joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180204be0
Capabilities:
Delete registry key

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x470
mov rax, qword [0x1804e0010]
xor rax, rsp
mov qword [rsp + 0x460], rax
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
test rdx, rdx
jne 0x180204c0f
xor al, al
jmp 0x180204c5a
mov r9d, dword [rcx + 4]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x4a8], rbp
or r9d, 0x20019
xor ebp, ebp
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x30], rbp
call fcn.1802043a0
test al, al
je 0x180204c50
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [rdi], bpl
je 0x180204c75
mov byte [rdi + 1], 1
mov al, 1
mov rbp, qword [rsp + 0x4a8]
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.180393f50
add rsp, 0x470
pop rdi
pop rsi
pop rbx
ret
cmp qword [rbx + 0x18], 8
mov rdx, rbx
jb 0x180204c82
mov rdx, qword [rbx]
mov rcx, rsi
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
test eax, eax
je 0x180204c50
cmp qword [rbx + 0x18], 8
jb 0x180204c99
mov rbx, qword [rbx]
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x412
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x40]
mov r9d, 0x208
sub rbx, rax
lea rdx, [rsp + 0x40]
nop
lea rax, [r9 + 0x7ffffdf6]
test rax, rax
je 0x180204ce2
movzx eax, word [rbx + rdx]
test ax, ax
je 0x180204ce2
mov word [rdx], ax
add rdx, 2
sub r9, 1
jne 0x180204cc0
mov r8d, dword [rdi + 4]
lea rax, [rdx - 2]
test r9, r9
mov rcx, rsi
cmovne rax, rdx
lea rdx, [rsp + 0x40]
mov word [rax], bp
call fcn.1802049d0
test eax, eax
setne al
jmp 0x180204c52
Function at 0x180205059
Capabilities:
Get file system object information

Disassembly:
test rcx, rcx
je 0x18020511e
push rsi
push rdi
push r14
sub rsp, 0x300
mov rax, qword [0x1804e0010]
xor rax, rsp
mov qword [rsp + 0x2f0], rax
mov rsi, r8
mov qword [rsp + 0x338], rbx
mov r14, rdx
mov rdi, rcx
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x2b8
call sub.VCRUNTIME140.dll_memset
mov ebx, 0xfffffffe
test r14, r14
je 0x1802050ce
mov r9d, 0x2b8
mov dword [rsp + 0x20], 0x4009
lea r8, [rsp + 0x30]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test rax, rax
mov edx, ebx
cmovne edx, dword [rsp + 0x38]
mov dword [r14], edx
test rsi, rsi
je 0x1802050fb
mov r9d, 0x2b8
mov dword [rsp + 0x20], 0x400b
lea r8, [rsp + 0x30]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test rax, rax
cmovne ebx, dword [rsp + 0x38]
mov dword [rsi], ebx
mov rbx, qword [rsp + 0x338]
mov rcx, qword [rsp + 0x2f0]
xor rcx, rsp
call fcn.180393f50
add rsp, 0x300
pop r14
pop rdi
pop rsi
ret

Function at 0x180205570
Capabilities:
Get file system object information

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x320
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x1804e0010]
xor rax, rsp
mov qword [rsp + 0x310], rax
mov rdi, rdx
mov rbx, rcx
mov qword [rsp + 0x40], rcx
xor esi, esi
mov dword [rsp + 0x30], esi
test rdx, rdx
jne 0x1802055c5
mov qword [rcx + 0x10], rsi
mov qword [rcx + 0x18], 7
mov word [rcx], si
jmp 0x180205628
xor edx, edx
mov r8d, 0x2b8
lea rcx, [rsp + 0x50]
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x20], 0x208
mov r9d, 0x2b8
lea r8, [rsp + 0x50]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], 7
mov word [rbx], si
lea rax, [rsp + 0x60]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], si
jne 0x180205610
lea rdx, [rsp + 0x60]
mov rcx, rbx
call fcn.180005cd0
nop
mov dword [rsp + 0x30], 1
mov rax, rbx
mov rcx, qword [rsp + 0x310]
xor rcx, rsp
call fcn.180393f50
lea r11, [rsp + 0x320]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x180205660
Capabilities:
Get common file path

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x280
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [r11 + 0x18], rbx
mov rax, qword [0x1804e0010]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rbx, rcx
mov qword [rsp + 0x50], rcx
xor edi, edi
mov dword [rsp + 0x30], edi
mov word [rsp + 0x60], di
mov word [r11 - 0x20], di
mov qword [rsp + 0x40], rdi
lea r8, [rsp + 0x40]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
js 0x180205704
mov qword [rsp + 0x38], rdi
lea rcx, [rsp + 0x38]
call qword [sym.imp.SHELL32.dll_SHGetDesktopFolder]
test eax, eax
js 0x1802056f4
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1802056f4
mov dword [rsp + 0x20], 0x104
lea r9, [rsp + 0x60]
mov r8d, 0x8000
mov rdx, qword [rsp + 0x40]
call fcn.180205200
nop
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x180205704
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], 7
mov word [rbx], di
lea rax, [rsp + 0x60]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp word [rax + r8*2], 0
jne 0x180205720
lea rdx, [rsp + 0x60]
mov rcx, rbx
call fcn.180005cd0
mov dword [rsp + 0x30], 1
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x180205750
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rax, rbx
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.180393f50
mov rbx, qword [rsp + 0x2a0]
add rsp, 0x280
pop rdi
ret
Function at 0x18020b000
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub rsp, 0x28
mov rax, qword [rcx + 8]
mov r8, qword [rcx + 0x10]
cmp rax, r8
je 0x18020b0f5
mov qword [rsp + 0x30], rbx
nop word [rax + rax]
mov rbx, qword [rax]
test rbx, rbx
je 0x18020b02d
cmp dword [rbx + 0x1c], edx
je 0x18020b040
add rax, 8
cmp rax, r8
jne 0x18020b020
mov rbx, qword [rsp + 0x30]
add rsp, 0x28
ret
movzx eax, byte [rbx + 0x18]
test al, al
je 0x18020b0f0
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [rbx + 8]
xorps xmm1, xmm1
mov ecx, eax
xorps xmm0, xmm0
cvtsi2sd xmm1, rcx
mov ecx, dword [rbx + 0xc]
cvtsi2sd xmm0, rcx
divsd xmm1, xmm0
comisd xmm1, xmmword [0x1803f6ef0]
movsd qword [rbx + 0x10], xmm1
jb 0x18020b0a0
movsd xmm1, qword [0x1803f6ef0]
movabs rax, 0x3ff0000000000000
mov qword [rbx + 0x10], rax
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x18]
mov rcx, qword [rbx + 0x28]
test rcx, rcx
je 0x18020b0c7
mov eax, edi
sub eax, dword [rbx + 0x38]
cmp eax, dword [rbx + 0x20]
jb 0x18020b0c7
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax]
mov dword [rbx + 0x38], edi
movsd xmm0, qword [rbx + 0x10]
ucomisd xmm0, qword [0x1803f6ef0]
mov rdi, qword [rsp + 0x20]
jp 0x18020b0f0
jne 0x18020b0f0
mov rax, qword [rbx]
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x28
jmp qword [rax + 8]
mov rbx, qword [rsp + 0x30]
add rsp, 0x28
ret
Function at 0x1802149a0
Capabilities:
Get disk information

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0xb8], rbx
mov rax, qword [0x1804e0010]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov ebp, r8d
mov r14, rdx
mov r15, rcx
xor r12d, r12d
mov ebx, r12d
mov qword [rsp + 0x20], rbx
lea r13, [r12 - 1]
cmp r8d, 0x3fe
jbe 0x180214a6e
lea ecx, [rbp + 2]
mov eax, 2
mul rcx
cmovo rax, r13
mov rcx, rax
call fcn.1803944a8
mov r14, rax
mov rbx, rax
mov qword [rsp + 0x20], rax
mov rdx, rax
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
je 0x180214a3a
cmp eax, ebp
ja 0x180214a3a
mov ecx, eax
mov word [rbx + rcx*2], r12w
lea ecx, [rax + 1]
mov word [rbx + rcx*2], r12w
mov ebp, eax
jmp 0x180214a9d
test r14, r14
je 0x180214a47
mov rcx, r14
call fcn.180393fb0
xor al, al
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.180393f50
mov rbx, qword [rsp + 0xb8]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov rax, rbp
add rax, rax
cmp rax, 0x800
jae 0x180214bd6
mov word [rax + rdx], r12w
lea ecx, [rbp + 1]
add rcx, rcx
cmp rcx, 0x800
jae 0x180214bd0
mov word [rcx + rdx], r12w
mov eax, r12d
mov edi, r12d
test ebp, ebp
je 0x180214bb5
mov rsi, r14
nop
cmp word [rsi], 0
jne 0x180214ba7
cmp eax, edi
je 0x180214ba7
lea rdx, [r14 + rax*2]
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x48], 7
mov word [rsp + 0x30], r12w
mov r8, r13
nop word [rax + rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x180214af0
lea rcx, [rsp + 0x30]
call fcn.180005cd0
nop
mov rdx, qword [r15 + 8]
cmp qword [r15 + 0x10], rdx
je 0x180214b44
mov qword [rdx + 0x10], r12
mov qword [rdx + 0x18], r12
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rsp + 0x40]
movups xmmword [rdx + 0x10], xmm1
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x48], 7
mov word [rsp + 0x30], r12w
add qword [r15 + 8], 0x20
jmp 0x180214b52
lea r8, [rsp + 0x30]
mov rcx, r15
call fcn.18006eb60
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x180214b90
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180214b8b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180214bc9
call fcn.180393fb0
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x48], 7
mov word [rsp + 0x30], r12w
lea eax, [rdi + 1]
inc edi
add rsi, 2
cmp edi, ebp
jb 0x180214ab0
test rbx, rbx
je 0x180214bc2
mov rcx, rbx
call fcn.180393fb0
mov al, 1
jmp 0x180214a49
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1803945d8
int3
call fcn.1803945d8
int3
Function at 0x180217ad0
Capabilities:
Check os version

Disassembly:
sub rsp, 0x158
mov rax, qword [0x1804e0010]
xor rax, rsp
mov qword [rsp + 0x140], rax
xor edx, edx
mov dword [rsp + 0x20], VarUI4FromDisp
mov r8d, VarUI4FromDisp
lea rcx, [rsp + 0x24]
call sub.VCRUNTIME140.dll_memset
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x180217b41
mov eax, dword [rsp + 0x24]
cmp eax, 5
jae 0x180217b27
cmp eax, 4
jne 0x180217b41
cmp dword [rsp + 0x28], 0x5a
jb 0x180217b41
xor al, al
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.180393f50
add rsp, 0x158
ret
mov al, 1
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.180393f50
add rsp, 0x158
ret
Function at 0x18021b240
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
movzx edx, dx
lea r8, [0x1803d1f10]
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdi, rax
test rax, rax
je 0x18021b369
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
test eax, eax
je 0x18021b369
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x18021b369
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x18021b369
mov edx, esi
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rdi, rax
test rax, rax
je 0x18021b369
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
test rax, rax
je 0x18021b360
mov r8d, esi
mov rdx, rbx
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
xor esi, esi
lea r8, [rsp + 0x40]
xor edx, edx
mov qword [rsp + 0x40], rsi
mov rcx, rdi
call qword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
jne 0x18021b360
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x18021b360
call fcn.1801f2670
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rcx]
call qword [rdx + 0x10]
test rbx, rbx
je 0x18021b34d
mov ecx, dword [rbx + 0x10]
mov dword [rbx + 0x10], esi
test ecx, ecx
je 0x18021b34d
mov rax, qword [rbx]
lea edx, [rsi + 1]
mov rcx, rbx
call qword [rax]
mov ebx, esi
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rbx, qword [rsp + 0x30]
xor eax, eax
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x180222d20
Capabilities:
Hide graphical window

Disassembly:
mov r11, rsp
push rsi
push rdi
push r14
sub rsp, 0x60
mov qword [r11 - 0x48], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov rax, qword [0x1804e0010]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rbx, rcx
mov r14, qword [rsp + 0xa8]
cmp dword [rsp + 0xb0], 0
jne 0x180222f26
cmp r8d, 0x102
jne 0x180222ddf
mov rax, qword [rcx + 0x30]
mov dword [rax + 0x34], 1
cmp r9w, 0x1b
je 0x180222dae
cmp r9w, 0xd
je 0x180222db2
mov rcx, qword [rcx + 0x30]
test rcx, rcx
je 0x180222dc5
mov rax, qword [rcx + 0x18]
mov qword [r11 - 0x58], rax
mov r9, qword [rcx + 0x10]
mov r8d, dword [rcx + 8]
mov rdx, qword [rbx + 8]
mov rcx, qword [rbx + 0x40]
call qword [sym.imp.USER32.dll_CallWindowProcW]
jmp 0x180222dc5
mov byte [rcx + 0x48], 1
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_GetParent]
mov rcx, rax
call qword [sym.imp.USER32.dll_SetFocus]
xor edi, edi
mov qword [r14], rdi
mov rcx, qword [rbx + 0x30]
cmp dword [rcx + 0x34], edi
je 0x180222f26
lea eax, [rdi + 1]
jmp 0x180222f28
cmp r8d, 8
jne 0x180222ed3
mov rax, qword [rcx + 0x30]
mov dword [rax + 0x34], 1
mov rdx, qword [rcx + 8]
lea rcx, [rsp + 0x38]
call fcn.1803726a0
mov rsi, rax
lea rbp, [rbx + 0x60]
xor edi, edi
cmp rbp, rax
je 0x180222e36
mov rcx, rbp
call fcn.180005c50
movups xmm0, xmmword [rsi]
movups xmmword [rbp], xmm0
movups xmm1, xmmword [rsi + 0x10]
movups xmmword [rbp + 0x10], xmm1
mov qword [rsi + 0x10], rdi
mov qword [rsi + 0x18], 7
mov word [rsi], di
mov rdx, qword [rsp + 0x50]
cmp rdx, 8
jb 0x180222e7b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180222e76
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180222e76
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180393fb0
movdqa xmm0, xmmword [0x1803f7240]
movdqu xmmword [rsp + 0x48], xmm0
mov word [rsp + 0x38], di
xor edx, edx
mov rcx, qword [rbx + 8]
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [rbx + 8]
call qword [sym.imp.USER32.dll_DestroyWindow]
cmp byte [rbx + 0x48], 0
jne 0x180222ebf
xor r9d, r9d
xor r8d, r8d
mov edx, 0x660
mov rcx, qword [rbx + 0x58]
call qword [sym.imp.USER32.dll_SendMessageW]
mov qword [r14], rdi
mov rax, qword [rbx + 0x30]
cmp dword [rax + 0x34], 0
je 0x180222f26
mov eax, 1
jmp 0x180222f28
cmp r8d, 0x20
jne 0x180222f26
mov rax, qword [rcx + 0x30]
mov dword [rax + 0x34], 1
mov eax, dword [0x1804f3394]
test al, 1
jne 0x180222f0d
or eax, 1
mov dword [0x1804f3394], eax
mov edx, 0x7f01
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorW]
mov qword [0x1804f3398], rax
jmp 0x180222f14
mov rax, qword [0x1804f3398]
mov rcx, rax
call qword [sym.imp.USER32.dll_SetCursor]
mov qword [r14], 1
jmp 0x180222ec2
xor eax, eax
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.180393f50
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x1802244a0
Capabilities:
Get graphical window text

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x280
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x1804e0010]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rbx, rcx
mov rsi, qword [rsp + 0x2b8]
cmp dword [rsp + 0x2c0], 0
jne 0x1802246e6
cmp r8d, 0x20
jne 0x180224561
mov rax, qword [rcx + 0x30]
mov dword [rax + 0x34], 1
mov eax, dword [0x1804f33b8]
test al, 1
jne 0x180224521
or eax, 1
mov dword [0x1804f33b8], eax
mov edx, 0x7f01
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorW]
mov qword [0x1804f33b0], rax
jmp 0x180224528
mov rax, qword [0x1804f33b0]
test rax, rax
je 0x18022453d
mov rcx, rax
call qword [sym.imp.USER32.dll_SetCursor]
mov edi, 1
jmp 0x180224546
mov rcx, qword [rbx + 0x30]
xor edi, edi
mov dword [rcx + 0x34], edi
mov qword [rsi], rdi
mov rcx, qword [rbx + 0x30]
cmp dword [rcx + 0x34], 0
je 0x1802246e6
mov eax, 1
jmp 0x1802246e8
cmp r8d, 7
jne 0x1802245d6
mov rax, qword [rcx + 0x30]
mov dword [rax + 0x34], 1
lea rdx, [rcx + 0x48]
cmp qword [rdx + 0x18], 8
jb 0x180224580
mov rdx, qword [rdx]
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_SetWindowTextW]
movsxd r8, dword [rbx + 0x58]
mov r9, r8
mov edx, 0xb1
mov rcx, qword [rbx + 8]
call qword [sym.imp.USER32.dll_SendMessageW]
xor r9d, r9d
xor r8d, r8d
mov edx, 0xb7
mov rcx, qword [rbx + 8]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rax, qword [rbx + 0x30]
xor edi, edi
mov dword [rax + 0x34], edi
mov qword [rsi], rdi
mov rax, qword [rbx + 0x30]
cmp dword [rax + 0x34], edi
je 0x1802246e6
lea eax, [rdi + 1]
jmp 0x1802246e8
cmp r8d, 8
jne 0x180224682
mov rax, qword [rcx + 0x30]
mov dword [rax + 0x34], 1
xor edx, edx
mov r8d, 0x20a
lea rcx, [rsp + 0x60]
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x105
lea rdx, [rsp + 0x60]
mov rcx, qword [rbx + 8]
call qword [sym.imp.USER32.dll_GetWindowTextW]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
xor edi, edi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], 7
mov word [rsp + 0x30], di
lea rax, [rsp + 0x60]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], di
jne 0x180224640
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x30]
call fcn.180005cd0
nop
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.1802247c0
mov rax, qword [rbx + 0x30]
mov dword [rax + 0x34], edi
mov qword [rsi], rdi
mov rax, qword [rbx + 0x30]
cmp dword [rax + 0x34], 0
je 0x1802246e6
mov eax, 1
jmp 0x1802246e8
cmp r8d, 0x2133
jne 0x1802246b4
mov rax, qword [rcx + 0x30]
mov dword [rax + 0x34], 1
lea rax, [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r9
mov rdx, qword [rsp + 0x20]
call fcn.180224a50
mov qword [rsi], rax
jmp 0x180224671
cmp r8d, 0x2138
jne 0x1802246e6
mov rax, qword [rcx + 0x30]
mov dword [rax + 0x34], 1
lea rax, [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r9
mov rdx, qword [rsp + 0x20]
call fcn.180224a50
mov qword [rsi], rax
jmp 0x180224671
xor eax, eax
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.180393f50
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1802263b0
Capabilities:
Read .ini file

Disassembly:
push rbx
push rbp
push rdi
sub rsp, 0xb0
mov rax, qword [0x1804e0010]
xor rax, rsp
mov qword [rsp + 0x80], rax
cmp qword [rcx + 0x10], 0
movzx edi, r8b
mov rbp, rdx
mov rbx, rcx
je 0x1802265c5
cmp qword [rcx + 0x18], 8
mov rax, rcx
jb 0x1802263ef
mov rax, qword [rcx]
mov r9d, 0x2c
mov qword [rsp + 0x20], rax
mov r8, rbp
lea rdx, str.WindowPlacement
lea rcx, str.Placement
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStructW]
test eax, eax
je 0x1802265c5
test dil, dil
jne 0x180226428
mov eax, 1
jmp 0x1802265c7
movss xmm0, dword [rbx + 0x24]
mulss xmm0, dword [0x1803f70b8]
mov qword [rsp + 0xe0], rsi
mov qword [rsp + 0xe8], r12
mov qword [rsp + 0xa8], r14
addss xmm0, dword [0x1803f6de0]
mov qword [rsp + 0xa0], r15
movaps xmmword [rsp + 0x90], xmm6
call sub.api_ms_win_crt_math_l1_1_0.dll_floorf
cvttss2si edx, xmm0
lea rcx, [rbp + 0x1c]
mov r8d, edx
call qword [sym.imp.USER32.dll_OffsetRect]
lea rdx, [rbp + 0x1c]
lea rcx, [rsp + 0x38]
call qword [sym.imp.USER32.dll_CopyRect]
mov eax, dword [rsp + 0x38]
mov edx, 2
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x3c]
mov dword [rsp + 0x34], eax
mov rcx, qword [rsp + 0x30]
mov dword [rsp + 0x58], 0x28
call qword [sym.imp.USER32.dll_MonitorFromPoint]
mov rcx, rax
lea rdx, [rsp + 0x58]
call qword [sym.imp.USER32.dll_GetMonitorInfoW]
test eax, eax
je 0x1802264d6
lea rdx, [rsp + 0x6c]
lea rcx, [rsp + 0x48]
call qword [sym.imp.USER32.dll_CopyRect]
jmp 0x1802264e9
xor edx, edx
lea r8, [rsp + 0x48]
xor r9d, r9d
lea ecx, [rdx + 0x30]
call qword [sym.imp.USER32.dll_SystemParametersInfoW]
movss xmm6, dword [rbx + 0x24]
mov r14d, dword [rsp + 0x40]
movaps xmm0, xmm6
mulss xmm0, dword [0x1803f711c]
mov r15d, dword [rsp + 0x44]
mov edi, dword [rsp + 0x38]
sub r14d, edi
mov esi, dword [rsp + 0x3c]
sub r15d, esi
addss xmm0, dword [0x1803f6de0]
call sub.api_ms_win_crt_math_l1_1_0.dll_floorf
mov eax, dword [rsp + 0x50]
cvttss2si ecx, xmm0
sub eax, ecx
cmp edi, eax
jg 0x18022653e
mov eax, dword [rsp + 0x54]
sub eax, ecx
cmp esi, eax
jg 0x18022653e
test edi, edi
js 0x18022653e
test esi, esi
jns 0x180226564
mulss xmm6, dword [0x1803f7090]
addss xmm6, dword [0x1803f6de0]
movaps xmm0, xmm6
call sub.api_ms_win_crt_math_l1_1_0.dll_floorf
cvttss2si edi, xmm0
mov dword [rsp + 0x38], edi
mov esi, edi
mov dword [rsp + 0x3c], edi
lea eax, [r14 + rdi]
mov dword [rsp + 0x40], eax
lea rdx, [rsp + 0x38]
lea eax, [r15 + rsi]
lea rcx, [rbp + 0x1c]
mov dword [rsp + 0x44], eax
call qword [sym.imp.USER32.dll_CopyRect]
mov rdx, rbp
mov byte [rbx + 0x21], 1
mov rcx, rbx
call fcn.180226350
movaps xmm6, xmmword [rsp + 0x90]
mov eax, 1
mov r15, qword [rsp + 0xa0]
mov r14, qword [rsp + 0xa8]
mov r12, qword [rsp + 0xe8]
mov rsi, qword [rsp + 0xe0]
mov byte [rbx + 0x21], 0
jmp 0x1802265c7
xor eax, eax
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.180393f50
add rsp, 0xb0
pop rdi
pop rbp
pop rbx
ret
Function at 0x180234710
Capabilities:
Enumerate gui resources

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x70
mov qword [r11 - 0x58], 0xfffffffffffffffe
mov qword [r11 + 0x18], rbx
mov rax, qword [0x1804e0010]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rdi, rdx
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x38], xmm0
movdqa xmm1, xmmword [0x1803f7240]
movdqu xmmword [rsp + 0x38], xmm1
xor eax, eax
mov word [rsp + 0x28], ax
movdqu xmmword [rsp + 0x48], xmm0
mov qword [r11 - 0x20], rax
lea rax, [r11 - 0x50]
cmp rax, rcx
je 0x180234782
mov rdx, rcx
cmp qword [rcx + 0x18], 8
jb 0x180234774
mov rdx, qword [rcx]
mov r8, qword [rcx + 0x10]
lea rcx, [rsp + 0x28]
call fcn.180005cd0
lea rdx, [rsp + 0x28]
lea rcx, [0x180234650]
call qword [sym.imp.USER32.dll_EnumWindows]
mov r8, qword [rsp + 0x50]
mov rax, r8
mov rdx, qword [rsp + 0x48]
sub rax, rdx
sar rax, 3
test rax, rax
setne bl
lea rax, [rsp + 0x48]
cmp rdi, rax
je 0x1802347c1
mov rcx, rdi
call fcn.180069830
nop
lea rcx, [rsp + 0x48]
call fcn.180009600
nop
lea rcx, [rsp + 0x28]
call fcn.180005c50
movzx eax, bl
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.180393f50
mov rbx, qword [rsp + 0x90]
add rsp, 0x70
pop rdi
ret