joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400387a4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ax, word [rsp + 0x3e]
mov word [rsp + 0x19e], ax
mov rcx, qword [rsp + 0xd0]
mov edx, dword [rsp + 0x7c]
mov r8d, edx
add rcx, r8
mov r8, qword [rsp + 0x188]
and al, 0x88
add dword [rax], eax
add byte [rcx - 0x7f], cl
invalid
ror byte [rbp - 0x6b74ada8], cl
and al, 0x24
add dword [rax], eax
add byte [rcx - 0x77], al
ror dword [rcx + rcx*4 - 0x74], 1
and al, 0x48
add dword [rax], eax
add byte [rbx + rcx*4 + 0x4c], cl
and al, 0x30
and r9, 0x7669f827
imul esi, dword [rsi + 0x4c], 0xa0248c89
add dword [rax], eax
add byte [rcx + rcx*4 - 0x7c], cl
and al, 0x40
add dword [rax], eax
add byte [rax - 0x77], cl
mov word [rax + riz*4], fs
add byte [rax], al
add byte [rax], al
jne 0x140038742
jmp 0x140038a52
mov qword [rsp + 0x1a0], 0xe425880
call fcn.140037a60
mov ecx, 0x22f8379c
xor edx, edx
mov r8d, edx
mov edx, 0x22f87cec
sub edx, dword [rsp + 0x198]
mov r9b, byte [rsp + 0x4f]
add r9b, 0x52
mov byte [rsp + 0x1af], r9b
mov r10, rax
mov qword [rsp + 0xd0], r10
movsxd rax, dword [rax + 0x3c]
cmp al, 0x4c
mov edx, dword [rsp + 0xd0]
mov r11, r10
add r11, rax
mov esi, dword [r10 + rax]
mov r9b, byte [rsp + 0x4f]
and r9b, 0xf9
mov byte [rsp + 0x1af], r9b
cmp esi, edx
cmove r8, r11
mov di, word [rsp + 0x3e]
mov word [rsp + 0x19e], di
mov edx, dword [r8 + 0x88]
add byte [rax], al
mov eax, edx
add rax, qword [rsp + 0xd0]
mov qword [rsp + 0xf8], rax
mov rax, qword [rsp + 0x30]
xor rax, 0x1a9f45dc
mov r8, qword [rsp + 0xf8]
sub ecx, dword [rsp + 0x198]
mov qword [rsp + 0x1a0], rax
xor di, 0x7f80
mov word [rsp + 0x19e], di
mov di, word [rsp + 0x3e]
xor di, 0xffff
mov word [rsp + 0x19e], di
mov edx, dword [r8 + 0x20]
mov eax, edx
mov di, word [rsp + 0x3e]
add di, 0x6b61
add rax, qword [rsp + 0xd0]
mov word [rsp + 0x19e], di
mov qword [rsp + 0x138], rax
mov di, word [rsp + 0x3e]
xor di, 0xffff
dec dword [rax - 0x75]
test byte [rax + rdi*8], ah
add byte [rax], al
add byte [rsi - 0x77], ah
mov esp, 0x19e24
add byte [rsi - 0x75], ah
jl 0x140038b91
or di, 0xe26f
mov word [rsp + 0x19e], di
mov edx, dword [rax + 0x18]
mov dword [rsp + 0x124], edx
mov edx, dword [rsp + 0x124]
mov di, word [rsp + 0x3e]
mov word [rsp + 0x19e], di
mov esi, dword [rsp + 0x38]
add esi, 0x6e569d7f
mov dword [rsp + 0x1b0], esi
mov qword [rsp + 0xb8], 0
add byte [rax], al
add byte [rax], al
add byte [rax], al
cmp edx, ecx
je 0x140038c84
jmp 0x1400388dc
Function at 0x1400388b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x22f8379d
sub eax, dword [rsp + 0x198]
mov ecx, dword [rsp + 0xcc]
mov word [rsp + 0x19e], 0xb1ac
mov dword [rsp + 0x100], ecx
mov ecx, dword [rsp + 0x100]
mov dx, word [rsp + 0x3e]
mov word [rsp + 0x19e], dx
mov r8d, dword [rsp + 0x38]
xor r8d, 0xffffffff
mov ecx, ecx
mov r9d, ecx
mov dword [rsp + 0x1b0], r8d
mov r10b, byte [rsp + 0x197]
xor r10b, 0x43
add eax, dword [rsp + 0x100]
mov r11, qword [rsp + 0x58]
and al, 0x58
mov bl, byte [r11 + r9]
mov dword [rsp + 0xcc], eax
mov sil, byte [rsp + 0x4f]
and sil, 0xa2
mov byte [rsp + 0x1af], sil
cmp bl, r10b
je sym.DUI70.dll_public_virtual:_struct_DirectUI::IClassInfo____ptr64___cdecl_DirectUI::CCSysLink::GetClassInfoW_void____ptr64
jmp 0x14003884c
mov word [rsi + rbx*4], fs
add dword [rax], eax
add byte [rcx + 0x66c189c0], cl
mov r8d, dword [rsp + 0x3e]
and r8w, 0xc30e
mov word [rsp + 0x19e], r8w
add rcx, qword [rsp + 0xd0]
mov rdx, rcx
mov qword [rsp + 0xf0], rdx
mov rdx, qword [rsp + 0x30]
xor rdx, rdx
mov qword [rsp + 0x1a0], rdx
mov qword [rsp + 0x1a0], 0xffffffffe4d4e500
mov qword [rsp + 0xb8], 0
add byte [rax], al
cmp rcx, 0
jne 0x140038e74
mov al, 0xb7
mov rcx, qword [rsp + 0xb8]
mov dl, byte [rsp + 0x4f]
sub al, dl
mov byte [rsp + 0x1af], al
mov rax, rcx
invalid
invalid
invalid
invalid
add dword [rax], eax
Function at 0x140038940
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ax, word [rsp + 0x3e]
mov word [rsp + 0x19e], ax
mov rcx, qword [rsp + 0xd0]
mov edx, dword [rsp + 0x7c]
mov r8d, edx
add rcx, r8
mov r8, qword [rsp + 0x188]
and al, 0x88
add dword [rax], eax
add byte [rcx - 0x7f], cl
invalid
ror byte [rbp - 0x6b74ada8], cl
and al, 0x24
add dword [rax], eax
add byte [rcx - 0x77], al
ror dword [rcx + rcx*4 - 0x74], 1
and al, 0x48
add dword [rax], eax
add byte [rbx + rcx*4 + 0x4c], cl
and al, 0x30
and r9, 0x7669f827
imul esi, dword [rsi + 0x4c], 0xa0248c89
add dword [rax], eax
add byte [rcx + rcx*4 - 0x7c], cl
and al, 0x40
add dword [rax], eax
add byte [rax - 0x77], cl
mov word [rax + riz*4], fs
add byte [rax], al
add byte [rax], al
jne 0x140038742
jmp 0x140038a52
mov qword [rsp + 0x1a0], 0xe425880
call fcn.140037a60
mov ecx, 0x22f8379c
xor edx, edx
mov r8d, edx
mov edx, 0x22f87cec
sub edx, dword [rsp + 0x198]
mov r9b, byte [rsp + 0x4f]
add r9b, 0x52
mov byte [rsp + 0x1af], r9b
mov r10, rax
mov qword [rsp + 0xd0], r10
movsxd rax, dword [rax + 0x3c]
cmp al, 0x4c
mov edx, dword [rsp + 0xd0]
mov r11, r10
add r11, rax
mov esi, dword [r10 + rax]
mov r9b, byte [rsp + 0x4f]
and r9b, 0xf9
mov byte [rsp + 0x1af], r9b
cmp esi, edx
cmove r8, r11
mov di, word [rsp + 0x3e]
mov word [rsp + 0x19e], di
mov edx, dword [r8 + 0x88]
add byte [rax], al
mov eax, edx
add rax, qword [rsp + 0xd0]
mov qword [rsp + 0xf8], rax
mov rax, qword [rsp + 0x30]
xor rax, 0x1a9f45dc
mov r8, qword [rsp + 0xf8]
sub ecx, dword [rsp + 0x198]
mov qword [rsp + 0x1a0], rax
xor di, 0x7f80
mov word [rsp + 0x19e], di
mov di, word [rsp + 0x3e]
xor di, 0xffff
mov word [rsp + 0x19e], di
mov edx, dword [r8 + 0x20]
mov eax, edx
mov di, word [rsp + 0x3e]
add di, 0x6b61
add rax, qword [rsp + 0xd0]
mov word [rsp + 0x19e], di
mov qword [rsp + 0x138], rax
mov di, word [rsp + 0x3e]
xor di, 0xffff
dec dword [rax - 0x75]
test byte [rax + rdi*8], ah
add byte [rax], al
add byte [rsi - 0x77], ah
mov esp, 0x19e24
add byte [rsi - 0x75], ah
jl 0x140038b91
or di, 0xe26f
mov word [rsp + 0x19e], di
mov edx, dword [rax + 0x18]
mov dword [rsp + 0x124], edx
mov edx, dword [rsp + 0x124]
mov di, word [rsp + 0x3e]
mov word [rsp + 0x19e], di
mov esi, dword [rsp + 0x38]
add esi, 0x6e569d7f
mov dword [rsp + 0x1b0], esi
mov qword [rsp + 0xb8], 0
add byte [rax], al
add byte [rax], al
add byte [rax], al
cmp edx, ecx
je 0x140038c84
jmp 0x1400388dc
Function at 0x140038a98
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ax, word [rsp + 0x3e]
mov word [rsp + 0x19e], ax
mov rcx, qword [rsp + 0xd0]
mov edx, dword [rsp + 0x7c]
mov r8d, edx
add rcx, r8
mov r8, qword [rsp + 0x188]
and al, 0x88
add dword [rax], eax
add byte [rcx - 0x7f], cl
invalid
ror byte [rbp - 0x6b74ada8], cl
and al, 0x24
add dword [rax], eax
add byte [rcx - 0x77], al
ror dword [rcx + rcx*4 - 0x74], 1
and al, 0x48
add dword [rax], eax
add byte [rbx + rcx*4 + 0x4c], cl
and al, 0x30
and r9, 0x7669f827
imul esi, dword [rsi + 0x4c], 0xa0248c89
add dword [rax], eax
add byte [rcx + rcx*4 - 0x7c], cl
and al, 0x40
add dword [rax], eax
add byte [rax - 0x77], cl
mov word [rax + riz*4], fs
add byte [rax], al
add byte [rax], al
jne 0x140038742
jmp 0x140038a52
mov qword [rsp + 0x1a0], 0xe425880
call fcn.140037a60
mov ecx, 0x22f8379c
xor edx, edx
mov r8d, edx
mov edx, 0x22f87cec
sub edx, dword [rsp + 0x198]
mov r9b, byte [rsp + 0x4f]
add r9b, 0x52
mov byte [rsp + 0x1af], r9b
mov r10, rax
mov qword [rsp + 0xd0], r10
movsxd rax, dword [rax + 0x3c]
cmp al, 0x4c
mov edx, dword [rsp + 0xd0]
mov r11, r10
add r11, rax
mov esi, dword [r10 + rax]
mov r9b, byte [rsp + 0x4f]
and r9b, 0xf9
mov byte [rsp + 0x1af], r9b
cmp esi, edx
cmove r8, r11
mov di, word [rsp + 0x3e]
mov word [rsp + 0x19e], di
mov edx, dword [r8 + 0x88]
add byte [rax], al
mov eax, edx
add rax, qword [rsp + 0xd0]
mov qword [rsp + 0xf8], rax
mov rax, qword [rsp + 0x30]
xor rax, 0x1a9f45dc
mov r8, qword [rsp + 0xf8]
sub ecx, dword [rsp + 0x198]
mov qword [rsp + 0x1a0], rax
xor di, 0x7f80
mov word [rsp + 0x19e], di
mov di, word [rsp + 0x3e]
xor di, 0xffff
mov word [rsp + 0x19e], di
mov edx, dword [r8 + 0x20]
mov eax, edx
mov di, word [rsp + 0x3e]
add di, 0x6b61
add rax, qword [rsp + 0xd0]
mov word [rsp + 0x19e], di
mov qword [rsp + 0x138], rax
mov di, word [rsp + 0x3e]
xor di, 0xffff
dec dword [rax - 0x75]
test byte [rax + rdi*8], ah
add byte [rax], al
add byte [rsi - 0x77], ah
mov esp, 0x19e24
add byte [rsi - 0x75], ah
jl 0x140038b91
or di, 0xe26f
mov word [rsp + 0x19e], di
mov edx, dword [rax + 0x18]
mov dword [rsp + 0x124], edx
mov edx, dword [rsp + 0x124]
mov di, word [rsp + 0x3e]
mov word [rsp + 0x19e], di
mov esi, dword [rsp + 0x38]
add esi, 0x6e569d7f
mov dword [rsp + 0x1b0], esi
mov qword [rsp + 0xb8], 0
add byte [rax], al
add byte [rax], al
add byte [rax], al
cmp edx, ecx
je 0x140038c84
jmp 0x1400388dc
Function at 0x140038b58
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ax, word [rsp + 0x3e]
mov word [rsp + 0x19e], ax
mov rcx, qword [rsp + 0xd0]
mov edx, dword [rsp + 0x7c]
mov r8d, edx
add rcx, r8
mov r8, qword [rsp + 0x188]
and al, 0x88
add dword [rax], eax
add byte [rcx - 0x7f], cl
invalid
ror byte [rbp - 0x6b74ada8], cl
and al, 0x24
add dword [rax], eax
add byte [rcx - 0x77], al
ror dword [rcx + rcx*4 - 0x74], 1
and al, 0x48
add dword [rax], eax
add byte [rbx + rcx*4 + 0x4c], cl
and al, 0x30
and r9, 0x7669f827
imul esi, dword [rsi + 0x4c], 0xa0248c89
add dword [rax], eax
add byte [rcx + rcx*4 - 0x7c], cl
and al, 0x40
add dword [rax], eax
add byte [rax - 0x77], cl
mov word [rax + riz*4], fs
add byte [rax], al
add byte [rax], al
jne 0x140038742
jmp 0x140038a52
mov qword [rsp + 0x1a0], 0xe425880
call fcn.140037a60
mov ecx, 0x22f8379c
xor edx, edx
mov r8d, edx
mov edx, 0x22f87cec
sub edx, dword [rsp + 0x198]
mov r9b, byte [rsp + 0x4f]
add r9b, 0x52
mov byte [rsp + 0x1af], r9b
mov r10, rax
mov qword [rsp + 0xd0], r10
movsxd rax, dword [rax + 0x3c]
cmp al, 0x4c
mov edx, dword [rsp + 0xd0]
mov r11, r10
add r11, rax
mov esi, dword [r10 + rax]
mov r9b, byte [rsp + 0x4f]
and r9b, 0xf9
mov byte [rsp + 0x1af], r9b
cmp esi, edx
cmove r8, r11
mov di, word [rsp + 0x3e]
mov word [rsp + 0x19e], di
mov edx, dword [r8 + 0x88]
add byte [rax], al
mov eax, edx
add rax, qword [rsp + 0xd0]
mov qword [rsp + 0xf8], rax
mov rax, qword [rsp + 0x30]
xor rax, 0x1a9f45dc
mov r8, qword [rsp + 0xf8]
sub ecx, dword [rsp + 0x198]
mov qword [rsp + 0x1a0], rax
xor di, 0x7f80
mov word [rsp + 0x19e], di
mov di, word [rsp + 0x3e]
xor di, 0xffff
mov word [rsp + 0x19e], di
mov edx, dword [r8 + 0x20]
mov eax, edx
mov di, word [rsp + 0x3e]
add di, 0x6b61
add rax, qword [rsp + 0xd0]
mov word [rsp + 0x19e], di
mov qword [rsp + 0x138], rax
mov di, word [rsp + 0x3e]
xor di, 0xffff
dec dword [rax - 0x75]
test byte [rax + rdi*8], ah
add byte [rax], al
add byte [rsi - 0x77], ah
mov esp, 0x19e24
add byte [rsi - 0x75], ah
jl 0x140038b91
or di, 0xe26f
mov word [rsp + 0x19e], di
mov edx, dword [rax + 0x18]
mov dword [rsp + 0x124], edx
mov edx, dword [rsp + 0x124]
mov di, word [rsp + 0x3e]
mov word [rsp + 0x19e], di
mov esi, dword [rsp + 0x38]
add esi, 0x6e569d7f
mov dword [rsp + 0x1b0], esi
mov qword [rsp + 0xb8], 0
add byte [rax], al
add byte [rax], al
add byte [rax], al
cmp edx, ecx
je 0x140038c84
jmp 0x1400388dc

Function at 0x140038be4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov r8w, word [rcx]
mov rcx, qword [rsp + 0xf8]
mov qword [rsp + 0x1a0], rdx
mov r9w, word [rsp + 0x3e]
sub r9w, r9w
mov eax, dword [rcx + 0x1c]
mov rcx, qword [rsp + 0xd0]
add byte [rcx + 0x48c289c0], cl
add ecx, edx

Function at 0x140038c0c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add byte [rcx + 0x48c289c0], cl
add ecx, edx
movzx eax, r8w
mov edx, eax
mov eax, dword [rcx + rdx*4]
mov word [rsp + 0x19e], r9w
mov word [rsi + rbx*4], fs
add dword [rax], eax
add byte [rcx + 0x66c189c0], cl
mov r8d, dword [rsp + 0x3e]
Function at 0x140038f44
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ax, 0xd6a1
mov rcx, qword [rsp + 0x30]
xor rcx, 0xb3d79e3
mov edx, dword [rsp + 0x100]
mov r8w, word [rsp + 0xe6]
mov qword [rsp + 0x1a0], rcx
mov r9b, byte [rsp + 0x4f]
xor r9b, 0xff
mov r10w, word [rsp + 0x1b6]
mov r11w, dx
mov byte [rsp + 0x1af], r9b
sub ax, r10w
mov edx, dword [rsp + 0x38]
and edx, 0x1d6f7dc9
mov dword [rsp + 0x1b0], edx
mov word [rsp + 0x106], r11w
mov edx, dword [rsp + 0x38]
sub edx, edx
mov dword [rsp + 0x1b0], edx
cmp ax, r8w
jae 0x1400389b6
mov eax, 0x22f8379c
mov rcx, qword [rsp + 0x30]
sub rcx, 0x50e2ee1
mov qword [rsp + 0x1a0], rcx
mov dx, word [rsp + 0x106]
mov word [rsp + 0x110], dx
mov dx, word [rsp + 0x106]
mov word [rsp + 0x112], dx
mov r8b, byte [rsp + 0x4f]
or r8b, 0x2c
invalid
invalid
invalid
Function at 0x140039b90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xd8
mov al, 0x54
mov byte [rsp + 0xd1], 0x7d
mov edx, dword [rsp + 0xd4]
mov dword [rsp + 0xd4], edx
mov dword [rsp + 0xc4], 0x563ac982
test byte [rsp + rax*8], ah
add byte [rax], al
add byte [rdx + 0x66563ac9], al
mov r8d, dword [rsp + 0xd2]
mov r9b, byte [rsp + 0xd1]
mov r10w, r8w
xor r10w, 0x2de0
xor r10d, 0x44662de0
mov dword [rsp + 0xd2], edx
sub al, r9b
mov byte [rsp + 0xb7], al
imul r11d, edx, 0x7763c9e3
mov dword [rsp + 0xd4], r11d
mov qword [rsp + 0x50], rcx
mov byte [rsp + 0x4f], r9b
mov dword [rsp + 0x48], edx
mov word [rsp + 0x46], r8w
call fcn.140037a60
mov r9b, 0xf3
mov edx, dword [rsp + 0x48]
xor edx, 0x641d0f06
mov rcx, rax
ror dword [rcx + 0xd42494], 0
add byte [rax - 0x75], cl
mov ah, 0x24
enter 0, 0

Function at 0x14003b3f4
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [rsp + 0xb4]
cmp eax, dword [rsp + 0x124]
jb 0x14003b34e
jmp 0x14003a481
mov r10d, dword [rax + rdx*4]
mov dword [rsp + 0xb4], r10d
mov r10d, dword [rsp + 0x15c]
mov cx, word [rsp + 0x8c]
mov word [rax], es
add byte [rax], al
mov word [rsp + 0x1a0], cx
cmp r8d, r10d
jne 0x14003afce
invalid
lodsd eax, dword [rsi]
sti
invalid
invalid
jmp 0x14003a97a

Function at 0x14003b56c
Capabilities:
Encode data using xor
Identify system language via api
Resolve function by parsing pe exports

Disassembly:
mov dword [rsp + 0x50], eax
mov cl, byte [rsp + 0x37]
xor cl, cl
mov byte [rsp + 0x6b], cl
mov r8d, dword [rsp + 0x28]
mov r10d, dword [rsp + 0x2c]
cmp r8d, r10d
je 0x14003b4db
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x48]
add rsp, 0x80
pop rbx
pop rdi
pop rsi
jmp fcn.140038450

Function at 0x14003ccb4
Capabilities:
Access peb ldr_data

Disassembly:
and al, 0x18
add dword [rax], eax
add byte [rcx - 0x3b2f8e3e], al
mov al, 0x89
xchg esp, eax
and al, 0x84
add byte [rax], al
add byte [rax - 0x7d], cl
stc
add byte [rax - 0x77], cl
and al, 0x58
mov byte [rsp + 0x57], bl
mov dword [rsp + 0x50], r11d
mov word [rsp + 0x4e], r8w
mov qword [rsp + 0x40], r10
je 0x14003d435
jmp 0x14003cd36
mov ax, 0x4c51
mov ecx, 0x60f76ed0
sub ecx, dword [rsp + 0x118]
mov dl, byte [rsp + 0x57]
add dl, 0xfb
mov byte [rsp + 0x11f], dl
mov word [rsp + 0x3e], ax
mov r8, qword gs:[ecx]
mov r9w, word [rsp + 0x4e]
imul r10w, r9w, 0xf044
invalid
invalid
lea rax, [0x14003bf90]
mov qword [rsp + 0x60], rax
jmp 0x14003d1aa

Function at 0x14003d60c
Capabilities:
Access peb ldr_data

Disassembly:
add byte [rsi + 0x44], ah
mov ebx, dword [rsp + 0x13e]
add byte [rax], al
Function at 0x14003d614
Capabilities:
Access peb ldr_data

Disassembly:
add byte [rax], al
xor r11w, 0x2ca2
mov word [rsp + 0x11e], r11w
mov bl, byte [rsp + 0x12f]
sub r8w, word [rsp + 0x13e]
mov word [rsp + 0x8e], r8w
sub eax, dword [rsp + 0x120]
mov word [rsp + 0x13c], 0xbe10
mov dword [rsp + 0x74], eax
mov esi, dword [rsp + 0x74]
mov rdi, qword gs:[esi]
mov rax, qword [rdi + 0x60]
mov bpl, bl
add bpl, 0xde
mov byte [rsp + 0x12f], bpl
mov rax, qword [rax + 0x18]
mov r14, rax
add r14, 0x20
mov word [rsp + 0x13c], 0x420b
mov rax, qword [rax + 0x20]
mov qword [rsp + 0x110], 0
mov r8w, r9w
sub r8w, r8w
mov word [rsp + 0x13c], r8w
cmp rax, r14
mov qword [rsp + 0x68], rdx
mov qword [rsp + 0x60], rcx
mov dword [rsp + 0x5c], r10d
mov byte [rsp + 0x5b], bl
mov word [rsp + 0x58], r9w
mov qword [rsp + 0x50], rdi
and al, 0x50

Function at 0x14003e0b0
Capabilities:
Access peb ldr_data

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x188
invalid

Function at 0x14003e128
Capabilities:
Access peb ldr_data

Disassembly:
mov r11w, word cs:[rsp + 0x182]

Function at 0x14003e270
Capabilities:
Access peb ldr_data

Disassembly:
and al, 0x74
add dword [rax], eax
add byte [rbp + 0x69], al
rcr byte [rdx + 0x66ffffe3], 1
mov r11d, r10d
mov word [rsp + 0x176], r11w
xor bpl, 0x6e
mov r10d, ecx
add r10d, 0x81cfd8e5
mov dword [rsp + 0x184], r10d
mov byte [rsp + 0x146], bpl
mov bpl, byte [rsp + 0x174]
xor bpl, 0x6f
invalid
invalid
lodsb al, byte [rsi]
and al, 0x47

Function at 0x14003e300
Capabilities:
Access peb ldr_data

Disassembly:
add byte [rdx + rcx*4 - 0x6c], al
and al, 0x74
add dword [rax], eax
add byte [rcx - 0x80], al
cmp dword [rax - 0x39], ecx
test byte [rax + rdi*2], ah
add dword [rax], eax
add byte [rax], al
int 0xff
mov byte cs:[rsp + 0x149], r10b
mov r10b, byte [rsp + 0x174]
xor r10b, 0x31
mov byte [rsp + 0x175], 0xdc
mov byte [rsp + 0x14a], r10b
mov r10b, byte [rsp + 0x174]
xor r10b, 0x31
mov dword [rsp + 0x184], 0x3013ca5
mov byte [rsp + 0x14b], r10b
mov r10b, byte [rsp + 0x174]
add r10b, 0xa3
mov byte [rsp + 0x14c], r10b
mov r10d, r8d
xor r10d, 0xc8aa
mov r11w, r10w
invalid
invalid

Function at 0x14003e3b0
Capabilities:
Access peb ldr_data

Disassembly:
add byte [rax - 0x78], al
lodsb al, byte [rsi]
and al, 0x4d
add dword [rax], eax
add byte [rax - 0x77], cl
mov ah, 0x24
js sym.DUI70.dll_public:_static_struct_DirectUI::IClassInfo____ptr64___cdecl_DirectUI::TouchCheckBoxGlyph::GetClassInfoPtr_void_
invalid

Function at 0x14003e3d8
Capabilities:
Access peb ldr_data

Disassembly:
add byte [rsi + 0x41], ah
add ebx, 0x44664a87
mov dword [rsp + 0xd0], ebx
mov byte [rsp + 0x175], bl
invalid

Function at 0x14003e490
Capabilities:
Access peb ldr_data

Disassembly:
pushfq
and al, 0x75
add dword [rax], eax
add byte [rsi + 0x44], ah
mov edx, dword [rsp + 0x182]
mov dword [rsp + 0x184], edx
add r10w, 0x4a39
mov dword [rsp + 0x184], 0x7c7948ef
mov word [rsp + 0xda], r10w
fiadd dword [rax]
add byte [rax], al
mov byte [rsp + 0x175], 0xe2
mov r15b, 0x49
mov word [rsp + 0x76], ax
mov al, bl
mul r15b
mov edx, r8d
Function at 0x14003e4dc
Capabilities:
Access peb ldr_data

Disassembly:
mov edx, edx
mov byte [rsp + 0x175], al
mov word [rsp + 0xf4], 0
mov qword [rsp + 0xec], 0
mov qword [rsp + 0xe4], 0
mov qword [rsp + 0xdc], 0
mov word [rsp + 0x176], 0x1b28
mov word [rsp + 0x176], r10w
movsx edx, byte [rsp + 0x15b]
mov r10w, dx
mov word [rsp + 0x176], r11w
add dword [rax], eax
add byte [rsi + 0x44], ah
mov dword [rsp + 0xf6], edx
movsx edx, byte [rsp + 0x15c]
mov r10w, dx
mov word [rsp + 0xf8], r10w
add r8d, 0xffffbbf7
mov r10w, r8w
mov word [rsp + 0x176], r10w
movsx edx, byte [rsp + 0x15d]
and al, 0x5d
add dword [rax], eax
add byte [rsi + 0x41], ah
mov edx, edx
mov edx, ecx
add edx, 0x4a2b4b79
mov dword [rsp + 0x184], edx
mov word [rsp + 0xfa], r10w
mov r12, rsi
xor r12, 0x2a19b920
movsx edx, byte [rsp + 0x15e]
mov r10w, dx
mov qword [rsp + 0x178], r12
mov edx, ecx
or edx, 0x2532bd67
mov dword [rsp + 0x184], edx
mov word [rsp + 0xfc], r10w
mov r12, rsi
or r12, 0x350c9bca
mov qword [rsp + 0x178], r12
mov al, byte [rsp + 0x15f]
pop rdi
add dword [rax], eax
add byte [rdi], cl
mov esi, 0x894166d0
shl byte [rsi + 0x44], cl
mov dword [rsp + 0xfe], edx

Function at 0x14003e538
Capabilities:
Access peb ldr_data

Disassembly:
mov edx, edx
mov byte [rsp + 0x175], al
mov word [rsp + 0xf4], 0
mov qword [rsp + 0xec], 0
mov qword [rsp + 0xe4], 0
mov qword [rsp + 0xdc], 0
mov word [rsp + 0x176], 0x1b28
mov word [rsp + 0x176], r10w
movsx edx, byte [rsp + 0x15b]
mov r10w, dx
mov word [rsp + 0x176], r11w
add dword [rax], eax
add byte [rsi + 0x44], ah
mov dword [rsp + 0xf6], edx
movsx edx, byte [rsp + 0x15c]
mov r10w, dx
mov word [rsp + 0xf8], r10w
add r8d, 0xffffbbf7
mov r10w, r8w
mov word [rsp + 0x176], r10w
movsx edx, byte [rsp + 0x15d]
and al, 0x5d
add dword [rax], eax
add byte [rsi + 0x41], ah
mov edx, edx
mov edx, ecx
add edx, 0x4a2b4b79
mov dword [rsp + 0x184], edx
mov word [rsp + 0xfa], r10w
mov r12, rsi
xor r12, 0x2a19b920
movsx edx, byte [rsp + 0x15e]
mov r10w, dx
mov qword [rsp + 0x178], r12
mov edx, ecx
or edx, 0x2532bd67
mov dword [rsp + 0x184], edx
mov word [rsp + 0xfc], r10w
mov r12, rsi
or r12, 0x350c9bca
mov qword [rsp + 0x178], r12
mov al, byte [rsp + 0x15f]
pop rdi
add dword [rax], eax
add byte [rdi], cl
mov esi, 0x894166d0
shl byte [rsi + 0x44], cl
mov dword [rsp + 0xfe], edx
Function at 0x14003e570
Capabilities:
Access peb ldr_data

Disassembly:
mov edx, edx
mov byte [rsp + 0x175], al
mov word [rsp + 0xf4], 0
mov qword [rsp + 0xec], 0
mov qword [rsp + 0xe4], 0
mov qword [rsp + 0xdc], 0
mov word [rsp + 0x176], 0x1b28
mov word [rsp + 0x176], r10w
movsx edx, byte [rsp + 0x15b]
mov r10w, dx
mov word [rsp + 0x176], r11w
add dword [rax], eax
add byte [rsi + 0x44], ah
mov dword [rsp + 0xf6], edx
movsx edx, byte [rsp + 0x15c]
mov r10w, dx
mov word [rsp + 0xf8], r10w
add r8d, 0xffffbbf7
mov r10w, r8w
mov word [rsp + 0x176], r10w
movsx edx, byte [rsp + 0x15d]
and al, 0x5d
add dword [rax], eax
add byte [rsi + 0x41], ah
mov edx, edx
mov edx, ecx
add edx, 0x4a2b4b79
mov dword [rsp + 0x184], edx
mov word [rsp + 0xfa], r10w
mov r12, rsi
xor r12, 0x2a19b920
movsx edx, byte [rsp + 0x15e]
mov r10w, dx
mov qword [rsp + 0x178], r12
mov edx, ecx
or edx, 0x2532bd67
mov dword [rsp + 0x184], edx
mov word [rsp + 0xfc], r10w
mov r12, rsi
or r12, 0x350c9bca
mov qword [rsp + 0x178], r12
mov al, byte [rsp + 0x15f]
pop rdi
add dword [rax], eax
add byte [rdi], cl
mov esi, 0x894166d0
shl byte [rsi + 0x44], cl
mov dword [rsp + 0xfe], edx

Function at 0x14003e5dc
Capabilities:
Access peb ldr_data

Disassembly:
pop rdi
add dword [rax], eax
add byte [rdi], cl
mov esi, 0x894166d0
shl byte [rsi + 0x44], cl
mov dword [rsp + 0xfe], edx
mov byte [rsp + 0x175], 0x6b
mov edx, dword [rsp + 0x170]
xor edx, 0x2c0abd97
mov r12, qword gs:[edx]
mov esp, dword [rdx]

Function at 0x140040190
Capabilities:
Identify system language via api

Disassembly:
add byte [rax - 0x77], cl
stc
mov qword [rsp + 0x1c8], rdx
mov rdx, rbx
mov byte [rsp + 0x1c7], r10b
mov word [rsp + 0x1c4], r11w
mov qword [rsp + 0x1b8], r8
call r9
lea rcx, [rsp + 0x244]
lea rdx, [rsp + 0x20c]
mov r11w, word [rsp + 0x1c4]
or r11w, 0x72fd
mov word [rsp + 0x300], r11w
mov byte [rsp + 0x303], 0xfd
mov ebp, dword [rsp + 0x2fc]
add ebp, 0xa74feb13
mov dword [rsp + 0x304], 0x1880468
mov dword [rsp + 0x2cc], ebp
mov dword [rsp + 0x1b4], eax
mov qword [rsp + 0x1a8], rdx
mov qword [rsp + 0x1a0], rcx