joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400dec70
Capabilities:
Accept command line arguments

Disassembly:
push rbx
sub rsp, 0x40
mov rbx, rdx
lea rcx, [rsp + 0x20]
call fcn.140114b80
nop
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.14010f2cc
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov r8, rax
mov edx, 0x5e4
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
mov dl, 1
mov rcx, qword [0x14021c5d8]
call fcn.140024d60
mov rcx, qword [0x14021c5d8]
call fcn.140025410
mov rcx, rbx
call fcn.1400deb34
nop
lea rcx, [rsp + 0x20]
call fcn.140114c28
xor eax, eax
add rsp, 0x40
pop rbx
ret
Function at 0x1400e0ca4
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
lea rdx, str.SoftwareClassesDirectoryBackground_shell
mov r8, rcx
mov rdi, 0xffffffff80000001
mov rcx, rdi
call fcn.140132628
mov r8, rbx
lea rdx, str.SoftwareClassesDirectory_shell
mov rcx, rdi
call fcn.140132628
mov r8, rbx
lea rdx, str.SoftwareClassesDrive_shell
mov rcx, rdi
call fcn.140132628
mov r8, rbx
lea rdx, str.SoftwareClasses_shell
mov rcx, rdi
call fcn.140132628
mov r8, rbx
lea rdx, str.SoftwareClassesLibraryFolderBackground_shell
mov rcx, rdi
call fcn.140132628
mov r8, rbx
lea rdx, str.SoftwareClassesLibraryFolder_shell
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.140132628
Function at 0x1400e6638
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
movzx r9d, r8w
mov ebx, 0x845
mov rbp, rdx
mov rdi, rcx
sub r9d, ebx
je 0x1400e667b
sub r9d, 1
je 0x1400e667b
cmp r9d, 0xcc
jne 0x1400e67f8
cmp byte [rcx + 0x41], 0
jne 0x1400e67f8
mov r8b, 1
mov edx, 0x844
mov rcx, rbp
call fcn.1400d45a8
mov r14d, eax
test eax, eax
js 0x1400e67f8
mov edx, ebx
mov rcx, rbp
call qword [sym.imp.USER32.dll_GetDlgItem]
mov edx, 0x912
mov rcx, rbp
mov r12, rax
call qword [sym.imp.USER32.dll_GetDlgItem]
mov edx, 0x846
mov rcx, rbp
mov r13, rax
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, r12
mov qword [rsp + 0x40], rax
mov rbx, rax
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
cdqe
mov esi, 2
mov edx, esi
mov qword [rsp + 0x98], rax
lea rcx, [rax + 1]
call fcn.14012005c
mov rcx, r13
mov r15, rax
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
cdqe
mov edx, esi
mov qword [rsp + 0x30], rax
lea rcx, [rax + 1]
call fcn.14012005c
mov rcx, rbx
mov rsi, rax
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
cdqe
mov edx, 2
mov qword [rsp + 0x38], rax
lea rcx, [rax + 1]
call fcn.14012005c
mov rbx, rax
test r15, r15
je 0x1400e67de
test rax, rax
je 0x1400e67d6
mov r8, qword [rsp + 0x98]
mov rdx, r15
inc r8d
mov rcx, r12
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov r8, qword [rsp + 0x30]
mov rdx, rsi
inc r8d
mov rcx, r13
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov r8, qword [rsp + 0x38]
mov rdx, rbx
mov rcx, qword [rsp + 0x40]
inc r8d
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov rcx, qword [0x14021c740]
mov r9, rsi
mov r8, r15
mov dword [rsp + 0x28], 0x80000000
mov edx, r14d
mov qword [rsp + 0x20], rbx
call fcn.14007c3fc
mov rax, qword [rdi]
xor r8d, r8d
mov rdx, rbp
mov byte [rdi + 0x42], 1
mov rcx, rdi
call qword [rax + 0x10]
mov r8d, r14d
mov edx, 0x844
mov rcx, rbp
call fcn.1400d485c
mov byte [rdi + 0x42], 0
mov rcx, r15
call fcn.14012008c
test rbx, rbx
je 0x1400e67eb
mov rcx, rbx
call fcn.14012008c
test rsi, rsi
je 0x1400e67f8
mov rcx, rsi
call fcn.14012008c
lea r11, [rsp + 0x50]
xor eax, eax
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1400e6818
Capabilities:
Hide graphical window

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r13
push r14
lea rbp, [rsp - 0x880]
sub rsp, 0x980
mov rax, qword [0x1401e7e78]
xor rax, rsp
mov qword [rbp + 0x870], rax
mov dil, r8b
mov rbx, rdx
mov rsi, rcx
mov byte [rcx + 0x41], 1
xor edx, edx
mov r8d, 0x100
lea rcx, [rsp + 0x70]
call fcn.14013b230
and qword [rsp + 0x58], 0
lea r8, [rsp + 0x58]
mov edx, 0x7d6
mov rcx, qword [0x14021c740]
call fcn.14007d690
test eax, eax
je 0x1400e689c
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x1400e689c
mov r8b, 1
lea rdx, [rsp + 0x70]
call fcn.140062d20
jmp 0x1400e68b3
xor edx, edx
lea ecx, [rdx + 0x4d]
call fcn.140068cf4
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.140041e2c
and qword [rsp + 0x48], 0
and qword [rsp + 0x40], 0
and qword [rsp + 0x38], 0
and qword [rsp + 0x30], 0
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
lea r9, [0x140167e00]
lea r8, [rsp + 0x70]
lea rdx, str.Default_shell__
lea rcx, [rsp + 0x60]
call fcn.140120be0
nop
lea rcx, [rsp + 0x60]
call fcn.140058574
mov r8, rax
mov edx, 0xabf
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
mov edx, 0xac1
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov r13d, 0x844
test dil, dil
je 0x1400e69a2
mov dword [rsp + 0x50], 0x10
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 1
mov r8d, 0x192
mov edx, r13d
mov rcx, rbx
call qword [sym.imp.USER32.dll_SendDlgItemMessageW]
mov edx, r13d
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
mov r14d, 0xfffffff0
mov edx, r14d
call qword [sym.imp.USER32.dll_GetWindowLongPtrW]
mov rdi, rax
test al, 1
jne 0x1400e69a2
or rdi, 1
mov edx, r13d
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
mov r8, rdi
mov edx, r14d
call qword [sym.imp.USER32.dll_SetWindowLongPtrW]
and qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 0x184
mov edx, r13d
mov rcx, rbx
call qword [sym.imp.USER32.dll_SendDlgItemMessageW]
xor r14d, r14d
xor edx, edx
jmp 0x1400e6a22
inc r14d
mov r8d, r14d
lea rdx, [0x1401a99f0]
lea rcx, [rbp + 0x70]
call fcn.140004a58
lea rcx, [rbp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r8d, 0x400
sub r8d, eax
cdqe
lea rcx, [rbp + 0x70]
lea rcx, [rcx + rax*2]
mov rdx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_lstrcpynW]
lea rax, [rbp + 0x70]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 0x180
mov edx, r13d
mov rcx, rbx
call qword [sym.imp.USER32.dll_SendDlgItemMessageW]
mov edx, r14d
mov rcx, qword [0x14021c740]
call fcn.14007bfa4
test rax, rax
mov rdi, rax
jne 0x1400e69c4
mov rax, qword [rsi]
mov r9d, 1
mov r8d, r13d
mov rdx, rbx
mov rcx, rsi
call qword [rax + 0x48]
mov byte [rsi + 0x41], 0
lea rcx, [rsp + 0x60]
call fcn.140120ddc
xor eax, eax
mov rcx, qword [rbp + 0x870]
xor rcx, rsp
call fcn.140139b10
mov rbx, qword [rsp + 0x9c0]
add rsp, 0x980
pop r14
pop r13
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400ebe98
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0x30
mov ebx, r9d
lea rax, [r11 + 0x20]
mov qword [r11 - 0x20], rax
mov rdi, r8
mov qword [r11 - 0x28], r8
mov rbp, rcx
mov rcx, qword [rcx + 0x28]
xor r8d, r8d
xor r9d, r9d
mov dword [rsp + 0x68], ebx
mov rsi, rdx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400ebeda
mov al, 1
jmp 0x1400ebf27
cmp eax, 0xea
jne 0x1400ebf25
cmp ebx, 1
jne 0x1400ebf25
cmp dword [rsp + 0x68], 4
jne 0x1400ebf25
mov rcx, qword [rbp + 0x28]
lea rax, [rsp + 0x68]
and dword [rsp + 0x50], 0
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
lea rax, [rsp + 0x50]
mov rdx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400ebf25
mov al, byte [rsp + 0x50]
mov byte [rdi], al
jmp 0x1400ebed6
xor al, al
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret

Function at 0x1400ebf34
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
lea rax, [r11 + 8]
mov rbx, r8
mov rbp, rcx
mov qword [r11 - 0x20], rax
mov rcx, qword [rcx + 0x28]
xor r14d, r14d
xor r9d, r9d
mov qword [r11 - 0x28], r14
xor r8d, r8d
mov dword [r11 + 8], r14d
mov rsi, rdx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400ebfee
mov eax, dword [rsp + 0x50]
test eax, eax
je 0x1400ebfee
mov rcx, qword [rbx]
cdq
sub eax, edx
sar eax, 1
mov edi, eax
test rcx, rcx
je 0x1400ebf96
call fcn.14012008c
mov qword [rbx], r14
lea ecx, [rdi + 2]
movsxd rcx, ecx
add rcx, rcx
call fcn.140120104
lea rcx, [rsp + 0x50]
mov qword [rbx], rax
mov qword [rsp + 0x28], rcx
xor r9d, r9d
mov rcx, qword [rbp + 0x28]
xor r8d, r8d
mov rdx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rbx]
test eax, eax
sete r8b
test eax, eax
mov al, r8b
cmovne edi, r14d
movsxd rdx, edi
mov word [rcx + rdx*2], r14w
mov rcx, qword [rbx]
mov word [rcx + rdx*2 + 2], r14w
jmp 0x1400ebff0
xor al, al
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x1400ec004
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
xor r14d, r14d
movsxd rdi, r9d
lea rax, [r11 + 8]
mov dword [r11 + 8], r14d
mov rbx, r8
mov qword [r11 - 0x30], rax
mov rbp, rcx
mov qword [r11 - 0x38], r14
mov rcx, qword [rcx + 0x28]
lea r9, [r11 - 0x28]
xor r8d, r8d
mov dword [r11 - 0x28], r14d
mov rsi, rdx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400ec092
cmp dword [rsp + 0x30], 1
jne 0x1400ec092
mov rcx, qword [rbp + 0x28]
lea eax, [rdi + rdi]
mov dword [rsp + 0x60], eax
xor r9d, r9d
lea rax, [rsp + 0x60]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov rdx, rsi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400ec092
test rbx, rbx
je 0x1400ec08e
mov word [rbx + rdi*2 - 2], r14w
mov al, 1
jmp 0x1400ec094
xor al, al
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x1400ecfa0
Capabilities:
Set registry value

Disassembly:
sub rsp, 0x38
mov rcx, qword [rcx + 0x28]
lea eax, [r9 - 0xfe]
cmp eax, 1
mov r10d, r9d
mov eax, dword [rsp + 0x60]
mov r9d, 4
mov dword [rsp + 0x28], eax
cmova r9d, r10d
mov qword [rsp + 0x20], r8
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add rsp, 0x38
ret

Function at 0x1400ef974
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x140
mov rax, qword [0x1401e7e78]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov rax, qword [0x14021c740]
mov rbx, rcx
xor ecx, ecx
cmp byte [rax + 0x110ea], cl
je 0x1400ef9e0
cmp byte [rax + 0x110eb], cl
je 0x1400ef9e0
cmp byte [rax + 0x110ec], cl
je 0x1400ef9e0
cmp byte [rax + 0x110f0], cl
je 0x1400ef9e0
cmp byte [rax + 0x110ef], cl
je 0x1400ef9e0
xor al, al
jmp 0x1400efb08
mov dil, cl
mov ecx, 0x14
call qword [sym.imp.USER32.dll_GetKeyState]
movzx r13d, ax
mov r14b, 1
mov r12b, r13b
mov ecx, 0x90
and r12b, r14b
call qword [sym.imp.USER32.dll_GetKeyState]
mov sil, al
mov word [rsp + 0x32], ax
mov ecx, 0x91
and sil, r14b
call qword [sym.imp.USER32.dll_GetKeyState]
mov rcx, qword [0x14021c5d8]
mov bpl, al
and bpl, r14b
mov word [rsp + 0x30], ax
call fcn.140014138
mov rcx, rax
call fcn.14005a9b4
mov rcx, qword [0x14021c5d8]
mov r14b, al
call fcn.140027994
mov rcx, qword [0x14021c5d8]
mov r15b, al
call fcn.140013ff4
cmp r12b, byte [rbx + 0xeddc]
je 0x1400efa6c
mov byte [rbx + 0xeddc], r12b
mov dil, 1
cmp sil, byte [rbx + 0xeddd]
je 0x1400efa7f
mov byte [rbx + 0xeddd], sil
mov dil, 1
cmp bpl, byte [rbx + 0xedde]
je 0x1400efa92
mov byte [rbx + 0xedde], bpl
mov dil, 1
cmp r14b, byte [rbx + 0xede0]
je 0x1400efaa5
mov byte [rbx + 0xede0], r14b
mov dil, 1
cmp r15b, byte [rbx + 0xeddf]
je 0x1400efab8
mov byte [rbx + 0xeddf], r15b
mov dil, 1
cmp rax, qword [rbx + 0xede8]
je 0x1400efacd
mov qword [rbx + 0xede8], rax
mov dil, 1
jmp 0x1400efad2
test dil, dil
je 0x1400efb05
movzx ecx, word [rsp + 0x30]
lea rdx, str.KeyboardState:_Capsx_04X_Numx_04X_Scrlx_04X
movzx r9d, word [rsp + 0x32]
mov r8d, r13d
mov dword [rsp + 0x20], ecx
lea rcx, [rsp + 0x40]
call fcn.140003da0
mov r8b, 1
lea rcx, [rsp + 0x40]
mov dl, r8b
call fcn.14002b004
mov al, dil
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.140139b10
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret

Function at 0x1400f6484
Capabilities:
Check for time delay via gettickcount

Disassembly:
push rbx
sub rsp, 0x20
cmp byte [rcx + 0xa80], 0
mov rbx, rcx
je 0x1400f64a9
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [rbx + 0xa7c]
cmp eax, 0x7d0
jbe 0x1400f64da
cmp dword [rbx + 0xa78], 0
jle 0x1400f64bb
mov byte [rbx + 0xa81], 1
jmp 0x1400f64da
mov byte [rbx + 0xa80], 1
mov rcx, qword [0x14021c5d8]
call fcn.140021558
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rbx + 0xa7c], eax
add rsp, 0x20
pop rbx
ret
Function at 0x1400f76e0
Capabilities:
Check for unmoving mouse cursor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x14021c740]
xor ebx, ebx
mov edi, edx
cmp byte [rax + 0x11129], bl
je 0x1400f78ad
cmp edx, 0x203
jne 0x1400f77b7
mov ecx, dword [rax + 0x11138]
cmp ecx, 2
je 0x1400f777a
cmp ecx, 1
jne 0x1400f773d
mov rcx, qword [0x14021c5d8]
xor edx, edx
add rcx, 0x260
call fcn.14003ddc0
test al, al
jne 0x1400f777a
mov rax, qword [0x14021c740]
mov ecx, dword [rax + 0x11138]
cmp ecx, 3
je 0x1400f776e
cmp ecx, 1
jne 0x1400f78ad
mov rcx, qword [0x14021c5d8]
xor edx, edx
add rcx, 0x260
call fcn.14003ddc0
test al, al
jne 0x1400f78ad
lea rcx, str.ToolBar:_ReBar_double_click:_RecreateAction
jmp 0x1400f786c
mov r8b, 1
lea rcx, str.ToolBar:_ReBar_double_click:_DoMaximizeRestore
mov dl, r8b
call fcn.14002b004
mov rax, qword [0x14021c5d8]
mov ecx, 0x200
or word [rax + 0x4028], cx
mov rcx, qword [0x14021c5d8]
add rcx, 0x260
call fcn.1400348d0
jmp 0x1400f78ad
cmp edi, 0x205
jne 0x1400f7800
lea rcx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov r8b, 1
lea rcx, str.ShowSysmenu_called_from__TabBar_
mov dl, r8b
call fcn.14002b004
mov rcx, qword [0x14021c5d8]
xor r9d, r9d
mov r8d, dword [rsp + 0x34]
mov edx, dword [rsp + 0x30]
mov rcx, qword [rcx + 0x3fb0]
call fcn.14007a0d8
jmp 0x1400f78ad
mov rcx, qword [0x14021c5d8]
add rcx, 0x260
call fcn.140037610
cmp eax, 0x51f
jne 0x1400f785d
lea rcx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_GetCursorPos]
movzx ecx, word [rsp + 0x34]
lea r8d, [rdi - 0x160]
movzx eax, word [rsp + 0x30]
mov r9d, 2
mov rdx, qword [0x14021c5e0]
shl ecx, 0x10
or eax, ecx
mov rcx, qword [0x14021c5d8]
cdqe
mov qword [rsp + 0x20], rax
call fcn.140025700
jmp 0x1400f78ad
cmp edi, 0x208
jne 0x1400f78ad
lea rcx, str.ToolBar:_ReBar_MBtnUp:_RecreateAction
mov r8b, 1
mov dl, r8b
call fcn.14002b004
mov rax, qword [0x14021c740]
cmp byte [rax + 0x11234], bl
jne 0x1400f7894
mov ecx, 0x10
call fcn.1401239d4
test al, al
je 0x1400f7899
mov ebx, 1
mov rcx, qword [0x14021c5d8]
xor r9d, r9d
mov r8d, ebx
xor edx, edx
call fcn.14001f834
mov rbx, qword [rsp + 0x50]
xor eax, eax
add rsp, 0x40
pop rdi
ret
Function at 0x1400fcb04
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x30
and qword [rsp + 0x58], 0
mov bl, 1
cmp dword [0x14021c614], 6
ja 0x1400fcb2a
jne 0x1400fcba7
cmp dword [0x14021c618], 0
jbe 0x1400fcba7
lea rax, [rsp + 0x58]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerAdvanced
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400fcba7
and dword [rsp + 0x48], eax
lea rdx, str.TaskbarSmallIcons
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
xor r9d, r9d
lea rax, [rsp + 0x48]
mov dword [rsp + 0x50], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400fcb9a
cmp dword [rsp + 0x48], eax
setne bl
jmp 0x1400fcb9c
xor bl, bl
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
add rsp, 0x30
pop rbx
ret
Function at 0x1401000e4
Capabilities:
Delete file
Move file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov sil, dl
mov rbx, rcx
mov dil, 1
add rcx, 0x10
cmp qword [rcx], 0
je 0x14010010b
call fcn.1400111e0
test sil, sil
je 0x1401001ab
mov rcx, rbx
call fcn.14012148c
test al, al
jne 0x1401001ab
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.140120b90
nop
lea rcx, [rsp + 0x20]
call fcn.14012148c
test al, al
jne 0x1401001a1
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.140121ccc
mov rcx, rax
mov edx, 0x80
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.140121ccc
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1401001a1
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.140121ccc
mov rcx, rax
xor edx, edx
lea r8d, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x1401001a1
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor dil, dil
lea rcx, [rsp + 0x20]
call fcn.140120ddc
mov rcx, rbx
call fcn.1401214e4
mov al, dil
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x140101a58
Capabilities:
Get graphical window text

Disassembly:
push rbx
sub rsp, 0x20
xor eax, eax
mov rbx, rcx
cmp byte [rcx + 0x3b9], al
jne 0x140101aa6
mov byte [rcx + 0x3c0], al
lea rdx, [rcx + 0x28]
mov dword [rcx + 0x3c4], eax
mov r8d, 0x80
mov rcx, qword [0x14021c5e0]
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
mov byte [rbx + 0x3b9], 1
add rsp, 0x20
pop rbx
ret
add rsp, 0x20
pop rbx
jmp fcn.1401021c4
Function at 0x140102138
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor eax, eax
mov dword [rcx + 0x3bc], r8d
mov rdi, rdx
mov rbx, rcx
test rdx, rdx
je 0x14010219c
cmp word [rdx], ax
je 0x14010219c
mov dword [rcx + 0x14], 0x17
mov rcx, qword [0x14021c5d8]
call fcn.1400140ac
mov rdx, rax
lea rcx, [rbx + 0x334]
mov r8d, 0x40
call qword [sym.imp.KERNEL32.dll_lstrcpynW]
lea rcx, [rbx + 0x130]
mov r8d, 0x100
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcpynW]
jmp 0x1401021b1
mov dword [rcx + 0x14], 7
mov word [rcx + 0x130], ax
mov word [rcx + 0x334], ax
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.140101a58

Function at 0x1401021c4
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x130
mov rax, qword [0x1401e7e78]
xor rax, rsp
mov qword [rsp + 0x120], rax
xor edi, edi
mov rbx, rcx
cmp byte [rcx + 0x3b9], dil
je 0x14010228b
cmp qword [rcx + 0x20], rdi
je 0x14010228b
cmp dword [rcx + 0x3bc], edi
jne 0x14010228b
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x100
call fcn.14013b230
mov rcx, qword [0x14021c5e0]
lea rdx, [rsp + 0x20]
mov r8d, 0x80
call qword [sym.imp.USER32.dll_GetWindowTextW]
cmp word [rbx + 0x130], di
jne 0x14010225a
cmp word [rbx + 0x334], di
jne 0x14010225a
lea rdx, [rbx + 0x28]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x14010228b
lea rcx, [rbx + 0x28]
mov word [rbx + 0x130], di
mov r8d, 0x80
mov word [rbx + 0x334], di
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_lstrcpynW]
mov rdx, rbx
mov ecx, 1
call qword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.140139b10
mov rbx, qword [rsp + 0x148]
add rsp, 0x130
pop rdi
ret
Function at 0x140104640
Capabilities:
Delete file
Move file
Set file attributes

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov dl, 1
add rcx, 0x1f8
call fcn.1401000e4
lea rcx, [rbx + 0x98]
mov dl, 1
call fcn.1401000e4
lea rcx, [rbx + 0xf0]
mov dl, 1
add rsp, 0x20
pop rbx
jmp fcn.1401000e4

Function at 0x140104c5c
Capabilities:
Read .ini file

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x28]
sub rsp, 0x128
mov rax, qword [0x1401e7e78]
xor rax, rsp
mov qword [rbp + 0x10], rax
mov rax, qword [rbp + 0x90]
lea r13, [rcx + 0x30a]
mov rsi, rdx
mov qword [rsp + 0x38], rdx
xor edi, edi
mov qword [rsp + 0x30], rax
mov rdx, r13
mov rcx, rax
mov rbx, r9
mov r14, r8
mov r15b, dil
call fcn.140028184
lea rax, str.ConEmu_Stable_2
mov word [r14], di
mov qword [rsp + 0x40], rax
mov r12d, 3
lea rax, str.stable:_t
mov word [rbx], di
mov qword [rsp + 0x48], rax
lea rdi, [rsp + 0x50]
lea rax, str._stable
mov qword [rsp + 0x50], rax
lea rax, str.ConEmu_Preview_2
mov qword [rsp + 0x58], rax
lea rax, str._npreview:_t
mov qword [rsp + 0x60], rax
lea rax, str._preview
mov qword [rsp + 0x68], rax
lea rax, str.ConEmu_Devel_2
mov qword [rsp + 0x70], rax
lea rax, str._nalpha:_t
mov qword [rsp + 0x78], rax
lea rax, str._alpha
mov qword [rbp - 0x80], rax
mov r8, qword [rdi - 8]
mov edx, 0x64
mov rcx, r14
call fcn.140001f38
mov rcx, qword [rdi - 0x10]
lea r9, [rbp - 0x70]
lea r8, [0x14015a140]
mov qword [rsp + 0x28], rsi
lea rdx, str.version
mov dword [rsp + 0x20], 0x40
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x140104e63
mov rdx, r13
lea rcx, [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
xor ecx, ecx
test eax, eax
setns sil
test r15b, r15b
jne 0x140104da7
test sil, sil
je 0x140104da7
mov r8, qword [rdi]
lea edx, [rcx + 0x64]
mov rcx, qword [rsp + 0x30]
mov r15b, 1
call fcn.140001f38
xor ecx, ecx
mov word [rbp - 0x5c], cx
lea r8, [rbp - 0x70]
mov rcx, r14
mov edx, 0x64
call fcn.140001f38
lea r8, [0x1401b0640]
mov edx, 0x64
mov rcx, rbx
call fcn.140001f38
lea r8, [rbp - 0x70]
mov edx, 0x64
mov rcx, rbx
call fcn.140001f38
mov r8, qword [rdi]
mov edx, 0x64
mov rcx, rbx
call fcn.140001f38
test sil, sil
je 0x140104e52
mov rdx, r13
lea rcx, [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
lea r8, str.__equal_
mov edx, 0x64
test eax, eax
mov rcx, r14
lea rax, str.__newer_
cmovg r8, rax
call fcn.140001f38
mov rdx, r13
lea rcx, [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
lea r8, str.__equal_
mov edx, 0x64
test eax, eax
mov rcx, rbx
lea rax, str.__newer_
cmovg r8, rax
call fcn.140001f38
mov rsi, qword [rsp + 0x38]
lea r8, [0x14016abcc]
mov rcx, rbx
jmp 0x140104e6d
mov rcx, r14
lea r8, str._Not_found_
mov edx, 0x64
call fcn.140001f38
add rdi, 0x18
sub r12, 1
jne 0x140104d31
xor eax, eax
cmp word [rbx], ax
jne 0x140104e9b
lea rdx, str._Not_found_
mov rcx, rbx
call fcn.140028184
mov rcx, qword [rbp + 0x10]
xor rcx, rsp
call fcn.140139b10
add rsp, 0x128
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret