joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401d8140
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0xe0
mov esi, edx
lea rax, [rsp + 0x30]
mov rbx, rcx
lea rdx, str.SoftwareRealtekAEAPO
mov r9d, 0x20119
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
xor edi, edi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401d8368
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x110]
lea r9, [rsp + 0x118]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
lea rdx, str.CapProperties
xor r8d, r8d
mov qword [rsp + 0x100], rbp
mov dword [rsp + 0x110], 0x44
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ebp, [rdi + 1]
test eax, eax
jne 0x1401d81ee
cmp dword [rsp + 0x110], 0x44
jne 0x1401d81ee
cmp dword [rsp + 0x40], 0xaeaeaeae
jne 0x1401d81ee
test dword [rsp + 0x58], 0xfffffee0
cmove edi, ebp
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x1401d8360
lea rcx, [rsp + 0x90]
mov rdx, rbx
mov r8d, 0x44
call fcn.140219480
lea rdx, [rsp + 0x40]
mov rcx, rbx
mov r8d, 0x44
call fcn.140219480
or r9d, 0xffffffff
lea rdx, str.LoadFiltersInfo_successful
mov rcx, rbx
or r8d, r9d
mov dword [rsp + 0x20], 0
call fcn.1401d8ee0
test esi, esi
je 0x1401d8360
mov rax, qword [rbx + 0x48]
test rax, rax
je 0x1401d8360
mov edx, dword [rsp + 0x44]
cmp edx, dword [rsp + 0x94]
je 0x1401d8275
mov r8, qword [rbx + 0x90]
xor ecx, ecx
call rax
mov edx, dword [rsp + 0x48]
cmp edx, dword [rsp + 0x98]
je 0x1401d828e
mov r8, qword [rbx + 0x90]
mov ecx, ebp
call qword [rbx + 0x48]
mov edx, dword [rsp + 0x4c]
cmp edx, dword [rsp + 0x9c]
je 0x1401d82aa
mov r8, qword [rbx + 0x90]
mov ecx, 2
call qword [rbx + 0x48]
mov edx, dword [rsp + 0x50]
cmp edx, dword [rsp + 0xa0]
je 0x1401d82c6
mov r8, qword [rbx + 0x90]
mov ecx, 3
call qword [rbx + 0x48]
mov edx, dword [rsp + 0x54]
cmp edx, dword [rsp + 0xa4]
je 0x1401d82e2
mov r8, qword [rbx + 0x90]
mov ecx, 4
call qword [rbx + 0x48]
mov edx, dword [rsp + 0x60]
cmp edx, dword [rsp + 0xb0]
je 0x1401d82fe
mov r8, qword [rbx + 0x90]
mov ecx, 6
call qword [rbx + 0x48]
mov edx, dword [rsp + 0x64]
cmp edx, dword [rsp + 0xb4]
je 0x1401d831a
mov r8, qword [rbx + 0x90]
mov ecx, 7
call qword [rbx + 0x48]
mov eax, dword [rsp + 0xb8]
cmp dword [rsp + 0x68], eax
je 0x1401d8344
xor edx, edx
mov rcx, rbx
call fcn.1401d97f0
test eax, eax
je 0x1401d8344
mov r8, qword [rbx + 0x90]
xor edx, edx
lea ecx, [rdx + 8]
call qword [rbx + 0x48]
mov edx, dword [rsp + 0x6c]
cmp edx, dword [rsp + 0xbc]
je 0x1401d8360
mov r8, qword [rbx + 0x90]
mov ecx, 9
call qword [rbx + 0x48]
mov rbp, qword [rsp + 0x100]
add rsp, 0xe0
pop rdi
pop rsi
pop rbx
ret
Function at 0x1401d8380
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rcx
sub rsp, 0xa8
test byte [0x140318538], 2
je 0x1401d8529
mov rax, qword [0x140318520]
lea r8, [r11 - 0x58]
mov qword [r11 + 0x10], rbx
mov qword [r8], rax
mov rax, qword [0x140318528]
mov qword [r11 - 8], rdi
mov qword [r8 + 8], rax
mov rax, qword [0x140318530]
xor edi, edi
mov qword [r8 + 0x10], rax
mov rax, qword [0x140318538]
test edx, edx
mov qword [r8 + 0x18], rax
mov rax, qword [0x140318540]
mov ebx, edi
mov qword [r8 + 0x20], rax
mov rax, qword [0x140318548]
mov qword [r8 + 0x28], rax
mov rax, qword [0x140318550]
mov qword [r8 + 0x30], rax
mov rax, qword [0x140318558]
mov qword [r8 + 0x38], rax
mov eax, dword [0x140318560]
mov dword [r8 + 0x40], eax
mov eax, dword [rsp + 0x5c]
mov dword [rsp + 0x58], edx
cmovne eax, edi
cmp dword [0x14031857c], ebx
mov dword [rsp + 0x50], 0xaeaeaeae
mov dword [rsp + 0x5c], eax
jne 0x1401d8444
lea rdx, [r11 - 0x58]
lea rcx, [0x140318520]
call fcn.1401d8a60
mov ebx, eax
jmp 0x1401d850f
mov qword [rsp + 0x40], rdi
lea rax, [rsp + 0xb0]
lea rdx, str.SoftwareRealtekAEAPO
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 0x102
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1401d84f1
mov rcx, qword [rsp + 0xb0]
lea rax, [rsp + 0x50]
lea rdx, str.CapProperties
mov r9d, 3
xor r8d, r8d
mov dword [rsp + 0x28], 0x44
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, 1
test eax, eax
cmove ebx, ecx
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x1401d84f1
or r9d, 0xffffffff
lea rdx, str.WriteRegistry_successful
lea rcx, [0x140318520]
or r8d, r9d
mov dword [rsp + 0x20], edi
call fcn.1401d8ee0
jmp 0x1401d850f
or r9d, 0xffffffff
lea rdx, str.WriteRegistry_failed
lea rcx, [0x140318520]
or r8d, r9d
mov dword [rsp + 0x20], edi
call fcn.1401d8ee0
mov rdi, qword [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [rsp + 0xb8]
add rsp, 0xa8
ret
xor eax, eax
add rsp, 0xa8
ret
Function at 0x1401d8540
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rcx
sub rsp, 0xa8
test byte [0x140318538], 4
je 0x1401d86e9
mov rax, qword [0x140318520]
lea r8, [r11 - 0x58]
mov qword [r11 + 0x10], rbx
mov qword [r8], rax
mov rax, qword [0x140318528]
mov qword [r11 - 8], rdi
mov qword [r8 + 8], rax
mov rax, qword [0x140318530]
xor edi, edi
mov qword [r8 + 0x10], rax
mov rax, qword [0x140318538]
test edx, edx
mov qword [r8 + 0x18], rax
mov rax, qword [0x140318540]
mov ebx, edi
mov qword [r8 + 0x20], rax
mov rax, qword [0x140318548]
mov qword [r8 + 0x28], rax
mov rax, qword [0x140318550]
mov qword [r8 + 0x30], rax
mov rax, qword [0x140318558]
mov qword [r8 + 0x38], rax
mov eax, dword [0x140318560]
mov dword [r8 + 0x40], eax
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x5c], edx
cmovne eax, edi
cmp dword [0x14031857c], ebx
mov dword [rsp + 0x50], 0xaeaeaeae
mov dword [rsp + 0x58], eax
jne 0x1401d8604
lea rdx, [r11 - 0x58]
lea rcx, [0x140318520]
call fcn.1401d8a60
mov ebx, eax
jmp 0x1401d86cf
mov qword [rsp + 0x40], rdi
lea rax, [rsp + 0xb0]
lea rdx, str.SoftwareRealtekAEAPO
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 0x102
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1401d86b1
mov rcx, qword [rsp + 0xb0]
lea rax, [rsp + 0x50]
lea rdx, str.CapProperties
mov r9d, 3
xor r8d, r8d
mov dword [rsp + 0x28], 0x44
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, 1
test eax, eax
cmove ebx, ecx
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x1401d86b1
or r9d, 0xffffffff
lea rdx, str.WriteRegistry_successful
lea rcx, [0x140318520]
or r8d, r9d
mov dword [rsp + 0x20], edi
call fcn.1401d8ee0
jmp 0x1401d86cf
or r9d, 0xffffffff
lea rdx, str.WriteRegistry_failed
lea rcx, [0x140318520]
or r8d, r9d
mov dword [rsp + 0x20], edi
call fcn.1401d8ee0
mov rdi, qword [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [rsp + 0xb8]
add rsp, 0xa8
ret
xor eax, eax
add rsp, 0xa8
ret
Function at 0x1401d8700
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rcx
sub rsp, 0xa8
test byte [0x140318538], 8
je 0x1401d889c
mov rax, qword [0x140318520]
lea r8, [r11 - 0x58]
mov qword [r11 + 0x10], rbx
mov qword [r8], rax
mov rax, qword [0x140318528]
mov qword [r11 - 8], rdi
mov qword [r8 + 8], rax
mov rax, qword [0x140318530]
xor edi, edi
mov qword [r8 + 0x10], rax
mov rax, qword [0x140318538]
mov ebx, edi
cmp dword [0x14031857c], ebx
mov qword [r8 + 0x18], rax
mov rax, qword [0x140318540]
mov qword [r8 + 0x20], rax
mov rax, qword [0x140318548]
mov qword [r8 + 0x28], rax
mov rax, qword [0x140318550]
mov qword [r8 + 0x30], rax
mov rax, qword [0x140318558]
mov qword [r8 + 0x38], rax
mov eax, dword [0x140318560]
mov dword [r8 + 0x40], eax
mov dword [rsp + 0x60], edx
mov dword [rsp + 0x50], 0xaeaeaeae
jne 0x1401d87b7
lea rdx, [r11 - 0x58]
lea rcx, [0x140318520]
call fcn.1401d8a60
mov ebx, eax
jmp 0x1401d8882
mov qword [rsp + 0x40], rdi
lea rax, [rsp + 0xb0]
lea rdx, str.SoftwareRealtekAEAPO
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 0x102
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1401d8864
mov rcx, qword [rsp + 0xb0]
lea rax, [rsp + 0x50]
lea rdx, str.CapProperties
mov r9d, 3
xor r8d, r8d
mov dword [rsp + 0x28], 0x44
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, 1
test eax, eax
cmove ebx, ecx
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x1401d8864
or r9d, 0xffffffff
lea rdx, str.WriteRegistry_successful
lea rcx, [0x140318520]
or r8d, r9d
mov dword [rsp + 0x20], edi
call fcn.1401d8ee0
jmp 0x1401d8882
or r9d, 0xffffffff
lea rdx, str.WriteRegistry_failed
lea rcx, [0x140318520]
or r8d, r9d
mov dword [rsp + 0x20], edi
call fcn.1401d8ee0
mov rdi, qword [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [rsp + 0xb8]
add rsp, 0xa8
ret
xor eax, eax
add rsp, 0xa8
ret
Function at 0x1401d88b0
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rcx
sub rsp, 0xa8
test byte [0x140318538], 1
je 0x1401d8a4c
mov rax, qword [0x140318520]
lea r8, [r11 - 0x58]
mov qword [r11 + 0x10], rbx
mov qword [r8], rax
mov rax, qword [0x140318528]
mov qword [r11 - 8], rdi
mov qword [r8 + 8], rax
mov rax, qword [0x140318530]
xor edi, edi
mov qword [r8 + 0x10], rax
mov rax, qword [0x140318538]
mov ebx, edi
cmp dword [0x14031857c], ebx
mov qword [r8 + 0x18], rax
mov rax, qword [0x140318540]
mov qword [r8 + 0x20], rax
mov rax, qword [0x140318548]
mov qword [r8 + 0x28], rax
mov rax, qword [0x140318550]
mov qword [r8 + 0x30], rax
mov rax, qword [0x140318558]
mov qword [r8 + 0x38], rax
mov eax, dword [0x140318560]
mov dword [r8 + 0x40], eax
mov dword [rsp + 0x54], edx
mov dword [rsp + 0x50], 0xaeaeaeae
jne 0x1401d8967
lea rdx, [r11 - 0x58]
lea rcx, [0x140318520]
call fcn.1401d8a60
mov ebx, eax
jmp 0x1401d8a32
mov qword [rsp + 0x40], rdi
lea rax, [rsp + 0xb0]
lea rdx, str.SoftwareRealtekAEAPO
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 0x102
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1401d8a14
mov rcx, qword [rsp + 0xb0]
lea rax, [rsp + 0x50]
lea rdx, str.CapProperties
mov r9d, 3
xor r8d, r8d
mov dword [rsp + 0x28], 0x44
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, 1
test eax, eax
cmove ebx, ecx
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x1401d8a14
or r9d, 0xffffffff
lea rdx, str.WriteRegistry_successful
lea rcx, [0x140318520]
or r8d, r9d
mov dword [rsp + 0x20], edi
call fcn.1401d8ee0
jmp 0x1401d8a32
or r9d, 0xffffffff
lea rdx, str.WriteRegistry_failed
lea rcx, [0x140318520]
or r8d, r9d
mov dword [rsp + 0x20], edi
call fcn.1401d8ee0
mov rdi, qword [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [rsp + 0xb8]
add rsp, 0xa8
ret
xor eax, eax
add rsp, 0xa8
ret
Function at 0x1401d8a60
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xe0
mov rax, qword [0x140300da0]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov rsi, rdx
or r9d, 0xffffffff
lea rcx, [0x140318520]
lea rdx, str.Start_WriteService
or r8d, r9d
xor ebx, ebx
mov dword [rsp + 0x20], 1
call fcn.1401d8ee0
lea rcx, [0x140318520]
call fcn.1401d8b90
test rax, rax
mov rdi, rax
jne 0x1401d8adc
lea ecx, [rbx + 1]
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x140318520]
call fcn.1401d8b90
test rax, rax
mov rdi, rax
je 0x1401d8b45
lea rcx, [rsp + 0x48]
mov rdx, rsi
mov r8d, 0x44
mov dword [rsp + 0x40], 0xae0ae0ae
mov dword [rsp + 0x44], 1
call fcn.140219480
lea r9, [rsp + 0x30]
lea rdx, [rsp + 0x40]
mov r8d, 0x88
mov rcx, rdi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1401d8b31
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ebx, 1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
lea rdx, str.WriteService_successful
jne 0x1401d8b4c
lea rdx, str.WriteService_failed
or r9d, 0xffffffff
lea rcx, [0x140318520]
mov dword [rsp + 0x20], 0
or r8d, r9d
call fcn.1401d8ee0
mov eax, ebx
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.140216200
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1401d8b90
Capabilities:
Start service

Disassembly:
push r12
sub rsp, 0x40
xor r12d, r12d
lea rcx, str..pipeAERTAPOProperties
xor r9d, r9d
mov qword [rsp + 0x30], r12
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
jne 0x1401d8ce5
mov qword [rsp + 0x50], rbx
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Cant_open_pipe:
lea rcx, [0x140318520]
or r9d, 0xffffffff
mov r8d, eax
mov dword [rsp + 0x20], r12d
call fcn.1401d8ee0
cmp dword [0x140318580], r12d
je 0x1401d8c1a
mov ebx, 1
mov rax, r12
mov dword [0x140318580], ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop r12
ret
mov qword [rsp + 0x60], rsi
mov ebx, 1
xor edx, edx
xor ecx, ecx
mov r8d, ebx
mov qword [rsp + 0x68], rdi
mov esi, r12d
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
test rax, rax
mov rdi, rax
je 0x1401d8cd3
lea r8d, [rbx + 0xf]
lea rdx, str.AERTFilters
mov rcx, rax
mov qword [rsp + 0x58], rbp
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
test rax, rax
mov rbp, rax
je 0x1401d8c82
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
mov rcx, rbp
test eax, eax
cmovne esi, ebx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test esi, esi
mov rbp, qword [rsp + 0x58]
je 0x1401d8cd3
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rsp + 0x30], r12
lea rcx, str..pipeAERTAPOProperties
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
cmove rax, r12
jmp 0x1401d8cd6
mov rax, r12
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop r12
ret
Function at 0x1401d97f0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x10], edx
push rdi
sub rsp, 0x40
mov rdi, rcx
mov ecx, dword [rcx + 0x28]
xor ebx, ebx
test ecx, ecx
jne 0x1401d9817
xor eax, eax
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
mov eax, dword [rdi + 0x18]
test eax, eax
je 0x1401d98ad
add eax, eax
cmp eax, ecx
jne 0x1401d98ad
lea rax, [rsp + 0x30]
lea rdx, str.SoftwareAndrea_ElectronicsAEAudioAPOSettings
mov r9d, 0x20119
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401d98ad
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x58]
lea r9, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
lea rdx, str.AEOpts
xor r8d, r8d
mov dword [rsp + 0x58], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1401d98a2
mov ecx, dword [rsp + 0x60]
mov eax, 1
not ecx
cmp ecx, dword [rdi + 0x28]
cmove ebx, eax
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x1401d9b50
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x100
mov esi, edx
lea rax, [rsp + 0x30]
mov rbx, rcx
lea rdx, str.SoftwareRealtekAEAPO
mov r9d, 0x20119
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
xor edi, edi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401d9cc1
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x130]
lea r9, [rsp + 0x138]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
lea rdx, str.RenProperties
xor r8d, r8d
mov qword [rsp + 0x120], rbp
mov dword [rsp + 0x130], 0x60
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ebp, [rdi + 1]
test eax, eax
jne 0x1401d9bf4
cmp dword [rsp + 0x130], 0x60
jne 0x1401d9bf4
cmp dword [rsp + 0x40], 0xaee0aee0
cmove edi, ebp
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x1401d9cb9
lea rcx, [rsp + 0xa0]
mov rdx, rbx
mov r8d, 0x60
call fcn.140219480
lea rdx, [rsp + 0x40]
mov rcx, rbx
mov r8d, 0x60
call fcn.140219480
or r9d, 0xffffffff
lea rdx, str.LoadEQInfo_successful
mov rcx, rbx
or r8d, r9d
mov dword [rsp + 0x20], 0
call fcn.1401da170
test esi, esi
je 0x1401d9cb9
mov rax, qword [rbx + 0x60]
test rax, rax
je 0x1401d9cb9
mov edx, dword [rsp + 0x4c]
cmp edx, dword [rsp + 0xac]
je 0x1401d9c73
mov r8, qword [rbx + 0xa0]
xor ecx, ecx
call rax
mov r8, qword [rbx + 0xa0]
xor edx, edx
mov ecx, ebp
call qword [rbx + 0x60]
mov edx, dword [rsp + 0x48]
cmp edx, dword [rsp + 0xa8]
je 0x1401d9c9d
mov r8, qword [rbx + 0xa0]
mov ecx, 2
call qword [rbx + 0x60]
mov edx, dword [rsp + 0x78]
cmp edx, dword [rsp + 0xd8]
je 0x1401d9cb9
mov r8, qword [rbx + 0xa0]
mov ecx, 3
call qword [rbx + 0x60]
mov rbp, qword [rsp + 0x120]
add rsp, 0x100
pop rdi
pop rsi
pop rbx
ret
Function at 0x1401dccfc
Capabilities:
Get graphical window text

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rsi
movsxd rsi, r8d
mov rdi, rdx
mov rbx, rcx
cmp qword [rcx + 0xa0], 0
jne 0x1401dcd3a
mov r8d, esi
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x1401dcdee
call fcn.1401e9268
mov r11, rax
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
jne 0x1401dcd59
mov ecx, 0x80004005
call fcn.140003c70
int3
mov rax, qword [rax]
mov rcx, r11
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x40], rax
mov rcx, qword [rbx + 0xa0]
mov rax, qword [rcx]
lea rdx, [rsp + 0x40]
call qword [rax + 0x118]
mov rdx, rsi
or rsi, 0xffffffffffffffff
mov r9, rsi
mov r8, qword [rsp + 0x40]
mov rcx, rdi
call fcn.140219260
test eax, eax
je 0x1401dcdc1
cmp eax, 0xc
je 0x1401dcdbb
cmp eax, 0x16
je 0x1401dcdb5
cmp eax, 0x22
je 0x1401dcdb5
cmp eax, 0x50
je 0x1401dcdc1
call fcn.1401e7838
int3
call fcn.1401e7838
int3
call fcn.1401e77f0
int3
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebx, eax
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov ecx, esi
lock xadd dword [rdx + 0x10], ecx
add ecx, esi
test ecx, ecx
jg 0x1401dcdec
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov eax, ebx
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x1401dd948
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0xb0], 0
mov rdi, qword [rcx + 0xc0]
mov rbp, qword [rcx + 0xb8]
mov rsi, rcx
je 0x1401dd9a5
call fcn.1401dc36c
mov rdx, qword [rsi + 0xb0]
mov r8d, 5
mov rbx, qword [rax + 0x18]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rcx, rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbp, rax
test rbp, rbp
je 0x1401dd9b6
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
test rdi, rdi
mov ebx, 1
je 0x1401dd9f3
cmp word [rdi + 2], 0xffff
mov ecx, dword [rdi]
jne 0x1401dd9d7
mov ecx, dword [rdi + 0xc]
movzx edx, word [rdi + 0x12]
movzx eax, word [rdi + 0x14]
jmp 0x1401dd9df
mov dx, word [rdi + 0xa]
mov ax, word [rdi + 0xc]
test ecx, 0x1801
jne 0x1401dd9f1
test dx, dx
jne 0x1401dd9f1
test ax, ax
je 0x1401dd9f3
xor ebx, ebx
cmp qword [rsi + 0xb0], 0
je 0x1401dda06
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1401de15c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
movzx edx, dx
jmp method.wWz.:_5_m8_o__.virtual_624
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
test rdx, 0xffffffffffff0000
mov rbp, r8
mov rdi, rdx
mov rsi, rcx
mov qword [rcx + 0xb0], rdx
jne 0x1401de19b
cmp dword [rcx + 0xa8], 0
jne 0x1401de19b
movzx eax, dx
mov dword [rcx + 0xa8], eax
call fcn.1401dc36c
mov r8d, 5
mov rdx, rdi
mov rbx, qword [rax + 0x18]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rcx, rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r9, rbx
mov r8, rbp
mov rdx, rax
mov rcx, rsi
mov rdi, rax
call fcn.1401de100
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1401df14c
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, rcx
mov rcx, qword [rcx + 0x40]
mov rbx, r8
call fcn.1401fc734
test rax, rax
mov rsi, rax
je 0x1401df1c9
mov rcx, rax
call qword [sym.imp.USER32.dll_GetDlgCtrlID]
test rbx, rbx
movzx edi, ax
je 0x1401df1c4
cmp dword [rbx], 0x38
jb 0x1401df1c4
mov rax, qword [rbp + 0x40]
or dword [rbx + 4], 1
or qword [rbx + 0x30], 0xffffffffffffffff
xor r9d, r9d
xor r8d, r8d
mov edx, 0x87
mov rcx, rsi
mov qword [rbx + 8], rax
mov qword [rbx + 0x10], rsi
call qword [sym.imp.USER32.dll_SendMessageW]
bt rax, 0xd
jb 0x1401df1c4
or dword [rbx + 4], 0x80000002
mov rax, rdi
jmp 0x1401df1cd
or rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1401e02cc
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov edi, ecx
call fcn.1401dc3bc
mov rbx, rax
mov rax, qword [rax + 0x78]
test rax, rax
je 0x1401e0303
mov rcx, qword [rax + 0x40]
test rcx, rcx
je 0x1401e0303
xor r9d, r9d
xor r8d, r8d
mov edx, 0x401
call qword [sym.imp.USER32.dll_SendMessageW]
test edi, edi
mov rbx, qword [rbx + 0xa0]
je 0x1401e0333
test rbx, rbx
je 0x1401e0333
mov ecx, 1
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x1401e0333
mov rax, qword [rbx]
or rdx, 0xffffffffffffffff
mov rcx, rbx
call qword [rax + 0x2d0]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret