joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100029980
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x20
mov eax, r8d
mov rbp, rdx
mov r14d, 1
shr eax, 4
mov ebx, r8d
mov rsi, rcx
add ax, r14w
lea r8d, [r14 + 5]
mov rcx, rbp
movzx edx, ax
call qword [sym.imp.KERNEL32.DLL_FindResourceW]
xor r13d, r13d
mov r12, rax
cmp rax, r13
je 0x10002cfe4
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_LoadResource]
cmp rax, r13
je 0x10002cfe4
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_LockResource]
mov rdi, rax
cmp rax, r13
je 0x10002cfe4
mov rdx, r12
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_SizeofResource]
mov r11d, eax
add r11, rdi
and ebx, 0xf
jbe 0x100029a2c
cmp rdi, r11
jae 0x10002cfe4
add ebx, 0xffffffff
movzx eax, word [rdi]
lea rdi, [rdi + rax*2 + 2]
jne 0x100029a16
cmp rdi, r11
jae 0x10002cfe4
cmp word [rdi], r13w
je 0x10002cfe4
mov rax, qword [rsi]
movzx ebx, word [rdi]
mov ecx, r14d
sub ecx, dword [rax - 8]
mov eax, dword [rax - 0xc]
sub eax, ebx
or ecx, eax
jge 0x100029a5e
mov edx, ebx
mov rcx, rsi
call fcn.100022420
movzx ecx, word [rdi]
lea r8, [rdi + 2]
cmp ecx, 0xffffffff
je 0x10002cf86
movsxd r9, ecx
mov rcx, qword [rsi]
lea rdi, [rbx + rbx]
mov rdx, rdi
add r9, r9
call sub.msvcrt.dll_memcpy_s
cmp eax, r13d
jne 0x10002cfa0
cmp ebx, r13d
jl 0x10002cfd9
mov rcx, qword [rsi]
cmp ebx, dword [rcx - 0xc]
jg 0x10002cfd9
mov dword [rcx - 0x10], ebx
mov rcx, qword [rsi]
mov eax, r14d
mov word [rdi + rcx], r13w
jmp 0x100029ab1
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop r13
pop r12
ret
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r8
repne scasw ax, word [rdi]
not rcx
sub rcx, r14
add ecx, r14d
jmp 0x100029a6e
cmp eax, 0xc
je 0x10002cfce
cmp eax, 0x16
je 0x10002cfc3
cmp eax, 0x22
je 0x10002cfc3
cmp eax, 0x50
je 0x100029a8c
mov ecx, 0x80004005
call fcn.10003dc70
int3
mov ecx, 0x80070057
call fcn.10003dc70
int3
mov ecx, 0x8007000e
call fcn.10003dc70
int3
mov ecx, 0x80070057
call fcn.10003dc70
int3
xor eax, eax
jmp 0x100029ab1
Function at 0x100029f90
Capabilities:
Get graphical window text

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x30
xor r13d, r13d
mov rbp, rdx
mov r12, rcx
mov qword [rax + 8], r13
mov qword [rax + 0x10], r13
movabs r14, 0x8001000000010000
cmp dword [0x1000747b4], r13d
jne 0x10002e269
mov rax, qword [0x100073a50]
mov rdi, qword [rax + 0xb0]
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov rcx, 0xffffffffffffffff
lea ebx, [rax + 1]
mov eax, 2
movsxd rdx, ebx
mul rdx
cmovo rax, rcx
mov rcx, rax
call fcn.100001f90
mov r8d, ebx
mov rcx, rdi
mov rdx, rax
mov rsi, rax
mov word [rax], r13w
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov rcx, qword [0x100073578]
mov r8d, ebx
mov rcx, qword [rcx + 0x20]
mov rdx, rsi
call fcn.100003154
mov rcx, qword [r12 + 0x118]
lea rax, [rsp + 0x68]
shr rbp, 0x10
lea r9, [rsp + 0x60]
mov r8, rsi
movzx edx, bp
mov qword [rsp + 0x20], rax
call fcn.10002a0c4
mov ebx, eax
cmp eax, r13d
je 0x10002e2be
mov rcx, rsi
call sub.msvcrt.dll_free
mov rcx, qword [rsp + 0x60]
cmp rcx, r13
je 0x10002a07c
call qword [sym.imp.msvcrt.dll_free]
mov rcx, qword [rsp + 0x68]
cmp rcx, r13
jne 0x10002e2d7
cmp dword [0x1000747b4], r13d
jne 0x10002e2e3
mov rax, qword [0x100073278]
mov rbp, qword [rsp + 0x78]
or dword [rax + 0x34], 2
mov eax, ebx
mov rbx, qword [rsp + 0x70]
add rsp, 0x30
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
mov al, byte [0x1000747b8]
cmp al, 4
jae 0x10002e27c
cmp al, r13b
jne 0x100029fcf
test qword [0x1000747a0], r14
je 0x100029fcf
mov rcx, qword [0x1000747a8]
mov rax, rcx
and rax, r14
cmp rax, rcx
jne 0x100029fcf
mov rcx, qword [0x100073280]
lea rdx, [0x100064c98]
mov r8d, 0x18
call fcn.10003f210
nop
jmp 0x100029fcf
mov rcx, qword [0x100073278]
or dword [rcx + 0x34], 4
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBeep]
nop
jmp 0x10002a064
call qword [sym.imp.msvcrt.dll_free]
nop
jmp 0x10002a08a
mov al, byte [0x1000747b8]
cmp al, 4
jae 0x10002e2f6
cmp al, r13b
jne 0x10002a097
test qword [0x1000747a0], r14
je 0x10002a097
mov rcx, qword [0x1000747a8]
mov rax, rcx
and rax, r14
cmp rax, rcx
jne 0x10002a097
mov rcx, qword [0x100073280]
lea rdx, [0x100064ca8]
mov r8d, 0x19
call fcn.10003f210
nop
jmp 0x10002a097

Function at 0x10002a41c
Capabilities:
Hide graphical window

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0xc0]
call qword [sym.imp.USER32.dll_SetFocus]
mov rcx, qword [rbx + 0xb0]
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [rbx + 0xb0]
call qword [sym.imp.USER32.dll_DestroyWindow]
mov rcx, qword [rbx + 0xb0]
mov edx, 6
call fcn.10002502c
mov rcx, qword [rbx + 0xc0]
mov edx, 1
call qword [sym.imp.USER32.dll_EnableWindow]
mov rcx, rbx
call fcn.100008bb8
mov rcx, qword [rbx + 0xb8]
and qword [rbx + 0xb0], 0
mov edx, 0x41b
call qword [sym.imp.USER32.dll_GetDlgItem]
mov edx, 1
mov rcx, rax
call qword [sym.imp.USER32.dll_EnableWindow]
mov rcx, qword [rbx + 0xb8]
mov edx, 0x41c
call qword [sym.imp.USER32.dll_GetDlgItem]
mov edx, 1
mov rcx, rax
add rsp, 0x20
pop rbx
jmp qword [sym.imp.USER32.dll_EnableWindow]
Function at 0x10002b08c
Capabilities:
Set registry value

Disassembly:
push rdi
sub rsp, 0x50
cmp dword [0x1000747b4], 0
movabs rdi, 0x8001000000010000
jne 0x10002eb45
cmp byte [0x100073584], 0
mov rcx, qword [0x1000735d0]
sete byte [0x100073584]
call qword [sym.imp.USER32.dll_GetParent]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetMenu]
mov cl, byte [0x100073584]
mov edx, 0x3c5
neg cl
mov rcx, rax
sbb r8d, r8d
and r8d, 8
call qword [sym.imp.USER32.dll_CheckMenuItem]
and qword [rsp + 0x40], 0
lea rax, [rsp + 0x70]
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], 0
lea rdx, str.SoftwareMicrosoftCalc
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x28], 0x20006
and dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x10002b170
cmp byte [0x100073584], al
mov rcx, qword [rsp + 0x70]
lea rdx, str.ShowHistory
setne al
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x68], eax
lea rax, [rsp + 0x68]
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edx, edx
lea rcx, [0x100073460]
lea r8d, [rdx + 1]
call fcn.100022e74
cmp dword [0x1000747b4], 0
jne 0x10002eb99
add rsp, 0x50
pop rdi
ret
mov al, byte [0x1000747b8]
cmp al, 4
jae 0x10002eb57
test al, al
jne 0x10002b0a9
test qword [0x1000747a0], rdi
je 0x10002b0a9
mov rcx, qword [0x1000747a8]
mov rax, rcx
and rax, rdi
cmp rax, rcx
jne 0x10002b0a9
mov rcx, qword [0x100073280]
lea rdx, [0x100064b28]
mov r8d, 1
call fcn.10003f210
nop
jmp 0x10002b0a9
mov al, byte [0x1000747b8]
cmp al, 4
jae 0x10002ebab
test al, al
jne 0x10002b18f
test qword [0x1000747a0], rdi
je 0x10002b18f
mov rcx, qword [0x1000747a8]
mov rax, rcx
and rax, rdi
cmp rax, rcx
jne 0x10002b18f
mov rcx, qword [0x100073280]
lea rdx, [0x100064b38]
mov r8d, 2
call fcn.10003f210
nop
jmp 0x10002b18f
Function at 0x10002b220
Capabilities:
Hide graphical window

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
push rdi
sub rsp, 0x80
and qword [rax + 8], 0
mov rdi, rcx
mov rcx, qword [rcx + 0xc0]
xor r9d, r9d
xor r8d, r8d
mov edx, reloc.COMCTL32.dll_Ordinal_392
call qword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
js 0x10002b412
cmp qword [rdi + 0xb0], 0
jne 0x10002b412
mov rcx, qword [rdi + 0xc0]
lea r9, [rsp + 0x60]
movsxd r8, eax
mov edx, SetWindowSubclass
mov dword [rdi + 0xd0], eax
call qword [sym.imp.USER32.dll_SendMessageW]
mov r11, qword [rdi]
lea rdx, [rsp + 0x90]
mov rcx, rdi
call qword [r11]
cmp qword [rsp + 0x90], 0
je 0x10002b412
mov rcx, qword [rdi + 0xc0]
lea rdx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_GetClientRect]
mov ebx, dword [rsp + 0x6c]
cmp dword [rsp + 0x7c], ebx
cmovl ebx, dword [rsp + 0x7c]
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
and qword [rsp + 0x58], 0
mov r8d, dword [rsp + 0x64]
mov edx, dword [rsp + 0x68]
mov ecx, dword [rsp + 0x60]
mov qword [rsp + 0x50], rax
and qword [rsp + 0x48], 0
mov rax, qword [rdi + 0xc0]
sub ebx, r8d
mov qword [rsp + 0x40], rax
dec edx
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], edx
inc ecx
mov dword [rsp + 0x28], r8d
mov r8, qword [rsp + 0x90]
mov dword [rsp + 0x20], ecx
lea rdx, str.EDIT
mov r9d, 0x50000046
mov ecx, 8
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov rcx, qword [rsp + 0x90]
mov qword [rdi + 0xb0], rax
call sub.msvcrt.dll_free
mov edx, dword [rdi + 0xd4]
mov rcx, qword [rdi + 0xb0]
call fcn.10002502c
mov r9, qword [rdi + 0xb8]
mov rcx, qword [rdi + 0xb0]
lea rdx, [0x10002ab20]
mov r8d, 1
call sub.COMCTL32.dll_SetWindowSubclass
mov rcx, qword [rdi + 0xb0]
mov r8, rdi
mov edx, 0xffffffeb
call qword [sym.imp.USER32.dll_SetWindowLongPtrW]
mov r8, qword [rdi + 0x58]
mov rcx, qword [rdi + 0xb0]
xor r9d, r9d
lea edx, [r9 + 0x30]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rdi + 0xb0]
mov edx, 0xfffffff4
mov r8d, reloc.COMCTL32.dll_SetWindowSubclass
call qword [sym.imp.USER32.dll_SetWindowLongW]
mov rcx, qword [rdi + 0xb0]
mov edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [rdi + 0xb8]
mov edx, 0x41b
call qword [sym.imp.USER32.dll_GetDlgItem]
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_EnableWindow]
mov rcx, qword [rdi + 0xb8]
mov edx, 0x41c
call qword [sym.imp.USER32.dll_GetDlgItem]
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_EnableWindow]
mov rcx, qword [rdi + 0xb0]
call qword [sym.imp.USER32.dll_SetFocus]
mov rbx, qword [rsp + 0x98]
add rsp, 0x80
pop rdi
ret
Function at 0x10003ee60
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
cmp byte [0x100073586], bl
je 0x10003ee7b
mov byte [0x100073586], bl
xor r9d, r9d
jmp 0x10003eeeb
cmp byte [0x100073585], bl
je 0x10003eeaf
mov rdx, qword [0x100073560]
lea rcx, [0x100073460]
xor r9d, r9d
mov r8d, 0x2cb
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
call fcn.10000e6e8
mov byte [0x100073585], bl
jmp 0x10003eee1
cmp byte [0x100073587], bl
je 0x10003eee1
mov rdx, qword [0x100073570]
lea rcx, [0x100073460]
xor r9d, r9d
mov r8d, 0xfa0
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
call fcn.10000e6e8
mov byte [0x100073587], bl
mov byte [0x100073586], 1
mov r9b, 1
mov rdx, qword [0x100073568]
lea rcx, [0x100073460]
mov r8d, 0xeb
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 1
call fcn.10000e6e8
add rsp, 0x30
pop rbx
jmp fcn.10000fed8

Function at 0x10003ef20
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
cmp byte [0x100073587], bl
je 0x10003ef3b
mov byte [0x100073587], bl
xor r9d, r9d
jmp 0x10003efab
cmp byte [0x100073586], bl
je 0x10003ef6f
mov rdx, qword [0x100073568]
lea rcx, [0x100073460]
xor r9d, r9d
mov r8d, 0xeb
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
call fcn.10000e6e8
mov byte [0x100073586], bl
jmp 0x10003efa1
cmp byte [0x100073585], bl
je 0x10003efa1
mov rdx, qword [0x100073560]
lea rcx, [0x100073460]
xor r9d, r9d
mov r8d, 0x2cb
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
call fcn.10000e6e8
mov byte [0x100073585], bl
mov byte [0x100073587], 1
mov r9b, 1
mov rdx, qword [0x100073570]
lea rcx, [0x100073460]
mov r8d, 0xfa0
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 1
call fcn.10000e6e8
add rsp, 0x30
pop rbx
jmp fcn.10000fed8

Function at 0x100040230
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xb0
mov rax, qword [0x1000730b0]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov rdi, rcx
mov rcx, qword [rcx + 0x420]
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
xor esi, esi
cmp eax, esi
jbe 0x1000402fc
mov rcx, qword [rdi + 0x420]
lea ebx, [rsi + 0x40]
lea rdx, [rsp + 0x20]
mov r8d, ebx
call qword [sym.imp.USER32.dll_GetWindowTextW]
lea r11d, [rsi + 0x2d]
cmp word [rsp + 0x20], r11w
jne 0x1000402c7
lea rcx, [rsp + 0x20]
lea rax, [rbx + 0x7fffffbe]
cmp rax, rsi
je 0x1000402b9
movzx edx, word [rcx + 2]
cmp dx, si
je 0x1000402b9
mov word [rcx], dx
add rcx, 2
sub rbx, 1
jne 0x100040297
cmp rbx, rsi
jne 0x1000402c2
sub rcx, 2
mov word [rcx], si
jmp 0x1000402ea
mov rcx, qword [rdi + 0x420]
lea rdx, [rsp + 0x22]
mov r8d, 0x3f
mov word [rsp + 0x20], r11w
mov word [rsp + 0x22], si
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov rcx, qword [rdi + 0x420]
lea rdx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov al, 1
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.100001c30
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x10004032c
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0xb0
mov rax, qword [0x1000730b0]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov rbp, rcx
mov rcx, qword [rcx + 0x420]
movzx r12d, dx
mov esi, 0x40
lea rdx, [rsp + 0x20]
mov r8d, esi
call qword [sym.imp.USER32.dll_GetWindowTextW]
xor ebx, ebx
mov r11, rsi
mov edi, ebx
lea rax, [rsp + 0x20]
cmp word [rax], bx
je 0x10004038f
add rax, 2
sub r11, 1
jne 0x100040380
cmp r11, rbx
jne 0x10004039b
mov edi, 0x80070057
jmp 0x1000403bb
mov rcx, qword [rbp + 0x420]
sub rsi, r11
lea rdx, [rsp + 0x20]
mov word [rsp + rsi*2 + 0x20], r12w
mov word [rsp + rsi*2 + 0x22], bx
call qword [sym.imp.USER32.dll_SetWindowTextW]
cmp edi, ebx
sete al
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.100001c30
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
Function at 0x1000429f0
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
sub rsp, 0x440
mov rax, qword [0x1000730b0]
xor rax, rsp
mov qword [rsp + 0x430], rax
mov rbx, rcx
mov rsi, r8
xor r12d, r12d
lea rcx, [rsp + 0x42]
xor edx, edx
mov r8d, 0x3e6
mov ebp, r12d
mov word [rsp + 0x40], r12w
call sub.msvcrt.dll_memset
lea r9d, [r12 + 0xa]
lea r8, [rsp + 0x20]
lea edx, [r12 + 0xc]
mov ecx, 0x400
mov word [rbx], r12w
call qword [sym.imp.KERNEL32.DLL_GetLocaleInfoW]
mov r9d, dword [rsi]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x20]
repne scasw ax, word [rdi]
cmp r9d, r12d
mov edi, 0x1f4
not rcx
lea rax, [rcx - 1]
lea ecx, [r12 + 0x20]
cdqe
mov word [rsp + rax*2 + 0x20], cx
mov word [rsp + rax*2 + 0x22], r12w
jle 0x100042ad5
lea r8, [0x100065230]
lea rcx, [rsp + 0x40]
mov rdx, rdi
call fcn.10001e3d4
lea r8, [rsp + 0x40]
mov rdx, rdi
mov rcx, rbx
call fcn.1000031d4
cmp eax, r12d
jne 0x100042ad0
cmp dword [rsi], 1
mov r8, rdi
mov rdx, rbx
mov ecx, 0x390
jg 0x100042acb
mov ecx, 0x391
call fcn.10004295c
mov ebp, 1
cmp dword [rsi + 4], r12d
jle 0x100042b3f
cmp ebp, r12d
je 0x100042af2
lea r8, [rsp + 0x20]
mov rdx, rdi
mov rcx, rbx
call fcn.1000031d4
jmp 0x100042af7
mov ebp, 1
mov r9d, dword [rsi + 4]
lea r8, [0x100065230]
lea rcx, [rsp + 0x40]
mov rdx, rdi
call fcn.10001e3d4
lea r8, [rsp + 0x40]
mov rdx, rdi
mov rcx, rbx
call fcn.1000031d4
cmp eax, r12d
jne 0x100042b3f
cmp dword [rsi + 4], 1
mov r8, rdi
mov rdx, rbx
mov ecx, 0x392
jg 0x100042b3a
mov ecx, 0x393
call fcn.10004295c
cmp dword [rsi + 8], r12d
jle 0x100042ba9
cmp ebp, r12d
je 0x100042b5c
lea r8, [rsp + 0x20]
mov rdx, rdi
mov rcx, rbx
call fcn.1000031d4
jmp 0x100042b61
mov ebp, 1
mov r9d, dword [rsi + 8]
lea r8, [0x100065230]
lea rcx, [rsp + 0x40]
mov rdx, rdi
call fcn.10001e3d4
lea r8, [rsp + 0x40]
mov rdx, rdi
mov rcx, rbx
call fcn.1000031d4
cmp eax, r12d
jne 0x100042ba9
cmp dword [rsi + 8], 1
mov r8, rdi
mov rdx, rbx
mov ecx, 0x394
jg 0x100042ba4
mov ecx, 0x395
call fcn.10004295c
cmp dword [rsi + 0xc], r12d
jle 0x100042c0c
cmp ebp, r12d
je 0x100042bc4
lea r8, [rsp + 0x20]
mov rdx, rdi
mov rcx, rbx
call fcn.1000031d4
mov r9d, dword [rsi + 0xc]
lea r8, [0x100065230]
lea rcx, [rsp + 0x40]
mov rdx, rdi
call fcn.10001e3d4
lea r8, [rsp + 0x40]
mov rdx, rdi
mov rcx, rbx
call fcn.1000031d4
cmp eax, r12d
jne 0x100042c0c
cmp dword [rsi + 0xc], 1
mov r8, rdi
mov rdx, rbx
mov ecx, 0x396
jg 0x100042c07
mov ecx, 0x397
call fcn.10004295c
mov rcx, qword [rsp + 0x430]
xor rcx, rsp
call fcn.100001c30
lea r11, [rsp + 0x440]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
Function at 0x1000447f0
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x5f0
mov rax, qword [0x1000730b0]
xor rax, rsp
mov qword [rsp + 0x5e0], rax
xor edi, edi
mov rbx, rcx
mov rcx, qword [rcx + 0xb0]
mov rbp, rdx
lea rdx, [rsp + 0x60]
lea r8d, [rdi + 0x64]
mov rsi, rdi
mov qword [rsp + 0x30], rdi
call qword [sym.imp.USER32.dll_GetWindowTextW]
cmp word [rsp + 0x60], di
jne 0x10004485b
cmp rbp, 0x2b
jne 0x100044854
mov rcx, rbx
call fcn.100044590
mov al, 1
jmp 0x100044a62
mov rcx, qword [0x100073578]
lea rdx, [rsp + 0x60]
mov r8d, 0x64
mov rcx, qword [rcx + 0x20]
call fcn.100003154
mov r9d, dword [0x100073064]
mov edx, 0x64
lea r8d, [rdx - 0x60]
lea rcx, [rsp + 0x60]
call fcn.100003a78
cmp eax, edi
jne 0x1000449e6
mov rcx, qword [0x100073578]
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x60]
call fcn.1000132ac
cmp eax, edi
je 0x1000449d5
mov rcx, qword [rbx + 0xb0]
lea rdx, [rsp + 0x60]
mov r8d, 0x64
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov rsi, qword [rsp + 0x30]
cmp rbp, 0xd
je 0x1000448df
cmp rbp, 9
jne 0x1000448ea
cmp word [rsp + 0x60], di
je 0x100044986
movsxd r8, dword [rbx + 0xd0]
mov rcx, qword [rbx + 0xc0]
xor r9d, r9d
mov edx, 0x182
call qword [sym.imp.USER32.dll_SendMessageW]
cmp word [rsp + 0x60], di
je 0x100044986
mov rax, qword [0x100073578]
mov r9, rsi
mov rcx, qword [rax + 0x20]
mov rax, qword [rcx]
cmp dword [rax + 0x358], edi
je 0x100044964
mov edx, dword [0x100073060]
mov eax, 0x2d
lea rcx, [0x1000747e0]
cmp ax, word [rsi]
lea rax, [rsp + 0x130]
mov dword [rsp + 0x28], 0x54
sete dil
mov qword [rsp + 0x20], rax
mov r8d, edi
call fcn.10005224c
lea r9, [rsp + 0x130]
movsxd r8, dword [rbx + 0xd0]
mov rcx, qword [rbx + 0xc0]
mov edx, 0x181
call qword [sym.imp.USER32.dll_SendMessageW]
movsxd r8, dword [rbx + 0xd0]
jmp 0x1000449b0
mov rcx, qword [rbx + 0xc0]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x18b
call qword [sym.imp.USER32.dll_SendMessageW]
movsxd rcx, dword [rbx + 0xd0]
lea r8, [rcx - 1]
cmp eax, ecx
je 0x1000449b0
mov r8, rcx
mov rcx, qword [rbx + 0xc0]
xor r9d, r9d
mov edx, Ordinal_392
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, rbx
call fcn.1000130b0
mov dil, 1
jmp 0x100044a56
mov rsi, qword [rsp + 0x30]
cmp rsi, rdi
je 0x1000449fa
mov qword [rsp + 0x48], rsi
jmp 0x100044a2b
cmp eax, 0x77
jne 0x1000449fa
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
mov edx, 0x77
jmp 0x100044a07
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
mov edx, SHStripMneumonicW
lea r8, [rsp + 0x1e0]
mov r9d, 0x200
mov rcx, rax
call qword [sym.imp.USER32.dll_LoadStringW]
lea rax, [rsp + 0x1e0]
mov qword [rsp + 0x48], rax
mov rcx, qword [rbx + 0xb0]
lea r9, [rsp + 0x38]
xor r8d, r8d
mov edx, 0x1503
mov dword [rsp + 0x38], 0x20
mov qword [rsp + 0x40], rdi
mov dword [rsp + 0x50], edi
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_free]
mov al, dil
mov rcx, qword [rsp + 0x5e0]
xor rcx, rsp
call fcn.100001c30
lea r11, [rsp + 0x5f0]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x100046200
Capabilities:
Read .ini file

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x70
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov rax, qword [0x1000730b0]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov r12, r9
mov rbx, r8
mov rdi, rdx
mov ecx, 0x4e20
call fcn.100001f90
mov rsi, rax
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0x2710
mov r9, rax
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringW]
mov ebp, eax
xor r13d, r13d
cmp eax, r13d
jbe 0x1000462cf
mov ebx, r13d
mov ecx, ebx
lea rdx, [rsi + rcx*2]
mov qword [rsp + 0x58], 7
mov qword [rsp + 0x50], r13
mov word [rsp + 0x40], r13w
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [rsp + 0x38]
call fcn.10001b608
nop
mov eax, dword [rsp + 0x50]
lea ebx, [rbx + rax + 1]
lea rdx, [rsp + 0x38]
mov rcx, r12
call fcn.100049080
nop
cmp qword [rsp + 0x58], 8
jb 0x1000462cb
mov rcx, qword [rsp + 0x40]
call sub.msvcrt.dll_free
cmp ebp, ebx
ja 0x10004626b
mov rcx, rsi
call sub.msvcrt.dll_free
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.100001c30
mov rbx, qword [rsp + 0xa0]
add rsp, 0x70
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x100051028
Capabilities:
Get geographical location
Link many functions at runtime

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x1000730b0]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rbx, rcx
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.DLL_LoadLibraryW]
lea rdx, str.AdjustCalendarDate
mov rcx, rax
mov qword [rbx + 0x38], rax
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov rcx, qword [rbx + 0x38]
lea rdx, str.ConvertCalDateTimeToSystemTime
mov qword [rbx], rax
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov rcx, qword [rbx + 0x38]
lea rdx, str.ConvertSystemTimeToCalDateTime
mov qword [rbx + 0x10], rax
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov rcx, qword [rbx + 0x38]
lea rdx, str.GetCalendarMonthsInYear
mov qword [rbx + 8], rax
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov rcx, qword [rbx + 0x38]
lea rdx, str.GetCalendarDaysInMonth
mov qword [rbx + 0x18], rax
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov rcx, qword [rbx + 0x38]
lea rdx, str.GetCalendarDifferenceInDays
mov qword [rbx + 0x20], rax
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov rcx, qword [rbx + 0x38]
lea rdx, str.CompareCalendarDates
mov qword [rbx + 0x28], rax
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
lea r8, [rsp + 0x20]
mov r9d, 8
mov edx, 0x1009
xor ecx, ecx
mov qword [rbx + 0x30], rax
call qword [sym.imp.KERNEL32.DLL_GetLocaleInfoEx]
lea rcx, [rsp + 0x20]
call qword [sym.imp.msvcrt.dll__wtoi]
mov dword [rbx + 0x40], eax
mov rax, rbx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.100001c30
add rsp, 0x50
pop rbx
ret