joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401be910
Capabilities:
Extract resource via kernel32 functions
Identify system language via api

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
mov edi, dword [0x1406949a4]
xor edx, edx
mov r10d, ecx
mov r11d, edx
test edi, edi
je 0x1401be971
lea r8, [0x1406989b8]
nop dword [rax]
nop dword [rax + rax]
mov r9d, dword [r8]
mov ecx, edx
mov rbx, qword [r8 - 8]
mov rsi, qword [r8 + 8]
test r9d, r9d
je 0x1401be965
mov rax, rbx
cmp r10d, dword [rax]
je 0x1401be9a1
inc ecx
add rax, 0x10
cmp ecx, r9d
jb 0x1401be955
inc r11d
add r8, 0x18
cmp r11d, edi
jb 0x1401be940
lea rcx, [0x14067aa40]
mov rax, rcx
nop dword [rax + rax]
cmp r10d, dword [rax]
je 0x1401be9be
inc edx
add rax, 0x10
cmp edx, 0xbc
jb 0x1401be980
xor eax, eax
mov rbx, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
pop rdi
ret
mov edx, ecx
mov rcx, rsi
add rdx, rdx
mov rdx, qword [rbx + rdx*8 + 8]
mov rbx, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
pop rdi
jmp sym.ErrorReportClient.exe_wchar_t_const____ptr64___cdecl_SfGetStringSmart_struct_HSFLANG______ptr64__wchar_t_const____ptr64_
add rdx, rdx
mov rdx, qword [rcx + rdx*8 + 8]
mov rcx, qword [0x14068c270]
mov rbx, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
pop rdi
jmp sym.ErrorReportClient.exe_wchar_t_const____ptr64___cdecl_SfGetString_struct_HSFLANG______ptr64__wchar_t_const__const___ptr64_const____ptr64_

Function at 0x1401befe0
Capabilities:
Print debug messages

Disassembly:
mov rax, rdx
mov rdx, rcx
mov rcx, rax
jmp fcn.140197000
Function at 0x1401bf890
Capabilities:
Get graphical window text

Disassembly:
push rbx
push r14
push r15
sub rsp, 0x300
mov rax, qword [0x1406836b8]
xor rax, rsp
mov qword [rsp + 0x2e0], rax
movups xmm0, xmmword [r8]
mov rbx, rcx
mov qword [rsp + 0x78], 3
mov ecx, dword [rcx + 0x28]
xor eax, eax
mov dword [rsp + 0x74], eax
and ecx, 1
mov qword [rsp + 0x98], rax
add ecx, ecx
mov qword [rsp + 0xa0], rax
mov r15, r8
mov qword [rsp + 0xa8], rax
mov r14, rdx
mov eax, dword [rbx + 0x1c]
and eax, 1
mov dword [rsp + 0x70], 0xfffffff4
or ecx, eax
mov qword [rsp + 0x80], rdx
mov eax, dword [rbx + 0x2c]
mov dword [rsp + 0xb4], eax
mov eax, dword [rbx + 0x30]
mov dword [rsp + 0xb8], eax
mov eax, dword [rbx + 0x34]
mov dword [rsp + 0xcc], eax
mov eax, dword [rbx + 8]
mov dword [rsp + 0xb0], ecx
mov rcx, qword [rbx]
mov qword [rsp + 0x68], rax
movups xmmword [rsp + 0xbc], xmm0
mov qword [rsp + 0x60], rcx
movups xmmword [rsp + 0x88], xmm0
call qword [sym.imp.USER32.dll_GetParent]
xor r8d, r8d
lea r9, [rsp + 0x60]
mov rcx, rax
lea edx, [r8 + 0x4e]
call qword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 4
je 0x1401bfaa1
mov qword [rsp + 0x338], rbp
mov qword [rsp + 0x2f8], rsi
mov qword [rsp + 0x2f0], rdi
call sym.ErrorReportClient.exe_XPTheme_GetDefault
xor ebp, ebp
test rax, rax
je 0x1401bf9ab
call sym.ErrorReportClient.exe_XPTheme_GetDefault
cmp dword [rax], ebp
je 0x1401bf9ab
mov rax, qword [0x140699300]
cmp qword [rax + 0x40], rbp
je 0x1401bf9b2
lea ecx, [rbp + 1]
jmp 0x1401bf9b4
mov rax, qword [0x140699300]
mov ecx, ebp
cmp dword [rbx + 0x28], ebp
mov esi, ebp
mov rdi, qword [rbx + 0x10]
cmove esi, ecx
test rdi, rdi
je 0x1401bf9db
mov rdx, rdi
mov rcx, r14
call qword [sym.imp.GDI32.dll_SelectObject]
mov rdi, rax
mov rax, qword [0x140699300]
test esi, esi
je 0x1401bfa0a
mov rcx, qword [rax + 0x40]
xor r8d, r8d
lea edx, [r8 + 1]
call qword [rax + 0x108]
test eax, eax
je 0x1401bfa0a
mov rax, qword [0x140699300]
mov r8, r15
mov rcx, qword [rbx]
mov rdx, r14
call qword [rax + 0x200]
mov rcx, qword [rbx]
call qword [sym.imp.USER32.dll_IsWindowEnabled]
mov rcx, qword [rbx]
lea rdx, [rsp + 0xd0]
test eax, eax
mov r8d, 0x104
sete bpl
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov eax, dword [rbx + 0x28]
lea rdx, [rsp + 0x50]
movups xmm0, xmmword [r15]
mov r9d, dword [rbx + 0x2c]
mov rcx, r14
mov r8d, dword [rbx + 0x34]
mov dword [rsp + 0x48], eax
mov eax, dword [rbx + 0x1c]
mov dword [rsp + 0x40], esi
mov dword [rsp + 0x38], ebp
mov dword [rsp + 0x30], eax
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x28], rax
mov eax, dword [rbx + 0x30]
mov dword [rsp + 0x20], eax
movaps xmmword [rsp + 0x50], xmm0
call sym.ErrorReportClient.exe_SfDoneBar_Draw
mov rsi, qword [rsp + 0x2f8]
mov rbp, qword [rsp + 0x338]
test rdi, rdi
je 0x1401bfa99
mov rdx, rdi
mov rcx, r14
call qword [sym.imp.GDI32.dll_SelectObject]
mov rdi, qword [rsp + 0x2f0]
mov rcx, qword [rsp + 0x2e0]
xor rcx, rsp
call fcn.14039bbb0
add rsp, 0x300
pop r15
pop r14
pop rbx
ret

Function at 0x1401c0500
Capabilities:
Print debug messages

Disassembly:
mov rax, rdx
mov rdx, rcx
mov rcx, rax
jmp fcn.140197000
Function at 0x1401c1670
Capabilities:
Print debug messages

Disassembly:
mov rax, rdx
mov rdx, rcx
mov rcx, rax
jmp fcn.140197000
Function at 0x1401c67f0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x30
mov ebp, dword [rcx + 8]
mov rbx, rcx
mov r14d, dword [rcx + 0xc]
mov edi, r8d
mov r15d, dword [rcx + 0xa4]
mov esi, dword [rcx + 0xa8]
mov ecx, 0x11
mov r12d, edx
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x1401c6840
lea esi, [rsi + rsi*4]
add esi, esi
cmp r12d, 7
ja case.0x1401c685c.4
lea rdx, [0x140000000]
mov ecx, dword [rdx + r12*4 + 0x1c6960]
add rcx, rdx
jmp rcx
mov r9d, esi
lea rdx, [rbx + 0x14]
mov dword [rsp + 0x20], edi
mov r8, rdx
mov rcx, rbx
call fcn.1401c26c0
jmp case.0x1401c685c.4
lea rdx, [rbx + 0x14]
mov dword [rsp + 0x20], edi
mov r8, rdx
mov r9d, r15d
mov rcx, rbx
call fcn.1401c26c0
jmp case.0x1401c685c.4
neg esi
jmp case.0x1401c685c.2
neg r15d
mov r9d, r15d
jmp 0x1401c6861
mov edx, dword [rbx + 8]
cmp ebp, edx
jl 0x1401c68b0
cmp ebp, dword [rbx + 0xc]
mov edx, ebp
cmovg edx, dword [rbx + 0xc]
xor eax, eax
cmp dword [rbx + 0x1c], eax
jbe case.0x1401c685c.4
nop dword [rax + rax]
bt edi, eax
jae 0x1401c68c9
mov dword [rbx + rax*4 + 0x14], edx
inc eax
cmp eax, dword [rbx + 0x1c]
jb 0x1401c68c0
jmp case.0x1401c685c.4
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x1401c6915
test r14d, r14d
jle 0x1401c6915
test ebp, ebp
jns 0x1401c6915
mov edx, dword [rbx + 8]
xor eax, eax
test edx, edx
jg 0x1401c68fe
mov ecx, dword [rbx + 0xc]
mov edx, eax
test ecx, ecx
cmovs edx, ecx
cmp dword [rbx + 0x1c], eax
jbe case.0x1401c685c.4
bt edi, eax
jae 0x1401c690c
mov dword [rbx + rax*4 + 0x14], edx
inc eax
cmp eax, dword [rbx + 0x1c]
jb 0x1401c6903
jmp case.0x1401c685c.4
mov edx, dword [rbx + 8]
cmp r14d, edx
jl 0x1401c6928
cmp r14d, dword [rbx + 0xc]
mov edx, r14d
cmovg edx, dword [rbx + 0xc]
xor eax, eax
cmp dword [rbx + 0x1c], eax
jbe case.0x1401c685c.4
nop
bt edi, eax
jae 0x1401c6939
mov dword [rbx + rax*4 + 0x14], edx
inc eax
cmp eax, dword [rbx + 0x1c]
jb 0x1401c6930
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r12
ret
Function at 0x1401c9ee0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov edi, dword [rsp + 0x60]
mov r14d, r9d
mov esi, dword [rcx + 8]
mov ebx, r8d
mov ebp, dword [rcx + 0xc]
mov r15d, edx
test edi, edi
jne 0x1401c9f31
mov ecx, ebp
mov eax, 0x66666667
sub ecx, esi
add ecx, 5
imul ecx
mov edi, edx
sar edi, 2
mov eax, edi
shr eax, 0x1f
add edi, eax
mov eax, 1
cmove edi, eax
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x1401c9f46
lea edi, [rdi + rdi*4]
add edi, edi
cmp r15d, 7
ja case.0x1401c9f5e.4
lea rdx, [0x140000000]
mov ecx, dword [rdx + r15*4 + 0x1c9fbc]
add rcx, rdx
jmp rcx
add ebx, edi
jmp case.0x1401c9f5e.4
add ebx, r14d
jmp case.0x1401c9f5e.4
sub ebx, edi
jmp case.0x1401c9f5e.4
sub ebx, r14d
jmp case.0x1401c9f5e.4
mov ebx, esi
cmp ebx, ebp
cmovg ebx, ebp
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x1401c9fb0
test ebp, ebp
jle 0x1401c9fb0
test esi, esi
jns 0x1401c9fb0
xor ebx, ebx
jmp case.0x1401c9f5e.4
mov ebx, ebp
cmp ebx, esi
jge 0x1401c9f74
mov eax, esi
jmp 0x1401c9f7b
Function at 0x1401c9fe0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push r13
push r14
push r15
sub rsp, 0x40
mov r14d, r9d
mov r15, r8
mov r12d, edx
mov r13, rcx
xor edi, edi
mov esi, edi
mov dword [rsp + 0x30], edi
mov rbx, qword [0x140698d08]
mov qword [rsp + 0x38], rdi
cmp dword [0x14068c074], edi
jne 0x1401ca0cc
mov eax, dword [0x14068c070]
test eax, eax
jne 0x1401ca0cc
mov edx, dword [0x14068c07c]
test edx, edx
je 0x1401ca05b
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x14068c070]
mov edx, dword [0x14068c07c]
test eax, eax
jne 0x1401ca0cc
test edx, edx
jne 0x1401ca06c
call fcn.14018bc50
test eax, eax
je 0x1401ca082
lea rdx, [rsp + 0x38]
mov rcx, qword [section..data]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
test eax, eax
jne 0x1401ca0cc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
add eax, 0xffffff82
cmp eax, 1
jbe 0x1401ca0c2
cmp ecx, 0x78
je 0x1401ca0c2
cmp ecx, 1
je 0x1401ca0c2
cmp ecx, 0x32
je 0x1401ca0c2
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov r12, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r13
ret
mov dword [0x14068c070], 1
test rbx, rbx
jne 0x1401ca0ec
lea rcx, str.ImageList_Draw
call fcn.140199e30
mov rbx, rax
test rax, rax
je 0x1401ca116
mov qword [0x140698d08], rax
mov eax, dword [rsp + 0x88]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x80]
mov dword [rsp + 0x20], eax
mov r9d, r14d
mov r8, r15
mov edx, r12d
mov rcx, r13
call rbx
mov esi, eax
mov dword [rsp + 0x30], eax
cmp dword [0x14068c074], 0
je 0x1401ca128
cmp dword [0x14068c070], 0
jne 0x1401ca154
mov ebx, edi
test esi, esi
sete bl
test ebx, ebx
je 0x1401ca13b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rdx, qword [rsp + 0x38]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x1401ca154
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
jmp 0x1401ca0a3

Function at 0x1401ca170
Capabilities:
Print debug messages

Disassembly:
mov rax, rdx
mov rdx, rcx
mov rcx, rax
jmp fcn.140197000
Function at 0x1401cc620
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
xor edi, edi
mov esi, edi
mov dword [rsp + 0x20], edi
mov rbx, qword [0x140698db0]
mov qword [rsp + 0x48], rdi
cmp dword [0x14068c074], edi
jne 0x1401cc6f1
mov eax, dword [0x14068c070]
test eax, eax
jne 0x1401cc6f1
mov edx, dword [0x14068c07c]
test edx, edx
je 0x1401cc689
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x14068c070]
mov edx, dword [0x14068c07c]
test eax, eax
jne 0x1401cc6f1
test edx, edx
jne 0x1401cc69a
call fcn.14018bc50
test eax, eax
je 0x1401cc6b0
lea rdx, [rsp + 0x48]
mov rcx, qword [section..data]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
test eax, eax
jne 0x1401cc6f1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
add eax, 0xffffff82
cmp eax, 1
jbe 0x1401cc6e7
cmp ecx, 0x78
je 0x1401cc6e7
cmp ecx, 1
je 0x1401cc6e7
cmp ecx, 0x32
je 0x1401cc6e7
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
mov dword [0x14068c070], 1
test rbx, rbx
jne 0x1401cc711
lea rcx, str.ImageList_GetImageCount
call fcn.140199e30
mov rbx, rax
test rax, rax
je 0x1401cc71c
mov qword [0x140698db0], rax
mov rcx, r14
call rbx
mov esi, eax
mov dword [rsp + 0x20], eax
cmp dword [0x14068c074], 0
je 0x1401cc72e
cmp dword [0x14068c070], 0
jne 0x1401cc75a
mov ebx, edi
test esi, esi
sete bl
test ebx, ebx
je 0x1401cc741
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x1401cc75a
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
jmp 0x1401cc6d1

Function at 0x1401cc770
Capabilities:
Print debug messages

Disassembly:
mov rax, rdx
mov rdx, rcx
mov rcx, rax
jmp fcn.140197000

Function at 0x1401d3d60
Capabilities:
Print debug messages

Disassembly:
mov rax, rdx
mov rdx, rcx
mov rcx, rax
jmp fcn.140197000
Function at 0x1401d9c50
Capabilities:
Print debug messages

Disassembly:
mov rax, rdx
mov rdx, rcx
mov rcx, rax
jmp fcn.140197000
Function at 0x1401dda00
Capabilities:
Log keystrokes via polling

Disassembly:
mov r11, rsp
mov qword [r11 + 0x20], rbx
push rdi
sub rsp, 0x80
mov eax, dword [rcx + 4]
mov ebx, r9d
mov rdi, rcx
test al, 1
jne 0x1401ddc3d
bt eax, 0xe
jb 0x1401ddc3d
mov qword [r11 + 8], rbp
mov ecx, 0x10
mov qword [r11 + 0x10], rsi
mov qword [r11 + 0x18], r14
call qword [sym.imp.USER32.dll_GetKeyState]
xor r14d, r14d
mov ebp, 0x11
test ax, ax
mov ecx, ebp
sets r14b
call qword [sym.imp.USER32.dll_GetKeyState]
xor esi, esi
lea ecx, [rbp + 1]
test ax, ax
sets sil
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x1401ddb6e
movaps xmmword [rsp + 0x70], xmm6
movsd xmm6, qword [rdi + 0x180]
movaps xmmword [rsp + 0x60], xmm7
movaps xmm1, xmm6
movsd xmm7, qword [rdi + 0x188]
movaps xmm0, xmm7
movaps xmmword [rsp + 0x50], xmm8
movaps xmmword [rsp + 0x40], xmm9
call sub.api_ms_win_crt_math_l1_1_0.dll_atan2
mulsd xmm6, xmm6
movaps xmm9, xmm0
mulsd xmm7, xmm7
addsd xmm6, xmm7
movaps xmm0, xmm6
call sub.api_ms_win_crt_math_l1_1_0.dll_sqrt
movsd xmm6, qword [0x1404538b8]
movaps xmm8, xmm0
test r14d, r14d
je 0x1401ddad1
movaps xmm8, xmm6
test esi, esi
je 0x1401ddadf
movsd xmm1, qword [0x1404539c8]
jmp 0x1401ddae7
movsd xmm1, qword [0x1404539d8]
movd xmm0, ebx
cvtdq2pd xmm0, xmm0
mulsd xmm0, xmm1
divsd xmm0, qword [0x1404539f0]
addsd xmm9, xmm0
movaps xmm0, xmm9
call sub.api_ms_win_crt_math_l1_1_0.dll_cos
movsd xmm7, qword [0x140453a08]
movaps xmm1, xmm0
mulsd xmm1, xmm8
comisd xmm7, xmm1
jbe 0x1401ddb24
movaps xmm0, xmm7
jmp 0x1401ddb2b
movaps xmm0, xmm6
minsd xmm0, xmm1
movsd qword [rdi + 0x180], xmm0
movaps xmm0, xmm9
call sub.api_ms_win_crt_math_l1_1_0.dll_sin
movaps xmm9, xmmword [rsp + 0x40]
mulsd xmm0, xmm8
movaps xmm8, xmmword [rsp + 0x50]
comisd xmm7, xmm0
ja 0x1401ddb5a
minsd xmm6, xmm0
movaps xmm7, xmm6
movaps xmm6, xmmword [rsp + 0x70]
movsd qword [rdi + 0x188], xmm7
movaps xmm7, xmmword [rsp + 0x60]
jmp 0x1401ddbdb
test r14d, r14d
je 0x1401ddb9a
test ebx, ebx
jns 0x1401ddb87
test esi, esi
mov eax, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
cmovne ebp, eax
neg ebx
mov edx, ebp
jmp 0x1401ddbbb
test esi, esi
mov ebp, 0x10
mov eax, 0xa
cmovne ebp, eax
mov edx, ebp
jmp 0x1401ddbbb
test ebx, ebx
jns 0x1401ddbac
xor esi, 1
neg ebx
lea edx, [rsi*2 + 0xd]
jmp 0x1401ddbbb
test esi, esi
mov edx, 0xe
mov eax, VariantTimeToDosDateTime
cmovne edx, eax
movd xmm2, ebx
mov rcx, rdi
cvtdq2pd xmm2, xmm2
mulsd xmm2, qword [0x14067bcd8]
divsd xmm2, qword [0x1404539f0]
call fcn.1401dc4d0
mov ebx, 1
mov r8d, 0x2710
mov edx, ebx
mov rcx, rdi
call fcn.1401dbfe0
mov ecx, dword [rdi + 8]
lea rax, [rdi + 0xc]
mov r8, qword [rdi + 0x3c8]
mov r9d, 5
mov edx, dword [rdi + 0x48]
shl ebx, cl
mov rcx, rdi
dec ebx
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
call qword [rdi + 0x3d0]
mov r14, qword [rsp + 0xa0]
mov rsi, qword [rsp + 0x98]
mov rbp, qword [rsp + 0x90]
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x1401e0940
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r12
push r14
push r15
sub rsp, 0x30
mov r14, r8
mov r15, rdx
mov r12, rcx
mov ebx, 0xffffffff
mov dword [rsp + 0x20], ebx
mov rdi, qword [0x140698dd8]
xor esi, esi
mov qword [rsp + 0x68], rsi
cmp dword [0x14068c074], esi
jne 0x1401e09fe
mov eax, dword [0x14068c070]
test eax, eax
jne 0x1401e09fe
mov ecx, dword [0x14068c07c]
test ecx, ecx
je 0x1401e09ae
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x14068c070]
mov ecx, dword [0x14068c07c]
test eax, eax
jne 0x1401e09fe
test ecx, ecx
jne 0x1401e09bf
call fcn.14018bc50
test eax, eax
je 0x1401e09d5
lea rdx, [rsp + 0x68]
mov rcx, qword [section..data]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
test eax, eax
jne 0x1401e09fe
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
add eax, 0xffffff82
cmp eax, 1
jbe 0x1401e09f4
cmp ecx, 0x78
je 0x1401e09f4
cmp ecx, 1
je 0x1401e09f4
cmp ecx, 0x32
jne 0x1401e0a6f
mov dword [0x14068c070], 1
test rdi, rdi
jne 0x1401e0a1e
lea rcx, str.ImageList_Add
call fcn.140199e30
mov rdi, rax
test rax, rax
je 0x1401e0a2f
mov qword [0x140698dd8], rax
mov r8, r14
mov rdx, r15
mov rcx, r12
call rdi
mov ebx, eax
mov dword [rsp + 0x20], eax
cmp dword [0x14068c074], 0
je 0x1401e0a41
cmp dword [0x14068c070], 0
jne 0x1401e0a6f
mov edi, esi
cmp ebx, 0xffffffff
sete dil
test edi, edi
je 0x1401e0a56
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov rdx, qword [rsp + 0x68]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test edi, edi
je 0x1401e0a6f
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop r12
ret
Function at 0x1401e0a90
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push r13
push r14
push r15
sub rsp, 0x40
mov r14d, r9d
mov r15d, r8d
mov r12d, edx
mov r13d, ecx
xor edi, edi
mov esi, edi
mov qword [rsp + 0x38], rdi
mov rbx, qword [0x140698dc8]
mov qword [rsp + 0x30], rdi
cmp dword [0x14068c074], esi
jne 0x1401e0b7d
mov eax, dword [0x14068c070]
test eax, eax
jne 0x1401e0b7d
mov edx, dword [0x14068c07c]
test edx, edx
je 0x1401e0b0c
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x14068c070]
mov edx, dword [0x14068c07c]
test eax, eax
jne 0x1401e0b7d
test edx, edx
jne 0x1401e0b1d
call fcn.14018bc50
test eax, eax
je 0x1401e0b33
lea rdx, [rsp + 0x30]
mov rcx, qword [section..data]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
test eax, eax
jne 0x1401e0b7d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
add eax, 0xffffff82
cmp eax, 1
jbe 0x1401e0b73
cmp ecx, 0x78
je 0x1401e0b73
cmp ecx, 1
je 0x1401e0b73
cmp ecx, 0x32
je 0x1401e0b73
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov r12, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r13
ret
mov dword [0x14068c070], 1
test rbx, rbx
jne 0x1401e0b9d
lea rcx, str.ImageList_Create
call fcn.140199e30
mov rbx, rax
test rax, rax
je 0x1401e0bbe
mov qword [0x140698dc8], rax
mov eax, dword [rsp + 0x80]
mov dword [rsp + 0x20], eax
mov r9d, r14d
mov r8d, r15d
mov edx, r12d
mov ecx, r13d
call rbx
mov rsi, rax
mov qword [rsp + 0x38], rax
cmp dword [0x14068c074], 0
je 0x1401e0bd0
cmp dword [0x14068c070], 0
jne 0x1401e0bfd
mov ebx, edi
test rsi, rsi
sete bl
test ebx, ebx
je 0x1401e0be4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rdx, qword [rsp + 0x30]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x1401e0bfd
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rsi
jmp 0x1401e0b54
Function at 0x1401e0c10
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
xor edi, edi
mov esi, edi
mov dword [rsp + 0x20], edi
mov rbx, qword [0x140698dd0]
mov qword [rsp + 0x48], rdi
cmp dword [0x14068c074], edi
jne 0x1401e0ce1
mov eax, dword [0x14068c070]
test eax, eax
jne 0x1401e0ce1
mov edx, dword [0x14068c07c]
test edx, edx
je 0x1401e0c79
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x14068c070]
mov edx, dword [0x14068c07c]
test eax, eax
jne 0x1401e0ce1
test edx, edx
jne 0x1401e0c8a
call fcn.14018bc50
test eax, eax
je 0x1401e0ca0
lea rdx, [rsp + 0x48]
mov rcx, qword [section..data]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
test eax, eax
jne 0x1401e0ce1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
add eax, 0xffffff82
cmp eax, 1
jbe 0x1401e0cd7
cmp ecx, 0x78
je 0x1401e0cd7
cmp ecx, 1
je 0x1401e0cd7
cmp ecx, 0x32
je 0x1401e0cd7
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
mov dword [0x14068c070], 1
test rbx, rbx
jne 0x1401e0d01
lea rcx, str.ImageList_Destroy
call fcn.140199e30
mov rbx, rax
test rax, rax
je 0x1401e0d0c
mov qword [0x140698dd0], rax
mov rcx, r14
call rbx
mov esi, eax
mov dword [rsp + 0x20], eax
cmp dword [0x14068c074], 0
je 0x1401e0d1e
cmp dword [0x14068c070], 0
jne 0x1401e0d4a
mov ebx, edi
test esi, esi
sete bl
test ebx, ebx
je 0x1401e0d31
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x1401e0d4a
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
jmp 0x1401e0cc1
Function at 0x1401e0d60
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r12
push r14
push r15
sub rsp, 0x30
mov r14, r8
mov r15, rdx
mov r12, rcx
xor edi, edi
mov esi, edi
mov dword [rsp + 0x20], edi
mov rbx, qword [0x140698de0]
mov qword [rsp + 0x68], rdi
cmp dword [0x14068c074], edi
jne 0x1401e0e3f
mov eax, dword [0x14068c070]
test eax, eax
jne 0x1401e0e3f
mov edx, dword [0x14068c07c]
test edx, edx
je 0x1401e0dd3
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x14068c070]
mov edx, dword [0x14068c07c]
test eax, eax
jne 0x1401e0e3f
test edx, edx
jne 0x1401e0de4
call fcn.14018bc50
test eax, eax
je 0x1401e0dfa
lea rdx, [rsp + 0x68]
mov rcx, qword [section..data]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
test eax, eax
jne 0x1401e0e3f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
add eax, 0xffffff82
cmp eax, 1
jbe 0x1401e0e35
cmp ecx, 0x78
je 0x1401e0e35
cmp ecx, 1
je 0x1401e0e35
cmp ecx, 0x32
je 0x1401e0e35
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop r12
ret
mov dword [0x14068c070], 1
test rbx, rbx
jne 0x1401e0e5f
lea rcx, str.ImageList_GetIconSize
call fcn.140199e30
mov rbx, rax
test rax, rax
je 0x1401e0e70
mov qword [0x140698de0], rax
mov r8, r14
mov rdx, r15
mov rcx, r12
call rbx
mov esi, eax
mov dword [rsp + 0x20], eax
cmp dword [0x14068c074], 0
je 0x1401e0e82
cmp dword [0x14068c070], 0
jne 0x1401e0eae
mov ebx, edi
test esi, esi
sete bl
test ebx, ebx
je 0x1401e0e95
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rdx, qword [rsp + 0x68]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x1401e0eae
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
jmp 0x1401e0e1b