joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140018ad8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov r14, r8
mov rbx, rdx
mov r15, rcx
xor edi, edi
call fcn.1400321b4
lea r8d, [rdi + 5]
mov rdx, rbx
mov rbp, qword [rax + 0x18]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
test rax, rax
je 0x140018b34
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
mov r9, rbp
mov r8, r14
mov rdx, rdi
mov rcx, r15
call fcn.140018b6c
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rbp, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret

Function at 0x140019780
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x40
mov rdi, r9
mov rsi, r8
mov r14, rdx
mov r15, rcx
and qword [rax - 0x10], 0
and qword [rax - 0x18], 0
xor ebx, ebx
mov eax, dword [0x1403ee544]
test eax, eax
je 0x1400197d2
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x1403ee544]
test eax, eax
jne 0x1400197db
call fcn.1400198e8
test eax, eax
je 0x1400197f7
lea rdx, [rsp + 0x30]
mov rcx, qword [0x1403e2448]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne ebx, ecx
test ebx, ebx
jne 0x1400197ff
xor eax, eax
jmp 0x140019857
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9, rdi
mov r8, rsi
mov rdx, r14
mov rcx, r15
call qword [sym.imp.USER32.dll_CreateDialogIndirectParamW]
mov rsi, rax
mov qword [rsp + 0x38], rax
xor ebx, ebx
test rax, rax
sete bl
test ebx, ebx
je 0x140019839
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x14001983b
xor edi, edi
mov rdx, qword [rsp + 0x30]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x140019854
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
mov r14, qword [rsp + 0x68]
add rsp, 0x40
pop r15
ret
Function at 0x14001ad88
Capabilities:
Check os version

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x160
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x1403e39c0]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rdi, rdx
mov rbx, rcx
mov qword [rsp + 0x28], rcx
call fcn.140019b04
nop
lea rax, vtable.CWinApp.0
mov qword [rbx], rax
xor esi, esi
test rdi, rdi
je 0x14001ade9
mov rcx, rdi
call fcn.14028b74c
mov qword [rbx + 0xa0], rax
jmp 0x14001adf0
mov qword [rbx + 0xa0], rsi
call fcn.1400321b4
mov rdi, rax
mov ecx, esi
test rax, rax
setne cl
test ecx, ecx
jne 0x14001ae0a
call fcn.140010b1c
int3
lea rcx, [rax + 0xc0]
lea rdx, [0x14001a1b8]
call fcn.14003f3d0
mov ecx, esi
test rax, rax
setne cl
test ecx, ecx
jne 0x14001ae2f
call fcn.140010b1c
int3
mov qword [rax + 8], rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rbx + 0x58], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rbx + 0x60], eax
mov qword [rdi + 8], rbx
mov qword [rbx + 0x88], rsi
mov qword [rbx + 0x100], rsi
mov qword [rbx + 0xd0], rsi
mov qword [rbx + 0xd8], rsi
mov qword [rbx + 0xb0], rsi
mov qword [rbx + 0xc8], rsi
mov qword [rbx + 0xa8], rsi
mov qword [rbx + 0x118], rsi
mov qword [rbx + 0xb8], rsi
mov qword [rbx + 0x130], rsi
mov qword [rbx + 0x90], rsi
mov qword [rbx + 0x128], rsi
mov qword [rbx + 0x120], rsi
mov dword [rbx + 0x108], esi
mov qword [rbx + 0x110], rsi
mov qword [rbx + 0xe8], rsi
mov qword [rbx + 0xf0], rsi
mov qword [rbx + 0x140], rsi
mov dword [rbx + 0xc0], esi
mov dword [rbx + 0xe0], esi
mov qword [rbx + 0x138], 0x200
mov dword [rbx + 0x14c], esi
mov dword [rbx + 0x150], 0x493e0
mov edi, 1
mov dword [rbx + 0x154], edi
mov dword [rsp + 0x30], 0x114
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rsp + 0x34], 6
jne 0x14001af1e
cmp dword [rsp + 0x38], edi
jae 0x14001af22
cmp dword [rsp + 0x34], 6
mov eax, esi
jbe 0x14001af24
mov eax, edi
mov dword [rbx + 0x158], eax
mov dword [rbx + 0x15c], esi
mov qword [rbx + 0x168], rsi
mov qword [rbx + 0x170], rsi
mov dword [rbx + 0x160], edi
mov rax, rbx
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1402410d0
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14001d5a0
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rsi, r9
mov r14, r8
and qword [r9], 0
mov rbx, qword [rbp + 0x40]
and dword [rbx], 0
cmp qword [rcx + 0xb0], 0
je 0x14001d67f
xor r8d, r8d
call fcn.14001da40
mov rdi, rax
test rax, rax
je 0x14001d75a
mov qword [rbp - 0x18], rax
and dword [rbp - 0x10], 0
and qword [rbp - 8], 0
and dword [rbp + 0x20], 0
and dword [rbp + 0x40], 0
lea rax, [rbp + 0x40]
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
lea r9, [rbp + 0x20]
xor r8d, r8d
mov rdx, r14
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [rbp + 0x40]
mov dword [rbx], ecx
test eax, eax
jne 0x14001d663
call fcn.140011164
mov qword [rsi], rax
lea rcx, [rbp + 0x40]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x20]
xor r8d, r8d
mov rdx, r14
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001d663
lea ebx, [rax + 1]
jmp 0x14001d671
mov rcx, qword [rsi]
call fcn.140010948
and qword [rsi], 0
xor ebx, ebx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14001d758
mov rax, qword [rcx]
and qword [rsp + 0x20], 0
mov r9, r8
mov r8, rdx
lea rdx, [rbp + 0x38]
call qword [rax + 0x108]
nop
mov rax, qword [rbp + 0x38]
movsxd rcx, dword [rax - 0x10]
test ecx, ecx
jne 0x14001d6ac
xor ebx, ebx
jmp 0x14001d73e
mov rdi, rcx
shr ecx, 1
mov dword [rbx], ecx
call fcn.140011164
mov qword [rsi], rax
xor edx, edx
lea ebx, [rdx + 1]
test rdi, rdi
jle 0x14001d73a
xor r9d, r9d
mov r10d, ebx
test r10, r10
js 0x14001d72f
mov rax, qword [rbp + 0x38]
lea ecx, [rdx + 1]
cmp ecx, dword [rax - 0x10]
jg 0x14001d72f
movzx r8d, word [r9 + rax + 2]
test edx, edx
js 0x14001d724
cmp edx, dword [rax - 0x10]
jg 0x14001d724
sub r8b, bl
shl r8b, 4
sub r8b, 0x41
add r8b, byte [r9 + rax]
mov eax, edx
test edx, edx
jns 0x14001d703
lea eax, [rbx + rdx]
sar eax, 1
movsxd rcx, eax
mov rax, qword [rsi]
mov byte [rcx + rax], r8b
add edx, 2
add r10, 2
add r9, 4
movsxd rax, edx
cmp rax, rdi
jl 0x14001d6cb
jmp 0x14001d73a
mov ecx, 0x80070057
call fcn.140004b6c
int3
mov ecx, 0x80070057
call fcn.140004b6c
int3
mov rax, qword [rbp + 0x38]
lea rdx, [rax - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14001d758
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, ebx
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x14001d770
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
cmp qword [rcx + 0xb0], 0
mov edi, r9d
mov rbx, r8
mov rax, rdx
je 0x14001d7ea
xor r8d, r8d
call fcn.14001da40
mov rsi, rax
test rax, rax
jne 0x14001d7a6
mov eax, edi
jmp 0x14001d800
lea rax, [rsp + 0x50]
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x34]
lea rax, [rsp + 0x30]
xor r8d, r8d
mov rdx, rbx
mov qword [rsp + 0x20], rax
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
cmove edi, dword [rsp + 0x30]
jmp 0x14001d7a2
mov r9, qword [rcx + 0xd8]
mov r8d, edi
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x14001dec4
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x30
xor edi, edi
mov rbx, r9
mov r12, r8
mov r15, rdx
mov rsi, rcx
cmp qword [rcx + 0xb0], rdi
je 0x14001df46
xor r8d, r8d
call fcn.14001da40
mov rsi, rax
test rax, rax
je 0x14001dfd4
mov ecx, dword [rsp + 0x70]
mov r9d, 3
mov dword [rsp + 0x28], ecx
xor r8d, r8d
mov rcx, rax
mov qword [rsp + 0x20], rbx
mov rdx, r12
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
sete dil
mov eax, edi
jmp 0x14001dfd4
mov ebp, dword [rsp + 0x70]
mov eax, 2
lea ecx, [rbp*2 + 1]
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.140011164
mov r14, rax
mov r8d, edi
test ebp, ebp
je 0x14001dfaa
mov rdx, rax
mov r8d, ebp
mov r9d, ebp
mov al, byte [rbx]
and al, 0xf
movzx ecx, al
add cx, 0x41
mov word [rdx], cx
lea rdx, [rdx + 4]
mov al, byte [rbx]
inc rbx
shr al, 4
movzx ecx, al
add cx, 0x41
mov word [rdx - 2], cx
sub r9, 1
jne 0x14001df7f
lea eax, [r8 + r8]
mov r9, r14
mov word [r14 + rax*2], di
mov r8, r12
mov rax, qword [rsi]
mov rdx, r15
mov rcx, rsi
call qword [rax + 0x110]
mov rcx, r14
mov ebx, eax
call fcn.140010948
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r12
ret
Function at 0x14001e480
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x2a0
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov rax, qword [0x1403e39c0]
xor rax, rsp
mov qword [rsp + 0x290], rax
mov rdi, r8
mov qword [rsp + 0x38], r8
mov rsi, rcx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x60], r8
mov rcx, qword [rdx]
sub rcx, 0x18
call fcn.1400143f8
lea rbx, [rax + 0x18]
mov qword [rsp + 0x30], rbx
cmp rsi, 0xffffffff80000000
jne 0x14001e538
call fcn.140032230
cmp eax, 1
jne 0x14001e538
lea r8, [rsp + 0x30]
lea rdx, str.SoftwareClasses_
lea rcx, [rsp + 0x58]
call fcn.14001e340
nop
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.140014074
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14001e527
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rsi, 0xffffffff80000001
mov qword [rsp + 0x50], rsi
mov rbx, qword [rsp + 0x30]
lea rax, [rsp + 0x40]
test rdi, rdi
je 0x14001e562
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x2001f
xor r9d, r9d
mov r8, rbx
mov rdx, rsi
mov rcx, rdi
call fcn.14001dc58
jmp 0x14001e57c
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test eax, eax
jne 0x14001e667
mov r9d, 0x104
lea r8, [rsp + 0x80]
xor edx, edx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov edi, eax
test eax, eax
jne 0x14001e623
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x48]
call fcn.140010f60
nop
mov r8, qword [rsp + 0x38]
lea rdx, [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
call fcn.14001e480
mov edi, eax
test eax, eax
setne bl
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14001e5f4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test bl, bl
je 0x14001e604
mov rbx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x38]
jmp 0x14001e628
mov rbx, qword [rsp + 0x30]
jmp 0x14001e586
mov rax, qword [rsp + 0x38]
cmp edi, 0x103
je 0x14001e638
cmp edi, 0x3f2
jne 0x14001e65b
test rax, rax
je 0x14001e64d
mov r8, rbx
mov rdx, rsi
mov rcx, rax
call fcn.14001eb60
jmp 0x14001e659
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov edi, eax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14001e681
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, edi
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.1402410d0
add rsp, 0x2a0
pop rdi
pop rsi
pop rbx
ret
Function at 0x14001eb60
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx], 0
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
je 0x14001ebc3
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14001ebd7
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14001ebd7
mov rcx, qword [rbx]
xor r9d, r9d
and qword [rsp + 0x28], 0
xor r8d, r8d
mov qword [rsp + 0x20], rcx
mov rdx, rdi
mov rcx, rsi
call rax
jmp 0x14001ebdc
cmp dword [rcx + 8], 0
je 0x14001ebd7
mov rdx, r8
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x14001ebdc
mov eax, 1
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x140020238
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
xor edi, edi
xor ebx, ebx
mov r14, r9
mov rsi, r8
mov rbp, rdx
mov r12, rcx
test r8, r8
je 0x1400202aa
call fcn.1400321b4
mov r8d, 0xf0
mov rdx, rsi
mov r15, qword [rax + 0x18]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x1400202aa
mov rdx, rax
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbx, rax
test rax, rax
je 0x1400202f3
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
mov esi, 1
test rdi, rdi
je 0x1400202d8
mov r10, qword [r12]
mov r9, r14
mov r8, rdi
mov rdx, rbp
mov rcx, r12
call qword [r10 + 0x40]
mov esi, eax
test rbx, rbx
je 0x1400202d8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rcx, qword [rbp + 0xc8]
test rcx, rcx
je 0x1400202f1
mov r8, qword [rcx]
mov rdx, r14
call qword [r8 + 0x140]
mov eax, esi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x1400360a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
xor edi, edi
xor ebx, ebx
mov rsi, rdx
mov r14, rcx
test rdx, rdx
je 0x140036108
call fcn.1400321b4
mov r8d, 0xf0
mov rdx, rsi
mov rbp, qword [rax + 0x18]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x140036108
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbx, rax
test rax, rax
je 0x14003612a
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
mov rdx, rdi
mov rcx, r14
call fcn.140049494
mov esi, eax
test rdi, rdi
je 0x140036128
test rbx, rbx
je 0x140036128
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140037734
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rsi, rdx
mov rbx, rcx
test rcx, rcx
je 0x14003780c
mov rcx, qword [rcx + 0x40]
test rcx, rcx
je 0x14003780c
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x14003780c
test rsi, rsi
je 0x14003780c
xor r15d, r15d
xor ebp, ebp
xor edi, edi
call fcn.1400321b4
lea r8, str.AFX_DIALOG_LAYOUT
mov rdx, rsi
mov r14, qword [rax + 0x18]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rsi, rax
test rax, rax
je 0x1400377d9
mov rdx, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rdx, rsi
mov rcx, r14
mov r15d, eax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rdi, rax
test rax, rax
je 0x14003780c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbp, rax
mov r8d, r15d
mov rdx, rbp
mov rcx, rbx
call fcn.1400fe248
mov esi, eax
test rbp, rbp
je 0x1400377fc
test rdi, rdi
je 0x1400377fc
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeResource]
test esi, esi
je 0x140037808
mov rcx, rbx
call fcn.140037304
mov eax, esi
jmp 0x14003780e
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret

Function at 0x1400387d0
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, rcx
mov rbx, r8
mov rcx, qword [rcx + 0x40]
call fcn.140048950
mov rdi, rax
test rax, rax
je 0x14003884c
mov rcx, rax
call qword [sym.imp.USER32.dll_GetDlgCtrlID]
mov esi, eax
test rbx, rbx
je 0x140038847
cmp dword [rbx], 0x40
jb 0x140038847
mov rcx, qword [rbp + 0x40]
xor r9d, r9d
or dword [rbx + 4], 1
xor r8d, r8d
or qword [rbx + 0x30], 0xffffffffffffffff
mov edx, 0x87
mov qword [rbx + 8], rcx
mov rcx, rdi
mov qword [rbx + 0x10], rdi
call qword [sym.imp.USER32.dll_SendMessageW]
bt rax, 0xd
jb 0x140038847
or dword [rbx + 4], 0x80000002
mov rax, rsi
jmp 0x140038850
or rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14003c780
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x70
mov edi, r9d
mov rsi, r8
mov r14, rdx
mov r15d, ecx
and qword [rax - 0x10], 0
and qword [rax - 0x18], 0
xor ebx, ebx
mov eax, dword [0x1403ee544]
test eax, eax
je 0x14003c7d2
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x1403ee544]
test eax, eax
jne 0x14003c7db
call fcn.1400198e8
test eax, eax
je 0x14003c7f7
lea rdx, [rsp + 0x60]
mov rcx, qword [0x1403e2448]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne ebx, ecx
test ebx, ebx
jne 0x14003c802
xor eax, eax
jmp 0x14003c8b0
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0xb8]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0xb0]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0xa8]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0xa0]
mov dword [rsp + 0x20], eax
mov r9d, edi
mov r8, rsi
mov rdx, r14
mov ecx, r15d
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov rsi, rax
mov qword [rsp + 0x68], rax
xor ebx, ebx
test rax, rax
sete bl
test ebx, ebx
je 0x14003c892
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x14003c894
xor edi, edi
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x14003c8ad
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rsi
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret
Function at 0x14003c8cc
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push r14
sub rsp, 0x30
mov rdi, r8
mov rsi, rdx
mov r14, rcx
and dword [rax - 0x18], 0
and qword [rax + 0x20], 0
xor ebx, ebx
mov eax, dword [0x1403ee544]
test eax, eax
je 0x14003c916
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x1403ee544]
test eax, eax
jne 0x14003c91f
call fcn.1400198e8
test eax, eax
je 0x14003c93b
lea rdx, [rsp + 0x58]
mov rcx, qword [0x1403e2448]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne ebx, ecx
test ebx, ebx
jne 0x14003c943
xor eax, eax
jmp 0x14003c98a
mov r8, rdi
mov rdx, rsi
mov rcx, r14
call qword [sym.imp.USER32.dll_GetClassInfoExW]
mov edi, eax
mov dword [rsp + 0x20], eax
xor ebx, ebx
test eax, eax
sete bl
test ebx, ebx
je 0x14003c96d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x14003c96f
xor esi, esi
mov rdx, qword [rsp + 0x58]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x14003c988
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r14
ret

Function at 0x14003c9a0
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
xor edi, edi
mov dword [rax - 0x18], edi
mov rbx, qword [0x1403f1af8]
and qword [rax + 0x10], rdi
xor esi, esi
mov eax, dword [0x1403ee544]
test eax, eax
je 0x14003c9eb
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x1403ee544]
test eax, eax
jne 0x14003c9f4
call fcn.1400198e8
test eax, eax
je 0x14003ca10
lea rdx, [rsp + 0x48]
mov rcx, qword [0x1403e2448]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne 0x14003ca18
xor eax, eax
jmp 0x14003ca75
test rbx, rbx
jne 0x14003ca38
lea rcx, [0x1402e6c78]
call fcn.14002cea8
mov rbx, rax
test rax, rax
je 0x14003ca43
mov qword [0x1403f1af8], rax
mov rcx, r14
call rbx
mov edi, eax
mov dword [rsp + 0x20], eax
xor ebx, ebx
test edi, edi
sete bl
test ebx, ebx
je 0x14003ca58
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x14003ca5a
xor esi, esi
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x14003ca73
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret