joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400555d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x480
mov rax, qword [0x1403486d0]
xor rax, rsp
mov qword [rsp + 0x470], rax
mov r15, r9
mov rsi, r8
mov rbx, rdx
xor r14d, r14d
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x60], r14
xor edx, edx
lea r8d, [r14 + 0x60]
mov rcx, rbx
call fcn.140057120
mov rdi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x140055653
xor edx, edx
lea r8d, [r14 + 2]
mov rcx, rbx
call fcn.140057120
mov rdi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x140055653
call fcn.140054450
mov ebx, eax
jmp 0x140055778
mov r8, r15
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
jne 0x140055674
call fcn.140054450
jmp 0x140055767
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
mov qword [rsp + 0x40], rax
test rax, rax
jne 0x140055697
call fcn.140054450
jmp 0x140055767
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
mov dword [rsp + 0x30], eax
inc eax
cmp eax, ebx
jae 0x1400556b9
mov ebx, 0x8007000e
jmp 0x140055769
mov ecx, eax
test eax, eax
je 0x1400556ee
xor edx, edx
mov rax, 0xffffffffffffffff
div rcx
cmp rax, 2
jb 0x1400557b0
lea rdx, [rcx + rcx]
cmp rdx, 0x400
jbe 0x1400556ee
lea rcx, [rsp + 0x60]
call fcn.1400542c0
jmp 0x1400556f8
lea rax, [rsp + 0x68]
mov qword [rsp + 0x60], rax
jmp 0x14005570b
cmp qword [rsp + 0x60], 0
jne 0x14005571a
mov ebx, 0x8007000e
jmp 0x140055769
mov dword [rsp + 0x28], ebx
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, ebx
mov r8, rsi
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x140055744
call fcn.140054450
jmp 0x140055767
mov ecx, eax
mov rax, qword [rsp + 0x60]
mov word [rax + rcx*2], r14w
mov r8d, dword [rsp + 0x4d0]
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x48]
call fcn.1400550f0
mov ebx, eax
test rdi, rdi
je 0x140055778
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rax, [rsp + 0x68]
cmp qword [rsp + 0x60], rax
je 0x14005578f
lea rcx, [rsp + 0x60]
call fcn.140054870
nop
mov eax, ebx
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.1400e6b50
add rsp, 0x480
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
mov ecx, 0x80070216
call fcn.140052c30
int3
Function at 0x140057120
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r12
push r14
push r15
sub rsp, 0x30
mov r14d, r8d
mov r15, rdx
mov r12, rcx
xor edi, edi
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x68], rdi
cmp dword [0x1403754e8], edi
jne 0x1400571fd
mov eax, dword [0x1403754e4]
test eax, eax
jne 0x1400571fd
mov esi, edi
mov r8d, dword [0x1403754f0]
test r8d, r8d
je 0x140057190
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x1403754e4]
mov r8d, dword [0x1403754f0]
test eax, eax
je 0x14005719d
mov ebx, 1
mov esi, ebx
jmp 0x1400571cc
test r8d, r8d
jne 0x1400571b0
call fcn.140057280
test eax, eax
jne 0x1400571b0
lea ebx, [rax + 1]
jmp 0x1400571cc
lea rdx, [rsp + 0x68]
mov rcx, qword [section..data]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ebx, 1
test eax, eax
cmovne esi, ebx
test esi, esi
jne 0x140057202
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [rax - 0x7e]
cmp ecx, 1
jbe 0x1400571ed
cmp eax, 0x78
je 0x1400571ed
cmp eax, 1
je 0x1400571ed
cmp eax, 0x32
jne 0x1400571f5
mov dword [0x1403754e4], ebx
mov esi, ebx
test esi, esi
jne 0x140057202
mov ebx, edi
jmp 0x140057202
mov ebx, 1
test ebx, ebx
jne 0x140057222
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop r12
ret
mov r8d, r14d
mov rdx, r15
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rsi, rax
mov qword [rsp + 0x20], rax
cmp dword [0x1403754e8], 0
je 0x14005724b
cmp dword [0x1403754e4], 0
jne 0x140057278
mov ebx, edi
test rsi, rsi
sete bl
test ebx, ebx
je 0x14005725f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rdx, qword [rsp + 0x68]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x140057278
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rsi
jmp 0x140057208
Function at 0x140057990
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0xc0
lea rax, [0x140347028]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
lea r9, vtable.RunLoopJobThread.0
lea r8, [0x140057b80]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
mov rcx, qword [0x140347020]
cmp rcx, 0xffffffffffffffff
je 0x1400579db
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x140347020], rbx
mov edx, 0xffffffff
mov rcx, qword [0x140347018]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rax, vtable.std::_Func_impl_no_alloc_class__lambda_37bb286e45eca93a7d7e1877bf3edc69___void___.0
mov qword [rsp + 0x80], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0xb8], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0xd0], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0xd8], rax
mov qword [rsp + 0x78], 0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x80]
call qword [vtable.std::_Func_impl_no_alloc_class__lambda_37bb286e45eca93a7d7e1877bf3edc69___void___.0]
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0xd8], rax
lea rbx, [0x140347050]
mov qword [rsp + 0x30], rbx
mov byte [rsp + 0x38], 1
mov rcx, rbx
call sub.KERNEL32.dll_EnterCriticalSection
nop
lea r8, [rsp + 0x40]
mov rdx, qword [0x140347040]
lea rcx, [0x140347040]
call fcn.1400575c0
mov rcx, qword [0x140347038]
call qword [sym.imp.CoreFoundation.dll_CFRunLoopSourceSignal]
mov rcx, qword [0x140347030]
call qword [sym.imp.CoreFoundation.dll_CFRunLoopWakeUp]
nop
mov rcx, rbx
call sub.KERNEL32.dll_LeaveCriticalSection
nop
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x140057ad0
mov rax, qword [rcx]
lea rdx, [rsp + 0x40]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
nop
mov rcx, qword [rsp + 0xb8]
test rcx, rcx
je 0x140057af1
mov rax, qword [rcx]
lea rdx, [rsp + 0x80]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
add rsp, 0xc0
pop rbx
ret
Function at 0x140059e90
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0x90
mov rax, qword [0x1403486d0]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov r10, r9
mov rbx, r8
mov rax, rdx
xor edi, edi
mov dword [rbp - 0x19], edi
mov dword [rbp - 0x15], 4
lea rcx, [rbp - 0x15]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp - 0x19]
mov qword [rsp + 0x20], rcx
lea r9, [rbp - 0x11]
xor r8d, r8d
mov rdx, r10
mov rcx, qword [rax]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140059f0e
cmp dword [rbp - 0x11], 4
jne 0x140059f0e
cmp dword [rbp - 0x19], edi
setne al
lea rcx, [0x1402706e8]
lea rdx, [0x140270a58]
test al, al
cmovne rdx, rcx
jmp 0x140059f15
lea rdx, [0x140271500]
mov qword [rbp - 9], rdi
mov qword [rbp + 7], rdi
mov qword [rbp + 0xf], 7
mov word [rbp - 9], di
mov r8, 0xffffffffffffffff
inc r8
cmp word [rdx + r8*2], di
jne 0x140059f30
lea rcx, [rbp - 9]
call fcn.1400523d0
nop
lea r9, [rbp - 9]
cmp qword [rbp + 0xf], 8
cmovae r9, qword [rbp - 9]
mov r8, rbx
lea rdx, [0x140271510]
lea rcx, [rbp + 0x17]
call fcn.1400c48a0
nop
mov rax, qword [0x140375520]
cmp rax, qword [0x140375528]
je 0x140059f8c
lea rdx, [rbp + 0x17]
mov rcx, rax
call fcn.1400591a0
add qword [0x140375520], 0x20
jmp 0x140059fa0
lea r8, [rbp + 0x17]
mov rdx, rax
lea rcx, [0x140375518]
call fcn.140057f70
nop
mov rdx, qword [rbp + 0x2f]
cmp rdx, 8
jb 0x140059fe3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x17]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140059fde
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140059fde
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e6a28
mov qword [rbp + 0x27], rdi
mov qword [rbp + 0x2f], 7
mov word [rbp + 0x17], di
mov rdx, qword [rbp + 0xf]
cmp rdx, 8
jb 0x14005a036
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 9]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005a031
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005a031
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e6a28
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.1400e6b50
add rsp, 0x90
pop rdi
pop rbx
pop rbp
ret
Function at 0x14005e9a0
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov rdi, rcx
xor r15d, r15d
mov qword [rax - 0x28], r15
mov dword [rax - 0x30], r15d
mov qword [rax - 0x38], r15
mov dword [rax - 0x40], 3
mov dword [rax - 0x48], r15d
xor r9d, r9d
xor r8d, r8d
mov esi, 0xffffffff
mov edx, esi
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
mov edx, 0x80000000
lea ecx, [rax + rdx]
test edx, ecx
jne 0x14005ea01
cmp eax, 0x80010119
jne 0x14005eb41
mov qword [rsp + 0x20], rdi
lea r9, [0x14028f5c8]
xor edx, edx
lea r8d, [rdx + 1]
lea rcx, [0x14028f5b8]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x14005eb41
mov ecx, DispGetParam
call fcn.1400e69ec
mov rbx, rax
mov qword [rsp + 0x78], rax
test rax, rax
je 0x14005ea65
mov qword [rax + 8], r15
mov dword [rax + 0x10], 1
lea rcx, str.ROOTCIMV2
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x14005eb66
jmp 0x14005ea68
mov rbx, r15
mov qword [rsp + 0x78], rbx
test rbx, rbx
je 0x14005eb5b
mov rcx, qword [rdi]
mov rax, qword [rcx]
lea r14, [rdi + 8]
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbx]
call qword [rax + 0x18]
mov ebp, eax
mov rcx, qword [r14]
test eax, eax
js 0x14005eae1
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0xa]
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
mov ebp, eax
test eax, eax
jns 0x14005eb02
mov rcx, qword [r14]
test rcx, rcx
je 0x14005eaef
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov qword [r14], r15
mov rcx, qword [rdi]
test rcx, rcx
je 0x14005eb05
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov qword [rdi], r15
jmp 0x14005eb05
mov ebp, r15d
lock xadd dword [rbx + 0x10], esi
cmp esi, 1
jne 0x14005eb3f
mov rcx, qword [rbx]
test rcx, rcx
je 0x14005eb20
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r15
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14005eb32
call fcn.1400e6a28
mov qword [rbx + 8], r15
mov edx, DispGetParam
mov rcx, rbx
call fcn.1400e6a28
mov eax, ebp
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
mov ecx, 0x8007000e
call fcn.1400f8040
nop
mov ecx, 0x8007000e
call fcn.1400f8040
int3
Function at 0x14006a9b0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push r13
push r14
push r15
sub rsp, 0x70
mov r14d, r9d
mov r15, r8
mov r12, rdx
mov r13d, ecx
xor edi, edi
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x60], rdi
cmp dword [0x1403754e8], edi
jne 0x14006aa95
mov eax, dword [0x1403754e4]
test eax, eax
jne 0x14006aa95
mov esi, edi
mov r8d, dword [0x1403754f0]
test r8d, r8d
je 0x14006aa28
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x1403754e4]
mov r8d, dword [0x1403754f0]
test eax, eax
je 0x14006aa35
mov ebx, 1
mov esi, ebx
jmp 0x14006aa64
test r8d, r8d
jne 0x14006aa48
call fcn.140057280
test eax, eax
jne 0x14006aa48
lea ebx, [rax + 1]
jmp 0x14006aa64
lea rdx, [rsp + 0x60]
mov rcx, qword [section..data]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ebx, 1
test eax, eax
cmovne esi, ebx
test esi, esi
jne 0x14006aa9a
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [rax - 0x7e]
cmp ecx, 1
jbe 0x14006aa85
cmp eax, 0x78
je 0x14006aa85
cmp eax, 1
je 0x14006aa85
cmp eax, 0x32
jne 0x14006aa8d
mov dword [0x1403754e4], ebx
mov esi, ebx
test esi, esi
jne 0x14006aa9a
mov ebx, edi
jmp 0x14006aa9a
mov ebx, 1
test ebx, ebx
jne 0x14006aabf
xor eax, eax
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret
mov rax, qword [rsp + 0xe8]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0xe0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0xc8]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0xc0]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0xb8]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0xb0]
mov dword [rsp + 0x20], eax
mov r9d, r14d
mov r8, r15
mov rdx, r12
mov ecx, r13d
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov rsi, rax
mov qword [rsp + 0x68], rax
cmp dword [0x1403754e8], 0
je 0x14006ab4b
cmp dword [0x1403754e4], 0
jne 0x14006ab78
mov ebx, edi
test rsi, rsi
sete bl
test ebx, ebx
je 0x14006ab5f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x14006ab78
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rsi
jmp 0x14006aaa0
Function at 0x14006ab80
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r12
push r14
push r15
sub rsp, 0x30
mov r14, r8
mov r15, rdx
mov r12, rcx
xor edi, edi
mov dword [rsp + 0x20], edi
mov qword [rsp + 0x68], rdi
cmp dword [0x1403754e8], edi
jne 0x14006ac5c
mov eax, dword [0x1403754e4]
test eax, eax
jne 0x14006ac5c
mov esi, edi
mov r8d, dword [0x1403754f0]
test r8d, r8d
je 0x14006abef
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x1403754e4]
mov r8d, dword [0x1403754f0]
test eax, eax
je 0x14006abfc
mov ebx, 1
mov esi, ebx
jmp 0x14006ac2b
test r8d, r8d
jne 0x14006ac0f
call fcn.140057280
test eax, eax
jne 0x14006ac0f
lea ebx, [rax + 1]
jmp 0x14006ac2b
lea rdx, [rsp + 0x68]
mov rcx, qword [section..data]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ebx, 1
test eax, eax
cmovne esi, ebx
test esi, esi
jne 0x14006ac61
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [rax - 0x7e]
cmp ecx, 1
jbe 0x14006ac4c
cmp eax, 0x78
je 0x14006ac4c
cmp eax, 1
je 0x14006ac4c
cmp eax, 0x32
jne 0x14006ac54
mov dword [0x1403754e4], ebx
mov esi, ebx
test esi, esi
jne 0x14006ac61
mov ebx, edi
jmp 0x14006ac61
mov ebx, 1
test ebx, ebx
jne 0x14006ac81
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop r12
ret
mov r8, r14
mov rdx, r15
mov rcx, r12
call qword [sym.imp.USER32.dll_GetClassInfoExW]
mov esi, eax
mov dword [rsp + 0x20], eax
cmp dword [0x1403754e8], 0
je 0x14006aca8
cmp dword [0x1403754e4], 0
jne 0x14006acd4
mov ebx, edi
test esi, esi
sete bl
test ebx, ebx
je 0x14006acbb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rdx, qword [rsp + 0x68]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x14006acd4
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
jmp 0x14006ac67
Function at 0x14006ace0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x30
mov r12, rcx
xor edi, edi
mov r15d, edi
mov dword [rsp + 0x20], edi
mov r14, qword [0x140375b18]
mov qword [rsp + 0x58], rdi
cmp dword [0x1403754e8], edi
jne 0x14006adbe
mov eax, dword [0x1403754e4]
test eax, eax
jne 0x14006adbe
mov esi, edi
mov ecx, dword [0x1403754f0]
test ecx, ecx
je 0x14006ad50
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x1403754e4]
mov ecx, dword [0x1403754f0]
test eax, eax
je 0x14006ad5d
mov ebx, 1
mov esi, ebx
jmp 0x14006ad8b
test ecx, ecx
jne 0x14006ad6f
call fcn.140057280
test eax, eax
jne 0x14006ad6f
lea ebx, [rax + 1]
jmp 0x14006ad8b
lea rdx, [rsp + 0x58]
mov rcx, qword [section..data]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ebx, 1
test eax, eax
cmovne esi, ebx
test esi, esi
jne 0x14006adc3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
add eax, 0xffffff82
cmp eax, 1
jbe 0x14006adae
cmp ecx, 0x78
je 0x14006adae
cmp ecx, 1
je 0x14006adae
cmp ecx, 0x32
jne 0x14006adb6
mov dword [0x1403754e4], ebx
mov esi, ebx
test esi, esi
jne 0x14006adc3
mov ebx, edi
jmp 0x14006adc3
mov ebx, 1
test ebx, ebx
jne 0x14006ade3
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r12
ret
test r14, r14
jne 0x14006ae03
lea rcx, str.InitCommonControlsEx
call fcn.14006a8e0
mov r14, rax
test rax, rax
je 0x14006ae10
mov qword [0x140375b18], rax
mov rcx, r12
call r14
mov r15d, eax
mov dword [rsp + 0x20], eax
cmp dword [0x1403754e8], 0
je 0x14006ae22
cmp dword [0x1403754e4], 0
jne 0x14006ae4f
mov ebx, edi
test r15d, r15d
sete bl
test ebx, ebx
je 0x14006ae36
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rdx, qword [rsp + 0x58]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x14006ae4f
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, r15d
jmp 0x14006adc9

Function at 0x14006ae60
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x20
mov eax, dword [0x1403754f0]
mov rbx, rcx
test eax, eax
je 0x14006ae86
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x1403754f0]
cmp dword [0x1403754e4], 0
jne 0x14006aedf
test eax, eax
jne 0x14006ae9c
call fcn.140057280
test eax, eax
je 0x14006aeb0
mov rcx, qword [section..data]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
test eax, eax
jne 0x14006aedf
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [rax - 0x7e]
cmp ecx, 1
jbe 0x14006aed5
cmp eax, 0x78
je 0x14006aed5
cmp eax, 1
je 0x14006aed5
cmp eax, 0x32
je 0x14006aed5
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov dword [0x1403754e4], 1
mov eax, 1
add rsp, 0x20
pop rbx
ret
Function at 0x14006aef0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
xor edi, edi
mov word [rsp + 0x20], di
mov qword [rsp + 0x48], rdi
cmp dword [0x1403754e8], edi
jne 0x14006afbf
mov eax, dword [0x1403754e4]
test eax, eax
jne 0x14006afbf
mov esi, edi
mov edx, dword [0x1403754f0]
test edx, edx
je 0x14006af53
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x1403754e4]
mov edx, dword [0x1403754f0]
test eax, eax
je 0x14006af60
mov ebx, 1
mov esi, ebx
jmp 0x14006af8e
test edx, edx
jne 0x14006af72
call fcn.140057280
test eax, eax
jne 0x14006af72
lea ebx, [rax + 1]
jmp 0x14006af8e
lea rdx, [rsp + 0x48]
mov rcx, qword [section..data]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ebx, 1
test eax, eax
cmovne esi, ebx
test esi, esi
jne 0x14006afc4
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [rax - 0x7e]
cmp ecx, 1
jbe 0x14006afaf
cmp eax, 0x78
je 0x14006afaf
cmp eax, 1
je 0x14006afaf
cmp eax, 0x32
jne 0x14006afb7
mov dword [0x1403754e4], ebx
mov esi, ebx
test esi, esi
jne 0x14006afc4
mov ebx, edi
jmp 0x14006afc4
mov ebx, 1
test ebx, ebx
jne 0x14006afe1
movzx eax, di
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
mov rcx, r14
call qword [sym.imp.USER32.dll_RegisterClassExW]
movzx esi, ax
mov word [rsp + 0x20], ax
cmp dword [0x1403754e8], 0
je 0x14006b004
cmp dword [0x1403754e4], 0
jne 0x14006b031
mov ebx, edi
test si, si
sete bl
test ebx, ebx
je 0x14006b018
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x14006b031
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
movzx eax, si
jmp 0x14006afcb
Function at 0x14006fd90
Capabilities:
Get graphical window text

Disassembly:
push rbx
push rbp
push r12
push r15
sub rsp, 0x68
mov rax, qword [0x1403486d0]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbx, rcx
mov qword [rsp + 0x28], rcx
mov rcx, rdx
mov r15, rdx
xor r12d, r12d
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
movsxd rbp, eax
test eax, eax
jne 0x14006fde0
mov qword [rbx], r12
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], 7
mov word [rbx], r12w
jmp 0x14006fe90
mov qword [rsp + 0xa0], rsi
mov eax, 2
mov qword [rsp + 0xa8], rdi
mov rsi, 0xffffffffffffffff
lea edi, [rbp + 1]
mov qword [rsp + 0x60], r14
movsxd rdx, edi
mul rdx
cmovo rax, rsi
mov rcx, rax
call fcn.1400e6a30
mov r8d, edi
mov rdx, rax
mov rcx, r15
mov r14, rax
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov rdi, qword [rsp + 0xa8]
mov word [r14 + rbp*2], r12w
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x48], 7
nop dword [rax + rax]
inc rsi
cmp word [r14 + rsi*2], r12w
jne 0x14006fe50
mov r8, rsi
lea rcx, [rsp + 0x30]
mov rdx, r14
call fcn.1400523d0
mov rcx, r14
call fcn.1400e6a28
movups xmm0, xmmword [rsp + 0x30]
mov r14, qword [rsp + 0x60]
movups xmm1, xmmword [rsp + 0x40]
mov rsi, qword [rsp + 0xa0]
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0x10], xmm1
mov rax, rbx
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400e6b50
add rsp, 0x68
pop r15
pop r12
pop rbp
pop rbx
ret
Function at 0x140072cf0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push r13
push r14
push r15
sub rsp, 0x40
mov r14, r9
mov r15, r8
mov r12, rdx
mov r13, rcx
xor edi, edi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
cmp dword [0x1403754e8], edi
jne 0x140072dd5
mov eax, dword [0x1403754e4]
test eax, eax
jne 0x140072dd5
mov esi, edi
mov r8d, dword [0x1403754f0]
test r8d, r8d
je 0x140072d68
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x1403754e4]
mov r8d, dword [0x1403754f0]
test eax, eax
je 0x140072d75
mov ebx, 1
mov esi, ebx
jmp 0x140072da4
test r8d, r8d
jne 0x140072d88
call fcn.140057280
test eax, eax
jne 0x140072d88
lea ebx, [rax + 1]
jmp 0x140072da4
lea rdx, [rsp + 0x30]
mov rcx, qword [section..data]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ebx, 1
test eax, eax
cmovne esi, ebx
test esi, esi
jne 0x140072dda
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [rax - 0x7e]
cmp ecx, 1
jbe 0x140072dc5
cmp eax, 0x78
je 0x140072dc5
cmp eax, 1
je 0x140072dc5
cmp eax, 0x32
jne 0x140072dcd
mov dword [0x1403754e4], ebx
mov esi, ebx
test esi, esi
jne 0x140072dda
mov ebx, edi
jmp 0x140072dda
mov ebx, 1
test ebx, ebx
jne 0x140072dff
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov r12, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r13
ret
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x20], rax
mov r9, r14
mov r8, r15
mov rdx, r12
mov rcx, r13
call qword [sym.imp.USER32.dll_CreateDialogParamW]
mov rsi, rax
mov qword [rsp + 0x38], rax
cmp dword [0x1403754e8], 0
je 0x140072e38
cmp dword [0x1403754e4], 0
jne 0x140072e65
mov ebx, edi
test rsi, rsi
sete bl
test ebx, ebx
je 0x140072e4c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rdx, qword [rsp + 0x30]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x140072e65
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rsi
jmp 0x140072de0