joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003e298
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov ebp, r8d
mov r13, rdx
mov r14, rcx
call fcn.140034368
xor ebx, ebx
mov rdi, rax
cmp qword [0x1402725b8], rbx
jne 0x14003e39e
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x14003e473
lea rdx, str.MessageBoxA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14003e473
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, [0x1401e40b0]
mov rcx, rsi
mov qword [0x1402725b8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, [0x1401e4098]
mov rcx, rsi
mov qword [0x1402725c0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
mov qword [0x1402725c8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov r11, rax
mov qword [0x1402725d8], rax
test rax, rax
je 0x14003e395
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov qword [0x1402725d0], rax
jmp 0x14003e3a5
mov rax, qword [0x1402725d0]
jmp 0x14003e3ac
mov rax, qword [0x1402725d0]
mov r11, qword [0x1402725d8]
cmp rax, rdi
je 0x14003e414
cmp r11, rdi
je 0x14003e414
mov rcx, rax
call sub.KERNEL32.dll_DecodePointer
mov rcx, qword [0x1402725d8]
mov rsi, rax
call sub.KERNEL32.dll_DecodePointer
mov r12, rax
test rsi, rsi
je 0x14003e414
test rax, rax
je 0x14003e414
call rsi
test rax, rax
je 0x14003e40e
lea rcx, [rsp + 0x88]
mov r9d, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x14003e40e
test byte [rsp + 0x38], 1
jne 0x14003e414
bts ebp, 0x15
jmp 0x14003e452
mov rcx, qword [0x1402725c0]
cmp rcx, rdi
je 0x14003e452
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x14003e452
call rax
mov rbx, rax
test rax, rax
je 0x14003e452
mov rcx, qword [0x1402725c8]
cmp rcx, rdi
je 0x14003e452
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x14003e452
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x1402725b8]
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x14003e473
mov r9d, ebp
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x14003e475
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x14004b4c0
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x20
movzx eax, byte [rcx + 0x1f0]
mov rbx, rcx
test al, 4
je 0x14004b4e4
and al, 0xfb
mov byte [rcx + 0x1f0], al
mov al, 1
add rsp, 0x20
pop rbx
ret
mov qword [rsp + 0x30], rbp
mov rbp, qword [rcx + 0x40]
mov qword [rsp + 0x40], rdi
test dl, dl
je 0x14004b54c
mov rcx, rbp
call qword [sym.imp.USER32.dll_GetParent]
mov rcx, rax
call fcn.14001256c
mov rdi, rax
test rax, rax
je 0x14004b54c
nop
mov rcx, rbx
call fcn.14000a5c4
mov ecx, eax
and ecx, 0x18000000
cmp ecx, 0x10000000
jne 0x14004b639
bt eax, 0x1e
jae 0x14004b54c
mov rcx, qword [rdi + 0x40]
call qword [sym.imp.USER32.dll_GetParent]
mov rcx, rax
call fcn.14001256c
mov rdi, rax
test rax, rax
jne 0x14004b510
mov rax, qword [rbx + 0x178]
lea rcx, [rbx + 0x178]
mov qword [rsp + 0x38], rsi
call qword [rax + 0x18]
movzx esi, al
test al, al
jne 0x14004b5b4
mov rdx, qword [rbx + 0x178]
or byte [rbx + 0x228], 8
lea rcx, [rbx + 0x178]
call qword [rdx + reloc.OLEAUT32.dll_VariantClear]
xor edx, edx
lea rcx, [rbx + 0x178]
lea r8d, [rdx + 2]
call fcn.140075680
mov rcx, qword [rbx + 0x40]
xor edx, edx
lea r8d, [rdx + 1]
call qword [sym.imp.USER32.dll_InvalidateRect]
mov rcx, qword [rbx + 0x40]
call qword [sym.imp.USER32.dll_UpdateWindow]
and byte [rbx + 0x228], 0xf7
movzx r8d, byte [rbx + 0x1f0]
mov rax, qword [rbx]
mov dl, 1
shr r8b, 1
mov rcx, rbx
and r8b, 1
call qword [rax + 0x290]
test rbp, rbp
je 0x14004b622
mov rcx, rbp
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x14004b622
test sil, sil
jne 0x14004b60b
lea rcx, [rbx + 0x178]
xor r8d, r8d
mov dl, 1
call fcn.140075680
mov r11, qword [rbx + 0x178]
lea rcx, [rbx + 0x178]
call qword [r11 + 0x10]
mov ecx, 0x12
call qword [sym.imp.USER32.dll_GetKeyState]
shr ax, 0xf
and al, 1
mov byte [0x14027471d], al
mov rsi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x40]
mov al, 1
add rsp, 0x20
pop rbx
ret
mov rbp, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x40]
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x14004d360
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rsi
mov rdi, rcx
call fcn.14000f64c
mov rcx, rdi
call fcn.14000a5c4
mov edx, eax
and edx, 0xf
mov dword [rdi + 0x220], edx
and byte [rdi + 0x230], 0xfe
shr eax, 6
and al, 1
or byte [rdi + 0x230], al
test byte [rdi + 0x230], 1
je 0x14004d3b9
mov dword [rdi + 0x218], 1
mov edx, 0xf4
mov r9d, 1
lea r8d, [r9 + 0xa]
mov rcx, qword [rdi + 0x40]
call qword [sym.imp.USER32.dll_SendMessageW]
and byte [rdi + 0x21c], 0xfe
cmp dword [rdi + 0x220], 1
sete al
and al, 1
or byte [rdi + 0x21c], al
xor r9d, r9d
xor r8d, r8d
mov edx, 0xf0
mov rcx, qword [rdi + 0x40]
call qword [sym.imp.USER32.dll_SendMessageW]
mov dword [rdi + 0x224], eax
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x288]
xor esi, esi
mov r8, rsi
test al, al
setne r8b
xor r9d, r9d
lea edx, [rsi + 0xa]
mov rcx, qword [rdi + 0x40]
call qword [sym.imp.USER32.dll_PostMessageW]
lea rcx, [rdi + 0xb0]
mov rax, qword [rcx]
lea rdx, [rdi + 0x178]
call qword [rax + 0xb0]
mov r11, qword [rdi + 0x178]
xor edx, edx
lea rcx, [rdi + 0x178]
call qword [r11 + 0x30]
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
mov r11, qword [rdi + 0x178]
mov dl, 1
lea rcx, [rdi + 0x178]
call qword [r11 + 0x30]
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
lea rdx, [rsp + 0x28]
mov rcx, qword [rdi + 0x40]
call qword [sym.imp.USER32.dll_GetClientRect]
mov r11, qword [rdi + 0x178]
lea rdx, [rsp + 0x28]
lea rcx, [rdi + 0x178]
call qword [r11 + 0xa8]
xor r9d, r9d
xor edx, edx
mov r8d, 0x6000000
mov rcx, rdi
call fcn.14000a62c
and byte [rdi + 0x1f0], 0xfb
test byte [rdi + 0x1f0], 1
je 0x14004d5c3
call fcn.140008c24
mov rcx, rax
test rax, rax
setne sil
test esi, esi
jne 0x14004d4ec
mov ecx, 0x80004005
call fcn.1400052e0
int3
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0x50]
mov rcx, rdi
call fcn.140014290
mov r11, qword [rsp + 0x50]
mov eax, dword [r11 - 0x10]
test eax, eax
je 0x14004d5a8
test eax, eax
jle 0x14004d5a8
mov edx, 0x26
mov rcx, r11
call fcn.14002fb50
mov r10, rax
test rax, rax
je 0x14004d5a3
mov r11, qword [rsp + 0x50]
sub r10, r11
sar r10, 1
test r10d, r10d
js 0x14004d5a8
mov ecx, dword [r11 - 0x10]
lea eax, [rcx - 1]
cmp r10d, eax
je 0x14004d5a8
lea eax, [r10 + 1]
test eax, eax
js 0x14004d598
cmp eax, ecx
jg 0x14004d598
cdqe
movzx ecx, word [r11 + rax*2]
call fcn.1401a3900
movzx ecx, ax
mov edx, 2
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov ecx, eax
call qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
je 0x14004d5a3
or byte [rdi + 0x1f0], 4
mov r11, qword [rsp + 0x50]
jmp 0x14004d5a8
mov ecx, 0x80070057
call fcn.1400052e0
int3
mov r11, qword [rsp + 0x50]
lea rdx, [r11 - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14004d5c3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x140054ca0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x40
mov eax, dword [rsp + 0x80]
mov r12, r9
mov rbp, r8
mov rdi, rcx
lea esi, [rax + rax]
test rdx, rdx
je 0x140054cef
lea rax, [rsp + 0x30]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor ebx, ebx
test eax, eax
cmove rbx, qword [rsp + 0x30]
jmp 0x140054cf2
mov rbx, rcx
test rbx, rbx
je 0x140054d92
lea rax, [rsp + 0x80]
lea r9, [rsp + 0x68]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov rdx, rbp
mov rcx, rbx
mov qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140054d84
mov eax, dword [rsp + 0x68]
cmp eax, 1
je 0x140054d41
cmp eax, 2
je 0x140054d41
cmp eax, 6
je 0x140054d41
cmp eax, 7
jne 0x140054d84
cmp esi, dword [rsp + 0x80]
jb 0x140054d84
lea rax, [rsp + 0x80]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov rdx, rbp
mov rcx, rbx
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140054d84
cmp rbx, rdi
je 0x140054d80
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
jmp 0x140054d94
cmp rbx, rdi
je 0x140054d92
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
add rsp, 0x40
pop r12
pop rdi
pop rsi
ret
Function at 0x140054db0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov r11, rsp
push rsi
sub rsp, 0x70
xor eax, eax
xor r9d, r9d
xor r8d, r8d
mov qword [r11 - 0x20], rax
mov qword [r11 - 0x28], rax
mov qword [r11 - 0x30], rax
mov qword [r11 - 0x38], rax
mov qword [r11 - 0x40], rax
mov qword [r11 - 0x48], rax
lea rax, [r11 + 0x18]
xor edx, edx
mov rsi, rcx
mov qword [r11 - 0x50], rax
lea rax, [r11 + 0x10]
mov qword [r11 - 0x58], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x140054f0b
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x60], rdi
cmp dword [rsp + 0x88], eax
je 0x140054ed6
mov eax, dword [rsp + 0x90]
inc eax
mov ecx, eax
mov dword [rsp + 0x90], eax
add rcx, rcx
call fcn.140031e78
mov rdi, rax
test rax, rax
je 0x140054ef9
mov ecx, dword [rsp + 0x88]
nop
mov r9d, dword [rsp + 0x90]
dec ecx
mov r8, rdi
mov dword [rsp + 0x88], ecx
mov edx, ecx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x140054ef1
lea rax, [rsp + 0x98]
mov r9d, 0x2001f
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140054ef1
mov rbx, qword [rsp + 0x98]
test rbx, rbx
je 0x140054ef1
mov rcx, rbx
call fcn.140054db0
test al, al
je 0x140054ee8
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x140054ef1
mov ecx, dword [rsp + 0x88]
test ecx, ecx
jne 0x140054e40
mov rcx, rdi
call fcn.140030ffc
mov rbx, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x60]
mov al, 1
add rsp, 0x70
pop rsi
ret
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rdi
call fcn.140030ffc
mov rbx, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x60]
xor al, al
add rsp, 0x70
pop rsi
ret
xor al, al
add rsp, 0x70
pop rsi
ret
Function at 0x1400554f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rcx
push rdi
push r12
push r13
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rbp
mov qword [rsp + 0x78], rsi
mov rbx, r9
mov r12, r8
mov r13, rdx
mov rdi, rcx
xor esi, esi
mov qword [rcx], rsi
mov qword [rcx + 8], rsi
mov dword [rcx + 0x10], esi
mov dword [rcx + 0x14], esi
mov eax, dword [rsp + 0x88]
mov dword [rcx + 0x18], eax
add rcx, 0x20
call fcn.1400b1050
nop
mov dword [rdi + 0x30], esi
mov dword [rdi + 0x34], esi
mov word [rdi + 0x38], si
mov rax, qword [rdi + 0x20]
lea rcx, [rdi + 0x20]
call qword [rax + 0x18]
mov byte [rsp + 0x20], sil
xor r9d, r9d
mov r8, qword [rsp + 0x80]
mov rdx, rbx
lea rcx, [rdi + 0x20]
call fcn.1400bcf70
test al, al
je 0x140055692
xor edx, edx
lea rcx, [rdi + 0x20]
call fcn.1400b7450
test al, al
je 0x140055692
mov rdx, r12
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbp, rax
test rax, rax
je 0x140055692
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x140055692
movzx edx, word [rax + 6]
mov dword [rdi + 0x10], edx
movzx ecx, word [rax]
mov word [rdi + 0x38], cx
mov eax, 4
mul rdx
mov r12, 0xffffffffffffffff
cmovo rax, r12
mov rcx, rax
call fcn.140008c1c
mov qword [rdi], rax
mov dword [rdi + 0x14], esi
mov r9d, esi
cmp dword [rdi + 0x10], esi
jle 0x140055624
mov rdx, rsi
lea r8, [rbx + 8]
nop dword [rax]
movzx ecx, word [r8]
mov dword [rdx + rax], ecx
mov rax, qword [rdi]
cmp dword [rdx + rax], 0
je 0x140055613
inc dword [rdi + 0x14]
inc r9d
add r8, 2
add rdx, 4
cmp r9d, dword [rdi + 0x10]
jl 0x140055600
movsxd rcx, dword [rdi + 0x14]
mov eax, 4
mul rcx
cmovo rax, r12
mov rcx, rax
call fcn.140008c1c
mov qword [rdi + 8], rax
mov edx, esi
cmp dword [rdi + 0x10], edx
jle 0x14005567a
mov r8, rsi
mov rcx, rsi
nop dword [rax]
mov rax, qword [rdi]
mov r9d, dword [rcx + rax]
test r9d, r9d
je 0x14005566f
mov rax, qword [rdi + 8]
mov dword [r8 + rax], r9d
inc esi
add r8, 4
cmp esi, dword [rdi + 0x14]
je 0x14005567a
inc edx
add rcx, 4
cmp edx, dword [rdi + 0x10]
jl 0x140055650
movzx eax, word [rbx + 2]
mov dword [rdi + 0x30], eax
movzx eax, word [rbx + 4]
mov dword [rdi + 0x34], eax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FreeResource]
nop
mov rax, rdi
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r13
pop r12
pop rdi
ret
Function at 0x140055f20
Capabilities:
Identify system language via api

Disassembly:
push rbx
sub rsp, 0x20
mov eax, dword [rcx + 0xc]
mov rbx, rcx
cmp eax, 0xffffffff
jne 0x140056025
mov rax, qword [rcx]
call qword [rax + 0x28]
test al, al
je 0x140055f4a
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x50]
jmp 0x140055f50
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
movzx ecx, ax
cmp ecx, 0x1401
jg 0x140055fbe
je case.0x140055f9a.1025
cmp ecx, 0x460
jg 0x140055f9c
je case.0x140055f9a.1025
sub ecx, 0x401
cmp ecx, 0x58
ja case.0x140055f9a.1026
lea rdx, [0x140000000]
movsxd rax, ecx
movzx eax, byte [rdx + rax + 0x56034]
mov ecx, dword [rdx + rax*4 + 0x5602c]
add rcx, rdx
jmp rcx
sub ecx, 0x801
je case.0x140055f9a.1025
sub ecx, 0x1f
je case.0x140055f9a.1025
sub ecx, 0x40
je case.0x140055f9a.1025
sub ecx, 0x3a1
je case.0x140055f9a.1025
cmp ecx, 0x400
jmp 0x140056016
cmp ecx, 0x2c01
jg 0x140055ff0
je case.0x140055f9a.1025
cmp ecx, 0x1801
je case.0x140055f9a.1025
cmp ecx, 0x1c01
je case.0x140055f9a.1025
cmp ecx, 0x2001
je case.0x140055f9a.1025
cmp ecx, 0x2401
je case.0x140055f9a.1025
cmp ecx, 0x2801
jmp 0x140056016
cmp ecx, 0x3001
je case.0x140055f9a.1025
cmp ecx, 0x3401
je case.0x140055f9a.1025
cmp ecx, 0x3801
je case.0x140055f9a.1025
cmp ecx, 0x3c01
je case.0x140055f9a.1025
cmp ecx, 0x4001
je case.0x140055f9a.1025
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov eax, 1
add rsp, 0x20
pop rbx
ret

Function at 0x1400560a0
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rax, qword [rcx]
mov ebx, r9d
mov rdi, r8
mov esi, edx
mov rbp, rcx
call qword [rax + 0x28]
test al, al
je 0x140056107
mov rax, qword [rbp]
mov rcx, rbp
call qword [rax + 0x50]
mov r9d, ebx
mov r8, rdi
movzx ecx, ax
mov edx, esi
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x140056145
mov rax, qword [rbp]
mov rcx, rbp
call qword [rax + 0x60]
mov r9d, ebx
mov r8, rdi
movzx ecx, ax
mov edx, esi
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x140056145
mov r9d, ebx
mov r8, rdi
mov edx, esi
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x140056145
mov r9d, ebx
mov r8, rdi
mov edx, esi
mov ecx, 0x800
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x140056145
mov r9d, ebx
mov r8, rdi
mov edx, esi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140058280
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r13
sub rsp, 0x20
mov r13, rdx
mov rsi, rcx
mov rdx, r8
mov rcx, r13
mov rbp, r8
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rdi, rax
test rax, rax
jne 0x1400582b8
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r13
pop rdi
pop rsi
ret
mov rcx, rax
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], r12
call qword [sym.imp.KERNEL32.dll_LockResource]
xor bl, bl
mov r12, rax
test rax, rax
je 0x14005831d
mov rdx, rbp
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebp, eax
test eax, eax
jne 0x1400582f1
mov rcx, rsi
call fcn.140055d70
jmp 0x14005831b
mov r8b, 1
mov edx, ebp
mov rcx, rsi
call fcn.140055da0
test al, al
je 0x14005831d
mov rcx, rsi
mov r9, rbp
call fcn.140055d60
mov rcx, qword [rsi + 8]
mov r8, r12
mov edx, eax
call fcn.14002f9cc
mov bl, 1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov r12, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov al, bl
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r13
pop rdi
pop rsi
ret
Function at 0x14005eba0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
xor edi, edi
mov rsi, rcx
mov rbx, rdi
test rdx, rdx
je 0x14005ec2a
lea rcx, [0x140272710]
mov qword [rsp + 0x48], rdi
call fcn.14005e6a0
mov r8d, dword [rsi + 0xb0]
lea rcx, [rsp + 0x48]
mov r10, qword [rax]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
mov edx, 0xf0
mov rcx, rax
call qword [r10 + 0xd0]
test rax, rax
je 0x14005ec2a
mov rdx, qword [rsp + 0x48]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbx, rax
test rax, rax
jne 0x14005ec1e
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
mov rdx, rdi
mov rcx, rsi
call fcn.140059c20
mov esi, eax
test rdi, rdi
je 0x14005ec4a
test rbx, rbx
je 0x14005ec4a
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rbx, qword [rsp + 0x40]
mov eax, esi
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x14005ffa0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rbp
mov qword [rsp + 0x78], rsi
mov rbp, r8
mov rbx, rdx
mov rdi, rcx
call fcn.14000b818
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.14000b8bc
nop
mov qword [rdi + 0xb0], rbx
cmp word [rdi + 0xb2], 0
jne 0x14005fffd
cmp dword [rdi + 0xa8], 0
jne 0x14005fffd
movzx eax, bx
mov dword [rdi + 0xa8], eax
mov qword [rdi + 0xf8], rbx
mov qword [rsp + 0x60], 0
lea rcx, [0x140272710]
call fcn.14005e6a0
mov r10, qword [rax]
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
mov r8d, ebx
lea edx, [r9 + 5]
mov rcx, rax
call qword [r10 + 0xd0]
mov rsi, rax
test rax, rax
jne 0x140060058
cmp dword [rsp + 0x40], eax
je 0x140060054
mov rdx, qword [rsp + 0x38]
xor ecx, ecx
call fcn.14000abd0
xor eax, eax
jmp 0x14006009b
mov rdx, qword [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbx, rax
mov r9, rsi
mov r8, rbp
mov rdx, rax
mov rcx, rdi
call fcn.14005eb50
mov edi, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeResource]
nop
cmp dword [rsp + 0x40], 0
je 0x140060099
mov rdx, qword [rsp + 0x38]
xor ecx, ecx
call fcn.14000abd0
mov eax, edi
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x140060300
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r15
sub rsp, 0x78
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov rbx, rcx
mov r13, qword [rcx + 0xc0]
mov rsi, qword [rcx + 0xb8]
mov qword [rsp + 0xc8], rsi
call fcn.14000b840
mov r15, qword [rax + 0x18]
cmp qword [rbx + 0xb0], 0
je 0x1400603a6
mov qword [rsp + 0xc0], 0
lea rcx, [0x140272710]
call fcn.14005e6a0
mov r10, qword [rax]
lea rcx, [rsp + 0xc0]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
mov r8d, dword [rbx + 0xb0]
lea edx, [r9 + 5]
mov rcx, rax
call qword [r10 + 0xd0]
mov r15, rax
mov rdx, qword [rsp + 0xc0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
mov qword [rsp + 0xc8], rax
test rsi, rsi
je 0x1400603b7
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r13, rax
test r13, r13
jne 0x1400603c5
or rax, 0xffffffffffffffff
jmp 0x14006051b
mov rcx, rbx
call fcn.1400173ec
mov rdi, rax
mov qword [rsp + 0x40], rax
call fcn.140012688
xor r12d, r12d
mov dword [rsp + 0xb8], r12d
test rdi, rdi
je 0x140060410
mov rcx, rdi
call qword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x140060410
xor edx, edx
mov rcx, rdi
call qword [sym.imp.USER32.dll_EnableWindow]
mov r12d, 1
mov dword [rsp + 0xb8], r12d
lea rcx, [rsp + 0x58]
call fcn.140009514
nop
mov rcx, rbx
call fcn.140014f9c
mov rcx, rdi
call fcn.14001256c
mov r9, r15
mov r8, rax
mov rdx, r13
mov rcx, rbx
call fcn.14005e6b0
test eax, eax
je 0x14006049c
test byte [rbx + 0x78], 0x10
je 0x14006046c
mov r13d, 4
mov rcx, rbx
call fcn.14000a5c4
bt eax, 8
mov eax, 5
cmovb r13d, eax
mov edx, r13d
mov rcx, rbx
call fcn.140011ea4
cmp qword [rbx + 0x40], 0
je 0x14006049c
mov dword [rsp + 0x30], 0x97
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call fcn.14000a8a8
nop
jmp 0x1400604bb
call fcn.14000957c
test r12d, r12d
je 0x1400604d3
mov edx, 1
mov rcx, rdi
call qword [sym.imp.USER32.dll_EnableWindow]
test rdi, rdi
je 0x1400604ed
call qword [sym.imp.USER32.dll_GetActiveWindow]
cmp rax, qword [rbx + 0x40]
jne 0x1400604ed
mov rcx, rdi
call qword [sym.imp.USER32.dll_SetActiveWindow]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0xc0]
mov rcx, rbx
call fcn.140017448
cmp qword [rbx + 0xb0], 0
je 0x140060514
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeResource]
movsxd rax, dword [rbx + 0x88]
add rsp, 0x78
pop r15
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret