joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5fe560
Capabilities:
Get graphical window text

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x40
mov rbp, rsp
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x38], 0
nop
mov rcx, qword [rbp + 0x28]
call fcn.0040fd60
mov rax, qword [rbp + 0x20]
cmp qword [rax + 0x508], 0
je 0x5fe5e8
mov rcx, qword [rbp + 0x20]
call fcn.005fe620
lea rcx, [rbp + 0x38]
mov edx, eax
add edx, 1
call fcn.00411620
xor ebx, ebx
mov rax, qword [rbp + 0x38]
test rax, rax
je 0x5fe5b7
mov ebx, dword [rax - 4]
mov rcx, qword [rbp + 0x38]
call fcn.00411370
mov rsi, rax
mov rax, qword [rbp + 0x20]
mov rcx, qword [rax + 0x508]
mov rdx, rsi
mov r8d, ebx
call sub.user32.dll_GetWindowTextW
mov rcx, qword [rbp + 0x28]
mov rdx, rsi
mov r8d, eax
call fcn.00410020
nop
lea rcx, [rbp + 0x38]
call fcn.0040fd60
mov rax, qword [rbp + 0x28]
lea rsp, [rbp + 0x40]
pop rbx
pop rsi
pop rbp
ret

Function at 0x61e5d0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push rbp
sub rsp, 0x50
mov rbp, rsp
mov qword [rbp + 0x28], rbp
mov qword [rbp + 0x60], rcx
mov qword [rbp + 0x68], rdx
mov rcx, qword [rbp + 0x68]
call fcn.0040fef0
nop
xor ecx, ecx
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x61e6be
nop
mov dword [rbp + 0x3c], 0
mov rax, qword [rbp + 0x68]
mov qword [rbp + 0x20], rax
test rax, rax
je 0x61e61c
mov rax, qword [rbp + 0x20]
mov eax, dword [rax - 4]
mov dword [rbp + 0x3c], eax
mov ecx, 0x2002
mov edx, dword [rbp + 0x3c]
add edx, edx
add edx, 2
movsxd rdx, edx
call sub.kernel32.dll_GlobalAlloc
mov qword [rbp + 0x48], rax
nop
mov rcx, qword [rbp + 0x48]
call sub.kernel32.dll_GlobalLock
mov qword [rbp + 0x40], rax
nop
mov dword [rbp + 0x38], 0
mov rax, qword [rbp + 0x20]
test rax, rax
je 0x61e65e
mov rax, qword [rbp + 0x20]
mov eax, dword [rax - 4]
mov dword [rbp + 0x38], eax
mov rcx, qword [rbp + 0x68]
call fcn.00411370
mov rcx, rax
mov rdx, qword [rbp + 0x40]
mov r8d, dword [rbp + 0x38]
add r8d, r8d
add r8d, 2
movsxd r8, r8d
call fcn.004095a0
call sub.user32.dll_EmptyClipboard
mov ecx, 0xd
mov rdx, qword [rbp + 0x48]
call sub.user32.dll_SetClipboardData
nop
mov rcx, qword [rbp + 0x48]
call sub.kernel32.dll_GlobalUnlock
jmp 0x61e6b6
nop
call sub.user32.dll_CloseClipboard
jmp 0x61e6db
mov rcx, qword [0x00428000]
mov dl, 1
mov r8, qword [0x007db808]
call fcn.0043c3c0
mov rcx, rax
call fcn.0040f030
nop
lea rcx, [rbp + 0x68]
call fcn.0040fd60
lea rsp, [rbp + 0x50]
pop rbp
ret

Function at 0x629f50
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x20
movzx rbx, word [0x00629fa0]
mov ecx, 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x629f70
or bx, 1
mov ecx, 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x629f83
or bx, 4
mov ecx, 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x629f96
or bx, 2
mov eax, ebx
add rsp, 0x20
pop rbx
ret
Function at 0x654e60
Capabilities:
Get graphical window text

