joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14017cab0
Capabilities:
Log keystrokes via polling

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x58
mov ecx, reloc.WS2_32.dll_socket
call fcn.1401105c0
test eax, eax
je 0x14017cae1
mov dword [rsp + 0x38], 2
jmp 0x14017cae9
mov dword [rsp + 0x38], 1
mov eax, dword [rsp + 0x38]
mov dword [rsp + 0x20], eax
mov ecx, dword [rsp + 0x20]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
jne 0x14017cb0c
xor eax, eax
jmp 0x14017cc3b
cmp dword [rsp + 0x88], 0
jne 0x14017cb3c
cmp dword [rsp + 0x90], 0
jne 0x14017cb3c
mov rax, qword [rsp + 0x70]
mov eax, dword [rax + 0xac]
and eax, 4
test eax, eax
je 0x14017cb3c
mov dword [rsp + 0x3c], 1
jmp 0x14017cb44
mov dword [rsp + 0x3c], 0
mov eax, dword [rsp + 0x3c]
mov dword [rsp + 0x24], eax
mov rax, qword [rsp + 0x70]
mov eax, dword [rax + 0xac]
and eax, 1
test eax, eax
jne 0x14017cb6c
cmp dword [rsp + 0x24], 0
jne 0x14017cb6c
xor eax, eax
jmp 0x14017cc3b
mov rcx, qword [rsp + 0x70]
mov eax, dword [rsp + 0x78]
mov dword [rcx + 0xb94], eax
mov rcx, qword [rsp + 0x70]
mov eax, dword [rsp + 0x88]
mov dword [rcx + 0xbb0], eax
mov rcx, qword [rsp + 0x70]
mov eax, dword [rsp + 0x90]
mov dword [rcx + 0xbb4], eax
xor eax, eax
test rax, rax
jne 0x14017cbb1
mov qword [rsp + 0x40], 0
jmp 0x14017cbbf
xor eax, eax
add rax, 8
mov rax, qword [rax]
mov qword [rsp + 0x40], rax
mov r9d, reloc.mfc90u.dll_SerializeElements_class_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_______
mov r8, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x70]
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_RedrawWindow]
mov rdx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x70]
call sub.mfc90u.dll_CDragListBox::CancelDrag
lea rdi, [rsp + 0x28]
mov rsi, qword [rsp + 0x80]
mov ecx, reloc.WS2_32.dll_recv
rep movsb byte [rdi], byte [rsi]
mov rdi, qword [rsp + 0x70]
lea rsi, [rsp + 0x28]
add rdi, 0xb98
mov ecx, reloc.WS2_32.dll_recv
rep movsb byte [rdi], byte [rsi]
mov rcx, qword [rsp + 0x70]
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_SetCapture]
mov rcx, rax
call sub.mfc90u.dll_CDaoDatabase::Execute
mov eax, 1
add rsp, 0x58
pop rdi
pop rsi
ret

Function at 0x1401812a0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov ecx, reloc.WS2_32.dll_socket
call fcn.1401105c0
test eax, eax
je 0x1401812c1
mov dword [rsp + 0x24], 2
jmp 0x1401812c9
mov dword [rsp + 0x24], 1
mov eax, dword [rsp + 0x24]
mov dword [rsp + 0x20], eax
mov ecx, dword [rsp + 0x20]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
jne 0x1401812e9
xor eax, eax
jmp 0x140181314
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_SetCapture]
mov rcx, rax
call sub.mfc90u.dll_CDaoDatabase::Execute
mov rax, qword [rsp + 0x40]
mov dword [rax + COleDocObjectItem::DoDefaultPrinting], 1
mov eax, 1
add rsp, 0x38
ret
Function at 0x1401825e0
Capabilities:
Log keystrokes via polling

