joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14010e9a0
Capabilities:
Get geographical location

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x278
mov rax, qword [0x14020cc58]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rbx, rcx
mov rcx, qword [rcx + 0x10]
mov rsi, r8
mov rdi, rdx
lea r8, [rsp + 0x30]
mov edx, r9d
call fcn.1400dbd90
mov edx, dword [rsp + 0x2c0]
mov rcx, qword [rbx + 0x10]
lea r8, [rsp + 0x40]
mov ebp, eax
call fcn.1400dbd90
test ebp, ebp
mov ebx, eax
jne 0x14010e9fd
test eax, eax
je 0x14010ebfe
mov rcx, qword [rdi + 8]
cmp byte [rcx], 0
je 0x14010ea10
mov dl, 0x20
mov rcx, rdi
call fcn.140177460
test rsi, rsi
je 0x14010ea20
mov rdx, rsi
mov rcx, rdi
call fcn.140177510
test ebp, ebp
je 0x14010ebce
test ebx, ebx
je 0x14010eb51
movzx eax, word [rsp + 0x46]
cmp word [rsp + 0x36], ax
jne 0x14010ea66
movzx eax, word [rsp + 0x42]
cmp word [rsp + 0x32], ax
jne 0x14010ea66
movzx eax, word [rsp + 0x40]
cmp word [rsp + 0x30], ax
jne 0x14010ea66
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.14010e8e0
jmp 0x14010ebfe
lea r8, [rsp + 0x50]
mov r9d, 0x104
mov edx, 0x21
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x14010eabb
movzx eax, word [rsp + 0x50]
sub eax, 0x30
je 0x14010eaa1
cmp eax, 2
jne 0x14010eabb
movzx eax, word [rsp + 0x36]
movzx r8d, word [rsp + 0x30]
jmp 0x14010eac6
movzx eax, word [rsp + 0x30]
movzx r9d, word [rsp + 0x36]
movzx r8d, word [rsp + 0x32]
lea rdx, str._02d__d__d
jmp 0x14010ead3
movzx eax, word [rsp + 0x30]
movzx r8d, word [rsp + 0x36]
movzx r9d, word [rsp + 0x32]
lea rdx, str._d__02d__d
mov rcx, rdi
mov dword [rsp + 0x20], eax
call fcn.140178bf0
lea rdx, [0x1401b7eb0]
mov rcx, rdi
call fcn.140177510
lea r8, [rsp + 0x50]
mov r9d, 0x104
mov edx, 0x21
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x14010ebda
movzx eax, word [rsp + 0x50]
sub eax, 0x30
je 0x14010eb34
cmp eax, 2
jne 0x14010ebda
movzx eax, word [rsp + 0x46]
movzx r8d, word [rsp + 0x40]
jmp 0x14010ebe5
movzx eax, word [rsp + 0x40]
movzx r9d, word [rsp + 0x46]
movzx r8d, word [rsp + 0x42]
lea rdx, str._02d__d__d
jmp 0x14010ebf2
lea rdx, [0x1401d2c70]
mov rcx, rdi
call fcn.140177510
lea r8, [rsp + 0x50]
mov r9d, 0x104
mov edx, 0x21
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x14010ebbb
movzx eax, word [rsp + 0x50]
sub eax, 0x30
je 0x14010eba1
cmp eax, 2
jne 0x14010ebbb
movzx eax, word [rsp + 0x36]
movzx r9d, word [rsp + 0x32]
movzx r8d, word [rsp + 0x30]
jmp 0x14010ebeb
movzx eax, word [rsp + 0x30]
movzx r9d, word [rsp + 0x36]
movzx r8d, word [rsp + 0x32]
lea rdx, str._02d__d__d
jmp 0x14010ebf2
movzx eax, word [rsp + 0x30]
movzx r9d, word [rsp + 0x32]
movzx r8d, word [rsp + 0x36]
jmp 0x14010ebeb
lea rdx, [0x1401d2c6c]
jmp 0x14010eae6
movzx r8d, word [rsp + 0x46]
movzx eax, word [rsp + 0x40]
movzx r9d, word [rsp + 0x42]
lea rdx, str._d__02d__d
mov rcx, rdi
mov dword [rsp + 0x20], eax
call fcn.140178bf0
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1401a8fb0
add rsp, 0x278
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140110480
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x240
mov rax, qword [0x14020cc58]
xor rax, rsp
mov qword [rsp + 0x230], rax
xor eax, eax
mov rbx, rdx
mov rsi, rcx
mov qword [rdx], rax
mov qword [rdx + 8], rax
lea r8, [rsp + 0x20]
lea edx, [rax + 0x21]
mov r9d, 0x104
mov ecx, 0x400
lea edi, [rax + 1]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1401104db
movzx edi, word [rsp + 0x20]
sub edi, 0x30
mov rdx, qword [rsi]
movzx eax, byte [rdx]
cmp al, 0x30
jb 0x1401105f8
cmp al, 0x39
ja 0x1401105f8
xor r11d, r11d
test al, al
mov r10, r11
je 0x140110524
nop
nop
cmp al, 0x30
jb 0x140110524
cmp al, 0x39
ja 0x140110524
movzx eax, al
add rdx, 1
sub eax, 0x30
movsxd rcx, eax
lea rax, [r10 + r10*4]
lea r10, [rcx + rax*2]
movzx eax, byte [rdx]
test al, al
jne 0x140110500
lea r8, str._.:t
mov qword [rsi], rdx
mov al, 0x2f
mov rcx, r8
sub rcx, rdx
cmp byte [rdx], al
jne 0x1401105f8
movzx eax, byte [rcx + rdx + 1]
add rdx, 1
test al, al
jne 0x140110536
mov qword [rsi], rdx
movzx eax, byte [rdx]
cmp al, 0x30
jb 0x1401105f8
cmp al, 0x39
ja 0x1401105f8
test al, al
je 0x140110588
cmp al, 0x30
jb 0x140110588
cmp al, 0x39
ja 0x140110588
movzx eax, al
add rdx, 1
sub eax, 0x30
movsxd rcx, eax
lea rax, [r11 + r11*4]
lea r11, [rcx + rax*2]
mov al, byte [rdx]
test al, al
jne 0x140110565
mov qword [rsi], rdx
mov al, 0x2f
sub r8, rdx
cmp byte [rdx], al
jne 0x1401105f8
movzx eax, byte [r8 + rdx + 1]
add rdx, 1
test al, al
jne 0x140110590
mov qword [rsi], rdx
movzx eax, byte [rdx]
cmp al, 0x30
jb 0x1401105f8
cmp al, 0x39
ja 0x1401105f8
mov rcx, rsi
call fcn.140175d70
test edi, edi
je 0x1401105e4
cmp edi, 2
mov word [rbx + 2], r11w
je 0x1401105d5
mov word [rbx], ax
mov word [rbx + 6], r10w
mov eax, 1
jmp 0x1401105fa
mov word [rbx + 6], ax
mov word [rbx], r10w
mov eax, 1
jmp 0x1401105fa
mov word [rbx], ax
mov word [rbx + 2], r10w
mov word [rbx + 6], r11w
mov eax, 1
jmp 0x1401105fa
xor eax, eax
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1401a8fb0
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14013b9d0
Capabilities:
Move file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp byte [rcx + 0x400], 0
mov edi, r8d
mov esi, edx
mov rbx, rcx
je 0x14013ba09
mov rcx, qword [rcx + 0x3d8]
mov edx, 1
call qword [sym.imp.USER32.dll_KillTimer]
mov byte [rbx + 0x400], 0
xor r9d, r9d
mov r8d, edi
mov edx, esi
mov rcx, rbx
call fcn.140138950
cmp eax, 0xffffffff
je 0x14013ba60
mov ecx, send
call fcn.1400da310
mov rcx, rbx
test eax, eax
je 0x14013ba48
mov edx, 0xa031
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp fcn.140108860
movsx eax, byte [0x14020ddf5]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], eax
call fcn.140103b80
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x14013bdf0
Capabilities:
Move file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rax, rdx
movsx esi, dx
mov rbx, rcx
shr rax, 0x10
mov edx, esi
movsx edi, ax
mov r8d, edi
call fcn.1401390b0
test eax, eax
jne 0x14013bf02
movsx ecx, byte [0x14020ddd3]
sub ecx, 1
je 0x14013bf02
cmp ecx, 1
je 0x14013be89
cmp dword [rbx + 0x46c], 0xffffffff
jne 0x14013be80
mov dword [rbx + 0x46c], eax
mov rax, qword [0x14020e348]
test rax, rax
je 0x14013be6e
lea rcx, [rsp + 0x48]
mov edx, 0x80
call rax
test byte [rsp + 0x48], 0x20
jne 0x14013be6e
mov dword [rbx + 0x46c], 1
mov edx, dword [rbx + 0x46c]
lea rcx, str.cached_oneclickactivate__d_n
call fcn.1400b3fb0
cmp dword [rbx + 0x46c], 0
jne 0x14013bf02
cmp byte [rbx + 0x400], 0
je 0x14013beab
mov rcx, qword [rbx + 0x3d8]
mov edx, 1
call qword [sym.imp.USER32.dll_KillTimer]
mov byte [rbx + 0x400], 0
xor r9d, r9d
mov r8d, edi
mov edx, esi
mov rcx, rbx
call fcn.140138950
cmp eax, 0xffffffff
je 0x14013bf02
mov ecx, send
call fcn.1400da310
mov rcx, rbx
test eax, eax
je 0x14013beea
mov edx, 0xa031
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
jmp fcn.140108860
movsx eax, byte [0x14020ddf5]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], eax
call fcn.140103b80
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x14013c690
Capabilities:
Change the wallpaper

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
movsxd rbx, edx
mov rdi, rcx
call fcn.14015f700
test eax, eax
je 0x14013c6c6
xor r9d, r9d
mov r8, rbx
mov rcx, rdi
lea edx, [r9 + 5]
call fcn.1400f94a0
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
imul ebx, ebx, 0xfffffffb
mov eax, 0x88888889
add dword [rdi + 0x428], ebx
mov ecx, dword [rdi + 0x428]
imul ecx
lea ebx, [rcx + rdx]
sar ebx, 6
mov eax, ebx
shr eax, 0x1f
add ebx, eax
je 0x14013c818
mov eax, ebx
xor edx, edx
lea r8, [rsp + 0x80]
xor r9d, r9d
imul eax, eax, 0x78
sub ecx, eax
mov dword [rdi + 0x428], ecx
lea ecx, [rdx + 0x68]
call qword [sym.imp.USER32.dll_SystemParametersInfoW]
mov r11d, dword [rsp + 0x80]
mov rcx, qword [rdi + 0x3d8]
cmp r11d, 1
mov eax, 3
cmovb r11d, eax
mov dword [rsp + 0x80], r11d
call fcn.1400d8890
bt eax, 0x14
jae 0x14013c818
mov rcx, qword [rdi + 0x3d8]
xor eax, eax
lea r8, [rsp + 0x20]
mov qword [rsp + 0x20], rax
xor edx, edx
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x20], 0x1c
mov dword [rsp + 0x24], 2
call qword [sym.imp.USER32.dll_GetScrollInfo]
mov esi, dword [rsp + 0x80]
mov eax, dword [rsp + 0x30]
cmp esi, eax
cmova esi, eax
cmp byte [rdi + 0x230], 0
mov dword [rsp + 0x80], esi
je 0x14013c7a5
neg ebx
mov rcx, qword [rdi + 0x3d8]
imul esi, ebx
call fcn.1400d8890
bt eax, 0x14
jae 0x14013c7fd
mov rcx, qword [rdi + 0x3d8]
xor eax, eax
lea r8, [rsp + 0x40]
mov qword [rsp + 0x40], rax
xor edx, edx
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x58], eax
mov dword [rsp + 0x40], 0x1c
mov dword [rsp + 0x44], 4
call qword [sym.imp.USER32.dll_GetScrollInfo]
test eax, eax
je 0x14013c7fd
mov eax, dword [rsp + 0x54]
jmp 0x14013c7ff
xor eax, eax
mov r9d, 1
lea edx, [rax + rsi]
mov rcx, rdi
mov r8d, r9d
call fcn.14013bf20
mov rsi, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
Function at 0x140141bf0
Capabilities:
Capture webcam image

Disassembly:
push rbx
sub rsp, 0x20
call qword [sym.imp.USER32.dll_GetDlgItem]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
mov edx, 0x188
mov rbx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0xffffffff
jne 0x1400d695c
xor r9d, r9d
xor r8d, r8d
mov edx, 0x186
mov rcx, rbx
call qword [sym.imp.USER32.dll_SendMessageW]
add rsp, 0x20
pop rbx
ret
push rbx
sub rsp, 0x20
mov rbx, qword [rcx + 0x90]
mov edx, 0x40e
mov rcx, rbx
call qword [sym.imp.USER32.dll_IsDlgButtonChecked]
mov edx, 0x411
mov rcx, rbx
cmp eax, 1
jne 0x140141cf2
call fcn.1400d5f00
mov edx, 0x412
mov rcx, rbx
call fcn.1400d5f00
mov edx, 0x413
mov rcx, rbx
call fcn.1400d5f00
mov edx, 0x414
mov rcx, rbx
call fcn.1400d5f00
mov edx, 0x415
mov rcx, rbx
call fcn.1400d5f00
mov edx, 0x416
mov rcx, rbx
call fcn.1400d5f00
mov edx, 0x417
mov rcx, rbx
call fcn.1400d5f00
mov edx, 0x418
mov rcx, rbx
call fcn.1400d5f00
mov edx, 0x412
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetDlgItem]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
mov edx, 0x18b
call qword [sym.imp.USER32.dll_SendMessageW]
mov edx, 0x419
mov rcx, rbx
test eax, eax
je 0x140141cce
call fcn.1400d5f00
mov edx, 0x41a
mov rcx, rbx
call fcn.1400d5f00
mov edx, 0x412
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp 0x1400d6920
call fcn.1400d5e60
mov edx, 0x41a
mov rcx, rbx
call fcn.1400d5e60
mov edx, 0x412
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp 0x1400d6920
call fcn.1400d5e60
mov edx, 0x412
mov rcx, rbx
call fcn.1400d5e60
mov edx, 0x413
mov rcx, rbx
call fcn.1400d5e60
mov edx, 0x414
mov rcx, rbx
call fcn.1400d5e60
mov edx, 0x415
mov rcx, rbx
call fcn.1400d5e60
mov edx, 0x416
mov rcx, rbx
call fcn.1400d5e60
mov edx, 0x417
mov rcx, rbx
call fcn.1400d5e60
mov edx, 0x418
mov rcx, rbx
call fcn.1400d5e60
mov edx, 0x419
mov rcx, rbx
call fcn.1400d5e60
mov edx, 0x41a
mov rcx, rbx
call fcn.1400d5e60
mov edx, 0x412
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetDlgItem]
xor r9d, r9d
or r8, 0xffffffffffffffff
mov rcx, rax
mov edx, 0x186
add rsp, 0x20
pop rbx
jmp qword [sym.imp.USER32.dll_SendMessageW]
Function at 0x140143550
Capabilities:
Persist via run registry key

Disassembly:
push rbx
sub rsp, 0x390
mov rax, qword [0x14020cc58]
xor rax, rsp
mov qword [rsp + 0x380], rax
lea rcx, [rsp + 0x140]
call fcn.140177280
lea r9, [rsp + 0x140]
lea r8, [0x1401b4940]
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov rcx, 0xffffffff80000002
xor ebx, ebx
call fcn.1400da720
test eax, eax
je 0x1401436a3
lea rcx, [rsp + 0x20]
call fcn.140177280
lea rcx, [rsp + 0x260]
mov ebx, 2
call fcn.140177280
lea rcx, [rsp + 0x260]
xor edx, edx
call fcn.1400d97f0
mov r8, qword [rsp + 0x268]
lea rdx, str.__s___startup
lea rcx, [rsp + 0x20]
call fcn.1401789a0
call fcn.1400ce420
test rax, rax
je 0x14014360b
call fcn.1400ce420
lea rdx, str.__instance___s_
lea rcx, [rsp + 0x20]
mov r8, rax
call fcn.140178bf0
mov r8, qword [0x14020e1d0]
cmp qword [r8 + 0x18], 0
je 0x14014362e
mov r8, qword [r8 + 0x18]
lea rdx, str.__config___s_
lea rcx, [rsp + 0x20]
call fcn.140178bf0
lea rcx, [rsp + 0x260]
call fcn.14017d580
mov rdx, qword [rsp + 0x148]
lea rcx, str.reg:__s_n
call fcn.1400b3fb0
mov rdx, qword [rsp + 0x28]
lea rcx, str.set:__s_n
call fcn.1400b3fb0
mov r11, qword [rsp + 0x28]
mov rax, qword [rsp + 0x148]
movzx ecx, byte [r11]
cmp cl, byte [rax]
jne 0x140143689
test cl, cl
je 0x140143694
mov cl, byte [r11 + 1]
add r11, 1
add rax, 1
cmp cl, byte [rax]
je 0x140143675
movzx eax, byte [rax]
movzx ecx, byte [r11]
cmp ecx, eax
jne 0x140143699
mov ebx, 1
lea rcx, [rsp + 0x20]
call fcn.14017d580
lea rcx, [rsp + 0x140]
call fcn.14017d580
mov eax, ebx
mov rcx, qword [rsp + 0x380]
xor rcx, rsp
call fcn.1401a8fb0
add rsp, 0x390
pop rbx
ret

Function at 0x140148950
Capabilities:
Persist via run registry key

Disassembly:
sub rsp, 0x38
lea r8, [0x1401b4940]
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov rcx, 0xffffffff80000002
call fcn.1400e2360
call fcn.1400ce420
test rax, rax
jne 0x1401489d3
call fcn.1400db310
test eax, eax
je 0x1401489d3
lea rax, [rsp + 0x40]
lea rdx, str.Software_voidtoolsEverything
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call fcn.1400da670
test eax, eax
je 0x1401489d3
lea r8, str.InstallRunOnStartup
lea rdx, str.Software_voidtoolsEverything
xor r9d, r9d
mov rcx, 0xffffffff80000002
call fcn.1400e2250
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x38
ret
Function at 0x14014c6f0
Capabilities:
Persist via run registry key

Disassembly:
sub rsp, 0x298
mov rax, qword [0x14020cc58]
xor rax, rsp
mov qword [rsp + 0x280], rax
lea r8, [0x1401b4940]
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov rcx, 0xffffffff80000002
call fcn.1400e2360
call fcn.1400ce420
test rax, rax
jne 0x14014c788
call fcn.1400db310
test eax, eax
je 0x14014c788
lea rax, [rsp + 0x30]
lea rdx, str.Software_voidtoolsEverything
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call fcn.1400da670
test eax, eax
je 0x14014c788
lea r8, str.InstallRunOnStartup
lea rdx, str.Software_voidtoolsEverything
xor r9d, r9d
mov rcx, 0xffffffff80000002
call fcn.1400e2250
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [rsp + 0x40]
call fcn.140177280
lea rcx, [rsp + 0x160]
call fcn.140177280
lea rcx, [rsp + 0x160]
xor edx, edx
call fcn.1400d97f0
mov r8, qword [rsp + 0x168]
lea rdx, str.__s___startup
lea rcx, [rsp + 0x40]
call fcn.1401789a0
call fcn.1400ce420
test rax, rax
je 0x14014c7ea
call fcn.1400ce420
lea rdx, str.__instance___s_
lea rcx, [rsp + 0x40]
mov r8, rax
call fcn.140178bf0
mov r8, qword [0x14020e1d0]
cmp qword [r8 + 0x18], 0
je 0x14014c80d
mov r8, qword [r8 + 0x18]
lea rdx, str.__config___s_
lea rcx, [rsp + 0x40]
call fcn.140178bf0
lea rcx, [rsp + 0x160]
call fcn.14017d580
mov r9, qword [rsp + 0x48]
lea r8, [0x1401b4940]
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov rcx, 0xffffffff80000002
call fcn.1400e2110
call fcn.1400ce420
test rax, rax
jne 0x14014c8a1
call fcn.1400db310
test eax, eax
je 0x14014c8a1
lea rax, [rsp + 0x30]
lea rdx, str.Software_voidtoolsEverything
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call fcn.1400da670
test eax, eax
je 0x14014c8a1
lea r8, str.InstallRunOnStartup
lea rdx, str.Software_voidtoolsEverything
mov r9d, 1
mov rcx, 0xffffffff80000002
call fcn.1400e2250
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [rsp + 0x40]
call fcn.14017d580
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.1401a8fb0
add rsp, 0x298
ret
Function at 0x140162480
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r13
push r15
sub rsp, 0x170
mov rax, qword [0x14020cc58]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov rdi, rcx
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x40]
call fcn.140177280
mov rcx, qword [rdi + 0xa0]
xor r9d, r9d
lea edx, [r9 + 0xe]
xor r8d, r8d
call qword [sym.imp.USER32.dll_SendMessageW]
add eax, 1
movsxd rbx, eax
lea rcx, [rbx + rbx]
call fcn.1400cf700
mov rcx, qword [rdi + 0xa0]
mov r8, rbx
mov r9, rax
mov edx, reloc.WS2_32.dll_listen
mov rsi, rax
mov qword [rsp + 0x38], rax
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rdi + 0x28]
mov rbx, rsi
xor esi, esi
test rcx, rcx
mov edx, esi
mov qword [rsp + 0x28], rsi
mov r12, rsi
mov dword [rsp + 0x20], edx
je 0x140162526
call fcn.1400cf780
mov edx, esi
lea rbp, [rdi + 0x40]
mov r15, rsi
mov ecx, 0x100
mov qword [rsp + 0x1a8], r14
nop
nop
movzx eax, word [rbx]
mov r13, rbx
test ax, ax
je 0x14016256e
nop
nop
cmp ax, 0xd
jne 0x140162561
cmp word [rbx + 2], 0xa
je 0x1401625fa
mov ax, word [rbx + 2]
add rbx, 2
test ax, ax
jne 0x140162550
mov rdi, rbx
sub rdi, r13
sar rdi, 1
cmp esi, edx
jl 0x1401625c5
lea esi, [rdx + rdx]
test esi, esi
cmove esi, ecx
movsxd rcx, esi
imul rcx, rcx, 0xd0
call fcn.1400cf700
movsxd r8, dword [rsp + 0x20]
mov rdx, r12
mov rcx, rax
mov r14, rax
imul r8, r8, 0xd0
call fcn.1401a8fe0
test r12, r12
je 0x1401625b9
mov rcx, r12
call fcn.1400cf780
mov dword [rsp + 0x20], esi
mov rsi, qword [rsp + 0x28]
mov r12, r14
lea rcx, [rsp + 0x40]
mov r8d, edi
mov rdx, r13
call fcn.1401782a0
mov eax, dword [rsp + 0x40]
mov dword [r15 + r12 + 0x10], eax
mov edx, dword [rsp + 0x40]
add edx, 1
cmp edx, 0x100
jle 0x14016260c
mov rcx, rbp
call fcn.1400e4820
mov rcx, rax
jmp 0x140162631
mov rdi, rbx
sub rdi, r13
sar rdi, 1
add rbx, 4
jmp 0x140162577
mov rax, qword [rbp + 0x10]
movsxd rdi, edx
lea rcx, [rdi + rax]
cmp rcx, qword [rbp + 0x18]
jb 0x140162625
mov rcx, rbp
call fcn.1400e4750
mov rcx, qword [rbp + 0x10]
lea rax, [rcx + rdi]
mov qword [rbp + 0x10], rax
mov qword [r15 + r12 + 8], rcx
movsxd r8, dword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
call fcn.1401a8fe0
mov rax, qword [r15 + r12 + 8]
movsxd r11, dword [rsp + 0x40]
mov edx, dword [rsp + 0x20]
add esi, 1
mov byte [r11 + rax], 0
add r15, 0x20
cmp word [rbx], 0
mov qword [rsp + 0x28], rsi
mov ecx, 0x100
jne 0x140162540
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
mov qword [rax + 0x28], r12
mov dword [rax + 0x30], esi
call fcn.1400cf780
lea rcx, [rsp + 0x40]
call fcn.14017d580
mov r14, qword [rsp + 0x1a8]
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1401a8fb0
lea r11, [rsp + 0x170]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x140162ae0
Capabilities:
Get graphical window text

Disassembly:
mov r11, rsp
push rbx
push rdi
sub rsp, 0x5b8
mov rax, qword [0x14020cc58]
xor rax, rsp
mov qword [rsp + 0x5a0], rax
mov qword [r11 + 0x20], rbp
mov rdi, rcx
mov qword [r11 - 0x18], rsi
lea rcx, [r11 - 0x248]
mov rbp, r8
mov rsi, rdx
call fcn.140177280
lea rcx, [rsp + 0x380]
mov rdx, rsi
call fcn.14017d850
test rbp, rbp
je 0x140162c36
lea rcx, [rsp + 0x160]
call fcn.140177280
lea rcx, [rsp + 0x40]
call fcn.140177280
mov rcx, qword [rdi + 0x10]
mov edx, 0x3ea
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov ebx, dword [rsp + 0x164]
add eax, 1
cmp eax, ebx
jle 0x140162b87
lea rcx, [rsp + 0x160]
mov edx, eax
call fcn.14017d5a0
mov ebx, dword [rsp + 0x164]
mov rcx, qword [rdi + 0x10]
mov edx, 0x3ea
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rdx, qword [rsp + 0x168]
lea r8d, [rbx + 1]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov rcx, qword [rdi + 0x10]
mov edx, 0x3ea
call qword [sym.imp.USER32.dll_GetDlgItem]
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x34]
mov rcx, rax
mov edx, 0xb0
call qword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [rsp + 0x34]
mov r11d, dword [rsp + 0x30]
mov rcx, rax
sub r11d, eax
mov rax, qword [rsp + 0x168]
lea r9, [rax + rcx*2]
lea rdx, str._s_T_s
lea rcx, [rsp + 0x40]
mov r8, rsi
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], r11d
call fcn.1401789a0
mov rdx, qword [rsp + 0x48]
lea rcx, [rsp + 0x380]
call fcn.14017d850
lea rcx, [rsp + 0x40]
call fcn.14017d580
lea rcx, [rsp + 0x160]
call fcn.14017d580
jmp 0x140162c46
lea rcx, [rsp + 0x380]
mov rdx, rsi
call fcn.14017d850
mov rcx, qword [rdi + 0x10]
mov edx, 0x3ea
call qword [sym.imp.USER32.dll_GetDlgItem]
mov r9, qword [rsp + 0x388]
mov edx, 0xc2
mov rcx, rax
mov r8d, 1
call qword [sym.imp.USER32.dll_SendMessageW]
mov rsi, qword [rsp + 0x5b0]
test rbp, rbp
mov rbp, qword [rsp + 0x5e8]
je 0x140162d0c
mov rcx, qword [rdi + 0x10]
mov edx, 0x3ea
call qword [sym.imp.USER32.dll_GetDlgItem]
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x34]
mov rcx, rax
mov edx, 0xb0
call qword [sym.imp.USER32.dll_SendMessageW]
mov r11d, dword [rsp + 0x30]
mov rcx, qword [rdi + 0x10]
add r11d, 0xffffffff
mov edx, 0x3ea
mov dword [rsp + 0x30], r11d
mov ebx, r11d
call qword [sym.imp.USER32.dll_GetDlgItem]
mov r9, rbx
xor r8d, r8d
mov edx, 0xb1
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rdi + 0x10]
mov ebx, dword [rsp + 0x30]
mov edx, 0x3ea
call qword [sym.imp.USER32.dll_GetDlgItem]
mov r9, rbx
mov r8, rbx
mov rcx, rax
mov edx, 0xb1
call qword [sym.imp.USER32.dll_SendMessageW]
lea rcx, [rsp + 0x380]
call fcn.14017d580
mov rcx, qword [rdi + 0x10]
mov edx, 0x3ea
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
call qword [sym.imp.USER32.dll_SetFocus]
mov rcx, qword [rsp + 0x5a0]
xor rcx, rsp
call fcn.1401a8fb0
add rsp, 0x5b8
pop rdi
pop rbx
ret