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rsi, rdx
mov rcx, rsi
mov edx, 0xe
xor r8, r8
xor r9, r9
call sub.user32.dll_SendMessageW
mov rdi, rax
mov rcx, rbx
xor edx, edx
mov r8d, edi
call fcn.00410020
test edi, edi
je 0x654ed5
mov rcx, qword [rbx]
call fcn.00411370
mov rcx, rsi
mov edx, 0xd
mov r8d, edi
add r8d, 1
movsxd r8, r8d
mov r9, rax
call sub.user32.dll_SendMessageW
sub edi, eax
test edi, edi
jle 0x654ed5
xor eax, eax
mov rcx, qword [rbx]
test rcx, rcx
je 0x654ec9
mov eax, dword [rcx - 4]
mov rcx, rbx
mov edx, eax
sub edx, edi
call fcn.00411620
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret

Function at 0x69daf0
Capabilities:
Get keyboard layout

Disassembly:
push rbp
add rsp, 0xffffffffffffff80
mov rbp, rsp
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x28], 0
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x38], rbp
mov qword [rbp + 0x90], rcx
nop
mov byte [0x007ca060], 0
mov word [rbp + 0x54], 0
lea rcx, [rbp + 0x54]
call sub.user32.dll_GetKeyboardLayoutNameW
mov rcx, qword [0x0053e3b0]
mov dl, 1
call fcn.0053f990
mov qword [rbp + 0x70], rax
nop
mov rcx, qword [rbp + 0x70]
mov rdx, 0xffffffff80000002
call fcn.0053fb90
lea rcx, [rbp + 0x28]
lea rdx, [rbp + 0x54]
mov r8d, 0xa
call fcn.00411460
lea rcx, [rbp + 0x30]
lea rdx, [0x0069dcd8]
mov r8, qword [rbp + 0x28]
call fcn.004117d0
mov rcx, qword [rbp + 0x70]
mov rdx, qword [rbp + 0x30]
call fcn.0053fe00
test al, al
je 0x69dc2a
mov rcx, qword [rbp + 0x70]
lea rdx, [rbp + 0x68]
lea r8, [0x0069dd4c]
call fcn.005403a0
mov rcx, qword [rbp + 0x68]
mov edx, 0x8000
call fcn.0043fe20
mov qword [rbp + 0x78], rax
cmp qword [rbp + 0x78], 0
je 0x69dc2a
nop
mov rcx, qword [rbp + 0x78]
lea rdx, [0x0069dd64]
call fcn.0041e4e0
mov qword [rbp + 0x40], rax
cmp qword [rbp + 0x40], 0
je 0x69dc20
call qword [rbp + 0x40]
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x48], 0
je 0x69dc20
mov rcx, qword [rbp + 0x90]
call fcn.0069da60
test eax, eax
je 0x69dc04
mov rax, qword [rbp + 0x48]
mov eax, dword [rax + 0x50]
mov dword [rbp + 0x50], eax
jmp 0x69dc0e
mov rax, qword [rbp + 0x48]
mov eax, dword [rax + 0x50]
mov dword [rbp + 0x50], eax
mov eax, dword [rbp + 0x50]
and eax, 1
cmp eax, 1
sete al
mov byte [0x007ca060], al
nop
mov rcx, qword [rbp + 0x78]
call sub.kernel32.dll_FreeLibrary
nop
mov rcx, qword [rbp + 0x70]
call fcn.0040cd20
nop
lea rcx, [rbp + 0x28]
mov edx, 2
call fcn.0040fe40
lea rcx, [rbp + 0x68]
call fcn.0040fd60
lea rsp, [rbp + 0x80]
pop rbp
ret

Function at 0x69dde0
Capabilities:
Log keystrokes via polling

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rbp, rsp
mov rsi, rcx
lea rdi, [rbp + 0x20]
movsq qword [rdi], qword [rsi]
movsq qword [rdi], qword [rsi]
movsq qword [rdi], qword [rsi]
movsq qword [rdi], qword [rsi]
movzx bx, byte [rbp + 0x28]
test bx, bx
je 0x69de3c
mov ecx, 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x69de18
add bx, 0x2000
mov ecx, 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x69de2c
add bx, 0x4000
mov eax, dword [rbp + 0x30]
test eax, 0x20000000
je 0x69de3c
add bx, 0x8000
mov eax, ebx
lea rsp, [rbp + 0x48]
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x6b03d0
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x20
movzx rbx, word [0x006b0438]
mov eax, ecx
test ax, 4
je 0x6b03ea
or bx, 1
mov eax, ecx
test ax, 8
je 0x6b03f7
or bx, 4
mov eax, ecx
test ax, 1
je 0x6b0404
or bx, 8
mov eax, ecx
test ax, 2
je 0x6b0411
or bx, 0x10
test cx, 0x10
je 0x6b041c
or bx, 0x20
mov ecx, 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x6b042f
or bx, 2
mov eax, ebx
add rsp, 0x20
pop rbx
ret

Function at 0x6b0440
Capabilities:
Log keystrokes via polling

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov ebx, ecx
movzx rsi, word [0x006b048c]
mov ecx, 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x6b0463
or si, 1
mov ecx, 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x6b0476
or si, 4
test ebx, 0x20000000
je 0x6b0482
or si, 2
mov eax, esi
add rsp, 0x28
pop rbx
pop rsi
ret
Function at 0x6be880
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push rbp
sub rsp, 0x510
mov rbp, rsp
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x58], rbp
mov qword [rbp + 0x520], rcx
nop
mov rax, qword [rbp + 0x520]
cmp qword [rax + 0x80], 0
jne 0x6bea8d
mov rcx, qword [0x00458a98]
mov dl, 1
call fcn.004915e0
mov rcx, qword [rbp + 0x520]
mov qword [rcx + 0x80], rax
mov rax, qword [rbp + 0x520]
lea rcx, [rax + 0x88]
call fcn.0040fd60
mov ecx, 0x40
lea rdx, [rbp + 0x2f0]
call sub.user32.dll_GetKeyboardLayoutList
mov dword [rbp + 0x4fc], eax
xor eax, eax
mov ecx, dword [rbp + 0x4fc]
sub ecx, 1
mov dword [rbp + 0x3c], ecx
mov dword [rbp + 0x4f8], eax
mov ecx, dword [rbp + 0x3c]
cmp dword [rbp + 0x4f8], ecx
jg 0x6bea70
mov ecx, dword [rbp + 0x3c]
sub ecx, eax
add ecx, 1
mov dword [rbp + 0x3c], ecx
lea rax, [rbp + 0x2f0]
mov qword [rbp + 0x60], rax
mov rax, qword [rbp + 0x60]
mov rcx, qword [rax]
call fcn.0059cc80
test al, al
je 0x6bea57
mov rax, qword [rbp + 0x60]
movzx eax, word [rax]
mov dword [rbp + 0x48], eax
mov byte [rbp + 0x50], 0
lea rcx, [rbp + 0x70]
lea rdx, [0x006beaf8]
lea r8, [rbp + 0x48]
xor r9, r9
call fcn.00434a30
mov rcx, 0xffffffff80000002
mov rdx, rax
xor r8, r8
mov r9d, 0x20019
lea rax, [rbp + 0x508]
mov qword [rsp + 0x20], rax
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0x6bea57
nop
mov dword [rbp + 0x4f4], 0x200
mov rcx, qword [rbp + 0x508]
lea rdx, [0x006beb66]
xor r8, r8
xor r9, r9
lea rax, [rbp + 0xf0]
mov qword [rsp + 0x20], rax
lea rax, [rbp + 0x4f4]
mov qword [rsp + 0x28], rax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x6bea4a
lea rcx, [rbp + 0x40]
lea rdx, [rbp + 0xf0]
mov r8d, pe_nt_image_headers64
call fcn.00411460
mov rax, qword [rbp + 0x520]
mov rax, qword [rax + 0x80]
mov rcx, rax
mov rdx, qword [rbp + 0x40]
mov r8, qword [rbp + 0x60]
mov r8, qword [r8]
mov rax, qword [rax]
call qword [rax + 0x80]
mov rax, qword [rbp + 0x60]
mov rcx, qword [rbp + 0x520]
mov rax, qword [rax]
cmp rax, qword [rcx + 0x90]
jne 0x6bea4a
mov rax, qword [rbp + 0x520]
lea rcx, [rax + 0x88]
lea rdx, [rbp + 0xf0]
mov r8d, pe_nt_image_headers64
call fcn.00411460
nop
mov rcx, qword [rbp + 0x508]
call sub.advapi32.dll_RegCloseKey
add qword [rbp + 0x60], 8
mov eax, dword [rbp + 0x3c]
sub eax, 1
mov dword [rbp + 0x3c], eax
mov eax, dword [rbp + 0x3c]
test eax, eax
jne 0x6be933
nop
mov rax, qword [rbp + 0x520]
mov rax, qword [rax + 0x80]
mov byte [rax + 0x49], 0
mov rcx, rax
mov dl, 1
call fcn.00491460
mov rax, qword [rbp + 0x520]
mov rax, qword [rax + 0x80]
mov qword [rbp + 0x500], rax
nop
lea rcx, [rbp + 0x40]
call fcn.0040fd60
mov rax, qword [rbp + 0x500]
lea rsp, [rbp + 0x510]
pop rbp
ret
Function at 0x6c11c0
Capabilities:
Enumerate gui resources

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, rcx
mov esi, edx
mov rax, qword [0x007e9df8]
cmp qword [rax + 0x2d0], 0
je 0x6c1384
test sil, sil
jne 0x6c12ac
cmp dword [rbx + 0x138], 0
jne 0x6c129d
mov rcx, rbx
call fcn.006c54a0
lea rcx, [0x006c1080]
mov rdx, rax
call sub.user32.dll_EnumWindows
cmp qword [rbx + 0xa8], 0
je 0x6c125f
mov rax, qword [0x007e9df8]
cmp byte [rax + 0x193], 0
je 0x6c125f
mov rax, qword [rbx + 0x1a0]
test rax, rax
je 0x6c1239
mov rax, qword [rax - 8]
lea rdi, [rax - 1]
test edi, edi
jl 0x6c125e
mov rax, qword [rbx + 0x1a0]
movsxd rcx, edi
mov rcx, qword [rax + rcx*8]
xor edx, edx
call sub.user32.dll_ShowWindow
sub edi, 1
cmp edi, 0xffffffff
jne 0x6c1241
nop
mov rax, qword [rbx + 0x130]
mov edi, dword [rax + 0x10]
sub edi, 1
test edi, edi
jl 0x6c129c
mov rcx, qword [rbx + 0x130]
mov edx, edi
call fcn.0048a200
mov rcx, rax
test sil, sil
setne al
movzx rax, al
neg eax
mov edx, eax
call sub.user32.dll_ShowOwnedPopups
sub edi, 1
cmp edi, 0xffffffff
jne 0x6c1270
nop
lea rax, [rbx + 0x138]
add dword [rax], 1
jmp 0x6c1384
cmp dword [rbx + 0x138], 0
jle 0x6c1384
lea rax, [rbx + 0x138]
sub dword [rax], 1
cmp dword [rbx + 0x138], 0
jne 0x6c1384
cmp qword [rbx + 0xa8], 0
je 0x6c1323
mov rax, qword [0x007e9df8]
cmp byte [rax + 0x193], 0
je 0x6c1323
mov rax, qword [rbx + 0x1a0]
test rax, rax
je 0x6c12fa
mov rax, qword [rax - 8]
lea rdi, [rax - 1]
test edi, edi
jl 0x6c1322
mov rax, qword [rbx + 0x1a0]
movsxd rcx, edi
mov rcx, qword [rax + rcx*8]
mov edx, 5
call sub.user32.dll_ShowWindow
sub edi, 1
cmp edi, 0xffffffff
jne 0x6c1302
nop
mov rax, qword [rbx + 0x130]
mov edi, dword [rax + 0x10]
sub edi, 1
test edi, edi
jl 0x6c1360
mov rcx, qword [rbx + 0x130]
mov edx, edi
call fcn.0048a200
mov rcx, rax
test sil, sil
setne al
movzx rax, al
neg eax
mov edx, eax
call sub.user32.dll_ShowOwnedPopups
sub edi, 1
cmp edi, 0xffffffff
jne 0x6c1334
nop
mov rax, qword [rbx + 0x130]
mov rcx, rax
mov rsi, qword [rax]
call qword [rsi + 0x10]
lea rcx, [rbx + 0x1a0]
mov rdx, qword [0x006ab1b0]
call fcn.004143f0
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret

Function at 0x6c25d0
Capabilities:
Get graphical window text

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x220
mov rbp, rsp
mov rbx, rcx
mov rsi, rdx
cmp byte [rbx + 0x158], 0
je 0x6c263c
cmp byte [rbx + 0x193], 0
jne 0x6c263c
mov rcx, qword [rbx + 0x2d0]
lea rdx, [rbp + 0x20]
mov r8d, pe_nt_image_headers64
call sub.user32.dll_GetWindowTextW
mov rcx, rsi
lea rdx, [rbp + 0x20]
mov r8d, eax
call fcn.00410020
xor eax, eax
mov rcx, qword [rsi]
test rcx, rcx
je 0x6c2627
mov eax, dword [rcx - 4]
test eax, eax
jne 0x6c264b
mov rcx, rsi
mov rdx, qword [rbx + 0x118]
call fcn.00410390
jmp 0x6c264b
mov rcx, rsi
mov rdx, qword [rbx + 0x118]
call fcn.00410390
mov rax, rsi
lea rsp, [rbp + 0x220]
pop rbx
pop rsi
pop rbp
ret
Function at 0x6c5890
Capabilities:
Hide graphical window from taskbar

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, rcx
mov esi, edx
cmp sil, byte [rbx + 0x193]
je 0x6c5a55
mov byte [rbx + 0x193], sil
mov rax, qword [rbx + 0xa8]
test rax, rax
je 0x6c59bd
mov rcx, rax
call fcn.00593030
test al, al
je 0x6c59bd
mov rax, qword [rbx + 0xa8]
movzx rax, word [rax + 0x34]
test ax, 0x10
jne 0x6c59bd
mov rax, qword [rbx + 0xa8]
movzx rax, word [rax + 0x34]
test ax, 2
jne 0x6c59bd
test sil, sil
je 0x6c593c
mov rcx, qword [rbx + 0x2d0]
xor edx, edx
xor r8, r8
call fcn.006afdc0
mov rcx, qword [rbx + 0xa8]
call fcn.00592a80
mov rcx, rax
mov dl, 1
mov rax, qword [rbx + 0xa8]
movzx r8, byte [rax + 0xa9]
call fcn.006afdc0
jmp 0x6c59a6
call sub.user32.dll_GetForegroundWindow
mov rdi, rax
mov rcx, qword [rbx + 0xa8]
call fcn.00592a80
cmp rdi, rax
sete dil
mov rcx, qword [rbx + 0xa8]
call fcn.00592a80
mov rcx, rax
xor edx, edx
mov rax, qword [rbx + 0xa8]
movzx r8, byte [rax + 0xa9]
call fcn.006afdc0
mov rcx, qword [rbx + 0x2d0]
mov dl, 1
mov r8b, 1
call fcn.006afdc0
test dil, dil
je 0x6c59a6
mov rcx, qword [rbx + 0xa8]
call fcn.00592a80
mov rcx, rax
call sub.user32.dll_SetForegroundWindow
mov rcx, qword [rbx + 0xa8]
mov edx, 0xb033
xor r8, r8
xor r9, r9
call fcn.005867c0
test sil, sil
je 0x6c5a03
mov rcx, qword [rbx + 0x2d0]
mov rax, rcx
mov rsi, rcx
mov rcx, rax
mov edx, 0xffffffec
call sub.user32.dll_GetWindowLongPtrW
or rax, 0x80
mov rcx, rsi
mov edx, 0xffffffec
mov r8, rax
call sub.user32.dll_SetWindowLongPtrW
mov rcx, qword [rbx + 0x2d0]
xor edx, edx
call sub.user32.dll_SetWindowTextW
jmp 0x6c5a55
mov rcx, qword [rbx + 0x2d0]
mov rax, rcx
mov rsi, rcx
mov rcx, rax
mov edx, 0xffffffec
call sub.user32.dll_GetWindowLongPtrW
and rax, 0xffffffffffffff7f
mov rcx, rsi
mov edx, 0xffffffec
mov r8, rax
call sub.user32.dll_SetWindowLongPtrW
mov rsi, qword [rbx + 0x2d0]
mov rax, qword [rbx + 0x118]
mov rcx, rax
call fcn.00411370
mov rcx, rsi
mov rdx, rax
call sub.user32.dll_SetWindowTextW
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
Function at 0x6d0b20
Capabilities:
Hide graphical window

Disassembly:
push r13
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
cmp qword [rbx + 0xc8], 0
jne 0x6d0bdb
mov rcx, qword [rbx + 0x10]
call fcn.00592a80
mov rcx, qword [0x005b12c0]
mov dl, 1
mov r8, rax
call fcn.005899c0
mov qword [rbx + 0xc8], rax
mov rsi, qword [rbx + 0xc8]
mov rcx, rsi
xor edx, edx
call fcn.005c6200
lea rax, [rsi + 0x4d0]
mov qword [rax + 8], rbx
lea rcx, [0x006d01a0]
mov qword [rax], rcx
mov rcx, qword [rbx + 0xc8]
call fcn.00592a80
mov rdi, rax
mov rcx, rsi
mov edx, 3
mov rax, qword [rsi]
call qword [rax + 0x1b8]
mov rcx, rdi
xor edx, edx
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x30], 8
call sub.user32.dll_SetWindowPos
mov rcx, qword [rbx + 0xc8]
call fcn.00592a80
mov rcx, rax
xor edx, edx
call sub.user32.dll_ShowWindow
cmp qword [rbx + 0xe8], 0
jne 0x6d0c8a
mov rcx, qword [rbx + 0x10]
call fcn.00592a80
mov rcx, qword [0x005b12c0]
mov dl, 1
mov r8, rax
call fcn.005899c0
mov qword [rbx + 0xe8], rax
mov rsi, qword [rbx + 0xe8]
mov rcx, rsi
mov dl, 1
call fcn.005c6200
lea rax, [rsi + 0x4d0]
mov qword [rax + 8], rbx
lea rcx, [0x006d0200]
mov qword [rax], rcx
mov rcx, qword [rbx + 0xe8]
call fcn.00592a80
mov rdi, rax
mov rcx, rsi
mov edx, 2
mov rax, qword [rsi]
call qword [rax + 0x1b8]
mov rcx, rdi
xor edx, edx
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x30], 8
call sub.user32.dll_SetWindowPos
mov rcx, qword [rbx + 0xe8]
call fcn.00592a80
mov rcx, rax
xor edx, edx
call sub.user32.dll_ShowWindow
cmp qword [rbx + 0xd8], 0
jne 0x6d0d32
mov rcx, qword [rbx + 0x10]
call fcn.00592a80
mov rcx, qword [0x005b2348]
mov dl, 1
mov r8, rax
call fcn.005899c0
mov qword [rbx + 0xd8], rax
mov rsi, qword [rbx + 0xd8]
mov byte [rsi + 0x4a0], 1
mov rcx, qword [rbx + 0xd8]
call fcn.00592a80
mov rdi, rax
mov rcx, rsi
mov edx, 2
mov rax, qword [rsi]
call qword [rax + 0x1b8]
mov r13d, eax
mov rcx, rsi
mov edx, 3
mov rax, qword [rsi]
call qword [rax + 0x1b8]
mov rcx, rdi
xor edx, edx
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], r13d
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x30], 8
call sub.user32.dll_SetWindowPos
mov rcx, qword [rbx + 0xd8]
call fcn.00592a80
mov rcx, rax
xor edx, edx
call sub.user32.dll_ShowWindow
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop r13
ret
Function at 0x6e0cd0
Capabilities:
Check for software breakpoints

Disassembly:
push rbp
push rsi
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov rsi, rcx
mov eax, dword [rsi + 0x24]
cmp eax, 0xcc
je 0x6e0da6
cmp eax, 0xcb
je 0x6e0d37
cmp eax, 0xca
jne 0x6e0d19
mov rcx, rsi
call fcn.006e1490
cmp dword [rsi + 0x58], 0
je 0x6e0d30
mov dword [rsi + 0x24], 0xcf
mov eax, 1
jmp 0x6e0db3
mov rcx, qword [rsi]
mov dword [rcx + 0x28], 0x14
mov dword [rcx + 0x2c], eax
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax]
jmp 0x6e0da6
mov dword [rsi + 0x24], 0xcb
mov rax, qword [rsi + 0x240]
cmp dword [rax + 0x20], 0
je 0x6e0d9a
mov rdx, qword [rsi + 0x10]
jmp 0x6e0d59
add eax, dword [rsi + 0x1a4]
mov dword [rdx + 0xc], eax
test rdx, rdx
je 0x6e0d63
mov rcx, rsi
call qword [rdx]
mov rax, qword [rsi + 0x240]
mov rcx, rsi
call qword [rax]
test eax, eax
je 0x6e0db1
cmp eax, 2
je 0x6e0d9a
mov rdx, qword [rsi + 0x10]
or eax, 2
cmp eax, 3
jne 0x6e0d59
test rdx, rdx
je 0x6e0d59
mov ecx, dword [rdx + 8]
mov eax, dword [rdx + 0xc]
inc ecx
mov dword [rdx + 8], ecx
cmp ecx, eax
jl 0x6e0d59
jmp 0x6e0d50
mov eax, dword [rsi + 0xac]
mov dword [rsi + 0xb4], eax
mov rcx, rsi
add rsp, 0x28
pop rsi
pop rbp
jmp 0x6e0dc0
xor eax, eax
add rsp, 0x28
pop rsi
pop rbp
ret
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov rsi, rcx
cmp dword [rsi + 0x24], 0xcc
je 0x6e0df8
mov rax, qword [rsi + 0x220]
mov rcx, rsi
call qword [rax]
mov dword [rsi + 0xa8], 0
mov dword [rsi + 0x24], 0xcc
mov rdx, qword [rsi + 0x220]
cmp dword [rdx + 0x10], 0
je 0x6e0e9d
lea r14, [rsi + 0xa8]
mov eax, dword [rsi + 0xa8]
mov ecx, dword [rsi + 0x8c]
cmp eax, ecx
jae 0x6e0e6e
mov rdx, qword [rsi + 0x10]
test rdx, rdx
je 0x6e0e3a
mov dword [rdx + 8], eax
mov dword [rdx + 0xc], ecx
mov rcx, rsi
call qword [rdx]
mov eax, dword [rsi + 0xa8]
mov edi, eax
mov rax, qword [rsi + 0x228]
xor ebx, ebx
xor edx, edx
xor r9d, r9d
mov rcx, rsi
mov r8, r14
call qword [rax + 8]
mov eax, dword [rsi + 0xa8]
cmp eax, edi
je 0x6e0eb1
mov ecx, dword [rsi + 0x8c]
cmp eax, ecx
jb 0x6e0e20
mov rdx, qword [rsi + 0x220]
mov rcx, rsi
call qword [rdx + 8]
mov rax, qword [rsi + 0x220]
mov rcx, rsi
call qword [rax]
mov dword [rsi + 0xa8], 0
mov rdx, qword [rsi + 0x220]
xor eax, eax
cmp dword [rdx + 0x10], 0
jne 0x6e0e16
cmp dword [rsi + 0x5c], 1
mov eax, 0xce
sbb eax, 0
mov dword [rsi + 0x24], eax
mov ebx, 1
mov eax, ebx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
Function at 0x6e0dc0
Capabilities:
Check for software breakpoints

Disassembly:
push rbp
push rsi
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov rsi, rcx
mov eax, dword [rsi + 0x24]
cmp eax, 0xcc
je 0x6e0da6
cmp eax, 0xcb
je 0x6e0d37
cmp eax, 0xca
jne 0x6e0d19
mov rcx, rsi
call fcn.006e1490
cmp dword [rsi + 0x58], 0
je 0x6e0d30
mov dword [rsi + 0x24], 0xcf
mov eax, 1
jmp 0x6e0db3
mov rcx, qword [rsi]
mov dword [rcx + 0x28], 0x14
mov dword [rcx + 0x2c], eax
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax]
jmp 0x6e0da6
mov dword [rsi + 0x24], 0xcb
mov rax, qword [rsi + 0x240]
cmp dword [rax + 0x20], 0
je 0x6e0d9a
mov rdx, qword [rsi + 0x10]
jmp 0x6e0d59
add eax, dword [rsi + 0x1a4]
mov dword [rdx + 0xc], eax
test rdx, rdx
je 0x6e0d63
mov rcx, rsi
call qword [rdx]
mov rax, qword [rsi + 0x240]
mov rcx, rsi
call qword [rax]
test eax, eax
je 0x6e0db1
cmp eax, 2
je 0x6e0d9a
mov rdx, qword [rsi + 0x10]
or eax, 2
cmp eax, 3
jne 0x6e0d59
test rdx, rdx
je 0x6e0d59
mov ecx, dword [rdx + 8]
mov eax, dword [rdx + 0xc]
inc ecx
mov dword [rdx + 8], ecx
cmp ecx, eax
jl 0x6e0d59
jmp 0x6e0d50
mov eax, dword [rsi + 0xac]
mov dword [rsi + 0xb4], eax
mov rcx, rsi
add rsp, 0x28
pop rsi
pop rbp
jmp 0x6e0dc0
xor eax, eax
add rsp, 0x28
pop rsi
pop rbp
ret
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov rsi, rcx
cmp dword [rsi + 0x24], 0xcc
je 0x6e0df8
mov rax, qword [rsi + 0x220]
mov rcx, rsi
call qword [rax]
mov dword [rsi + 0xa8], 0
mov dword [rsi + 0x24], 0xcc
mov rdx, qword [rsi + 0x220]
cmp dword [rdx + 0x10], 0
je 0x6e0e9d
lea r14, [rsi + 0xa8]
mov eax, dword [rsi + 0xa8]
mov ecx, dword [rsi + 0x8c]
cmp eax, ecx
jae 0x6e0e6e
mov rdx, qword [rsi + 0x10]
test rdx, rdx
je 0x6e0e3a
mov dword [rdx + 8], eax
mov dword [rdx + 0xc], ecx
mov rcx, rsi
call qword [rdx]
mov eax, dword [rsi + 0xa8]
mov edi, eax
mov rax, qword [rsi + 0x228]
xor ebx, ebx
xor edx, edx
xor r9d, r9d
mov rcx, rsi
mov r8, r14
call qword [rax + 8]
mov eax, dword [rsi + 0xa8]
cmp eax, edi
je 0x6e0eb1
mov ecx, dword [rsi + 0x8c]
cmp eax, ecx
jb 0x6e0e20
mov rdx, qword [rsi + 0x220]
mov rcx, rsi
call qword [rdx + 8]
mov rax, qword [rsi + 0x220]
mov rcx, rsi
call qword [rax]
mov dword [rsi + 0xa8], 0
mov rdx, qword [rsi + 0x220]
xor eax, eax
cmp dword [rdx + 0x10], 0
jne 0x6e0e16
cmp dword [rsi + 0x5c], 1
mov eax, 0xce
sbb eax, 0
mov dword [rsi + 0x24], eax
mov ebx, 1
mov eax, ebx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret

Function at 0x6e1030
Capabilities:
Check for software breakpoints

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov edi, edx
mov rsi, rcx
mov eax, dword [rsi + 0x24]
cmp eax, 0xcc
je 0x6e1067
cmp eax, 0xcf
je 0x6e1067
mov rcx, qword [rsi]
mov dword [rcx + 0x28], 0x14
mov dword [rcx + 0x2c], eax
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax]
test edi, edi
mov eax, 1
cmovg eax, edi
mov rcx, qword [rsi + 0x240]
cmp dword [rcx + 0x24], 0
je 0x6e1089
mov ecx, dword [rsi + 0xac]
cmp eax, ecx
cmovg eax, ecx
mov dword [rsi + 0xb4], eax
mov rcx, rsi
add rsp, 0x20
pop rdi
pop rsi
pop rbp
jmp 0x6e0dc0