Disassembly:
mov dword [rsp + 0x20], r9d
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov ecx, reloc.WS2_32.dll_recv
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x140182624
mov rax, qword [rsp + 0x40]
cmp dword [rax + 0x8c0], 0
jne 0x140182624
mov dword [rsp + 0x28], 1
jmp 0x14018262c
mov dword [rsp + 0x28], 0
mov eax, dword [rsp + 0x28]
mov dword [rsp + 0x24], eax
mov ecx, send
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x140182661
mov rax, qword [rsp + 0x40]
cmp dword [rax + 0x8c4], 0
jne 0x140182661
mov dword [rsp + 0x2c], 1
jmp 0x140182669
mov dword [rsp + 0x2c], 0
mov eax, dword [rsp + 0x2c]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x48], 0x29
jne 0x140182686
cmp dword [rsp + 0x20], 0
je 0x140182686
mov eax, 1
jmp 0x1401826a4
cmp dword [rsp + 0x48], 0x20
jne 0x1401826a2
cmp dword [rsp + 0x24], 0
jne 0x14018269b
cmp dword [rsp + 0x20], 0
je 0x1401826a2
mov eax, 1
jmp 0x1401826a4
xor eax, eax
add rsp, 0x38
ret
Function at 0x140183c90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xa8
mov dword [rsp + 0x20], 0
mov rcx, qword [rsp + 0xb0]
add rcx, 0x530
call fcn.1401c4550
mov dword [rsp + 0x24], eax
mov rcx, qword [rsp + 0xb0]
add rcx, 0x530
call fcn.140154800
cmp dword [rsp + 0x24], eax
je 0x140183eec
mov rcx, qword [rsp + 0xb0]
add rcx, 0x530
lea rdx, [rsp + 0x24]
call fcn.140154850
mov dword [rsp + 0x2c], eax
cmp dword [rsp + 0x2c], 0xffffffff
jne 0x140183d12
jmp 0x140183eec
mov rax, qword [rsp + 0xc0]
mov eax, dword [rax]
cmp dword [rsp + 0x2c], eax
je 0x140183d40
mov rax, qword [rsp + 0xc0]
mov eax, dword [rax + 8]
cmp dword [rsp + 0x2c], eax
je 0x140183d40
mov dword [rsp + 0x90], 0
jmp 0x140183d4b
mov dword [rsp + 0x90], 1
mov eax, dword [rsp + 0x90]
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0
jne 0x140183d68
cmp dword [rsp + 0x20], 0
je 0x140183eb8
mov edx, dword [rsp + 0x2c]
mov rcx, qword [rsp + 0xb8]
call fcn.14000848c
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x140183eb8
mov dword [rsp + 0x38], 0xffffffff
mov dword [rsp + 0x3c], 0xffffffff
mov dword [rsp + 0x40], 0xffffffff
mov dword [rsp + 0x44], 0xffffffff
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
call qword [rax + 0x158]
test eax, eax
je 0x140183eb8
mov dword [rsp + 0x48], 0
mov rax, qword [rsp + 0xc8]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x140183e9f
cmp dword [rsp + 0x48], 0
jne 0x140183e9f
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x88]
mov rax, qword [rax + 8]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x88]
add rax, 0x10
mov qword [rsp + 0x58], rax
mov rcx, qword [rsp + 0x58]
mov eax, dword [rsp + 0x3c]
cmp dword [rcx + 4], eax
jne 0x140183e7d
mov rcx, qword [rsp + 0x58]
mov eax, dword [rsp + 0x44]
cmp dword [rcx + 0xc], eax
jne 0x140183e7d
mov rcx, qword [rsp + 0x58]
mov eax, dword [rsp + 0x38]
cmp dword [rcx], eax
jne 0x140183e7d
mov rcx, qword [rsp + 0x58]
mov eax, dword [rsp + 0x40]
cmp dword [rcx + 8], eax
jne 0x140183e7d
mov dword [rsp + 0x94], 1
jmp 0x140183e88
mov dword [rsp + 0x94], 0
cmp dword [rsp + 0x94], 0
je 0x140183e9a
mov dword [rsp + 0x48], 1
jmp 0x140183df3
cmp dword [rsp + 0x48], 0
jne 0x140183eb8
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0xc8]
call fcn.14018d6c0
cmp dword [rsp + 0x28], 0
je 0x140183ee7
cmp dword [rsp + 0x20], 0
jne 0x140183edd
mov rcx, qword [rsp + 0xc0]
mov rax, qword [rsp + 0xc0]
mov eax, dword [rax + 8]
cmp dword [rcx], eax
jne 0x140183edf
jmp 0x140183eec
mov dword [rsp + 0x20], 1
jmp 0x140183ccb
add rsp, 0xa8
ret
Function at 0x1401870e0
Capabilities:
Write clipboard data

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x20], 0
mov eax, dword [rsp + 0x60]
add eax, 1
cdqe
shl rax, 1
mov qword [rsp + 0x28], rax
mov rdx, qword [rsp + 0x28]
mov ecx, 0x2000
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140187137
xor eax, eax
jmp 0x1401871a7
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x14018715e
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
xor eax, eax
jmp 0x1401871a7
movsxd r8, dword [rsp + 0x60]
shl r8, 1
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x30]
call sub.MSVCR90.dll_memcpy
movsxd r11, dword [rsp + 0x60]
xor ecx, ecx
mov rax, qword [rsp + 0x30]
mov word [rax + r11*2], cx
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rdx, qword [rsp + 0x20]
mov ecx, recv
call qword [sym.imp.USER32.dll_SetClipboardData]
nop
mov rax, qword [rsp + 0x20]
add rsp, 0x48
ret

Function at 0x1401871b0
Capabilities:
Write clipboard data

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0xc8
mov qword [rsp + 0xb8], 0xfffffffffffffffe
mov rcx, qword [rsp + 0xd0]
mov eax, dword [rsp + 0xd8]
mov dword [rcx + 0xc48], eax
mov rax, qword [rsp + 0xd0]
cmp qword [rax + 0xc50], 0
jne 0x1401871fa
xor eax, eax
jmp 0x1401872fc
mov rcx, qword [rsp + 0xd0]
mov rcx, qword [rcx + 0xc50]
call fcn.1402ea390
test eax, eax
jne 0x14018721f
call qword [sym.imp.USER32.dll_CloseClipboard]
xor eax, eax
jmp 0x1401872fc
mov r8d, reloc.mfc90u.dll_CDaoTableDef::GetValidationRule
mov edx, 2
lea rcx, [rsp + 0x20]
call fcn.1403c15d8
nop
lea rdx, [rsp + 0x20]
mov rcx, qword [rsp + 0xd0]
mov rcx, qword [rcx + 0xc50]
call fcn.1402eaa40
test eax, eax
jne 0x14018727b
call qword [sym.imp.USER32.dll_CloseClipboard]
mov qword [rsp + 0xa8], 0
lea rcx, [rsp + 0x20]
call sub.mfc90u.dll_CPrintInfo::CPrintInfo
mov rax, qword [rsp + 0xa8]
jmp 0x1401872fc
lea rcx, [rsp + 0x20]
call sub.mfc90u.dll_DDX_OCBoolRO
mov qword [rsp + 0x90], rax
mov rax, qword [rsp + 0xd0]
mov rax, qword [rax + 0xc50]
mov rcx, qword [rsp + 0xd0]
mov rcx, qword [rcx + 0xc50]
mov rax, qword [rax]
call qword [rax + 0x30]
movzx ecx, ax
mov rdx, qword [rsp + 0x90]
call qword [sym.imp.USER32.dll_SetClipboardData]
mov rcx, qword [rsp + 0xd0]
mov rcx, qword [rcx + 0xc50]
call fcn.1402ea1b0
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0xb0], rax
lea rcx, [rsp + 0x20]
call sub.mfc90u.dll_CPrintInfo::CPrintInfo
mov rax, qword [rsp + 0xb0]
jmp 0x1401872fc
add rsp, 0xc8
ret
Function at 0x1401b89b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
cmp dword [rsp + 0x88], 0
je 0x1401b89df
mov dword [rsp + 0x30], 1
jmp 0x1401b8b20
mov rax, qword [rsp + 0x70]
cmp dword [rax + 0xc], 0
jne 0x1401b89f9
mov rax, qword [rsp + 0x70]
cmp dword [rax + 8], 0
je 0x1401b8a8a
mov rax, qword [rsp + 0x70]
cmp dword [rax + 8], 0
je 0x1401b8a15
mov rax, qword [rsp + 0x60]
mov eax, dword [rax + 0x238]
mov dword [rsp + 0x40], eax
jmp 0x1401b8a24
mov rax, qword [rsp + 0x60]
mov eax, dword [rax + 0x220]
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x34], eax
mov eax, dword [rsp + 0x34]
and rax, 0xff
movzx eax, al
cmp eax, 0xc0
jg 0x1401b8a7d
movzx eax, word [rsp + 0x34]
sar eax, 8
cdqe
and rax, 0xff
movzx eax, al
cmp eax, 0xc0
jg 0x1401b8a7d
mov eax, dword [rsp + 0x34]
shr eax, 0x10
mov eax, eax
and rax, 0xff
movzx eax, al
cmp eax, 0xc0
jg 0x1401b8a7d
mov dword [rsp + 0x30], 3
jmp 0x1401b8a85
mov dword [rsp + 0x30], 0
jmp 0x1401b8b20
mov rax, qword [rsp + 0x70]
cmp dword [rax + 0x1c], 0xffffffff
jne 0x1401b8abb
cmp dword [rsp + 0x80], 0
je 0x1401b8aa9
mov dword [rsp + 0x44], 3
jmp 0x1401b8ab1
mov dword [rsp + 0x44], 0
mov eax, dword [rsp + 0x44]
mov dword [rsp + 0x30], eax
jmp 0x1401b8b20
mov rax, qword [rsp + 0x70]
mov eax, dword [rax + 0x1c]
and rax, 0xff
movzx eax, al
cmp eax, 0xc0
jle 0x1401b8b18
mov rax, qword [rsp + 0x70]
movzx eax, word [rax + 0x1c]
sar eax, 8
cdqe
and rax, 0xff
movzx eax, al
cmp eax, 0xc0
jle 0x1401b8b18
mov rax, qword [rsp + 0x70]
mov eax, dword [rax + 0x1c]
shr eax, 0x10
mov eax, eax
and rax, 0xff
movzx eax, al
cmp eax, 0xc0
jle 0x1401b8b18
mov dword [rsp + 0x30], 3
jmp 0x1401b8b20
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x3c], 0
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x30]
lea r8, [rsp + 0x90]
mov edx, dword [rsp + 0x78]
mov rcx, qword [rsp + 0x68]
call fcn.140207220
add rsp, 0x58
ret
Function at 0x1401c23b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
cmp qword [rsp + 0x60], 0
jne 0x1401c23ea
lea rcx, [0x1404f92a8]
call qword [sym.imp.mfc90u.dll_CDumpContext::operator___1]
mov rdx, rax
mov rcx, qword [rsp + 0x58]
call sub.mfc90u.dll_AfxCriticalNewHandler
mov qword [rsp + 0x60], rax
lea rcx, [0x1404f92a8]
call qword [sym.imp.mfc90u.dll_CDumpContext::operator___1]
mov r8, rax
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jne 0x1401c241b
xor eax, eax
jmp 0x1401c2498
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x1401c243c
xor eax, eax
jmp 0x1401c2498
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x1401c2463
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_FreeResource]
xor eax, eax
jmp 0x1401c2498
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r8d, eax
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x50]
call fcn.1401c39d0
mov dword [rsp + 0x20], eax
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [rsp + 0x20]
add rsp, 0x48
ret
Function at 0x1401f0de0
Capabilities:
Get keyboard layout
Log keystrokes
Log keystrokes via polling

Disassembly:
mov dword [rsp + 8], ecx
push rbx
sub rsp, 0x170
mov rax, qword [0x1404f5550]
xor rax, rsp
mov qword [rsp + 0x160], rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_GetKeyboardState]
mov r8d, 4
xor edx, edx
lea rcx, [rsp + reloc.mfc90u.dll_CColorDialog::CColorDialog]
call sub.MSVCR90.dll_memset
call sub.mfc90u.dll_AfxFormatString1
mov ecx, dword [rax + 0x60]
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
mov rbx, rax
xor edx, edx
mov ecx, dword [rsp + 0x180]
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 2
lea r9, [rsp + reloc.mfc90u.dll_CColorDialog::CColorDialog]
lea r8, [rsp + 0x50]
mov edx, eax
mov ecx, dword [rsp + 0x180]
call qword [sym.imp.USER32.dll_ToUnicodeEx]
mov dword [rsp + reloc.mfc90u.dll_CChevronOwnerDrawMenu::CChevronOwnerDrawMenu], eax
cmp dword [rsp + reloc.mfc90u.dll_CChevronOwnerDrawMenu::CChevronOwnerDrawMenu], 0
jle 0x1401f0e8d
mov dword [rsp + 0x158], 1
jmp 0x1401f0e98
mov dword [rsp + 0x158], 0
mov eax, dword [rsp + 0x158]
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1403c2380
add rsp, 0x170
pop rbx
ret

Function at 0x1401f0ec0
Capabilities:
Get keyboard layout
Log keystrokes
Log keystrokes via polling

Disassembly:
mov dword [rsp + 8], ecx
push rbx
sub rsp, 0x160
mov rax, qword [0x1404f5550]
xor rax, rsp
mov qword [rsp + 0x158], rax
cmp dword [rsp + 0x170], 0x60
jb 0x1401f0f07
cmp dword [rsp + 0x170], 0x69
ja 0x1401f0f07
mov ecx, send
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x1401f0f67
cmp dword [0x1404f7e58], 0
jne 0x1401f0f67
cmp dword [rsp + 0x170], 0x41
jb 0x1401f0f24
cmp dword [rsp + 0x170], 0x5a
jbe 0x1401f0f5b
mov ecx, send
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x1401f0f47
mov eax, dword [rsp + 0x170]
jmp 0x1401f0fee
mov ecx, dword [rsp + 0x170]
call qword [sym.imp.MSVCR90.dll_toupper]
jmp 0x1401f0fee
mov eax, dword [rsp + 0x170]
jmp 0x1401f0fee
mov r8d, 4
xor edx, edx
lea rcx, [rsp + reloc.mfc90u.dll_CChevronOwnerDrawMenu::CChevronOwnerDrawMenu]
call sub.MSVCR90.dll_memset
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_GetKeyboardState]
call sub.mfc90u.dll_AfxFormatString1
mov ecx, dword [rax + 0x60]
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
mov rbx, rax
xor edx, edx
mov ecx, dword [rsp + 0x170]
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 2
lea r9, [rsp + reloc.mfc90u.dll_CChevronOwnerDrawMenu::CChevronOwnerDrawMenu]
lea r8, [rsp + 0x50]
mov edx, eax
mov ecx, dword [rsp + 0x170]
call qword [sym.imp.USER32.dll_ToUnicodeEx]
lea rcx, [rsp + reloc.mfc90u.dll_CChevronOwnerDrawMenu::CChevronOwnerDrawMenu]
call qword [sym.imp.USER32.dll_CharUpperW]
movzx eax, word [rsp + reloc.mfc90u.dll_CChevronOwnerDrawMenu::CChevronOwnerDrawMenu]
mov rcx, qword [rsp + 0x158]
xor rcx, rsp
call fcn.1403c2380
add rsp, 0x160
pop rbx
ret
Function at 0x1401ffad0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx + 0x18]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x30], eax
mov rcx, qword [rsp + 0x50]
mov eax, dword [rsp + 0x30]
mov dword [rcx + 8], eax
mov rax, qword [rsp + 0x50]
mov dword [rax + 0x10], 0
mov rax, qword [rsp + 0x50]
mov dword [rax + 0xc], 0
cmp dword [rsp + 0x30], 0
jne 0x1401ffb40
mov eax, 1
jmp 0x1401ffb42
xor eax, eax
add rsp, 0x48
ret

Function at 0x1401fff00
Capabilities:
Set registry value

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [rsp + 0x50]
cmp dword [rax + 0x30], 0
je 0x1401fff22
xor eax, eax
jmp 0x1401fff91
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x34], eax
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x34]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx + 0x18]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rsp + 0x30], eax
mov rcx, qword [rsp + 0x50]
mov eax, dword [rsp + 0x30]
mov dword [rcx + 8], eax
mov rax, qword [rsp + 0x50]
mov dword [rax + 0x10], 4
mov rax, qword [rsp + 0x50]
mov dword [rax + 0xc], 4
cmp dword [rsp + 0x30], 0
jne 0x1401fff8f
mov eax, 1
jmp 0x1401fff91
xor eax, eax
add rsp, 0x48
ret

Function at 0x1401fffa0
Capabilities:
Set registry value

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [rsp + 0x50]
cmp dword [rax + 0x30], 0
je 0x1401fffc2
xor eax, eax
jmp 0x140200005
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx + 0x18]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jne 0x140200003
mov eax, 1
jmp 0x140200005
xor eax, eax
add rsp, 0x48
ret

Function at 0x140200010
Capabilities:
Set registry value

Disassembly:
movsd qword [rsp + 0x18], xmm2
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [rsp + 0x50]
cmp dword [rax + 0x30], 0
je 0x140200033
xor eax, eax
jmp 0x140200076
mov dword [rsp + 0x28], 8
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 3
xor r8d, r8d
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx + 0x18]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jne 0x140200074
mov eax, 1
jmp 0x140200076
xor eax, eax
add rsp, 0x48
ret
Function at 0x140200080
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [rsp + 0x50]
cmp dword [rax + 0x30], 0
je 0x1402000a5
xor eax, eax
jmp 0x140200128
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.MSVCR90.dll_wcslen]
add rax, 1
mov eax, eax
shl rax, 1
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx + 0x18]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rsp + 0x30], eax
mov rcx, qword [rsp + 0x50]
mov eax, dword [rsp + 0x30]
mov dword [rcx + 8], eax
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.MSVCR90.dll_wcslen]
mov ecx, eax
add ecx, 1
mov rax, qword [rsp + 0x50]
mov dword [rax + 0x10], ecx
mov rax, qword [rsp + 0x50]
mov dword [rax + 0xc], 1
cmp dword [rsp + 0x30], 0
jne 0x140200126
mov eax, 1
jmp 0x140200128
xor eax, eax
add rsp, 0x48
ret
Function at 0x1402007a0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x158
mov qword [rsp + 0x140], 0xfffffffffffffffe
mov rax, qword [rsp + 0x160]
cmp dword [rax + 0x30], 0
je 0x1402007d7
xor eax, eax
jmp 0x140200a2f
mov dword [rsp + 0x38], shutdown
lea rcx, [rsp + 0x100]
call fcn.1403c18ae
nop
mov edx, 2
mov ecx, shutdown
call qword [sym.imp.MSVCR90.dll_calloc]
mov qword [rsp + 0x30], rax
mov r8, 0xffffffffffffffff
mov edx, 5
lea rcx, [rsp + 0x100]
call sub.mfc90u.dll_CEditView::SerializeRaw
mov rax, qword [rsp + 0x170]
mov rax, qword [rax]
mov eax, dword [rax]
mov dword [rsp + 0x138], eax
xor eax, eax
test rax, rax
jg 0x140200841
cmp qword [rsp + 0x110], 0
jg 0x140200846
call sub.mfc90u.dll_AfxOleUnregisterServerClass
xor edx, edx
imul rdx, rdx, 4
mov rcx, qword [rsp + 0x108]
mov eax, dword [rsp + 0x138]
mov dword [rdx + rcx], eax
mov rax, qword [rsp + 0x170]
mov rax, qword [rax]
mov eax, dword [rax + 4]
mov dword [rsp + 0x13c], eax
xor eax, eax
cmp rax, 1
jg 0x140200886
cmp qword [rsp + 0x110], 1
jg 0x14020088b
call sub.mfc90u.dll_AfxOleUnregisterServerClass
mov edx, 1
imul rdx, rdx, 4
mov rcx, qword [rsp + 0x108]
mov eax, dword [rsp + 0x13c]
mov dword [rdx + rcx], eax
mov r9d, reloc.WS2_32.dll_recv
mov r8d, shutdown
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0xb0]
call fcn.1403c142e
nop
mov qword [rsp + 0x20], 0
mov r9d, reloc.mfc90u.dll_CDaoTableDef::GetValidationRule
xor r8d, r8d
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x40]
call sub.mfc90u.dll_AFX_MODULE_THREAD_STATE::AFX_MODULE_THREAD_STATE
nop
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x100]
call sub.mfc90u.dll_CRecordset::RebindParams
lea rcx, [rsp + 0x40]
call sub.mfc90u.dll_COleServerDoc::CanCloseFrame
lea rcx, [rsp + 0xb0]
call sub.mfc90u.dll_CDHtmlDialog::GetExternal
mov dword [rsp + 0x12c], eax
lea rcx, [rsp + 0xb0]
call sub.mfc90u.dll_DDX_LBString
mov r11, rax
mov eax, dword [rsp + 0x12c]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r11
mov r9d, 3
xor r8d, r8d
mov rdx, qword [rsp + 0x168]
mov rcx, qword [rsp + 0x160]
mov rcx, qword [rcx + 0x18]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rsp + 0x128], eax
mov rcx, qword [rsp + 0x160]
mov eax, dword [rsp + 0x128]
mov dword [rcx + 8], eax
mov rcx, qword [rsp + 0x160]
mov eax, dword [rsp + 0x12c]
mov dword [rcx + 0x10], eax
mov rax, qword [rsp + 0x160]
mov dword [rax + 0xc], 2
cmp qword [rsp + 0x30], 0
je 0x1402009b3
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.MSVCR90.dll_free]
mov qword [rsp + 0x30], 0
cmp dword [rsp + 0x128], 0
jne 0x1402009f7
mov dword [rsp + 0x130], 1
lea rcx, [rsp + 0x40]
call sub.mfc90u.dll_CWnd::CWnd
nop
lea rcx, [rsp + 0xb0]
call sub.mfc90u.dll_CHtmlEditCtrl::CHtmlEditCtrl
nop
lea rcx, [rsp + 0x100]
call sub.mfc90u.dll_CDaoWorkspace::CDaoWorkspace
mov eax, dword [rsp + 0x130]
jmp 0x140200a2f
mov dword [rsp + 0x134], 0
lea rcx, [rsp + 0x40]
call sub.mfc90u.dll_CWnd::CWnd
nop
lea rcx, [rsp + 0xb0]
call sub.mfc90u.dll_CHtmlEditCtrl::CHtmlEditCtrl
nop
lea rcx, [rsp + 0x100]
call sub.mfc90u.dll_CDaoWorkspace::CDaoWorkspace
mov eax, dword [rsp + 0x134]
add rsp, 0x158
ret