joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401ad0bc
Capabilities:
Get graphical window text

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x14049e048]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor eax, eax
mov rbx, rcx
cmp dword [rcx + 0x3e0], eax
jne 0x1401ad189
mov byte [rcx + CMFCRibbonInfo::XRibbonBar::XRibbonBar], 1
cmp byte [rcx + reloc.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup], al
je 0x1401ad118
add rcx, 0x1f0
call fcn.14018af8c
xor r9d, r9d
mov edx, CMapStringToOb::HashKey
mov rcx, qword [rax + 0x40]
lea r8d, [r9 + 0xd]
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x1401ad1ac
mov edx, 1
mov byte [rcx + CMFCRibbonInfo::XRibbonBar::XRibbonBar], al
call qword [sym.imp.mfc140u.dll_CWnd::SetWindowPlacement]
lea rdx, [rsp + 0x20]
lea rcx, str.ACADLSPASDOC
call qword [sym.imp.accore.dll_int___cdecl_acedGetVar_wchar_t_const____ptr64__struct_resbuf____ptr64_]
movzx eax, word [rbx + reloc.mfc140u.dll_CEnumArray::CEnumArray]
lea rdx, [rsp + 0x20]
lea rcx, str.ACADLSPASDOC
mov word [rsp + 0x30], ax
call qword [sym.imp.accore.dll_int___cdecl_acedSetVar_wchar_t_const____ptr64__struct_resbuf_const____ptr64_]
lea rdx, [rsp + 0x20]
lea rcx, str.LEGACYCODESEARCH
call qword [sym.imp.accore.dll_int___cdecl_acedGetVar_wchar_t_const____ptr64__struct_resbuf____ptr64_]
movzx eax, byte [rbx + reloc.mfc140u.dll_CEvent::CEvent]
lea rdx, [rsp + 0x20]
lea rcx, str.LEGACYCODESEARCH
mov word [rsp + 0x30], ax
call qword [sym.imp.accore.dll_int___cdecl_acedSetVar_wchar_t_const____ptr64__struct_resbuf_const____ptr64_]
mov rcx, qword [rbx + 0x428]
call qword [sym.imp.USER32.dll_DestroyWindow]
mov rcx, qword [rbx + 0x430]
call qword [sym.imp.USER32.dll_DestroyWindow]
mov rcx, rbx
call qword [sym.imp.acui24.dll_protected_virtual:_void___cdecl_CAcUiDialog::OnOK_void____ptr64]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140088c50
add rsp, 0x50
pop rbx
ret
Function at 0x1401ae264
Capabilities:
Get common file path
Get program files directory

Disassembly:
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x40
mov rbx, rcx
and dword [rsp + 0x30], 0
lea rdx, [0x14032f730]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__11]
mov dword [rsp + 0x30], 1
call qword [sym.imp.acdb24.dll_class_AcDbHostApplicationServices____ptr64___cdecl_acdbHostApplicationServices_void_]
mov rdx, qword [rax]
mov r8, qword [rdx + 0xf8]
lea rdx, str.ProgramFiles_x86_
mov rcx, rax
call r8
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.mfc140u.dll_CMFCControlRendererInfo::CMFCControlRendererInfo]
mov rcx, rbx
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::HitTest]
test al, al
je 0x1401ae2f2
mov edx, SerializeElements<ATL::CStringT<wchar_t,StrTraitMFC_DLL<wchar_t,ATL::ChTraitsCRT<wchar_t>
mov rcx, rbx
call qword [sym.imp.mfc140u.dll_Ordinal_4946]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x2a]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
or edx, 0xffffffff
mov rcx, rbx
call qword [sym.imp.mfc140u.dll_CDialogImpl::ProcessMouseClick]
mov rcx, rbx
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::HitTest]
test al, al
je 0x1401ae30f
lea rdx, str.C:Program_Files__x86_
mov rcx, rbx
call qword [sym.imp.mfc140u.dll_CMFCControlRendererInfo::CMFCControlRendererInfo]
mov edx, SerializeElements<ATL::CStringT<wchar_t,StrTraitMFC_DLL<wchar_t,ATL::ChTraitsCRT<wchar_t>
mov rcx, rbx
call qword [sym.imp.mfc140u.dll_Ordinal_4946]
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
or edx, 0xffffffff
mov rcx, rbx
call qword [sym.imp.mfc140u.dll_CDialogImpl::ProcessMouseClick]
mov rax, rbx
add rsp, 0x40
pop rbx
ret
Function at 0x1401ae364
Capabilities:
Get common file path
Get program files directory

Disassembly:
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x40
mov rbx, rcx
and dword [rsp + 0x30], 0
call qword [sym.imp.acdb24.dll_class_AcDbHostApplicationServices____ptr64___cdecl_acdbHostApplicationServices_void_]
mov rdx, qword [rax]
mov r8, qword [rdx + 0xf8]
lea rdx, str.ProgramFiles
mov rcx, rax
call r8
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__11]
mov dword [rsp + 0x30], 1
mov rcx, rbx
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::HitTest]
test al, al
je 0x1401ae3e5
mov edx, SerializeElements<ATL::CStringT<wchar_t,StrTraitMFC_DLL<wchar_t,ATL::ChTraitsCRT<wchar_t>
mov rcx, rbx
call qword [sym.imp.mfc140u.dll_Ordinal_4946]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x26]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
or edx, 0xffffffff
mov rcx, rbx
call qword [sym.imp.mfc140u.dll_CDialogImpl::ProcessMouseClick]
mov rcx, rbx
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::HitTest]
test al, al
je 0x1401ae402
lea rdx, str.C:Program_Files
mov rcx, rbx
call qword [sym.imp.mfc140u.dll_CMFCControlRendererInfo::CMFCControlRendererInfo]
mov edx, SerializeElements<ATL::CStringT<wchar_t,StrTraitMFC_DLL<wchar_t,ATL::ChTraitsCRT<wchar_t>
mov rcx, rbx
call qword [sym.imp.mfc140u.dll_Ordinal_4946]
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
or edx, 0xffffffff
mov rcx, rbx
call qword [sym.imp.mfc140u.dll_CDialogImpl::ProcessMouseClick]
mov rax, rbx
add rsp, 0x40
pop rbx
ret

Function at 0x1401b0380
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rax, qword [0x14049e048]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rsi, rcx
call qword [sym.imp.accore.dll_public:_static_class_CProxyInet____ptr64___cdecl_CProxyInet::GetProxyInet_void_]
mov rbx, rax
xor edi, edi
mov qword [rsp + 0x20], rdi
lea rcx, [rsp + 0x20]
call qword [sym.imp.ac1st24.dll_public:_void___cdecl_AcString::constructor_void____ptr64]
nop
mov rcx, rsi
call qword [sym.imp.ac1st24.dll_public:_class_AcString____ptr64___cdecl_AcString::setEmpty_void____ptr64]
mov rcx, qword [rbx]
mov r8, qword [rcx + 0x40]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call r8
test al, al
je 0x1401b0401
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1401b0401
test al, 0x10
je 0x1401b0401
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.ac1st24.dll_public:_class_AcString____ptr64___cdecl_AcString::assign_class_AcString_const____ptr64____ptr64]
mov dil, 1
lea rcx, [rsp + 0x20]
call qword [sym.imp.ac1st24.dll_public:_void___cdecl_AcString::destructor_void____ptr64]
mov al, dil
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140088c50
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x1401c4afc
Capabilities:
Enumerate files on windows
Read file on windows

Disassembly:
lea r8, [sym.ACAD.exe_class_CStringList_CFontNameCBox::m_BigfontList]
lea rdx, [sym.ACAD.exe_class_CStringList_CFontNameCBox::m_SHXFontList]
lea rcx, [sym.ACAD.exe_class_ATL::CStringT_wchar_t__class_StrTraitMFC_DLL_wchar_t__class_ATL::ChTraitsCRT_wchar_t____CFontNameCBox::m_ShxFontSearchPaths]
jmp fcn.1401c6330
Function at 0x1401de114
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x14049e048]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rsi, rdx
mov rbx, rcx
mov rcx, rdx
call qword [sym.imp.mfc140u.dll_CMFCToolBar::DrawButton]
mov rdx, rbx
lea rcx, [rbp - 0x20]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__10]
nop
lea rcx, [rbp - 0x20]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::HitTest]
xor edi, edi
test al, al
jne 0x1401de23a
lea rcx, [rbp - 0x20]
call fcn.1401ddc74
lea rcx, [rbp - 0x20]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___2]
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathIsFileSpecW]
test eax, eax
jne 0x1401de199
lea rcx, [rbp - 0x20]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___2]
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1401de213
mov edx, SerializeElements<ATL::CStringT<wchar_t,StrTraitMFC_DLL<wchar_t,ATL::ChTraitsCRT<wchar_t>
lea rcx, [rbp - 0x20]
call qword [sym.imp.mfc140u.dll_Ordinal_4946]
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathStripPathW]
or edx, 0xffffffff
lea rcx, [rbp - 0x20]
call qword [sym.imp.mfc140u.dll_CDialogImpl::ProcessMouseClick]
lea rdx, [rbp - 0x20]
lea rcx, [rbp - 0x18]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__10]
nop
mov edx, SerializeElements<ATL::CStringT<wchar_t,StrTraitMFC_DLL<wchar_t,ATL::ChTraitsCRT<wchar_t>
lea rcx, [rbp - 0x20]
call qword [sym.imp.mfc140u.dll_Ordinal_4946]
mov rbx, rax
lea rcx, [rbp - 0x18]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___2]
mov r8d, SerializeElements<ATL::CStringT<wchar_t,StrTraitMFC_DLL<wchar_t,ATL::ChTraitsCRT<wchar_t>
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.accore.dll_int___cdecl_acedFindFile_wchar_t_const____ptr64__wchar_t____ptr64__unsigned_long_long_unsigned___int64__]
or edx, 0xffffffff
lea rcx, [rbp - 0x20]
call qword [sym.imp.mfc140u.dll_CDialogImpl::ProcessMouseClick]
nop
lea rcx, [rbp - 0x18]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rcx, [rbp - 0x20]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___2]
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1401de23a
lea rdx, [rbp - 0x20]
mov rcx, rsi
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
mov dil, 1
lea rcx, [rbp - 0x20]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
mov al, dil
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140088c50
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x1401f6740
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x14049e048]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x1401f67b3
cmp byte [rcx + 0x72], 0
je 0x1401f67b3
mov rax, qword [rcx]
mov edi, 0xffff
mov edx, edi
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
cmp di, ax
je 0x1401f6808
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_wchar_t__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1401f67cd
sub eax, 1
je 0x1401f67d1
cmp eax, 2
jne 0x1401f6808
mov byte [rbx + 0x72], 0
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140088c50
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
mov byte [rbx + 0x72], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x1401f67ff
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x1401f6808
cmp byte [rbx + 0x72], 0
sete al
jmp 0x1401f67b5
xor al, al
jmp 0x1401f67b5
Function at 0x1401f7904
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x14049e048]
xor rax, rsp
mov qword [rbp - 8], rax
mov r15d, 0xffff
movzx esi, dx
mov rdi, rcx
cmp r15w, dx
jne 0x1401f7946
xor r14d, r14d
movzx eax, r14w
jmp 0x1401f7a4e
call qword [sym.imp.MSVCP140.dll_protected:_wchar_t____ptr64___cdecl_std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__::pptr_void_const___ptr64]
xor r14d, r14d
test rax, rax
je 0x1401f7982
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_wchar_t____ptr64___cdecl_std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__::epptr_void_const___ptr64]
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.MSVCP140.dll_protected:_wchar_t____ptr64___cdecl_std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__::pptr_void_const___ptr64]
cmp rax, rbx
jae 0x1401f7982
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_wchar_t____ptr64___cdecl_std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__::_Pninc_void____ptr64]
mov word [rax], si
movzx eax, si
jmp 0x1401f7a4e
cmp qword [rdi + 0x80], r14
je 0x1401f7a4a
mov rcx, rdi
call fcn.1401f6890
mov rcx, qword [rdi + 0x68]
test rcx, rcx
jne 0x1401f79c0
movzx ecx, si
mov rdx, qword [rdi + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputwc]
cmp ax, r15w
setne al
test al, al
cmove si, r15w
jmp 0x1401f797a
lea rax, [rbp - 0x40]
mov word [rbp - 0x30], si
mov qword [rsp + 0x38], rax
lea rdx, [rdi + 0x74]
lea rax, [rbp - 8]
mov qword [rsp + 0x30], rax
lea r9, [rbp - 0x2e]
lea rax, [rbp - 0x28]
mov qword [rsp + 0x28], rax
lea r8, [rbp - 0x30]
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_wchar_t__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__wchar_t_const____ptr64__wchar_t_const____ptr64__wchar_t_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1401f7a0e
sub eax, 1
je 0x1401f7a0e
cmp eax, 2
jne 0x1401f7a4a
movzx ecx, word [rbp - 0x30]
jmp 0x1401f79a3
mov rbx, qword [rbp - 0x40]
lea rax, [rbp - 0x28]
sub rbx, rax
je 0x1401f7a39
mov r9, qword [rdi + 0x80]
lea rcx, [rbp - 0x28]
mov r8, rbx
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rbx, rax
jne 0x1401f7a4a
lea rax, [rbp - 0x30]
mov byte [rdi + 0x72], 1
cmp qword [rbp - 0x38], rax
cmovne r15w, si
movzx eax, r15w
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140088c50
mov rbx, qword [rsp + 0xc0]
add rsp, 0x80
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret

Function at 0x1401faa50
Capabilities:
Get keyboard layout

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
mov rcx, rax
mov edx, 4
call qword [sym.imp.IMM32.dll_ImmGetProperty]
shr eax, 0x10
and al, 1
add rsp, 0x28
ret
Function at 0x1401fd4b4
Capabilities:
Get file system object information

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x310
mov rax, qword [0x14049e048]
xor rax, rsp
mov qword [rsp + 0x300], rax
xor ebx, ebx
mov r14, rcx
test rcx, rcx
je 0x1401fd61f
mov rax, qword [rcx]
call qword [rax + 0x40]
mov rdi, qword [0x1404b6ad8]
mov r15, rax
test rdi, rdi
je 0x1401fd61f
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + UnRegisterTypeLib]
mov qword [rsp + 0x38], rax
test rax, rax
je 0x1401fd61a
mov rax, qword [rdi]
lea rdx, [rsp + 0x38]
mov rcx, rdi
call qword [rax + 0xc0]
mov rsi, rax
test rax, rax
je 0x1401fd60e
cmp r15, rax
jne 0x1401fd60e
mov rax, qword [rax]
mov rcx, rsi
call qword [rax + 0xe0]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x1401fd60e
mov rax, qword [rsi]
lea rdx, [rsp + 0x30]
mov rcx, rsi
call qword [rax + 0xe8]
mov rcx, qword [rax + 0x40]
call qword [sym.imp.USER32.dll_GetParent]
mov rcx, rax
call qword [sym.imp.mfc140u.dll_CMFCRibbonComboBox::FindItem]
mov rbp, rax
test rax, rax
je 0x1401fd602
lea rdx, str.HQ6_
mov rcx, rax
call qword [sym.imp.mfc140u.dll_COlePropertyPage::IgnoreApply]
test eax, eax
je 0x1401fd602
mov rcx, qword [rbp + 0x40]
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x7f]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rbx, rax
test rax, rax
jne 0x1401fd602
mov rax, qword [r14]
mov rcx, r14
call qword [rax + 0x38]
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x2b8
mov rbx, rax
call sub.VCRUNTIME140.dll_memset
mov r9d, 0x2b8
mov dword [rsp + 0x20], ATL::CStringT<wchar_t,StrTraitMFC_DLL<wchar_t,ATL::ChTraitsCRT<wchar_t>
lea r8, [rsp + 0x40]
mov edx, 0x80
mov rcx, rbx
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov rbx, qword [rsp + 0x40]
cmp qword [rsp + 0x30], 0
jne 0x1401fd562
cmp qword [rsp + 0x38], 0
jne 0x1401fd522
mov rax, rbx
jmp 0x1401fd621
xor eax, eax
mov rcx, qword [rsp + 0x300]
xor rcx, rsp
call fcn.140088c50
lea r11, [rsp + 0x310]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x1401ff20c
Capabilities:
Get keyboard layout

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x14049e048]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rdi, rcx
xor ebx, ebx
test rcx, rcx
jne 0x1401ff242
mov ecx, ebx
jmp 0x1401ff246
mov rcx, qword [rcx + 0x40]
xor edx, edx
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ecx, eax
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
mov rsi, rax
lea rcx, [rbp - 0x38]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
cmp byte [rdi + 0x14c], bl
jne 0x1401ff29e
mov ebx, SerializeElements<ATL::CStringT<wchar_t,StrTraitMFC_DLL<wchar_t,ATL::ChTraitsCRT<wchar_t>
mov edx, ebx
lea rcx, [rbp - 0x38]
call qword [sym.imp.mfc140u.dll_Ordinal_4946]
mov rdx, rax
mov r8d, ebx
mov rcx, rsi
call qword [sym.imp.IMM32.dll_ImmGetDescriptionW]
or edx, 0xffffffff
lea rcx, [rbp - 0x38]
call qword [sym.imp.mfc140u.dll_CDialogImpl::ProcessMouseClick]
jmp 0x1401ff377
mov qword [rbp - 0x40], rbx
mov qword [rbp - 0x50], rbx
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
lea r9, [0x140350ee0]
xor edx, edx
lea r8d, [rdx + 1]
lea rcx, [0x140350f00]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x1401ff393
mov rcx, qword [rbp - 0x40]
mov rax, qword [rcx]
lea rdx, [rbp - 0x48]
call qword [rax + 0x68]
test eax, eax
js 0x1401ff393
mov rcx, qword [rbp - 0x40]
mov rax, qword [rcx]
lea rdx, [rbp - 0x30]
mov qword [rsp + 0x20], rdx
lea r9, [rbp - 0x20]
lea r8, str.c_t4
movzx edx, word [rbp - 0x48]
call qword [rax + 0x40]
test eax, eax
js 0x1401ff393
mov rcx, qword [rbp - 0x40]
mov rax, qword [rcx]
lea r9, [rbp - 0x30]
lea r8, [rbp - 0x48]
lea rdx, [rbp - 0x20]
call qword [rax + 0x58]
test eax, eax
js 0x1401ff393
mov rcx, qword [rbp - 0x40]
mov rax, qword [rcx]
lea rdx, [rbp - 0x50]
mov qword [rsp + 0x20], rdx
lea r9, [rbp - 0x30]
movzx r8d, word [rbp - 0x48]
lea rdx, [rbp - 0x20]
call qword [rax + 0x60]
test eax, eax
js 0x1401ff393
mov rdx, qword [rbp - 0x50]
lea rcx, [rbp - 0x38]
call qword [sym.imp.mfc140u.dll_CMFCControlRendererInfo::CMFCControlRendererInfo]
mov rcx, qword [rbp - 0x50]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop
mov rcx, qword [rbp - 0x40]
test rcx, rcx
je 0x1401ff377
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
xor r8d, r8d
lea rdx, [0x1403cef60]
lea rcx, [rbp - 0x38]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
cmp eax, 0xffffffff
setne bl
jmp 0x1401ff3a3
mov rcx, qword [rbp - 0x40]
test rcx, rcx
je 0x1401ff3a3
mov rdx, qword [rcx]
call qword [rdx + reloc.OLEAUT32.dll_SafeArrayGetDim]
nop
lea rcx, [rbp - 0x38]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
mov al, bl
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140088c50
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x1401ff3f0
Capabilities:
Log keystrokes via input method manager

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
xor r14d, r14d
lea rsi, [rcx - 0xf8]
mov ebp, 1
mov ebx, r14d
test rsi, rsi
je 0x1401ff424
mov rbx, qword [rsi + 0x40]
mov rcx, rbx
call qword [sym.imp.IMM32.dll_ImmGetContext]
mov rdi, rax
test rax, rax
je 0x1401ff46c
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 8]
call qword [sym.imp.IMM32.dll_ImmGetCompositionStringW]
test eax, eax
jne 0x1401ff460
mov rcx, rsi
call fcn.1401ff20c
test al, al
movzx edx, r14b
cmovne edx, ebp
mov bpl, dl
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.IMM32.dll_ImmReleaseContext]
mov rbx, qword [rsp + 0x30]
mov al, bpl
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140202e58
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x14049e048]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rsi, rcx
xor ebp, ebp
xor ecx, ecx
mov word [rsp + 0x30], bp
mov rdi, rdx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
lea rcx, [0x1404c2a70]
mov rbx, rax
call qword [sym.imp.USER32.dll_GetKeyboardState]
shr rdi, 0x10
lea r9, [rsp + 0x30]
movzx edx, dil
lea r8, [0x1404c2a70]
mov qword [rsp + 0x28], rbx
mov ecx, esi
mov dword [rsp + 0x20], ebp
call qword [sym.imp.USER32.dll_ToAsciiEx]
movzx eax, word [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140088c50
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret

Function at 0x140202fe0
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x20
mov ecx, 0x70
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
bt ax, 0xf
jb 0x1402030d6
mov ecx, 0x71
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
bt ax, 0xf
jb 0x1402030d6
mov ecx, 0x72
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
bt ax, 0xf
jb 0x1402030d6
mov ecx, 0x73
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
bt ax, 0xf
jb 0x1402030d6
mov ecx, 0x74
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
bt ax, 0xf
jb 0x1402030d6
mov ecx, 0x75
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
bt ax, 0xf
jb 0x1402030d6
mov ecx, 0x76
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
bt ax, 0xf
jb 0x1402030d6
mov ecx, 0x77
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
bt ax, 0xf
jb 0x1402030d6
mov ecx, 0x78
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
bt ax, 0xf
jb 0x1402030d6
mov ecx, 0x79
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
bt ax, 0xf
jb 0x1402030d6
mov ecx, 0x7a
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
bt ax, 0xf
jb 0x1402030d6
mov ecx, 0x7b
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
bt ax, 0xf
jb 0x1402030d6
xor eax, eax
jmp 0x1402030db
mov eax, 1
add rsp, 0x20
pop rbx
ret
Function at 0x140205d88
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.mfc140u.dll_AfxFieldText]
mov rcx, qword [rax + 8]
cmp qword [rcx + 0x40], 0
jne 0x140205daf
xor eax, eax
jmp 0x140205e4e
xor ebx, ebx
call qword [sym.imp.mfc140u.dll_AfxFieldText]
mov rcx, qword [rax + 8]
mov rcx, qword [rcx + 0x40]
test rcx, rcx
je 0x140205dc8
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x140205e4b
mov ecx, SafeArrayDestroy
call qword [sym.imp.USER32.dll_GetClipboardData]
mov rdi, rax
test rax, rax
je 0x140205e70
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalSize]
mov rdx, rax
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rbx, rax
test rax, rax
je 0x140205e70
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rsi, rax
test rax, rax
je 0x140205e67
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalLock]
test rax, rax
je 0x140205e5e
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalFree]
call qword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x140205da8