joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140008140
Capabilities:
Create thread
Resume thread

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
mov rdi, rcx
mov rsi, rdx
mov rbx, r8
mov rbp, r9
call sym.pop_pthread_mem
mov r12, rax
test rax, rax
je 0x1400083a9
test rdi, rdi
je 0x14000817a
mov rax, qword [rax + 0x1d8]
mov qword [rdi], rax
mov r13, qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [r12 + 8], rbp
mov dword [r12 + 0x44], 1
mov rbp, qword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [r12 + 0xbc], 0
mov r14, r13
mov qword [r12 + 0x28], 0xffffffffffffffff
mov qword [r12 + 0x10], rbx
xor ebx, ebx
xor r9d, r9d
xor r8d, r8d
mov edx, 1
xor ecx, ecx
call rbp
mov qword [r12 + 0x30], rax
test rax, rax
jne 0x1400081e7
add ebx, 1
cmp ebx, 1
je 0x1400082f0
mov ecx, 0x14
call r14
cmp ebx, 5
jne 0x1400081b5
mov qword [r12 + 0x38], 0xffffffffffffffff
lea r14, [r12 + 0x68]
mov rcx, r14
call sym.pthread_spin_destroy
cmp eax, 1
je 0x1400083ef
cmp qword [r12 + 0x30], 0
mov qword [r12 + 0x68], 0xffffffffffffffff
mov dword [r12], 0xbab1f00d
mov dword [r12 + 0xc0], 0
mov dword [r12 + 0xb8], 0
je 0x140008392
xor edx, edx
test rsi, rsi
je 0x14000825f
mov eax, dword [rsi]
mov edx, dword [rsi + 0x10]
mov dword [r12 + 0x44], eax
test al, 8
jne 0x1400083c0
mov eax, dword [rsi + 0x18]
mov dword [r12 + 0xc0], eax
lea r8, [sym.pthread_create_wrapper]
mov r9, r12
xor ecx, ecx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 4
call qword [sym.imp.msvcrt.dll__beginthreadex]
mov r13, rax
lea rax, [rax - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140008350
mov eax, dword [r12 + 0xc0]
mov edx, 0xfffffff1
cmp eax, 0xfffffff2
jge 0x140008320
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov rcx, qword [r12 + 0x30]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
test byte [r12 + 0x44], 4
jne 0x140008300
mov qword [r12 + 0x28], r13
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_ResumeThread]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
xor ecx, ecx
call r13
jmp 0x1400081b5
mov qword [r12 + 0x28], 0
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400082cf
mov edx, 0xfffffffe
cmp eax, 0xffffffff
jl 0x1400082a5
mov edx, 0xf
cmp eax, 0xe
jg 0x1400082a5
cmp eax, 2
mov edx, 2
cmovle edx, eax
jmp 0x1400082a5
mov rcx, qword [r12 + 0x30]
test rcx, rcx
je 0x140008360
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [r12 + 0x38]
call sym.pthread_mutex_destroy
mov rcx, r14
call sym.pthread_spin_destroy
cmp eax, 1
je 0x1400083ef
mov qword [r12 + 0x68], 0xffffffffffffffff
mov qword [r12 + 0x30], 0
mov qword [r12 + 0x28], 0
test rdi, rdi
je 0x14000839e
mov qword [rdi], 0
cmp qword [r12 + 0x1d0], 0
je 0x1400083e0
mov eax, 0xb
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov dword [rsp + 0x3c], edx
call sym.__pthread_self_lite
mov edx, dword [rsp + 0x3c]
mov eax, dword [rax + 0xc0]
mov dword [r12 + 0xc0], eax
jmp 0x14000825f
mov rcx, r12
call sym.push_pthread_mem.part.0
mov eax, 0xb
jmp 0x1400083ae
call sym.replace_spin_keys.part.0
nop
nop word cs:[rax + rax]
Function at 0x140008e30
Capabilities:
Print debug messages

Disassembly:
push r12
push rbx
sub rsp, 0x58
mov r12, rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x140008e50
add rsp, 0x58
pop rbx
pop r12
ret
lea rdx, [rsp + 0x48]
mov r9d, 0x400
mov r8d, eax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x20], rdx
mov ecx, 0x1100
xor edx, edx
mov dword [rsp + 0x28], 0
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
test eax, eax
jne 0x140008e98
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x140008e44
int3
mov rcx, qword [rsp + 0x48]
mov rbx, qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call rbx
mov rcx, r12
call rbx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x140008e85

Function at 0x140008ec0
Capabilities:
Check mutex on windows

Disassembly:
push r12
sub rsp, 0x20
xor edx, edx
xor ecx, ecx
lea r8, [0x14001f2c0]
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov edx, 0xffffffff
mov r12, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x140008f78
mov rdx, qword [0x14001f200]
lea rcx, [0x14001f200]
mov rax, qword [rdx + 8]
test rax, rax
je 0x140008f48
cmp rdx, rcx
jne 0x140008f2a
mov qword [rdx], rax
cmp rax, rcx
je 0x140008f2f
nop dword [rax]
test rax, rax
je 0x140008f5a
mov rdx, qword [rdx]
mov qword [rax], rdx
mov rdx, rax
mov rax, qword [rdx + 8]
cmp rax, rcx
jne 0x140008f18
mov rax, qword [rcx + 8]
mov qword [rdx + 8], rax
test rax, rax
je 0x140008f5a
mov rdx, rax
jmp 0x140008f26
lea rcx, [0x14001f300]
call qword [sym.imp.KERNEL32.dll_FindAtomA]
test ax, ax
jne 0x140008f96
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add rsp, 0x20
pop r12
ret
lea rcx, str.failed_to_to_lock_cleanup_mutex_n
call sym.__shmem_get_error
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add rsp, 0x20
pop r12
ret
movzx ecx, ax
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
jmp 0x140008f5a
Function at 0x140007540
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, rcx
lea rdi, str.GlobalEaseusOfficeSharedRead
mov r8, rdi
xor edx, edx
mov ecx, 0xf001f
call qword [sym.imp.KERNEL32.dll_OpenFileMappingW]
test rax, rax
jne 0x140007589
mov qword [rsp + 0x28], rdi
lea r8d, [rax + 4]
xor r9d, r9d
mov dword [rsp + 0x20], 0x6e00000
xor edx, edx
lea rcx, [rax - 1]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov qword [rbx], rax
test rax, rax
je 0x1400076e8
lea rdi, str.GlobalEaseusOfficeSharedWrite
xor edx, edx
mov r8, rdi
mov ecx, 0xf001f
call qword [sym.imp.KERNEL32.dll_OpenFileMappingW]
test rax, rax
jne 0x1400075d1
mov qword [rsp + 0x28], rdi
lea r8d, [rax + 4]
xor r9d, r9d
mov dword [rsp + 0x20], 0x6e00000
xor edx, edx
lea rcx, [rax - 1]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov qword [rbx + 8], rax
test rax, rax
je 0x1400076e8
lea r9, str.GlobalEaseusOfficeRepairReadEvent
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbx + 0x10], rax
test rax, rax
je 0x1400076e8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResetEvent]
lea r9, str.GlobalEaseusOfficeRepairWriteEvent
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbx + 0x18], rax
test rax, rax
je 0x1400076e8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResetEvent]
lea r9, str.GlobalEaseusOfficeRepairStopEvent
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov ecx, 0x3e8
mov qword [rbx + 0x20], rax
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edi, edi
lea r8, [0x140007ed0]
mov qword [rsp + 0x28], rdi
mov r9, rbx
xor edx, edx
mov dword [rsp + 0x20], edi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov r9, rbx
mov qword [rsp + 0x28], rdi
lea r8, [0x140008190]
mov qword [rbx + 0x28], rax
xor edx, edx
mov dword [rsp + 0x20], edi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov r9, rbx
mov qword [rsp + 0x28], rdi
lea r8, [0x140008350]
mov qword [rbx + 0x30], rax
xor edx, edx
mov dword [rsp + 0x20], edi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor r9d, r9d
mov qword [rsp + 0x28], rdi
lea r8, [0x140008430]
mov qword [rbx + 0x38], rax
xor edx, edx
mov dword [rsp + 0x20], edi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0x40], rax
mov al, 1
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400076f6
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140007705
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x140007714
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x140007723
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x140007732
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
mov al, 1
mov qword [rbx], rdi
mov qword [rbx + 8], rdi
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rdi
mov qword [rbx + 0x20], rdi
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x140008540
Capabilities:
Check mutex on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x100
mov rdi, r8
mov rsi, rcx
lea r8, str.GlobalEaseusOfficeRepair2020
xor ecx, ecx
mov edx, 1
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov rbx, rax
test rax, rax
je 0x14000858f
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x14000858f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000869a
xor r9d, r9d
mov r8, rdi
xor edx, edx
mov rcx, rsi
call fcn.14001463c
xorps xmm0, xmm0
xorps xmm1, xmm1
xor r8d, r8d
movdqa xmmword [rsp + 0x20], xmm0
xor edx, edx
movdqa xmmword [rsp + 0x30], xmm1
movdqa xmmword [rsp + 0x40], xmm0
movdqa xmmword [rsp + 0x50], xmm1
movdqa xmmword [rsp + 0x60], xmm0
movdqa xmmword [rsp + 0x70], xmm1
movdqa xmmword [rsp + 0x80], xmm0
call fcn.140008770
xor edi, edi
mov qword [rsp + 0x80], rax
lea rcx, [rsp + 0x98]
mov dword [rsp + 0x90], edi
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [rsp + 0xc0]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [rsp + 0x20]
mov dword [rsp + 0xe8], edi
mov qword [rsp + 0xf0], 0xffffffffffffffff
call fcn.140007540
lea r9, str.GlobalEaseusOfficeRepairQuitEvent
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rdi, rax
test rax, rax
jne 0x140008650
mov byte [0x140278072], 1
mov byte [0x140278073], 1
mov edx, 0xffffffff
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x40]
mov byte [0x140278073], 1
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rbx, rbx
je 0x140008690
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x20]
call fcn.140007390
lea r11, [rsp + 0x100]
xor eax, eax
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x14000a240
Capabilities:
Set file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x40
cmp byte [rcx + 0xa0], 0
mov rbx, rdx
mov rdi, rcx
je 0x14000a2ad
mov qword [rsp + 0x30], 0
mov r8, 0xffffffffffffffff
mov qword [rsp + 0x38], 0xf
mov byte [rsp + 0x20], 0
nop word [rax + rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x14000a280
lea rcx, [rsp + 0x20]
call fcn.140003aa0
lea rcx, [rdi + 0x78]
lea rdx, [rsp + 0x20]
call fcn.140006650
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
mov qword [rsp + 0x58], rsi
xor sil, sil
cmp qword [rcx + 0xd0], 0
je 0x14000a308
mov qword [rsp + 0x30], 0
mov r8, 0xffffffffffffffff
mov qword [rsp + 0x38], 0xf
mov byte [rsp + 0x20], sil
nop dword [rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x14000a2e0
lea rcx, [rsp + 0x20]
call fcn.140003aa0
mov rcx, qword [rdi + 0xd0]
lea rdx, [rsp + 0x20]
call fcn.140009410
movzx esi, al
cmp qword [rdi + 0xe0], 0xffffffffffffffff
je 0x14000a320
mov edx, 2
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov rbx, qword [rsp + 0x60]
movzx eax, sil
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret

Function at 0x14000a440
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push r14
sub rsp, 0x830
mov rax, qword [0x1402677d8]
xor rax, rsp
mov qword [rsp + 0x820], rax
mov rsi, rdx
mov rbp, rcx
test rdx, rdx
je 0x14000a57d
xor edx, edx
mov qword [rsp + 0x860], rdi
mov r8d, 0x7d0
lea rcx, [rsp + 0x50]
call fcn.140199110
mov rdi, 0xffffffffffffffff
mov rbx, rdi
inc rbx
cmp byte [rsi + rbx], 0
jne 0x14000a495
xor r14d, r14d
test rbx, rbx
je 0x14000a4ef
mov dword [rsp + 0x28], r14d
mov r9d, ebx
mov r8, rsi
mov qword [rsp + 0x20], r14
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea ecx, [rax - 1]
cmp ecx, 0x3e7
ja 0x14000a4ef
mov dword [rsp + 0x28], eax
mov r9d, ebx
lea rax, [rsp + 0x50]
mov r8, rsi
xor edx, edx
mov qword [rsp + 0x20], rax
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea rax, [rsp + 0x50]
inc rdi
cmp word [rax + rdi*2], r14w
jne 0x14000a4f4
mov qword [rsp + 0x30], r14
test rdi, rdi
mov rdi, qword [rsp + 0x860]
mov edx, 0xc0000000
mov dword [rsp + 0x28], 0x80
mov r8d, 3
mov dword [rsp + 0x20], 2
je 0x14000a53b
xor r9d, r9d
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
jmp 0x14000a547
xor r9d, r9d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14000a57d
mov r8d, dword [rbp + 0x38]
lea r9, [rsp + 0x40]
mov rdx, qword [rbp + 0x30]
mov rcx, rax
mov dword [rsp + 0x40], r14d
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x14000a57f
xor al, al
mov rcx, qword [rsp + 0x820]
xor rcx, rsp
call fcn.140197410
mov rbx, qword [rsp + 0x868]
add rsp, 0x830
pop r14
pop rsi
pop rbp
ret
Function at 0x14000cd10
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp dword [rcx + 0x10108], 0
mov rbx, rcx
je 0x14000cdd8
xor r11d, r11d
cmp dword [rcx + 0xd4], r11d
jbe 0x14000cdd8
nop word [rax + rax]
movzx eax, byte [r11 + rbx + 0x100]
mov r8, qword [rbx + 0x10138]
mov r10d, dword [rbx + 0x10130]
mov edx, dword [rbx + 0x10128]
and r10d, 0xfffd
xor rax, rdx
or r10d, 2
movzx ecx, al
shr edx, 8
mov eax, dword [r8 + rcx*4]
mov ecx, dword [rbx + 0x10130]
xor eax, edx
mov dword [rbx + 0x10128], eax
movzx eax, al
add eax, dword [rbx + 0x1012c]
imul eax, eax, 0x8088405
inc eax
mov dword [rbx + 0x1012c], eax
shr rax, 0x18
xor rax, rcx
shr ecx, 8
movzx eax, al
mov eax, dword [r8 + rax*4]
xor eax, ecx
mov dword [rbx + 0x10130], eax
mov eax, r10d
xor eax, 1
imul eax, r10d
shr eax, 8
xor byte [r11 + rbx + 0x100], al
inc r11d
cmp r11d, dword [rbx + 0xd4]
jb 0x14000cd40
mov r9d, dword [rbx + 0xd4]
lea r8, [rbx + 0x100]
mov rdx, qword [rbx + 0x58]
mov rcx, qword [rbx + 0x38]
mov edi, dword [rbx + 0xd4]
call qword [rbx + 0x10]
xor edx, edx
mov dword [rbx + 0xd4], 0
cmp eax, edi
mov ecx, 0xffffffff
cmovne edx, ecx
mov ecx, dword [rbx + 0x84]
add qword [rbx + 0x10118], rdi
mov eax, edx
add qword [rbx + 0x10120], rcx
mov dword [rbx + 0x84], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140018360
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rdi
push r14
push r15
sub rsp, 0x30
mov qword [rax - 0x28], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov r15, r8
movsxd rsi, edx
mov rdi, rcx
lea r14, [rcx + 0x28]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
test esi, esi
jle 0x140018498
cmp esi, dword [rdi + 0xc]
jge 0x140018498
mov ecx, dword [rdi]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x1400183cb
cmp esi, dword [rax + 0x10]
jl 0x140018486
test r15, r15
je 0x140018486
jmp 0x140018400
mov ecx, 0x20
call fcn.140017e9c
mov rbx, rax
test rbx, rbx
je 0x1400183e7
lea rax, vtable.CThreadData.0
mov qword [rbx], rax
and dword [rbx + 0x10], 0
and qword [rbx + 0x18], 0
mov rcx, qword [rdi + 0x20]
mov rax, qword [rdi + 0x18]
mov qword [rbx + rcx], rax
mov qword [rdi + 0x18], rbx
mov eax, dword [rdi + 0xc]
shl rax, 3
mov edx, dword [rsp + 0x58]
mov ecx, 0xffffffff
cmp qword [rbx + 0x18], 0
jne 0x14001842d
cmp rax, rcx
cmovbe edx, eax
ja 0x1400184b5
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
jmp 0x140018449
cmp rax, rcx
cmovbe edx, eax
ja 0x1400184c6
mov r8d, 2
mov rcx, qword [rbx + 0x18]
call qword [sym.imp.KERNEL32.dll_LocalReAlloc]
mov rcx, rax
test rax, rax
je 0x1400184d7
mov qword [rbx + 0x18], rcx
mov eax, dword [rdi + 0xc]
sub eax, dword [rbx + 0x10]
movsxd r8, eax
shl r8, 3
movsxd rax, dword [rbx + 0x10]
lea rcx, [rcx + rax*8]
xor edx, edx
call fcn.140199110
mov eax, dword [rdi + 0xc]
mov dword [rbx + 0x10], eax
mov rdx, rbx
mov ecx, dword [rdi]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x140018498
cmp esi, dword [rbx + 0x10]
jge 0x140018498
mov qword [rcx + rsi*8], r15
mov rcx, r14
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop rdi
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp rcx, rax
sbb ecx, ecx
and ecx, 0x80070216
call fcn.140015384
int3
cmp rcx, rax
sbb ecx, ecx
and ecx, 0x80070216
call fcn.140015384
int3
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.140014c10
int3
Function at 0x14001b218
Capabilities:
Get graphical window text

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x30
mov qword [rax - 0x18], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
movsxd rsi, r8d
mov rbx, rdx
mov rdi, rcx
xor ebp, ebp
cmp qword [rcx + 0xd0], rbp
jne 0x14001b25a
mov r8d, esi
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x14001b2fe
call fcn.140019f30
mov rcx, rax
test rax, rax
je 0x14001b319
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x14003a4e2.0]
add rax, 0x18
mov qword [rsp + 0x40], rax
mov rcx, qword [rdi + 0xd0]
mov rax, qword [rcx]
lea rdx, [rsp + 0x40]
mov rax, qword [rax + 0x118]
call qword [case.0x14003a4e2.0]
mov rdx, rsi
or rdi, 0xffffffffffffffff
mov r9, rdi
mov r8, qword [rsp + 0x40]
mov rcx, rbx
call fcn.1401a1c70
test eax, eax
je 0x14001b2c2
cmp eax, 0xc
je 0x14001b313
cmp eax, 0x50
jne 0x14001b324
test rbx, rbx
jne 0x14001b2cb
mov ebx, ebp
jmp 0x14001b2d6
mov rcx, rbx
call fcn.1401a1f38
mov rbx, rax
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov ecx, edi
lock xadd dword [rdx + 0x10], ecx
add ecx, edi
test ecx, ecx
jg 0x14001b2fc
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14003a4e2.0]
mov eax, ebx
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
call fcn.140014c10
nop
mov ecx, 0x80004005
call fcn.140015384
nop
call fcn.140014bec
int3

Function at 0x14001c550
Capabilities:
Get graphical window text

Disassembly:
sub rsp, 0x78
test rdx, rdx
je 0x14001c5b8
mov r10, qword [rcx + 0x10]
test r10, r10
je 0x14001c5a2
cmp qword [rcx + 0x18], 0
jne 0x14001c59d
mov eax, dword [rcx + 0xc]
cmp eax, dword [rcx + 0x30]
jae 0x14001c5be
mov qword [rsp + 0x58], rdx
lea r9, [rsp + 0x20]
mov dword [rsp + 0x20], 0x50
mov edx, eax
mov dword [rsp + 0x24], 0x40
mov r8d, 1
mov rcx, qword [r10 + 8]
call qword [sym.imp.USER32.dll_SetMenuItemInfoW]
add rsp, 0x78
ret
mov rcx, qword [rcx + 0x20]
test rcx, rcx
je 0x14001c5b8
mov rcx, qword [rcx + 0x40]
add rsp, 0x78
jmp fcn.14001b7e4
call fcn.140014bec
int3
call fcn.140014bec
int3

Function at 0x14001f314
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
xor edi, edi
xor ebx, ebx
mov rsi, rdx
mov r14, rcx
test rdx, rdx
je 0x14001f37c
call fcn.1400152e8
mov r8d, 0xf0
mov rdx, rsi
mov rbp, qword [rax + 0x18]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x14001f37c
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbx, rax
test rax, rax
je 0x14001f39e
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
mov rdx, rdi
mov rcx, r14
call fcn.140029db0
mov esi, eax
test rdi, rdi
je 0x14001f39c
test rbx, rbx
je 0x14001f39c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x14001f544
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rbx, r8
lea rcx, [0x1401c69a0]
mov esi, edx
call fcn.1401a1f38
mov r8d, eax
lea rdx, [0x1401c69a0]
mov rcx, rbx
call fcn.1400192d0
xor ebp, ebp
mov edx, esi
cmp qword [rdi + 0xc8], rbp
jne 0x14001f62b
mov rcx, qword [rdi + 0x40]
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rsi, rax
test rax, rax
je 0x14001f643
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
movsxd rdi, eax
test eax, eax
js 0x14001f65e
mov r9, qword [rbx]
lea edx, [rbp + 1]
mov ecx, dword [r9 - 0xc]
sub edx, dword [r9 - 8]
sub ecx, edi
or edx, ecx
jge 0x14001f5da
mov edx, edi
mov rcx, rbx
call fcn.140015588
mov r9, qword [rbx]
cmp edi, dword [r9 - 0xc]
jg 0x14001f65e
mov dword [r9 - 0x10], edi
lea r8d, [rdi + 1]
mov rax, qword [rbx]
mov rdx, r9
mov rcx, rsi
mov word [rax + rdi*2], bp
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov rcx, qword [rbx]
test rcx, rcx
jne 0x14001f607
mov eax, ebp
jmp 0x14001f614
movsxd rdx, dword [rcx - 0xc]
call fcn.1401a2064
test eax, eax
js 0x14001f65e
mov rcx, qword [rbx]
cmp eax, dword [rcx - 0xc]
jg 0x14001f65e
mov dword [rcx - 0x10], eax
movsxd rcx, eax
mov rax, qword [rbx]
mov word [rax + rcx*2], bp
jmp 0x14001f643
mov rcx, rdi
call fcn.14001b114
test rax, rax
je 0x14001f643
mov rdx, rbx
mov rcx, rax
call fcn.14001fae4
mov rax, qword [rbx]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov eax, dword [rax - 0x10]
add rsp, 0x20
pop rdi
ret
mov ecx, 0x80070057
call fcn.140015384
int3

Function at 0x14001fae4
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
xor ebp, ebp
mov rcx, qword [rcx + 0xd0]
mov rbx, rdx
test rcx, rcx
jne 0x14001fb98
mov rcx, qword [rsi + 0x40]
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
movsxd rdi, eax
test eax, eax
js 0x14001fbbd
mov r9, qword [rbx]
lea edx, [rbp + 1]
mov ecx, dword [r9 - 0xc]
sub edx, dword [r9 - 8]
sub ecx, edi
or edx, ecx
jge 0x14001fb46
mov edx, edi
mov rcx, rbx
call fcn.140015588
mov r9, qword [rbx]
cmp edi, dword [r9 - 0xc]
jg 0x14001fbbd
mov dword [r9 - 0x10], edi
lea r8d, [rdi + 1]
mov rax, qword [rbx]
mov rdx, r9
mov word [rax + rdi*2], bp
mov rcx, qword [rsi + 0x40]
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov rcx, qword [rbx]
test rcx, rcx
jne 0x14001fb74
mov eax, ebp
jmp 0x14001fb81
movsxd rdx, dword [rcx - 0xc]
call fcn.1401a2064
test eax, eax
js 0x14001fbbd
mov rcx, qword [rbx]
cmp eax, dword [rcx - 0xc]
jg 0x14001fbbd
mov dword [rcx - 0x10], eax
movsxd rcx, eax
mov rax, qword [rbx]
mov word [rax + rcx*2], bp
jmp 0x14001fba8
mov rax, qword [rcx]
mov rax, qword [rax + 0x118]
call qword [case.0x14003a4e2.0]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov ecx, 0x80070057
call fcn.140015384
int3