joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002b430
Capabilities:
Terminate process

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, rcx
call sym.rwl_ref.constprop.0
test eax, eax
je 0x14002b458
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rsi, qword [rbx]
lea rdi, [rsi + 0x18]
mov rcx, rdi
call sym.pthread_mutex_lock
test eax, eax
jne 0x14002b481
lock add dword [rsi + 0xc], 1
cmp dword [rsi + 0xc], 0x7fffffff
je 0x14002b498
mov rcx, rdi
call sym.pthread_mutex_unlock
mov edx, eax
mov rcx, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp sym.rwl_unref
lea r12, [rsi + 0x20]
mov rcx, r12
call sym.pthread_mutex_lock
test eax, eax
mov ebp, eax
je 0x14002b4c0
mov rcx, rdi
call sym.pthread_mutex_unlock
mov edx, ebp
jmp 0x14002b483
mov eax, dword [rsi + 0x10]
mov rcx, r12
mov dword [rsi + 0x10], 0
sub dword [rsi + 0xc], eax
call sym.pthread_mutex_unlock
mov rcx, rdi
mov esi, eax
call sym.pthread_mutex_unlock
test esi, esi
cmove esi, eax
mov edx, esi
jmp 0x14002b483

Function at 0x14002b4f0
Capabilities:
Terminate process

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rdi, rdx
call sym.rwl_ref.constprop.0
test eax, eax
je 0x14002b518
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rsi, qword [rbx]
mov rdx, rdi
lea rbp, [rsi + 0x18]
mov rcx, rbp
call sym.pthread_mutex_timedlock
test eax, eax
jne 0x14002b544
lock add dword [rsi + 0xc], 1
cmp dword [rsi + 0xc], 0x7fffffff
je 0x14002b560
mov rcx, rbp
call sym.pthread_mutex_unlock
mov edx, eax
mov rcx, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp sym.rwl_unref
lea r12, [rsi + 0x20]
mov rdx, rdi
mov rcx, r12
call sym.pthread_mutex_timedlock
test eax, eax
mov edi, eax
je 0x14002b590
cmp eax, 0x8a
je 0x14002b5c0
mov rcx, rbp
call sym.pthread_mutex_unlock
mov edx, edi
jmp 0x14002b546
mov eax, dword [rsi + 0x10]
mov rcx, r12
mov dword [rsi + 0x10], 0
sub dword [rsi + 0xc], eax
call sym.pthread_mutex_unlock
mov rcx, rbp
mov esi, eax
call sym.pthread_mutex_unlock
test esi, esi
cmove esi, eax
mov edx, esi
jmp 0x14002b546
lock add dword [rsi + 0x10], 1
jmp 0x14002b57c

Function at 0x14002b5d0
Capabilities:
Terminate process

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, rcx
call sym.rwl_ref.constprop.0
test eax, eax
je 0x14002b5f8
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rsi, qword [rbx]
lea rdi, [rsi + 0x18]
mov rcx, rdi
call sym.pthread_mutex_trylock
test eax, eax
jne 0x14002b621
lock add dword [rsi + 0xc], 1
cmp dword [rsi + 0xc], 0x7fffffff
je 0x14002b638
mov rcx, rdi
call sym.pthread_mutex_unlock
mov edx, eax
mov rcx, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp sym.rwl_unref
lea r12, [rsi + 0x20]
mov rcx, r12
call sym.pthread_mutex_lock
test eax, eax
mov ebp, eax
je 0x14002b660
mov rcx, rdi
call sym.pthread_mutex_unlock
mov edx, ebp
jmp 0x14002b623
mov eax, dword [rsi + 0x10]
mov rcx, r12
mov dword [rsi + 0x10], 0
sub dword [rsi + 0xc], eax
call sym.pthread_mutex_unlock
mov rcx, rdi
mov esi, eax
call sym.pthread_mutex_unlock
test esi, esi
cmove esi, eax
mov edx, esi
jmp 0x14002b623
Function at 0x14002b690
Capabilities:
Terminate process

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, rcx
call sym.rwl_ref.constprop.0
test eax, eax
je 0x14002b6b8
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rsi, qword [rbx]
lea rbp, [rsi + 0x18]
mov rcx, rbp
call sym.pthread_mutex_trylock
test eax, eax
mov edx, eax
jne 0x14002b70e
lea r12, [rsi + 0x20]
mov rcx, r12
call sym.pthread_mutex_trylock
test eax, eax
mov edi, eax
jne 0x14002b748
mov eax, dword [rsi + 8]
mov edx, 0x10
test eax, eax
jne 0x14002b70e
mov edx, dword [rsi + 0x10]
mov eax, dword [rsi + 0xc]
test edx, edx
jle 0x14002b701
sub eax, edx
mov dword [rsi + 0x10], 0
mov dword [rsi + 0xc], eax
test eax, eax
jg 0x14002b720
mov dword [rsi + 8], 1
xor edx, edx
mov rcx, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp sym.rwl_unref
mov rcx, r12
call sym.pthread_mutex_unlock
mov rcx, rbp
mov esi, eax
call sym.pthread_mutex_unlock
test esi, esi
jne 0x14002b740
test eax, eax
mov esi, 0x10
cmovne esi, eax
mov edx, esi
jmp 0x14002b70e
mov rcx, rbp
call sym.pthread_mutex_unlock
test eax, eax
cmovne edi, eax
mov edx, edi
jmp 0x14002b70e

Function at 0x14002b760
Capabilities:
Terminate process

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rbx, rcx
call sym.rwl_ref_unlock
test eax, eax
jne 0x14002b7e0
mov rdi, qword [rbx]
mov edx, dword [rdi + 8]
lea rbp, [rdi + 0x20]
test edx, edx
je 0x14002b7b8
lock sub dword [rdi + 8], 1
mov rcx, rbp
call sym.pthread_mutex_unlock
lea rcx, [rdi + 0x18]
mov esi, eax
call sym.pthread_mutex_unlock
test esi, esi
cmove esi, eax
mov edx, esi
mov rcx, rbx
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp sym.rwl_unref
mov rcx, rbp
call sym.pthread_mutex_lock
test eax, eax
mov esi, eax
jne 0x14002b79f
lock add dword [rdi + 0x10], 1
mov eax, dword [rdi + 0x10]
test eax, eax
je 0x14002b7f0
mov rcx, rbp
call sym.pthread_mutex_unlock
mov esi, eax
jmp 0x14002b79f
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
lea rcx, [rdi + 0x28]
call sym.pthread_cond_signal
mov rcx, rbp
mov esi, eax
call sym.pthread_mutex_unlock
test esi, esi
cmove esi, eax
jmp 0x14002b79f
Function at 0x14002b810
Capabilities:
Terminate process

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rbx, rcx
call sym.rwl_ref.constprop.0
test eax, eax
je 0x14002b838
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov rsi, qword [rbx]
lea rdi, [rsi + 0x18]
mov rcx, rdi
call sym.pthread_mutex_lock
test eax, eax
mov ebp, eax
jne 0x14002b889
lea r12, [rsi + 0x20]
mov rcx, r12
call sym.pthread_mutex_lock
test eax, eax
mov ebp, eax
jne 0x14002b920
mov edx, dword [rsi + 8]
test edx, edx
jne 0x14002b884
mov edx, dword [rsi + 0x10]
mov eax, dword [rsi + 0xc]
test edx, edx
jle 0x14002b880
sub eax, edx
mov dword [rsi + 0x10], 0
mov dword [rsi + 0xc], eax
test eax, eax
jg 0x14002b8a0
lock add dword [rsi + 8], 1
mov edx, ebp
mov rcx, rbx
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp sym.rwl_unref
mov qword [rsp + 0x28], rsi
lea r13, [rsi + 0x28]
neg eax
mov dword [rsi + 0x10], eax
lea rax, [sym.st_cancelwrite]
mov qword [rsp + 0x20], rax
call sym.pthread_getclean
mov rax, qword [rax]
mov qword [rsp + 0x30], rax
lock or qword [rsp], 0
call sym.pthread_getclean
lea rdx, [rsp + 0x20]
mov qword [rax], rdx
lock or qword [rsp], 0
jmp 0x14002b8ef
mov eax, dword [rsi + 0x10]
test eax, eax
jns 0x14002b930
mov rdx, r12
mov rcx, r13
call sym.pthread_cond_wait
test eax, eax
mov edi, eax
je 0x14002b8e8
call sym.pthread_getclean
mov rdx, qword [rsp + 0x30]
mov ebp, edi
mov qword [rax], rdx
mov rcx, qword [rsp + 0x28]
call qword [rsp + 0x20]
jmp 0x14002b889
mov rcx, rdi
call sym.pthread_mutex_unlock
jmp 0x14002b889
call sym.pthread_getclean
mov rdx, qword [rsp + 0x30]
mov qword [rax], rdx
mov dword [rsi + 0xc], 0
jmp 0x14002b884
Function at 0x14002b950
Capabilities:
Terminate process

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
test rcx, rcx
mov rbx, rcx
mov rsi, rdx
je 0x14002ba00
test rdx, rdx
je 0x14002ba00
call sym.rwl_ref.constprop.0
test eax, eax
je 0x14002b990
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov rdi, qword [rbx]
mov rdx, rsi
lea rbp, [rdi + 0x18]
mov rcx, rbp
call sym.pthread_mutex_timedlock
test eax, eax
mov edx, eax
jne 0x14002b9e7
lea r13, [rdi + 0x20]
mov rdx, rsi
mov rcx, r13
call sym.pthread_mutex_timedlock
test eax, eax
mov r12d, eax
jne 0x14002ba18
mov edx, dword [rdi + 8]
test edx, edx
jne 0x14002b9df
mov edx, dword [rdi + 0x10]
mov eax, dword [rdi + 0xc]
test edx, edx
jle 0x14002b9db
sub eax, edx
mov dword [rdi + 0x10], 0
mov dword [rdi + 0xc], eax
test eax, eax
jg 0x14002ba28
lock add dword [rdi + 8], 1
mov edx, r12d
mov rcx, rbx
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
jmp sym.rwl_unref
mov eax, 0x16
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov rcx, rbp
call sym.pthread_mutex_unlock
jmp 0x14002b9e4
mov qword [rsp + 0x28], rdi
lea r14, [rdi + 0x28]
neg eax
mov dword [rdi + 0x10], eax
lea rax, [sym.st_cancelwrite]
mov qword [rsp + 0x20], rax
call sym.pthread_getclean
mov rax, qword [rax]
mov qword [rsp + 0x30], rax
lock or qword [rsp], 0
call sym.pthread_getclean
lea rdx, [rsp + 0x20]
mov qword [rax], rdx
lock or qword [rsp], 0
jmp 0x14002ba74
test ebp, ebp
jne 0x14002ba8b
mov r8, rsi
mov rdx, r13
mov rcx, r14
call sym.pthread_cond_timedwait
mov ebp, eax
mov eax, dword [rdi + 0x10]
test eax, eax
js 0x14002ba70
call sym.pthread_getclean
mov rdx, qword [rsp + 0x30]
test ebp, ebp
mov qword [rax], rdx
jne 0x14002bab0
mov dword [rdi + 0xc], 0
jmp 0x14002b9df
mov rcx, qword [rsp + 0x28]
mov r12d, ebp
call qword [rsp + 0x20]
jmp 0x14002b9e4
Function at 0x100002cb0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x20
xor ebx, ebx
mov r12d, r8d
mov rbp, rdx
cmp rdx, rbx
je 0x100002d3c
movzx edx, cx
mov rcx, qword [0x1000148e0]
lea r8d, [rbx + 0xa]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rsi, rax
cmp rax, rbx
je 0x100002d3c
mov rcx, qword [0x1000148e0]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
cmp r12d, eax
jb 0x100002d3c
mov rcx, qword [0x1000148e0]
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
cmp rax, rbx
je 0x100002d3c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
cmp rax, rbx
je 0x100002d3c
mov r8, rdi
mov rdx, rax
mov rcx, rbp
call sub.msvcrt.dll_memcpy
mov ebx, edi
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop r12
ret

Function at 0x100004ebc
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
sub rsp, 0x450
mov rax, qword [0x100014120]
xor rax, rsp
mov qword [rsp + 0x440], rax
mov r12, rcx
mov rcx, qword [rcx + 8]
mov edx, 0x712
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, qword [r12 + 8]
mov edx, 0x713
mov rbx, rax
call qword [sym.imp.USER32.dll_GetDlgItem]
mov esi, 0x104
lea rdx, [rsp + 0x230]
mov rcx, rbx
mov r8d, esi
mov rdi, rax
call qword [sym.imp.USER32.dll_GetWindowTextW]
lea rdx, [rsp + 0x20]
mov r8d, esi
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov r11, rsi
lea rax, [rsp + 0x230]
xor r13d, r13d
cmp word [rax], r13w
je 0x100004f59
add rax, 2
sub r11, 1
jne 0x100004f49
cmp r11, r13
je 0x100005039
mov rax, rsi
sub rax, r11
cmp rax, r13
je 0x100005039
mov rax, rsi
lea rcx, [rsp + 0x20]
cmp word [rcx], r13w
je 0x100004f89
add rcx, 2
sub rax, 1
jne 0x100004f79
cmp rax, r13
je 0x100005039
sub rsi, rax
cmp rsi, r13
je 0x100005039
mov edi, r13d
jbe 0x100004fc9
lea rbx, [rsp + 0x20]
movzx ecx, word [rbx]
call qword [sym.imp.msvcrt.dll_iswalnum]
cmp eax, r13d
jne 0x100004fbc
cmp word [rbx], 0x2d
jne 0x100005039
inc edi
add rbx, 2
mov eax, edi
cmp rax, rsi
jb 0x100004fa8
cmp qword [r12 + 0x18], r13
je 0x100004fea
mov rcx, qword [r12 + 0x18]
lea r8, [rsp + 0x230]
lea rdx, [rsp + 0x20]
mov rax, qword [rcx]
call qword [rax + 0x18]
jmp 0x100004fed
mov eax, r13d
cmp eax, r13d
jne 0x100005039
cmp qword [r12 + 0x18], r13
je 0x100005013
mov rcx, qword [r12 + 0x18]
lea r8, [rsp + 0x230]
lea rdx, [rsp + 0x20]
mov rax, qword [rcx]
call qword [rax + 8]
jmp 0x100005016
mov eax, r13d
cmp eax, r13d
jne 0x100005032
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x230]
mov rcx, r12
call fcn.100004cd8
jmp 0x10000504e
mov edx, 0x836
jmp 0x10000503e
mov edx, 0x834
lea rcx, [r12 + 8]
mov r8d, 0x30
call fcn.1000051c0
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.10000f290
lea r11, [rsp + 0x450]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
Function at 0x1000051c0
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rdi
sub rsp, 0x450
mov rax, qword [0x100014120]
xor rax, rsp
mov qword [rsp + 0x440], rax
mov rdi, rcx
mov ebx, edx
lea rcx, [rsp + 0x22]
xor ebp, ebp
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x20], bp
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x232]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x230], bp
call sub.msvcrt.dll_memset
mov rcx, qword [rdi]
lea rdx, [rsp + 0x20]
mov r8d, 0x104
call qword [sym.imp.USER32.dll_GetWindowTextW]
lea r8, [rsp + 0x230]
lea rcx, [0x1000141e0]
mov r9d, 0x104
mov edx, ebx
call fcn.10000b984
mov rcx, qword [rdi]
lea r9d, [rbp + 0x30]
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x230]
call qword [sym.imp.USER32.dll_MessageBoxW]
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.10000f290
lea r11, [rsp + 0x450]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x10000793c
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
push rdi
push r12
sub rsp, 0x450
mov rax, qword [0x100014120]
xor rax, rsp
mov qword [rsp + 0x440], rax
mov rsi, rcx
mov edi, r8d
mov ebx, edx
lea rcx, [rsp + 0x22]
xor r12d, r12d
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x20], r12w
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x232]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x230], r12w
call sub.msvcrt.dll_memset
mov rcx, qword [rsi]
lea rdx, [rsp + 0x20]
mov r8d, 0x104
call qword [sym.imp.USER32.dll_GetWindowTextW]
lea r8, [rsp + 0x230]
lea rcx, [0x1000141e0]
mov r9d, 0x104
mov edx, ebx
call fcn.10000b984
mov rcx, qword [rsi]
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x230]
mov r9d, edi
call qword [sym.imp.USER32.dll_MessageBoxW]
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.10000f290
mov rbx, qword [rsp + 0x488]
add rsp, 0x450
pop r12
pop rdi
pop rsi
ret
Function at 0x100007ddc
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
sub rsp, 0x20
xor ebx, ebx
lea rcx, [0x1000016c0]
mov qword [0x100014970], rbx
mov qword [0x100014978], rbx
mov qword [0x100014980], rbx
mov qword [0x100014988], rbx
mov qword [0x100014990], rbx
mov qword [0x100014998], rbx
mov qword [0x1000149a0], rbx
mov qword [0x1000149a8], rbx
mov qword [0x1000149b0], rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x100014970], rax
cmp rax, rbx
je 0x100007f86
lea rdx, [0x1000016d0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x100014970]
lea rdx, [0x1000016e0]
mov qword [0x100014980], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x100014970]
lea rdx, [0x1000016f0]
mov qword [0x100014988], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x100014970]
lea rdx, [0x100001700]
mov qword [0x100014990], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x100014970]
lea rdx, [0x100001720]
mov qword [0x100014998], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x100014970]
lea rdx, [0x100001738]
mov qword [0x1000149a0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x100014970]
lea rdx, [0x100001748]
mov qword [0x1000149a8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x100014980]
mov qword [0x1000149b0], rax
cmp rcx, rbx
je 0x100007f55
cmp qword [0x100014988], rbx
je 0x100007f55
cmp qword [0x100014990], rbx
je 0x100007f55
cmp qword [0x100014998], rbx
je 0x100007f55
cmp qword [0x1000149a0], rbx
je 0x100007f55
cmp qword [0x1000149a8], rbx
je 0x100007f55
cmp rax, rbx
je 0x100007f55
call rcx
cmp eax, ebx
je 0x100007f86
lea rdx, [0x100001758]
xor ecx, ecx
call qword [0x100014988]
mov qword [0x100014978], rax
jmp 0x100007f86
mov qword [0x100014980], rbx
mov qword [0x100014988], rbx
mov qword [0x100014990], rbx
mov qword [0x100014998], rbx
mov qword [0x1000149a0], rbx
mov qword [0x1000149a8], rbx
mov qword [0x1000149b0], rbx
lea rax, [0x100014970]
add rsp, 0x20
pop rbx
ret
Function at 0x10000b418
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rdi
sub rsp, 0x450
mov rax, qword [0x100014120]
xor rax, rsp
mov qword [rsp + 0x440], rax
mov rdi, rcx
mov ebx, edx
lea rcx, [rsp + 0x22]
xor ebp, ebp
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x20], bp
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x232]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x230], bp
call sub.msvcrt.dll_memset
mov rcx, qword [rdi]
lea rdx, [rsp + 0x20]
mov r8d, 0x104
call qword [sym.imp.USER32.dll_GetWindowTextW]
lea r8, [rsp + 0x230]
lea rcx, [0x1000141e0]
mov r9d, 0x104
mov edx, ebx
call fcn.10000b984
mov rcx, qword [rdi]
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x230]
mov r9d, 0x131
call qword [sym.imp.USER32.dll_MessageBoxW]
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.10000f290
lea r11, [rsp + 0x450]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x10000b5c4
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x450
mov rax, qword [0x100014120]
xor rax, rsp
mov qword [rsp + 0x440], rax
mov rbx, rcx
mov esi, 1
movzx ecx, dx
sub ecx, esi
je 0x10000b612
cmp ecx, esi
jne 0x10000b712
mov qword [rbx + 8], 2
lea edx, [rsi + 1]
jmp 0x10000b709
mov rcx, qword [rbx]
mov edx, 0x5e6
lea rdi, [rbx + 0x10]
call qword [sym.imp.USER32.dll_GetDlgItem]
mov r12d, 0x104
mov rdx, rdi
mov rcx, rax
mov r8d, r12d
call qword [sym.imp.USER32.dll_GetWindowTextW]
xor ebp, ebp
cmp eax, r12d
jae 0x10000b647
mov eax, eax
mov word [rbx + rax*2 + 0x10], bp
lea r8, [rsp + 0x20]
lea rcx, [0x1000141e0]
mov r9d, r12d
mov edx, 0x65
call fcn.10000b984
cmp eax, ebp
je 0x10000b702
lea rax, [rsp + 0x20]
sub rdi, rax
movzx ecx, word [rax]
movzx edx, word [rax + rdi]
sub ecx, edx
jne 0x10000b683
add rax, 2
test edx, edx
jne 0x10000b670
cmp ecx, ebp
jne 0x10000b702
mov edi, 0x206
lea rcx, [rsp + 0x232]
xor edx, edx
mov r8, rdi
mov word [rsp + 0x230], bp
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x22]
mov r8, rdi
xor edx, edx
mov word [rsp + 0x20], bp
call sub.msvcrt.dll_memset
mov rcx, qword [rbx]
lea rdx, [rsp + 0x230]
mov r8d, r12d
call qword [sym.imp.USER32.dll_GetWindowTextW]
lea r8, [rsp + 0x20]
lea rcx, [0x1000141e0]
mov r9d, r12d
mov edx, 0x712
call fcn.10000b984
mov rcx, qword [rbx]
lea r8, [rsp + 0x230]
lea rdx, [rsp + 0x20]
xor r9d, r9d
call qword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x10000b712
mov qword [rbx + 8], rsi
mov rdx, rsi
mov rcx, qword [rbx]
call qword [sym.imp.USER32.dll_EndDialog]
mov rax, rsi
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.10000f290
lea r11, [rsp + 0x450]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
Function at 0x10000b984
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x20
mov rbx, qword [0x1000148e0]
movzx r12d, word [0x1000141e0]
xor edi, edi
mov r14d, r9d
mov rbp, r8
mov esi, edx
cmp rbx, rdi
je 0x10000ba6f
mov eax, edx
lea edx, [rdi + 6]
movzx r9d, r12w
sar eax, 4
mov rcx, rbx
and esi, 0xf
inc eax
movzx r13d, ax
mov r8, r13
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
cmp rax, rdi
jne 0x10000ba09
mov r9d, 0x400
cmp r12w, r9w
je 0x10000ba6f
lea edx, [rdi + 6]
mov r8, r13
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
cmp rax, rdi
je 0x10000ba6f
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
cmp rax, rdi
je 0x10000ba6f
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdx, rax
cmp rax, rdi
je 0x10000ba6f
cmp esi, edi
jbe 0x10000ba42
mov ecx, esi
movzx eax, word [rdx]
inc eax
sub rcx, 1
cdqe
lea rdx, [rdx + rax*2]
jne 0x10000ba31
movzx esi, word [rdx]
cmp rbp, rdi
je 0x10000ba6d
lea eax, [r14 - 1]
mov rcx, rbp
cmp esi, eax
cmovl eax, esi
add rdx, 2
movsxd rsi, eax
lea rbx, [rsi + rsi]
mov r8, rbx
call sub.msvcrt.dll_memcpy
mov word [rbx + rbp], di
mov edi, esi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov eax, edi
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop r13
pop r12
ret

Function at 0x10000ba98
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
movzx edi, r8w
movzx r9d, r8w
mov rsi, rdx
mov r8, rdx
mov edx, 5
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
test rax, rax
jne 0x10000baec
mov r9d, 0x400
cmp di, r9w
je 0x10000bae8
lea edx, [rax + 5]
mov r8, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
test rax, rax
jne 0x10000baec
xor eax, eax
jmp 0x10000bb06
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x10000bae8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x10000cf5c
Capabilities:
Accept command line arguments

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x260
mov rax, qword [0x100014120]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov r14, qword [rsp + 0x2c0]
mov rbp, r8
mov r13, r9
mov rdi, rdx
lea r8, [rsp + 0x40]
lea rcx, [0x1000141e0]
mov r9d, 0x104
mov edx, 0xc83
call fcn.10000b984
test eax, eax
jg 0x10000cfb8
xor eax, eax
jmp 0x10000d138
mov rcx, qword [0x1000148e0]
xor r9d, r9d
mov edx, 0x3e9
lea r8d, [r9 + 1]
mov dword [rsp + 0x28], 0x40
and dword [rsp + 0x20], 0
call qword [sym.imp.USER32.dll_LoadImageW]
xor r12d, r12d
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea rdx, [0x100001dc8]
mov rcx, rax
call qword [sym.imp.msvcrt.dll_wcsstr]
mov rbx, rax
test rax, rax
je 0x10000d01f
lea rcx, [0x100001dc8]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
lea rcx, [rbx + rcx*2]
call qword [sym.imp.msvcrt.dll__wtoi64]
mov r12, rax
xor ecx, ecx
call fcn.10000c31c
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
test rdi, rdi
je 0x10000d12a
cmp eax, 0xb7
jne 0x10000d0a0
lea rcx, [0x100001d38]
mov rdx, rbp
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
je 0x10000d121
mov rcx, rax
call qword [sym.imp.USER32.dll_GetLastActivePopup]
mov rcx, rax
call qword [sym.imp.USER32.dll_SetForegroundWindow]
mov rcx, qword [0x1000141e8]
lea rbx, [0x1000141e8]
cmp rcx, rbx
je 0x10000d121
test byte [rcx + 0x1c], 0x80
je 0x10000d121
mov edx, 0xa
jmp 0x10000d111
mov rcx, qword [0x1000141e8]
lea rbx, [0x1000141e8]
cmp rcx, rbx
je 0x10000d0ce
test byte [rcx + 0x1c], 0x80
je 0x10000d0ce
mov rcx, qword [rcx + 0x10]
lea r8, [0x1000019d8]
mov edx, 0xb
call fcn.10000c40c
lea rax, [0x100001dd8]
mov r9, r14
mov r8, rbp
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov rdx, rsi
mov rcx, r12
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], rax
call fcn.10000d98c
mov rcx, qword [0x1000141e8]
cmp rcx, rbx
je 0x10000d121
test byte [rcx + 0x1c], 0x80
je 0x10000d121
mov edx, 0xc
mov rcx, qword [rcx + 0x10]
lea r8, [0x1000019d8]
call fcn.10000c40c
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call qword [sym.imp.USER32.dll_DestroyIcon]
mov eax, 1
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.10000f290
add rsp, 0x260
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret