joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140022650
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x38
lea rax, [rsp + 0x40]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SYSTEMCurrentControlSetServicesTcpipParameters
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1400226f7
lea rax, [rsp + 0x40]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SYSTEMCurrentControlSetServicesWinsock2Parameters
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1400226f7
lea rax, [rsp + 0x40]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SYSTEMCurrentControlSetServicesWinsockParameters
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1400226f7
lea rcx, str.HAVE_TCPIP
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x1400226f0
cmp byte [0x14036df3d], 0
je 0x1400226f7
xor al, al
add rsp, 0x38
ret
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
add rsp, 0x38
ret

Function at 0x140022710
Capabilities:
Initialize winsock library

Disassembly:
sub rsp, 0x1d8
mov rax, qword [0x140365b58]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
call fcn.140022650
test al, al
je 0x140022797
mov qword [rsp + 0x1d0], rbx
lea rdx, [rsp + 0x20]
mov ebx, 0x202
mov ecx, ebx
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x140022757
cmp word [rsp + 0x20], bx
je 0x14002276e
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, ebx
lea rdx, [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x140022775
mov byte [0x14036df3d], 1
mov rbx, qword [rsp + 0x1d0]
xor al, al
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.14005df20
add rsp, 0x1d8
ret
xor al, al
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.14005df20
add rsp, 0x1d8
ret
Function at 0x1400227c0
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x28
lea rcx, [0x1400207c0]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__set_invalid_parameter_handler]
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__tzset]
add rsp, 0x28
jmp 0x1400227c0
push rbp
lea rbp, [rsp - 0x980]
sub rsp, 0xa80
mov rax, qword [0x140365b58]
xor rax, rsp
mov qword [rbp + 0x970], rax
lea rax, [rsp + 0x50]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREMySQL
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14002293e
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x44]
lea rax, [rbp + 0x60]
mov qword [rsp + 0xa90], rbx
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x60]
lea rax, [rsp + 0x48]
mov qword [rsp + 0xa98], rdi
xor edi, edi
mov qword [rsp + 0x28], rax
xor edx, edx
mov qword [rsp + 0x20], rdi
mov ebx, edi
mov dword [rsp + 0x44], 0xff
mov dword [rsp + 0x40], 0x3ff
call qword [sym.imp.ADVAPI32.dll_RegEnumValueA]
cmp eax, 0x103
je 0x140022923
nop dword [rax]
inc ebx
cmp eax, 0xea
je 0x1400228cf
test eax, eax
jne 0x140022923
cmp dword [rsp + 0x48], 1
jne 0x1400228cf
lea r9, [rbp + 0x60]
mov qword [rsp + 0x20], rdi
lea r8, [0x1400623f0]
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x460]
call fcn.140034f90
lea rcx, [rbp + 0x460]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll__putenv]
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x44]
lea rax, [rbp + 0x60]
mov dword [rsp + 0x44], 0xff
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x60]
lea rax, [rsp + 0x48]
mov dword [rsp + 0x40], 0x3ff
mov qword [rsp + 0x28], rax
mov edx, ebx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegEnumValueA]
cmp eax, 0x103
jne 0x140022880
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdi, qword [rsp + 0xa98]
mov rbx, qword [rsp + 0xa90]
mov rcx, qword [rbp + 0x970]
xor rcx, rsp
call fcn.14005df20
add rsp, 0xa80
pop rbp
ret
Function at 0x140023b80
Capabilities:
Get common file path
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x230
mov rax, qword [0x140365b58]
xor rax, rsp
mov qword [rsp + 0x220], rax
xor ebp, ebp
mov rsi, rcx
mov edi, ebp
lea edx, [rbp + 0x40]
call fcn.14002f9a0
mov rbx, rax
test rax, rax
je 0x140023cc4
xorps xmm0, xmm0
lea rcx, [rsp + 0x20]
movups xmmword [rax], xmm0
mov edx, 0x200
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
movups xmmword [rax + 0x30], xmm0
call qword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryA]
test eax, eax
je 0x140023bfc
mov r8, rbx
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.1400237d0
mov edi, eax
mov edx, 0x200
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x140023c22
mov r8, rbx
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.1400237d0
add edi, eax
mov r8, rbx
lea rdx, [0x140062ab8]
mov rcx, rsi
call fcn.1400237d0
mov edx, 0x200
lea rcx, [rsp + 0x20]
add edi, eax
call fcn.140023dd0
test rax, rax
je 0x140023c85
mov r8, rbx
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.1400237d0
lea r8, str._data
mov edx, 0x200
lea rcx, [rsp + 0x20]
add edi, eax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcat_s]
mov r8, rbx
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.1400237d0
add edi, eax
lea rcx, str.MYSQL_HOME
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x140023ca7
mov r8, rbx
mov rdx, rax
mov rcx, rsi
call fcn.1400237d0
add edi, eax
mov r8, rbx
lea rdx, [0x14005f88b]
mov rcx, rsi
call fcn.1400237d0
add eax, edi
test eax, eax
cmovg rbx, rbp
mov rax, rbx
mov rcx, qword [rsp + 0x220]
xor rcx, rsp
call fcn.14005df20
lea r11, [rsp + 0x230]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14002d900
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x14002d91f
bt eax, 0xa
jae 0x14002d91f
mov eax, 1
add rsp, 0x28
ret
xor eax, eax
add rsp, 0x28
ret
Function at 0x1400310d0
Capabilities:
Clear file content

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
call fcn.140030f20
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x140031115
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x140031115
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140030ec0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov rbx, rax
call fcn.140020770
mov ecx, dword [rbx]
mov rbx, qword [rsp + 0x30]
mov dword [rax], ecx
mov eax, 0xffffffff
add rsp, 0x20
pop rdi
ret

Function at 0x1400313f0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
xor eax, eax
mov rdi, r9
mov qword [rsp + 0x30], rax
mov rbx, r8
mov qword [rsp + 0x38], rax
mov rsi, rdx
mov qword [rsp + 0x48], rax
test r8, r8
je 0x1400314a2
call fcn.140030f20
mov ecx, 0xffffffff
mov dword [rsp + 0x40], edi
shr rdi, 0x20
lea rdx, [rsp + 0x30]
cmp rbx, rcx
mov qword [rsp + 0x20], rdx
lea r9, [rsp + 0x70]
mov dword [rsp + 0x44], edi
cmovbe ecx, ebx
mov rdx, rsi
mov r8d, ecx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x14003148e
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x26
je 0x1400314a2
cmp eax, 0x6d
je 0x1400314a2
mov ecx, eax
call fcn.140030ec0
mov rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
mov eax, dword [rsp + 0x70]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
mov rbx, qword [rsp + 0x60]
xor eax, eax
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret

Function at 0x1400314c0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
xor eax, eax
mov rdi, r9
mov qword [rsp + 0x30], rax
mov rbx, r8
mov qword [rsp + 0x38], rax
mov rsi, rdx
mov qword [rsp + 0x48], rax
test r8, r8
je 0x140031554
call fcn.140030f20
mov ecx, 0xffffffff
mov dword [rsp + 0x40], edi
shr rdi, 0x20
lea rdx, [rsp + 0x30]
cmp rbx, rcx
mov qword [rsp + 0x20], rdx
lea r9, [rsp + 0x70]
mov dword [rsp + 0x44], edi
cmovbe ecx, ebx
mov rdx, rsi
mov r8d, ecx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x140031550
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140030ec0
mov rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
mov eax, dword [rsp + 0x70]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x140031570
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, r8
mov rdi, rdx
test r8, r8
je 0x1400315ee
call fcn.140030f20
mov ecx, 0xffffffff
mov qword [rsp + 0x20], 0
cmp rbx, rcx
lea r9, [rsp + 0x50]
mov rdx, rdi
cmovbe ecx, ebx
mov r8d, ecx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1400315df
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x26
je 0x1400315ee
cmp eax, 0x6d
je 0x1400315ee
mov ecx, eax
call fcn.140030ec0
mov rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov eax, dword [rsp + 0x50]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rbx, qword [rsp + 0x40]
xor eax, eax
add rsp, 0x30
pop rdi
ret

