joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18000f620
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
xor edi, edi
mov rsi, rdx
mov rbp, rcx
mov ebx, edi
lea r14d, [rdi + 0x20]
mov edx, 1
lea rcx, [rsp + 0x50]
mov r8d, edx
mov r9, rbp
call fcn.1800acec4
test rax, rax
je 0x18000f6b5
movzx eax, byte [rsp + 0x50]
cmp al, 9
mov ecx, eax
cmove ecx, r14d
inc edi
mov byte [rbx + rsi], cl
inc rbx
mov byte [rsp + 0x50], cl
cmp cl, 0xd
jg 0x18000f640
movsxd rax, edi
mov byte [rax + rsi], 0
test rbx, rbx
js 0x18000f692
cmp byte [rbx + rsi], 0
jne 0x18000f692
dec edi
sub rbx, 1
jns 0x18000f684
movsxd rax, edi
test edi, edi
js 0x18000f6b0
lea rcx, [rax + rsi]
nop dword [rax]
cmp byte [rcx], r14b
jne 0x18000f6b0
mov byte [rcx], 0
dec rcx
cmp rcx, rsi
jns 0x18000f6a0
mov eax, 1
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x18003f980
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub rsp, 0x28
movzx edx, cx
mov r8d, 5
mov rcx, qword [0x1801086e8]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rcx, qword [0x1801086e8]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
add rsp, 0x28
jmp qword [sym.imp.KERNEL32.dll_LockResource]
Function at 0x180041950
Capabilities:
Capture screenshot

Disassembly:
push rsi
push rdi
push r14
push r15
sub rsp, 0x58
mov r14, rcx
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov rcx, r14
mov rdi, rax
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov edx, dword [0x180109014]
mov r8d, 0x2e
mov rcx, r14
mov rsi, rax
call qword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov r15, rax
test rax, rax
je 0x180041ab0
mov qword [rsp + 0x80], rbx
mov rdx, rax
mov qword [rsp + 0x88], rbp
mov rcx, rdi
mov qword [rsp + 0x90], r12
mov qword [rsp + 0x50], r13
call qword [sym.imp.GDI32.dll_SelectObject]
mov rdx, qword [0x180109018]
mov rcx, rsi
mov r12, rax
call qword [sym.imp.GDI32.dll_SelectObject]
mov r9d, dword [0x180109014]
mov ecx, r9d
mov r13, rax
and ecx, 0x80000003
jge 0x1800419ec
dec ecx
or ecx, 0xfffffffc
inc ecx
test ecx, ecx
lea ebp, [r9 + 4]
cmove ebp, r9d
xor eax, eax
mov ebx, eax
test ebp, ebp
jle 0x180041a44
nop
mov dword [rsp + 0x40], 0xcc0020
mov r9d, 4
mov dword [rsp + 0x38], eax
xor r8d, r8d
mov dword [rsp + 0x30], eax
mov edx, ebx
mov qword [rsp + 0x28], rsi
mov rcx, rdi
mov dword [rsp + 0x20], gethostbyname
call qword [sym.imp.GDI32.dll_BitBlt]
add ebx, 4
mov eax, 0
cmp ebx, ebp
jl 0x180041a00
mov r9d, dword [0x180109014]
mov dword [rsp + 0x40], 0xcc0020
xor r8d, r8d
mov dword [rsp + 0x38], eax
mov edx, 0x1db
mov dword [rsp + 0x30], eax
mov rcx, r14
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], gethostbyname
call qword [sym.imp.GDI32.dll_BitBlt]
mov rdx, r13
mov rcx, rsi
call qword [sym.imp.GDI32.dll_SelectObject]
mov rdx, r12
mov rcx, rdi
call qword [sym.imp.GDI32.dll_SelectObject]
mov rcx, r15
call qword [sym.imp.GDI32.dll_DeleteObject]
mov r13, qword [rsp + 0x50]
mov r12, qword [rsp + 0x90]
mov rbp, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x80]
mov rcx, rdi
call qword [sym.imp.GDI32.dll_DeleteDC]
mov rcx, rsi
add rsp, 0x58
pop r15
pop r14
pop rdi
pop rsi
jmp qword [sym.imp.GDI32.dll_DeleteDC]
Function at 0x180041bd0
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xa8
movaps xmmword [rsp + 0x90], xmm6
mov rax, qword [0x180107738]
xor rax, rsp
mov qword [rsp + 0x80], rax
movsxd rdi, edx
mov rbx, r9
mov edx, edi
mov esi, r8d
mov r14, rcx
call qword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
xor r13d, r13d
mov dword [rsp + 0x48], edi
mov rdx, rax
mov qword [rsp + 0x40], r13
mov rcx, r14
mov dword [rsp + 0x4c], esi
mov r15, rax
call qword [sym.imp.GDI32.dll_SelectObject]
xor ecx, ecx
mov r12, rax
call qword [sym.imp.GDI32.dll_GetStockObject]
lea rdx, [rsp + 0x40]
mov rcx, r14
mov r8, rax
call qword [sym.imp.USER32.dll_FillRect]
mov ebp, 1
mov r9, rbx
xor r8d, r8d
mov dword [rsp + 0x20], ebp
xor edx, edx
mov rcx, r14
call qword [sym.imp.GDI32.dll_TextOutA]
lea eax, [rdi + rdi*2]
mov dword [rsp + 0x50], 0x28
lea eax, [rax*8 + 0x1f]
mov dword [rsp + 0x54], edi
and eax, 0xffffffe0
mov dword [rsp + 0x58], esi
cdq
mov qword [rsp + 0x5c], 0x180001
and edx, 7
mov dword [rsp + 0x74], r13d
add eax, edx
lea r9d, [r13 + 4]
sar eax, 3
mov ecx, esi
movsxd rbp, eax
mov r8d, 0x3000
imul ecx, ebp
mov dword [rsp + 0x64], ecx
movsxd rdx, ecx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [rsp + 0x30], r13d
mov r9d, esi
mov rbx, rax
xor r8d, r8d
lea rax, [rsp + 0x50]
mov rdx, r15
mov qword [rsp + 0x28], rax
mov rcx, r14
mov qword [rsp + 0x20], rbx
call qword [sym.imp.GDI32.dll_GetDIBits]
mov ecx, esi
xorps xmm2, xmm2
imul ecx, edi
xorps xmm6, xmm6
mov r11, rdi
movd xmm3, ecx
cvtdq2ps xmm3, xmm3
test esi, esi
jle 0x180041dee
mov r10d, r13d
mov edi, esi
nop word [rax + rax]
mov r9, r13
cmp r11, 4
jl 0x180041da4
lea rdx, [rbx + 6]
lea r8, [r11 - 4]
add rdx, r10
shr r8, 2
inc r8
lea r9, [r8*4]
nop word [rax + rax]
movzx eax, byte [rdx - 6]
mov ecx, 0xff
sub ecx, eax
movzx eax, byte [rdx - 3]
movd xmm1, ecx
mov ecx, 0xff
sub ecx, eax
movzx eax, byte [rdx]
cvtdq2ps xmm1, xmm1
movd xmm0, ecx
mov ecx, 0xff
cvtdq2ps xmm0, xmm0
sub ecx, eax
movzx eax, byte [rdx + 3]
add rdx, 0xc
addss xmm1, xmm6
movaps xmm6, xmm1
addss xmm6, xmm0
movd xmm0, ecx
cvtdq2ps xmm0, xmm0
mov ecx, 0xff
sub ecx, eax
addss xmm6, xmm0
movd xmm0, ecx
cvtdq2ps xmm0, xmm0
addss xmm6, xmm0
sub r8, 1
jne 0x180041d40
cmp r9, r11
jge 0x180041dd8
lea rdx, [r10 + r9*2]
mov r8, r11
add rdx, r9
add rdx, rbx
sub r8, r9
movzx eax, byte [rdx]
mov ecx, 0xff
sub ecx, eax
add rdx, 3
movd xmm0, ecx
cvtdq2ps xmm0, xmm0
addss xmm6, xmm0
sub r8, 1
jne 0x180041db9
add r10, rbp
sub rdi, 1
jne 0x180041d10
comiss xmm6, xmm2
jbe 0x180041dee
divss xmm6, xmm3
divss xmm6, dword [0x1800e02b4]
test rbx, rbx
je 0x180041e0c
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rdx, r12
mov rcx, r14
call qword [sym.imp.GDI32.dll_SelectObject]
mov rcx, r15
call qword [sym.imp.GDI32.dll_DeleteObject]
movaps xmm0, xmm6
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.18007b2f0
movaps xmm6, xmmword [rsp + 0x90]
add rsp, 0xa8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180047ad0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push r15
sub rsp, 0x40
mov rbx, r9
mov rsi, r8
mov r14, rdx
mov r15, rcx
xor edi, edi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
cmp dword [0x180108694], edi
jne 0x180047bae
mov eax, dword [0x180108690]
test eax, eax
jne 0x180047bae
mov r9d, dword [0x18010869c]
test r9d, r9d
je 0x180047b42
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x180108690]
mov r9d, dword [0x18010869c]
test eax, eax
jne 0x180047bae
test r9d, r9d
jne 0x180047b54
call fcn.1800021b0
test eax, eax
je 0x180047b6a
lea rdx, [rsp + 0x30]
mov rcx, qword [section..data]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
test eax, eax
jne 0x180047bae
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [rax - 0x7e]
cmp ecx, 1
jbe 0x180047ba4
cmp eax, 0x78
je 0x180047ba4
cmp eax, 1
je 0x180047ba4
cmp eax, 0x32
je 0x180047ba4
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
mov r14, qword [rsp + 0x68]
add rsp, 0x40
pop r15
ret
mov dword [0x180108690], 1
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9, rbx
mov r8, rsi
mov rdx, r14
mov rcx, r15
call qword [sym.imp.USER32.dll_CreateDialogIndirectParamA]
mov rsi, rax
mov qword [rsp + 0x38], rax
cmp dword [0x180108694], 0
je 0x180047be4
cmp dword [0x180108690], 0
jne 0x180047c11
mov ebx, edi
test rsi, rsi
sete bl
test ebx, ebx
je 0x180047bf8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rdx, qword [rsp + 0x30]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x180047c11
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rsi
jmp 0x180047b89
Function at 0x180047c20
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push r15
sub rsp, 0x70
mov edi, r9d
mov rsi, r8
mov r14, rdx
mov r15d, ecx
xor ebx, ebx
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x60], rbx
cmp dword [0x180108694], ebx
jne 0x180047cfe
mov eax, dword [0x180108690]
test eax, eax
jne 0x180047cfe
mov r9d, dword [0x18010869c]
test r9d, r9d
je 0x180047c92
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x180108690]
mov r9d, dword [0x18010869c]
test eax, eax
jne 0x180047cfe
test r9d, r9d
jne 0x180047ca4
call fcn.1800021b0
test eax, eax
je 0x180047cba
lea rdx, [rsp + 0x60]
mov rcx, qword [section..data]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
test eax, eax
jne 0x180047cfe
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [rax - 0x7e]
cmp ecx, 1
jbe 0x180047cf4
cmp eax, 0x78
je 0x180047cf4
cmp eax, 1
je 0x180047cf4
cmp eax, 0x32
je 0x180047cf4
xor eax, eax
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret
mov dword [0x180108690], 1
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0xb8]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0xb0]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0xa8]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0xa0]
mov dword [rsp + 0x20], eax
mov r9d, edi
mov r8, rsi
mov rdx, r14
mov ecx, r15d
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov rsi, rax
mov qword [rsp + 0x68], rax
cmp dword [0x180108694], 0
je 0x180047d8a
cmp dword [0x180108690], 0
jne 0x180047db8
mov edi, ebx
test rsi, rsi
sete dil
test edi, edi
je 0x180047d9f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test edi, edi
je 0x180047db8
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rsi
jmp 0x180047cd9
Function at 0x180047dc0
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, qword [0x180109580]
mov qword [rsp + 0x30], 0
cmp dword [0x180108694], 0
jne 0x180047e5a
mov eax, dword [0x180108690]
test eax, eax
jne 0x180047e5a
mov ecx, dword [0x18010869c]
test ecx, ecx
je 0x180047e0c
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x180108690]
mov ecx, dword [0x18010869c]
test eax, eax
jne 0x180047e5a
test ecx, ecx
jne 0x180047e1d
call fcn.1800021b0
test eax, eax
je 0x180047e33
lea rdx, [rsp + 0x30]
mov rcx, qword [section..data]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
test eax, eax
jne 0x180047e5a
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [rax - 0x7e]
cmp ecx, 1
jbe 0x180047e50
cmp eax, 0x78
je 0x180047e50
cmp eax, 1
je 0x180047e50
cmp eax, 0x32
jne 0x180047ea2
mov dword [0x180108690], 1
test rbx, rbx
jne 0x180047e7a
lea rcx, str.InitCommonControls
call fcn.180045e60
mov rbx, rax
test rax, rax
je 0x180047e7d
mov qword [0x180109580], rax
call rbx
nop
cmp dword [0x180108694], 0
je 0x180047e8f
cmp dword [0x180108690], 0
jne 0x180047ea2
mov rdx, qword [rsp + 0x30]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
add rsp, 0x20
pop rbx
ret
add rsp, 0x20
pop rbx
ret

Function at 0x180047eb0
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x20
mov eax, dword [0x18010869c]
mov rbx, rcx
test eax, eax
je 0x180047ed6
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x18010869c]
cmp dword [0x180108690], 0
jne 0x180047f2f
test eax, eax
jne 0x180047eec
call fcn.1800021b0
test eax, eax
je 0x180047f00
mov rcx, qword [section..data]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
test eax, eax
jne 0x180047f2f
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [rax - 0x7e]
cmp ecx, 1
jbe 0x180047f25
cmp eax, 0x78
je 0x180047f25
cmp eax, 1
je 0x180047f25
cmp eax, 0x32
je 0x180047f25
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov dword [0x180108690], 1
mov eax, 1
add rsp, 0x20
pop rbx
ret
Function at 0x180047f50
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rdi, rdx
mov rsi, rcx
xor ebx, ebx
mov dword [rsp + 0x20], ebx
mov qword [rsp + 0x50], rbx
cmp dword [0x180108694], ebx
jne 0x180048011
mov eax, dword [0x180108690]
test eax, eax
jne 0x180048011
mov r8d, dword [0x18010869c]
test r8d, r8d
je 0x180047fb0
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x180108690]
mov r8d, dword [0x18010869c]
test eax, eax
jne 0x180048011
test r8d, r8d
jne 0x180047fc2
call fcn.1800021b0
test eax, eax
je 0x180047fd8
lea rdx, [rsp + 0x50]
mov rcx, qword [section..data]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
test eax, eax
jne 0x180048011
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [rax - 0x7e]
cmp ecx, 1
jbe 0x180048007
cmp eax, 0x78
je 0x180048007
cmp eax, 1
je 0x180048007
cmp eax, 0x32
je 0x180048007
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov dword [0x180108690], 1
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.USER32.dll_UnregisterClassA]
mov esi, eax
mov dword [rsp + 0x20], eax
cmp dword [0x180108694], 0
je 0x180048035
cmp dword [0x180108690], 0
jne 0x180048062
mov edi, ebx
test esi, esi
sete dil
test edi, edi
je 0x180048049
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rdx, qword [rsp + 0x50]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test edi, edi
je 0x180048062
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x180065d30
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
xor edi, edi
mov esi, edi
mov dword [rsp + 0x20], edi
mov rbx, qword [0x180109eb8]
mov qword [rsp + 0x48], rdi
cmp dword [0x180108694], edi
jne 0x180065e01
mov eax, dword [0x180108690]
test eax, eax
jne 0x180065e01
mov edx, dword [0x18010869c]
test edx, edx
je 0x180065d99
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x180108690]
mov edx, dword [0x18010869c]
test eax, eax
jne 0x180065e01
test edx, edx
jne 0x180065daa
call fcn.1800021b0
test eax, eax
je 0x180065dc0
lea rdx, [rsp + 0x48]
mov rcx, qword [section..data]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
test eax, eax
jne 0x180065e01
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
add eax, 0xffffff82
cmp eax, 1
jbe 0x180065df7
cmp ecx, 0x78
je 0x180065df7
cmp ecx, 1
je 0x180065df7
cmp ecx, 0x32
je 0x180065df7
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
mov dword [0x180108690], 1
test rbx, rbx
jne 0x180065e21
lea rcx, str.ChooseColorA
call fcn.180065c60
mov rbx, rax
test rax, rax
je 0x180065e2c
mov qword [0x180109eb8], rax
mov rcx, r14
call rbx
mov esi, eax
mov dword [rsp + 0x20], eax
cmp dword [0x180108694], 0
je 0x180065e3e
cmp dword [0x180108690], 0
jne 0x180065e6a
mov ebx, edi
test esi, esi
sete bl
test ebx, ebx
je 0x180065e51
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x180065e6a
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
jmp 0x180065de1
Function at 0x180065e80
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push r15
sub rsp, 0x40
mov rbx, r9
mov rsi, r8
mov r14, rdx
mov r15, rcx
xor edi, edi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
cmp dword [0x180108694], edi
jne 0x180065f5e
mov eax, dword [0x180108690]
test eax, eax
jne 0x180065f5e
mov r9d, dword [0x18010869c]
test r9d, r9d
je 0x180065ef2
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x180108690]
mov r9d, dword [0x18010869c]
test eax, eax
jne 0x180065f5e
test r9d, r9d
jne 0x180065f04
call fcn.1800021b0
test eax, eax
je 0x180065f1a
lea rdx, [rsp + 0x30]
mov rcx, qword [section..data]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
test eax, eax
jne 0x180065f5e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [rax - 0x7e]
cmp ecx, 1
jbe 0x180065f54
cmp eax, 0x78
je 0x180065f54
cmp eax, 1
je 0x180065f54
cmp eax, 0x32
je 0x180065f54
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
mov r14, qword [rsp + 0x68]
add rsp, 0x40
pop r15
ret
mov dword [0x180108690], 1
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9, rbx
mov r8, rsi
mov rdx, r14
mov rcx, r15
call qword [sym.imp.USER32.dll_CreateDialogParamA]
mov rsi, rax
mov qword [rsp + 0x38], rax
cmp dword [0x180108694], 0
je 0x180065f94
cmp dword [0x180108690], 0
jne 0x180065fc1
mov ebx, edi
test rsi, rsi
sete bl
test ebx, ebx
je 0x180065fa8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rdx, qword [rsp + 0x30]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x180065fc1
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rsi
jmp 0x180065f39
Function at 0x180065fd0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push r13
push r14
push r15
sub rsp, 0x70
mov r14d, r9d
mov r15d, r8d
mov r12d, edx
mov r13d, ecx
xor ebx, ebx
mov esi, ebx
mov qword [rsp + 0x68], rbx
mov rdi, qword [0x180109ec8]
mov qword [rsp + 0x60], rbx
cmp dword [0x180108694], ebx
jne 0x1800660bd
mov eax, dword [0x180108690]
test eax, eax
jne 0x1800660bd
mov edx, dword [0x18010869c]
test edx, edx
je 0x18006604c
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x180108690]
mov edx, dword [0x18010869c]
test eax, eax
jne 0x1800660bd
test edx, edx
jne 0x18006605d
call fcn.1800021b0
test eax, eax
je 0x180066073
lea rdx, [rsp + 0x60]
mov rcx, qword [section..data]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
test eax, eax
jne 0x1800660bd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
add eax, 0xffffff82
cmp eax, 1
jbe 0x1800660b3
cmp ecx, 0x78
je 0x1800660b3
cmp ecx, 1
je 0x1800660b3
cmp ecx, 0x32
je 0x1800660b3
xor eax, eax
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret
mov dword [0x180108690], 1
test rdi, rdi
jne 0x1800660dd
lea rcx, str.CreateUpDownControl
call fcn.180045e60
mov rdi, rax
test rax, rax
je 0x180066151
mov qword [0x180109ec8], rax
mov eax, dword [rsp + 0xe8]
mov dword [rsp + 0x58], eax
mov eax, dword [rsp + 0xe0]
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0xd8]
mov dword [rsp + 0x48], eax
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0x38], rax
mov eax, dword [rsp + 0xc0]
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0xb0]
mov dword [rsp + 0x20], eax
mov r9d, r14d
mov r8d, r15d
mov edx, r12d
mov ecx, r13d
call rdi
mov rsi, rax
mov qword [rsp + 0x68], rax
cmp dword [0x180108694], 0
je 0x180066163
cmp dword [0x180108690], 0
jne 0x180066191
mov edi, ebx
test rsi, rsi
sete dil
test edi, edi
je 0x180066178
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test edi, edi
je 0x180066191
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rsi
jmp 0x180066094
Function at 0x1800661a0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rdi, rcx
xor ebx, ebx
mov word [rsp + 0x20], bx
mov qword [rsp + 0x48], rbx
cmp dword [0x180108694], ebx
jne 0x18006625c
mov eax, dword [0x180108690]
test eax, eax
jne 0x18006625c
mov edx, dword [0x18010869c]
test edx, edx
je 0x1800661fb
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x180108690]
mov edx, dword [0x18010869c]
test eax, eax
jne 0x18006625c
test edx, edx
jne 0x18006620c
call fcn.1800021b0
test eax, eax
je 0x180066222
lea rdx, [rsp + 0x48]
mov rcx, qword [section..data]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
test eax, eax
jne 0x18006625c
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [rax - 0x7e]
cmp ecx, 1
jbe 0x180066252
cmp eax, 0x78
je 0x180066252
cmp eax, 1
je 0x180066252
cmp eax, 0x32
je 0x180066252
movzx eax, bx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov dword [0x180108690], 1
mov rcx, rdi
call qword [sym.imp.USER32.dll_RegisterClassA]
movzx esi, ax
mov word [rsp + 0x20], ax
cmp dword [0x180108694], 0
je 0x18006627f
cmp dword [0x180108690], 0
jne 0x1800662ad
mov edi, ebx
test si, si
sete dil
test edi, edi
je 0x180066294
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test edi, edi
je 0x1800662ad
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
movzx eax, si
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret