joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140104250
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x1498
call fcn.14005de10
sub rsp, rax
mov rax, qword [0x1401bb8b8]
xor rax, rsp
mov qword [rsp + 0x1480], rax
mov eax, dword [rsp + 0x14b8]
sar eax, 6
cdqe
lea rcx, [0x1401bebd0]
mov edx, dword [rsp + 0x14b8]
and edx, 0x3f
movsxd rdx, edx
imul rdx, rdx, 0x48
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + rdx + 0x28]
mov qword [rsp + 0x68], rax
mov eax, dword [rsp + 0x14c8]
mov rcx, qword [rsp + 0x14c0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x70]
mov rdi, rax
xor eax, eax
mov ecx, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x14c0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x50], rax
jae 0x14010445d
lea rax, [rsp + 0x147e]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x60]
cmp qword [rsp + 0x38], rax
jae 0x1401043a9
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x50], rax
jae 0x1401043a9
mov rax, qword [rsp + 0x50]
movzx eax, word [rax]
mov word [rsp + 0x40], ax
mov rax, qword [rsp + 0x50]
add rax, 2
mov qword [rsp + 0x50], rax
movzx eax, word [rsp + 0x40]
mov word [rsp + 0x30], ax
movzx eax, word [rsp + 0x30]
cmp eax, 0xa
jne 0x140104389
mov eax, dword [rsp + 0x78]
add eax, 2
mov dword [rsp + 0x78], eax
mov eax, SafeArrayGetElemsize
mov rcx, qword [rsp + 0x38]
mov word [rcx], ax
mov rax, qword [rsp + 0x38]
add rax, 2
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movzx ecx, word [rsp + 0x30]
mov word [rax], cx
mov rax, qword [rsp + 0x38]
add rax, 2
mov qword [rsp + 0x38], rax
jmp 0x140104318
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov eax, eax
shl rax, 1
mov dword [rsp + 0x44], eax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x48]
mov r8d, dword [rsp + 0x44]
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x14010441d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x70], eax
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x14010447c
mov eax, dword [rsp + 0x48]
mov ecx, dword [rsp + 0x74]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x74], eax
mov eax, dword [rsp + 0x44]
cmp dword [rsp + 0x48], eax
jae 0x140104458
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x14010447c
jmp 0x1401042ee
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
mov rcx, qword [rsp + 0x1480]
xor rcx, rsp
call fcn.14005db80
add rsp, 0x1498
pop rdi
pop rsi
ret
Function at 0x14010ec30
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0xb8
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.14010eac0
lea rcx, [rsp + 0x40]
call fcn.14010ebf0
movzx eax, al
test eax, eax
jne 0x14010ec78
mov qword [rsp + 0x70], 0
lea rcx, [rsp + 0x40]
call fcn.14010eae0
mov rax, qword [rsp + 0x70]
jmp 0x14010ee49
lea rcx, [rsp + 0x40]
call fcn.14010ebd0
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
call fcn.14010eb80
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x78]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x40]
call fcn.14010ebd0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, dword [rsp + 0x68]
mov r8, rax
xor edx, edx
xor ecx, ecx
call fcn.14010e990
cdqe
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
jne 0x14010ed1e
mov qword [rsp + 0x80], 0
lea rcx, [rsp + 0x40]
call fcn.14010eae0
mov rax, qword [rsp + 0x80]
jmp 0x14010ee49
mov r9d, 0x66
lea r8, str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
mov edx, 2
mov rcx, qword [rsp + 0x58]
call fcn.1400e97a0
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.140064200
lea rcx, [rsp + 0x48]
call fcn.1400642a0
movzx eax, al
test eax, eax
jne 0x14010ed85
mov qword [rsp + 0x88], 0
lea rcx, [rsp + 0x48]
call fcn.140064240
lea rcx, [rsp + 0x40]
call fcn.14010eae0
mov rax, qword [rsp + 0x88]
jmp 0x14010ee49
lea rcx, [rsp + 0x48]
call fcn.140064390
mov qword [rsp + 0x90], rax
lea rcx, [rsp + 0x40]
call fcn.14010ebd0
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x68]
mov r8, qword [rsp + 0x98]
xor edx, edx
xor ecx, ecx
call fcn.14010e990
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jne 0x14010ee1b
mov qword [rsp + 0xa0], 0
lea rcx, [rsp + 0x48]
call fcn.140064240
lea rcx, [rsp + 0x40]
call fcn.14010eae0
mov rax, qword [rsp + 0xa0]
jmp 0x14010ee49
lea rcx, [rsp + 0x48]
call fcn.1400de040
mov qword [rsp + 0xa8], rax
lea rcx, [rsp + 0x48]
call fcn.140064240
lea rcx, [rsp + 0x40]
call fcn.14010eae0
mov rax, qword [rsp + 0xa8]
add rsp, 0xb8
ret
Function at 0x14010ee60
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x78
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.14010eac0
lea rcx, [rsp + 0x20]
call fcn.14010eb00
movzx eax, al
test eax, eax
jne 0x14010eea5
mov qword [rsp + 0x40], 0
lea rcx, [rsp + 0x20]
call fcn.14010eae0
mov rax, qword [rsp + 0x40]
jmp 0x14010ef9f
lea rcx, [rsp + 0x20]
call fcn.14010ebd0
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x30]
call fcn.14010eb80
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x48]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
shl rax, 1
mov r9d, 0x40
lea r8, str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
mov edx, 2
mov rcx, rax
call fcn.1400e97a0
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.14007c8e0
lea rcx, [rsp + 0x28]
call fcn.1400ddee0
movzx eax, al
test eax, eax
jne 0x14010ef3f
mov qword [rsp + 0x50], 0
lea rcx, [rsp + 0x28]
call fcn.14007c900
lea rcx, [rsp + 0x20]
call fcn.14010eae0
mov rax, qword [rsp + 0x50]
jmp 0x14010ef9f
lea rcx, [rsp + 0x20]
call fcn.14010ebd0
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x28]
call fcn.14007cd80
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x38]
shl rax, 1
mov r8, rax
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
call fcn.140062070
lea rcx, [rsp + 0x28]
call fcn.1400d17f0
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x28]
call fcn.14007c900
lea rcx, [rsp + 0x20]
call fcn.14010eae0
mov rax, qword [rsp + 0x68]
add rsp, 0x78
ret

Function at 0x1401106f0
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x38]
mov rdx, qword [rax]
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
add rsp, 0x28
ret
Function at 0x140003ec0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x140003ef3
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rcx, rax
mov qword [rsp + 0x30], rbx
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x140003f39
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
add rcx, rbx
and edi, 0xf
jbe 0x140003f34
nop
cmp rbx, rcx
jae 0x140003f39
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
dec edi
jne 0x140003f20
cmp rbx, rcx
jb 0x140003f3d
xor eax, eax
jmp 0x140003f49
xor eax, eax
cmp word [rbx], ax
cmove rbx, rax
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140010890
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x20
mov rcx, qword [rcx + 0x40]
mov rsi, rdx
xor ebx, ebx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x1400108f5
lea ecx, [rbx + 1]
mov qword [rsp + 0x30], rdi
call qword [sym.imp.USER32.dll_GetClipboardData]
mov rdi, rax
test rax, rax
je 0x1400108ea
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
test rax, rax
je 0x1400108ea
mov rdx, rax
mov rcx, rsi
call fcn.140002590
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov ebx, 1
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rdi, qword [rsp + 0x30]
mov eax, ebx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret

Function at 0x140012580
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push rbp
sub rsp, 0x30
lea rbp, [rsp + 0x20]
mov qword [rbp + 0x20], rbx
mov qword [rbp + 0x28], rsi
mov qword [rbp + 0x30], rdi
mov qword [rbp + 0x38], r14
mov rax, qword [0x1416e97c0]
xor rax, rbp
mov qword [rbp + 8], rax
mov rbx, rdx
mov rdi, rcx
test rdx, rdx
je 0x1400126c0
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x1400126c0
call fcn.14002dbf0
mov rcx, qword [rax + 8]
call fcn.140022e54
mov rcx, qword [rdi + 0x40]
xor esi, esi
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x1400126b3
call qword [sym.imp.USER32.dll_EmptyClipboard]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, 0x2002
inc eax
movsxd rdx, eax
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov r14, rax
test rax, rax
je 0x1400126ad
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
or rcx, 0xffffffffffffffff
mov rdi, rax
inc rcx
cmp word [rbx + rcx*2], si
jne 0x140012626
inc ecx
cmp ecx, 0x3fffffff
jle 0x14001263e
mov rax, rsi
jmp 0x14001267d
movsxd rax, ecx
lea r8d, [rcx + rcx]
add rax, rax
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x14001265b
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1401b1e20
sub rsp, rcx
mov r9d, 3
lea rcx, [rsp + 0x20]
mov rdx, rbx
call fcn.1400071d0
sub rdi, rax
movzx ecx, byte [rax]
lea rax, [rax + 1]
mov byte [rdi + rax - 1], cl
test cl, cl
jne 0x140012680
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rdx, r14
mov ecx, 1
call qword [sym.imp.USER32.dll_SetClipboardData]
test rax, rax
setne sil
call qword [sym.imp.USER32.dll_CloseClipboard]
lea rcx, [rbp]
call fcn.140010780
mov eax, esi
jmp 0x1400126c2
xor eax, eax
mov rcx, qword [rbp + 8]
xor rcx, rbp
call fcn.1401b1e80
mov rbx, qword [rbp + 0x20]
mov rsi, qword [rbp + 0x28]
mov rdi, qword [rbp + 0x30]
mov r14, qword [rbp + 0x38]
lea rsp, [rbp + 0x10]
pop rbp
ret
Function at 0x14001f760
Capabilities:
Create process on windows

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
test rcx, rcx
je 0x14001f772
mov rcx, qword [rcx + 0x40]
mov r8, qword [rdx]
lea rdx, str.open
xor r9d, r9d
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rdx, qword [rbx]
sub rdx, 0x18
cmp eax, 0x20
jg 0x14001f7ba
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14001f7b2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
add rsp, 0x30
pop rbx
ret
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14001f7ca
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, 1
add rsp, 0x30
pop rbx
ret

Function at 0x14002600c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
xor edi, edi
xor ebx, ebx
mov rsi, rdx
mov r14, rcx
test rdx, rdx
je 0x140026074
call fcn.14002dbf0
mov r8d, 0xf0
mov rdx, rsi
mov rbp, qword [rax + 0x18]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x140026074
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbx, rax
test rax, rax
je 0x140026096
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
mov rdx, rdi
mov rcx, r14
call fcn.140058270
mov esi, eax
test rdi, rdi
je 0x140026094
test rbx, rbx
je 0x140026094
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x140027b14
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, rcx
mov rcx, qword [rcx + 0x40]
mov rbx, r8
call fcn.140056904
mov rdi, rax
test rax, rax
je 0x140027b90
mov rcx, rax
call qword [sym.imp.USER32.dll_GetDlgCtrlID]
mov esi, eax
test rbx, rbx
je 0x140027b8b
cmp dword [rbx], 0x40
jb 0x140027b8b
mov rcx, qword [rbp + 0x40]
or dword [rbx + 4], 1
or qword [rbx + 0x30], 0xffffffffffffffff
mov qword [rbx + 8], rcx
xor r9d, r9d
xor r8d, r8d
mov edx, 0x87
mov rcx, rdi
mov qword [rbx + 0x10], rdi
call qword [sym.imp.USER32.dll_SendMessageW]
bt rax, 0xd
jb 0x140027b8b
or dword [rbx + 4], 0x80000002
mov rax, rsi
jmp 0x140027b94
or rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14002b880
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x70
mov edi, r9d
mov rsi, r8
mov r14, rdx
mov r15d, ecx
and qword [rax - 0x10], 0
and qword [rax - 0x18], 0
xor ebx, ebx
mov eax, dword [0x1416f1580]
test eax, eax
je 0x14002b8d2
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x1416f1580]
test eax, eax
jne 0x14002b8db
call fcn.14002bd8c
test eax, eax
je 0x14002b8f7
lea rdx, [rsp + 0x60]
mov rcx, qword [0x1416e8158]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne ebx, ecx
test ebx, ebx
jne 0x14002b902
xor eax, eax
jmp 0x14002b9b0
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0xb8]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0xb0]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0xa8]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0xa0]
mov dword [rsp + 0x20], eax
mov r9d, edi
mov r8, rsi
mov rdx, r14
mov ecx, r15d
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov rsi, rax
mov qword [rsp + 0x68], rax
xor ebx, ebx
test rax, rax
sete bl
test ebx, ebx
je 0x14002b992
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x14002b994
xor edi, edi
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x14002b9ad
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rsi
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret
Function at 0x14002b9cc
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push r14
sub rsp, 0x30
mov rdi, r8
mov rsi, rdx
mov r14, rcx
and dword [rax - 0x18], 0
and qword [rax + 0x20], 0
xor ebx, ebx
mov eax, dword [0x1416f1580]
test eax, eax
je 0x14002ba16
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x1416f1580]
test eax, eax
jne 0x14002ba1f
call fcn.14002bd8c
test eax, eax
je 0x14002ba3b
lea rdx, [rsp + 0x58]
mov rcx, qword [0x1416e8158]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne ebx, ecx
test ebx, ebx
jne 0x14002ba43
xor eax, eax
jmp 0x14002ba8a
mov r8, rdi
mov rdx, rsi
mov rcx, r14
call qword [sym.imp.USER32.dll_GetClassInfoExW]
mov edi, eax
mov dword [rsp + 0x20], eax
xor ebx, ebx
test eax, eax
sete bl
test ebx, ebx
je 0x14002ba6d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x14002ba6f
xor esi, esi
mov rdx, qword [rsp + 0x58]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x14002ba88
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r14
ret

Function at 0x14002baa0
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
xor edi, edi
mov dword [rax - 0x18], edi
mov rbx, qword [0x1416f4958]
and qword [rax + 0x10], rdi
xor esi, esi
mov eax, dword [0x1416f1580]
test eax, eax
je 0x14002baeb
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x1416f1580]
test eax, eax
jne 0x14002baf4
call fcn.14002bd8c
test eax, eax
je 0x14002bb10
lea rdx, [rsp + 0x48]
mov rcx, qword [0x1416e8158]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne 0x14002bb18
xor eax, eax
jmp 0x14002bb75
test rbx, rbx
jne 0x14002bb38
lea rcx, str.InitCommonControlsEx
call fcn.14002b7d0
mov rbx, rax
test rax, rax
je 0x14002bb43
mov qword [0x1416f4958], rax
mov rcx, r14
call rbx
mov edi, eax
mov dword [rsp + 0x20], eax
xor ebx, ebx
test edi, edi
sete bl
test ebx, ebx
je 0x14002bb58
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x14002bb5a
xor esi, esi
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x14002bb73
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x14002bcb4
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov rdi, rcx
xor r14d, r14d
mov word [rax - 0x18], r14w
mov qword [rax + 0x10], r14
mov ebx, r14d
mov eax, dword [0x1416f1580]
test eax, eax
je 0x14002bcfc
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x1416f1580]
test eax, eax
jne 0x14002bd05
call fcn.14002bd8c
test eax, eax
je 0x14002bd21
lea rdx, [rsp + 0x48]
mov rcx, qword [0x1416e8158]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne ebx, ecx
test ebx, ebx
jne 0x14002bd2b
movzx eax, r14w
jmp 0x14002bd73
mov rcx, rdi
call qword [sym.imp.USER32.dll_RegisterClassW]
movzx ebx, ax
mov word [rsp + 0x20], ax
mov edi, r14d
test bx, bx
sete dil
test edi, edi
je 0x14002bd54
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x14002bd57
mov esi, r14d
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test edi, edi
je 0x14002bd70
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
movzx eax, bx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret

Function at 0x14002c140
Capabilities:
Get graphical window text

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rsi
movsxd rsi, r8d
mov rbx, rdx
mov rdi, rcx
cmp qword [rcx + 0xc8], 0
jne 0x14002c17e
mov r8d, esi
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x14002c236
call fcn.140022b78
mov rdx, rax
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
jne 0x14002c19d
mov ecx, 0x80004005
call fcn.140002730
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x40], rax
mov rcx, qword [rdi + 0xc8]
mov rax, qword [rcx]
lea rdx, [rsp + 0x40]
call qword [rax + 0x118]
mov rdx, rsi
or rdi, 0xffffffffffffffff
mov r9, rdi
mov r8, qword [rsp + 0x40]
mov rcx, rbx
call fcn.1401b8df4
test eax, eax
je 0x14002c205
cmp eax, 0xc
je 0x14002c1ff
cmp eax, 0x16
je 0x14002c1f9
cmp eax, 0x22
je 0x14002c1f9
cmp eax, 0x50
je 0x14002c205
call fcn.140021da8
int3
call fcn.140021da8
int3
call fcn.140021dcc
int3
test rbx, rbx
je 0x14002c215
mov rcx, rbx
call fcn.1401b8ff4
mov rbx, rax
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov ecx, edi
lock xadd dword [rdx + 0x10], ecx
add ecx, edi
test ecx, ecx
jg 0x14002c234
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, ebx
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x14002c800
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, r8
mov rdi, rdx
mov rsi, rcx
mov qword [rcx + 0xe0], rdx
test rdx, 0xffffffffffff0000
jne 0x14002c83f
cmp dword [rcx + 0xd8], 0
jne 0x14002c83f
movzx eax, dx
mov dword [rcx + 0xd8], eax
call fcn.14002dbf0
mov r8d, 5
mov rdx, rdi
mov rbx, qword [rax + 0x18]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rcx, rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r9, rbx
mov r8, rbp
mov rdx, rax
mov rcx, rsi
mov rdi, rax
call fcn.14002cb9c
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14002c89c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov r14, r8
mov rbx, rdx
mov r15, rcx
xor edi, edi
call fcn.14002dbf0
lea r8d, [rdi + 5]
mov rbp, qword [rax + 0x18]
mov rdx, rbx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rcx, rbp
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
test rax, rax
je 0x14002c8f8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
mov r9, rbp
mov r8, r14
mov rdx, rdi
mov rcx, r15
call fcn.14002c930
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret