joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000dda0
Capabilities:
Log keystrokes

Disassembly:
push rdi
push r14
push r15
sub rsp, 0x30
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], rsi
mov r15, r9
mov r14, r8
mov ebp, edx
mov rsi, rcx
cmp edx, 0x501
jne 0x14000de3f
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x14000ddee
lea edx, [rax + 5]
mov rcx, rsi
call fcn.1400338d0
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, rax
call fcn.14002c388
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edi, eax
xor edx, edx
mov rcx, qword [rbx + 0x40]
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ecx, eax
mov r8d, 1
mov edx, edi
call qword [sym.imp.USER32.dll_AttachThreadInput]
mov edx, 9
mov rcx, rsi
call fcn.1400338d0
mov rcx, qword [rsi + 0x40]
call qword [sym.imp.USER32.dll_SetForegroundWindow]
jmp 0x14000df69
cmp ebp, 0x503
jne 0x14000de51
call fcn.14000e050
jmp 0x14000df69
cmp ebp, 0x502
jne 0x14000de6f
call fcn.14000dfa0
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x300]
jmp 0x14000df69
cmp ebp, 0x500
jne 0x14000de81
call fcn.14000e150
jmp 0x14000df69
cmp ebp, 0x504
jne 0x14000def5
call fcn.1400347dc
mov rcx, rax
test rax, rax
je 0x14000df91
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x20], rax
mov r8d, 0xea64
lea rcx, [rsp + 0x20]
call fcn.14000ef10
mov edx, 1
mov rcx, rsi
call fcn.140032c74
mov rcx, rax
mov rbx, qword [rsp + 0x20]
mov rdx, rbx
call fcn.140033864
nop
lea rdx, [rbx - 0x18]
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000df69
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x14000df69
cmp ebp, 0x505
jne 0x14000df4e
cmp r14d, 3
je 0x14000df64
cmp r14d, 1
jne 0x14000df34
cmp dword [0x1402c0338], 0
je 0x14000df34
cmp qword [0x1402c0128], 0
jne 0x14000df34
xor r9d, r9d
mov edx, 0x20210806
mov r8d, 0x3e8
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_SetTimer]
mov r9, r15
mov r8, r14
mov edx, 0x505
mov rcx, qword [rsi + 0x4b8]
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x14000df69
cmp ebp, 0x506
jne 0x14000df69
mov rax, qword [0x1402c0bb0]
mov byte [rax + 0x460], r14b
call fcn.14000e3d0
mov r9, r15
mov r8, r14
mov edx, ebp
mov rcx, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
jmp fcn.140030548
mov ecx, 0x80004005
call fcn.14000bb00
int3
Function at 0x14000dfa0
Capabilities:
Terminate thread

Disassembly:
push rdi
sub rsp, 0x20
mov qword [rsp + 0x30], rbx
call fcn.14000e050
mov r8d, dword [0x1402c0bcc]
xor edi, edi
test r8d, r8d
je 0x14000dfed
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rbx, rax
test rax, rax
je 0x14000dfe7
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x1402c0bcc], edi
cmp dword [0x1402c2448], edi
je 0x14000e023
mov rbx, qword [0x1402c2450]
mov rcx, qword [0x1402c2440]
mov qword [0x1402c2450], rdi
mov dword [0x1402c2448], edi
call qword [sym.imp.WS2_32.dll_closesocket]
mov qword [0x1402c2450], rbx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x1402c0968]
mov rbx, qword [rsp + 0x30]
mov dword [0x1402c0b78], edi
test rcx, rcx
je 0x14000e03f
call fcn.140029704
mov qword [0x1402c0968], rdi
add rsp, 0x20
pop rdi
ret
Function at 0x14000e150
Capabilities:
Create thread

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov rbx, rcx
call fcn.1400347dc
mov rcx, rax
test rax, rax
je 0x14000e355
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x60], rax
call fcn.1400347dc
mov rcx, rax
test rax, rax
je 0x14000e360
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x58], rax
mov r8d, 0xea64
lea rcx, [rsp + 0x60]
call fcn.14000ef10
mov edi, 1
mov edx, edi
mov rcx, rbx
call fcn.140032c74
mov rcx, rax
lea rdx, [rsp + 0x58]
call fcn.14002cb0c
mov rax, qword [rsp + 0x58]
cmp dword [rax - 8], edi
jle 0x14000e1ef
mov edx, dword [rax - 0x10]
lea rcx, [rsp + 0x58]
call fcn.14000b5a0
mov rax, qword [rsp + 0x58]
test rax, rax
je 0x14000e34a
mov rcx, qword [rsp + 0x60]
sub rax, rcx
movzx edx, word [rcx]
cmp dx, word [rcx + rax]
jne 0x14000e216
add rcx, 2
test dx, dx
jne 0x14000e200
xor eax, eax
jmp 0x14000e21a
sbb eax, eax
or eax, edi
test eax, eax
jne 0x14000e2e1
lea rcx, [rbx + 0x478]
call fcn.140022320
mov rax, qword [0x1402c0bb0]
test rax, rax
je 0x14000e241
mov byte [rax + 0x461], dil
mov r8d, 0xead4
lea rcx, [rsp + 0x60]
call fcn.14000ef10
mov edx, edi
mov rcx, rbx
call fcn.140032c74
mov rcx, rax
mov rdx, qword [rsp + 0x60]
call fcn.140033864
mov rax, qword [0x1402c0bb0]
test rax, rax
je 0x14000e27b
mov byte [rax + 0x460], dil
mov dword [0x1402c0bc8], 0
lea rax, [0x1402c0bc8]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
mov r9, rbx
lea r8, [0x1400085e0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, qword [rbx + 0x40]
call qword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x14000e2ff
mov edx, 2
mov rcx, rbx
call fcn.1400338d0
mov r9d, 4
xor r8d, r8d
lea edx, [r9 + 0x14]
mov rcx, qword [rbx + 0x40]
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x14000e2ff
mov rax, qword [0x1402c0bb0]
sub dil, byte [rax + 0x460]
mov byte [rax + 0x460], dil
mov rcx, rbx
call fcn.14000e3d0
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov ebx, 0xffffffff
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000e323
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], ebx
sub ebx, 1
jg 0x14000e33f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
mov ecx, 0x80004005
call fcn.14000bb00
nop
mov ecx, 0x80004005
call fcn.14000bb00
nop
mov ecx, 0x80004005
call fcn.14000bb00
int3
Function at 0x14000ef10
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
movzx r9d, word [0x1402ae570]
mov eax, r8d
shr eax, 4
mov edi, r8d
inc ax
mov r14, rcx
movzx r8d, ax
mov edx, 6
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
mov rsi, rax
test rax, rax
je 0x14000f022
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x14000f022
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x14000f022
mov rdx, rsi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
add rcx, rbx
and edi, 0xf
jbe 0x14000efb0
cmp rbx, rcx
jae 0x14000f022
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
add edi, 0xffffffff
jne 0x14000ef97
cmp rbx, rcx
jae 0x14000f022
movzx edi, word [rbx]
test di, di
je 0x14000f022
mov r10, qword [r14]
mov ecx, 1
movzx edx, di
mov eax, dword [r10 - 0xc]
sub ecx, dword [r10 - 8]
sub eax, edi
or ecx, eax
jge 0x14000efe6
mov edx, edi
mov rcx, r14
call fcn.14000b6b0
mov r10, qword [r14]
movzx edx, word [rbx]
movzx r9d, dx
lea r8, [rbx + 2]
mov rdx, rdi
mov rcx, r10
call fcn.1401d22f0
xor edx, edx
test eax, eax
je 0x14000f009
cmp eax, 0xc
je 0x14000f040
cmp eax, 0x50
jne 0x14000f03a
mov rcx, qword [r14]
cmp edi, dword [rcx - 0xc]
jg 0x14000f046
mov dword [rcx - 0x10], edi
mov eax, 1
mov rcx, qword [r14]
mov word [rcx + rdi*2], dx
jmp 0x14000f024
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
call fcn.1400355ac
int3
call fcn.1400355d0
int3
mov ecx, 0x80070057
call fcn.14000bb00
int3
Function at 0x140015300
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x1d0]
sub rsp, 0x2d0
mov rax, qword [0x1402aa8c0]
xor rax, rsp
mov qword [rbp + 0x1c0], rax
mov rsi, rcx
mov ebx, r8d
add rcx, 0x460
mov rdi, rdx
call fcn.1400188a0
lea rcx, [rsi + 0xc98]
mov rdx, rdi
call fcn.1400133f0
lea rcx, [rsi + 0x1018]
mov rdx, rdi
call fcn.14001be50
lea rcx, [rsi + 0x14d0]
mov rdx, rdi
call fcn.14001dd50
test ebx, ebx
je 0x14001553a
mov r8, rdi
lea rdx, str._sMain.dat
lea rcx, [rbp - 0x50]
call fcn.14000a640
lea rdx, [0x140261acc]
lea rcx, [rbp - 0x50]
call fcn.1401d1788
mov rbx, rax
test rax, rax
je 0x14001553a
xorps xmm0, xmm0
lea rcx, [rsp + 0x30]
xor eax, eax
mov r9, rbx
movups xmmword [rsp + 0x30], xmm0
mov qword [rbp - 0x60], rax
movups xmmword [rsp + 0x40], xmm0
lea edx, [rax + 0x78]
lea r8d, [rax + 1]
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rbp - 0x80], xmm0
movups xmmword [rbp - 0x70], xmm0
call fcn.1401d1c20
mov rcx, rbx
call fcn.1401d192c
movzx eax, byte [rsp + 0x30]
xorps xmm0, xmm0
mov r8d, dword [rsp + 0x38]
xor r9d, r9d
mov dword [rsi + 0x19e0], eax
movzx eax, word [rsp + 0x32]
mov dword [rsi + 0x1bb8], eax
movzx eax, byte [rsp + 0x34]
mov dword [rsi + 0x19e4], eax
movzx eax, byte [rsp + 0x35]
mov dword [rsi + 0x1bbc], eax
movzx eax, byte [rsp + 0x36]
mov dword [rsi + 0x130], eax
movzx eax, byte [rsp + 0x37]
mov dword [rsi + 0x134], eax
mov eax, 0x51eb851f
imul r8d
movsd qword [rsp + 0x20], xmm0
mov dword [rsp + 0x28], 0
mov r10d, edx
sar r10d, 5
mov eax, r10d
shr eax, 0x1f
add r10d, eax
imul eax, r10d, 0x64
sub r8d, eax
mov eax, 0x88888889
imul r8d
add edx, r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x3c
sub r8d, eax
mov eax, 0x2aaaaaab
imul r10d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea ecx, [rdx + rdx*2]
shl ecx, 3
sub r10d, ecx
lea rcx, [rsp + 0x20]
mov edx, r10d
call fcn.1400165c0
lea rcx, [rsi + 0x148]
lea rdx, [rsp + 0x20]
call fcn.140046020
mov r8d, dword [rsp + 0x3c]
mov eax, 0x51eb851f
imul r8d
mov eax, 0x88888889
mov r10d, edx
sar r10d, 5
mov ecx, r10d
shr ecx, 0x1f
add r10d, ecx
imul ecx, r10d, 0x64
sub r8d, ecx
imul r8d
add edx, r8d
sar edx, 5
mov ecx, edx
mov eax, 0x2aaaaaab
shr ecx, 0x1f
xor r9d, r9d
add edx, ecx
imul ecx, edx, 0x3c
imul r10d
sub r8d, ecx
lea rcx, [rsp + 0x20]
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 3
sub r10d, eax
mov edx, r10d
call fcn.1400165c0
lea rcx, [rsi + 0x230]
lea rdx, [rsp + 0x20]
call fcn.140046020
mov eax, dword [rsp + 0x40]
mov dword [rsi + 0x138], eax
mov rcx, qword [rbp + 0x1c0]
xor rcx, rsp
call fcn.1401c8d10
mov rbx, qword [rsp + 0x300]
add rsp, 0x2d0
pop rdi
pop rsi
pop rbp
ret
Function at 0x140015560
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rdi
push r14
lea rbp, [rsp - 0x1f0]
sub rsp, 0x2f0
mov rax, qword [0x1402aa8c0]
xor rax, rsp
mov qword [rbp + 0x1e0], rax
mov rdi, rcx
mov rbx, rdx
add rcx, 0x460
call fcn.1400190f0
lea rcx, [rdi + 0xc98]
mov rdx, rbx
call fcn.140013aa0
lea rcx, [rdi + 0x1018]
mov rdx, rbx
call fcn.14001c2a0
lea rcx, [rdi + 0x14d0]
mov rdx, rbx
call fcn.14001e220
mov r8, rbx
lea rdx, str._sMain.dat
lea rcx, [rbp - 0x30]
call fcn.14000a640
lea rdx, [0x140261b0c]
lea rcx, [rbp - 0x30]
call fcn.1401d1788
mov r14, rax
test rax, rax
je 0x14001579b
movzx ecx, byte [rdi + 0x19e0]
lea rdx, [rsp + 0x20]
xorps xmm0, xmm0
mov qword [rsp + 0x320], rsi
xor eax, eax
movsd qword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rbp - 0x40], rax
movzx eax, word [rdi + 0x1bb8]
mov word [rsp + 0x52], ax
movzx eax, byte [rdi + 0x19e4]
mov byte [rsp + 0x54], al
movzx eax, byte [rdi + 0x1bbc]
mov byte [rsp + 0x55], al
movzx eax, byte [rdi + 0x130]
mov byte [rsp + 0x56], al
movzx eax, byte [rdi + 0x134]
mov byte [rsp + 0x50], cl
lea rcx, [rdi + 0x148]
mov byte [rsp + 0x57], al
movups xmmword [rsp + 0x60], xmm0
mov dword [rsp + 0x28], 0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rbp - 0x80], xmm0
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm0
call fcn.140045f8c
cmp dword [rsp + 0x28], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov ebx, 0xffffffff
jne 0x1400156b8
movsd xmm0, qword [rsp + 0x20]
lea rdx, [rsp + 0x30]
call qword [sym.imp.OLEAUT32.dll_UnRegisterTypeLib]
movzx esi, word [rsp + 0x38]
cmp eax, 1
je 0x1400156ba
mov esi, ebx
cmp dword [rsp + 0x28], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
jne 0x1400156e4
movsd xmm0, qword [rsp + 0x20]
lea rdx, [rsp + 0x40]
call qword [sym.imp.OLEAUT32.dll_UnRegisterTypeLib]
movzx ecx, word [rsp + 0x4a]
cmp eax, 1
je 0x1400156e6
mov ecx, ebx
imul eax, esi, 0x64
lea rdx, [rsp + 0x20]
add eax, ecx
lea rcx, [rdi + 0x230]
mov dword [rsp + 0x58], eax
mov dword [rdi + 0x13c], eax
call fcn.140045f8c
cmp dword [rsp + 0x28], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
jne 0x140015730
movsd xmm0, qword [rsp + 0x20]
lea rdx, [rsp + 0x40]
call qword [sym.imp.OLEAUT32.dll_UnRegisterTypeLib]
movzx esi, word [rsp + 0x48]
cmp eax, 1
je 0x140015732
mov esi, ebx
cmp dword [rsp + 0x28], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
jne 0x14001575c
movsd xmm0, qword [rsp + 0x20]
lea rdx, [rsp + 0x30]
call qword [sym.imp.OLEAUT32.dll_UnRegisterTypeLib]
cmp eax, 1
jne 0x14001575c
movzx ebx, word [rsp + 0x3a]
imul eax, esi, 0x64
lea rcx, [rsp + 0x50]
mov edx, 0x78
mov r9, r14
add eax, ebx
lea r8d, [rdx - 0x77]
mov dword [rsp + 0x5c], eax
mov dword [rdi + 0x140], eax
mov eax, dword [rdi + 0x138]
mov dword [rsp + 0x60], eax
call fcn.1401d3fc8
mov rcx, r14
call fcn.1401d192c
mov rsi, qword [rsp + 0x320]
mov rcx, qword [rbp + 0x1e0]
xor rcx, rsp
call fcn.1401c8d10
mov rbx, qword [rsp + 0x328]
add rsp, 0x2f0
pop r14
pop rdi
pop rbp
ret
Function at 0x14002c2e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
xor edi, edi
xor ebx, ebx
mov rsi, rdx
mov r14, rcx
test rdx, rdx
je 0x14002c348
call fcn.140042f8c
mov r8d, 0xf0
mov rdx, rsi
mov rbp, qword [rax + 0x18]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x14002c348
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbx, rax
test rax, rax
je 0x14002c36a
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
mov rdx, rdi
mov rcx, r14
call fcn.14003d5fc
mov esi, eax
test rdi, rdi
je 0x14002c368
test rbx, rbx
je 0x14002c368
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x14002d160
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rsi, rdx
mov rbx, rcx
test rcx, rcx
je 0x14002d238
mov rcx, qword [rcx + 0x40]
test rcx, rcx
je 0x14002d238
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x14002d238
test rsi, rsi
je 0x14002d238
xor r15d, r15d
xor ebp, ebp
xor edi, edi
call fcn.140042f8c
lea r8, [0x1401fc530]
mov rdx, rsi
mov r14, qword [rax + 0x18]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rsi, rax
test rax, rax
je 0x14002d205
mov rdx, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rdx, rsi
mov rcx, r14
mov r15d, eax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rdi, rax
test rax, rax
je 0x14002d238
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbp, rax
mov r8d, r15d
mov rdx, rbp
mov rcx, rbx
call fcn.140048c20
mov esi, eax
test rbp, rbp
je 0x14002d228
test rdi, rdi
je 0x14002d228
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeResource]
test esi, esi
je 0x14002d234
mov rcx, rbx
call fcn.14002ce20
mov eax, esi
jmp 0x14002d23a
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x14002e1ac
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, rcx
mov rbx, r8
mov rcx, qword [rcx + 0x40]
call fcn.14004a878
mov rdi, rax
test rax, rax
je 0x14002e228
mov rcx, rax
call qword [sym.imp.USER32.dll_GetDlgCtrlID]
mov esi, eax
test rbx, rbx
je 0x14002e223
cmp dword [rbx], 0x40
jb 0x14002e223
mov rcx, qword [rbp + 0x40]
xor r9d, r9d
or dword [rbx + 4], 1
xor r8d, r8d
or qword [rbx + 0x30], 0xffffffffffffffff
mov edx, 0x87
mov qword [rbx + 8], rcx
mov rcx, rdi
mov qword [rbx + 0x10], rdi
call qword [sym.imp.USER32.dll_SendMessageW]
bt rax, 0xd
jb 0x14002e223
or dword [rbx + 4], 0x80000002
mov rax, rsi
jmp 0x14002e22c
or rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140033188
Capabilities:
Get graphical window text

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x30
mov qword [rax - 0x18], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
movsxd rsi, r8d
mov rbx, rdx
mov rdi, rcx
xor ebp, ebp
cmp qword [rcx + 0xd0], rbp
jne 0x1400331ca
mov r8d, esi
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x14003326e
call fcn.1400347dc
mov rcx, rax
test rax, rax
je 0x140033289
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x14005e6be.0]
add rax, 0x18
mov qword [rsp + 0x40], rax
mov rcx, qword [rdi + 0xd0]
mov rax, qword [rcx]
lea rdx, [rsp + 0x40]
mov rax, qword [rax + 0x118]
call qword [case.0x14005e6be.0]
mov rdx, rsi
or rdi, 0xffffffffffffffff
mov r9, rdi
mov r8, qword [rsp + 0x40]
mov rcx, rbx
call fcn.1401d4634
test eax, eax
je 0x140033232
cmp eax, 0xc
je 0x140033283
cmp eax, 0x50
jne 0x140033294
test rbx, rbx
jne 0x14003323b
mov ebx, ebp
jmp 0x140033246
mov rcx, rbx
call fcn.1401d4330
mov rbx, rax
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov ecx, edi
lock xadd dword [rdx + 0x10], ecx
add ecx, edi
test ecx, ecx
jg 0x14003326c
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14005e6be.0]
mov eax, ebx
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
invalid
invalid

Function at 0x140033ebc
Capabilities:
Get graphical window text

Disassembly:
sub rsp, 0x78
test rdx, rdx
je 0x140033f24
mov r10, qword [rcx + 0x10]
test r10, r10
je 0x140033f0e
cmp qword [rcx + 0x18], 0
jne 0x140033f09
mov eax, dword [rcx + 0xc]
cmp eax, dword [rcx + 0x30]
jae 0x140033f2a
mov qword [rsp + 0x58], rdx
lea r9, [rsp + 0x20]
mov dword [rsp + 0x20], 0x50
mov edx, eax
mov dword [rsp + 0x24], 0x40
mov r8d, 1
mov rcx, qword [r10 + 8]
call qword [sym.imp.USER32.dll_SetMenuItemInfoW]
add rsp, 0x78
ret
mov rcx, qword [rcx + 0x20]
test rcx, rcx
je 0x140033f24
mov rcx, qword [rcx + 0x40]
add rsp, 0x78
jmp fcn.14004a518
call fcn.1400355ac
int3
call fcn.1400355ac
int3
Function at 0x140039d38
Capabilities:
Extract resource via kernel32 functions

Disassembly:
movzx edx, dx
jmp method.CDialogEx.virtual_720
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov qword [rcx + 0xf0], rdx
mov rbp, r8
mov rdi, rdx
mov rsi, rcx
cmp rdx, 0x10000
jae 0x140039d77
cmp dword [rcx + 0xe8], 0
jne 0x140039d77
movzx eax, di
mov dword [rcx + 0xe8], eax
call fcn.140042f8c
mov r8d, 5
mov rdx, rdi
mov rbx, qword [rax + 0x18]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r9, rbx
mov r8, rbp
mov rdx, rax
mov rcx, rsi
mov rdi, rax
call fcn.14003a0fc
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rbp, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140039dd4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov r14, r8
mov rbx, rdx
mov r15, rcx
xor edi, edi
call fcn.140042f8c
lea r8d, [rdi + 5]
mov rdx, rbx
mov rbp, qword [rax + 0x18]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
test rax, rax
je 0x140039e30
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
mov r9, rbp
mov r8, r14
mov rdx, rdi
mov rcx, r15
call fcn.140039e68
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rbp, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x14003e120
Capabilities:
Check os version

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x160
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x1402aa8c0]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rdi, rdx
mov rbx, rcx
mov qword [rsp + 0x28], rcx
call fcn.1400430d0
nop
lea rax, vtable.CWinApp.0
mov qword [rbx], rax
xor esi, esi
test rdi, rdi
je 0x14003e17a
mov rcx, rdi
call fcn.1401daebc
jmp 0x14003e17d
mov rax, rsi
mov qword [rbx + 0xa0], rax
call fcn.140042f8c
mov rdi, rax
test rax, rax
je 0x14003e2fe
lea rcx, [rax + 0xc0]
lea rdx, [0x14003e8a4]
call fcn.140047498
mov ecx, esi
test rax, rax
setne cl
test rax, rax
je 0x14003e2fe
test ecx, ecx
je 0x14003e2fe
mov qword [rax + 8], rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rbx + 0x58], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rbx + 0x60], eax
mov qword [rdi + 8], rbx
mov qword [rbx + 0x88], rsi
mov qword [rbx + 0x100], rsi
mov qword [rbx + 0xd0], rsi
mov qword [rbx + 0xd8], rsi
mov qword [rbx + 0xb0], rsi
mov qword [rbx + 0xc8], rsi
mov qword [rbx + 0xa8], rsi
mov qword [rbx + 0x118], rsi
mov qword [rbx + 0xb8], rsi
mov qword [rbx + 0x130], rsi
mov qword [rbx + 0x90], rsi
mov qword [rbx + 0x128], rsi
mov qword [rbx + 0x120], rsi
mov dword [rbx + 0x108], esi
mov qword [rbx + 0x110], rsi
mov qword [rbx + 0xe8], rsi
mov qword [rbx + 0xf0], rsi
mov qword [rbx + 0x140], rsi
mov dword [rbx + 0xc0], esi
mov dword [rbx + 0xe0], esi
mov qword [rbx + 0x138], 0x200
mov dword [rbx + 0x14c], esi
mov dword [rbx + 0x150], 0x493e0
mov edi, 1
mov dword [rbx + 0x154], edi
mov dword [rsp + 0x30], 0x114
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rsp + 0x34], 6
jne 0x14003e2b0
cmp dword [rsp + 0x38], edi
jae 0x14003e2b4
cmp dword [rsp + 0x34], 6
mov eax, esi
jbe 0x14003e2b6
mov eax, edi
mov dword [rbx + 0x158], eax
mov dword [rbx + 0x15c], esi
mov qword [rbx + 0x168], rsi
mov qword [rbx + 0x170], rsi
mov dword [rbx + 0x160], edi
mov rax, rbx
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1401c8d10
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call fcn.1400355ac
nop