joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140007910
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r9, qword [sym.MZ_FX9.0KBJcFVDV_EY_ep8z24o_q_wE8Jbc_Q__xo]
xor edx, edx
cmp word [r9], 0x5a4d
mov r8, rcx
jne 0x14000797f
mov rcx, r9
call fcn.1400077e0
test eax, eax
je 0x14000797f
movsxd rax, dword [r9 + 0x3c]
mov rcx, r8
sub rcx, r9
add r9, rax
movzx eax, word [r9 + 0x14]
lea rdx, [r9 + rax + 0x18]
movzx eax, word [r9 + 6]
test eax, eax
je 0x14000797d
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [rdx + rax*8 + 0x28]
mov r8d, dword [rdx + 0xc]
cmp rcx, r8
mov rax, r8
jb 0x140007974
add eax, dword [rdx + 8]
cmp rcx, rax
jb 0x14000797f
add rdx, 0x28
cmp rdx, r9
jne 0x140007960
xor edx, edx
mov rax, rdx
add rsp, 0x28
ret

Function at 0x140007d00
Capabilities:
Allocate thread local storage

Disassembly:
sub rsp, 0x28
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov dword [0x1403bb1e0], 0xffffffff
mov r8d, 0xffff
call qword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
mov qword [0x1403bb1e8], rax
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x140007d50
lea rdx, [0x140007c10]
mov ecx, eax
mov dword [0x1403bb1d8], eax
call fcn.14000d0c0
test eax, eax
jne 0x140007d58
add rsp, 0x28
ret
call qword [0x1403bc26c]
jmp 0x140007d47
call sub.msvcrt.dll_abort
nop
nop
Function at 0x140007d60
Capabilities:
Get thread local storage value

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rsi, qword [0x1403b7da0]
mov r11d, dword [rsi]
mov rbx, rcx
test r11d, r11d
jne 0x140007d98
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x140007e00
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov r12, qword [rcx + 0x10]
test r12, r12
je 0x140007e10
mov esi, dword [0x1403bb1d8]
mov r13, qword [0x1403bc26c]
call r13
mov edi, eax
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, edi
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_SetLastError]
test rsi, rsi
je 0x140007e80
mov rbp, qword [rsi]
cmp rbp, r12
jb 0x140007ec8
sub r12, 1
mov rax, qword [rsi + r12*8 + 8]
test rax, rax
jne 0x140007d87
mov rcx, rbx
call fcn.140007c60
mov qword [rsi + r12*8 + 8], rax
jmp 0x140007d87
call fcn.140007c60
mov qword [rbx + 0x10], rax
jmp 0x140007d87
mov r10d, dword [rsi]
test r10d, r10d
je 0x140007f2a
mov r9d, dword [0x1403b69b0]
test r9d, r9d
je 0x140007f58
lock add dword [0x1403bb1e0], 1
jne 0x140007f8c
mov r12, qword [rbx + 0x10]
test r12, r12
je 0x140007f37
mov eax, dword [rsi]
test eax, eax
je 0x140007da1
lock sub dword [0x1403bb1e0], 1
js 0x140007da1
mov rcx, qword [0x1403bb1e8]
xor r8d, r8d
mov edx, 1
call qword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
jmp 0x140007da1
lea rcx, [r12 + 0x21]
mov edx, 8
call fcn.14000cf40
lea rdi, [r12 + 0x20]
test rax, rax
mov rsi, rax
je 0x140007fb3
mov qword [rax], rdi
mov ecx, dword [0x1403bb1d8]
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x140007ddb
call r13
jmp 0x140007ddb
lea rdi, [rbp + rbp]
mov rcx, rsi
lea rax, [r12 + 0x20]
cmp rdi, r12
cmovb rdi, rax
lea rdx, [rdi*8 + 8]
call fcn.14000cf98
test rax, rax
mov rsi, rax
je 0x140007fb3
mov qword [rax], rdi
lea rcx, [rax + rbp*8 + 8]
sub rdi, rbp
xor edx, edx
lea r8, [rdi*8]
call sub.msvcrt.dll_memset
jmp 0x140007ea3
call fcn.140007d00
mov dword [0x1403b69b0], 1
mov edx, dword [rsi]
test edx, edx
jne 0x140007e2c
mov r12, qword [rbx + 0x10]
test r12, r12
jne 0x140007da1
mov rax, qword [0x1403bb1d0]
lea r12, [rax + 1]
mov qword [0x1403bb1d0], r12
mov qword [rbx + 0x10], r12
jmp 0x140007e47
lock add dword [0x1403b69b4], 1
je 0x140007f11
mov r8d, dword [0x1403b69b0]
lea rdi, [0x1403b69b0]
mov rbp, qword [0x1403bc2bc]
test r8d, r8d
jne 0x140007f20
nop dword [rax]
xor ecx, ecx
call rbp
mov ecx, dword [rdi]
test ecx, ecx
je 0x140007f80
jmp 0x140007f20
mov rcx, qword [0x1403bb1e8]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x140007e3a
lock sub dword [0x1403bb1e0], 1
jmp 0x140007e3a
call sub.msvcrt.dll_abort
nop
nop dword [rax]
cmp qword [rcx], rdx
jae 0x140007fd0
mov qword [rcx], rdx
mov qword [rcx + 0x18], 0
cmp qword [rcx + 8], r8
jae 0x140007fda
mov qword [rcx + 8], r8
test r9, r9
je 0x140007fe4
cmp qword [rcx], rdx
je 0x140007fe8
ret
mov qword [rcx + 0x18], r9
ret
Function at 0x14000cff8
Capabilities:
Set thread local storage value

Disassembly:
nop
and eax, 0xda7853
cmp dl, byte [rax + 0x76e325ff]
fiadd dword [rax]
mov byte [rax + 0x76d325ff], dl
fiadd dword [rax]
rcl byte [rax - 0x3dda0070], cl
jbe 0x14000cfef
jmp qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp qword [sym.imp.KERNEL32.dll_VirtualQuery]
nop
jmp qword [sym.imp.KERNEL32.dll_VirtualProtect]
add byte [rax + 0x76b325ff], dl
fiadd dword [rax]
xchg dword [rax - 0x5dda0070], edx
jbe 0x14000cfff
add byte [rax - 0x6dda0070], dl
jbe 0x14000d007
add byte [rax - 0x7dda0070], dl
jbe 0x14000d00f
add byte [rax + 0x7e25ff90], dl
cmp al, byte [rax]
nop
nop
jmp qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]

Function at 0x1403c7540
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x50
mov r12, r9
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
test r8, r8
jne 0x1403c756d
xor al, al
jmp 0x1403c76cf
mov rax, qword [0x1403e76c0]
lea rcx, [rsp]
xor r11d, r11d
mov qword [rcx], rax
mov rax, qword [0x1403e76c8]
mov qword [rsp + 0x60], rbp
mov qword [rcx + 8], rax
mov rax, qword [0x1403e76d0]
mov rdx, r11
mov qword [rcx + 0x10], rax
mov rax, qword [0x1403e76d8]
mov qword [rcx + 0x18], rax
mov rax, qword [0x1403e76e0]
mov qword [rcx + 0x20], rax
mov rax, qword [0x1403e76e8]
mov qword [rcx + 0x28], rax
mov rax, qword [0x1403e76f0]
mov qword [rcx + 0x30], rax
mov rax, qword [0x1403e76f8]
mov qword [rcx + 0x38], rax
movzx eax, byte [0x1403e7700]
mov byte [rcx + 0x40], al
mov rax, qword [r9]
mov rcx, r8
lea rbp, [r8 + rax]
test rbx, rbx
je 0x1403c76c1
add r8, 4
nop word [rax + rax]
movzx r9d, byte [rdx + rdi]
inc rdx
shl r9d, 0x10
cmp rdx, rbx
jne 0x1403c7619
mov r11d, 2
jmp 0x1403c763d
movzx eax, byte [rdx + rdi]
inc rdx
shl eax, 8
or r9d, eax
cmp rdx, rbx
jne 0x1403c7633
mov r11d, 1
jmp 0x1403c763d
movzx eax, byte [rdx + rdi]
or r9d, eax
inc rdx
mov r10d, r9d
and r9d, 0x3f
cmp r8, rbp
ja 0x1403c76e5
mov rax, r10
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx], al
mov rax, r10
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx + 1], al
cmp r11, 1
jbe 0x1403c7682
mov byte [rcx + 2], 0x3d
add rcx, 3
add r8, 3
jmp 0x1403c769a
shr r10, 6
add rcx, 3
and r10d, 0x3f
add r8, 3
movzx eax, byte [rsp + r10]
mov byte [rcx - 1], al
test r11, r11
je 0x1403c76aa
mov byte [rcx], 0x3d
inc rcx
inc r8
jmp 0x1403c76b8
movzx eax, byte [rsp + r9]
inc rcx
inc r8
mov byte [rcx - 1], al
cmp rdx, rbx
jb 0x1403c7600
sub rcx, rsi
mov al, 1
mov qword [r12], rcx
mov rbp, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r12
ret
xor al, al
jmp 0x1403c76ca
Function at 0x141388268
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1413883ef
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x141388299
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14138827f
add dl, dl
jne 0x1413882a6
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x141388306
xor eax, eax
add dl, dl
jne 0x1413882b5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1413883bd
add dl, dl
jne 0x1413882c6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1413882d3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1413882e0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1413882ed
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1413882fa
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14138828e
mov eax, 1
add dl, dl
jne 0x141388316
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141388323
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14138830b
sub eax, ebx
mov ebx, 1
jne 0x14138835c
mov ecx, 1
add dl, dl
jne 0x14138833e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14138834b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141388333
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14138828e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x141388378
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x141388385
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14138836d
cmp eax, 0x7d00
jae 0x1413883ab
cmp eax, 0x500
jb 0x1413883a6
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14138828e
cmp eax, 0x7f
ja 0x1413883ae
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14138828e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1413883e2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14138828e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0xc54cf0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0xc54cfd
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0xc54d0d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0xc54cf5
lea eax, [rcx + 1]
jmp 0xc54d1b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0xc54d2e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0xc54d14
sub eax, 3
jb 0xc54d4e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0xc54d9d
sar eax, 1
movsxd rbp, eax
jb 0xc54d84
jmp 0xc54d5c
add ebx, ebx
jne 0xc54d5a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0xc54d84
inc ecx
add ebx, ebx
jne 0xc54d6a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0xc54d84
call r11
adc ecx, ecx
add ebx, ebx
jne 0xc54d7d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0xc54d6c
add ecx, 2
jmp 0xc54d89
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.00c54cb2
jmp 0xc54cfd
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x360400
mov dl, 0x27
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0xc54de9
cmp rsi, rcx
jae 0xc54df1
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0xc54dd0
cmp al, 0x8f
ja 0xc54dd0
cmp byte [rsi - 2], 0xf
je 0xc54dd6
sub al, 0xe8
cmp al, 1
ja 0xc54dba
cmp rsi, rcx
jae 0xc54df1
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0xc54dc0
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0xc54df1
lodsb al, byte [rsi]
jmp 0xc54dd0
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x849000]
mov eax, dword [rdi]
or eax, eax
je 0xc54e4e
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x854000]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0xc54dfe
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0xc54e48
mov qword [rbx], rax
add rbx, 8
jmp 0xc54e1e
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0xc54e92
cmp al, 0xef
ja 0xc54e7a
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0xc54e5a
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0xc54e69
mov eax, dword [rdi]
add rdi, 4
jmp 0xc54e69
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0xc54ee6
sub rsp, 0xffffffffffffff80
jmp 0x467020
Function at 0x14000e368
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
xor edi, edi
xor ebx, ebx
mov rsi, rdx
mov r14, rcx
test rdx, rdx
je 0x14000e3d0
call fcn.14000b694
mov r8d, 0xf0
mov rdx, rsi
mov rbp, qword [rax + 0x18]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x14000e3d0
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbx, rax
test rax, rax
je 0x14000e3f2
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
mov rdx, rdi
mov rcx, r14
call fcn.1400306f4
mov esi, eax
test rdi, rdi
je 0x14000e3f0
test rbx, rbx
je 0x14000e3f0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x14000f2d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rsi, rdx
mov rbx, rcx
test rcx, rcx
je 0x14000f3a8
mov rcx, qword [rcx + 0x40]
test rcx, rcx
je 0x14000f3a8
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x14000f3a8
test rsi, rsi
je 0x14000f3a8
xor r15d, r15d
xor ebp, ebp
xor edi, edi
call fcn.14000b694
lea r8, str.AFX_DIALOG_LAYOUT
mov rdx, rsi
mov r14, qword [rax + 0x18]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rsi, rax
test rax, rax
je 0x14000f375
mov rdx, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rdx, rsi
mov rcx, r14
mov r15d, eax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rdi, rax
test rax, rax
je 0x14000f3a8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbp, rax
mov r8d, r15d
mov rdx, rbp
mov rcx, rbx
call fcn.1400314f8
mov esi, eax
test rbp, rbp
je 0x14000f398
test rdi, rdi
je 0x14000f398
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeResource]
test esi, esi
je 0x14000f3a4
mov rcx, rbx
call fcn.14000ef38
mov eax, esi
jmp 0x14000f3aa
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x140010538
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, rcx
mov rbx, r8
mov rcx, qword [rcx + 0x40]
call fcn.140028a90
mov rdi, rax
test rax, rax
je 0x1400105b4
mov rcx, rax
call qword [sym.imp.USER32.dll_GetDlgCtrlID]
mov esi, eax
test rbx, rbx
je 0x1400105af
cmp dword [rbx], 0x40
jb 0x1400105af
mov rcx, qword [rbp + 0x40]
xor r9d, r9d
or dword [rbx + 4], 1
xor r8d, r8d
or qword [rbx + 0x30], 0xffffffffffffffff
mov edx, 0x87
mov qword [rbx + 8], rcx
mov rcx, rdi
mov qword [rbx + 0x10], rdi
call qword [sym.imp.USER32.dll_SendMessageW]
bt rax, 0xd
jb 0x1400105af
or dword [rbx + 4], 0x80000002
mov rax, rsi
jmp 0x1400105b8
or rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140014fa4
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x70
mov edi, r9d
mov rsi, r8
mov r14, rdx
mov r15d, ecx
and qword [rax - 0x10], 0
and qword [rax - 0x18], 0
xor ebx, ebx
mov eax, dword [0x140361f6c]
test eax, eax
je 0x140014ff6
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x140361f6c]
test eax, eax
jne 0x140014fff
call fcn.14001552c
test eax, eax
je 0x14001501b
lea rdx, [rsp + 0x60]
mov rcx, qword [0x14027a4b0]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne ebx, ecx
test ebx, ebx
jne 0x140015026
xor eax, eax
jmp 0x1400150d4
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0xb8]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0xb0]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0xa8]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0xa0]
mov dword [rsp + 0x20], eax
mov r9d, edi
mov r8, rsi
mov rdx, r14
mov ecx, r15d
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov rsi, rax
mov qword [rsp + 0x68], rax
xor ebx, ebx
test rsi, rsi
sete bl
test ebx, ebx
je 0x1400150b6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x1400150b8
xor edi, edi
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x1400150d1
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rsi
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret
Function at 0x1400150f0
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push r14
sub rsp, 0x30
mov rdi, r8
mov rsi, rdx
mov r14, rcx
and dword [rax - 0x18], 0
and qword [rax + 0x20], 0
xor ebx, ebx
mov eax, dword [0x140361f6c]
test eax, eax
je 0x14001513a
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x140361f6c]
test eax, eax
jne 0x140015143
call fcn.14001552c
test eax, eax
je 0x14001515f
lea rdx, [rsp + 0x58]
mov rcx, qword [0x14027a4b0]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne ebx, ecx
test ebx, ebx
jne 0x140015167
xor eax, eax
jmp 0x1400151ae
mov r8, rdi
mov rdx, rsi
mov rcx, r14
call qword [sym.imp.USER32.dll_GetClassInfoExW]
mov edi, eax
mov dword [rsp + 0x20], eax
xor ebx, ebx
test edi, edi
sete bl
test ebx, ebx
je 0x140015191
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x140015193
xor esi, esi
mov rdx, qword [rsp + 0x58]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x1400151ac
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r14
ret

Function at 0x1400151c4
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
xor edi, edi
mov dword [rax - 0x18], edi
mov rbx, qword [0x140365348]
and qword [rax + 0x10], rdi
xor esi, esi
mov eax, dword [0x140361f6c]
test eax, eax
je 0x14001520f
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x140361f6c]
test eax, eax
jne 0x140015218
call fcn.14001552c
test eax, eax
je 0x140015234
lea rdx, [rsp + 0x48]
mov rcx, qword [0x14027a4b0]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne 0x14001523c
xor eax, eax
jmp 0x1400152a1
test rbx, rbx
jne 0x14001525c
lea rcx, str.InitCommonControlsEx
call fcn.140014f10
mov rbx, rax
test rax, rax
je 0x14001526f
mov qword [0x140365348], rax
mov rcx, rbx
call fcn.1401ad7ac
mov rcx, r14
call rbx
mov edi, eax
mov dword [rsp + 0x20], eax
xor ebx, ebx
test edi, edi
sete bl
test ebx, ebx
je 0x140015284
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x140015286
xor esi, esi
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x14001529f
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x140015454
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov rdi, rcx
xor r14d, r14d
mov word [rax - 0x18], r14w
mov qword [rax + 0x10], r14
mov ebx, r14d
mov eax, dword [0x140361f6c]
test eax, eax
je 0x14001549c
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x140361f6c]
test eax, eax
jne 0x1400154a5
call fcn.14001552c
test eax, eax
je 0x1400154c1
lea rdx, [rsp + 0x48]
mov rcx, qword [0x14027a4b0]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne ebx, ecx
test ebx, ebx
jne 0x1400154cb
movzx eax, r14w
jmp 0x140015513
mov rcx, rdi
call qword [sym.imp.USER32.dll_RegisterClassW]
movzx ebx, ax
mov word [rsp + 0x20], ax
mov edi, r14d
test bx, bx
sete dil
test edi, edi
je 0x1400154f4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x1400154f7
mov esi, r14d
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test edi, edi
je 0x140015510
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
movzx eax, bx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret

Function at 0x140015a7c
Capabilities:
Get graphical window text

Disassembly:
push rsi
push rdi
push r14
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rbp
movsxd rbp, r8d
mov rsi, rdx
mov rdi, rcx
cmp qword [rcx + 0xd0], 0
jne 0x140015abd
mov r8d, ebp
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x140015b9a
call fcn.140005a7c
mov r14, rax
test rax, rax
jne 0x140015ad5
mov ecx, 0x80004005
call fcn.140003350
int3
mov rax, qword [rax]
mov rbx, qword [rax + 0x18]
mov rcx, rbx
call fcn.1401ad7ac
mov rcx, r14
call rbx
add rax, 0x18
mov qword [rsp + 0x50], rax
mov rdi, qword [rdi + 0xd0]
mov rax, qword [rdi]
mov rbx, qword [rax + 0x118]
mov rcx, rbx
call fcn.1401ad7ac
lea rdx, [rsp + 0x50]
mov rcx, rdi
call rbx
mov rdx, rbp
or rbx, 0xffffffffffffffff
mov r9, rbx
mov r8, qword [rsp + 0x50]
mov rcx, rsi
call fcn.1401b41d0
test eax, eax
je 0x140015b56
cmp eax, 0xc
je 0x140015b50
cmp eax, 0x16
je 0x140015b4a
cmp eax, 0x22
je 0x140015b4a
cmp eax, 0x50
je 0x140015b56
call fcn.140006968
int3
call fcn.140006968
int3
call fcn.14000698c
int3
test rsi, rsi
jne 0x140015b5f
xor ebp, ebp
jmp 0x140015b6a
mov rcx, rsi
call fcn.1401b4090
mov rbp, rax
mov rsi, qword [rsp + 0x50]
mov ecx, ebx
lock xadd dword [rsi - 8], ecx
add ecx, ebx
test ecx, ecx
jg 0x140015b98
mov rdi, qword [rsi - 0x18]
mov rax, qword [rdi]
mov rbx, qword [rax + 8]
mov rcx, rbx
call fcn.1401ad7ac
lea rdx, [rsi - 0x18]
mov rcx, rdi
call rbx
mov eax, ebp
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret