joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140009f10
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x40
xor eax, eax
xor edx, edx
xor r8d, r8d
xor r9d, r9d
mov dword [rsp + 0x28], edx
mov edx, 0x90020
mov qword [rsp + 0x20], r8
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
call qword [sym.imp.KERNEL32.DLL_GetFileSizeEx]
mov ebx, eax
test eax, eax
jne 0x140009f5c
call fcn.14003893c
lea rcx, str.Could_not_unmount_drive:__s
mov rdx, rax
call fcn.140038472
jmp 0x140009f61
mov ebx, 1
mov eax, ebx
add rsp, 0x40
pop rbx
ret

Function at 0x140009f69
Capabilities:
Get file attributes

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x68
mov word [rsp + 0x29], 0x3a3f
mov rbx, rcx
mov rsi, rdx
mov byte [rsp + 0x2b], 0
test rcx, rcx
je 0x140009f96
test rdx, rdx
je 0x140009f96
cmp byte [rcx], 0x3f
jne 0x140009fa3
mov ecx, 0x57
call qword [0x14011c730]
jmp 0x140009ff8
mov rdx, qword [str._GLOBALROOT]
mov r8d, 0xe
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_freopen]
test eax, eax
jne 0x14000a015
mov al, byte [rbx]
lea rdx, [rsp + 0x29]
lea r8, [rsi + 0xe]
mov ecx, 9
mov byte [rsp + 0x29], al
call qword [sym.imp.KERNEL32.DLL_GetCurrentProcessId]
movsx ecx, byte [rbx]
mov edi, eax
call qword [0x14011cc00]
mov rdx, rsi
mov r8d, eax
test edi, edi
jne 0x140009fff
lea rcx, str.Could_not_mount__s_as__c:
call fcn.140038472
xor eax, eax
jmp 0x14000a128
lea rcx, str._s_was_successfully_mounted_as__c:
call fcn.140038472
mov eax, 1
jmp 0x14000a128
mov r13, qword [0x14011c760]
mov rdx, rsi
mov rcx, rbx
call r13
test eax, eax
jne 0x14000a00b
mov r12, qword [sym.imp.KERNEL32.DLL_PeekNamedPipe]
call r12
cmp eax, 0x91
jne 0x140009ff8
lea rdi, [rsp + 0x2c]
mov rbp, qword [0x14011c5f8]
mov r8d, 0x34
mov rcx, rbx
mov rdx, rdi
call rbp
test eax, eax
jne 0x14000a071
call fcn.14003893c
mov rdx, rbx
lea rcx, str._s_is_already_mounted__but_volume_GUID_could_not_be_checked:__s
mov r8, rax
call fcn.140038472
jmp 0x14000a095
mov rdx, rdi
mov rcx, rsi
call fcn.1400797d0
test eax, eax
je 0x14000a00b
mov r9, rdi
mov r8, rsi
lea rcx, str._s_is_mounted__but_volume_GUID_doesnt_match:_r_n__expected__s__got__s
mov rdx, rbx
call fcn.140038472
lea rcx, str.Retrying_after_dismount...
call fcn.140038472
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
test eax, eax
jne 0x14000a0c5
call fcn.14003893c
mov rdx, rbx
lea rcx, str.Warning:_Could_not_delete_volume_mountpoint__s:__s
mov r8, rax
call fcn.140038472
mov rdx, rsi
mov rcx, rbx
call r13
test eax, eax
jne 0x14000a00b
call r12
cmp eax, 0x91
jne 0x140009ff8
mov r8d, 0x34
mov rdx, rdi
mov rcx, rbx
call rbp
test eax, eax
je 0x140009ff8
mov rdx, rdi
mov rcx, rsi
call fcn.1400797d0
test eax, eax
jne 0x140009ff8
movsx ecx, byte [rbx]
call qword [0x14011cc00]
mov rdx, rsi
lea rcx, str._s_was_remounted_as__c:__second_time_lucky__
mov r8d, eax
jmp 0x14000a006
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
Function at 0x14000a3ff
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x40
xor eax, eax
xor edx, edx
xor r8d, r8d
xor r9d, r9d
mov dword [rsp + 0x28], edx
mov edx, 0x70140
mov qword [rsp + 0x20], r8
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
call qword [sym.imp.KERNEL32.DLL_GetFileSizeEx]
mov ebx, eax
test eax, eax
jne 0x14000a449
call fcn.14003893c
lea rcx, str.Could_not_refresh_drive_layout:__s
mov rdx, rax
call fcn.140038472
mov eax, ebx
add rsp, 0x40
pop rbx
ret
Function at 0x14000b72e
Capabilities:
Get file size

Disassembly:
push rdi
push rbx
sub rsp, 0x68
xor eax, eax
mov rbx, rcx
lea rdi, [rsp + 0x4c]
mov ecx, 5
mov dword [rsp + 0x48], 2
rep stosd dword [rdi], eax
lea rcx, str.Initializing_disk...
call fcn.140038472
xor r8d, r8d
xor r9d, r9d
xor r10d, r10d
mov qword [rsp + 0x38], r8
mov rdi, qword [sym.imp.KERNEL32.DLL_GetFileSizeEx]
mov edx, 0x7c058
mov rcx, rbx
mov qword [rsp + 0x30], r8
lea r8, [rsp + 0x48]
mov dword [rsp + 0x28], r9d
mov r9d, 0x18
mov qword [rsp + 0x20], r10
call rdi
test eax, eax
jne 0x14000b7a7
call fcn.14003893c
lea rcx, str.Could_not_delete_drive_layout:__s
mov rdx, rax
jmp 0x14000b7ea
xor eax, eax
xor edx, edx
xor ecx, ecx
xor r9d, r9d
mov dword [rsp + 0x28], edx
xor r8d, r8d
mov edx, 0x70140
mov qword [rsp + 0x20], rcx
mov rcx, rbx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
call rdi
mov edx, eax
mov eax, 1
test edx, edx
jne 0x14000b7f1
call fcn.14003893c
lea rcx, str.Could_not_refresh_drive_layout:__s
mov rdx, rax
call fcn.140038472
xor eax, eax
add rsp, 0x68
pop rbx
pop rdi
ret
Function at 0x14000c1db
Capabilities:
Get file size

Disassembly:
push rdi
mov eax, 0x1050
push rsi
push rbx
call fcn.140077930
sub rsp, rax
xor edx, edx
xor eax, eax
mov r9d, 1
xor r8d, r8d
xor esi, esi
mov r10d, ecx
lea rdi, [rsp + 0x50]
mov ecx, 0x400
mov dword [rsp + 0x4c], edx
rep stosd dword [rdi], eax
xor edx, edx
mov ecx, r10d
call fcn.1400077b5
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14000c2f9
xor eax, eax
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x28], 0x1000
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x4c]
mov edx, 0x70050
mov rcx, rbx
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.DLL_GetFileSizeEx]
test eax, eax
jne 0x14000c266
xor esi, esi
jmp 0x14000c2e6
cmp dword [rsp + 0x4c], 0
je 0x14000c25f
cmp dword [rsp + 0x50], 1
jne 0x14000c25f
cmp dword [rsp + 0x54], 2
jne 0x14000c25f
lea rcx, [rsp + 0xa0]
lea rdx, [0x1400bf040]
call fcn.1400378e4
test eax, eax
je 0x14000c25f
lea rcx, [rsp + 0x130]
lea rdx, [0x1400bf000]
call fcn.1400378e4
test eax, eax
je 0x14000c25f
movabs rax, 0x4ffffffff
cmp qword [rsp + 0x120], rax
jle 0x14000c25f
mov rdx, qword [rsp + 0x118]
mov rcx, rbx
xor esi, esi
call fcn.140009b4b
lea rdx, [0x14008a466]
mov rcx, rax
call fcn.1400797d0
test eax, eax
sete sil
lea rax, [rbx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14000c2f9
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_CreateDirectorCreateEventACreateFileA]
mov eax, esi
add rsp, 0x1050
pop rbx
pop rsi
pop rdi
ret

Function at 0x14000c81d
Capabilities:
Set file attributes

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
cmp byte [rcx], 0
mov rdi, rcx
jne 0x14000c831
xor ebx, ebx
jmp 0x14000c88e
xor eax, eax
xor edx, edx
mov r8, rcx
mov rbp, qword [0x14011c6a0]
mov qword [rsp + 0x20], rdx
or r9d, 0xffffffff
xor edx, edx
mov ecx, 0xfde9
mov dword [rsp + 0x28], eax
call rbp
mov esi, eax
cmp eax, 1
jle 0x14000c82d
movsxd rcx, eax
mov edx, 2
call sub.msvcrt.dll_vfprintf
mov rbx, rax
test rax, rax
je 0x14000c82d
or r9d, 0xffffffff
xor edx, edx
mov dword [rsp + 0x28], esi
mov r8, rdi
mov qword [rsp + 0x20], rax
mov ecx, 0xfde9
call rbp
cmp eax, esi
je 0x14000c892
xor eax, eax
jmp 0x14000c900
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_SetFileAttributesW]
test rax, rax
jne 0x14000c900
mov rsi, qword [0x1400b5f50]
cmp word [rsi], 0x3f
jbe 0x14000c8bb
lea rcx, [0x14008c4a4]
call fcn.140038472
jmp 0x14000c88e
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [0x14011c648]
test rax, rax
je 0x14000c8e7
movzx edx, word [rsi]
lea ecx, [rdx + 1]
mov word [rsi], cx
mov rcx, qword [0x1400b5f40]
mov qword [rcx + rdx*8], rax
jmp 0x14000c900
call fcn.14003893c
mov rdx, rbx
lea rcx, [0x14008c4cd]
mov r8, rax
call fcn.140038472
jmp 0x14000c88e
mov rcx, rbx
mov qword [rsp + 0x38], rax
call fcn.1400796c8
mov rax, qword [rsp + 0x38]
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x14000cf4e
Capabilities:
Get file size

Disassembly:
sub rsp, 0x48
xor eax, eax
xor edx, edx
xor r8d, r8d
xor r9d, r9d
mov dword [rsp + 0x28], edx
mov edx, 0x9001c
mov qword [rsp + 0x20], r8
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
call qword [sym.imp.KERNEL32.DLL_GetFileSizeEx]
nop
add rsp, 0x48
ret
Function at 0x14001f455
Capabilities:
Set file attributes

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x40
xor eax, eax
xor edx, edx
mov rdi, qword [0x14011c6a0]
or r9d, 0xffffffff
lea r8, str.WinInet
mov ecx, 0xfde9
mov qword [rsp + 0x20], rdx
xor edx, edx
mov dword [rsp + 0x28], eax
call rdi
mov esi, eax
cmp eax, 1
jg 0x14001f48f
xor ebx, ebx
jmp 0x14001f4c5
movsxd rcx, eax
mov edx, 2
call sub.msvcrt.dll_vfprintf
mov rbx, rax
test rax, rax
je 0x14001f48b
or r9d, 0xffffffff
xor edx, edx
mov dword [rsp + 0x28], esi
mov ecx, 0xfde9
mov qword [rsp + 0x20], rax
lea r8, str.WinInet
call rdi
cmp esi, eax
je 0x14001f4c9
xor eax, eax
jmp 0x14001f537
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_SetFileAttributesW]
test rax, rax
jne 0x14001f537
mov rsi, qword [0x1400b5f50]
cmp word [rsi], 0x3f
jbe 0x14001f4f2
lea rcx, [0x140094ad0]
call fcn.140038472
jmp 0x14001f4c5
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [0x14011c648]
test rax, rax
je 0x14001f51e
movzx edx, word [rsi]
lea ecx, [rdx + 1]
mov word [rsi], cx
mov rcx, qword [0x1400b5f40]
mov qword [rcx + rdx*8], rax
jmp 0x14001f537
call fcn.14003893c
mov rdx, rbx
lea rcx, [0x140094af9]
mov r8, rax
call fcn.140038472
jmp 0x14001f4c5
mov rcx, rbx
mov qword [rsp + 0x38], rax
call fcn.1400796c8
mov rax, qword [rsp + 0x38]
add rsp, 0x40
pop rbx
pop rsi
pop rdi
ret
Function at 0x140026101
Capabilities:
Delete registry value
Get session user name
Reference public rsa key

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x168
lea rsi, [0x140084260]
mov r12, rcx
lea rdi, [rsp + 0x4c]
mov ecx, 0x45
mov rbp, r8
rep movsd dword [rdi], dword [rsi]
xor r8d, r8d
lea rcx, [rsp + 0x30]
mov ebx, edx
mov qword [rsp + 0x30], r8
xor edx, edx
mov r13d, r9d
mov r9d, 0x18
mov qword [rsp + 0x38], r8
xor r8d, r8d
mov dword [rsp + 0x20], 0xf0000008
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea rdx, [rsp + 0x60]
lea r8, [0x140097440]
mov ecx, eax
xor eax, eax
test ecx, ecx
jne 0x14002617e
call fcn.140024ffd
lea rcx, str.PKI:_Could_not_create_the_default_key_container:__s
mov rdx, rax
jmp 0x1400261d2
mov rcx, rax
neg rcx
mov cl, byte [r8 + rcx]
mov byte [rdx + rax], cl
inc rax
cmp rax, 0x100
jne 0x14002617e
xor ecx, ecx
lea rax, [rsp + 0x40]
xor r9d, r9d
mov r8d, 0x114
mov dword [rsp + 0x20], ecx
lea rdx, [rsp + 0x4c]
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x28], rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x1400261de
call fcn.140024ffd
lea rcx, str.PKI:_Could_not_import_public_key:__s
mov rdx, rax
call fcn.140038472
xor ebp, ebp
jmp 0x1400262a8
lea rax, [rsp + 0x38]
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov edx, 0x800c
call qword [sym.imp.ADVAPI32.dll_FreeSid]
test eax, eax
jne 0x140026213
call fcn.140024ffd
lea rcx, str.PKI:_Could_not_create_empty_hash:__s
mov rdx, rax
jmp 0x1400261d2
xor r9d, r9d
mov rcx, qword [rsp + 0x38]
mov r8d, ebx
mov rdx, r12
call qword [sym.imp.ADVAPI32.dll_InitializeSecuriOpenProcessToken]
test eax, eax
jne 0x14002623c
call fcn.140024ffd
lea rcx, str.PKI:_Could_not_hash_data:__s
mov rdx, rax
jmp 0x1400261d2
lea eax, [r13 - 1]
xor edx, edx
cdqe
cmp edx, eax
jge 0x140026262
mov cl, byte [rbp + rdx]
mov r8b, byte [rbp + rax]
mov byte [rbp + rdx], r8b
inc rdx
mov byte [rbp + rax], cl
dec rax
jmp 0x140026244
xor eax, eax
xor edx, edx
mov r9, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x20], rdx
mov r8d, r13d
mov rdx, rbp
mov dword [rsp + 0x28], eax
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov ebp, eax
test eax, eax
jne 0x1400262a8
xor eax, eax
mov ecx, ebx
mov rdi, r12
rep stosb byte [rdi], al
call fcn.140024ffd
lea rcx, str.Signature_validation_failed:__s
mov rdx, rax
call fcn.140038472
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1400262b8
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1400262ca
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov eax, ebp
add rsp, 0x168
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
Function at 0x140026640
Capabilities:
Set file attributes

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
cmp byte [rcx], 0
mov rdi, rcx
jne 0x140026654
xor ebx, ebx
jmp 0x1400266b1
xor eax, eax
xor edx, edx
mov r8, rcx
mov rbp, qword [0x14011c6a0]
mov qword [rsp + 0x20], rdx
or r9d, 0xffffffff
xor edx, edx
mov ecx, 0xfde9
mov dword [rsp + 0x28], eax
call rbp
mov esi, eax
cmp eax, 1
jle 0x140026650
movsxd rcx, eax
mov edx, 2
call sub.msvcrt.dll_vfprintf
mov rbx, rax
test rax, rax
je 0x140026650
or r9d, 0xffffffff
xor edx, edx
mov dword [rsp + 0x28], esi
mov r8, rdi
mov qword [rsp + 0x20], rax
mov ecx, 0xfde9
call rbp
cmp eax, esi
je 0x1400266b5
xor eax, eax
jmp 0x140026723
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_SetFileAttributesW]
test rax, rax
jne 0x140026723
mov rsi, qword [0x1400b5f50]
cmp word [rsi], 0x3f
jbe 0x1400266de
lea rcx, [0x1400974a0]
call fcn.140038472
jmp 0x1400266b1
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [0x14011c648]
test rax, rax
je 0x14002670a
movzx edx, word [rsi]
lea ecx, [rdx + 1]
mov word [rsi], cx
mov rcx, qword [0x1400b5f40]
mov qword [rcx + rdx*8], rax
jmp 0x140026723
call fcn.14003893c
mov rdx, rbx
lea rcx, [0x1400974c9]
mov r8, rax
call fcn.140038472
jmp 0x1400266b1
mov rcx, rbx
mov qword [rsp + 0x38], rax
call fcn.1400796c8
mov rax, qword [rsp + 0x38]
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x1400287c1
Capabilities:
Parse credit card information

Disassembly:
push rbp
push rdi
push rsi
push rbx
lea rax, [0x140112440]
xor r9d, r9d
xor edx, edx
mov r10d, 1
mov rbx, rax
mov r8, rcx
movsxd r11, edx
mov cl, byte [r8 + r11]
test cl, cl
je 0x140028990
cmp r9d, 0x1d
je 0x140028990
cmp cl, 0x3f
je 0x14002885b
jg 0x14002882b
cmp cl, 0x2b
je 0x140028853
jg 0x14002881a
cmp cl, 0x24
je 0x14002884b
cmp cl, 0x2a
jne 0x140028972
mov byte [rax], 5
jmp 0x140028978
cmp cl, 0x2e
jne 0x140028972
mov byte [rax], 1
jmp 0x140028978
cmp cl, 0x5c
je 0x140028863
cmp cl, 0x5e
je 0x140028843
cmp cl, 0x5b
je 0x1400288d0
jmp 0x140028972
mov byte [rax], 2
jmp 0x140028978
mov byte [rax], 3
jmp 0x140028978
mov byte [rax], 6
jmp 0x140028978
mov byte [rax], 4
jmp 0x140028978
lea r11, [r8 + r11 + 1]
mov cl, byte [r11]
test cl, cl
je 0x140028978
inc edx
cmp cl, 0x64
je 0x1400288a5
jg 0x140028893
cmp cl, 0x53
je 0x1400288bd
cmp cl, 0x57
je 0x1400288ad
cmp cl, 0x44
jne 0x1400288c5
mov byte [rax], 0xb
jmp 0x140028978
cmp cl, 0x73
je 0x1400288b5
cmp cl, 0x77
jne 0x1400288c5
mov byte [rax], 0xc
jmp 0x140028978
mov byte [rax], 0xa
jmp 0x140028978
mov byte [rax], 0xd
jmp 0x140028978
mov byte [rax], 0xe
jmp 0x140028978
mov byte [rax], 0xf
jmp 0x140028978
mov byte [rax], 7
mov cl, byte [r11]
jmp 0x140028975
cmp byte [r8 + r11 + 1], 0x5e
jne 0x1400288e7
mov byte [rax], 9
cmp byte [r8 + r11 + 2], 0
je 0x140028915
inc edx
jmp 0x1400288ea
mov byte [rax], 8
mov edi, edx
mov ecx, r10d
lea rbp, [0x140112400]
inc edx
movsxd rsi, edx
mov r11b, byte [r8 + rsi]
cmp r11b, 0x5d
je 0x14002894e
test r11b, r11b
je 0x14002894e
cmp r11b, 0x5c
jne 0x140028934
cmp ecx, 0x26
jle 0x14002891c
xor eax, eax
jmp 0x1400289a3
cmp byte [r8 + rsi + 1], 0
je 0x140028915
movsxd r11, ecx
lea edx, [rdi + 2]
inc ecx
mov byte [rbp + r11], 0x5c
jmp 0x140028939
cmp ecx, 0x27
jg 0x140028915
movsxd rsi, edx
movsxd r11, ecx
mov edi, edx
inc ecx
mov sil, byte [r8 + rsi]
mov byte [rbp + r11], sil
jmp 0x1400288f6
cmp ecx, 0x27
jg 0x140028915
lea r11, [0x140112400]
movsxd r10, r10d
movsxd rsi, ecx
add r10, r11
mov byte [r11 + rsi], 0
mov qword [rax + 8], r10
lea r10d, [rcx + 1]
jmp 0x140028978
mov byte [rax], 7
mov byte [rax + 8], cl
movsxd rcx, edx
add rax, 0x10
cmp byte [r8 + rcx], 0
je 0x140028915
inc edx
inc r9d
jmp 0x1400287dd
movsxd r9, r9d
lea rax, [0x140112440]
shl r9, 4
mov byte [rbx + r9], 0
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x140028ae9
Capabilities:
Get graphical window text

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rax, qword [0x1400b6bd0]
mov r12d, dword [rax]
mov esi, ecx
mov ebp, edx
mov rcx, qword [0x140114840]
mov edx, 0x3fd
call qword [sym.imp.USER32.dll_MessageBeep]
cmp dword [0x1401146d0], 3
mov rdi, rax
je 0x140028b28
xor esi, esi
jmp 0x140028be2
mov rbx, qword [0x1400b67d0]
cmp word [rbx + 0x554], 0
je 0x140028b21
cmp byte [rbx + 0x54d], 0
jle 0x140028b54
cmp byte [rbx + 0x54c], 0
je 0x140028b21
cmp byte [rbx + 0x550], 0
jne 0x140028b21
test byte [0x14008466e], 1
jne 0x140028b68
cmp dword [0x1401146c8], 0
je 0x140028ba1
jmp 0x140028be2
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [0x140114790]
mov edx, 0x147
mov r13, qword [0x14011d030]
call r13
xor r9d, r9d
mov rcx, qword [0x140114790]
mov edx, 0x150
movsxd r8, eax
call r13
cmp rax, 2
jne 0x140028b5d
jmp 0x140028b21
cmp word [rbx + 0x55c], 0
jne 0x140028bd5
cmp byte [rbx + 0x56b], 0
jne 0x140028bd5
mov ax, word [rbx + 0x552]
mov edx, eax
not edx
and dl, 7
je 0x140028bd5
mov edx, eax
not edx
test dl, 0x23
je 0x140028bd5
mov eax, edx
test ax, 0x1c0
jne 0x140028be2
cmp dword [0x140114734], 0
je 0x140028b21
test esi, esi
mov rcx, qword [0x140114840]
mov rax, qword [sym.imp.USER32.dll_CreateIconIndirectCreateWindowExW]
jne 0x140028bfb
xor r8d, r8d
test ebp, ebp
jne 0x140028c05
xor r8d, r8d
test r12d, r12d
setne r8b
mov edx, 0x3fd
call rax
mov edx, esi
mov rcx, rdi
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp qword [sym.imp.USER32.dll_GetWindowTextA]
Function at 0x140028c24
Capabilities:
Get graphical window text

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov ebx, ecx
mov edi, edx
mov rcx, qword [0x140114840]
mov edx, 0x3fc
call qword [sym.imp.USER32.dll_MessageBeep]
mov rsi, rax
mov eax, dword [0x1401146cc]
or eax, dword [0x1401146c8]
jne 0x140028d90
mov eax, dword [0x1401146d0]
test eax, eax
je 0x140028d90
cmp eax, 3
jne 0x140028ce6
mov rax, qword [0x1400b67d0]
mov edx, dword [rax + 0x55c]
or dx, word [rax + 0x576]
jne 0x140028cc3
mov dx, word [rax + 0x552]
mov ecx, edx
not ecx
and cl, 7
je 0x140028cc3
mov ecx, edx
not ecx
test cl, 0x23
je 0x140028cc3
test cx, 0x1c0
je 0x140028cc3
mov edx, 0xffff
shl rdx, 0x18
and rdx, qword [rax + 0x560]
jne 0x140028cc3
mov dl, byte [rax + 0x567]
or dl, byte [rax + 0x200]
je 0x140028d90
cmp byte [rax + 0x54d], 0
jle 0x140028ce6
cmp byte [rax + 0x54c], 0
je 0x140028d90
cmp byte [rax + 0x550], 0
jne 0x140028d90
test edi, edi
je 0x140028d7d
test ebx, ebx
jne 0x140028d3e
cmp dword [0x140115054], 1
je 0x140028d3a
mov rcx, qword [0x140114840]
mov edx, 0x3fc
call qword [0x14011cf60]
mov rcx, qword [0x140114840]
mov edx, 0x3fc
dec eax
sete al
xor r8d, r8d
movzx eax, al
mov dword [0x140115050], eax
call qword [sym.imp.USER32.dll_CreateIconIndirectCreateWindowExW]
mov dword [0x140115054], 1
xor ebx, ebx
jmp 0x140028d7d
mov rcx, rsi
call qword [0x14011cf70]
test eax, eax
jne 0x140028d7d
mov eax, dword [0x140115054]
cmp eax, 2
je 0x140028d7d
test eax, eax
je 0x140028d73
mov r8d, dword [0x140115050]
mov rcx, qword [0x140114840]
mov edx, 0x3fc
call qword [sym.imp.USER32.dll_CreateIconIndirectCreateWindowExW]
mov dword [0x140115054], 2
mov edx, ebx
mov rcx, rsi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp qword [sym.imp.USER32.dll_GetWindowTextA]
test edi, edi
je 0x140028d3a
jmp 0x140028cf2
Function at 0x140028d99
Capabilities:
Get graphical window text

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov ebx, ecx
mov edi, edx
mov rcx, qword [0x140114840]
mov edx, 0x3f0
call qword [sym.imp.USER32.dll_MessageBeep]
cmp dword [0x1401146d0], 3
mov rsi, rax
jne 0x140028de6
mov rax, qword [0x1400b67d0]
cmp byte [rax + 0x54d], 0
jle 0x140028de6
cmp byte [rax + 0x54c], 0
je 0x140028de4
cmp byte [rax + 0x550], 0
je 0x140028de6
xor ebx, ebx
mov eax, dword [0x1401146d4]
cmp eax, 1
jne 0x140028e11
mov rdx, qword [0x1400b5f80]
mov eax, 1
shl rax, 0x23
cmp qword [rdx], rax
jg 0x140028e16
cmp dword [0x140114728], 0
jne 0x140028e16
jmp 0x140028e30
cmp eax, 5
jne 0x140028e30
mov rcx, qword [0x140114840]
mov r8d, 1
mov edx, 0x3f0
call qword [sym.imp.USER32.dll_CreateIconIndirectCreateWindowExW]
jmp 0x140028e45
test edi, edi
je 0x140028ecc
test ebx, ebx
jne 0x140028e8d
cmp dword [0x14011504c], 1
jne 0x140028e4c
xor ebx, ebx
jmp 0x140028ecc
mov rcx, qword [0x140114840]
mov edx, 0x3f0
call qword [0x14011cf60]
mov rcx, qword [0x140114840]
mov edx, 0x3f0
dec eax
sete al
xor r8d, r8d
movzx eax, al
mov dword [0x140115048], eax
call qword [sym.imp.USER32.dll_CreateIconIndirectCreateWindowExW]
mov dword [0x14011504c], 1
jmp 0x140028e45
mov rcx, rsi
call qword [0x14011cf70]
test eax, eax
jne 0x140028ecc
mov eax, dword [0x14011504c]
cmp eax, 2
je 0x140028ecc
test eax, eax
je 0x140028ec2
mov r8d, dword [0x140115048]
mov rcx, qword [0x140114840]
mov edx, 0x3f0
call qword [sym.imp.USER32.dll_CreateIconIndirectCreateWindowExW]
mov dword [0x14011504c], 2
mov edx, ebx
mov rcx, rsi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp qword [sym.imp.USER32.dll_GetWindowTextA]

Function at 0x140028edf
Capabilities:
Get graphical window text

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov ebx, ecx
mov edi, edx
mov rcx, qword [0x140114840]
mov edx, 0x3f7
call qword [sym.imp.USER32.dll_MessageBeep]
mov rsi, rax
mov eax, dword [0x1401146d4]
sub eax, 6
cmp eax, 2
jbe 0x140028fee
cmp dword [0x1401146d0], 3
jne 0x140028f44
mov rax, qword [0x1400b67d0]
cmp byte [rax + 0x54d], 0
jle 0x140028f44
cmp byte [rax + 0x54c], 0
je 0x140028fee
cmp byte [rax + 0x550], 0
jne 0x140028fee
test edi, edi
je 0x140028fdb
test ebx, ebx
jne 0x140028f9c
cmp dword [0x140115044], 1
je 0x140028f98
mov rcx, qword [0x140114840]
mov edx, 0x3f7
call qword [0x14011cf60]
mov rcx, qword [0x140114840]
mov edx, 0x3f7
dec eax
sete al
xor r8d, r8d
movzx eax, al
mov dword [0x140115040], eax
call qword [sym.imp.USER32.dll_CreateIconIndirectCreateWindowExW]
mov dword [0x140115044], 1
xor ebx, ebx
jmp 0x140028fdb
mov rcx, rsi
call qword [0x14011cf70]
test eax, eax
jne 0x140028fdb
mov eax, dword [0x140115044]
cmp eax, 2
je 0x140028fdb
test eax, eax
je 0x140028fd1
mov r8d, dword [0x140115040]
mov rcx, qword [0x140114840]
mov edx, 0x3f7
call qword [sym.imp.USER32.dll_CreateIconIndirectCreateWindowExW]
mov dword [0x140115044], 2
mov edx, ebx
mov rcx, rsi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp qword [sym.imp.USER32.dll_GetWindowTextA]
test edi, edi
jne 0x140028f50
jmp 0x140028f98