Function at 0x140031910
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x50
xor ebx, ebx
mov rsi, rdx
mov r9d, ecx
test r8, r8
jne 0x140031934
xor eax, eax
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rsi
ret
mov edx, 0xffffffff
mov qword [rsp + 0x60], rdi
cmp r8, rdx
mov edi, edx
cmovbe rdi, r8
call fcn.140030f00
test al, 8
je 0x14003196d
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x48], rbx
lea rbx, [rsp + 0x30]
mov qword [rsp + 0x40], 0xffffffffffffffff
mov ecx, r9d
call fcn.140030f20
lea r9, [rsp + 0x70]
mov qword [rsp + 0x20], rbx
mov r8d, edi
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rdi, qword [rsp + 0x60]
test eax, eax
jne 0x1400319b6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140030ec0
mov rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rsi
ret
mov eax, dword [rsp + 0x70]
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rsi
ret

Function at 0x140032ea0
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
movsx ebx, cl
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov ecx, ebx
mov edi, eax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_toupper]
lea ecx, [rax - 0x41]
cmp cl, 0x19
ja 0x140032ee0
movsx ecx, al
sub ecx, 0x41
movzx edx, cl
bt edi, edx
jae 0x140032ee0
mov al, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
xor al, al
add rsp, 0x20
pop rdi
ret

Function at 0x140032f80
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, edx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140032fa4
test al, 1
je 0x140032f9c
test bl, 2
jne 0x140032fa4
xor eax, eax
add rsp, 0x20
pop rbx
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], 0xd
call fcn.140020770
mov dword [rax], 0xd
mov eax, 0xffffffff
add rsp, 0x20
pop rbx
ret
Function at 0x1400330c0
Capabilities:
Get common file path

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x138
mov rax, qword [0x140365b58]
xor rax, rsp
mov qword [rsp + 0x120], rax
mov ebp, r9d
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
test rdx, rdx
jne 0x14003310d
lea rdx, [rsp + 0x20]
mov ecx, 0xf6
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
lea rcx, [rsp + 0x20]
cmove rcx, rbx
mov rbx, rcx
mov r9, rsi
xor r8d, r8d
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x14003312a
mov eax, 0xffffffff
jmp 0x140033170
mov r8d, dword [rsp + 0x180]
mov rcx, rsi
mov edx, r8d
and edx, 0x40
or edx, ebp
or edx, 0x302
call fcn.140021a50
mov edi, eax
test eax, eax
jns 0x140033168
call fcn.140020770
xor edx, edx
mov rcx, rsi
mov ebx, dword [rax]
call fcn.140021720
call fcn.140020770
mov dword [rax], ebx
jmp 0x14003316e
inc dword [0x14036e5c4]
mov eax, edi
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.14005df20
add rsp, 0x138
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x2fc4d0aa0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x2fc4d14a2
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4f4108]
test eax, eax
je 0x2fc4d153a
lea rax, [0x2fc4f40e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4f4110]
mov qword [rbp - 8], rax
jmp 0x2fc4d151e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4d1512
cmp qword [rbp - 0x10], 0
je 0x2fc4d1512
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4d14d8
lea rax, [0x2fc4f40e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4d153b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4d1640
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4d1668
mov eax, 0
jmp 0x2fc4d16b6
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4d1691
mov eax, 0
jmp 0x2fc4d16b6
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4d16b1
mov eax, 0
jmp 0x2fc4d16b6
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d16bc
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4d173a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4d1731
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4d1731
mov rax, qword [rbp - 8]
jmp 0x2fc4d174f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4d1704
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x140001150
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r12
push r13
push r14
sub rsp, 0x40
mov rbx, r9
mov rsi, r8
mov r12, rdx
mov r13, rcx
mov r14, qword [0x1401495b0]
mov qword [rsp + 0x38], 0xffffffffffffffff
xor edi, edi
mov qword [rsp + 0x30], rdi
mov eax, dword [0x140149c64]
test eax, eax
je 0x1400011ad
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x140149c64]
test eax, eax
jne 0x1400011b6
call fcn.1400013c0
test eax, eax
je 0x1400011cc
lea rdx, [rsp + 0x30]
mov rcx, qword [0x1401459e0]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
test eax, eax
jne 0x1400011d2
or rax, 0xffffffffffffffff
jmp 0x140001222
mov qword [rsp + 0x20], rbx
mov r9, rsi
mov r8, r12
mov rdx, r13
mov rcx, r14
call qword [sym.imp.USER32.dll_DialogBoxParamW]
mov rsi, rax
mov qword [rsp + 0x38], rax
mov ebx, edi
cmp rax, 0xffffffffffffffff
sete bl
test ebx, ebx
je 0x140001206
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rdx, qword [rsp + 0x30]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x14000121f
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rsi
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop r13
pop r12
ret

Function at 0x1400012c0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r12
push r13
push r14
sub rsp, 0x30
mov r12, r8
mov r13, rdx
mov r14, rcx
or edi, 0xffffffff
mov dword [rsp + 0x20], edi
mov rbx, qword [0x140149270]
xor esi, esi
mov qword [rsp + 0x68], rsi
mov eax, dword [0x140149c64]
test eax, eax
je 0x140001318
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x140149c64]
test eax, eax
jne 0x140001321
call fcn.1400013c0
test eax, eax
je 0x140001395
lea rdx, [rsp + 0x68]
mov rcx, qword [0x1401459e0]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
test eax, eax
je 0x140001395
test rbx, rbx
jne 0x140001357
lea rcx, str.ImageList_Add
call fcn.140001610
mov rbx, rax
test rax, rax
je 0x140001368
mov qword [0x140149270], rax
mov r8, r12
mov rdx, r13
mov rcx, r14
call rbx
mov edi, eax
mov dword [rsp + 0x20], eax
mov ebx, esi
cmp edi, 0xffffffff
sete bl
test ebx, ebx
je 0x14000137c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov rdx, qword [rsp + 0x68]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x140001395
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop r13
pop r12
ret
Function at 0x1400016d0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push r13
push r14
push r15
sub rsp, 0x40
mov r12d, r9d
mov r13d, r8d
mov r14d, edx
mov r15d, ecx
xor edi, edi
mov esi, edi
mov qword [rsp + 0x38], rdi
mov rbx, qword [0x140149268]
mov qword [rsp + 0x30], rdi
mov eax, dword [0x140149c64]
test eax, eax
je 0x140001730
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x140149c64]
test eax, eax
jne 0x140001739
call fcn.1400013c0
test eax, eax
je 0x14000174f
lea rdx, [rsp + 0x30]
mov rcx, qword [0x1401459e0]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
test eax, eax
jne 0x140001753
xor eax, eax
jmp 0x1400017c4
test rbx, rbx
jne 0x140001773
lea rcx, str.ImageList_Create
call fcn.140001610
mov rbx, rax
test rax, rax
je 0x140001794
mov qword [0x140149268], rax
mov eax, dword [rsp + 0x80]
mov dword [rsp + 0x20], eax
mov r9d, r12d
mov r8d, r13d
mov edx, r14d
mov ecx, r15d
call rbx
mov rsi, rax
mov qword [rsp + 0x38], rax
mov ebx, edi
test rsi, rsi
sete bl
test ebx, ebx
je 0x1400017a8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rdx, qword [rsp + 0x30]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x1400017c1
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rsi
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov r12, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r13
ret

Function at 0x1400018b0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x30
mov r12, rcx
xor esi, esi
mov edi, esi
mov dword [rsp + 0x20], esi
mov rbx, qword [0x140149c68]
mov qword [rsp + 0x48], rsi
mov eax, dword [0x140149c64]
test eax, eax
je 0x1400018fd
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x140149c64]
test eax, eax
jne 0x140001906
call fcn.1400013c0
test eax, eax
je 0x14000191c
lea rdx, [rsp + 0x48]
mov rcx, qword [0x1401459e0]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
test eax, eax
jne 0x140001920
xor eax, eax
jmp 0x140001979
test rbx, rbx
jne 0x140001940
lea rcx, str.GetOpenFileNameW
call fcn.1400017f0
mov rbx, rax
test rax, rax
je 0x14000194b
mov qword [0x140149c68], rax
mov rcx, r12
call rbx
mov edi, eax
mov dword [rsp + 0x20], eax
mov ebx, esi
test edi, edi
sete bl
test ebx, ebx
je 0x14000195e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x140001977
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r12
ret