joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401e0ec0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r12
push r14
push r15
sub rsp, 0x30
mov r14d, r8d
mov r15d, edx
mov r12, rcx
xor edi, edi
mov esi, edi
mov dword [rsp + 0x20], edi
mov rbx, qword [0x140698de8]
mov qword [rsp + 0x68], rdi
cmp dword [0x14068c074], edi
jne 0x1401e0f9f
mov eax, dword [0x14068c070]
test eax, eax
jne 0x1401e0f9f
mov edx, dword [0x14068c07c]
test edx, edx
je 0x1401e0f33
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x14068c070]
mov edx, dword [0x14068c07c]
test eax, eax
jne 0x1401e0f9f
test edx, edx
jne 0x1401e0f44
call fcn.14018bc50
test eax, eax
je 0x1401e0f5a
lea rdx, [rsp + 0x68]
mov rcx, qword [section..data]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
test eax, eax
jne 0x1401e0f9f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
add eax, 0xffffff82
cmp eax, 1
jbe 0x1401e0f95
cmp ecx, 0x78
je 0x1401e0f95
cmp ecx, 1
je 0x1401e0f95
cmp ecx, 0x32
je 0x1401e0f95
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop r12
ret
mov dword [0x14068c070], 1
test rbx, rbx
jne 0x1401e0fbf
lea rcx, str.ImageList_SetIconSize
call fcn.140199e30
mov rbx, rax
test rax, rax
je 0x1401e0fd0
mov qword [0x140698de8], rax
mov r8d, r14d
mov edx, r15d
mov rcx, r12
call rbx
mov esi, eax
mov dword [rsp + 0x20], eax
cmp dword [0x14068c074], 0
je 0x1401e0fe2
cmp dword [0x14068c070], 0
jne 0x1401e100e
mov ebx, edi
test esi, esi
sete bl
test ebx, ebx
je 0x1401e0ff5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rdx, qword [rsp + 0x68]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x1401e100e
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
jmp 0x1401e0f7b

Function at 0x1401e1020
Capabilities:
Print debug messages

Disassembly:
mov rax, rdx
mov rdx, rcx
mov rcx, rax
jmp fcn.140197000

Function at 0x1401e1260
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
xor esi, esi
mov rcx, qword [0x140698e50]
mov rbx, rdx
test rcx, rcx
je 0x1401e1290
call qword [sym.imp.GDI32.dll_DeleteObject]
mov qword [0x140698e50], rsi
mov rcx, qword [0x140698e58]
test rcx, rcx
je 0x1401e12a9
call qword [sym.imp.GDI32.dll_DeleteObject]
mov qword [0x140698e58], rsi
mov rcx, qword [0x140698e60]
test rcx, rcx
je 0x1401e12c2
call qword [sym.imp.GDI32.dll_DeleteObject]
mov qword [0x140698e60], rsi
mov rcx, qword [0x140698e68]
test rcx, rcx
je 0x1401e12db
call qword [sym.imp.GDI32.dll_DeleteObject]
mov qword [0x140698e68], rsi
mov rdx, rdi
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.140197000
Function at 0x1401e15c0
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov r10, r9
mov rdi, r8
mov rbx, rcx
cmp edx, 0x100
ja 0x1401e16fc
je 0x1401e16cd
lea eax, [rdx - 1]
cmp eax, 0x86
ja case.0x1401e160e.3
lea r8, [0x140000000]
movzx eax, byte [r8 + rax + 0x1e189c]
mov ecx, dword [r8 + rax*4 + 0x1e187c]
add rcx, r8
jmp rcx
mov rdx, rdi
mov rcx, rbx
call fcn.1401e4a60
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rdx, rdi
mov rcx, rbx
call fcn.1401e4ad0
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
xor edx, edx
mov rcx, rbx
call fcn.1401e3890
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rcx, qword [rbx + 0x50]
xor edx, edx
lea r8d, [rdx + 1]
call qword [sym.imp.USER32.dll_InvalidateRect]
mov rcx, qword [rbx + 0x50]
call qword [sym.imp.USER32.dll_UpdateWindow]
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call fcn.1401e4570
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rax, r10
movzx r8d, r10w
shr rax, 0x10
mov rdx, rdi
movzx r9d, ax
mov rcx, rbx
call fcn.1401e49f0
test eax, eax
je case.0x1401e160e.1
mov eax, 1
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rax, r10
movsx r9d, r10w
shr rax, 0x10
mov r8d, 1
movzx ecx, ax
mov edx, edi
mov dword [rsp + 0x20], ecx
mov rcx, rbx
call fcn.1401e47c0
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
cmp edx, 0x201
ja 0x1401e17de
je 0x1401e17b7
mov eax, edx
sub eax, 0x101
je 0x1401e176d
sub eax, 0x12
je 0x1401e1758
cmp eax, 0xed
jne case.0x1401e160e.3
cmp dword [rcx + 0x94], 0
jne case.0x1401e160e.1
mov rax, r10
movsx edx, r10w
shr rax, 0x10
mov r9d, edi
movsx r8d, ax
call fcn.1401e45d0
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rdx, rdi
call fcn.1401e4990
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
call qword [sym.imp.USER32.dll_GetCapture]
cmp rax, qword [rbx + 0x50]
je case.0x1401e160e.1
lea eax, [rdi - 0x21]
cmp eax, 7
ja case.0x1401e160e.1
mov r8, qword [rbx + 0xf8]
mov r9d, 8
mov edx, dword [rbx + 0x58]
mov rcx, rbx
mov dword [rsp + 0x20], 0
call qword [rbx + 0x100]
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rax, r10
movsx r8d, r10w
shr rax, 0x10
xor edx, edx
movsx r9d, ax
mov dword [rsp + 0x20], edi
call fcn.1401e41d0
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov eax, edx
sub eax, 0x202
je 0x1401e1855
sub eax, 1
je 0x1401e182b
cmp eax, 7
je 0x1401e1813
lea eax, [rdx - 0x400]
cmp eax, 0x7bff
ja case.0x1401e160e.1
mov r8, rdi
mov rcx, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp 0x1401e5340
mov rdx, rdi
call fcn.1401e46d0
mov eax, 0x69
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rax, r10
movsx r8d, r10w
shr rax, 0x10
mov edx, 1
movsx r9d, ax
mov dword [rsp + 0x20], edi
call fcn.1401e41d0
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rax, r10
movsx edx, r10w
shr rax, 0x10
mov r9d, edi
movsx r8d, ax
call fcn.1401e4570
mov rbx, qword [rsp + 0x40]
xor eax, eax
add rsp, 0x30
pop rdi
ret
Function at 0x1401e5d80
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov edi, dword [rsp + 0x58]
mov ebp, r9d
mov r14d, ecx
mov esi, r8d
mov ebx, edx
test edi, edi
jne 0x1401e5dd3
mov r10d, r9d
mov eax, 0x66666667
sub r10d, r8d
add r10d, 5
imul r10d
mov edi, edx
sar edi, 2
mov eax, edi
shr eax, 0x1f
add edi, eax
mov eax, 1
cmove edi, eax
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x1401e5de8
lea edi, [rdi + rdi*4]
add edi, edi
cmp r14d, 7
ja 0x1401e5e6c
cmp dword [rsp + 0x60], 0
lea rcx, [0x140000000]
je case.default.0x1401e5e07
mov eax, dword [rcx + r14*4 + 0x1e5e74]
add rax, rcx
jmp rax
add ebx, dword [rsp + 0x50]
jmp 0x1401e5e6c
cmp ebx, ebp
cmovg ebx, ebp
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov eax, dword [rcx + r14*4 + 0x1e5e94]
add rax, rcx
jmp rax
sub ebx, dword [rsp + 0x50]
jmp 0x1401e5e6c
cmp ebx, esi
jge 0x1401e5e2d
mov eax, esi
jmp 0x1401e5e34

Function at 0x1401e5ef0
Capabilities:
Print debug messages

Disassembly:
mov rax, rdx
mov rdx, rcx
mov rcx, rax
jmp fcn.140197000

Function at 0x1401eb6a0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov edi, dword [rsp + 0x58]
mov ebp, r9d
mov r14d, ecx
mov esi, r8d
mov ebx, edx
test edi, edi
jne 0x1401eb6f3
mov r10d, r9d
mov eax, 0x66666667
sub r10d, r8d
add r10d, 5
imul r10d
mov edi, edx
sar edi, 2
mov eax, edi
shr eax, 0x1f
add edi, eax
mov eax, 1
cmove edi, eax
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x1401eb708
lea edi, [rdi + rdi*4]
add edi, edi
cmp r14d, 7
ja 0x1401eb770
cmp dword [rsp + 0x60], 0
lea rcx, [0x140000000]
je case.default.0x1401eb727
mov eax, dword [rcx + r14*4 + 0x1eb778]
add rax, rcx
jmp rax
cmp ebx, ebp
cmovg ebx, ebp
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov eax, dword [rcx + r14*4 + 0x1eb798]
add rax, rcx
jmp rax
add ebx, dword [rsp + 0x50]
jmp 0x1401eb770
sub ebx, dword [rsp + 0x50]
jmp 0x1401eb770
cmp ebx, esi
jge 0x1401eb72f
mov eax, esi
jmp 0x1401eb736

Function at 0x1401eb820
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rbx, rdx
mov rcx, qword [0x140698eb8]
test rcx, rcx
je 0x1401eb84d
call qword [sym.imp.GDI32.dll_DeleteObject]
mov qword [0x140698eb8], 0
mov rdx, rdi
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.140197000
Function at 0x1401ed970
Capabilities:
Print debug messages

Disassembly:
mov rax, rdx
mov rdx, rcx
mov rcx, rax
jmp fcn.140197000

Function at 0x1401edb20
Capabilities:
Get graphical window text

Disassembly:
push rbx
sub rsp, 0x70
mov rax, qword [0x1406836b8]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbx, rcx
mov rcx, qword [rcx + 0x10]
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
test eax, eax
js 0x1401edd05
mov ecx, 0x1000
cmp eax, ecx
cmovg eax, ecx
test eax, eax
je 0x1401edd05
mov qword [rsp + 0x90], rsi
lea esi, [rax + 1]
movsxd rcx, esi
mov eax, 2
mul rcx
mov rcx, 0xffffffffffffffff
mov qword [rsp + 0x68], rdi
cmovo rax, rcx
mov ecx, 0x40
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rdi, rax
test rax, rax
je 0x1401edcf8
mov rcx, qword [rbx + 0x10]
mov r8d, esi
mov rdx, rax
mov qword [rsp + 0x60], r14
call qword [sym.imp.USER32.dll_GetWindowTextW]
movups xmm0, xmmword [rbx + 0x18]
mov rcx, qword [rbx + 0x10]
mov r14d, eax
movups xmmword [rsp + 0x40], xmm0
call qword [sym.imp.USER32.dll_GetDC]
mov rsi, rax
test rax, rax
je 0x1401edc61
mov rdx, qword [rbx + 0x140]
mov rcx, rax
mov qword [rsp + 0x88], rbp
call qword [sym.imp.GDI32.dll_SelectObject]
lea r9, [rsp + 0x40]
mov dword [rsp + 0x20], 0x400
mov r8d, r14d
mov rdx, rdi
mov rcx, rsi
mov rbp, rax
call qword [sym.imp.USER32.dll_DrawTextW]
mov r9d, dword [rbx + 0x1cc]
mov r8d, dword [rsp + 0x4c]
mov edx, r8d
mov r10d, dword [rsp + 0x44]
sub edx, r10d
add dword [rsp + 0x48], 0x14
lea ecx, [r9 + 1]
cmp edx, ecx
jge 0x1401edc44
lea eax, [r10 + 1]
add eax, r9d
mov dword [rsp + 0x4c], eax
jmp 0x1401edc4d
add r8d, 0xa
mov dword [rsp + 0x4c], r8d
mov rdx, rbp
mov rcx, rsi
call qword [sym.imp.GDI32.dll_SelectObject]
mov rbp, qword [rsp + 0x88]
mov edx, 2
mov rcx, rdi
call fcn.14039ba1c
mov eax, dword [rbx + 0x54]
mov r14, qword [rsp + 0x60]
lea rcx, [rax + rax*2]
mov rax, qword [rbx + 0x230]
movzx edx, word [rax + rcx*8 + 2]
movsx ecx, dx
cmp dx, 0x64
jg 0x1401edc94
mov ecx, 0x64
mov eax, dword [rsp + 0x40]
inc eax
add ecx, eax
mov eax, dword [rsp + 0x48]
cmp eax, ecx
cmovl eax, ecx
mov dword [rsp + 0x48], eax
mov rax, qword [rsp + 0x40]
cmp rax, qword [rbx + 0x18]
jne 0x1401edcbf
mov rax, qword [rsp + 0x48]
cmp rax, qword [rbx + 0x20]
je 0x1401edcf8
movups xmm0, xmmword [rsp + 0x40]
mov dword [rsp + 0x30], ILFindChild
xor edx, edx
movups xmmword [rbx + 0x18], xmm0
mov ecx, dword [rbx + 0x24]
mov r9d, dword [rbx + 0x1c]
sub ecx, r9d
mov eax, dword [rbx + 0x20]
mov r8d, dword [rbx + 0x18]
sub eax, r8d
mov dword [rsp + 0x28], ecx
mov rcx, qword [rbx + 0x10]
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_SetWindowPos]
mov rsi, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14039bbb0
add rsp, 0x70
pop rbx
ret
Function at 0x1401f0130
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
push rdi
sub rsp, 0x28
mov rbx, rcx
mov qword [rsp + 0x50], rbp
mov rcx, qword [rcx]
call qword [sym.imp.USER32.dll_IsWindow]
xor ebp, ebp
mov edx, 1
test eax, eax
mov edi, ebp
cmove edx, ebp
cmp qword [rbx + 8], rdi
cmovne edi, edx
test edi, edi
je 0x1401f01fd
cmp dword [rbx + 0x20], ebp
je 0x1401f01fd
mov rcx, qword [rbx]
lea edx, [rbp - 0x10]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.USER32.dll_GetWindowLongPtrW]
mov rsi, rax
bt eax, 0x15
jae 0x1401f01af
mov rcx, qword [rbx]
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x48]
lea edx, [rbp + 1]
call qword [sym.imp.USER32.dll_GetScrollRange]
mov ecx, dword [rsp + 0x40]
cmp dword [rsp + 0x48], ecx
je 0x1401f01af
mov dword [rbx + 0x1c], 1
bt esi, 0x14
mov rsi, qword [rsp + 0x20]
jae 0x1401f01e0
mov rcx, qword [rbx]
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x48]
xor edx, edx
call qword [sym.imp.USER32.dll_GetScrollRange]
mov eax, dword [rsp + 0x40]
cmp dword [rsp + 0x48], eax
je 0x1401f01e0
mov dword [rbx + 0x18], 1
cmp dword [rbx + 0x18], ebp
je 0x1401f0202
cmp dword [rbx + 0x1c], ebp
je 0x1401f01fd
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x1401f01fd
mov dword [rbx + 0x1c], ebp
cmp dword [rbx + 0x18], ebp
jne 0x1401f0208
cmp dword [rbx + 0x1c], ebp
cmove edi, ebp
mov r8d, dword [rbx + 0x24]
cmp r8d, 0x23e7
jne 0x1401f0222
mov dword [rbx + 0x24], 0x10
mov r8d, 0x10
cmp dword [rbx + 0x28], 0x23e7
jne 0x1401f0232
mov dword [rbx + 0x28], 0x4b
cmp dword [rbx + 0x2c], 0x23e7
jne 0x1401f0242
mov dword [rbx + 0x2c], 0x19
cmp dword [rbx + 0x30], 0x23e7
jne 0x1401f0252
mov dword [rbx + 0x30], 3
mov edx, dword [rbx + 0x10]
mov eax, edx
mov ecx, dword [rbx + 0x14]
sub eax, r8d
mov dword [rbx + 0x40], eax
mov eax, ecx
sub eax, r8d
mov qword [rbx + 0x50], rbp
mov dword [rbx + 0x44], eax
lea eax, [rdx + r8]
mov dword [rbx + 0x48], eax
lea eax, [rcx + r8]
mov qword [rbx + 0x58], rbp
mov qword [rbx + 0x60], rbp
mov qword [rbx + 0x68], rbp
mov qword [rbx + 0x70], rbp
mov rbp, qword [rsp + 0x50]
mov dword [rbx + 0x4c], eax
test edi, edi
je 0x1401f02ce
cmp dword [rbx + 0x20], 0
je 0x1401f02ce
mov edx, 1
mov rcx, rbx
call sym.ErrorReportClient.exe_SfWheel_AutoScrollOriginIcon
mov rcx, rbx
call sym.ErrorReportClient.exe_SfWheel_AutoScrollSetCursor
mov rcx, qword [rbx + 0x78]
call qword [sym.imp.USER32.dll_SetCapture]
mov r8d, dword [rbx + 0x28]
xor r9d, r9d
mov rcx, qword [rbx + 0x78]
mov edx, 0x23e7
call qword [sym.imp.USER32.dll_SetTimer]
mov eax, edi
add rsp, 0x28
pop rdi
pop rbx
ret
Function at 0x1401f03a0
Capabilities:
Log keystrokes via polling

Disassembly:
test r9d, r9d
je 0x1401f0523
push rbx
push rbp
push r14
push r15
sub rsp, 0x38
mov qword [rsp + 0x60], rsi
mov ebx, r9d
xor esi, esi
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x30], r13
mov r15d, r8d
mov ebp, edx
mov r14, rcx
lea r13d, [rsi + 1]
cmp edx, 0x23e7
jne 0x1401f0474
lea edx, [rsi - 0x10]
mov qword [rsp + 0x70], r12
mov edi, esi
mov ebp, esi
call qword [sym.imp.USER32.dll_GetWindowLongPtrW]
mov r12, rax
bt eax, 0x15
jae 0x1401f041c
lea r9, [rsp + 0x78]
mov edx, r13d
lea r8, [rsp + 0x20]
mov rcx, r14
call qword [sym.imp.USER32.dll_GetScrollRange]
mov ecx, dword [rsp + 0x78]
cmp dword [rsp + 0x20], ecx
cmovne edi, r13d
bt r12d, 0x14
mov r12, qword [rsp + 0x70]
jae 0x1401f045e
lea r9, [rsp + 0x78]
xor edx, edx
lea r8, [rsp + 0x20]
mov rcx, r14
call qword [sym.imp.USER32.dll_GetScrollRange]
mov eax, dword [rsp + 0x78]
cmp dword [rsp + 0x20], eax
je 0x1401f045e
mov ebp, r13d
test edi, edi
je 0x1401f0471
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x1401f0471
test edi, edi
je 0x1401f0469
mov ebp, 2
jmp 0x1401f0474
test ebp, ebp
je 0x1401f050a
mov ebp, r13d
cmp ebx, 0x23e7
jne 0x1401f0524
cmp qword [0x140699000], r14
jne 0x1401f0493
mov ebx, dword [0x140698ffc]
test ebx, ebx
jne 0x1401f04c5
xor edx, edx
lea r8, [0x140698ffc]
xor r9d, r9d
lea ecx, [rdx + 0x68]
call qword [sym.imp.USER32.dll_SystemParametersInfoW]
mov ebx, dword [0x140698ffc]
mov eax, 3
test ebx, ebx
mov qword [0x140699000], r14
cmove ebx, eax
mov dword [0x140698ffc], ebx
cmp ebp, r13d
jne 0x1401f052e
mov ebx, r13d
cmp r15d, r13d
mov rdi, rsi
setne dil
test ebx, ebx
jle 0x1401f050a
cmp ebp, r13d
setne sil
nop dword [rax]
nop word [rax + rax]
xor r9d, r9d
lea edx, [rsi + 0x114]
mov r8, rdi
mov rcx, r14
call qword [sym.imp.USER32.dll_SendMessageW]
sub rbx, r13
jne 0x1401f04f0
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x60]
mov r13, qword [rsp + 0x30]
add rsp, 0x38
pop r15
pop r14
pop rbp
pop rbx
ret
mov eax, 5
cmp ebx, eax
cmova ebx, eax
cmp ebp, 2
jne 0x1401f04cd
cmp ebx, 0xffffffff
jne 0x1401f04cd
cmp r15d, r13d
mov ebx, r13d
mov rdi, rsi
setne dil
add rdi, 2
jmp 0x1401f04db
Function at 0x1401f0fb0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
mov dword [0x14067bf78], edx
jmp sym.ErrorReportClient.exe_SfWheel_ExcludeIntelliPointScrolling
Function at 0x1401f53a0
Capabilities:
Capture screenshot

Disassembly:
mov r11, rsp
push rdi
push r12
push r15
sub rsp, 0xd0
mov rax, qword [0x1406836b8]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov qword [r11 + 0x18], rbp
mov r15, rcx
mov qword [r11 - 0x20], rsi
mov qword [r11 - 0x28], r14
call qword [sym.imp.USER32.dll_GetDC]
xor edx, edx
mov rcx, r15
mov r12, rax
mov rsi, rax
call qword [sym.imp.USER32.dll_GetWindowLongPtrW]
mov rdi, rax
test rsi, rsi
jne 0x1401f5406
mov rcx, qword [rax + 0x2d0]
lea rdx, [rsp + 0x60]
call qword [sym.imp.USER32.dll_BeginPaint]
mov rsi, rax
jmp 0x1401f5417
mov qword [rsp + 0x60], 0
mov dword [rsp + 0x68], 1
mov rcx, qword [rdi + 0x2d0]
lea rdx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_GetClientRect]
mov rcx, qword [rdi + 0x2d0]
mov edx, 0xfffffff0
call qword [sym.imp.USER32.dll_GetWindowLongPtrW]
mov rcx, rsi
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov r8d, dword [rsp + 0x5c]
mov rcx, rsi
mov edx, dword [rsp + 0x58]
mov rbp, rax
call qword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov r14, rax
test rbp, rbp
je 0x1401f54e5
test rax, rax
je 0x1401f54e5
mov rdx, rax
mov qword [rsp + 0xf8], rbx
mov rcx, rbp
call qword [sym.imp.GDI32.dll_SelectObject]
mov rdx, rbp
mov rcx, rdi
mov rbx, rax
call fcn.1401f3870
mov rdx, rbp
mov rcx, rdi
call fcn.1401f5160
mov ecx, dword [rsp + 0x5c]
xor r8d, r8d
mov r9d, dword [rsp + 0x58]
xor edx, edx
mov dword [rsp + 0x40], 0xcc0020
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], ecx
mov rcx, rsi
call qword [sym.imp.GDI32.dll_BitBlt]
mov rdx, rbx
mov rcx, rbp
call qword [sym.imp.GDI32.dll_SelectObject]
mov rbx, qword [rsp + 0xf8]
jmp 0x1401f5500
test rsi, rsi
je 0x1401f5500
mov rdx, rsi
mov rcx, rdi
call fcn.1401f3870
mov rdx, rsi
mov rcx, rdi
call fcn.1401f5160
mov rsi, qword [rsp + 0xc8]
test r14, r14
je 0x1401f5516
mov rcx, r14
call qword [sym.imp.GDI32.dll_DeleteObject]
mov r14, qword [rsp + 0xc0]
test rbp, rbp
je 0x1401f552c
mov rcx, rbp
call qword [sym.imp.GDI32.dll_DeleteDC]
cmp qword [rsp + 0x60], 0
mov rbp, qword [rsp + 0x100]
je 0x1401f554e
mov rcx, qword [rdi + 0x2d0]
lea rdx, [rsp + 0x60]
call qword [sym.imp.USER32.dll_EndPaint]
mov rdx, r12
mov rcx, r15
call qword [sym.imp.USER32.dll_ReleaseDC]
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.14039bbb0
add rsp, 0xd0
pop r15
pop r12
pop rdi
ret
Function at 0x1401f9600
Capabilities:
Print debug messages

Disassembly:
mov rax, rdx
mov rdx, rcx
mov rcx, rax
jmp fcn.140197000
Function at 0x1401fe610
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rbx, rdx
mov rcx, qword [0x140699018]
test rcx, rcx
je 0x1401fe65a
mov rdx, qword [0x140699020]
call qword [sym.imp.GDI32.dll_SelectObject]
mov rcx, rax
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, qword [0x140699018]
call qword [sym.imp.GDI32.dll_DeleteDC]
xorps xmm0, xmm0
movdqu xmmword [0x140699018], xmm0
mov rdx, rdi
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.140197000
Function at 0x140202850
Capabilities:
Check for unmoving mouse cursor
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov esi, edx
mov ebx, r9d
xor edx, edx
mov edi, r8d
call qword [sym.imp.USER32.dll_GetWindowLongPtrW]
mov r9d, ebx
mov r8d, edi
mov edx, esi
lea rcx, [rax + 0x88]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp fcn.1402022b0
Function at 0x140216250
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r12
push r14
push r15
sub rsp, 0x30
mov r14d, r8d
mov r15, rdx
mov r12, rcx
mov ebx, 0xffffffff
mov dword [rsp + 0x20], ebx
mov rdi, qword [0x1406990e0]
xor esi, esi
mov qword [rsp + 0x68], rsi
cmp dword [0x14068c074], esi
jne 0x14021630e
mov eax, dword [0x14068c070]
test eax, eax
jne 0x14021630e
mov ecx, dword [0x14068c07c]
test ecx, ecx
je 0x1402162be
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x14068c070]
mov ecx, dword [0x14068c07c]
test eax, eax
jne 0x14021630e
test ecx, ecx
jne 0x1402162cf
call fcn.14018bc50
test eax, eax
je 0x1402162e5
lea rdx, [rsp + 0x68]
mov rcx, qword [section..data]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
test eax, eax
jne 0x14021630e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
add eax, 0xffffff82
cmp eax, 1
jbe 0x140216304
cmp ecx, 0x78
je 0x140216304
cmp ecx, 1
je 0x140216304
cmp ecx, 0x32
jne 0x14021637f
mov dword [0x14068c070], 1
test rdi, rdi
jne 0x14021632e
lea rcx, str.ImageList_AddMasked
call fcn.140199e30
mov rdi, rax
test rax, rax
je 0x14021633f
mov qword [0x1406990e0], rax
mov r8d, r14d
mov rdx, r15
mov rcx, r12
call rdi
mov ebx, eax
mov dword [rsp + 0x20], eax
cmp dword [0x14068c074], 0
je 0x140216351
cmp dword [0x14068c070], 0
jne 0x14021637f
mov edi, esi
cmp ebx, 0xffffffff
sete dil
test edi, edi
je 0x140216366
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov rdx, qword [rsp + 0x68]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test edi, edi
je 0x14021637f
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop r12
ret