joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400c0730
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov rdi, r9
mov rsi, r8
mov r15, rdx
mov rbx, rcx
xor ecx, ecx
mov dword [r8], ecx
mov dword [r9], ecx
lea rax, vtable.JRWndPtr.0
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x40], ecx
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.14005a4f0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x80], rax
xorps xmm0, xmm0
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1400c07b2
mov rax, qword [rcx]
lea rdx, [rsp + 0x20]
call qword [rax + 0x488]
movups xmm0, xmmword [rax]
mov rcx, qword [rsp + 0x38]
movq r13, xmm0
mov r12, r13
shr r12, 0x20
psrldq xmm0, 8
movq r14, xmm0
mov rbp, r14
shr rbp, 0x20
lea rax, vtable.JRWndPtr.0
mov qword [rsp + 0x30], rax
test rcx, rcx
je 0x1400c07fa
cmp dword [rsp + 0x40], 1
jne 0x1400c07fa
mov rax, qword [rcx]
lea rdx, [rsp + 0x30]
call qword [rax + 0x608]
mov rcx, qword [rsp + 0x38]
cmp dword [rsp + 0x40], 2
jne 0x1400c0815
test rcx, rcx
je 0x1400c0815
mov rax, qword [rcx]
mov edx, 1
call qword [rax + 0x2e8]
nop
mov rcx, rbx
cmp byte [rbx + 0x1f0], 0
je 0x1400c088f
mov eax, dword [r15]
sub eax, dword [rbx + 0x250]
mov dword [rsi], eax
mov dword [rdi], 1
call fcn.1400bf360
cmp dword [r15], eax
jl 0x1400c08ac
mov rcx, rbx
call fcn.1400bf360
sub r14d, r13d
sub r14d, eax
cmp dword [r15], r14d
jge 0x1400c08c7
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne 0x1400c0881
mov ecx, dword [rsi]
test ecx, ecx
js 0x1400c087b
mov eax, dword [rbx + 0x258]
sub eax, dword [rbx + 0x250]
cmp ecx, eax
jle 0x1400c0910
mov dword [rdi], 2
mov eax, dword [rbx + 0x258]
sub eax, dword [rbx + 0x250]
jmp 0x1400c0909
mov eax, dword [r15 + 4]
sub eax, dword [rbx + 0x254]
mov dword [rsi], eax
mov dword [rdi], 1
call fcn.1400bf360
cmp dword [r15 + 4], eax
jge 0x1400c08b4
mov dword [rdi], 3
jmp 0x1400c0910
mov rcx, rbx
call fcn.1400bf360
sub ebp, r12d
sub ebp, eax
cmp dword [r15 + 4], ebp
jl 0x1400c08cf
mov dword [rdi], 4
jmp 0x1400c0910
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne 0x1400c08fd
mov ecx, dword [rsi]
test ecx, ecx
js 0x1400c08f7
mov eax, dword [rbx + 0x25c]
sub eax, dword [rbx + 0x254]
cmp ecx, eax
jle 0x1400c0910
mov dword [rdi], 2
mov eax, dword [rbx + 0x25c]
sub eax, dword [rbx + 0x254]
cdq
sub eax, edx
sar eax, 1
mov dword [rsi], eax
mov al, 1
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1400c61c0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rbx, rcx
cmp dword [rdx + 8], 0x100
jne case.0x1400c6214.10
mov edi, 0xffffffff
cmp qword [rdx], 0
je 0x1400c61ed
mov edi, dword [rdx + 0x10]
lea eax, [rdi - 9]
cmp eax, 0x1f
ja case.0x1400c6214.10
cdqe
lea rdx, [0x140000000]
movzx eax, byte [rdx + rax + 0xc63d0]
mov ecx, dword [rdx + rax*4 + 0xc63bc]
add rcx, rdx
jmp rcx
mov dl, 1
lea rcx, [rsp + 0x20]
call fcn.140075470
nop
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x1400c6244
mov rax, qword [rcx]
mov edx, 9
call qword [rax + 0x5a8]
test al, al
je 0x1400c6244
xor dil, dil
jmp 0x1400c6279
movsxd rsi, edi
mov rax, qword [rbx]
mov dl, 1
mov rcx, rbx
call qword [rax + 0x328]
xor dil, dil
test al, al
je 0x1400c6279
mov rcx, qword [rbx + 0x2c8]
test rcx, rcx
je 0x1400c6279
mov rax, qword [rcx]
mov r9, rsi
xor r8d, r8d
mov rdx, rbx
call qword [rax]
movzx edi, al
lea rax, vtable.JRWndPtr.0
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x1400c62a9
cmp dword [rsp + 0x30], 1
jne 0x1400c62a9
mov rax, qword [rcx]
lea rdx, [rsp + 0x20]
call qword [rax + 0x608]
mov rcx, qword [rsp + 0x28]
cmp dword [rsp + 0x30], 2
jne 0x1400c62c5
test rcx, rcx
je 0x1400c62c5
mov r8, qword [rcx]
mov edx, 1
call qword [r8 + 0x2e8]
nop
movzx eax, dil
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
cmp dword [rbx + 0x2e0], 1
jne 0x1400c637c
xor al, al
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
cmp dword [rbx + 0x2e0], 1
je case.0x1400c6214.10
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
je case.0x1400c6214.10
jmp 0x1400c637c
mov eax, dword [rbx + 0x2e0]
cmp eax, 6
ja case.0x1400c6214.10
mov ecx, 0x65
bt ecx, eax
jae case.0x1400c6214.10
mov rax, qword [rbx + 0x348]
test rax, rax
je 0x1400c637c
cmp byte [rax + 0x544], 0
jne case.0x1400c6214.10
mov rcx, qword [rax + 0x4b8]
test rcx, rcx
je 0x1400c6366
mov rcx, qword [rcx + 8]
test rcx, rcx
je 0x1400c6366
mov rax, qword [rcx]
xor r8d, r8d
xor edx, edx
call qword [rax + 0x3c8]
test al, al
jne case.0x1400c6214.10
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne case.0x1400c6214.10
mov rax, qword [rbx]
mov dl, 1
mov rcx, rbx
call qword [rax + 0x328]
test al, al
je 0x1400c63a8
mov rcx, qword [rbx + 0x2c8]
test rcx, rcx
je 0x1400c63a8
mov rax, qword [rcx]
movsxd r9, edi
xor r8d, r8d
mov rdx, rbx
call qword [rax]
mov al, 1
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x1400c68f0
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov dword [rcx + 0x2e4], 2
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov dl, 1
test al, 1
mov rcx, rbx
mov rax, qword [rbx]
mov r8, qword [rax + 0x328]
je 0x1400c694e
call r8
test al, al
je 0x1400c6976
mov rcx, qword [rbx + 0x2c8]
test rcx, rcx
je 0x1400c6976
mov rax, qword [rcx]
mov r9d, 0xd
xor r8d, r8d
mov rdx, rbx
add rsp, 0x20
pop rbx
jmp qword [rax]
call r8
test al, al
je 0x1400c6976
mov rcx, qword [rbx + 0x2c8]
test rcx, rcx
je 0x1400c6976
mov rax, qword [rcx]
xor r9d, r9d
mov rdx, rbx
lea r8d, [r9 + 1]
add rsp, 0x20
pop rbx
jmp qword [rax]
add rsp, 0x20
pop rbx
ret
Function at 0x1400db580
Capabilities:
Log keystrokes via application hook

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x70
mov rbp, r9
mov rdi, r8
mov r15d, edx
mov r14, rcx
mov ecx, 0xf
call qword [sym.imp.USER32.dll_GetSysColorBrush]
mov rbx, rax
mov edx, 0x7f00
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorW]
mov rdx, rax
xor r9d, r9d
mov r8, rbx
mov ecx, 0x800
call fcn.1400ea1d0
mov rbx, rax
call fcn.1400ffca0
mov rcx, rax
test rax, rax
je 0x1400db76b
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x50], rax
mov rsi, 0xffffffffffffffff
xor r12d, r12d
test rbx, rbx
je 0x1400db631
cmp rbx, 0x10000
jae 0x1400db622
movzx edx, bx
lea rcx, [rsp + 0x50]
call fcn.14000b1e0
jmp 0x1400db642
mov r8, rsi
inc r8
cmp word [rbx + r8*2], r12w
jne 0x1400db625
jmp 0x1400db634
mov r8d, r12d
mov rdx, rbx
lea rcx, [rsp + 0x50]
call fcn.14000b900
nop
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x58], xmm0
mov rax, qword [r14]
mov qword [rsp + 0x40], r12
mov dword [rsp + 0x38], r12d
mov qword [rsp + 0x30], r12
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0x86400000
xor r9d, r9d
mov rbx, qword [rsp + 0x50]
mov r8, rbx
mov edx, 0x188
mov rcx, r14
call qword [rax + 0xb0]
test eax, eax
jne 0x1400db694
xor dil, dil
jmp 0x1400db730
mov r9, rbp
mov r8, rdi
mov edx, r15d
mov rcx, r14
call fcn.1400db780
mov rcx, qword [r14 + 0x40]
call qword [sym.imp.USER32.dll_SetCapture]
mov rcx, rax
call fcn.1400ebecc
mov rcx, qword [r14 + 0x40]
mov r9d, 1
mov r8, rcx
lea edx, [r9 + 0x1f]
call qword [sym.imp.USER32.dll_SendMessageW]
mov qword [0x1401f7bc8], r14
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r9d, eax
xor r8d, r8d
lea rdx, [0x1400dbcc0]
lea ecx, [r8 + 2]
call qword [sym.imp.USER32.dll_SetWindowsHookExW]
mov qword [0x1401f7bc0], rax
mov edx, 2
mov rcx, r14
call fcn.1400ef298
mov rcx, qword [0x1401f7bc0]
call qword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov qword [0x1401f7bc0], r12
mov qword [0x1401f7bc8], r12
mov rax, qword [r14]
mov rcx, r14
call qword [rax + 0xc0]
mov dil, 1
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], esi
sub esi, 1
jg 0x1400db748
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
movzx eax, dil
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
mov ecx, 0x80004005
call fcn.14000ba80
int3
Function at 0x1400e7f70
Capabilities:
Create thread

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x30
xor ebx, ebx
mov qword [rcx + 8], rdx
lea r14d, [r9 + 1]
mov dword [rcx + 0x10], ebx
mov eax, ebx
mov dword [rcx + 0x14], r9d
xchg dword [0x1401f7bfc], eax
cmp r14d, dword [rcx]
mov ebp, r9d
mov rsi, rdx
mov rdi, rcx
cmovge r14d, dword [rcx]
cmp r14d, 1
jne 0x1400e7fd1
test r9d, r9d
js 0x1400e80ec
mov rax, qword [rsi]
xor r8d, r8d
mov edx, ebx
mov rcx, rsi
call qword [rax]
inc ebx
cmp ebx, ebp
jle 0x1400e7fb3
add rsp, 0x30
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
jle 0x1400e80ec
mov rcx, qword [rcx + 0x48]
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], r13
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov eax, dword [rdi]
lea r13d, [r14 - 1]
sub eax, r14d
movsxd rbp, r14d
mov dword [rdi + 0x18], eax
mov rcx, 0xffffffffffffffff
mov eax, 0x18
dec rbp
mul rbp
cmovo rax, rcx
mov rcx, rax
call fcn.140002440
mov r12, rax
mov r14d, ebx
test rbp, rbp
jle 0x1400e80c0
mov qword [rsp + 0x70], r15
lea rsi, [rax + 0x10]
mov r15, rbp
nop dword [rax]
nop word [rax + rax]
movsxd rcx, r14d
lea r8, [0x1400e8100]
mov qword [rsp + 0x28], rbx
mov qword [rsi - 8], rdi
mov dword [rsi], r14d
lea rdx, [rcx + rcx*2]
mov dword [rsp + 0x20], ebx
lea r9, [r12 + rdx*8]
xor ecx, ecx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsi - 0x10], rax
test rax, rax
jne 0x1400e8077
dec dword [rdi]
inc r14d
add rsi, 0x18
sub r15, 1
jne 0x1400e8040
mov r15, qword [rsp + 0x70]
mov edx, r13d
mov rcx, rdi
call fcn.1400e8120
mov rcx, qword [rdi + 0x48]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rbx, r12
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400e80b4
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rbx, 0x18
sub rbp, 1
jne 0x1400e80a6
jmp 0x1400e80da
mov edx, r13d
mov rcx, rdi
call fcn.1400e8120
mov rcx, qword [rdi + 0x48]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, r12
call fcn.1400025e0
mov r13, qword [rsp + 0x68]
mov r12, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x1400e885c
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
movsxd r8, dword [0x14000003c]
lea rsi, [0x140000000]
add r8, rsi
mov rbx, rdx
mov rdi, rcx
cmp dword [r8 + 0x84], 0xd
jbe 0x1400e88d4
mov r10d, dword [r8 + 0xf0]
xor r9d, r9d
test r10d, r10d
je 0x1400e88d4
movzx ecx, word [r8 + 0x14]
movzx r11d, word [r8 + 6]
add rcx, 0x18
mov r10d, dword [r10 + rsi + 0xc]
add rcx, r8
test r11d, r11d
je 0x1400e88d4
mov eax, dword [rcx + 0xc]
cmp r10d, eax
jb 0x1400e88c8
mov edx, dword [rcx + 8]
add eax, edx
cmp r10d, eax
jb 0x1400e88e6
inc r9d
add rcx, 0x28
cmp r9d, r11d
jb 0x1400e88b6
xor eax, eax
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
mov dword [rdi], edx
mov eax, dword [rcx + 0x24]
mov dword [rbx], eax
mov eax, dword [rcx + 0xc]
add rax, rsi
jmp 0x1400e88d6
Function at 0x1400ebe4c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
xor ebx, ebx
mov rdi, rdx
mov rsi, rcx
test rdx, rdx
je 0x1400ebeaa
call fcn.1400ffa7c
mov r8d, 0xf0
mov rdx, rdi
mov rbp, qword [rax + 0x18]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x1400ebeaa
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x1400ebeb5
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
mov rdx, rbx
mov rcx, rsi
call fcn.1400e8db4
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1400ec4a8
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
xor ebp, ebp
mov rcx, qword [rcx + 0xd0]
mov rbx, rdx
test rcx, rcx
jne 0x1400ec557
mov rcx, qword [rsi + 0x40]
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
movsxd rdi, eax
test eax, eax
js 0x1400ec57c
mov rcx, qword [rbx]
lea r8d, [rbp + 1]
mov edx, dword [rcx - 0xc]
sub r8d, dword [rcx - 8]
sub edx, edi
or r8d, edx
jge 0x1400ec508
mov edx, edi
mov rcx, rbx
call fcn.14000b8a0
mov rdx, qword [rbx]
cmp edi, dword [rdx - 0xc]
jg 0x1400ec57c
mov dword [rdx - 0x10], edi
lea r8d, [rdi + 1]
mov rax, qword [rbx]
mov word [rax + rdi*2], bp
mov rcx, qword [rsi + 0x40]
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov rcx, qword [rbx]
test rcx, rcx
jne 0x1400ec534
mov eax, ebp
jmp 0x1400ec541
movsxd rdx, dword [rcx - 0xc]
call fcn.140146e34
test eax, eax
js 0x1400ec57c
mov rcx, qword [rbx]
cmp eax, dword [rcx - 0xc]
jg 0x1400ec57c
mov dword [rcx - 0x10], eax
mov ecx, eax
mov rax, qword [rbx]
mov word [rax + rcx*2], bp
jmp 0x1400ec567
mov rax, qword [rcx]
mov rax, qword [rax + 0x118]
call qword [case.0x140116099.0]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov ecx, 0x80070057
call fcn.14000ba80
int3
Function at 0x1400eca10
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rdi, rdx
mov rbx, rcx
test rcx, rcx
je 0x1400ecac9
mov rcx, qword [rcx + 0x40]
test rcx, rcx
je 0x1400ecac9
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1400ecac9
test rdi, rdi
je 0x1400ecac9
xor r14d, r14d
xor esi, esi
call fcn.1400ffa7c
lea r8, str.AFX_DIALOG_LAYOUT
mov rdx, rdi
mov rbp, qword [rax + 0x18]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdi, rax
test rax, rax
je 0x1400ecaa9
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rdx, rdi
mov rcx, rbp
mov r14d, eax
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x1400ecac9
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rsi, rax
mov r8d, r14d
mov rdx, rsi
mov rcx, rbx
call fcn.14012240c
mov edi, eax
test eax, eax
je 0x1400ecac5
mov rcx, rbx
call fcn.1400ec6d8
mov eax, edi
jmp 0x1400ecacb
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x1400ed964
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, rcx
mov rbx, r8
mov rcx, qword [rcx + 0x40]
call fcn.1401239b4
mov rdi, rax
test rax, rax
je 0x1400ed9e0
mov rcx, rax
call qword [sym.imp.USER32.dll_GetDlgCtrlID]
mov esi, eax
test rbx, rbx
je 0x1400ed9db
cmp dword [rbx], 0x40
jb 0x1400ed9db
mov rcx, qword [rbp + 0x40]
xor r9d, r9d
or dword [rbx + 4], 1
xor r8d, r8d
or qword [rbx + 0x30], 0xffffffffffffffff
mov edx, 0x87
mov qword [rbx + 8], rcx
mov rcx, rdi
mov qword [rbx + 0x10], rdi
call qword [sym.imp.USER32.dll_SendMessageW]
bt rax, 0xd
jb 0x1400ed9db
or dword [rbx + 4], 0x80000002
mov rax, rsi
jmp 0x1400ed9e4
or rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1400f2b10
Capabilities:
Get graphical window text

Disassembly:
sub rsp, 0x78
test rdx, rdx
je 0x1400f2b78
mov r10, qword [rcx + 0x10]
test r10, r10
je 0x1400f2b62
cmp qword [rcx + 0x18], 0
jne 0x1400f2b5d
mov eax, dword [rcx + 0xc]
cmp eax, dword [rcx + 0x30]
jae 0x1400f2b7e
mov qword [rsp + 0x58], rdx
lea r9, [rsp + 0x20]
mov dword [rsp + 0x20], 0x50
mov edx, eax
mov dword [rsp + 0x24], 0x40
mov r8d, 1
mov rcx, qword [r10 + 8]
call qword [sym.imp.USER32.dll_SetMenuItemInfoW]
add rsp, 0x78
ret
mov rcx, qword [rcx + 0x20]
test rcx, rcx
je 0x1400f2b78
mov rcx, qword [rcx + 0x40]
add rsp, 0x78
jmp fcn.140123650
call fcn.1400f9a54
int3
call fcn.1400f9a54
int3
Function at 0x1400f2f84
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbx, qword [rcx + 0x100]
xor r14d, r14d
mov rdi, rcx
mov rsi, qword [rcx + 0xf8]
cmp qword [rcx + 0xf0], r14
je 0x1400f2feb
call fcn.1400ffa7c
mov rdx, qword [rdi + 0xf0]
lea r8d, [r14 + 5]
mov rbp, qword [rax + 0x18]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x1400f2feb
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
test rsi, rsi
je 0x1400f2ffc
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
mov eax, 1
test rbx, rbx
je 0x1400f3041
mov edx, 0xffff
lea rcx, [rbx + 0xc]
cmp word [rbx + 2], dx
jne 0x1400f3020
movzx r8d, word [rbx + 0x12]
movzx edx, word [rbx + 0x14]
jmp 0x1400f302b
movzx edx, word [rcx]
mov rcx, rbx
movzx r8d, word [rbx + 0xa]
test dword [rcx], 0x1801
jne 0x1400f303e
test r8w, r8w
jne 0x1400f303e
test dx, dx
je 0x1400f3041
mov eax, r14d
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x1400f305c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov qword [rcx + 0xf0], rdx
mov rbp, r8
mov rdi, rdx
mov rbx, rcx
cmp rdx, 0x10000
jae 0x1400f309b
cmp dword [rcx + 0xe8], 0
jne 0x1400f309b
movzx eax, dx
mov dword [rcx + 0xe8], eax
call fcn.1400ffa7c
mov r8d, 5
mov rdx, rdi
mov rsi, qword [rax + 0x18]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x1400f30df
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x1400f30df
mov r9, rsi
mov r8, rbp
mov rdx, rax
mov rcx, rbx
call fcn.1400f3414
jmp 0x1400f30e1
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1400f30f8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rsi, r8
mov rbx, rdx
mov rbp, rcx
call fcn.1400ffa7c
mov r8d, 5
mov rdx, rbx
mov rdi, qword [rax + 0x18]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x1400f3162
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x1400f3162
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r9, rdi
mov r8, rsi
mov rdx, rax
mov rcx, rbp
call fcn.1400f317c
jmp 0x1400f3164
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400f6dc0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x50
mov rdi, r9
mov rbx, r8
and qword [r9], 0
mov r14, qword [rbp + 0x40]
and dword [r14], 0
cmp qword [rcx + 0xb0], 0
je 0x1400f6e98
xor r8d, r8d
call fcn.1400f7238
mov rsi, rax
test rax, rax
je 0x1400f6f47
mov qword [rbp - 0x20], rsi
and dword [rbp - 0x18], 0
and qword [rbp - 0x10], 0
and dword [rbp + 0x20], 0
and dword [rbp + 0x40], 0
lea rax, [rbp + 0x40]
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
lea r9, [rbp + 0x20]
xor r8d, r8d
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [rbp + 0x40]
mov dword [r14], ecx
test eax, eax
jne 0x1400f6e7c
call fcn.140002440
mov qword [rdi], rax
lea rcx, [rbp + 0x40]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x20]
xor r8d, r8d
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400f6e7c
lea ebx, [rax + 1]
jmp 0x1400f6e8a
mov rcx, qword [rdi]
call fcn.1400025e0
and qword [rdi], 0
xor ebx, ebx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1400f6f45
mov rax, qword [rcx]
and qword [rsp + 0x20], 0
mov r9, rbx
mov r8, rdx
lea rdx, [rbp + 0x40]
mov rax, qword [rax + 0x108]
call qword [case.0x140116099.0]
nop
mov rax, qword [rbp + 0x40]
mov ecx, dword [rax - 0x10]
test ecx, ecx
jne 0x1400f6ec8
xor ebx, ebx
jmp 0x1400f6f24
shr ecx, 1
mov dword [r14], ecx
call fcn.140002440
mov qword [rdi], rax
xor r8d, r8d
lea ebx, [r8 + 1]
cmp dword [r14], r8d
jbe 0x1400f6f20
lea ecx, [r8 + r8]
lea edx, [rcx + 1]
test edx, edx
js 0x1400f6f5c
mov rax, qword [rbp + 0x40]
cmp edx, dword [rax - 0x10]
jg 0x1400f6f5c
movsxd r9, ecx
movzx edx, word [rax + r9*2 + 2]
test ecx, ecx
js 0x1400f6f5c
cmp ecx, dword [rax - 0x10]
jg 0x1400f6f5c
shl dl, 4
sub dl, 0x51
add dl, byte [rax + r9*2]
mov rax, qword [rdi]
mov byte [r8 + rax], dl
add r8d, ebx
cmp r8d, dword [r14]
jb 0x1400f6ee1
mov rax, qword [rbp + 0x40]
lea rdx, [rax - 0x18]
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x1400f6f45
mov rcx, qword [rdx]
mov r8, qword [rcx]
mov rax, qword [r8 + 8]
call qword [case.0x140116099.0]
mov eax, ebx
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
mov ecx, 0x80070057
call fcn.14000ba80
int3
Function at 0x1400f6f68
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
cmp qword [rcx + 0xb0], 0
mov edi, r9d
mov rbx, r8
mov rax, rdx
je 0x1400f6fe3
xor r8d, r8d
call fcn.1400f7238
mov rsi, rax
test rax, rax
je 0x1400f6fdf
lea rax, [rsp + 0x50]
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x34]
lea rax, [rsp + 0x30]
xor r8d, r8d
mov rdx, rbx
mov qword [rsp + 0x20], rax
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x1400f6fdf
mov eax, dword [rsp + 0x30]
jmp 0x1400f6ff9
mov eax, edi
jmp 0x1400f6ff9
mov r9, qword [rcx + 0xd8]
mov r8d, edi
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret