joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400033d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
movzx edx, dx
jmp 0x140028864
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x20
mov r15, rdx
mov r14, rcx
call fcn.140032ed4
mov r8d, 0xf1
mov rdx, r15
mov rbx, qword [rax + 0x18]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor r12d, r12d
test rax, rax
jne 0x1400288aa
xor eax, eax
jmp 0x140028982
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rdi, rax
test rax, rax
je 0x1400288a3
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x1400288a3
movzx ecx, word [rax + 6]
mov eax, 4
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.140003400
mov rbp, rax
mov r9d, r12d
cmp r12w, word [rbx + 6]
jae 0x14002891c
mov rdx, rax
lea r8, [rbx + 8]
movzx ecx, word [r8]
inc r9d
mov dword [rdx], ecx
lea r8, [r8 + 2]
movzx eax, word [rbx + 6]
lea rdx, [rdx + 4]
cmp r9d, eax
jl 0x140028902
movzx r8d, word [rbx + 6]
mov rdx, rbp
mov rcx, r14
call fcn.1400291bc
mov rcx, rbp
mov esi, eax
call fcn.140011b54
test esi, esi
je 0x140028977
movzx ecx, word [rbx + 4]
movzx eax, word [rbx + 2]
mov dword [rsp + 0x60], eax
add eax, 7
mov dword [rsp + 0x68], eax
lea eax, [rcx + 7]
mov dword [rsp + 0x64], ecx
mov r8, qword [rsp + 0x60]
mov rcx, r14
mov dword [rsp + 0x6c], eax
mov rdx, qword [rsp + 0x68]
call fcn.1400293dc
mov rdx, r15
mov rcx, r14
call fcn.1400287e8
mov esi, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret

Function at 0x140006ab0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xd27
mov dword [rsp + 0x18], r8d
xor r9d, r9d
mov word [rsp + 0x18], ax
movzx eax, r9w
lea r11, [0x1402b21f0]
mov r8d, r9d
mov r10d, 1
nop word [rax + rax]
movzx edx, byte [r8 + r11]
cmp r10w, ax
mov ecx, r9d
cmovne cx, ax
add dl, 9
movzx eax, cx
movzx ecx, byte [rsp + rax*2 + 0x18]
inc ax
xor cl, dl
mov byte [r8 + r11], cl
inc r8
cmp r8, 0x1a2a00
jl 0x140006ae0
ret
Function at 0x140006e60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xc0
mov qword [rbp - 0x39], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rdi
mov rax, qword [0x1402b1760]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov rbx, rcx
xor ecx, ecx
call fcn.140038b98
lea rdx, str.Local_AppWizard_Generated_Applications
mov rcx, rbx
call fcn.14003a764
mov edx, 4
mov rcx, rbx
call fcn.140037660
mov ecx, 0xf8
call fcn.140003400
mov qword [rbp - 0x31], rax
xor edi, edi
test rax, rax
je 0x140006ef1
lea rcx, str.CSTMEditorView
mov qword [rsp + 0x20], rcx
lea r9, str.CMainFrame
lea r8, str.CSTMEditorDoc
mov edx, 0x80
mov rcx, rax
call fcn.14003aa90
jmp 0x140006ef4
mov rax, rdi
mov rdx, rax
mov rcx, rbx
call fcn.14003b118
mov rcx, rbx
call fcn.14003b420
mov edx, 1
mov rcx, rbx
call fcn.14003b96c
lea rcx, [rbp - 0x29]
call fcn.140036674
nop
lea rdx, [rbp - 0x29]
mov rcx, rbx
call fcn.140037828
lea rdx, [rbp - 0x29]
mov rcx, rbx
call fcn.14003b63c
test eax, eax
je 0x140006fbf
mov edx, 5
mov rcx, qword [rbx + 0x40]
call fcn.1400215c8
mov rcx, qword [rbx + 0x40]
call fcn.140007180
mov rcx, qword [rbx + 0x40]
call fcn.140007170
call fcn.140007140
mov rbx, qword [rax + 0x40]
mov dword [rbp + 0x27], 0x72657355
mov dword [rbp + 0x2b], 0x642e3233
mov word [rbp + 0x2f], 0x6c6c
mov byte [rbp + 0x31], 0
mov dword [rbp + 0x37], 0x776f6853
mov dword [rbp + 0x3b], 0x646e6957
mov word [rbp + 0x3f], 0x776f
mov byte [rbp + 0x41], 0
lea rcx, [rbp + 0x27]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, [rbp + 0x37]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
mov rcx, rbx
call rax
call fcn.140006e20
mov edi, 1
lea rcx, [rbp - 0x29]
call fcn.1400369a8
mov eax, edi
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1401d86d0
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x140011ef0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov qword [rcx + 0xf0], rdx
mov rbp, r8
mov rdi, rdx
mov rsi, rcx
cmp rdx, 0x10000
jae 0x140011f2f
cmp dword [rcx + 0xe8], 0
jne 0x140011f2f
movzx eax, di
mov dword [rcx + 0xe8], eax
call fcn.140032ed4
mov r8d, 5
mov rdx, rdi
mov rbx, qword [rax + 0x18]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r9, rbx
mov r8, rbp
mov rdx, rax
mov rcx, rsi
mov rdi, rax
call fcn.1400122e4
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rbp, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140011f8c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov r14, r8
mov rbx, rdx
mov r15, rcx
xor edi, edi
call fcn.140032ed4
lea r8d, [rdi + 5]
mov rdx, rbx
mov rbp, qword [rax + 0x18]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
test rax, rax
je 0x140011fe8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
mov r9, rbp
mov r8, r14
mov rdx, rdi
mov rcx, r15
call fcn.140012020
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rbp, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x140012cec
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x40
mov rdi, r9
mov rsi, r8
mov r14, rdx
mov r15, rcx
and qword [rax - 0x10], 0
and qword [rax - 0x18], 0
xor ebx, ebx
mov eax, dword [0x14045a998]
test eax, eax
je 0x140012d3e
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x14045a998]
test eax, eax
jne 0x140012d47
call fcn.140012e3c
test eax, eax
je 0x140012d63
lea rdx, [rsp + 0x30]
mov rcx, qword [0x1402b0008]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne ebx, ecx
test ebx, ebx
jne 0x140012d6b
xor eax, eax
jmp 0x140012dc3
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9, rdi
mov r8, rsi
mov rdx, r14
mov rcx, r15
call qword [sym.imp.USER32.dll_CreateDialogIndirectParamA]
mov rsi, rax
mov qword [rsp + 0x38], rax
xor ebx, ebx
test rsi, rsi
sete bl
test ebx, ebx
je 0x140012da5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x140012da7
xor edi, edi
mov rdx, qword [rsp + 0x30]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x140012dc0
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
mov r14, qword [rsp + 0x68]
add rsp, 0x40
pop r15
ret

Function at 0x1400185b4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
xor edi, edi
xor ebx, ebx
mov rsi, rdx
mov r14, rcx
test rdx, rdx
je 0x14001861c
call fcn.140032ed4
mov r8d, 0xf0
mov rdx, rsi
mov rbp, qword [rax + 0x18]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindResourceA]
test rax, rax
je 0x14001861c
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbx, rax
test rax, rax
je 0x14001863e
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
mov rdx, rdi
mov rcx, r14
call fcn.14004761c
mov esi, eax
test rdi, rdi
je 0x14001863c
test rbx, rbx
je 0x14001863c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x1400195ac
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rsi, rdx
mov rbx, rcx
test rcx, rcx
je 0x140019684
mov rcx, qword [rcx + 0x40]
test rcx, rcx
je 0x140019684
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x140019684
test rsi, rsi
je 0x140019684
xor r15d, r15d
xor ebp, ebp
xor edi, edi
call fcn.140032ed4
lea r8, str.AFX_DIALOG_LAYOUT
mov rdx, rsi
mov r14, qword [rax + 0x18]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rsi, rax
test rax, rax
je 0x140019651
mov rdx, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rdx, rsi
mov rcx, r14
mov r15d, eax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rdi, rax
test rax, rax
je 0x140019684
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbp, rax
mov r8d, r15d
mov rdx, rbp
mov rcx, rbx
call fcn.14004d634
mov esi, eax
test rbp, rbp
je 0x140019674
test rdi, rdi
je 0x140019674
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeResource]
test esi, esi
je 0x140019680
mov rcx, rbx
call fcn.140019214
mov eax, esi
jmp 0x140019686
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret

Function at 0x14001a814
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, rcx
mov rbx, r8
mov rcx, qword [rcx + 0x40]
call fcn.1400488d0
mov rdi, rax
test rax, rax
je 0x14001a890
mov rcx, rax
call qword [sym.imp.USER32.dll_GetDlgCtrlID]
mov esi, eax
test rbx, rbx
je 0x14001a88b
cmp dword [rbx], 0x40
jb 0x14001a88b
mov rcx, qword [rbp + 0x40]
xor r9d, r9d
or dword [rbx + 4], 1
xor r8d, r8d
or qword [rbx + 0x30], 0xffffffffffffffff
mov edx, 0x87
mov qword [rbx + 8], rcx
mov rcx, rdi
mov qword [rbx + 0x10], rdi
call qword [sym.imp.USER32.dll_SendMessageA]
bt rax, 0xd
jb 0x14001a88b
or dword [rbx + 4], 0x80000002
mov rax, rsi
jmp 0x14001a894
or rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14001f2f8
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x70
mov edi, r9d
mov rsi, r8
mov r14, rdx
mov r15d, ecx
and qword [rax - 0x10], 0
and qword [rax - 0x18], 0
xor ebx, ebx
mov eax, dword [0x14045a998]
test eax, eax
je 0x14001f34a
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x14045a998]
test eax, eax
jne 0x14001f353
call fcn.140012e3c
test eax, eax
je 0x14001f36f
lea rdx, [rsp + 0x60]
mov rcx, qword [0x1402b0008]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne ebx, ecx
test ebx, ebx
jne 0x14001f37a
xor eax, eax
jmp 0x14001f428
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0xb8]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0xb0]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0xa8]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0xa0]
mov dword [rsp + 0x20], eax
mov r9d, edi
mov r8, rsi
mov rdx, r14
mov ecx, r15d
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov rsi, rax
mov qword [rsp + 0x68], rax
xor ebx, ebx
test rsi, rsi
sete bl
test ebx, ebx
je 0x14001f40a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x14001f40c
xor edi, edi
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x14001f425
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rsi
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret
Function at 0x14001f444
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push r14
sub rsp, 0x30
mov rdi, r8
mov rsi, rdx
mov r14, rcx
and dword [rax - 0x18], 0
and qword [rax + 0x20], 0
xor ebx, ebx
mov eax, dword [0x14045a998]
test eax, eax
je 0x14001f48e
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x14045a998]
test eax, eax
jne 0x14001f497
call fcn.140012e3c
test eax, eax
je 0x14001f4b3
lea rdx, [rsp + 0x58]
mov rcx, qword [0x1402b0008]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne ebx, ecx
test ebx, ebx
jne 0x14001f4bb
xor eax, eax
jmp 0x14001f502
mov r8, rdi
mov rdx, rsi
mov rcx, r14
call qword [sym.imp.USER32.dll_GetClassInfoExA]
mov edi, eax
mov dword [rsp + 0x20], eax
xor ebx, ebx
test edi, edi
sete bl
test ebx, ebx
je 0x14001f4e5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x14001f4e7
xor esi, esi
mov rdx, qword [rsp + 0x58]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x14001f500
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r14
ret

Function at 0x14001f518
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
xor edi, edi
mov dword [rax - 0x18], edi
mov rbx, qword [0x14045dd88]
and qword [rax + 0x10], rdi
xor esi, esi
mov eax, dword [0x14045a998]
test eax, eax
je 0x14001f563
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x14045a998]
test eax, eax
jne 0x14001f56c
call fcn.140012e3c
test eax, eax
je 0x14001f588
lea rdx, [rsp + 0x48]
mov rcx, qword [0x1402b0008]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne 0x14001f590
xor eax, eax
jmp 0x14001f5f5
test rbx, rbx
jne 0x14001f5b0
lea rcx, str.InitCommonControlsEx
call fcn.14001f264
mov rbx, rax
test rax, rax
je 0x14001f5c3
mov qword [0x14045dd88], rax
mov rcx, rbx
call fcn.1401d8f64
mov rcx, r14
call rbx
mov edi, eax
mov dword [rsp + 0x20], eax
xor ebx, ebx
test edi, edi
sete bl
test ebx, ebx
je 0x14001f5d8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x14001f5da
xor esi, esi
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x14001f5f3
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x14001f74c
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov rdi, rcx
xor r14d, r14d
mov word [rax - 0x18], r14w
mov qword [rax + 0x10], r14
mov ebx, r14d
mov eax, dword [0x14045a998]
test eax, eax
je 0x14001f794
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x14045a998]
test eax, eax
jne 0x14001f79d
call fcn.140012e3c
test eax, eax
je 0x14001f7b9
lea rdx, [rsp + 0x48]
mov rcx, qword [0x1402b0008]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne ebx, ecx
test ebx, ebx
jne 0x14001f7c3
movzx eax, r14w
jmp 0x14001f80b
mov rcx, rdi
call qword [sym.imp.USER32.dll_RegisterClassA]
movzx ebx, ax
mov word [rsp + 0x20], ax
mov edi, r14d
test bx, bx
sete dil
test edi, edi
je 0x14001f7ec
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x14001f7ef
mov esi, r14d
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test edi, edi
je 0x14001f808
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
movzx eax, bx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret

Function at 0x140020b5c
Capabilities:
Get graphical window text

Disassembly:
push rsi
push rdi
push r14
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rbp
movsxd rbp, r8d
mov rsi, rdx
mov rdi, rcx
cmp qword [rcx + 0xd0], 0
jne 0x140020b9d
mov r8d, ebp
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x140020c7a
call fcn.140013574
mov r14, rax
test rax, rax
jne 0x140020bb5
mov ecx, 0x80004005
call fcn.140002ab0
int3
mov rax, qword [rax]
mov rbx, qword [rax + 0x18]
mov rcx, rbx
call fcn.1401d8f64
mov rcx, r14
call rbx
add rax, 0x18
mov qword [rsp + 0x50], rax
mov rdi, qword [rdi + 0xd0]
mov rax, qword [rdi]
mov rbx, qword [rax + 0x118]
mov rcx, rbx
call fcn.1401d8f64
lea rdx, [rsp + 0x50]
mov rcx, rdi
call rbx
mov rdx, rbp
or rbx, 0xffffffffffffffff
mov r9, rbx
mov r8, qword [rsp + 0x50]
mov rcx, rsi
call fcn.1401e0ed0
test eax, eax
je 0x140020c36
cmp eax, 0xc
je 0x140020c30
cmp eax, 0x16
je 0x140020c2a
cmp eax, 0x22
je 0x140020c2a
cmp eax, 0x50
je 0x140020c36
call fcn.140014f44
int3
call fcn.140014f44
int3
call fcn.140014f68
int3
test rsi, rsi
jne 0x140020c3f
xor ebp, ebp
jmp 0x140020c4a
mov rcx, rsi
call fcn.1401e0dc0
mov rbp, rax
mov rsi, qword [rsp + 0x50]
mov ecx, ebx
lock xadd dword [rsi - 8], ecx
add ecx, ebx
test ecx, ecx
jg 0x140020c78
mov rdi, qword [rsi - 0x18]
mov rax, qword [rdi]
mov rbx, qword [rax + 8]
mov rcx, rbx
call fcn.1401d8f64
lea rdx, [rsi - 0x18]
mov rcx, rdi
call rbx
mov eax, ebp
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x140028864
Capabilities:
Extract resource via kernel32 functions

Disassembly:
movzx edx, dx
jmp 0x140028864
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x20
mov r15, rdx
mov r14, rcx
call fcn.140032ed4
mov r8d, 0xf1
mov rdx, r15
mov rbx, qword [rax + 0x18]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor r12d, r12d
test rax, rax
jne 0x1400288aa
xor eax, eax
jmp 0x140028982
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rdi, rax
test rax, rax
je 0x1400288a3
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x1400288a3
movzx ecx, word [rax + 6]
mov eax, 4
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.140003400
mov rbp, rax
mov r9d, r12d
cmp r12w, word [rbx + 6]
jae 0x14002891c
mov rdx, rax
lea r8, [rbx + 8]
movzx ecx, word [r8]
inc r9d
mov dword [rdx], ecx
lea r8, [r8 + 2]
movzx eax, word [rbx + 6]
lea rdx, [rdx + 4]
cmp r9d, eax
jl 0x140028902
movzx r8d, word [rbx + 6]
mov rdx, rbp
mov rcx, r14
call fcn.1400291bc
mov rcx, rbp
mov esi, eax
call fcn.140011b54
test esi, esi
je 0x140028977
movzx ecx, word [rbx + 4]
movzx eax, word [rbx + 2]
mov dword [rsp + 0x60], eax
add eax, 7
mov dword [rsp + 0x68], eax
lea eax, [rcx + 7]
mov dword [rsp + 0x64], ecx
mov r8, qword [rsp + 0x60]
mov rcx, r14
mov dword [rsp + 0x6c], eax
mov rdx, qword [rsp + 0x68]
call fcn.1400293dc
mov rdx, r15
mov rcx, r14
call fcn.1400287e8
mov esi, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x140030330
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
xor edi, edi
mov dword [rax - 0x18], edi
mov rbx, qword [0x14045df80]
and qword [rax + 0x10], rdi
xor esi, esi
mov eax, dword [0x14045a998]
test eax, eax
je 0x14003037b
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x14045a998]
test eax, eax
jne 0x140030384
call fcn.140012e3c
test eax, eax
je 0x1400303a0
lea rdx, [rsp + 0x48]
mov rcx, qword [0x1402b0008]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne 0x1400303a8
xor eax, eax
jmp 0x14003040d
test rbx, rbx
jne 0x1400303c8
lea rcx, str.GetOpenFileNameA
call fcn.14003029c
mov rbx, rax
test rax, rax
je 0x1400303db
mov qword [0x14045df80], rax
mov rcx, rbx
call fcn.1401d8f64
mov rcx, r14
call rbx
mov edi, eax
mov dword [rsp + 0x20], eax
xor ebx, ebx
test edi, edi
sete bl
test ebx, ebx
je 0x1400303f0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x1400303f2
xor esi, esi
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x14003040b
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret

Function at 0x140030424
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
xor edi, edi
mov dword [rax - 0x18], edi
mov rbx, qword [0x14045df88]
and qword [rax + 0x10], rdi
xor esi, esi
mov eax, dword [0x14045a998]
test eax, eax
je 0x14003046f
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x14045a998]
test eax, eax
jne 0x140030478
call fcn.140012e3c
test eax, eax
je 0x140030494
lea rdx, [rsp + 0x48]
mov rcx, qword [0x1402b0008]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne 0x14003049c
xor eax, eax
jmp 0x140030501
test rbx, rbx
jne 0x1400304bc
lea rcx, str.GetSaveFileNameA
call fcn.14003029c
mov rbx, rax
test rax, rax
je 0x1400304cf
mov qword [0x14045df88], rax
mov rcx, rbx
call fcn.1401d8f64
mov rcx, r14
call rbx
mov edi, eax
mov dword [rsp + 0x20], eax
xor ebx, ebx
test edi, edi
sete bl
test ebx, ebx
je 0x1400304e4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x1400304e6
xor esi, esi
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x1400304ff
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret