joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400eff80
Capabilities:
Hide graphical window

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
lea rcx, str.ui_close_n
call fcn.1400b1c70
mov rcx, rbx
call fcn.1400eb370
mov rcx, qword [rbx + 0x78]
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, rbx
call fcn.1400e7330
cmp dword [rbx + 0x5b0], 0
jne 0x1400f003e
cmp byte [0x1401f3486], 0
je 0x1400effd1
mov rcx, rbx
call fcn.140149020
jmp 0x1400f003e
cmp qword [0x1401f3a98], rbx
mov rax, qword [rbx + 0x1b0]
mov dword [rbx + 0x5b0], 1
jne 0x1400efff4
mov qword [0x1401f3a98], rax
jmp 0x1400f0002
mov rcx, qword [rbx + 0x1b8]
mov qword [rcx + 0x1b0], rax
cmp qword [0x1401f3aa0], rbx
mov rax, qword [rbx + 0x1b8]
jne 0x1400f001b
mov qword [0x1401f3aa0], rax
jmp 0x1400f0029
mov rcx, qword [rbx + 0x1b0]
mov qword [rcx + 0x1b8], rax
mov rax, qword [0x1401f3a70]
mov qword [0x1401f3a70], rbx
mov qword [rbx + 0x1b0], rax
cmp byte [0x1401e2c52], 0
jne 0x1400f005b
cmp qword [0x1401f3a98], 0
jne 0x1400f005b
add rsp, 0x20
pop rbx
jmp fcn.1400e2370
call fcn.1400d5b50
xor ecx, ecx
add rsp, 0x20
pop rbx
jmp fcn.14000d160

Function at 0x1400f1e90
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push rbx
sub rsp, 0x20
cmp byte [0x1401e2cc9], 0
mov rbx, rcx
je 0x1400f1ffc
call fcn.140149ff0
test eax, eax
je 0x1400f1fed
mov rcx, qword [rbx + 0x228]
mov qword [rsp + 0x30], rdi
call fcn.1400d71e0
mov rcx, rbx
call fcn.1400ef4b0
mov r8d, dword [rbx + 0x3c0]
lea rdx, str.CUT_isviewing__d_n
or ecx, 0xffffffff
call fcn.1400b1ca0
xor edi, edi
cmp dword [rbx + 0x3c0], edi
je 0x1400f1f03
mov rdx, qword [rbx + 0x3c8]
mov rcx, qword [rbx + 0x78]
call qword [sym.imp.USER32.dll_ChangeClipboardChain]
mov dword [rbx + 0x3c0], edi
mov rcx, qword [rbx + 0x78]
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x1400f1f7b
call qword [sym.imp.USER32.dll_EmptyClipboard]
mov rcx, rbx
call fcn.1400e4ed0
test rax, rax
je 0x1400f1f75
mov rdx, rax
mov ecx, recv
call qword [sym.imp.USER32.dll_SetClipboardData]
mov ecx, 2
call fcn.1400e4e60
test rax, rax
mov rdi, rax
je 0x1400f1f70
mov ax, word [0x1401f3a48]
test ax, ax
jne 0x1400f1f64
lea rcx, str.Preferred_DropEffect
call qword [sym.imp.USER32.dll_RegisterClipboardFormatW]
mov word [0x1401f3a48], ax
movzx ecx, ax
mov rdx, rdi
call qword [sym.imp.USER32.dll_SetClipboardData]
mov edi, 1
call qword [sym.imp.USER32.dll_CloseClipboard]
lea rdx, str.iscut__d_n
mov r8d, edi
or ecx, 0xffffffff
call fcn.1400b1ca0
test edi, edi
je 0x1400f1fe2
lea rdx, str.ghost_selection_n
or ecx, 0xffffffff
call fcn.1400b1ca0
mov rcx, rbx
call fcn.140121bb0
mov r8d, dword [rbx + 0x3c0]
lea rdx, str.viewing__d_n
or ecx, 0xffffffff
call fcn.1400b1ca0
cmp dword [rbx + 0x3c0], 0
jne 0x1400f1fe2
mov rcx, qword [rbx + 0x78]
call qword [sym.imp.USER32.dll_SetClipboardViewer]
mov dword [rbx + 0x3c0], 1
mov qword [rbx + 0x3c8], rax
mov dword [rbx + 0x3bc], edi
mov rdi, qword [rsp + 0x30]
lea rdx, str.is_cut_done_n
or ecx, 0xffffffff
call fcn.1400b1ca0
add rsp, 0x20
pop rbx
ret
Function at 0x1400f2010
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push rbx
sub rsp, 0x20
cmp byte [0x1401e2cca], 0
mov rbx, rcx
je 0x1400f213e
call fcn.140149ff0
test eax, eax
je 0x1400f213e
mov rcx, qword [rbx + 0x228]
call fcn.1400d71e0
mov rcx, rbx
call fcn.1400ef4b0
mov rcx, qword [rbx + 0x78]
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x1400f213e
call qword [sym.imp.USER32.dll_EmptyClipboard]
mov rcx, rbx
call fcn.1400e4ed0
test rax, rax
je 0x1400f207a
mov rdx, rax
mov ecx, recv
call qword [sym.imp.USER32.dll_SetClipboardData]
mov rcx, rbx
call fcn.1400e5210
test rax, rax
mov rbx, rax
je 0x1400f20b6
mov ax, word [0x1401f3a40]
test ax, ax
jne 0x1400f20aa
lea rcx, str.Shell_IDList_Array
call qword [sym.imp.USER32.dll_RegisterClipboardFormatW]
mov word [0x1401f3a40], ax
movzx ecx, ax
mov rdx, rbx
call qword [sym.imp.USER32.dll_SetClipboardData]
mov edx, 4
lea ecx, [rdx - 2]
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
test rax, rax
mov rbx, rax
je 0x1400f2138
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
test rax, rax
je 0x1400f212f
mov rcx, rbx
mov dword [rax], 5
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
test eax, eax
jne 0x1400f212f
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1400f212f
mov ax, word [0x1401f3a48]
test ax, ax
jne 0x1400f2117
lea rcx, str.Preferred_DropEffect
call qword [sym.imp.USER32.dll_RegisterClipboardFormatW]
mov word [0x1401f3a48], ax
movzx ecx, ax
mov rdx, rbx
call qword [sym.imp.USER32.dll_SetClipboardData]
add rsp, 0x20
pop rbx
jmp qword [sym.imp.USER32.dll_CloseClipboard]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalFree]
call qword [sym.imp.USER32.dll_CloseClipboard]
add rsp, 0x20
pop rbx
ret

Function at 0x1400f2220
Capabilities:
Enumerate gui resources

Disassembly:
sub rsp, 0x28
lea rdx, [rsp + 0x30]
lea rcx, [0x1400e4d50]
mov qword [rsp + 0x30], 0
call qword [sym.imp.USER32.dll_EnumWindows]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1400f2258
call fcn.1400eff80
mov eax, 1
add rsp, 0x28
ret
xor eax, eax
add rsp, 0x28
ret
Function at 0x1400fcc70
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x250
mov rax, qword [0x1401f22c8]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbx, rdx
mov rdi, rcx
lea r8, [rsp + 0x30]
mov r9d, 0x104
mov edx, 0x21
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1400fcce3
movzx eax, word [rsp + 0x30]
sub eax, 0x30
je 0x1400fcccd
cmp eax, 2
jne 0x1400fcce3
movzx eax, word [rbx + 6]
movzx r8d, word [rbx]
jmp 0x1400fcceb
movzx eax, word [rbx]
movzx r9d, word [rbx + 6]
movzx r8d, word [rbx + 2]
lea rdx, str._02d__d__d
jmp 0x1400fccf7
movzx eax, word [rbx]
movzx r8d, word [rbx + 6]
movzx r9d, word [rbx + 2]
lea rdx, str._d__02d__d
mov rcx, rdi
mov dword [rsp + 0x20], eax
call fcn.140163070
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1401931f0
mov rbx, qword [rsp + 0x270]
add rsp, 0x250
pop rdi
ret
Function at 0x1400fcd30
Capabilities:
Get geographical location

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x278
mov rax, qword [0x1401f22c8]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rbx, rcx
mov rcx, qword [rcx + 0x10]
mov rsi, r8
mov rdi, rdx
lea r8, [rsp + 0x30]
mov edx, r9d
call fcn.1400cab50
mov edx, dword [rsp + 0x2c0]
mov rcx, qword [rbx + 0x10]
lea r8, [rsp + 0x40]
mov ebp, eax
call fcn.1400cab50
test ebp, ebp
mov ebx, eax
jne 0x1400fcd8d
test eax, eax
je 0x1400fcf8e
mov rcx, qword [rdi + 8]
cmp byte [rcx], 0
je 0x1400fcda0
mov dl, 0x20
mov rcx, rdi
call fcn.140161990
test rsi, rsi
je 0x1400fcdb0
mov rdx, rsi
mov rcx, rdi
call fcn.140161a40
test ebp, ebp
je 0x1400fcf5e
test ebx, ebx
je 0x1400fcee1
movzx eax, word [rsp + 0x46]
cmp word [rsp + 0x36], ax
jne 0x1400fcdf6
movzx eax, word [rsp + 0x42]
cmp word [rsp + 0x32], ax
jne 0x1400fcdf6
movzx eax, word [rsp + 0x40]
cmp word [rsp + 0x30], ax
jne 0x1400fcdf6
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.1400fcc70
jmp 0x1400fcf8e
lea r8, [rsp + 0x50]
mov r9d, 0x104
mov edx, 0x21
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1400fce4b
movzx eax, word [rsp + 0x50]
sub eax, 0x30
je 0x1400fce31
cmp eax, 2
jne 0x1400fce4b
movzx eax, word [rsp + 0x36]
movzx r8d, word [rsp + 0x30]
jmp 0x1400fce56
movzx eax, word [rsp + 0x30]
movzx r9d, word [rsp + 0x36]
movzx r8d, word [rsp + 0x32]
lea rdx, str._02d__d__d
jmp 0x1400fce63
movzx eax, word [rsp + 0x30]
movzx r8d, word [rsp + 0x36]
movzx r9d, word [rsp + 0x32]
lea rdx, str._d__02d__d
mov rcx, rdi
mov dword [rsp + 0x20], eax
call fcn.140163070
lea rdx, [0x1401a19d0]
mov rcx, rdi
call fcn.140161a40
lea r8, [rsp + 0x50]
mov r9d, 0x104
mov edx, 0x21
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1400fcf6a
movzx eax, word [rsp + 0x50]
sub eax, 0x30
je 0x1400fcec4
cmp eax, 2
jne 0x1400fcf6a
movzx eax, word [rsp + 0x46]
movzx r8d, word [rsp + 0x40]
jmp 0x1400fcf75
movzx eax, word [rsp + 0x40]
movzx r9d, word [rsp + 0x46]
movzx r8d, word [rsp + 0x42]
lea rdx, str._02d__d__d
jmp 0x1400fcf82
lea rdx, [0x1401b9d90]
mov rcx, rdi
call fcn.140161a40
lea r8, [rsp + 0x50]
mov r9d, 0x104
mov edx, 0x21
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1400fcf4b
movzx eax, word [rsp + 0x50]
sub eax, 0x30
je 0x1400fcf31
cmp eax, 2
jne 0x1400fcf4b
movzx eax, word [rsp + 0x36]
movzx r9d, word [rsp + 0x32]
movzx r8d, word [rsp + 0x30]
jmp 0x1400fcf7b
movzx eax, word [rsp + 0x30]
movzx r9d, word [rsp + 0x36]
movzx r8d, word [rsp + 0x32]
lea rdx, str._02d__d__d
jmp 0x1400fcf82
movzx eax, word [rsp + 0x30]
movzx r9d, word [rsp + 0x32]
movzx r8d, word [rsp + 0x36]
jmp 0x1400fcf7b
lea rdx, [0x1401b9d8c]
jmp 0x1400fce76
movzx r8d, word [rsp + 0x46]
movzx eax, word [rsp + 0x40]
movzx r9d, word [rsp + 0x42]
lea rdx, str._d__02d__d
mov rcx, rdi
mov dword [rsp + 0x20], eax
call fcn.140163070
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1401931f0
add rsp, 0x278
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400fe850
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x240
mov rax, qword [0x1401f22c8]
xor rax, rsp
mov qword [rsp + 0x230], rax
xor eax, eax
mov rbx, rdx
mov rsi, rcx
mov qword [rdx], rax
mov qword [rdx + 8], rax
lea r8, [rsp + 0x20]
lea edx, [rax + 0x21]
mov r9d, 0x104
mov ecx, 0x400
lea edi, [rax + 1]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1400fe8ab
movzx edi, word [rsp + 0x20]
sub edi, 0x30
mov rdx, qword [rsi]
movzx eax, byte [rdx]
cmp al, 0x30
jb 0x1400fe9c8
cmp al, 0x39
ja 0x1400fe9c8
xor r11d, r11d
test al, al
mov r10, r11
je 0x1400fe8f4
nop
nop
cmp al, 0x30
jb 0x1400fe8f4
cmp al, 0x39
ja 0x1400fe8f4
movzx eax, al
add rdx, 1
sub eax, 0x30
movsxd rcx, eax
lea rax, [r10 + r10*4]
lea r10, [rcx + rax*2]
movzx eax, byte [rdx]
test al, al
jne 0x1400fe8d0
lea r8, str._.:t
mov qword [rsi], rdx
mov al, 0x2f
mov rcx, r8
sub rcx, rdx
cmp byte [rdx], al
jne 0x1400fe9c8
movzx eax, byte [rcx + rdx + 1]
add rdx, 1
test al, al
jne 0x1400fe906
mov qword [rsi], rdx
movzx eax, byte [rdx]
cmp al, 0x30
jb 0x1400fe9c8
cmp al, 0x39
ja 0x1400fe9c8
test al, al
je 0x1400fe958
cmp al, 0x30
jb 0x1400fe958
cmp al, 0x39
ja 0x1400fe958
movzx eax, al
add rdx, 1
sub eax, 0x30
movsxd rcx, eax
lea rax, [r11 + r11*4]
lea r11, [rcx + rax*2]
mov al, byte [rdx]
test al, al
jne 0x1400fe935
mov qword [rsi], rdx
mov al, 0x2f
sub r8, rdx
cmp byte [rdx], al
jne 0x1400fe9c8
movzx eax, byte [r8 + rdx + 1]
add rdx, 1
test al, al
jne 0x1400fe960
mov qword [rsi], rdx
movzx eax, byte [rdx]
cmp al, 0x30
jb 0x1400fe9c8
cmp al, 0x39
ja 0x1400fe9c8
mov rcx, rsi
call fcn.1400fe810
test edi, edi
je 0x1400fe9b4
cmp edi, 2
mov word [rbx + 2], r11w
je 0x1400fe9a5
mov word [rbx], ax
mov word [rbx + 6], r10w
mov eax, 1
jmp 0x1400fe9ca
mov word [rbx + 6], ax
mov word [rbx], r10w
mov eax, 1
jmp 0x1400fe9ca
mov word [rbx], ax
mov word [rbx + 2], r10w
mov word [rbx + 6], r11w
mov eax, 1
jmp 0x1400fe9ca
xor eax, eax
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1401931f0
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140128cb0
Capabilities:
Move file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp byte [rcx + 0x400], 0
mov edi, r8d
mov esi, edx
mov rbx, rcx
je 0x140128ce9
mov rcx, qword [rcx + 0x3d8]
mov edx, 1
call qword [sym.imp.USER32.dll_KillTimer]
mov byte [rbx + 0x400], 0
xor r9d, r9d
mov r8d, edi
mov edx, esi
mov rcx, rbx
call fcn.140125d00
cmp eax, 0xffffffff
je 0x140128d40
mov ecx, setsockopt
call fcn.1400c9260
mov rcx, rbx
test eax, eax
je 0x140128d28
mov edx, 0xa031
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp fcn.1400f6bf0
movsx eax, byte [0x1401f3475]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], eax
call fcn.1400f22d0
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x1401290d0
Capabilities:
Move file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rax, rdx
movsx esi, dx
mov rbx, rcx
shr rax, 0x10
mov edx, esi
movsx edi, ax
mov r8d, edi
call fcn.140126460
test eax, eax
jne 0x1401291e2
movsx ecx, byte [0x1401f3453]
sub ecx, 1
je 0x1401291e2
cmp ecx, 1
je 0x140129169
cmp dword [rbx + 0x46c], 0xffffffff
jne 0x140129160
mov dword [rbx + 0x46c], eax
mov rax, qword [0x1401f3918]
test rax, rax
je 0x14012914e
lea rcx, [rsp + 0x48]
mov edx, 0x80
call rax
test byte [rsp + 0x48], 0x20
jne 0x14012914e
mov dword [rbx + 0x46c], 1
mov edx, dword [rbx + 0x46c]
lea rcx, str.cached_oneclickactivate__d_n
call fcn.1400b1c70
cmp dword [rbx + 0x46c], 0
jne 0x1401291e2
cmp byte [rbx + 0x400], 0
je 0x14012918b
mov rcx, qword [rbx + 0x3d8]
mov edx, 1
call qword [sym.imp.USER32.dll_KillTimer]
mov byte [rbx + 0x400], 0
xor r9d, r9d
mov r8d, edi
mov edx, esi
mov rcx, rbx
call fcn.140125d00
cmp eax, 0xffffffff
je 0x1401291e2
mov ecx, setsockopt
call fcn.1400c9260
mov rcx, rbx
test eax, eax
je 0x1401291ca
mov edx, 0xa031
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
jmp fcn.1400f6bf0
movsx eax, byte [0x1401f3475]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], eax
call fcn.1400f22d0
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x140129970
Capabilities:
Change the wallpaper

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
movsxd rbx, edx
mov rdi, rcx
call fcn.14014a3d0
test eax, eax
je 0x1401299a6
xor r9d, r9d
mov r8, rbx
mov rcx, rdi
lea edx, [r9 + 5]
call fcn.1400e7bf0
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
imul ebx, ebx, 0xfffffffb
mov eax, 0x88888889
add dword [rdi + 0x428], ebx
mov ecx, dword [rdi + 0x428]
imul ecx
lea ebx, [rcx + rdx]
sar ebx, 6
mov eax, ebx
shr eax, 0x1f
add ebx, eax
je 0x140129af8
mov eax, ebx
xor edx, edx
lea r8, [rsp + 0x80]
xor r9d, r9d
imul eax, eax, 0x78
sub ecx, eax
mov dword [rdi + 0x428], ecx
lea ecx, [rdx + 0x68]
call qword [sym.imp.USER32.dll_SystemParametersInfoW]
mov r11d, dword [rsp + 0x80]
mov rcx, qword [rdi + 0x3d8]
cmp r11d, 1
mov eax, 3
cmovb r11d, eax
mov dword [rsp + 0x80], r11d
call fcn.1400c77d0
bt eax, 0x14
jae 0x140129af8
mov rcx, qword [rdi + 0x3d8]
xor eax, eax
lea r8, [rsp + 0x20]
mov qword [rsp + 0x20], rax
xor edx, edx
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x20], 0x1c
mov dword [rsp + 0x24], 2
call qword [sym.imp.USER32.dll_GetScrollInfo]
mov esi, dword [rsp + 0x80]
mov eax, dword [rsp + 0x30]
cmp esi, eax
cmova esi, eax
cmp byte [rdi + 0x230], 0
mov dword [rsp + 0x80], esi
je 0x140129a85
neg ebx
mov rcx, qword [rdi + 0x3d8]
imul esi, ebx
call fcn.1400c77d0
bt eax, 0x14
jae 0x140129add
mov rcx, qword [rdi + 0x3d8]
xor eax, eax
lea r8, [rsp + 0x40]
mov qword [rsp + 0x40], rax
xor edx, edx
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x58], eax
mov dword [rsp + 0x40], 0x1c
mov dword [rsp + 0x44], 4
call qword [sym.imp.USER32.dll_GetScrollInfo]
test eax, eax
je 0x140129add
mov eax, dword [rsp + 0x54]
jmp 0x140129adf
xor eax, eax
mov r9d, 1
lea edx, [rax + rsi]
mov rcx, rdi
mov r8d, r9d
call fcn.140129200
mov rsi, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
Function at 0x14012ddc0
Capabilities:
Capture webcam image

Disassembly:
push rbx
sub rsp, 0x20
call qword [sym.imp.USER32.dll_GetDlgItem]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
mov edx, 0x188
mov rbx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0xffffffff
jne 0x1400c589c
xor r9d, r9d
xor r8d, r8d
mov edx, 0x186
mov rcx, rbx
call qword [sym.imp.USER32.dll_SendMessageW]
add rsp, 0x20
pop rbx
ret
push rbx
sub rsp, 0x20
mov rbx, qword [rcx + 0x90]
mov edx, 0x40e
mov rcx, rbx
call qword [sym.imp.USER32.dll_IsDlgButtonChecked]
mov edx, 0x411
mov rcx, rbx
cmp eax, 1
jne 0x14012dec2
call fcn.1400c4e40
mov edx, 0x412
mov rcx, rbx
call fcn.1400c4e40
mov edx, 0x413
mov rcx, rbx
call fcn.1400c4e40
mov edx, 0x414
mov rcx, rbx
call fcn.1400c4e40
mov edx, 0x415
mov rcx, rbx
call fcn.1400c4e40
mov edx, 0x416
mov rcx, rbx
call fcn.1400c4e40
mov edx, 0x417
mov rcx, rbx
call fcn.1400c4e40
mov edx, 0x418
mov rcx, rbx
call fcn.1400c4e40
mov edx, 0x412
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetDlgItem]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
mov edx, 0x18b
call qword [sym.imp.USER32.dll_SendMessageW]
mov edx, 0x419
mov rcx, rbx
test eax, eax
je 0x14012de9e
call fcn.1400c4e40
mov edx, 0x41a
mov rcx, rbx
call fcn.1400c4e40
mov edx, 0x412
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp 0x1400c5860
call fcn.1400c4da0
mov edx, 0x41a
mov rcx, rbx
call fcn.1400c4da0
mov edx, 0x412
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp 0x1400c5860
call fcn.1400c4da0
mov edx, 0x412
mov rcx, rbx
call fcn.1400c4da0
mov edx, 0x413
mov rcx, rbx
call fcn.1400c4da0
mov edx, 0x414
mov rcx, rbx
call fcn.1400c4da0
mov edx, 0x415
mov rcx, rbx
call fcn.1400c4da0
mov edx, 0x416
mov rcx, rbx
call fcn.1400c4da0
mov edx, 0x417
mov rcx, rbx
call fcn.1400c4da0
mov edx, 0x418
mov rcx, rbx
call fcn.1400c4da0
mov edx, 0x419
mov rcx, rbx
call fcn.1400c4da0
mov edx, 0x41a
mov rcx, rbx
call fcn.1400c4da0
mov edx, 0x412
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetDlgItem]
xor r9d, r9d
or r8, 0xffffffffffffffff
mov rcx, rax
mov edx, 0x186
add rsp, 0x20
pop rbx
jmp qword [sym.imp.USER32.dll_SendMessageW]
Function at 0x14012f720
Capabilities:
Persist via run registry key

Disassembly:
push rbx
sub rsp, 0x390
mov rax, qword [0x1401f22c8]
xor rax, rsp
mov qword [rsp + 0x380], rax
lea rcx, [rsp + 0x140]
call fcn.1401617b0
lea r9, [rsp + 0x140]
lea r8, [0x14019e570]
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov rcx, 0xffffffff80000002
xor ebx, ebx
call fcn.1400c9670
test eax, eax
je 0x14012f873
lea rcx, [rsp + 0x20]
call fcn.1401617b0
lea rcx, [rsp + 0x260]
mov ebx, 2
call fcn.1401617b0
lea rcx, [rsp + 0x260]
xor edx, edx
call fcn.1400c8740
mov r8, qword [rsp + 0x268]
lea rdx, str.__s___startup
lea rcx, [rsp + 0x20]
call fcn.140162e20
call fcn.1400bd380
test rax, rax
je 0x14012f7db
call fcn.1400bd380
lea rdx, str.__instance___s_
lea rcx, [rsp + 0x20]
mov r8, rax
call fcn.140163070
mov r8, qword [0x1401f37a0]
cmp qword [r8 + 0x18], 0
je 0x14012f7fe
mov r8, qword [r8 + 0x18]
lea rdx, str.__config___s_
lea rcx, [rsp + 0x20]
call fcn.140163070
lea rcx, [rsp + 0x260]
call fcn.140001150
mov rdx, qword [rsp + 0x148]
lea rcx, str.reg:__s_n
call fcn.1400b1c70
mov rdx, qword [rsp + 0x28]
lea rcx, str.set:__s_n
call fcn.1400b1c70
mov r11, qword [rsp + 0x28]
mov rax, qword [rsp + 0x148]
movzx ecx, byte [r11]
cmp cl, byte [rax]
jne 0x14012f859
test cl, cl
je 0x14012f864
mov cl, byte [r11 + 1]
add r11, 1
add rax, 1
cmp cl, byte [rax]
je 0x14012f845
movzx eax, byte [rax]
movzx ecx, byte [r11]
cmp ecx, eax
jne 0x14012f869
mov ebx, 1
lea rcx, [rsp + 0x20]
call fcn.140001150
lea rcx, [rsp + 0x140]
call fcn.140001150
mov eax, ebx
mov rcx, qword [rsp + 0x380]
xor rcx, rsp
call fcn.1401931f0
add rsp, 0x390
pop rbx
ret

Function at 0x140134af0
Capabilities:
Persist via run registry key

Disassembly:
sub rsp, 0x38
lea r8, [0x14019e570]
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov rcx, 0xffffffff80000002
call fcn.1400d1100
call fcn.1400bd380
test rax, rax
jne 0x140134b73
call fcn.1400ca260
test eax, eax
je 0x140134b73
lea rax, [rsp + 0x40]
lea rdx, str.Software_voidtoolsEverything
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call fcn.1400c95c0
test eax, eax
je 0x140134b73
lea r8, str.InstallRunOnStartup
lea rdx, str.Software_voidtoolsEverything
xor r9d, r9d
mov rcx, 0xffffffff80000002
call fcn.1400d0ff0
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x38
ret
Function at 0x140138890
Capabilities:
Persist via run registry key

Disassembly:
sub rsp, 0x298
mov rax, qword [0x1401f22c8]
xor rax, rsp
mov qword [rsp + 0x280], rax
lea r8, [0x14019e570]
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov rcx, 0xffffffff80000002
call fcn.1400d1100
call fcn.1400bd380
test rax, rax
jne 0x140138928
call fcn.1400ca260
test eax, eax
je 0x140138928
lea rax, [rsp + 0x30]
lea rdx, str.Software_voidtoolsEverything
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call fcn.1400c95c0
test eax, eax
je 0x140138928
lea r8, str.InstallRunOnStartup
lea rdx, str.Software_voidtoolsEverything
xor r9d, r9d
mov rcx, 0xffffffff80000002
call fcn.1400d0ff0
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [rsp + 0x40]
call fcn.1401617b0
lea rcx, [rsp + 0x160]
call fcn.1401617b0
lea rcx, [rsp + 0x160]
xor edx, edx
call fcn.1400c8740
mov r8, qword [rsp + 0x168]
lea rdx, str.__s___startup
lea rcx, [rsp + 0x40]
call fcn.140162e20
call fcn.1400bd380
test rax, rax
je 0x14013898a
call fcn.1400bd380
lea rdx, str.__instance___s_
lea rcx, [rsp + 0x40]
mov r8, rax
call fcn.140163070
mov r8, qword [0x1401f37a0]
cmp qword [r8 + 0x18], 0
je 0x1401389ad
mov r8, qword [r8 + 0x18]
lea rdx, str.__config___s_
lea rcx, [rsp + 0x40]
call fcn.140163070
lea rcx, [rsp + 0x160]
call fcn.140001150
mov r9, qword [rsp + 0x48]
lea r8, [0x14019e570]
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov rcx, 0xffffffff80000002
call fcn.1400d0eb0
call fcn.1400bd380
test rax, rax
jne 0x140138a41
call fcn.1400ca260
test eax, eax
je 0x140138a41
lea rax, [rsp + 0x30]
lea rdx, str.Software_voidtoolsEverything
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call fcn.1400c95c0
test eax, eax
je 0x140138a41
lea r8, str.InstallRunOnStartup
lea rdx, str.Software_voidtoolsEverything
mov r9d, 1
mov rcx, 0xffffffff80000002
call fcn.1400d0ff0
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [rsp + 0x40]
call fcn.140001150
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.1401931f0
add rsp, 0x298
ret