities:
Get keyboard layout

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
push rdi
sub rsp, 0x70
xor eax, eax
mov ebx, edx
mov rsi, rcx
mov qword [r11 - 0x58], rax
mov qword [r11 - 0x50], rax
mov qword [r11 - 0x48], rax
mov qword [r11 - 0x40], rax
mov qword [r11 - 0x38], rax
mov qword [r11 - 0x30], rax
mov qword [r11 - 0x28], rax
mov qword [r11 - 0x20], rax
mov qword [r11 - 0x18], rax
lea rdx, [r11 - 0x58]
xor ecx, ecx
mov dword [rsp + 0x20], 0x48
call qword [sym.imp.USER32.dll_GetGUIThreadInfo]
mov rcx, qword [rsp + 0x28]
xor edx, edx
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ecx, eax
mov ebp, eax
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
mov rdi, rax
test ebx, ebx
je 0x14004dfe4
mov rcx, rax
call sub.IMM32.dll_ImmIsIME
test eax, eax
je 0x14004e013
lea rcx, [0x14012dc70]
mov edx, 1
call qword [sym.imp.USER32.dll_LoadKeyboardLayoutW]
test rax, rax
je 0x14004e013
mov rcx, qword [rsp + 0x28]
mov edx, 0x50
mov r9, rax
lea r8d, [rdx - 0x4f]
call qword [sym.imp.USER32.dll_SendMessageW]
mov qword [rsi + 0xa0], rdi
jmp 0x14004e013
mov r9, qword [rsi + 0xa0]
cmp rax, r9
je 0x14004e013
mov rcx, qword [rsp + 0x28]
mov edx, 0x50
lea r8d, [rdx - 0x4f]
call qword [sym.imp.USER32.dll_SendMessageW]
mov ecx, ebp
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
mov qword [rsi + 0xa0], rax
lea r11, [rsp + 0x70]
mov eax, 1
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x14004e130
Capabilities:
Get graphical window text

Disassembly:
sub rsp, 0x428
call qword [sym.imp.USER32.dll_GetForegroundWindow]
test rax, rax
je 0x14004e252
lea rdx, [rsp + 0x20]
mov r8d, 0x200
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
je 0x14004e252
lea rdx, str.Netscape
lea rcx, [rsp + 0x20]
call fcn.1400e7f74
test rax, rax
je 0x14004e185
mov eax, 1
add rsp, 0x428
ret
lea rdx, str.Internet_Explorer
lea rcx, [rsp + 0x20]
call fcn.1400e7f74
test rax, rax
jne 0x14004e178
lea rdx, str.Mozilla
lea rcx, [rsp + 0x20]
call fcn.1400e7f74
test rax, rax
jne 0x14004e178
lea rdx, str.Opera
lea rcx, [rsp + 0x20]
call fcn.1400e7f74
test rax, rax
jne 0x14004e178
lea rdx, str.Google_Chrome
lea rcx, [rsp + 0x20]
call fcn.1400e7f74
test rax, rax
jne 0x14004e178
lea rdx, str.Microsoft_Edge
lea rcx, [rsp + 0x20]
call fcn.1400e7f74
test rax, rax
jne 0x14004e178
call fcn.1400dc5b0
test rax, rax
je 0x14004e252
lea rdx, [rsp + 0x20]
mov r8d, 0x200
mov rcx, rax
call qword [sym.imp.USER32.dll_GetClassNameW]
test eax, eax
je 0x14004e252
lea rdx, str.Internet_Explorer
lea rcx, [rsp + 0x20]
call fcn.1400e7f74
test rax, rax
jne 0x14004e178
lea rdx, str.Mozilla
lea rcx, [rsp + 0x20]
call fcn.1400e7f74
xor ecx, ecx
test rax, rax
setne cl
mov eax, ecx
add rsp, 0x428
ret
xor eax, eax
add rsp, 0x428
ret
Function at 0x140050d00
Capabilities:
Log keystrokes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ebx, edx
xor edx, edx
xor edi, edi
mov ecx, ebx
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov ecx, eax
test eax, eax
je 0x140050d5a
cmp ebx, 0xa3
je 0x140050d43
cmp ebx, 0xa5
je 0x140050d43
cmp ebx, 0x2e
ja 0x140050d48
movabs rdx, 0x61fe00000000
bt rdx, rbx
jae 0x140050d48
mov edi, 0x1000000
shl ecx, 0x10
or ecx, edi
mov eax, ecx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov eax, edi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1400515f0
Capabilities:
Get graphical window text

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x110
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rsi, rcx
mov edx, 0x414
mov rcx, qword [rcx + 0x10]
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
mov r8d, 0x40
lea rdx, [rsp + 0x80]
call qword [sym.imp.USER32.dll_GetWindowTextW]
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x30]
call fcn.1400519c0
nop
mov edx, dword [rsi + 0x28f0]
test edx, edx
jne 0x140051688
lea rcx, [rsp + 0x30]
mov r9, qword [rsp + 0x30]
mov r8, qword [rsp + 0x48]
cmp r8, 8
cmovae rcx, r9
lea rdx, [rsi + 0x28f4]
movzx eax, word [rcx]
mov word [rdx], ax
lea rcx, [rcx + 2]
lea rdx, [rdx + 2]
test ax, ax
jne 0x140051670
jmp 0x140051753
xor r8d, r8d
mov dword [rsp + 0x20], r8d
mov r9, qword [rsi + 8]
lea rcx, [rsp + 0x120]
call fcn.1400b1560
mov rbx, qword [rax]
mov rdx, qword [rsp + 0x120]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x1400516c0
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdi, [rsi + 0x28f4]
mov rdx, rdi
lea rcx, [rsp + 0x58]
call fcn.14003ae50
mov rdx, rax
cmp qword [rax + 0x18], 8
jb 0x1400516e1
mov rdx, qword [rax]
sub rdx, rbx
movzx ecx, word [rbx]
movzx eax, word [rbx + rdx]
sub ecx, eax
jne 0x1400516f7
add rbx, 2
test eax, eax
jne 0x1400516e4
test ecx, ecx
setne bl
cmp qword [rsp + 0x70], 8
jb 0x14005170e
mov rcx, qword [rsp + 0x58]
call fcn.1400e5d14
mov r9, qword [rsp + 0x30]
mov r8, qword [rsp + 0x48]
test bl, bl
je 0x140051753
mov dword [rsi + 0x28f0], 0
lea rcx, [rsp + 0x30]
cmp r8, 8
cmovae rcx, r9
nop dword [rax]
nop word [rax + rax]
movzx eax, word [rcx]
mov word [rdi], ax
lea rcx, [rcx + 2]
lea rdi, [rdi + 2]
test ax, ax
jne 0x140051740
cmp r8, 8
jb 0x140051761
mov rcx, r9
call fcn.1400e5d14
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140051780
Capabilities:
Get graphical window text

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x110
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rsi, rcx
mov edx, 0x414
mov rcx, qword [rcx + 0x10]
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
mov r8d, 0x40
lea rdx, [rsp + 0x80]
call qword [sym.imp.USER32.dll_GetWindowTextW]
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x30]
call fcn.1400519c0
nop
mov edx, dword [rsi + 0x28f0]
test edx, edx
jne 0x140051818
lea rcx, [rsp + 0x30]
mov r9, qword [rsp + 0x30]
mov r8, qword [rsp + 0x48]
cmp r8, 8
cmovae rcx, r9
lea rdx, [rsi + 0x28f4]
movzx eax, word [rcx]
mov word [rdx], ax
lea rcx, [rcx + 2]
lea rdx, [rdx + 2]
test ax, ax
jne 0x140051800
jmp 0x1400518e3
xor r8d, r8d
mov dword [rsp + 0x20], r8d
mov r9, qword [rsi + 8]
lea rcx, [rsp + 0x120]
call fcn.1400b1560
mov rbx, qword [rax]
mov rdx, qword [rsp + 0x120]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140051850
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdi, [rsi + 0x28f4]
mov rdx, rdi
lea rcx, [rsp + 0x58]
call fcn.14003ae50
mov rdx, rax
cmp qword [rax + 0x18], 8
jb 0x140051871
mov rdx, qword [rax]
sub rdx, rbx
movzx ecx, word [rbx]
movzx eax, word [rbx + rdx]
sub ecx, eax
jne 0x140051887
add rbx, 2
test eax, eax
jne 0x140051874
test ecx, ecx
setne bl
cmp qword [rsp + 0x70], 8
jb 0x14005189e
mov rcx, qword [rsp + 0x58]
call fcn.1400e5d14
mov r9, qword [rsp + 0x30]
mov r8, qword [rsp + 0x48]
test bl, bl
je 0x1400518e3
mov dword [rsi + 0x28f0], 0
lea rcx, [rsp + 0x30]
cmp r8, 8
cmovae rcx, r9
nop dword [rax]
nop word [rax + rax]
movzx eax, word [rcx]
mov word [rdi], ax
lea rcx, [rcx + 2]
lea rdi, [rdi + 2]
test ax, ax
jne 0x1400518d0
cmp r8, 8
jb 0x1400518f1
mov rcx, r9
call fcn.1400e5d14
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140059d80
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp - 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rdi, rcx
cmp qword [rcx + 0x78], 0
je 0x140059f78
cmp byte [rcx + 0x81], 0
je 0x140059f78
mov rax, qword [rcx]
or edx, 0xffffffff
call qword [rax + 0x18]
cmp eax, 0xffffffff
jne 0x140059dce
xor al, al
jmp 0x140059f7a
mov edx, 0xf
mov qword [rbp - 0x10], rdx
mov byte [rbp - 0x28], 0
xor ecx, ecx
mov qword [rbp - 0x28], rcx
mov qword [rbp - 0x18], 8
lea rax, [rbp - 0x28]
cmp rdx, 0x10
cmovae rax, rcx
mov byte [rax + 8], cl
xor r14d, r14d
mov r9, qword [rbp - 0x10]
nop
lea rdx, [rbp - 0x28]
cmp r9, 0x10
cmovae rdx, qword [rbp - 0x28]
lea r8, [rbp - 0x28]
cmovae r8, qword [rbp - 0x28]
mov rcx, qword [rdi + 0x78]
mov r10, qword [rcx]
mov r9, qword [rbp - 0x18]
add r9, rdx
lea rax, [rbp + 0x20]
mov qword [rsp + 0x20], rax
lea rdx, [rdi + 0x84]
call qword [r10 + 0x40]
test eax, eax
je 0x140059e46
dec eax
jne 0x140059f3b
jmp 0x140059e4d
mov byte [rdi + 0x81], r14b
lea rax, [rbp - 0x28]
mov r10, qword [rbp - 0x28]
mov r9, qword [rbp - 0x10]
cmp r9, 0x10
cmovae rax, r10
mov rbx, qword [rbp + 0x20]
sub rbx, rax
je 0x140059e97
lea rcx, [rbp - 0x28]
cmp r9, 0x10
cmovae rcx, r10
mov r9, qword [rdi + 0x90]
mov r8, rbx
mov edx, 1
call fcn.1400ec300
mov r9, qword [rbp - 0x10]
cmp rbx, rax
jne 0x140059f44
cmp byte [rdi + 0x81], r14b
je 0x140059f62
test rbx, rbx
jne 0x140059e00
or rax, 0xffffffffffffffff
mov r8, qword [rbp - 0x18]
sub rax, r8
cmp rax, 8
jbe 0x140059f55
lea rbx, [r8 + 8]
cmp rbx, 0xfffffffffffffffe
ja 0x140059f48
cmp r9, rbx
jae 0x140059ee3
mov rdx, rbx
lea rcx, [rbp - 0x28]
call fcn.14000c1e0
mov r9, qword [rbp - 0x10]
jmp 0x140059f01
test rbx, rbx
jne 0x140059f0a
mov qword [rbp - 0x18], r14
lea rax, [rbp - 0x28]
cmp r9, 0x10
cmovae rax, qword [rbp - 0x28]
mov byte [rax], r14b
jmp 0x140059dfb
test rbx, rbx
je 0x140059e00
lea rcx, [rbp - 0x28]
cmp r9, 0x10
cmovae rcx, qword [rbp - 0x28]
mov rax, qword [rbp - 0x18]
xor edx, edx
mov qword [rax + rcx], rdx
mov qword [rbp - 0x18], rbx
lea rax, [rbp - 0x28]
cmp qword [rbp - 0x10], 0x10
cmovae rax, qword [rbp - 0x28]
mov byte [rbx + rax], dl
jmp 0x140059dfb
mov r9, qword [rbp - 0x10]
sub eax, 2
je 0x140059f62
xor bl, bl
jmp 0x140059f64
lea rcx, str.string_too_long
call fcn.1400e4dc4
int3
lea rcx, str.string_too_long
call fcn.1400e4dc4
int3
mov bl, 1
cmp r9, 0x10
jb 0x140059f73
mov rcx, qword [rbp - 0x28]
call fcn.1400e5d14
movzx eax, bl
jmp 0x140059f7a
mov al, 1
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret