joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400eb050
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0xd20
mov rax, qword [0x1401f7280]
xor rax, rsp
mov qword [rsp + 0xd10], rax
mov rsi, rdx
mov rdi, rcx
lea rdx, [rsp + 0x2c0]
mov r8d, 0x104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor eax, eax
or rbx, 0xffffffffffffffff
mov word [rsp + 0xb0], ax
mov rax, rbx
lea rcx, [rsp + 0x2c0]
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400eb0b0
test rax, rax
je 0x1400eb1c3
lea rax, [rsp + 0x8f0]
lea r9, [rsp + 0xb00]
lea r8, [rsp + 0x6e0]
lea rdx, [rsp + 0x4d0]
lea rcx, [rsp + 0x2c0]
mov qword [rsp + 0x20], rax
call fcn.1400fa314
lea rcx, [rsp + 0xb0]
sub rcx, 2
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x1400eb101
lea r8, [rsp + 0x4d0]
xor edx, edx
nop word [rax + rax]
movzx eax, word [r8 + rdx*2]
lea rdx, [rdx + 1]
mov word [rcx + rdx*2 - 2], ax
test ax, ax
jne 0x1400eb120
lea rcx, [rsp + 0xb0]
sub rcx, 2
nop
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x1400eb140
lea r8, [rsp + 0x6e0]
xor edx, edx
nop word [rax + rax]
movzx eax, word [r8 + rdx*2]
lea rdx, [rdx + 1]
mov word [rcx + rdx*2 - 2], ax
test ax, ax
jne 0x1400eb160
lea rax, [rsp + 0xb0]
mov rcx, rbx
nop
cmp word [rax + rcx*2 + 2], 0
lea rcx, [rcx + 1]
jne 0x1400eb180
lea rax, [rcx - 1]
cmp rax, 0x101
ja 0x1400eb1c3
cmp word [rsp + rcx*2 + 0xae], 0x5c
je 0x1400eb1c3
lea rcx, [rsp + 0xb0]
sub rcx, 2
nop
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x1400eb1b0
mov eax, dword [0x140181e84]
mov dword [rcx], eax
lea r8, [rsp + 0xb0]
sub r8, 2
nop
cmp word [r8 + 2], 0
lea r8, [r8 + 2]
jne 0x1400eb1d0
movzx eax, word [0x14018f8a8]
movups xmm0, xmmword [str.i_view64.ini]
movsd xmm1, qword [0x14018f8a0]
lea r9, [rsp + 0x30]
mov rdx, rsi
mov rcx, rdi
movups xmmword [r8], xmm0
movsd qword [r8 + 0x10], xmm1
mov word [r8 + 0x18], ax
lea rax, [rsp + 0xb0]
lea r8, [0x140181e34]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x40
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea rax, [rsp + 0x30]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1400eb233
test rbx, rbx
je 0x1400eb24e
lea rcx, [rsp + 0x30]
call fcn.1400fa308
jmp 0x1400eb253
mov eax, 0xfffffc19
mov rcx, qword [rsp + 0xd10]
xor rcx, rsp
call fcn.1400f9a80
lea r11, [rsp + 0xd20]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1400eb280
Capabilities:
Read .ini file

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x170
mov rax, qword [0x1401f7280]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov rbp, qword [rsp + 0x1e0]
mov r14, qword [rsp + 0x1d0]
mov r12, qword [rsp + 0x1e8]
mov dword [rdx], 0xffffffff
xor eax, eax
mov rbx, r9
mov dword [r8], eax
mov dword [r9], eax
mov rsi, r8
mov r15, rcx
mov rdi, rdx
lea r9, [rsp + 0x60]
lea r8, str.0_0_0_0_0_
lea rcx, str.WinPosition
mov rdx, rbp
mov qword [rsp + 0x28], r12
mov dword [r14], eax
mov dword [rsp + 0x20], 0x80
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea rcx, [rsp + 0x60]
or rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400eb310
test eax, eax
jle 0x1400eb360
lea rdx, str.0_0_0_0_0_
lea rcx, [rsp + 0x60]
call fcn.1400f92fc
test eax, eax
je 0x1400eb360
lea rax, [rsp + 0x40]
lea rdx, str._d__d__d__d__d_
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x30], rax
mov r9, rsi
mov r8, rdi
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rbx
call fcn.1400fb8b4
jmp 0x1400eb3c2
lea rdx, str.WindowX
mov r9, r12
or r8d, 0xffffffff
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
lea rdx, str.WindowY
mov r9, r12
xor r8d, r8d
mov rcx, rbp
mov dword [rdi], eax
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
lea rdx, str.WindowW
mov r9, r12
xor r8d, r8d
mov rcx, rbp
mov dword [rsi], eax
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
lea rdx, str.WindowH
mov r9, r12
xor r8d, r8d
mov rcx, rbp
mov dword [rbx], eax
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [r14], eax
cmp dword [rdi], 0xffffffff
mov ebp, dword [rsp + 0x1d8]
jne 0x1400eb3d0
mov dword [rdi], ebp
cmp dword [rbx], 0xa
jg 0x1400eb41a
mov r9d, dword [rsi]
mov r8d, dword [rdi]
lea rdx, [rsp + 0x48]
mov rcx, r15
call fcn.1400ebfd0
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
sub eax, dword [rdi]
mov dword [rbx], eax
mov eax, dword [rsp + 0x48]
cmp dword [rdi], eax
jge 0x1400eb3fe
mov dword [rdi], eax
mov edx, dword [rdi]
mov ecx, dword [rbx]
mov eax, dword [rsp + 0x50]
add ecx, edx
cmp ecx, eax
jle 0x1400eb410
sub eax, edx
mov dword [rbx], eax
mov eax, dword [rbx]
cmp eax, 0xa
cmovle eax, ebp
mov dword [rbx], eax
cmp dword [r14], 0xa
jg 0x1400eb44c
mov ecx, 0x3e
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, 0x21
mov ebx, eax
sub ebx, dword [rsi]
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, 0x21
sub ebx, eax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
sub ebx, eax
mov dword [r14], ebx
mov r9d, dword [rsi]
mov r8d, dword [rdi]
lea rdx, [rsp + 0x48]
mov rcx, r15
call fcn.1400ebfd0
mov eax, dword [rsp + 0x48]
cmp dword [rdi], eax
jge 0x1400eb469
mov dword [rdi], eax
mov eax, dword [rsp + 0x4c]
cmp dword [rsi], eax
jge 0x1400eb473
mov dword [rsi], eax
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1400f9a80
add rsp, 0x170
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400eb760
Capabilities:
Get file size

Disassembly:
sub rsp, 0x48
test rcx, rcx
je 0x1400eb7ef
cmp word [rcx], 0
je 0x1400eb7ef
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov edx, 0x80000000
lea r8d, [r9 + 1]
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x40], rdi
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x1400eb7b8
xor eax, eax
mov rdi, qword [rsp + 0x40]
add rsp, 0x48
ret
lea rdx, [rsp + 0x54]
mov rcx, rax
mov qword [rsp + 0x58], rbx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov rcx, rdi
mov dword [rsp + 0x50], eax
mov rbx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, qword [rsp + 0x40]
mov rax, rbx
mov rbx, qword [rsp + 0x58]
add rsp, 0x48
ret
xor eax, eax
add rsp, 0x48
ret

Function at 0x1400ec100
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x40
movsxd rbp, dword [rsp + 0x70]
mov r14, r8
mov rbx, rdx
mov rdi, rcx
mov r8, rbp
xor edx, edx
add r8, r8
mov rcx, r9
mov rsi, r9
call fcn.1400f9ab0
lea rax, [rsp + 0x38]
mov r9d, 1
xor r8d, r8d
mov rdx, rbx
mov rcx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400ec196
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x70]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov rdx, r14
mov qword [rsp + 0x20], rsi
mov dword [rsp + 0x70], ebp
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
test eax, eax
je 0x1400ec19a
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x1400ec1a5
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x1400ed090
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x2b0
mov rax, qword [0x1401f7280]
xor rax, rsp
mov qword [rsp + 0x2a0], rax
xor eax, eax
mov rdi, rdx
mov rbx, rcx
mov word [rdx], ax
lea r8, [rsp + 0x88]
lea r9d, [rax + 9]
lea edx, [rax + 0xe]
mov ecx, 0x400
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov r9d, 9
lea rax, [rsp + 0x88]
lea r8, [rsp + 0x70]
lea edx, [r9 + 6]
mov ecx, 0x400
mov qword [rsp + 0x40], rax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov r9d, 9
lea rax, [rsp + 0x70]
lea r8, [rsp + 0x58]
lea edx, [r9 + 9]
mov ecx, 0x400
mov qword [rsp + 0x48], rax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
lea rcx, [rsp + 0x58]
call fcn.1400fa308
mov r9d, 9
lea r8, [rsp + 0x58]
lea edx, [r9 + 7]
mov ecx, 0x400
mov dword [rsp + 0x34], eax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
lea rcx, [rsp + 0x58]
call fcn.1400fa308
lea r8, [rsp + 0x58]
mov r9d, 9
mov edx, 0x1010
mov ecx, 0x400
mov dword [rsp + 0x38], eax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
lea rcx, [rsp + 0x58]
call fcn.1400fa308
lea rdx, str._I64d
lea rcx, [rsp + 0xa0]
mov r8, rbx
mov dword [rsp + 0x50], eax
call fcn.1400f98c8
lea r9, [rsp + 0x30]
lea r8, [rsp + 0xa0]
xor edx, edx
mov ecx, 0x400
mov dword [rsp + 0x28], 0x40
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_GetNumberFormatW]
mov eax, 1
mov rcx, qword [rsp + 0x2a0]
xor rcx, rsp
call fcn.1400f9a80
mov rbx, qword [rsp + 0x2d0]
add rsp, 0x2b0
pop rdi
ret
Function at 0x1400edc10
Capabilities:
Read .ini file

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x168
mov rax, qword [0x1401f7280]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rbx, qword [rsp + 0x1b0]
mov qword [rsp + 0x28], r8
mov rdi, r9
mov rbp, rcx
lea r9, [rsp + 0x50]
lea r8, str.0_0_0_0_0_
lea rcx, str.WinPosition
mov dword [rsp + 0x20], 0x80
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea rax, [rdi + 0xc]
lea rcx, [rdi + 8]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x50]
lea r9, [rdi + 4]
lea rdx, str._d__d__d__d__d_
mov r8, rdi
call fcn.1400fb8b4
mov ecx, 0x50
call qword [sym.imp.USER32.dll_GetSystemMetrics]
cmp eax, 2
jge 0x1400edcdc
xor edx, edx
lea r8, [rsp + 0x40]
xor r9d, r9d
lea ecx, [rdx + 0x30]
call qword [sym.imp.USER32.dll_SystemParametersInfoW]
mov ecx, dword [rdi]
mov eax, dword [rsp + 0x40]
cmp ecx, eax
jl 0x1400edcc4
cmp ecx, dword [rsp + 0x48]
jl 0x1400edcc6
mov dword [rdi], eax
mov ecx, dword [rdi + 4]
mov eax, dword [rsp + 0x44]
cmp ecx, eax
jl 0x1400edcd7
cmp ecx, dword [rsp + 0x4c]
jl 0x1400edd05
mov dword [rdi + 4], eax
jmp 0x1400edd05
mov ebx, dword [rdi]
mov r9d, dword [rdi + 4]
lea rdx, [rsp + 0x40]
mov r8d, ebx
mov rcx, rbp
call fcn.1400ebfd0
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
cmp ebx, dword [rsp + 0x40]
cmovl ebx, dword [rsp + 0x40]
mov dword [rdi], ebx
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1400f9a80
add rsp, 0x168
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400ee0f0
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov r14, r9
mov rdi, rdx
mov rbx, r8
lea r9, [0x140208860]
lea rdx, str.SortOrder
mov r8d, 9
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
lea r9, [0x140208860]
lea rdx, str.AutoSort
xor r8d, r8d
mov rcx, rsi
mov dword [rbx], eax
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [rdi], eax
test r14, r14
je 0x1400ee16b
lea r9, [0x140208860]
lea rdx, str.SortBeforeSel
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [r14], eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret

Function at 0x1400ee190
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov rsi, r9
mov rbx, r8
mov r14, rdx
mov rdi, rcx
test rdx, rdx
je 0x1400ee1d3
mov r9, rcx
lea rdx, str.Save_Compression
lea rcx, str.TIFF
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [r14], eax
test rbx, rbx
je 0x1400ee1f7
lea rdx, str.Save_Quality
lea rcx, [0x140183aa8]
mov r9, rdi
mov r8d, 0x50
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [rbx], eax
test rsi, rsi
je 0x1400ee21b
lea rdx, str.GrayPalette
lea rcx, str.TIFF
mov r9, rdi
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [rsi], eax
mov rbx, qword [rsp + 0x50]
test rbx, rbx
je 0x1400ee244
lea rdx, str.SaveAllPages
lea rcx, str.TIFF
mov r9, rdi
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [rbx], eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x1400ee260
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xc0
mov rax, qword [0x1401f7280]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rbp, qword [rsp + 0x120]
mov rbx, qword [rsp + 0x128]
mov r15, qword [rsp + 0x130]
mov rdi, qword [rsp + 0x138]
mov rsi, qword [rsp + 0x140]
xor eax, eax
mov qword [r9], rax
mov qword [r9 + 8], rax
mov r14, r9
mov dword [rbp], eax
mov r12, r8
mov r13, rdx
test ecx, ecx
je 0x1400ee336
lea r9, [rsp + 0x30]
lea r8, str.0_0_100_100_
lea rdx, str.Coord
mov rcx, rsi
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0x40
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea rax, [r14 + 0xc]
lea rcx, [r14 + 8]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea r9, [r14 + 4]
lea rcx, [rsp + 0x30]
lea rdx, str._d__d__d__d_
mov r8, r14
call fcn.1400fb8b4
lea rdx, str.Corner
mov r9, rdi
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [rbp], eax
lea rdx, str.Option
mov r9, rdi
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
lea rdx, str.Transp
mov r9, rdi
mov r8d, 0x21
mov rcx, rsi
mov dword [r13], eax
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [rbx], eax
test eax, eax
jns 0x1400ee377
mov dword [rbx], 0
jmp 0x1400ee383
mov edx, 0x64
cmp eax, edx
cmovg eax, edx
mov dword [rbx], eax
test r15, r15
je 0x1400ee3be
lea r9, [rsp + 0x30]
lea r8, str.65535
lea rdx, [0x1401869b0]
mov rcx, rsi
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], InitCommonControls
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea rcx, [rsp + 0x30]
call fcn.1400fa308
mov dword [r15], eax
lea r8, str.no_image
lea rdx, [0x140186970]
mov r9, r12
mov rcx, rsi
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0x104
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.1400f9a80
mov rbx, qword [rsp + 0x100]
add rsp, 0xc0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret

Function at 0x1400ee4b0
Capabilities:
Read .ini file

Disassembly:
sub rsp, 0x68
mov rax, qword [0x1401f7280]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x28], r9
lea r9, [rsp + 0x30]
mov dword [rsp + 0x20], InitCommonControls
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
xor edx, edx
or rax, 0xffffffffffffffff
lea rcx, [rsp + 0x30]
inc rax
cmp word [rcx + rax*2], dx
jne 0x1400ee4e6
test rax, rax
je 0x1400ee530
mov rcx, rdx
mov r9d, 0x2e
nop dword [rax]
cmp word [rsp + rcx*2 + 0x30], 0x2c
jne 0x1400ee50e
mov word [rsp + rcx*2 + 0x30], r9w
inc edx
lea r8, [rsp + 0x30]
or rax, 0xffffffffffffffff
mov ecx, edx
nop dword [rax + rax]
inc rax
cmp word [r8 + rax*2], 0
jne 0x1400ee520
cmp rcx, rax
jb 0x1400ee500
lea rcx, [rsp + 0x30]
call fcn.140100844
cvtsd2ss xmm0, xmm0
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400f9a80
add rsp, 0x68
ret
Function at 0x1400ee550
Capabilities:
Read .ini file

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x2d8
mov rax, qword [0x1401f7280]
xor rax, rsp
mov qword [rsp + 0x2c0], rax
mov rbx, qword [rsp + 0x330]
mov rdi, qword [rsp + 0x338]
mov rsi, r9
mov r14, r8
mov r15, rdx
mov rbp, rcx
test rdx, rdx
je 0x1400ee5cf
lea r9, [rsp + 0xb0]
lea r8, str.65280
lea rdx, str.FontColor
mov rcx, rbx
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], InitCommonControls
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea rcx, [rsp + 0xb0]
call fcn.1400fa308
mov dword [r15], eax
test r14, r14
je 0x1400ee610
lea r9, [rsp + 0xb0]
lea r8, str.16777215
lea rdx, str.TxtBgkr
mov rcx, rbx
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], InitCommonControls
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea rcx, [rsp + 0xb0]
call fcn.1400fa308
mov dword [r14], eax
test rsi, rsi
je 0x1400ee630
lea rdx, str.TranspText
mov r9, rdi
mov r8d, 1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [rsi], eax
mov edx, dword [0x1402094d0]
mov r8d, 0x60
lea ecx, [r8 - 0x6d]
call qword [sym.imp.KERNEL32.dll_MulDiv]
lea rdx, str._d000400000012449
lea rcx, [rsp + 0x30]
mov r8d, eax
call fcn.1400f98c8
lea r9, [rsp + 0xb0]
lea r8, [rsp + 0x30]
lea rdx, str.FontParam
mov rcx, rbx
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0x104
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
xor edx, edx
lea r8d, [rdx + 0x5c]
mov rcx, rbp
call fcn.1400f9ab0
lea rcx, [rsp + 0xb0]
mov rdx, rbp
call fcn.1400eaaf0
lea r9, [rbp + 0x1c]
lea r8, str.Courier_New
lea rdx, [0x14018dc58]
mov rcx, rbx
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0x40
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov rcx, qword [rsp + 0x2c0]
xor rcx, rsp
call fcn.1400f9a80
add rsp, 0x2d8
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400eece0
Capabilities:
Get disk size

Disassembly:
sub rsp, 0x28
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x1400eed16
mov rax, qword [rsp + 0x38]
cqo
and edx, 0x3ff
add rax, rdx
sar rax, 0xa
add rsp, 0x28
ret
xor eax, eax
add rsp, 0x28
ret

Function at 0x1400eed20
Capabilities:
Get common file path

Disassembly:
mov r11, rsp
push rbp
sub rsp, 0x470
mov rax, qword [0x1401f7280]
xor rax, rsp
mov qword [rsp + 0x440], rax
mov qword [r11 - 0x10], rbx
mov qword [r11 - 0x18], rsi
mov qword [r11 - 0x20], rdi
mov qword [r11 - 0x28], r14
mov rbp, r8
mov rdi, rdx
mov r14, rcx
call qword [sym.imp.USER32.dll_GetWindowRect]
xor eax, eax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rax
call fcn.1400ec530
cmp eax, 6
jl 0x1400eee5f
lea rcx, [rsp + 0x30]
mov edx, 0x104
or rsi, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea rcx, [rsp + 0x30]
mov rax, rsi
cmp word [rcx + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x1400eed92
cmp word [rsp + rax*2 + 0x2e], 0x5c
je 0x1400eedc3
lea rcx, [rsp + 0x30]
sub rcx, 2
nop
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x1400eedb0
mov eax, dword [0x140181e84]
mov dword [rcx], eax
lea rcx, [rsp + 0x30]
sub rcx, 2
nop dword [rax]
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x1400eedd0
mov eax, dword [0x14018f948]
movups xmm0, xmmword [str.Dwmapi.dll]
movups xmmword [rcx], xmm0
mov dword [rcx + 0x10], eax
movzx eax, word [0x14018f94c]
mov word [rcx + 0x14], ax
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
test rax, rax
je 0x1400eee5f
lea rdx, str.DwmGetWindowAttribute
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400eee37
mov r9d, InitCommonControls
lea r8, [rsp + 0x20]
mov rcx, r14
lea edx, [r9 - 7]
call rax
mov esi, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test esi, esi
js 0x1400eee5f
mov ecx, dword [rdi + 8]
mov eax, dword [rsp + 0x28]
sub ecx, dword [rdi]
sub eax, dword [rsp + 0x20]
cmp ecx, eax
je 0x1400eee5f
movups xmm1, xmmword [rsp + 0x20]
movups xmmword [rdi], xmm1
jmp 0x1400eee64
movups xmm1, xmmword [rsp + 0x20]
mov r14, qword [rsp + 0x450]
mov rdi, qword [rsp + 0x458]
mov rsi, qword [rsp + 0x460]
mov rbx, qword [rsp + 0x468]
test rbp, rbp
je 0x1400eee8d
movups xmmword [rbp], xmm1
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.1400f9a80
add rsp, 0x470
pop rbp
ret
Function at 0x1400ef300
Capabilities:
Get geographical location

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x1b8]
sub rsp, 0x2b8
mov rax, qword [0x1401f7280]
xor rax, rsp
mov qword [rbp + 0x1a0], rax
xor r14d, r14d
movsxd r15, r8d
mov rdi, rdx
mov rbx, rcx
mov esi, r14d
test r9, r9
jne 0x1400ef3ed
cmp dword [rbp + 0x210], r14d
je 0x1400ef35a
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
jmp 0x1400ef3f6
or rax, 0xffffffffffffffff
nop
inc rax
cmp word [rcx + rax*2], si
jne 0x1400ef360
test rax, rax
je 0x1400ef572
xor eax, eax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
lea esi, [rax + 1]
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], r14w
jne 0x1400ef385
lea r9, [rsp + 0x42]
lea r8, [rsp + 0x40]
cmp rax, 0xa
jne 0x1400ef3b7
lea rax, [rsp + 0x46]
lea rdx, str._d:_d:_d
mov qword [rsp + 0x20], rax
call fcn.1400fb8b4
jmp 0x1400ef3f6
lea rax, [rsp + 0x4c]
lea rdx, str._d:_d:_d__d:_d:_d
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x4a]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x46]
mov qword [rsp + 0x20], rax
call fcn.1400fb8b4
jmp 0x1400ef3f6
movups xmm0, xmmword [r9]
movups xmmword [rsp + 0x40], xmm0
mov rdx, qword [rsp + 0x40]
xor eax, eax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x70], eax
movzx eax, dx
sub eax, 0x76c
mov dword [rsp + 0x64], eax
mov rax, rdx
shr rax, 0x10
movzx eax, ax
dec eax
test eax, eax
cmovg r14d, eax
mov rax, rdx
shr rax, 0x30
mov dword [rsp + 0x60], r14d
mov dword [rsp + 0x5c], eax
cmp ax, 1
ja 0x1400ef451
mov dword [rsp + 0x5c], 1
mov rcx, qword [rsp + 0x48]
shr rdx, 0x20
mov dword [rsp + 0x70], 0xffffffff
movzx eax, cx
mov dword [rsp + 0x58], eax
mov rax, rcx
shr rcx, 0x20
shr rax, 0x10
movzx eax, ax
mov dword [rsp + 0x54], eax
movzx eax, cx
mov dword [rsp + 0x50], eax
movzx eax, dx
mov dword [rsp + 0x68], eax
test esi, esi
je 0x1400ef497
lea rcx, [rsp + 0x50]
call fcn.140100b90
lea r8, [rbp - 0x60]
mov r9d, 0xff
mov edx, 0x1001
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1400ef4c3
lea rdx, [rbp - 0x60]
mov ecx, 5
call fcn.14010241c
lea rdx, [0x14018f9a4]
mov rcx, rdi
call fcn.1400f9d68
test rax, rax
je 0x1400ef4f0
lea r9, [0x140182ce0]
lea r8, [0x14018f9a4]
mov edx, r15d
mov rcx, rdi
call fcn.1400ef7a0
lea r9, [rsp + 0x50]
mov rdx, r15
mov r8, rdi
mov rcx, rbx
call fcn.140101970
lea rdx, [0x140188451]
mov ecx, 5
call fcn.14010198c
cmp dword [rbp + 0x218], 0
je 0x1400ef572
movzx r8d, word [rsp + 0x4e]
lea rdx, str.__.3d
lea rcx, [rsp + 0x78]
call fcn.1400f98c8
sub rbx, 2
nop dword [rax + rax]
cmp word [rbx + 2], 0
lea rbx, [rbx + 2]
jne 0x1400ef540
lea rdx, [rsp + 0x78]
xor ecx, ecx
nop dword [rax]
nop word [rax + rax]
movzx eax, word [rdx + rcx*2]
lea rcx, [rcx + 1]
mov word [rbx + rcx*2 - 2], ax
test ax, ax
jne 0x1400ef560
mov rcx, qword [rbp + 0x1a0]
xor rcx, rsp
call fcn.1400f9a80
add rsp, 0x2b8
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret