joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140006410
Capabilities:
Patch process command line

Disassembly:
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x310
mov rax, qword [0x1401e7e78]
xor rax, rsp
mov qword [rsp + 0x300], rax
mov rax, qword [0x1401ead18]
mov r15, r9
mov r14, qword [rsp + 0x360]
mov rbx, r8
mov rdi, rdx
test rax, rax
jne 0x14000648e
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140006472
lea rdx, str.NtQueryInformationProcess
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
jmp 0x140006479
mov rax, qword [0x1401ead18]
test rax, rax
lea rcx, [0x140007830]
cmove rax, rcx
mov qword [0x1401ead18], rax
lea rcx, [rsp + 0x30]
mov r9d, 0x30
mov qword [rsp + 0x20], rcx
lea r8, [rsp + 0x38]
mov rcx, rdi
xor edx, edx
call rax
test eax, eax
jne 0x140006573
mov rdx, qword [rsp + 0x40]
lea r8, [rsp + 0xb0]
and qword [rsp + 0x20], 0
mov r9d, 0x248
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x14000656c
mov rdx, qword [rsp + 0xc8]
lea r8, [rsp + 0x70]
and qword [rsp + 0x20], 0
mov r9d, 0x40
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x14000656c
mov rax, qword [rsp + 0xd0]
mov rsi, qword [rsp + 0xc0]
mov qword [r15], rax
mov rax, qword [rsp + 0xc8]
add rax, 0x20
mov qword [r14], rax
mov rax, qword [rsp + 0x90]
jmp 0x140006567
cmp rax, qword [r14]
je 0x140006573
and qword [rsp + 0x20], 0
lea rdx, [rax - 0x10]
mov r9d, 0x88
mov r8, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x140006573
cmp byte [rsp + 0x368], 0
jne 0x14000656c
cmp qword [rbx + 0x30], rsi
je 0x14000656c
mov rax, qword [rbx + 0x10]
test rax, rax
jne 0x14000652e
mov eax, 1
jmp 0x140006575
xor eax, eax
mov rcx, qword [rsp + 0x300]
xor rcx, rsp
call fcn.140139b10
add rsp, 0x310
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
Function at 0x14000895c
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x280
mov rax, qword [0x1401e7e78]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rax, qword [0x14021c740]
xor edi, edi
mov rbx, rcx
cmp byte [rax + 0xce2], dil
je 0x140008a30
lea rsi, [rcx + 0x10]
cmp word [rsi], di
je 0x140008a30
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [rbx + 0x220]
cmp eax, 0x1388
jbe 0x140008a30
lea rdx, [0x140169b08]
mov rcx, rsi
call fcn.140142524
test rax, rax
je 0x140008a30
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x250
call fcn.14013b230
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x140008a30
mov eax, dword [rbx + 0x21c]
cmp dword [rsp + 0x38], eax
jne 0x140008a0e
mov eax, dword [rbx + 0x218]
cmp dword [rsp + 0x34], eax
je 0x140008a27
xor edx, edx
mov rcx, rbx
call fcn.1400087a0
mov dil, al
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rbx + 0x220], eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov al, dil
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140139b10
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x14000f83c
Capabilities:
Set current directory

Disassembly:
push rbx
sub rsp, 0x20
xor ebx, ebx
test rdx, rdx
je 0x14000f85a
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
je 0x14000f86b
mov bl, 1
jmp 0x14000f871
add rcx, 0xcfa
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
jne 0x14000f871
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov al, bl
add rsp, 0x20
pop rbx
ret

Function at 0x14000f87c
Capabilities:
Get keyboard layout

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x1b8]
sub rsp, 0x2a0
mov rax, qword [0x1401e7e78]
xor rax, rsp
mov qword [rbp + 0x190], rax
xor eax, eax
mov rdi, rcx
and qword [rsp + 0x30], rax
lea rcx, [rbp - 0x20]
xorps xmm0, xmm0
mov word [rbp - 0x10], ax
movups xmmword [rbp - 0x20], xmm0
call qword [sym.imp.USER32.dll_GetKeyboardLayoutNameW]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0xa0
mov r14, rax
call fcn.14013b230
lea rdx, [rsp + 0x40]
mov ecx, 0x14
call qword [sym.imp.USER32.dll_GetKeyboardLayoutList]
mov r8d, 0x10
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x20]
mov ebx, eax
call fcn.1401437b4
mov r9, r14
mov dword [rsp + 0x28], ebx
shr r9, 0x20
lea r8, [rbp - 0x20]
lea rdx, str.Layout_s__HKL0x_08X_08X__Count_u_n
mov dword [rsp + 0x20], r14d
lea rcx, [rbp]
mov esi, eax
call fcn.14000d110
mov r15d, 0xc8
mov dword [rsp + 0x20], ebx
mov r8d, r15d
lea r9, [rsp + 0x40]
lea rdx, [rbp]
mov rcx, rdi
call fcn.14000f3d4
or ebx, 0xffffffff
test esi, esi
je 0x14000fa09
xor edx, edx
lea rcx, [rdi + 0x5894]
cmp dword [rcx - 4], 0
jne 0x14000f97b
cmp ebx, 0xffffffff
mov eax, edx
cmovne eax, ebx
mov ebx, eax
jmp 0x14000f983
cmp dword [rcx], esi
je 0x14000fa41
inc edx
add rcx, 0x10
cmp edx, 0x14
jl 0x14000f969
test ebx, ebx
js 0x14000fa04
mov al, r14b
xor al, sil
je 0x14000f9f2
lea r8, str._nLOWORD_hkl_LOWORD_dwLayout_____Warning__strange_layout_ID
mov rdx, r15
lea rcx, [rbp]
call fcn.140001f38
lea rax, [rbp]
mov edx, 0xa
mov rcx, rax
call fcn.14013a9b0
test rax, rax
je 0x14000f9cd
mov ecx, 0x20
mov word [rax], cx
jmp 0x14000f9b1
test rdi, rdi
je 0x14000f9f2
mov rcx, qword [rdi + 0x3fa0]
test rcx, rcx
je 0x14000f9f2
xor r9d, r9d
mov byte [rsp + 0x20], 1
mov r8b, 1
lea rdx, [rbp]
call fcn.1401298e4
mov r9, r14
mov r8d, esi
mov edx, ebx
mov rcx, rdi
call fcn.140023b0c
jmp 0x14000fa41
cmp ebx, 0xffffffff
jne 0x14000fa41
lea r8, str._niUnused_1
mov rdx, r15
lea rcx, [rbp]
call fcn.140001f38
test rdi, rdi
je 0x14000fa41
mov rcx, qword [rdi + 0x3fa0]
test rcx, rcx
je 0x14000fa41
xor r9d, r9d
mov byte [rsp + 0x20], 1
mov r8b, 1
lea rdx, [rbp]
call fcn.1401298e4
mov rcx, qword [rbp + 0x190]
xor rcx, rsp
call fcn.140139b10
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x140010eb4
Capabilities:
Find taskbar

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x30
cmp byte [rcx + 0x80], 0
mov rbx, rcx
je 0x140010ed9
xor al, al
jmp 0x140011043
xor dil, dil
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov r14, rax
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov r15, rax
call qword [sym.imp.USER32.dll_GetShellWindow]
xor r9d, r9d
lea r8, str.Shell_TrayWnd
xor edx, edx
xor ecx, ecx
mov r12, rax
call qword [sym.imp.USER32.dll_FindWindowExW]
and dword [rbp + 0x50], 0
mov rsi, rax
and dword [rbp + 0x40], 0
and dword [rbp + 0x48], 0
and dword [rbp + 0x58], 0
test r12, r12
je 0x140010f64
lea rdx, [rbp + 0x40]
mov rcx, r12
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test eax, eax
je 0x140010f64
mov r8d, dword [rbp + 0x40]
test r8d, r8d
je 0x140010f64
cmp byte [rbx + 0x81], dil
mov rdx, r12
mov rcx, rbx
sete al
xor r9d, r9d
mov byte [rsp + 0x20], al
call fcn.14000ff78
mov dil, al
test al, al
jne 0x140010ff6
test rsi, rsi
je 0x140010fac
lea rdx, [rbp + 0x48]
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test eax, eax
je 0x140010fac
mov r8d, dword [rbp + 0x48]
test r8d, r8d
je 0x140010fac
cmp r8d, dword [rbp + 0x40]
je 0x140010fac
cmp byte [rbx + 0x81], 0
mov rdx, rsi
mov rcx, rbx
sete al
xor r9d, r9d
mov byte [rsp + 0x20], al
call fcn.14000ff78
mov dil, al
test al, al
jne 0x140010ff6
test r15, r15
je 0x140010ff6
lea rdx, [rbp + 0x50]
mov rcx, r15
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test eax, eax
je 0x140010ff6
mov r8d, dword [rbp + 0x50]
test r8d, r8d
je 0x140010ff6
cmp r8d, dword [rbp + 0x48]
je 0x140010ff6
cmp r8d, dword [rbp + 0x40]
je 0x140010ff6
cmp byte [rbx + 0x81], 0
mov rdx, r15
mov rcx, rbx
sete al
xor r9d, r9d
mov byte [rsp + 0x20], al
call fcn.14000ff78
mov dil, al
test r14, r14
je 0x140011040
lea rdx, [rbp + 0x58]
mov rcx, r14
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test eax, eax
je 0x140011040
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, dword [rbp + 0x58]
cmp r8d, eax
je 0x140011040
cmp r8d, dword [rbp + 0x40]
je 0x140011040
cmp r8d, dword [rbp + 0x50]
je 0x140011040
cmp r8d, dword [rbp + 0x48]
je 0x140011040
xor r9d, r9d
mov byte [rsp + 0x20], 1
mov rdx, r14
mov rcx, rbx
call fcn.14000ff78
mov al, dil
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140013494
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov dil, dl
mov rbx, rcx
test rcx, rcx
je 0x1400134cc
mov rcx, qword [rcx + 0x3fa0]
test rcx, rcx
je 0x1400134cc
xor r9d, r9d
mov byte [rsp + 0x20], 1
mov r8b, 1
lea rdx, str.CConEmuMain::Destroy__
call fcn.1401298e4
mov rdx, qword [0x14021c5e0]
mov r8b, dil
mov rcx, rbx
call fcn.1400132ac
cmp dword [0x140227950], 0
je 0x14001350c
test rbx, rbx
je 0x1400135ab
mov rcx, qword [rbx + 0x3fa0]
test rcx, rcx
je 0x1400135ab
lea rdx, str.___Destroy_skipped_due_to_gbInDisplayLastError
jmp 0x14001359b
test dil, dil
je 0x140013558
mov rcx, rbx
call fcn.1400279c4
test al, al
je 0x140013528
xor ecx, ecx
call fcn.1401147c4
test al, al
je 0x14001354c
xor r9d, r9d
mov byte [rsp + 0x20], 0
lea r8, [rbx + 0xa90]
lea rcx, str.ConEmus_parent_window_was_terminated_abnormally._nContinue_to_kill_ConEmu_process_
lea edx, [r9 + 0x31]
call fcn.14002b0f8
cmp eax, 1
jne 0x1400135ab
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
cmp qword [0x14021c5e0], 0
je 0x140013583
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, dword [rbx + 0x7c70]
xor r9d, r9d
mov rcx, qword [0x14021c5e0]
mov r8d, eax
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x1400135ab
test rbx, rbx
je 0x1400135ab
mov rcx, qword [rbx + 0x3fa0]
test rcx, rcx
je 0x1400135ab
lea rdx, str.___Destroy_skipped_due_to_ghWnd
xor r9d, r9d
mov byte [rsp + 0x20], 1
mov r8b, 1
call fcn.1401298e4
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x140013f84
Capabilities:
Query environment variable

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test edx, edx
je 0x140013fc2
mov rax, qword [0x14021c740]
cmp byte [rax + 0x11129], 0
je 0x140013fd3
mov rcx, qword [rcx + 0x3fb8]
mov edx, 1
call fcn.1400f4174
mov rcx, qword [rbx + 0x3fb8]
xor edx, edx
call fcn.1400f6740
jmp 0x140013fd3
mov rcx, qword [rcx + 0x3fb8]
mov edx, 1
call fcn.1400f4a20
mov rcx, rbx
call fcn.140014754
lea rcx, [rbx + 0x260]
call fcn.14003da64
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.1400255c0

Function at 0x140014384
Capabilities:
Set current directory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
add rcx, 0xcfa
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
xor edi, edi
test eax, eax
jne 0x1400143af
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rax, qword [0x14021c740]
mov ecx, dword [rax + 0x11460]
test ecx, ecx
je 0x1400143d3
mov ebx, ecx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_SetProcessAffinityMask]
call fcn.140001324
lea rcx, [rsi + 0x260]
mov rdx, qword [0x14021c5a0]
mov rdx, qword [rdx + 0x70]
call fcn.14003b934
mov rcx, rsi
call fcn.140015fe0
mov ecx, 0xc0
call fcn.14011ff78
mov qword [rsp + 0x30], rax
test rax, rax
je 0x140014416
mov rcx, rax
call fcn.14012f660
mov rdi, rax
mov qword [rsi + 0x3fd0], rdi
mov eax, 1
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140014e4c
Capabilities:
Enumerate gui resources

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1401e7e78]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rdi, rcx
mov rcx, qword [0x14021c5e0]
call qword [sym.imp.USER32.dll_IsWindowVisible]
xor ebx, ebx
test eax, eax
je 0x140014fc4
lea rcx, [rdi + 0x260]
xor edx, edx
call fcn.14003de70
test al, al
jne 0x140014fc4
mov rcx, qword [0x14021c5e0]
lea rdx, [rbp - 0x40]
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
call qword [sym.imp.USER32.dll_GetWindowRect]
lea rcx, [rbp - 0x40]
call qword [sym.imp.USER32.dll_IsRectEmpty]
test eax, eax
jne 0x140014fc4
mov r9d, dword [rbp - 0x34]
mov edi, r9d
mov r8d, dword [rbp - 0x38]
mov eax, r8d
mov edx, dword [rbp - 0x3c]
sub edi, edx
mov ecx, dword [rbp - 0x40]
sub eax, ecx
imul edi, eax
test edi, edi
jle 0x140014fc4
movups xmm0, xmmword [rbp - 0x40]
mov dword [rbp - 0x18], 2
movdqu xmmword [rbp - 0x30], xmm0
call qword [sym.imp.GDI32.dll_CreateRectRgn]
lea rdx, [rbp - 0x30]
mov qword [rbp - 0x20], rax
lea rcx, [0x1400137f4]
call qword [sym.imp.USER32.dll_EnumWindows]
cmp dword [rbp - 0x18], 1
lea r14d, [rbx + 0x64]
jne 0x140014f2f
mov r14d, ebx
jmp 0x140014fb5
mov rcx, qword [rbp - 0x20]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.GDI32.dll_GetRegionData]
mov r15d, eax
cmp eax, 8
jbe 0x140014fb5
mov ecx, r15d
mov edx, 1
call fcn.14012005c
mov r8, rax
mov edx, r15d
mov rsi, rax
mov dword [rax], 0x20
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.GDI32.dll_GetRegionData]
test eax, eax
je 0x140014f9d
cmp dword [rsi + 4], 1
jne 0x140014f9d
cmp dword [rsi + 8], ebx
jbe 0x140014f9d
mov r8d, dword [rsi + 8]
lea rdx, [rsi + 0x24]
mov ecx, dword [rdx + 4]
sub ecx, dword [rdx - 4]
mov eax, dword [rdx + 8]
sub eax, dword [rdx]
lea rdx, [rdx + 0x10]
imul ecx, eax
add ebx, ecx
sub r8, 1
jne 0x140014f83
mov rcx, rsi
call fcn.14012008c
imul eax, ebx, 0x64
cdq
idiv edi
cmp eax, r14d
cmova eax, r14d
mov r14d, eax
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.GDI32.dll_DeleteObject]
mov eax, r14d
jmp 0x140014fc6
xor eax, eax
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140139b10
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x1400177d0
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
test rcx, rcx
je 0x140017801
mov rcx, qword [rcx + 0x3fa0]
test rcx, rcx
je 0x140017801
xor r9d, r9d
mov byte [rsp + 0x20], 1
mov r8b, 1
lea rdx, str.CConEmuMain::OnAllVConClosed__
call fcn.1401298e4
and dword [rsp + 0x20], 0
lea rcx, str.AllVConClosed
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call fcn.14002bdd4
mov rcx, rbx
call fcn.140017728
lea rcx, [rbx + 0x128]
xor edx, edx
call fcn.1400fc754
xor edx, edx
mov rcx, rbx
call fcn.140027554
test al, al
je 0x14001784d
xor edx, edx
mov rcx, rbx
add rsp, 0x30
pop rbx
jmp fcn.140013494
mov rax, qword [0x14021c740]
mov cl, byte [rax + 0x11230]
cmp cl, 1
jne 0x140017880
mov rcx, qword [0x14021c5e0]
call qword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x1400178b2
xor edx, edx
lea rcx, [0x14021f640]
call fcn.140101ab0
jmp 0x1400178b2
cmp cl, 2
jne 0x1400178b2
lea rcx, [rbx + 0x260]
xor edx, edx
call fcn.14003de70
test al, al
jne 0x1400178b2
mov rcx, qword [0x14021c5e0]
xor r9d, r9d
mov edx, 0x112
mov r8d, 0xf020
call qword [sym.imp.USER32.dll_SendMessageW]
cmp byte [rbx + 0x5844], 0
jne 0x1400178d2
mov rcx, rbx
mov byte [rbx + 0x5844], 1
call fcn.1400255c0
mov rcx, rbx
call fcn.140014754
add rsp, 0x30
pop rbx
ret
Function at 0x1400195f4
Capabilities:
Get keyboard layout

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x198]
sub rsp, 0x298
mov rax, qword [0x1401e7e78]
xor rax, rsp
mov qword [rbp + 0x180], rax
mov rsi, r9
mov r12, r8
mov r14d, edx
mov rdi, rcx
mov eax, dword [rcx + 0x5880]
mov dword [rsp + 0x30], eax
mov r15, qword [rcx + 0x5888]
mov edx, 2
mov rcx, qword [0x14021c740]
call fcn.140087888
xor ebx, ebx
test eax, eax
je 0x1400196a3
lea rax, str.WM_INPUTLANGCHANGE
lea r8, str.WM_INPUTLANGCHANGEREQUEST
cmp r14d, 0x51
cmove r8, rax
mov qword [rsp + 0x20], rsi
mov r9d, r12d
lea rdx, str.CConEmuMain::OnLangChange:__s_CP:_i__HKL:0x_08I64X_
lea rcx, [rbp - 0x80]
call fcn.14000d13c
mov rcx, qword [rdi + 0x3fa0]
test rcx, rcx
je 0x1400196a3
mov byte [rsp + 0x20], 1
xor r9d, r9d
mov r8b, 1
lea rdx, [rbp - 0x80]
call fcn.1401298e4
mov dword [rdi + 0x5880], r14d
mov qword [rdi + 0x5888], rsi
mov r9, rsi
mov r8, r12
mov edx, r14d
mov rcx, qword [0x14021c5e0]
call qword [sym.imp.USER32.dll_DefWindowProcW]
mov r13, rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x60], xmm0
mov word [rsp + 0x70], ax
lea rcx, [rsp + 0x60]
call qword [sym.imp.USER32.dll_GetKeyboardLayoutNameW]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov r8d, 0x10
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x60]
call fcn.1401437b4
or edx, 0xffffffff
mov r9d, ebx
lea r8, [rdi + 0x5894]
cmp dword [r8 - 4], ebx
jne 0x140019723
mov ecx, r9d
cmp edx, 0xffffffff
cmovne ecx, edx
mov edx, ecx
jmp 0x140019728
cmp dword [r8], eax
je 0x140019748
inc r9d
add r8, 0x10
cmp r9d, 0x14
jl 0x140019710
cmp edx, 0xffffffff
je 0x140019748
mov r9, rsi
mov r8d, eax
mov rcx, rdi
call fcn.140023b0c
lea eax, [r14 - 0x50]
cmp eax, 1
ja 0x1400197b3
lea rcx, [rsp + 0x40]
call fcn.140114b80
nop
xor edx, edx
lea rcx, [rsp + 0x40]
call fcn.14010f2cc
test eax, eax
js 0x1400197a9
mov rcx, qword [rsp + 0x48]
call fcn.14011bab8
test rax, rax
je 0x1400197a9
cmp dword [rsp + 0x30], 0x50
jne 0x140019792
cmp r14d, 0x51
jne 0x140019792
cmp r15, rsi
je 0x1400197a9
test r15, r15
je 0x1400197a9
cmp r14d, 0x50
cmove rbx, r12
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.1400c0e50
nop
lea rcx, [rsp + 0x40]
call fcn.140114c28
mov qword [rdi + 0x5878], rsi
mov rcx, qword [rdi + 0x3fc8]
call fcn.1400f07d8
mov rax, r13
mov rcx, qword [rbp + 0x180]
xor rcx, rsp
call fcn.140139b10
add rsp, 0x298
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140023cec
Capabilities:
Get common file path
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
lea rbp, [rax - 0x778]
sub rsp, 0x870
mov rax, qword [0x1401e7e78]
xor rax, rsp
mov qword [rbp + 0x760], rax
xor esi, esi
mov rbx, rcx
test rdx, rdx
je 0x140023d57
cmp word [rdx], 0x3a
je 0x140023d57
lea rdi, [rcx + 0x110e]
cmp word [rdx], si
je 0x140023e98
mov byte [rcx + 0x1368], 1
mov rcx, rdi
call fcn.14000d194
mov rcx, rdi
call fcn.14011f8fc
jmp 0x140023e98
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x20a
call fcn.14013b230
lea rdx, [rsp + 0x20]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
dec eax
cmp eax, 0x103
ja 0x140023d8e
lea rcx, [rsp + 0x20]
call fcn.14011f8fc
jmp 0x140023d93
mov word [rsp + 0x20], si
cmp byte [rbx + 0x7d8], sil
jne 0x140023e84
xor edx, edx
lea rcx, [rbp + 0x130]
mov r8d, 0x208
call fcn.14013b230
mov edx, 0xfa
lea rcx, [rbp + 0x130]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x140023dd6
lea rcx, [rbp + 0x130]
call fcn.14011f8fc
lea rdx, [rbp + 0x130]
lea rcx, [rbp + 0x340]
call fcn.140004ad0
lea r8, str._system32
mov edx, 0x104
lea rcx, [rbp + 0x340]
call fcn.140001f38
cmp word [rsp + 0x20], si
je 0x140023e4a
lea rdx, [rbp + 0x130]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140023e4a
lea rdx, [rbp + 0x340]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140023e4a
lea rdx, [rbx + 0xcfa]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x140023e84
xor r9d, r9d
lea rdx, [rsp + 0x20]
xor ecx, ecx
lea r8d, [r9 + 0x28]
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x140023e6c
lea rcx, [rsp + 0x20]
call fcn.14011f8fc
cmp word [rsp + 0x20], si
jne 0x140023e84
lea rdx, [rbx + 0xcfa]
lea rcx, [rsp + 0x20]
call fcn.14000d194
lea rdi, [rbx + 0x110e]
mov rcx, rdi
lea rdx, [rsp + 0x20]
call fcn.14000d194
mov r8d, 0x104
lea rdx, [rbp + 0x550]
mov rcx, rdi
call fcn.1401241c8
mov rdx, rax
lea rcx, str.ConEmuWorkDrive
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, qword [rbp + 0x760]
xor rcx, rsp
call fcn.140139b10
lea r11, [rsp + 0x870]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x140023f90
Capabilities:
Get keyboard layout

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x2e0
mov rax, qword [0x1401e7e78]
xor rax, rsp
mov qword [rsp + 0x2d0], rax
mov rdi, rcx
mov esi, 1
mov rcx, qword [0x14021c740]
mov rbx, rdx
test byte [rcx + 0x11459], sil
jne 0x140024004
lea edx, [rsi + 1]
call fcn.140087888
test eax, eax
je 0x140024153
test rdi, rdi
je 0x140024153
mov rcx, qword [rdi + 0x3fa0]
test rcx, rcx
je 0x140024153
lea rdx, str.CConEmuMain::SwitchKeyboardLayout_skipped__cause_of_isMonitorConsoleLang0
jmp 0x140024143
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0xa0
call fcn.14013b230
lea rdx, [rsp + 0x30]
mov ecx, 0x14
call qword [sym.imp.USER32.dll_GetKeyboardLayoutList]
mov r9d, eax
xor edx, edx
cmp edx, r9d
jae 0x14002403b
cmp qword [rsp + rdx*8 + 0x30], rbx
je 0x14002407e
add edx, esi
jmp 0x14002402b
xor r8d, r8d
xor r10d, r10d
mov rcx, rbx
cmp r8d, r9d
jae 0x14002406f
mov rdx, qword [rsp + r8*8 + 0x30]
movzx ecx, dx
movzx eax, bx
cmp rcx, rax
cmove r10d, esi
add r8d, esi
cmp rcx, rax
cmovne rdx, rbx
mov rbx, rdx
test r10d, r10d
je 0x140024041
jmp 0x14002407e
movzx eax, cx
cmp rcx, rax
jne 0x14002407e
shl rbx, 0x10
or rbx, rcx
mov ecx, dword [rdi + 0x7c40]
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
mov rcx, qword [0x14021c740]
mov edx, 2
cmp rbx, rax
je 0x14002410f
call fcn.140087888
test eax, eax
je 0x1400240df
mov r8d, ebx
lea rdx, str.CConEmuMain::SwitchKeyboardLayout__posting_WM_INPUTLANGCHANGEREQUEST__WM_INPUTLANGCHANGE_for_0x_08X
lea rcx, [rsp + 0xd0]
call fcn.14000d13c
mov rcx, qword [rdi + 0x3fa0]
test rcx, rcx
je 0x1400240df
xor r9d, r9d
mov byte [rsp + 0x20], sil
mov r8b, sil
lea rdx, [rsp + 0xd0]
call fcn.1401298e4
mov rcx, qword [0x14021c5e0]
xor r8d, r8d
mov r9, rbx
lea edx, [r8 + 0x50]
call qword [sym.imp.USER32.dll_PostMessageW]
mov rcx, qword [0x14021c5e0]
xor r8d, r8d
mov r9, rbx
lea edx, [r8 + 0x51]
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x140024153
call fcn.140087888
test eax, eax
je 0x140024153
mov r8d, ebx
lea rdx, str.CConEmuMain::SwitchKeyboardLayout_skipped__cause_of_GetActiveKeyboardLayout__0x_08X
lea rcx, [rsp + 0xd0]
call fcn.14000d13c
mov rcx, qword [rdi + 0x3fa0]
test rcx, rcx
je 0x140024153
lea rdx, [rsp + 0xd0]
xor r9d, r9d
mov byte [rsp + 0x20], sil
mov r8b, sil
call fcn.1401298e4
mov rcx, qword [rsp + 0x2d0]
xor rcx, rsp
call fcn.140139b10
lea r11, [rsp + 0x2e0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret