joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100004848
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
mov rdx, qword [0x1000730f0]
mov rbx, rcx
test rdx, rdx
je 0x10002c860
mov rax, qword [0x1000730f8]
test rax, rax
je 0x10002c87d
test rdx, rdx
je 0x10002db32
test rax, rax
je 0x10002db32
mov rdx, qword [0x100073100]
test rdx, rdx
je 0x10002c8a1
xor ecx, ecx
test rdx, rdx
setne cl
jmp 0x10000489d
test ecx, ecx
je 0x1000048be
mov rcx, rax
mov qword [0x100073108], rbx
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rcx, qword [0x1000730f0]
call qword [sym.imp.KERNEL32.dll_SetEvent]
add rsp, 0x30
pop rbx
ret
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rdx, rax
mov qword [0x1000730f0], rax
jmp 0x100004861
lea edx, [rax + 1]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rdx, qword [0x1000730f0]
mov qword [0x1000730f8], rax
jmp 0x100004871
lea rax, [rsp + 0x48]
lea r8, [0x100002254]
xor r9d, r9d
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdx, rax
mov qword [0x100073100], rax
mov rax, qword [0x1000730f8]
jmp 0x100004893
xor ecx, ecx
jmp 0x10000489d

Function at 0x100007a98
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rdx, r8
mov rsi, r8
mov rbp, rcx
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x100007ae4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rdi, rdi
je 0x100007ae4
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [rdi], eax
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x10000fe70
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
cmp byte [0x100073585], bl
jne 0x10002ebed
cmp byte [0x100073586], bl
jne 0x10002ebfb
cmp byte [0x100073587], bl
jne 0x10002ec2a
mov byte [0x100073585], 1
mov r9b, 1
mov rdx, qword [0x100073560]
lea rcx, [0x100073460]
mov r8d, 0x2cb
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 1
call fcn.10000e6e8
add rsp, 0x30
pop rbx
jmp fcn.10000fed8
mov byte [0x100073585], bl
xor r9d, r9d
jmp 0x10000fea6
mov rdx, qword [0x100073568]
lea rcx, [0x100073460]
xor r9d, r9d
mov r8d, 0xeb
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
call fcn.10000e6e8
mov byte [0x100073586], bl
jmp 0x10000fe9c
mov rdx, qword [0x100073570]
lea rcx, [0x100073460]
xor r9d, r9d
mov r8d, 0xfa0
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
call fcn.10000e6e8
mov byte [0x100073587], bl
jmp 0x10000fe9c
Function at 0x10001e0d0
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xd0
mov rax, qword [0x1000730b0]
xor rax, rsp
mov qword [rsp + 0xc0], rax
xor edx, edx
mov rbx, rcx
lea r8d, [rdx + 0x28]
add rcx, r8
call sub.msvcrt.dll_memset
and qword [rbx + 0x50], 0
and dword [rbx + 0x58], 0
and dword [rbx + 0x5c], 0
lea rax, [0x100000000]
mov esi, 0x94
lea rcx, [rsp + 0x20]
mov r8, rsi
xor edx, edx
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], rax
mov dword [rbx], 0x60
mov byte [rbx + 0x18], 0
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [rsp + 0x30], 2
mov esi, 1
jne 0x10003c53b
cmp dword [rsp + 0x24], 5
jb 0x10001e16b
jmp 0x10001e167
mov byte [rbx + 0x18], sil
lea rax, [0x100063da0]
lea rcx, [rbx + 0x28]
mov dword [rbx + 0x1c], 0x800
mov qword [rbx + 0x20], rax
call fcn.10001e1c8
movzx ecx, byte [0x100073051]
test eax, eax
mov rax, rbx
cmovs ecx, esi
mov byte [0x100073051], cl
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.100001c30
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
cmp dword [rsp + 0x30], esi
jne 0x10001e16b
cmp dword [rsp + 0x24], 4
ja 0x10001e167
jne 0x10001e16b
cmp dword [rsp + 0x28], 0
ja 0x10001e167
jmp 0x10001e16b

Function at 0x10001e300
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
cmp rcx, rdx
je 0x10001e347
cmp rcx, 0xffffffffffffffff
je 0x10001e347
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x10001e345
cmp dword [rcx + 0x3c], edx
jl 0x10001e345
cmp dword [rcx + 0x3c], 0x10000000
jae 0x10001e345
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x10001e347
mov rax, rdx
add rsp, 0x18
ret
Function at 0x100022c0c
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x70
mov eax, dword [rsp + 0xb0]
and qword [rcx + 8], 0
and dword [rcx + 0x10], 0
and qword [rcx + 0x420], 0
mov ebx, dword [rsp + 0xc8]
mov dword [rcx + 0x14], eax
mov eax, dword [rsp + 0xc0]
mov r12, rdx
mov rsi, rcx
mov qword [rcx + 0x18], r8
mov dword [rcx], ebx
mov dword [rcx + 0x428], eax
lea rdx, [rsp + 0x40]
mov rcx, r8
mov ebp, r9d
mov rdi, r8
call qword [sym.imp.USER32.dll_GetClientRect]
mov edx, 0xffffffec
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindowLongW]
mov edx, 0xffffffec
mov rcx, rdi
and eax, 0xffbfdfff
mov r8d, eax
call qword [sym.imp.USER32.dll_SetWindowLongW]
lea rdx, [rsi + 0x20]
mov r8d, 0x200
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindowTextW]
call qword [sym.imp.UxTheme.dll_IsThemeActive]
test eax, eax
je 0x10003147c
test ebx, ebx
jne 0x1000260dc
mov edx, dword [r12 + 0xc]
mov ecx, dword [r12 + 8]
mov r9d, 6
sub edx, dword [r12 + 4]
sub ecx, dword [r12]
lea r8d, [r9 + 0x1a]
mov dword [rsp + 0x20], 1
call qword [sym.imp.COMCTL32.dll_ImageList_Create]
xor ecx, ecx
mov qword [rsi + 8], rax
movzx ebx, bp
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea r9, [rsp + 0x90]
mov r8d, 2
mov rdx, rbx
mov rcx, rax
call fcn.100007b6c
mov rcx, qword [rsp + 0x90]
lea rdx, [rsp + 0x40]
xor r8d, r8d
call fcn.100022ddc
mov rcx, qword [rsi + 8]
xor r8d, r8d
mov rdx, rax
mov rbx, rax
call qword [sym.imp.COMCTL32.dll_ImageList_Add]
mov r11, qword [rsi + 8]
and dword [rsp + 0x5c], 0
and dword [rsp + 0x64], 0
and dword [rsp + 0x58], 0
and dword [rsp + 0x60], 0
lea r9, [rsp + 0x50]
xor r8d, r8d
mov edx, 0x1602
mov rcx, rdi
mov qword [rsp + 0x50], r11
mov dword [rsp + 0x68], 4
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, rbx
call qword [sym.imp.GDI32.dll_DeleteObject]
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x31]
mov rcx, rdi
call qword [sym.imp.USER32.dll_SendMessageW]
lea rdx, [0x100062c88]
mov rcx, rdi
mov qword [rsi + 0x420], rax
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov r8, qword [rsp + 0xb8]
mov r9d, 1
mov rcx, rdi
lea edx, [r9 + 0x2f]
call qword [sym.imp.USER32.dll_SendMessageW]
lea r11, [rsp + 0x70]
mov rax, rsi
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
mov ebx, 0xfffffff0
mov rcx, rdi
mov dword [rsi + 0x10], ebp
mov edx, ebx
call qword [sym.imp.USER32.dll_GetWindowLongPtrW]
mov edx, ebx
mov rcx, rdi
or rax, 0xd
mov r8, rax
call qword [sym.imp.USER32.dll_SetWindowLongPtrW]
lea edx, [rbx - 4]
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindowLongPtrW]
lea edx, [rbx - 4]
mov rcx, rdi
btr rax, 9
mov r8, rax
call qword [sym.imp.USER32.dll_SetWindowLongPtrW]
mov dword [rsp + 0x30], 0x77
and dword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.USER32.dll_SetWindowPos]
jmp 0x100022da3
lea edx, [rax + 0x31]
xor r9d, r9d
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.USER32.dll_SendMessageW]
mov qword [rsi + 0x420], rax
jmp 0x100022da3
Function at 0x100025b3c
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbp
push rsi
push rdi
push r12
sub rsp, 0x50
mov eax, dword [0x100073580]
mov ebp, r8d
mov esi, edx
mov rdi, rcx
cmp eax, edx
je 0x100025cc5
cmp eax, 3
je 0x10002df89
mov rax, qword [rcx + 0x5f0]
test rax, rax
je 0x100025b82
cmp qword [rax + 0xb0], 0
jne 0x10002dfbf
cmp dword [0x1000747b4], 0
movabs r12, 0x8001000000010000
jne 0x10002dfe2
mov rcx, rdi
call fcn.100025cf4
mov rcx, qword [0x1000735d0]
mov dword [0x100073580], esi
mov dword [0x100073588], ebp
call qword [sym.imp.USER32.dll_GetParent]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetMenu]
and dword [rsp + 0x20], 0
mov edx, 0x130
lea r8d, [rdx + 3]
lea r9d, [rsi + 0x130]
mov rcx, rax
call qword [sym.imp.USER32.dll_CheckMenuRadioItem]
and qword [rsp + 0x40], 0
lea rax, [rsp + 0x88]
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], 0
lea rdx, str.SoftwareMicrosoftCalc
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x28], 0x20006
and dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x100025c67
mov rcx, qword [rsp + 0x88]
lea rax, [rsp + 0x78]
lea rdx, str.layout
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x78], esi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdi, [0x100073460]
xor edx, edx
mov rcx, rdi
call fcn.1000234a8
xor edx, edx
mov rcx, rdi
call fcn.100023a50
mov rcx, rdi
call fcn.100022610
mov rcx, qword [0x1000735f0]
mov edx, 0x96
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
call qword [sym.imp.USER32.dll_SetFocus]
call fcn.100001bd8
lea rcx, [0x100073a58]
xor edx, edx
call fcn.1000021a0
cmp dword [0x1000747b4], 0
jne 0x10002e036
mov rbp, qword [rsp + 0x70]
add rsp, 0x50
pop r12
pop rdi
pop rsi
ret
mov rcx, qword [rcx + 0xb48]
test rcx, rcx
je 0x100025b82
cmp qword [rcx + 0xb0], 0
je 0x100025b82
mov rax, qword [rcx]
mov edx, 0x2b
call qword [rax + 0x18]
test al, al
jne 0x100025b82
jmp 0x100025cc5
movzx edx, word [rax + 0xd0]
shl edx, 0x10
or rdx, 0x94
call fcn.100029f90
test eax, eax
jne 0x100025b82
jmp 0x100025cc5
mov al, byte [0x1000747b8]
cmp al, 4
jae 0x10002dff4
test al, al
jne 0x100025b99
test qword [0x1000747a0], r12
je 0x100025b99
mov rcx, qword [0x1000747a8]
mov rax, rcx
and rax, r12
cmp rax, rcx
jne 0x100025b99
mov rcx, qword [0x100073280]
lea rdx, [0x100064cb8]
mov r8d, 0x1a
call fcn.10003f210
nop
jmp 0x100025b99
mov al, byte [0x1000747b8]
cmp al, 4
jae 0x10002e048
test al, al
jne 0x100025cc5
test qword [0x1000747a0], r12
je 0x100025cc5
mov rcx, qword [0x1000747a8]
mov rax, rcx
and rax, r12
cmp rax, rcx
jne 0x100025cc5
mov rcx, qword [0x100073280]
lea rdx, [0x100064cc8]
mov r8d, 0x1b
call fcn.10003f210
nop
jmp 0x100025cc5
Function at 0x100025f50
Capabilities:
Get graphical window text

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x440
mov rax, qword [0x1000730b0]
xor rax, rsp
mov qword [rsp + 0x430], rax
mov rbx, rdx
mov rbp, rcx
xor edi, edi
mov rcx, qword [rbx + 0x20]
lea edx, [rdi + 1]
mov rsi, r9
mov r12, r8
call qword [sym.imp.GDI32.dll_SetBkMode]
test rsi, rsi
je 0x100025fa0
mov rcx, qword [rbx + 0x20]
mov rdx, rsi
call qword [sym.imp.GDI32.dll_SelectObject]
mov rdi, rax
mov rcx, qword [rbx + 0x20]
mov edx, 0x5b391e
call qword [sym.imp.GDI32.dll_SetTextColor]
lea r8, [0x100062f20]
lea rcx, [rsp + 0x30]
mov edx, 0x200
call sub.msvcrt.dll_wcscpy_s
mov rcx, qword [rbx]
lea rdx, [rsp + 0x3a]
mov r8d, 0x1fb
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov rcx, qword [rbx + 0x20]
lea r9, [rbx + 0x28]
lea rdx, [rsp + 0x30]
or r8d, 0xffffffff
mov dword [rsp + 0x20], 0x24
call qword [sym.imp.USER32.dll_DrawTextW]
test rdi, rdi
je 0x10002600a
mov rcx, qword [rbx + 0x20]
mov rdx, rdi
call qword [sym.imp.GDI32.dll_SelectObject]
xor edx, edx
mov rcx, r12
lea r8d, [rdx + 4]
call qword [sym.imp.USER32.dll_SetWindowLongW]
mov r8d, dword [rsp + 0x490]
cmp r8d, 0xffffffff
je 0x100026032
mov rdx, qword [rbx]
mov rcx, rbp
call fcn.100023ae8
mov eax, 1
mov rcx, qword [rsp + 0x430]
xor rcx, rsp
call fcn.100001c30
add rsp, 0x440
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x100028fec
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [rcx + 0x18]
mov r8d, 0x17
mov r14, r9
mov ebx, 0x80004005
call qword [sym.imp.KERNEL32.dll_FindResourceW]
xor esi, esi
mov rbp, rax
cmp rax, rsi
je 0x100031584
mov rcx, qword [rdi + 0x18]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r12d, eax
shr r12d, 1
je 0x1000290d5
mov rcx, qword [rdi + 0x18]
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
cmp rax, rsi
je 0x100031584
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r13, rax
cmp rax, rsi
je 0x1000290d5
lea ecx, [r12 + 1]
lea eax, [rsi + 2]
lea r15, [rsi - 1]
mov ebx, esi
mul rcx
cmovo rax, r15
mov rcx, rax
call fcn.100001f90
lea rdi, [r12 + r12]
mov rdx, r13
mov r8, rdi
mov rcx, rax
mov rbp, rax
call sub.msvcrt.dll_memcpy
mov word [rdi + rbp], si
cmp rbp, rsi
je 0x1000290bd
xor eax, eax
mov rcx, r15
mov rdi, rbp
repne scasw ax, word [rdi]
not rcx
lea esi, [rcx - 1]
mov r8d, esi
mov rdx, rbp
mov rcx, r14
call fcn.100022360
mov rcx, rbp
call sub.msvcrt.dll_free
jmp 0x1000290d5
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
cmp eax, esi
cmovle ebx, eax
jmp 0x1000290d5
Function at 0x100029848
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x20
mov r13, rcx
mov r12d, edx
lea rcx, [0x1000755a0]
xor edx, edx
xor ebx, ebx
call fcn.10002784c
lea r14d, [rbx + 1]
mov ebp, r14d
jmp 0x100029884
mov rsi, rax
test rax, rax
je 0x10002cf78
test rbx, rbx
jne 0x10002cf78
mov eax, r12d
lea edx, [rbx + 6]
xor r9d, r9d
shr eax, 4
mov rcx, rsi
add ax, r14w
movzx r8d, ax
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
mov rbx, rax
test rax, rax
je 0x10002cf62
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x10002cf5b
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
test rax, rax
je 0x10002cf5b
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, r12d
mov r11d, eax
add r11, rdi
and ecx, 0xf
jbe 0x10002991c
cmp rdi, r11
jae 0x10002cf5b
add ecx, 0xffffffff
movzx eax, word [rdi]
lea rdi, [rdi + rax*2 + 2]
jne 0x100029906
cmp rdi, r11
jae 0x10002cf5b
movzx eax, word [rdi]
neg ax
sbb rbx, rbx
and rbx, rdi
test rbx, rbx
je 0x10002cf62
test rsi, rsi
je 0x10002cf7f
mov r8d, r12d
mov rdx, rsi
mov rcx, r13
call fcn.100029980
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop r13
pop r12
ret
xor ebx, ebx
jmp 0x100029931
lea rcx, [0x1000755a0]
mov edx, ebp
call fcn.10002784c
add ebp, r14d
jmp 0x100029884
xor esi, esi
jmp 0x10002993a
xor eax, eax
jmp 0x100029951
Function at 0x100029980
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x20
mov eax, r8d
mov rbp, rdx
mov r14d, 1
shr eax, 4
mov ebx, r8d
mov rsi, rcx
add ax, r14w
lea r8d, [r14 + 5]
mov rcx, rbp
movzx edx, ax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
xor r13d, r13d
mov r12, rax
cmp rax, r13
je 0x10002cfe4
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
cmp rax, r13
je 0x10002cfe4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
cmp rax, r13
je 0x10002cfe4
mov rdx, r12
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r11d, eax
add r11, rdi
and ebx, 0xf
jbe 0x100029a2c
cmp rdi, r11
jae 0x10002cfe4
add ebx, 0xffffffff
movzx eax, word [rdi]
lea rdi, [rdi + rax*2 + 2]
jne 0x100029a16
cmp rdi, r11
jae 0x10002cfe4
cmp word [rdi], r13w
je 0x10002cfe4
mov rax, qword [rsi]
movzx ebx, word [rdi]
mov ecx, r14d
sub ecx, dword [rax - 8]
mov eax, dword [rax - 0xc]
sub eax, ebx
or ecx, eax
jge 0x100029a5e
mov edx, ebx
mov rcx, rsi
call fcn.100022420
movzx ecx, word [rdi]
lea r8, [rdi + 2]
cmp ecx, 0xffffffff
je 0x10002cf86
movsxd r9, ecx
mov rcx, qword [rsi]
lea rdi, [rbx + rbx]
mov rdx, rdi
add r9, r9
call sub.msvcrt.dll_memcpy_s
cmp eax, r13d
jne 0x10002cfa0
cmp ebx, r13d
jl 0x10002cfd9
mov rcx, qword [rsi]
cmp ebx, dword [rcx - 0xc]
jg 0x10002cfd9
mov dword [rcx - 0x10], ebx
mov rcx, qword [rsi]
mov eax, r14d
mov word [rdi + rcx], r13w
jmp 0x100029ab1
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop r13
pop r12
ret
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r8
repne scasw ax, word [rdi]
not rcx
sub rcx, r14
add ecx, r14d
jmp 0x100029a6e
cmp eax, 0xc
je 0x10002cfce
cmp eax, 0x16
je 0x10002cfc3
cmp eax, 0x22
je 0x10002cfc3
cmp eax, 0x50
je 0x100029a8c
mov ecx, 0x80004005
call fcn.10003dc70
int3
mov ecx, 0x80070057
call fcn.10003dc70
int3
mov ecx, 0x8007000e
call fcn.10003dc70
int3
mov ecx, 0x80070057
call fcn.10003dc70
int3
xor eax, eax
jmp 0x100029ab1
Function at 0x10002b220
Capabilities:
Hide graphical window

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
push rdi
sub rsp, 0x80
and qword [rax + 8], 0
mov rdi, rcx
mov rcx, qword [rcx + 0xc0]
xor r9d, r9d
xor r8d, r8d
mov edx, reloc.COMCTL32.dll_Ordinal_392
call qword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
js 0x10002b412
cmp qword [rdi + 0xb0], 0
jne 0x10002b412
mov rcx, qword [rdi + 0xc0]
lea r9, [rsp + 0x60]
movsxd r8, eax
mov edx, SetWindowSubclass
mov dword [rdi + 0xd0], eax
call qword [sym.imp.USER32.dll_SendMessageW]
mov r11, qword [rdi]
lea rdx, [rsp + 0x90]
mov rcx, rdi
call qword [r11]
cmp qword [rsp + 0x90], 0
je 0x10002b412
mov rcx, qword [rdi + 0xc0]
lea rdx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_GetClientRect]
mov ebx, dword [rsp + 0x6c]
cmp dword [rsp + 0x7c], ebx
cmovl ebx, dword [rsp + 0x7c]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
and qword [rsp + 0x58], 0
mov r8d, dword [rsp + 0x64]
mov edx, dword [rsp + 0x68]
mov ecx, dword [rsp + 0x60]
mov qword [rsp + 0x50], rax
and qword [rsp + 0x48], 0
mov rax, qword [rdi + 0xc0]
sub ebx, r8d
mov qword [rsp + 0x40], rax
dec edx
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], edx
inc ecx
mov dword [rsp + 0x28], r8d
mov r8, qword [rsp + 0x90]
mov dword [rsp + 0x20], ecx
lea rdx, str.EDIT
mov r9d, 0x50000046
mov ecx, 8
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov rcx, qword [rsp + 0x90]
mov qword [rdi + 0xb0], rax
call sub.msvcrt.dll_free
mov edx, dword [rdi + 0xd4]
mov rcx, qword [rdi + 0xb0]
call fcn.10002502c
mov r9, qword [rdi + 0xb8]
mov rcx, qword [rdi + 0xb0]
lea rdx, [0x10002ab20]
mov r8d, 1
call sub.COMCTL32.dll_SetWindowSubclass
mov rcx, qword [rdi + 0xb0]
mov r8, rdi
mov edx, 0xffffffeb
call qword [sym.imp.USER32.dll_SetWindowLongPtrW]
mov r8, qword [rdi + 0x58]
mov rcx, qword [rdi + 0xb0]
xor r9d, r9d
lea edx, [r9 + 0x30]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rdi + 0xb0]
mov edx, 0xfffffff4
mov r8d, reloc.COMCTL32.dll_SetWindowSubclass
call qword [sym.imp.USER32.dll_SetWindowLongW]
mov rcx, qword [rdi + 0xb0]
mov edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [rdi + 0xb8]
mov edx, 0x41b
call qword [sym.imp.USER32.dll_GetDlgItem]
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_EnableWindow]
mov rcx, qword [rdi + 0xb8]
mov edx, 0x41c
call qword [sym.imp.USER32.dll_GetDlgItem]
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_EnableWindow]
mov rcx, qword [rdi + 0xb0]
call qword [sym.imp.USER32.dll_SetFocus]
mov rbx, qword [rsp + 0x98]
add rsp, 0x80
pop rdi
ret
Function at 0x1000429f0
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
sub rsp, 0x440
mov rax, qword [0x1000730b0]
xor rax, rsp
mov qword [rsp + 0x430], rax
mov rbx, rcx
mov rsi, r8
xor r12d, r12d
lea rcx, [rsp + 0x42]
xor edx, edx
mov r8d, 0x3e6
mov ebp, r12d
mov word [rsp + 0x40], r12w
call sub.msvcrt.dll_memset
lea r9d, [r12 + 0xa]
lea r8, [rsp + 0x20]
lea edx, [r12 + 0xc]
mov ecx, 0x400
mov word [rbx], r12w
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov r9d, dword [rsi]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x20]
repne scasw ax, word [rdi]
cmp r9d, r12d
mov edi, 0x1f4
not rcx
lea rax, [rcx - 1]
lea ecx, [r12 + 0x20]
cdqe
mov word [rsp + rax*2 + 0x20], cx
mov word [rsp + rax*2 + 0x22], r12w
jle 0x100042ad5
lea r8, [0x100065230]
lea rcx, [rsp + 0x40]
mov rdx, rdi
call fcn.10001e3d4
lea r8, [rsp + 0x40]
mov rdx, rdi
mov rcx, rbx
call fcn.1000031d4
cmp eax, r12d
jne 0x100042ad0
cmp dword [rsi], 1
mov r8, rdi
mov rdx, rbx
mov ecx, 0x390
jg 0x100042acb
mov ecx, 0x391
call fcn.10004295c
mov ebp, 1
cmp dword [rsi + 4], r12d
jle 0x100042b3f
cmp ebp, r12d
je 0x100042af2
lea r8, [rsp + 0x20]
mov rdx, rdi
mov rcx, rbx
call fcn.1000031d4
jmp 0x100042af7
mov ebp, 1
mov r9d, dword [rsi + 4]
lea r8, [0x100065230]
lea rcx, [rsp + 0x40]
mov rdx, rdi
call fcn.10001e3d4
lea r8, [rsp + 0x40]
mov rdx, rdi
mov rcx, rbx
call fcn.1000031d4
cmp eax, r12d
jne 0x100042b3f
cmp dword [rsi + 4], 1
mov r8, rdi
mov rdx, rbx
mov ecx, 0x392
jg 0x100042b3a
mov ecx, 0x393
call fcn.10004295c
cmp dword [rsi + 8], r12d
jle 0x100042ba9
cmp ebp, r12d
je 0x100042b5c
lea r8, [rsp + 0x20]
mov rdx, rdi
mov rcx, rbx
call fcn.1000031d4
jmp 0x100042b61
mov ebp, 1
mov r9d, dword [rsi + 8]
lea r8, [0x100065230]
lea rcx, [rsp + 0x40]
mov rdx, rdi
call fcn.10001e3d4
lea r8, [rsp + 0x40]
mov rdx, rdi
mov rcx, rbx
call fcn.1000031d4
cmp eax, r12d
jne 0x100042ba9
cmp dword [rsi + 8], 1
mov r8, rdi
mov rdx, rbx
mov ecx, 0x394
jg 0x100042ba4
mov ecx, 0x395
call fcn.10004295c
cmp dword [rsi + 0xc], r12d
jle 0x100042c0c
cmp ebp, r12d
je 0x100042bc4
lea r8, [rsp + 0x20]
mov rdx, rdi
mov rcx, rbx
call fcn.1000031d4
mov r9d, dword [rsi + 0xc]
lea r8, [0x100065230]
lea rcx, [rsp + 0x40]
mov rdx, rdi
call fcn.10001e3d4
lea r8, [rsp + 0x40]
mov rdx, rdi
mov rcx, rbx
call fcn.1000031d4
cmp eax, r12d
jne 0x100042c0c
cmp dword [rsi + 0xc], 1
mov r8, rdi
mov rdx, rbx
mov ecx, 0x396
jg 0x100042c07
mov ecx, 0x397
call fcn.10004295c
mov rcx, qword [rsp + 0x430]
xor rcx, rsp
call fcn.100001c30
lea r11, [rsp + 0x440]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret