joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140200a40
Capabilities:
Set registry value

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [rsp + 0x50]
cmp dword [rax + 0x30], 0
je 0x140200a67
xor eax, eax
jmp 0x140200adb
mov eax, dword [rsp + 0x68]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 3
xor r8d, r8d
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx + 0x18]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rsp + 0x30], eax
mov rcx, qword [rsp + 0x50]
mov eax, dword [rsp + 0x30]
mov dword [rcx + 8], eax
mov rcx, qword [rsp + 0x50]
mov eax, dword [rsp + 0x68]
mov dword [rcx + 0x10], eax
mov rax, qword [rsp + 0x50]
mov dword [rax + 0xc], 3
cmp dword [rsp + 0x30], 0
jne 0x140200acf
mov dword [rsp + 0x34], 1
jmp 0x140200ad7
mov dword [rsp + 0x34], 0
mov eax, dword [rsp + 0x34]
add rsp, 0x48
ret

Function at 0x140200ae0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov dword [rsp + 0x34], 4
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx + 0x18]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x38], eax
mov rcx, qword [rsp + 0x50]
mov eax, dword [rsp + 0x38]
mov dword [rcx + 8], eax
mov rcx, qword [rsp + 0x50]
mov eax, dword [rsp + 0x30]
mov dword [rcx + 0xc], eax
mov rcx, qword [rsp + 0x50]
mov eax, dword [rsp + 0x34]
mov dword [rcx + 0x10], eax
cmp dword [rsp + 0x38], 0
jne 0x140200b6c
mov rcx, qword [rsp + 0x60]
mov eax, dword [rsp + 0x3c]
mov dword [rcx], eax
mov eax, 1
jmp 0x140200b6e
xor eax, eax
add rsp, 0x48
ret

Function at 0x140200b80
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov dword [rsp + 0x40], 8
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
mov rcx, qword [rcx + 0x18]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x44], eax
mov rcx, qword [rsp + 0x60]
mov eax, dword [rsp + 0x44]
mov dword [rcx + 8], eax
mov rcx, qword [rsp + 0x60]
mov eax, dword [rsp + 0x30]
mov dword [rcx + 0xc], eax
mov rcx, qword [rsp + 0x60]
mov eax, dword [rsp + 0x40]
mov dword [rcx + 0x10], eax
cmp dword [rsp + 0x44], 0
jne 0x140200c10
mov rax, qword [rsp + 0x70]
movsd xmm0, qword [rsp + 0x38]
movsd qword [rax], xmm0
mov eax, 1
jmp 0x140200c12
xor eax, eax
add rsp, 0x58
ret
Function at 0x140200c20
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x34], 0
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x30]
xor r8d, r8d
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x70]
mov rcx, qword [rcx + 0x18]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x3c], eax
cmp dword [rsp + 0x3c], 0
jne 0x140200d3d
cmp dword [rsp + 0x34], 0
jbe 0x140200d3d
mov eax, dword [rsp + 0x34]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x38]
add eax, 1
mov ecx, eax
call sub.mfc90u.dll_new__
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x70]
mov rcx, qword [rcx + 0x18]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x3c], eax
cmp dword [rsp + 0x3c], 0
jne 0x140200d10
cmp dword [rsp + 0x34], 0
jbe 0x140200d10
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.mfc90u.dll_CTreeCtrl::CTreeCtrl]
jmp 0x140200d1e
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.mfc90u.dll_CDocObjectServer::DoBeginPrinting]
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x50]
call sub.mfc90u.dll_delete__
mov qword [rsp + 0x40], 0
jmp 0x140200d4b
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.mfc90u.dll_CDocObjectServer::DoBeginPrinting]
mov rcx, qword [rsp + 0x70]
mov eax, dword [rsp + 0x3c]
mov dword [rcx + 8], eax
mov rcx, qword [rsp + 0x70]
mov eax, dword [rsp + 0x30]
mov dword [rcx + 0xc], eax
mov rcx, qword [rsp + 0x70]
mov eax, dword [rsp + 0x38]
mov dword [rcx + 0x10], eax
cmp dword [rsp + 0x3c], 0
jne 0x140200d80
mov dword [rsp + 0x58], 1
jmp 0x140200d88
mov dword [rsp + 0x58], 0
mov eax, dword [rsp + 0x58]
add rsp, 0x68
ret
Function at 0x140201470
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [rsp + 0x80]
mov qword [rax], 0
mov rax, qword [rsp + 0x88]
mov dword [rax], 0
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x30]
xor r8d, r8d
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x70]
mov rcx, qword [rcx + 0x18]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x38], eax
cmp dword [rsp + 0x38], 0
jne 0x14020158c
cmp dword [rsp + 0x34], 0
jbe 0x14020158c
mov rcx, qword [rsp + 0x88]
mov eax, dword [rsp + 0x34]
mov dword [rcx], eax
mov rax, qword [rsp + 0x88]
mov ecx, dword [rax]
call sub.mfc90u.dll_new__
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x80]
mov rax, qword [rsp + 0x40]
mov qword [rcx], rax
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x80]
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x70]
mov rcx, qword [rcx + 0x18]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x38], eax
cmp dword [rsp + 0x38], 0
jne 0x140201563
jmp 0x14020158c
mov rax, qword [rsp + 0x80]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rcx, qword [rsp + 0x48]
call sub.mfc90u.dll_delete__
mov rax, qword [rsp + 0x80]
mov qword [rax], 0
mov rcx, qword [rsp + 0x70]
mov eax, dword [rsp + 0x38]
mov dword [rcx + 8], eax
mov rax, qword [rsp + 0x70]
mov dword [rax + 0xc], 3
mov rcx, qword [rsp + 0x70]
mov rax, qword [rsp + 0x88]
mov eax, dword [rax]
mov dword [rcx + 0x10], eax
cmp dword [rsp + 0x38], 0
jne 0x1402015c7
mov dword [rsp + 0x50], 1
jmp 0x1402015cf
mov dword [rsp + 0x50], 0
mov eax, dword [rsp + 0x50]
add rsp, 0x68
ret

Function at 0x1402018b0
Capabilities:
Delete registry value

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx + 0x18]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov dword [rsp + 0x20], eax
mov rcx, qword [rsp + 0x40]
mov eax, dword [rsp + 0x20]
mov dword [rcx + 8], eax
mov rax, qword [rsp + 0x40]
mov dword [rax + 0xc], 0
mov rax, qword [rsp + 0x40]
mov dword [rax + 0x10], 0
cmp dword [rsp + 0x20], 0
jne 0x140201908
mov eax, 1
jmp 0x14020190a
xor eax, eax
add rsp, 0x38
ret
Function at 0x140201e50
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x880
mov rax, qword [0x1404f5550]
xor rax, rsp
mov qword [rsp + 0x870], rax
mov dword [rsp + 0x860], 1
mov dword [rsp + 0x40], 0
mov eax, dword [0x14044bc90]
mov dword [rsp + 0x60], eax
lea rdi, [rsp + 0x64]
xor eax, eax
mov ecx, 0x7fc
rep stosb byte [rdi], al
mov dword [rsp + 0x44], 0x800
mov dword [rsp + 0x48], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
lea r8, [rsp + 0x60]
mov edx, dword [rsp + 0x48]
mov rcx, qword [rsp + 0x890]
mov rcx, qword [rcx + 0x18]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0x103
jne 0x140201f11
mov dword [rsp + 0x860], 0
jmp 0x140201faa
cmp dword [rsp + 0x40], 0
jne 0x140201faa
mov rax, qword [rsp + 0x898]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x868], rax
lea r8, [rsp + 0x60]
mov rdx, qword [rsp + 0x868]
mov rcx, qword [rsp + 0x898]
call sub.mfc90u.dll_COleDispatchImpl::Release
mov dword [rsp + 0x44], 0x800
mov eax, dword [rsp + 0x48]
add eax, 1
mov dword [rsp + 0x48], eax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
lea r8, [rsp + 0x60]
mov edx, dword [rsp + 0x48]
mov rcx, qword [rsp + 0x890]
mov rcx, qword [rcx + 0x18]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov dword [rsp + 0x40], eax
jmp 0x140201f11
mov eax, dword [rsp + 0x860]
mov rcx, qword [rsp + 0x870]
xor rcx, rsp
call fcn.1403c2380
add rsp, 0x880
pop rdi
ret
Function at 0x140201fd0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x878
mov rax, qword [0x1404f5550]
xor rax, rsp
mov qword [rsp + 0x868], rax
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x4c], 0
mov dword [rsp + 0x44], 0x800
mov dword [rsp + 0x48], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
lea r8, [rsp + 0x60]
mov edx, dword [rsp + 0x48]
mov rcx, qword [rsp + 0x880]
mov rcx, qword [rcx + 0x18]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0x103
jne 0x140202072
mov dword [rsp + 0x4c], 0
jmp 0x140202113
cmp dword [rsp + 0x40], 0
jne 0x140202113
mov dword [rsp + 0x4c], 1
mov rax, qword [rsp + reloc.mfc90u.dll_CDocObjectServer::DoBeginPrinting]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x860], rax
lea r8, [rsp + 0x60]
mov rdx, qword [rsp + 0x860]
mov rcx, qword [rsp + reloc.mfc90u.dll_CDocObjectServer::DoBeginPrinting]
call sub.mfc90u.dll_COleDispatchImpl::Release
mov dword [rsp + 0x44], 0x800
mov eax, dword [rsp + 0x48]
add eax, 1
mov dword [rsp + 0x48], eax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
lea r8, [rsp + 0x60]
mov edx, dword [rsp + 0x48]
mov rcx, qword [rsp + 0x880]
mov rcx, qword [rcx + 0x18]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov dword [rsp + 0x40], eax
jmp 0x140202072
mov eax, dword [rsp + 0x4c]
mov rcx, qword [rsp + 0x868]
xor rcx, rsp
call fcn.1403c2380
add rsp, 0x878
ret
Function at 0x1402091e0
Capabilities:
Check for unmoving mouse cursor

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
movzx eax, byte [rax + 0x110]
test eax, eax
jne 0x140209316
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_SetCapture]
mov rcx, rax
call sub.mfc90u.dll_CDaoDatabase::Execute
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x1e8], 0
jne 0x140209239
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x48]
mov qword [rcx + 0x1e8], rax
mov rax, qword [rsp + 0x40]
mov byte [rax + 0x110], 1
mov rax, qword [rsp + 0x40]
mov rax, qword [rax]
mov edx, 1
mov rcx, qword [rsp + 0x40]
call qword [rax + 0x3d8]
mov rcx, qword [rsp + 0x40]
add rcx, 0x168
call qword [sym.imp.USER32.dll_GetCursorPos]
mov rax, qword [rsp + 0x40]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x40]
call qword [rax + 0x320]
and eax, 1
test eax, eax
je 0x1402092c9
mov rax, qword [rsp + 0x40]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x40]
call qword [rax + 0x320]
and eax, 0x80
test eax, eax
jne 0x1402092c9
call sub.mfc90u.dll_AfxFailMaxChars
mov rax, qword [rax + 8]
mov qword [rsp + 0x20], rax
mov edx, 0x7f86
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorW]
mov rcx, rax
call qword [sym.imp.USER32.dll_SetCursor]
mov rcx, qword [rsp + 0x40]
add rcx, 0x118
call qword [sym.imp.USER32.dll_GetCursorPos]
mov rax, qword [rsp + 0x40]
cmp qword [rax + reloc.mfc90u.dll_COleStreamFile::COleStreamFile], 0
je 0x1402092fd
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx + reloc.mfc90u.dll_COleStreamFile::COleStreamFile]
call fcn.1401fbbd0
jmp 0x140209316
mov rdx, qword [rsp + 0x40]
lea rcx, [0x1404f7d88]
call fcn.1400dbb20
mov rcx, rax
call fcn.1401fbbd0
add rsp, 0x38
ret
Function at 0x14020cb60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [rsp + 0x80]
mov rax, qword [rax + 0xc0]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x14020ccaa
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
jne 0x14020cbaf
call sub.mfc90u.dll_AfxOleUnregisterServerClass
mov rax, qword [rsp + 0x50]
mov rax, qword [rax]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x50]
add rax, 0x10
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov rax, qword [rax]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x3c], 1
mov rcx, qword [rsp + 0x40]
call fcn.14005e420
cmp eax, 9
jne 0x14020cc07
mov rax, qword [rsp + 0x80]
cmp dword [rax + 0x15c], 0
je 0x14020cc07
mov dword [rsp + 0x3c], 0
mov dword [rsp + 0x38], 1
cmp dword [0x1404f7e34], 0
je 0x14020cc4a
mov rcx, qword [rsp + 0x40]
call fcn.14005e420
cmp eax, 0x14
je 0x14020cc36
mov rcx, qword [rsp + 0x40]
call fcn.14005e420
cmp eax, 0x13
jne 0x14020cc3e
mov dword [rsp + 0x38], 1
mov rcx, qword [rsp + 0x40]
mov eax, dword [rsp + 0x38]
mov dword [rcx + 0x14], eax
cmp dword [rsp + 0x38], 0
jne 0x14020cc5b
mov dword [rsp + 0x60], 1
jmp 0x14020cc63
mov dword [rsp + 0x60], 0
mov r10, qword [rsp + 0x40]
mov r10, qword [r10]
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x3c]
mov dword [rsp + 0x20], eax
mov r9d, 1
mov r8d, 1
mov rdx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x40]
call qword [r10 + 0x30]
mov r11, qword [rsp + 0x40]
mov dword [r11 + 0x1c], 0xffffffff
jmp 0x14020cb8c
add rsp, 0x78
ret

Function at 0x140212260
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov ecx, send
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
test eax, eax
jge 0x140212280
xor eax, eax
jmp 0x14021235f
mov rax, qword [rsp + 0x80]
cmp qword [rax + reloc.mfc90u.dll_COleStreamFile::COleStreamFile], 0
je 0x1402122a8
mov rax, qword [rsp + 0x80]
mov rax, qword [rax + reloc.mfc90u.dll_COleStreamFile::COleStreamFile]
mov qword [rsp + 0x68], rax
jmp 0x1402122d7
mov rcx, qword [rsp + 0x80]
mov rcx, qword [rcx + 0x1e0]
call sub.mfc90u.dll_CWnd::ExecuteDlgInit
mov qword [rsp + 0x60], rax
mov rdx, qword [rsp + 0x60]
lea rcx, [0x1404f7d88]
call fcn.1400dbb20
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x14021235a
lea rcx, [rsp + 0x48]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_SetRectEmpty]
mov dword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
mov r8, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x30]
call fcn.1401f3c00
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_IsRectEmpty]
test eax, eax
je 0x14021235a
cmp dword [rsp + 0x40], 0
jne 0x14021235a
xor eax, eax
jmp 0x14021235f
mov eax, 1
add rsp, 0x78
ret
Function at 0x14021fe50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], r8
mov byte [rsp + 0x10], dl
mov qword [rsp + 8], rcx
sub rsp, 0x78
movzx eax, byte [rsp + 0x88]
test eax, eax
je 0x14021ff46
mov rax, qword [rsp + 0x80]
mov rax, qword [rax + 0x118]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov rax, qword [rax + reloc.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x90]
mov ecx, dword [rsp + 0x34]
mov eax, dword [rax + 0xc]
sub eax, ecx
mov dword [rsp + 0x5c], eax
mov rax, qword [rsp + 0x90]
mov ecx, dword [rsp + 0x30]
mov eax, dword [rax + 8]
sub eax, ecx
mov dword [rsp + 0x58], eax
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x5c]
mov dword [rsp + 0x4c], eax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x20], eax
mov ecx, dword [rsp + 0x38]
mov eax, dword [rsp + 0x40]
add eax, ecx
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x44]
mov dword [rsp + 0x24], eax
mov ecx, dword [rsp + 0x3c]
mov eax, dword [rsp + 0x44]
add eax, ecx
mov dword [rsp + 0x2c], eax
mov rax, qword [rsp + 0x80]
add rax, 0xc8
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x68]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x60], rax
lea r8, [rsp + 0x20]
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
call fcn.140225710
add rsp, 0x78
ret
Function at 0x14024b720
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0xb8
mov rcx, qword [rsp + 0xd0]
add rcx, 0xb0
mov rax, qword [rsp + 0xd0]
mov rax, qword [rax + 0xb0]
mov r8, qword [rsp + 0xd8]
lea rdx, [rsp + 0x30]
call qword [rax + reloc.OLEAUT32.dll_VariantTimeToSystemTime]
mov eax, dword [rax]
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x24], 0
jmp 0x14024b77f
mov eax, dword [rsp + 0x24]
add eax, 1
mov dword [rsp + 0x24], eax
mov rax, qword [rsp + 0xd0]
mov rax, qword [rax + reloc.mfc90u.dll_CAsyncSocket::Bind]
mov qword [rsp + 0x70], rax
movsxd rax, dword [rsp + 0x24]
cmp rax, qword [rsp + 0x70]
jge 0x14024b874
movsxd rax, dword [rsp + 0x24]
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0xd0]
add rax, 0x558
mov qword [rsp + 0x80], rax
cmp qword [rsp + 0x88], 0
jl 0x14024b806
mov rax, qword [rsp + 0x80]
mov rax, qword [rax + 0x10]
cmp qword [rsp + 0x88], rax
jge 0x14024b806
mov rcx, qword [rsp + 0x80]
mov rcx, qword [rcx + 8]
mov rax, qword [rsp + 0x88]
lea rax, [rcx + rax*8]
mov qword [rsp + 0x78], rax
jmp 0x14024b80b
call sub.mfc90u.dll_AfxOleUnregisterServerClass
mov rax, qword [rsp + 0x78]
mov rax, qword [rax]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x3c], 0
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x44], 0
lea rdi, [rsp + 0x50]
lea rsi, [rsp + 0x38]
mov ecx, reloc.WS2_32.dll_recv
rep movsb byte [rdi], byte [rsi]
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0xa0], xmm0
mov rdi, qword [rsp + 0x28]
lea rsi, [rsp + 0xa0]
add rdi, 0x34
mov ecx, reloc.WS2_32.dll_recv
rep movsb byte [rdi], byte [rsi]
jmp 0x14024b774
mov rax, qword [rsp + 0xd0]
mov ecx, dword [rax + 0x10]
add ecx, dword [rsp + 0x20]
mov rax, qword [rsp + 0xd0]
mov dword [rax + 0x18], ecx
lea rdi, [rsp + 0x60]
mov rsi, qword [rsp + 0xd0]
add rsi, 0x10
mov ecx, reloc.WS2_32.dll_recv
rep movsb byte [rdi], byte [rsi]
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x90], xmm0
mov rdi, qword [rsp + 0xd0]
lea rsi, [rsp + 0x90]
add rdi, 0xe4
mov ecx, reloc.WS2_32.dll_recv
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0xd0]
mov dword [rax + 0xa0], 0
mov rax, qword [rsp + 0xd0]
mov dword [rax + AfxOleUnlockControl], 0
mov rax, qword [rsp + 0xd0]
mov dword [rax + AfxOleUnlockControl], 0
add rsp, 0xb8
pop rdi
pop rsi
ret
Function at 0x140293c80
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [rsp + 0x50]
cmp dword [rax + 0xacc], 0
je 0x140293cc0
cmp qword [rsp + 0x60], 0x79
je 0x140293cb6
cmp qword [rsp + 0x60], 0x12
jne 0x140293cc0
mov eax, 1
jmp 0x140293e58
mov rax, qword [rsp + 0x50]
cmp dword [rax + 0xafc], 0
jne 0x140293cf9
cmp qword [rsp + 0x60], 0x79
je 0x140293ce8
cmp qword [rsp + 0x60], 0x12
je 0x140293ce8
mov dword [rsp + 0x2c], 0
jmp 0x140293cf0
mov dword [rsp + 0x2c], 1
mov eax, dword [rsp + 0x2c]
jmp 0x140293e58
mov ecx, send
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x140293d18
mov dword [rsp + 0x30], 1
jmp 0x140293d20
mov dword [rsp + 0x30], 0
mov eax, dword [rsp + 0x30]
mov dword [rsp + 0x20], eax
mov ecx, reloc.WS2_32.dll_recv
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x140293d47
mov dword [rsp + 0x34], 1
jmp 0x140293d4f
mov dword [rsp + 0x34], 0
mov eax, dword [rsp + 0x34]
mov dword [rsp + 0x24], eax
cmp qword [rsp + 0x60], 0x12
je 0x140293d82
cmp qword [rsp + 0x60], 0x79
je 0x140293d82
mov edx, 2
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_KillTimer]
xor eax, eax
jmp 0x140293e58
cmp qword [0x1404f8e30], 0
jne 0x140293e56
mov rax, qword [rsp + 0x50]
mov eax, dword [rax + 0x4ac]
and eax, 2
test eax, eax
jne 0x140293e56
cmp qword [rsp + 0x60], 0x12
je 0x140293dd0
cmp qword [rsp + 0x60], 0x79
jne 0x140293e56
cmp dword [rsp + 0x20], 0
jne 0x140293e56
cmp dword [rsp + 0x24], 0
jne 0x140293e56
call qword [sym.imp.USER32.dll_GetFocus]
mov rcx, rax
call sub.mfc90u.dll_CDaoDatabase::Execute
cmp rax, qword [rsp + 0x50]
jne 0x140293e09
mov rax, qword [rsp + 0x68]
and rax, 0x40000000
test rax, rax
jne 0x140293e09
cmp qword [rsp + 0x60], 0x79
jne 0x140293e09
mov rcx, qword [rsp + 0x58]
call sub.mfc90u.dll_CDHtmlDialog::ResizeBorder
jmp 0x140293e4f
cmp qword [rsp + 0x60], 0x79
jne 0x140293e1d
mov rcx, qword [rsp + 0x50]
call sub.mfc90u.dll_CDHtmlDialog::ResizeBorder
jmp 0x140293e4f
mov rax, qword [rsp + 0x50]
cmp dword [rax + 0xb04], 0
jge 0x140293e4f
mov dword [rsp + 0x28], 0xc8
xor r9d, r9d
mov r8d, dword [rsp + 0x28]
mov edx, 2
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_SetTimer]
mov eax, 1
jmp 0x140293e58
xor eax, eax
add rsp, 0x48
ret