joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18002b460
Capabilities:
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 8]
call fcn.18002bf50
and qword [rbx + 8], 0
mov ecx, 0x400
call fcn.18002b5c4
xor edx, edx
xor r8d, r8d
mov qword [rbx + 8], rax
mov ecx, edx
mov eax, 8
test cl, 1
je 0x18002b4a0
shr ecx, 1
xor ecx, 0xedb88320
jmp 0x18002b4a2
shr ecx, 1
dec eax
test eax, eax
jg 0x18002b491
mov rax, qword [rbx + 8]
inc edx
mov dword [r8 + rax], ecx
add r8, 4
cmp edx, 0x100
jl 0x18002b48a
add rsp, 0x20
pop rbx
ret

Function at 0x180031adb
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x180125780]
jne 0x18002c93a
rol rcx, 0x10
test cx, 0xffff
jne 0x18002c936
repz ret
ror rcx, 0x10
jmp 0x180031a34
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x180127280]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x180127378]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x180031ab9
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x180127280]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x180031adb
mov rax, qword [rsp + 0x88]
mov qword [0x180127378], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x180127318], rax
mov rax, qword [0x180127378]
mov qword [0x1801271f0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x180127300], rax
mov dword [0x1801271e0], 0xc0000409
mov dword [0x1801271e4], 1
mov rax, qword [0x180125780]
mov qword [rsp + 0x68], rax
mov rax, qword [0x180125788]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x180127278], eax
mov ecx, 1
call fcn.18003a9b4
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x180117718]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x180127278], 0
jne 0x180031b62
mov ecx, 1
call fcn.18003a9b4
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x18003ac08
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [0x180125780]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.18002f120
xor ebx, ebx
cmp qword [0x1801282a8], rbx
mov rdi, rax
jne 0x18003ad1b
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x18003adf2
lea rdx, str.MessageBoxW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18003adf2
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x1801282a8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x1801282b0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetUserObjectInformationW
mov rcx, rsi
mov qword [0x1801282b8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov r11, rax
mov qword [0x1801282c8], rax
test rax, rax
je 0x18003ad12
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x1801282c0], rax
jmp 0x18003ad22
mov rax, qword [0x1801282c0]
jmp 0x18003ad29
mov rax, qword [0x1801282c0]
mov r11, qword [0x1801282c8]
cmp rax, rdi
je 0x18003ad90
cmp r11, rdi
je 0x18003ad90
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rcx, qword [0x1801282c8]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov r12, rax
test rsi, rsi
je 0x18003ad90
test rax, rax
je 0x18003ad90
call rsi
test rax, rax
je 0x18003ad8a
lea rcx, [rsp + 0x30]
mov r9d, 0xc
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x18003ad8a
test byte [rsp + 0x40], 1
jne 0x18003ad90
bts ebp, 0x15
jmp 0x18003add0
mov rcx, qword [0x1801282b0]
cmp rcx, rdi
je 0x18003add0
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x18003add0
call rax
mov rbx, rax
test rax, rax
je 0x18003add0
mov rcx, qword [0x1801282b8]
cmp rcx, rdi
je 0x18003add0
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x18003add0
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x1801282a8]
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x18003adf2
mov r9d, ebp
mov r8, r14
mov rdx, r13
mov rcx, rbx
call rax
jmp 0x18003adf4
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.18002c920
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x2f2ae80
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x2f2ae8d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x2f2ae9d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x2f2ae85
lea eax, [rcx + 1]
jmp 0x2f2aeab
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x2f2aebe
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x2f2aea4
sub eax, 3
jb 0x2f2aede
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x2f2af2d
sar eax, 1
movsxd rbp, eax
jb 0x2f2af14
jmp 0x2f2aeec
add ebx, ebx
jne 0x2f2aeea
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x2f2af14
inc ecx
add ebx, ebx
jne 0x2f2aefa
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x2f2af14
call r11
adc ecx, ecx
add ebx, ebx
jne 0x2f2af0d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x2f2aefc
add ecx, 2
jmp 0x2f2af19
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.02f2ae42
jmp 0x2f2ae8d
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x2b04000]
mov eax, dword [rdi]
or eax, eax
je 0x2f2af89
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x2b2b000]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x2f2af39
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x2f2af83
mov qword [rbx], rax
add rbx, 8
jmp 0x2f2af59
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x2f2afcd
cmp al, 0xef
ja 0x2f2afb5
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x2f2af95
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0x2f2afa4
mov eax, dword [rdi]
add rdi, 4
jmp 0x2f2afa4
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x2f2b021
sub rsp, 0xffffffffffffff80
jmp 0x460980
Function at 0x140051700
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x58
mov rax, qword [0x1400a8020]
xor rax, rsp
mov qword [rsp + 0x40], rax
lea r8, [0x14008f664]
lea rcx, [rsp + 0x20]
call fcn.14003dd70
cmp qword [rsp + 0x38], 8
lea rcx, [rsp + 0x20]
cmovae rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov r8, qword [rsp + 0x38]
cmp r8, 8
jb 0x140051753
mov rdx, qword [rsp + 0x20]
inc r8
call fcn.140022b80
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400522f0
add rsp, 0x58
ret

Function at 0x1400524b4
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
sub rsp, 0x18
mov r8, rcx
mov eax, 0x5a4d
cmp word [0x140000000], ax
jne 0x140052545
movsxd rax, dword [0x14000003c]
lea rdx, [0x140000000]
lea rcx, [rax + rdx]
cmp dword [rcx], 0x4550
jne 0x140052545
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140052545
sub r8, rdx
movzx eax, word [rcx + 0x14]
lea rdx, [rcx + 0x18]
add rdx, rax
movzx eax, word [rcx + 6]
lea rcx, [rax + rax*4]
lea r9, [rdx + rcx*8]
mov qword [rsp], rdx
cmp rdx, r9
je 0x140052529
mov ecx, dword [rdx + 0xc]
cmp r8, rcx
jb 0x140052523
mov eax, dword [rdx + 8]
add eax, ecx
cmp r8, rax
jb 0x14005252b
add rdx, 0x28
jmp 0x140052508
xor edx, edx
test rdx, rdx
jne 0x140052534
xor al, al
jmp 0x14005254b
test dword [rdx + 0x24], 0x80000000
je 0x140052541
xor al, al
jmp 0x14005254b
mov al, 1
jmp 0x14005254b
xor al, al
jmp 0x14005254b
add rsp, 0x18
ret

Function at 0x140052919
Capabilities:
Encode data using xor

Disassembly:
push r13
push r9
push r14
mov r14d, 0x415f0
movabs r9, 0x14014f000
push rdi
mov r13d, 0x308a
mov edi, 0x151ca
imul r13, rdi
movabs rdi, 0x100002cc2
add r13, rdi
call 0x140052919
movabs r13, 0x1401053a6
mov r14d, 0xe1d0
movabs r9, 0x140293000
call 0x140052919
pop rdi
cmp r13, r9
jne 0x14005294c
mov edi, dword [r13]
xor edi, 0xe89c9545
mov dword [r9], edi
inc r13
inc r13
dec r14
dec r14
inc r13
inc r13
add r9, 4
dec r14
dec r14
cmp r14d, 0
jne 0x140052919
ret
mov r14d, 0x48d
push rdi
mov r13d, 0x8000000
movabs r9, 0x14014f000
mov edi, 3
imul r14d, edi
add r14d, 0x259
sub r9, r14
lea r14, [r9]
sub r14, r13
movabs r13, 0x1401149a6
push rdx
movabs rdi, 0x140115882
cmp r13, rdi
jge 0x140052a3b
mov edx, dword [r13 + 4]
xor edx, 0xe89c9545
cmp edx, 0
je 0x140052a3b
mov rdx, r13
push rbx
mov ebx, edx
sub ebx, r13d
test ebx, 3
je 0x1400529cf
mov ebx, dword [rdx + 6]
xor ebx, 0xe89c9545
shr ebx, 0x10
jmp 0x1400529d8
mov ebx, dword [rdx + 8]
xor ebx, 0xe89c9545
cmp bx, 0
je 0x140052a25
cmp edx, r13d
je 0x1400529eb
test ebx, 0xfff
je 0x140052a25
push rbx
shl ebx, 0x10
shr ebx, 0x1c
cmp ebx, 0xa
pop rbx
jne 0x140052a19
shl ebx, 0x14
shr ebx, 0x14
push rdi
mov edi, dword [r13]
add rbx, r9
xor edi, 0xe89c9545
add rbx, rdi
mov rdi, qword [rbx]
add rdi, r14
mov qword [rbx], rdi
pop rdi
add rdx, 2
jmp 0x1400529b1
pop rbx
mov edx, dword [r13 + 4]
xor edx, 0xe89c9545
add r13, rdx
add edx, 8
jmp 0x140052991
movabs r13, 0x1000066c1
invalid
invalid
invalid
Function at 0x140005590
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x1400055c3
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rcx, rax
mov qword [rsp + 0x30], rbx
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x140005609
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
add rcx, rbx
and edi, 0xf
jbe 0x140005604
nop
cmp rbx, rcx
jae 0x140005609
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
dec edi
jne 0x1400055f0
cmp rbx, rcx
jb 0x14000560d
xor eax, eax
jmp 0x140005619
xor eax, eax
cmp word [rbx], ax
cmove rbx, rax
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140006530
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
push rdi
push r14
push r15
sub rsp, 0x2a0
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x14025eb70]
xor rax, rsp
mov qword [rsp + 0x290], rax
mov r15, rdx
xor ebx, ebx
mov dword [rsp + 0x20], ebx
lea r14, [rcx + 0x20]
mov rax, qword [r14]
movzx eax, word [rax]
cmp ax, word [0x14021e450]
jne 0x140006582
mov eax, ebx
jmp 0x140006587
sbb eax, eax
or eax, 1
test eax, eax
jne 0x14000667e
mov word [rsp + 0x80], bx
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x82]
call fcn.140195510
lea rdx, [rsp + 0x80]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
call fcn.14000ab8c
mov rcx, rax
mov eax, ebx
test rcx, rcx
setne al
test eax, eax
jne 0x1400065de
mov ecx, 0x80004005
call fcn.140005bd0
int3
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x38], rax
lea rax, vtable.CUtlCommonPath.0
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x40], ebx
lea rcx, [rsp + 0x80]
or rsi, 0xffffffffffffffff
mov rax, rsi
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140006610
mov r8d, eax
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x38]
call fcn.140005950
nop
lea rdx, str.ICALauncher.xml
lea rcx, [rsp + 0x30]
call fcn.140006960
mov rdi, qword [rsp + 0x38]
test rdi, rdi
je 0x14000665a
mov rbx, rsi
nop
inc rbx
cmp word [rdi + rbx*2], 0
jne 0x140006650
mov r8d, ebx
mov rdx, rdi
mov rcx, r14
call fcn.140005950
nop
lea rdx, [rdi - 0x18]
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14000667e
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov rcx, qword [r14]
sub rcx, 0x18
call fcn.140005b00
add rax, 0x18
mov qword [r15], rax
mov rax, r15
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.140193150
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x14000b740
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
xor edi, edi
xor ebx, ebx
mov r14, r9
mov rsi, r8
mov rbp, rdx
mov r12, rcx
test r8, r8
je 0x14000b7b2
call fcn.14001d328
mov r8d, 0xf0
mov rdx, rsi
mov r15, qword [rax + 0x18]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x14000b7b2
mov rdx, rax
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbx, rax
test rax, rax
je 0x14000b7fb
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
mov esi, 1
test rdi, rdi
je 0x14000b7e0
mov r10, qword [r12]
mov r9, r14
mov r8, rdi
mov rdx, rbp
mov rcx, r12
call qword [r10 + 0x40]
mov esi, eax
test rbx, rbx
je 0x14000b7e0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rcx, qword [rbp + 0xc0]
test rcx, rcx
je 0x14000b7f9
mov r8, qword [rcx]
mov rdx, r14
call qword [r8 + 0x140]
mov eax, esi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x14000c288
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, r8
mov rdi, rdx
mov rsi, rcx
mov qword [rcx + 0xe0], rdx
test rdx, 0xffffffffffff0000
jne 0x14000c2c7
cmp dword [rcx + 0xd8], 0
jne 0x14000c2c7
movzx eax, dx
mov dword [rcx + 0xd8], eax
call fcn.14001d328
mov r8d, 5
mov rdx, rdi
mov rbx, qword [rax + 0x18]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rcx, rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r9, rbx
mov r8, rbp
mov rdx, rax
mov rcx, rsi
mov rdi, rax
call fcn.14000c624
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14000c324
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov r14, r8
mov rbx, rdx
mov r15, rcx
xor edi, edi
call fcn.14001d328
lea r8d, [rdi + 5]
mov rbp, qword [rax + 0x18]
mov rdx, rbx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rcx, rbp
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
test rax, rax
je 0x14000c380
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
mov r9, rbp
mov r8, r14
mov rdx, rdi
mov rcx, r15
call fcn.14000c3b8
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x14000cf00
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x40
mov rdi, r9
mov rsi, r8
mov r14, rdx
mov r15, rcx
and qword [rax - 0x10], 0
and qword [rax - 0x18], 0
xor ebx, ebx
mov eax, dword [0x140265b7c]
test eax, eax
je 0x14000cf52
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x140265b7c]
test eax, eax
jne 0x14000cf5b
call fcn.14000d050
test eax, eax
je 0x14000cf77
lea rdx, [rsp + 0x30]
mov rcx, qword [0x14025d4b8]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne ebx, ecx
test ebx, ebx
jne 0x14000cf7f
xor eax, eax
jmp 0x14000cfd7
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9, rdi
mov r8, rsi
mov rdx, r14
mov rcx, r15
call qword [sym.imp.USER32.dll_CreateDialogIndirectParamW]
mov rsi, rax
mov qword [rsp + 0x38], rax
xor ebx, ebx
test rax, rax
sete bl
test ebx, ebx
je 0x14000cfb9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x14000cfbb
xor edi, edi
mov rdx, qword [rsp + 0x30]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x14000cfd4
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
mov r14, qword [rsp + 0x68]
add rsp, 0x40
pop r15
ret

Function at 0x14000fafc
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
xor edi, edi
xor ebx, ebx
mov rsi, rdx
mov r14, rcx
test rdx, rdx
je 0x14000fb64
call fcn.14001d328
mov r8d, 0xf0
mov rdx, rsi
mov rbp, qword [rax + 0x18]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x14000fb64
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbx, rax
test rax, rax
je 0x14000fb86
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
mov rdx, rdi
mov rcx, r14
call fcn.1400346ac
mov esi, eax
test rdi, rdi
je 0x14000fb84
test rbx, rbx
je 0x14000fb84
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140011668
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, rcx
mov rcx, qword [rcx + 0x40]
mov rbx, r8
call fcn.14002326c
mov rdi, rax
test rax, rax
je 0x1400116e4
mov rcx, rax
call qword [sym.imp.USER32.dll_GetDlgCtrlID]
mov esi, eax
test rbx, rbx
je 0x1400116df
cmp dword [rbx], 0x40
jb 0x1400116df
mov rcx, qword [rbp + 0x40]
or dword [rbx + 4], 1
or qword [rbx + 0x30], 0xffffffffffffffff
mov qword [rbx + 8], rcx
xor r9d, r9d
xor r8d, r8d
mov edx, 0x87
mov rcx, rdi
mov qword [rbx + 0x10], rdi
call qword [sym.imp.USER32.dll_SendMessageW]
bt rax, 0xd
jb 0x1400116df
or dword [rbx + 4], 0x80000002
mov rax, rsi
jmp 0x1400116e8
or rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140015418
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x70
mov edi, r9d
mov rsi, r8
mov r14, rdx
mov r15d, ecx
and qword [rax - 0x10], 0
and qword [rax - 0x18], 0
xor ebx, ebx
mov eax, dword [0x140265b7c]
test eax, eax
je 0x14001546a
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x140265b7c]
test eax, eax
jne 0x140015473
call fcn.14000d050
test eax, eax
je 0x14001548f
lea rdx, [rsp + 0x60]
mov rcx, qword [0x14025d4b8]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne ebx, ecx
test ebx, ebx
jne 0x14001549a
xor eax, eax
jmp 0x140015548
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0xb8]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0xb0]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0xa8]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0xa0]
mov dword [rsp + 0x20], eax
mov r9d, edi
mov r8, rsi
mov rdx, r14
mov ecx, r15d
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov rsi, rax
mov qword [rsp + 0x68], rax
xor ebx, ebx
test rax, rax
sete bl
test ebx, ebx
je 0x14001552a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x14001552c
xor edi, edi
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x140015545
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rsi
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret