joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1402341a0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rsi, rcx
mov rdi, r8
mov rcx, qword [rcx + 0x160]
mov rbx, rdx
test rcx, rcx
je 0x1402341fe
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1402341fe
mov rcx, qword [rsi + 0x160]
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], SerializeElements<ATL::CStringT<wchar_t,StrTraitMFC_DLL<wchar_t,ATL::ChTraitsCRT<wchar_t>
call fcn.140240050
test eax, eax
jne 0x140234276
cmp rbx, 0x24
je 0x140234280
cmp rbx, 0x41
jne 0x140234305
lea ecx, [rbx - 0x30]
call qword [sym.imp.USER32.dll_GetKeyState]
bt ax, 0xf
jae 0x140234305
lea ecx, [rbx + 0x64]
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x140234242
lea ecx, [rbx + 0x61]
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x140234305
mov rcx, qword [rsi + 0x40]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1004
call qword [sym.imp.USER32.dll_SendMessageW]
xor ebx, ebx
mov rdi, rax
test eax, eax
jle 0x140234276
mov r8d, 1
mov edx, ebx
mov rcx, rsi
call fcn.140236b50
inc ebx
cmp ebx, edi
jl 0x140234260
mov eax, 1
jmp 0x140234307
mov ecx, reloc.WS2_32.dll_recv
call qword [sym.imp.USER32.dll_GetKeyState]
bt ax, 0xf
jae 0x1402342fb
mov rcx, qword [rsi + 0x40]
mov r9d, 2
mov edx, 0x100c
lea r8, [r9 - 3]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rbp, rax
add ebp, 1
js 0x140234305
mov rcx, qword [rsi + 0x40]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1004
call qword [sym.imp.USER32.dll_SendMessageW]
cmp ebp, eax
jge 0x140234305
xor ebx, ebx
mov edi, ebx
test ebp, ebp
jle 0x140234305
nop dword [rax]
nop dword [rax + rax]
mov r8d, ebx
test edi, edi
mov edx, edi
mov rcx, rsi
sete r8b
call fcn.140236b50
inc edi
cmp edi, ebp
jl 0x1402342e0
jmp 0x140234305
xor edx, edx
mov rcx, rsi
call fcn.140236940
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x140238af0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
cmp dword [rdx + 8], 0x100
mov rbx, rdx
mov rdi, rcx
jne 0x140238c8c
mov rax, qword [rdx + 0x10]
cmp rax, 0xd
jne 0x140238b86
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_GetParent]
mov rcx, rax
call sub.mfc140u.dll_CMFCRibbonComboBox::FindItem
test rax, rax
je 0x140238b71
mov rcx, qword [rax + 0x40]
xor r9d, r9d
xor r8d, r8d
cmp dword [0x1403c5398], r8d
je 0x140238b66
mov edx, 0x500
call qword [sym.imp.USER32.dll_SendMessageW]
mov eax, 1
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov edx, 0x512
call qword [sym.imp.USER32.dll_PostMessageW]
mov eax, 1
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
cmp rax, 0x28
je 0x140238c40
cmp rax, 0x26
je 0x140238c40
cmp rax, 0x72
je 0x140238c40
cmp rax, 0x43
jne 0x140238bda
lea ecx, [rax - 0x32]
call qword [sym.imp.USER32.dll_GetKeyState]
bt ax, 0xf
jae 0x140238bda
mov ecx, 0xa5
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x140238c1a
mov ecx, 0xa2
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x140238c1a
cmp qword [rbx + 0x10], 0x58
jne 0x140238c13
mov ecx, select
call qword [sym.imp.USER32.dll_GetKeyState]
bt ax, 0xf
jae 0x140238c13
mov ecx, 0xa5
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x140238c1a
mov ecx, 0xa2
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x140238c1a
cmp qword [rbx + 0x10], 0x2e
jne 0x140238c8c
mov rcx, qword [rdi + 0x40]
xor r9d, r9d
xor r8d, r8d
mov edx, 0xb0
call qword [sym.imp.USER32.dll_SendMessageW]
mov ecx, eax
shr rcx, 0x10
cmp ax, cx
jne 0x140238c8c
mov rcx, qword [rdi + 0x40]
jmp 0x140238c4d
cmp dword [0x1403c5398], 0
je 0x140238c8c
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_GetParent]
mov rcx, rax
call sub.mfc140u.dll_CMFCRibbonComboBox::FindItem
test rax, rax
je 0x140238c8c
mov r9, qword [rbx + 0x18]
mov edx, 0x513
mov r8, qword [rbx + 0x10]
mov rcx, qword [rax + 0x40]
call qword [sym.imp.USER32.dll_SendMessageW]
mov eax, 1
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rdx, rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp sub.mfc140u.dll_CPreviewView::OnVScroll
Function at 0x14023ac50
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
push r15
sub rsp, 0x30
mov r15d, r8d
mov rsi, rdx
mov rdi, rcx
test rdx, rdx
jne 0x14023ac84
mov dword [rsp + 0x20], edx
xor r9d, r9d
lea edx, [rsi + 2]
xor r8d, r8d
call fcn.14023df20
xor al, al
add rsp, 0x30
pop r15
pop rdi
pop rsi
ret
mov qword [rsp + 0x58], rbp
call fcn.140239e60
xor edx, edx
mov qword [rdi + 8], 0xffffffffffffffff
mov rcx, rsi
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
xor r8d, r8d
xor edx, edx
mov rcx, rsi
movsxd rbp, eax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test ebp, ebp
jg 0x14023aced
xor r9d, r9d
mov dword [rsp + 0x20], 0
xor r8d, r8d
mov rcx, rdi
lea edx, [r9 + 0xc]
call fcn.14023df20
mov rbp, qword [rsp + 0x58]
xor al, al
add rsp, 0x30
pop r15
pop rdi
pop rsi
ret
lea eax, [rbp + 1]
mov qword [rsp + 0x50], rbx
movsxd rcx, eax
mov qword [rsp + 0x60], r14
call sub.mfc140u.dll_operator_2
mov r9, rsi
mov r8d, 1
mov rdx, rbp
mov rcx, rax
mov rbx, rax
mov byte [rax], 0
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, 1
je 0x14023ad49
call fcn.14026358e
xor r9d, r9d
mov dword [rsp + 0x20], 0
xor r8d, r8d
mov rcx, rdi
lea edx, [r9 + 2]
call fcn.14023df20
xor al, al
jmp 0x14023ada9
mov byte [rbp + rbx], 0
mov rax, rbx
movzx edx, byte [rbx]
test dl, dl
je 0x14023ad85
nop dword [rax + rax]
inc rax
lea r8, [rcx + 1]
cmp dl, 0xd
jne 0x14023ad79
mov byte [rcx], 0xa
cmp byte [rax], 0xa
jne 0x14023ad7b
inc rax
jmp 0x14023ad7b
mov byte [rcx], dl
movzx edx, byte [rax]
mov rcx, r8
test dl, dl
jne 0x14023ad60
mov byte [rcx], 0
mov r9d, r15d
mov rax, qword [rdi]
xor r8d, r8d
mov rdx, rbx
mov rcx, rdi
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, rbx
call fcn.14026358e
cmp byte [rdi + 0x50], 0
sete al
mov rbx, qword [rsp + 0x50]
mov r14, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop r15
pop rdi
pop rsi
ret
Function at 0x14023ec80
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x160]
test rcx, rcx
je 0x140233744
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x140233744
mov rcx, qword [rbx + 0x160]
add rsp, 0x20
pop rbx
jmp 0x14023ec80
add rsp, 0x20
pop rbx
ret
push rbx
push rdi
sub rsp, 0x48
mov rdi, rcx
add rcx, 0x670
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
test eax, eax
jle 0x14023edc3
mov qword [rsp + 0x70], rbp
lea rcx, [rdi + 0x670]
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x40], r14
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___3]
lea r8, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x68]
lea rcx, [rdi + 0x130]
call sub.mfc140u.dll_Ordinal_6648
mov eax, dword [rsp + 0x60]
mov ecx, reloc.WS2_32.dll_recv
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x24], 0xffffffff
call qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, dword [rsp + 0x20]
lea r9, [rsp + 0x20]
movzx esi, ax
mov edx, 0x44f
mov eax, 0x8000
and si, ax
cmovne ecx, dword [rsp + 0x68]
xor ebx, ebx
mov r14d, ebx
mov dword [rsp + 0x20], ecx
mov rcx, qword [rdi + 0x170]
test si, si
sete r14b
mov r8, r14
call qword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0xffffffff
jne 0x14023ed80
test si, si
je 0x14023ed55
mov rcx, qword [rdi + 0x170]
lea edx, [rbx + 0xe]
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.USER32.dll_SendMessageW]
mov dword [rsp + 0x20], eax
jmp 0x14023ed59
mov dword [rsp + 0x20], ebx
mov rcx, qword [rdi + 0x170]
lea r9, [rsp + 0x20]
mov r8, r14
mov dword [rsp + 0x24], 0xffffffff
mov edx, 0x44f
call qword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0xffffffff
je 0x14023edb4
mov eax, dword [rsp + 0x30]
lea rcx, [rdi + 0x130]
test eax, eax
cmovns ebx, eax
mov r8d, ebx
mov edx, ebx
call sub.mfc140u.dll_CFrameWnd::SetHelpCapture
mov rcx, qword [rdi + 0x170]
lea r9, [rsp + 0x30]
xor r8d, r8d
mov edx, 0x437
call qword [sym.imp.USER32.dll_SendMessageW]
mov rsi, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x70]
mov r14, qword [rsp + 0x40]
add rsp, 0x48
pop rdi
pop rbx
ret
Function at 0x140240050
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rdi, rdx
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je case.0x14024019e.514
mov ecx, dword [rdi + 8]
mov eax, ecx
cmp ecx, 0x100
ja 0x140240183
je 0x1402400ac
add eax, 0xffffffba
cmp eax, 0x63
ja case.0x14024019e.514
lea rdx, [0x140000000]
movzx eax, byte [rdx + rax + 0x240218]
mov ecx, dword [rdx + rax*4 + 0x24020c]
add rcx, rdx
jmp rcx
mov rdi, qword [rdi + 0x10]
cmp rdi, 0x43
jne 0x140240104
lea ecx, [rdi - 0x32]
call qword [sym.imp.USER32.dll_GetKeyState]
bt ax, 0xf
jae 0x14024014e
mov rcx, qword [rbx + reloc.mfc140u.dll_CMFCOutlookBarPaneButton::CMFCOutlookBarPaneButton]
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x14024014e
lea rcx, [rbx + 0x240]
call fcn.1401411b0
lea edx, [rdi - 0x40]
lea rcx, [0x1403c4350]
call fcn.14010c3b0
lea eax, [rdi - 0x42]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
cmp rdi, 9
jne 0x140240124
lea rcx, [rbx + 0x130]
call sub.mfc140u.dll_CMFCRibbonSlider::SetACCData
lea eax, [rdi - 8]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
cmp rdi, 0x11
je case.0x14024019e.514
cmp rdi, 0x10
je case.0x14024019e.514
cmp rdi, 0x26
je case.0x14024019e.514
cmp rdi, 0x28
je case.0x14024019e.514
cmp rdi, 0x22
je case.0x14024019e.514
cmp rdi, 0x21
je case.0x14024019e.514
cmp rdi, 0x2e
je case.0x14024019e.514
mov rcx, qword [rbx + 0xd08]
test rcx, rcx
je case.0x14024019e.515
mov edx, edi
call fcn.1400050e0
test al, al
jne case.0x14024019e.514
cmp byte [rbx + 0xd00], 0
jne case.0x14024019e.514
mov rcx, rbx
call fcn.14023f1a0
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
add eax, 0xfffffdff
cmp eax, 0xd
ja case.0x14024019e.514
lea rdx, [0x140000000]
mov eax, dword [rdx + rax*4 + 0x24027c]
add rax, rdx
jmp rax
cmp byte [rbx + 0xd00], 0
jne case.0x14024019e.514
call fcn.14016b7e0
test eax, eax
je case.0x14024019e.514
mov rcx, rbx
call fcn.14023f460
test eax, eax
jmp 0x14024016c
cmp qword [rbx + 0xa58], 0
mov edx, ecx
mov r9, qword [rdi + 0x18]
mov r8, qword [rdi + 0x10]
je 0x1402401ef
mov rcx, qword [rbx + 0x9b0]
call qword [sym.imp.USER32.dll_PostMessageW]
mov eax, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rcx, qword [rbx + 0x170]
call qword [sym.imp.USER32.dll_PostMessageW]
mov rbx, qword [rsp + 0x30]
mov eax, 1
add rsp, 0x20
pop rdi
ret
Function at 0x1402411a0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov rsi, rdx
mov rdi, rcx
add rcx, 0x848
call fcn.14014bd30
mov ecx, dword [rsi + 8]
sub ecx, 0x100
je 0x1402412fe
sub ecx, reloc.mfc140u.dll_CMapStringToOb::HashKey
je 0x140241227
cmp ecx, 2
jne 0x14024126f
call qword [sym.imp.USER32.dll_GetFocus]
mov rcx, rax
call sub.mfc140u.dll_CMFCRibbonComboBox::FindItem
test rax, rax
je 0x14024126f
mov rax, qword [rax + 0x40]
cmp qword [rdi + 0x170], rax
je 0x14024120a
cmp qword [rdi + 0x9b0], rax
jne 0x14024126f
mov rcx, rdi
call fcn.1402407b0
mov eax, 1
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
call qword [sym.imp.USER32.dll_GetFocus]
mov rcx, rax
call sub.mfc140u.dll_CMFCRibbonComboBox::FindItem
test rax, rax
je 0x14024126f
mov rax, qword [rax + 0x40]
cmp qword [rdi + 0x170], rax
je 0x14024126f
cmp qword [rdi + 0x478], rax
je 0x14024126f
mov rcx, qword [rdi + 0x40]
call qword [sym.imp.USER32.dll_GetParent]
mov rcx, rax
call sub.mfc140u.dll_CMFCRibbonComboBox::FindItem
test rax, rax
je 0x14024126f
mov rcx, rax
call sub.mfc140u.dll_CMFCRibbonSlider::SetACCData
cmp qword [rdi + 0xd08], 0
je 0x1402412e4
lea rdx, [0x1402ac320]
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__15]
mov rbx, rax
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
xor eax, eax
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rax
mov rdx, rbx
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
mov rcx, rbx
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea r8, [rsp + 0x20]
mov rdx, rsi
mov rcx, qword [rdi + 0xd08]
call fcn.1400053d0
nop
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
mov rdx, rsi
mov rcx, rdi
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
jmp sub.mfc140u.dll_CPreviewView::OnVScroll
cmp qword [rsi + 0x10], 0x43
jne 0x14024126f
mov ecx, select
call qword [sym.imp.USER32.dll_GetKeyState]
bt ax, 0xf
jae 0x14024126f
xor r9d, r9d
xor r8d, r8d
mov edx, 0x301
mov rcx, qword [rdi + 0x170]
call qword [sym.imp.USER32.dll_SendMessageW]
mov edx, 3
lea rcx, [0x1403c4350]
call fcn.14010c3b0
mov eax, 1
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x140241360
Capabilities:
Print debug messages

Disassembly:
push rdi
sub rsp, 0x40
mov rax, qword [0x14039e2e8]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rdi, rcx
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x140241448
cmp byte [rdi + 0x8c0], 0
xorps xmm0, xmm0
mov qword [rsp + 0x58], rbx
movdqu xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x60], rsi
je 0x1402413b4
movups xmm0, xmmword [rdi + 0x92c]
movups xmmword [rsp + 0x28], xmm0
jmp 0x1402413c3
mov rcx, qword [rdi + 0x40]
lea rdx, [rsp + 0x28]
call qword [sym.imp.USER32.dll_GetWindowRect]
mov esi, dword [rsp + 0x30]
lea rcx, [rdi + 0x960]
mov ebx, dword [rsp + 0x34]
sub esi, dword [rsp + 0x28]
sub ebx, dword [rsp + 0x2c]
call fcn.14014c100
mov r8d, dword [rdi + 0x964]
mov edx, 0x60
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_MulDiv]
lea rcx, [rdi + 0x960]
mov ebx, eax
call fcn.14014c100
mov r8d, dword [rdi + 0x964]
mov edx, 0x60
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_MulDiv]
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x24], ebx
mov rcx, qword [rsp + 0x20]
call fcn.14016fcf0
mov rcx, qword [rsp + 0x28]
call fcn.14016fca0
lea rcx, str.Saving_tooltip_size
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rsi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1402654f0
add rsp, 0x40
pop rdi
ret
Function at 0x140243730
Capabilities:
Log keystrokes via polling

Disassembly:
push rdi
sub rsp, 0x20
mov rdi, rcx
cmp rdx, 5
jne 0x1402437e6
cmp byte [rcx + 0x160], 0
je 0x1402437c3
xor eax, eax
mov qword [rsp + 0x30], rbx
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x38], rax
call qword [sym.imp.USER32.dll_GetCursorPos]
mov rdx, qword [rsp + 0x38]
mov rcx, rdi
call fcn.140243410
mov rcx, qword [rdi + 0x40]
lea rdx, [rsp + 0x38]
mov rbx, rax
call qword [sym.imp.USER32.dll_ScreenToClient]
cmp ebx, 2
mov rbx, qword [rsp + 0x30]
jne 0x1402437c3
mov rdx, qword [rsp + 0x38]
lea rcx, [rdi + 0xf0]
call qword [sym.imp.USER32.dll_PtInRect]
test eax, eax
jne 0x1402437c3
mov rdx, qword [rsp + 0x38]
lea rcx, [rdi + 0x120]
call qword [sym.imp.USER32.dll_PtInRect]
test eax, eax
jne 0x1402437c3
lea edx, [rax + 3]
mov rcx, rdi
call fcn.140243160
mov rcx, qword [rdi + 0x40]
mov edx, 5
call qword [sym.imp.USER32.dll_KillTimer]
mov rcx, rdi
mov byte [rdi + reloc.mfc140u.dll_CHandleMap::CHandleMap], 0
add rsp, 0x20
pop rdi
jmp sub.mfc140u.dll_CDHtmlDialog::DDX_DHtml_ElementText_1
cmp rdx, 6
jne 0x140243827
lea ecx, [rdx - 5]
call qword [sym.imp.USER32.dll_GetKeyState]
bt ax, 8
jb 0x140243827
xor eax, eax
lea rcx, [rdi + 0xe8]
mov r9d, eax
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov rdx, rdi
call fcn.14014af60
mov rcx, qword [rdi + 0x40]
mov edx, 6
call qword [sym.imp.USER32.dll_KillTimer]
mov rcx, rdi
add rsp, 0x20
pop rdi
jmp sub.mfc140u.dll_CDHtmlDialog::DDX_DHtml_ElementText_1
Function at 0x140246e50
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x268
mov rax, qword [0x14039e2e8]
xor rax, rsp
mov qword [rsp + 0x250], rax
imul eax, dword [rsp + 0x2b0], 0x3e8
mov ebp, r9d
movsxd rbx, ecx
mov esi, r8d
mov rdi, rdx
mov qword [rsp + 0x48], rbx
inc ecx
mov dword [rsp + 0x40], 1
xor r9d, r9d
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x34], eax
lea rdx, [rsp + 0x40]
lea rax, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_select]
test eax, eax
jns 0x140246ec6
mov eax, 0xffffffff
jmp 0x140246ef2
jle 0x140246eed
lea rdx, [rsp + 0x40]
mov rcx, rbx
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x140246eed
mov r9d, ebp
mov r8d, esi
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_recv]
jmp 0x140246ef2
mov eax, 0xfffffffe
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1402654f0
add rsp, 0x268
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x140246fe0
Capabilities:
Send data
Send data on socket

Disassembly:
mov dword [rdx + 4], r8d
mov r9b, 1
mov r8d, CChevronOwnerDrawMenu::CChevronOwnerDrawMenu
jmp fcn.140247000
Function at 0x140251f80
Capabilities:
Reference sql statements

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x60
mov ebx, edx
mov edi, ecx
mov r9d, edx
lea r8, str.SELECT_lID_FROM_CopyBuffers_WHERE_lCopyBuffer___d
lea rdx, [rsp + 0x38]
lea rcx, [0x1403c44c8]
call fcn.140143da0
nop
lea rcx, [rsp + 0x38]
call fcn.1401437b0
test al, al
je 0x140251fcf
mov r8d, ebx
lea rdx, str.INSERT_INTO_CopyBuffers_VALUES_NULL___1___d__
lea rcx, [0x1403c44c8]
call fcn.140143b90
nop
lea rcx, [rsp + 0x38]
call fcn.140143000
mov r9d, ebx
mov r8d, edi
lea rdx, str.UPDATE_CopyBuffers_SET_lClipID___d_WHERE_lCopyBuffer___d
lea rcx, [0x1403c44c8]
call fcn.140143b90
movdqa xmm0, xmmword [0x1402ddc20]
movdqu xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
mov ecx, ebx
call fcn.140169820
cmp dword [rsp + 0x2c], 0
je 0x140252028
xor edx, edx
mov r8d, 0x20001
lea rcx, str.ding.wav
call qword [sym.imp.WINMM.dll_PlaySoundW]
mov al, 1
jmp 0x14025202e
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret

Function at 0x140252950
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov rbx, r9
mov dword [r9], 0
mov edi, r8d
mov rbp, rdx
mov rsi, rcx
mov r14d, 0x40000000
nop dword [rax]
nop word [rax + rax]
mov edx, dword [rbx]
mov r8d, edi
mov ecx, dword [rsi + 0x1c]
sub r8d, edx
cmp r8d, r14d
cmova r8d, r14d
add rdx, rbp
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__read]
test eax, eax
jle 0x1402529b7
add dword [rbx], eax
cmp dword [rbx], edi
jb 0x140252990
test eax, eax
jns 0x1402529da
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov ecx, dword [rax]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_strerror]
or edx, 0xffffffff
mov rcx, rsi
mov r8, rax
call fcn.140253f80
or eax, 0xffffffff
jmp 0x1402529e7
test eax, eax
jne 0x1402529e5
mov dword [rsi + 0x50], 1
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x14025fbd0
Capabilities:
Encode data using xor

Disassembly:
mov r10d, 1
mov r9, rcx
cmp dword [rcx + 0x1c], r10d
jle 0x14025fcd1
lea rax, [rcx + 0x32]
lea r11, [0x140000000]
nop
movzx edx, byte [rax + 1]
inc r10d
movzx ecx, byte [rax - 1]
lea rax, [rax + 0x10]
mov r8d, dword [r11 + rdx*4 + 0x39ddb0]
xor r8d, dword [r11 + rcx*4 + 0x39d5b0]
movzx ecx, byte [rax - 0x10]
xor r8d, dword [r11 + rcx*4 + 0x39d9b0]
movzx ecx, byte [rax - 0x12]
xor r8d, dword [r11 + rcx*4 + 0x39d1b0]
mov dword [rax - 0x12], r8d
movzx edx, byte [rax - 0xb]
movzx ecx, byte [rax - 0xc]
mov r8d, dword [r11 + rdx*4 + 0x39ddb0]
xor r8d, dword [r11 + rcx*4 + 0x39d9b0]
movzx ecx, byte [rax - 0xd]
xor r8d, dword [r11 + rcx*4 + 0x39d5b0]
movzx ecx, byte [rax - 0xe]
xor r8d, dword [r11 + rcx*4 + 0x39d1b0]
mov dword [rax - 0xe], r8d
movzx edx, byte [rax - 7]
movzx ecx, byte [rax - 8]
mov r8d, dword [r11 + rdx*4 + 0x39ddb0]
xor r8d, dword [r11 + rcx*4 + 0x39d9b0]
movzx ecx, byte [rax - 9]
xor r8d, dword [r11 + rcx*4 + 0x39d5b0]
movzx ecx, byte [rax - 0xa]
xor r8d, dword [r11 + rcx*4 + 0x39d1b0]
mov dword [rax - 0xa], r8d
movzx ecx, byte [rax - 4]
movzx edx, byte [rax - 3]
mov r8d, dword [r11 + rdx*4 + 0x39ddb0]
xor r8d, dword [r11 + rcx*4 + 0x39d9b0]
movzx ecx, byte [rax - 5]
xor r8d, dword [r11 + rcx*4 + 0x39d5b0]
movzx ecx, byte [rax - 6]
xor r8d, dword [r11 + rcx*4 + 0x39d1b0]
mov dword [rax - 6], r8d
cmp r10d, dword [r9 + 0x1c]
jl 0x14025fbf0
ret
Function at 0x14025ff70
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r14
sub rsp, 0x50
mov rax, qword [0x14039e2e8]
xor rax, rsp
mov qword [rsp + 0x38], rax
cmp dword [rcx], 0
mov rdi, r9
mov r14d, r8d
mov rbx, rdx
mov rbp, rcx
je 0x14025ffa4
mov eax, 0xfffffffb
jmp 0x14025fff0
cmp dword [rcx + 8], 1
je 0x14025ffb1
mov eax, 0xfffffffa
jmp 0x14025fff0
test rdx, rdx
je 0x140260158
test r14d, r14d
jle 0x140260158
mov qword [rsp + 0x78], rsi
test r14b, 0xf
jne 0x14026014e
mov ecx, dword [rcx + 4]
shr r14d, 4
test ecx, ecx
je 0x1402600c8
cmp ecx, 1
je 0x14026000e
mov eax, 0xffffffff
mov rsi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1402654f0
mov rbx, qword [rsp + 0x80]
add rsp, 0x50
pop r14
pop rdi
pop rbp
ret
lea esi, [r14 - 1]
movaps xmmword [rsp + 0x40], xmm6
movups xmm6, xmmword [rbp + 0xc]
test esi, esi
jle 0x140260054
nop
lea r8, [rsp + 0x20]
mov rdx, rbx
mov rcx, rbp
call fcn.14025f190
movdqu xmm0, xmmword [rsp + 0x20]
dec esi
pxor xmm0, xmm6
movups xmm6, xmmword [rbx]
add rbx, 0x10
movups xmmword [rdi], xmm0
add rdi, 0x10
movdqu xmmword [rsp + 0x20], xmm0
test esi, esi
jg 0x140260020
lea r8, [rsp + 0x20]
mov rdx, rbx
mov rcx, rbp
call fcn.14025f190
movdqu xmm0, xmmword [rsp + 0x20]
pxor xmm0, xmm6
movaps xmm6, xmmword [rsp + 0x40]
movdqu xmmword [rsp + 0x20], xmm0
psrldq xmm0, 0xf
movd eax, xmm0
movzx ebx, al
lea eax, [rbx - 1]
cmp eax, 0xf
ja 0x14026014e
mov r8d, reloc.WS2_32.dll_recv
sub r8, rbx
cmp r8, 0x10
jge 0x140260132
mov rdx, r8
nop word [rax + rax]
movzx eax, byte [rsp + rdx + 0x20]
cmp eax, ebx
jne 0x14026014e
inc rdx
cmp rdx, 0x10
jl 0x1402600b0
jmp 0x140260132
lea esi, [r14 - 1]
test esi, esi
jle 0x1402600ec
mov r8, rdi
mov rdx, rbx
mov rcx, rbp
call fcn.14025f190
add rbx, 0x10
add rdi, 0x10
dec esi
test esi, esi
jg 0x1402600d0
lea r8, [rsp + 0x20]
mov rdx, rbx
mov rcx, rbp
call fcn.14025f190
movzx ebx, byte [rsp + 0x2f]
lea eax, [rbx - 1]
cmp eax, 0xf
ja 0x14026014e
mov r8d, reloc.WS2_32.dll_recv
sub r8, rbx
cmp r8, 0x10
jge 0x140260132
mov rcx, r8
nop dword [rax + rax]
movzx eax, byte [rsp + rcx + 0x20]
cmp eax, ebx
jne 0x14026014e
inc rcx
cmp rcx, 0x10
jl 0x140260120
lea rdx, [rsp + 0x20]
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
shl r14d, 4
sub r14d, ebx
mov eax, r14d
jmp 0x14025ffeb
mov eax, 0xfffffff9
jmp 0x14025ffeb
xor eax, eax
jmp 0x14025fff0
Function at 0x1402606c0
Capabilities:
Hash data using sha256

Disassembly:
xor eax, eax
mov qword [rcx], rax
movups xmm0, xmmword [0x1403093d0]
movups xmmword [rcx + 8], xmm0
movups xmm1, xmmword [0x1403093e0]
movups xmmword [rcx + 0x18], xmm1
ret