joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401ad120
Capabilities:
Get geographical location

Disassembly:
sub rsp, 0x78
mov rax, qword [0x140412700]
xor rax, rsp
mov qword [rsp + 0x60], rax
cmp ecx, 3
jne 0x1401ad174
call qword [sym.imp.KERNEL32.dll_GetThreadLocale]
mov r9d, 0x20
lea r8, [rsp + 0x20]
mov ecx, eax
mov edx, 0x1004
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1401ad16c
xor edx, edx
lea rcx, [rsp + 0x20]
lea r8d, [rdx + 0xa]
call fcn.14028f070
jmp 0x1401ad172
call qword [sym.imp.KERNEL32.dll_GetACP]
mov ecx, eax
test ecx, ecx
jne 0x1401ad180
call qword [sym.imp.KERNEL32.dll_GetACP]
mov ecx, eax
cmp ecx, 1
jne 0x1401ad18d
call qword [sym.imp.KERNEL32.dll_GetOEMCP]
mov ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1402194b0
add rsp, 0x78
ret

Function at 0x1401afe50
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x2040
call fcn.14021a050
sub rsp, rax
mov rax, qword [0x140412700]
xor rax, rsp
mov qword [rsp + 0x2030], rax
mov rax, qword [rcx]
mov rdi, rcx
mov rax, qword [rax + 0x18]
call qword [case.0x14001d845.0]
xor ebx, ebx
test al, al
je 0x1401aff4e
mov rcx, qword [rdi + 0x98]
xor r8d, r8d
xor edx, edx
call fcn.1402a41d8
mov r9, qword [rdi + 0x98]
lea rcx, [rsp + 0x30]
mov esi, 1
mov r8d, 0x2000
mov edx, esi
call fcn.1402a44d4
lea r8, [rsp + 0x20]
mov dword [rdi + 0x78], esi
mov rdx, rax
mov byte [rsp + 0x20], bl
lea rcx, [rsp + 0x30]
call fcn.1401ad08c
mov bpl, byte [rsp + 0x20]
movsx ecx, al
mov byte [rdi + 0x94], al
sub ecx, esi
je 0x1401aff1d
sub ecx, esi
je 0x1401aff14
cmp ecx, esi
je 0x1401aff00
mov sil, bl
jmp 0x1401aff2c
mov al, bpl
mov dword [rdi + 0x7c], 0xfde9
neg al
sbb rbx, rbx
and ebx, 3
jmp 0x1401aff2c
mov dword [rdi + 0x7c], 0x4b1
jmp 0x1401aff24
mov dword [rdi + 0x7c], 0x4b0
mov ebx, 2
mov dword [rdi + 0x78], ebx
mov qword [rdi + 0xa0], rbx
xor r8d, r8d
mov rcx, qword [rdi + 0x98]
mov edx, ebx
call fcn.1402a41d8
mov al, sil
mov byte [rdi + 0x95], bpl
mov rcx, qword [rsp + 0x2030]
xor rcx, rsp
call fcn.1402194b0
lea r11, [rsp + 0x2040]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1401b0a34
Capabilities:
Get file version info

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x250
mov rax, qword [0x140412700]
xor rax, rsp
mov qword [rsp + 0x240], rax
xor edx, edx
mov rbx, rcx
lea r8d, [rdx + 0x34]
call fcn.1402bf2e0
xor edx, edx
lea rsi, [rbx + 0x208]
mov rcx, rsi
lea r8d, [rdx + 0x14]
call fcn.1402bf2e0
xor ebp, ebp
lea rdi, [rbx + 0x48]
mov dword [rsp + 0x20], ebp
cmp qword [rbx + 0x58], rbp
jne 0x1401b0ab2
mov r8d, 0x104
lea rdx, [rsp + 0x30]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.140011ae8
jmp 0x1401b0afe
cmp qword [rdi + 0x18], 7
jbe 0x1401b0abc
mov rdi, qword [rdi]
lea rax, [rsp + 0x30]
mov edx, 0x104
sub rdi, rax
lea rcx, [rsp + 0x30]
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x1401b0af0
movzx eax, word [rdi + rcx]
test ax, ax
je 0x1401b0af0
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x1401b0ace
test rdx, rdx
lea rax, [rcx - 2]
cmovne rax, rcx
mov word [rax], bp
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
call qword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov edi, eax
test eax, eax
je 0x1401b0b5f
mov ecx, edi
mov byte [rbx + 0x44], 1
call fcn.14000e3e0
mov rcx, qword [rbx + 0x38]
mov qword [rbx + 0x38], rax
test rcx, rcx
je 0x1401b0b31
call fcn.14000e3f0
mov r9, qword [rbx + 0x38]
lea rcx, [rsp + 0x30]
mov r8d, edi
xor edx, edx
call qword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x1401b0b5f
mov rcx, rbx
call fcn.1401b0ee4
cmp byte [rbx + 0x40], bpl
jne 0x1401b0b5f
mov rcx, rbx
call fcn.1401b0bd4
cmp byte [rbx + 0x41], bpl
je 0x1401b0bab
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
test rax, rax
je 0x1401b0bab
lea rdx, str.DllGetVersion
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1401b0ba2
mov rcx, rsi
mov dword [rsi], reloc.OLEAUT32.dll_SafeArrayLock
call qword [case.0x14001d845.0]
test eax, eax
jns 0x1401b0ba2
mov dword [rsi], ebp
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1402194b0
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x1401b4634
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
xor ebx, ebx
mov rsi, rdx
lea ecx, [rbx + 0x10]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x1401b468d
lea ecx, [rbx + 0x11]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x1401b468d
cmp qword [rsi + 0x10], 0x26
je 0x1401b467f
cmp qword [rsi + 0x10], 0x28
jne 0x1401b4689
mov rcx, rdi
call fcn.1401b5020
jmp 0x1401b4687
mov rcx, rdi
call fcn.1401b5180
mov bl, 1
mov al, bl
jmp 0x1401b468f
xor al, al
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1401b9d50
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
cmp dword [rdx + 8], 0x101
lea rbx, [rdx + 0x10]
mov rdi, rdx
mov rsi, rcx
jne 0x1401b9d7a
cmp qword [rbx], 0x11
je 0x1401b9d8c
jmp 0x1401b9da0
cmp dword [rdx + 8], 0x100
mov rax, rbx
jne 0x1401b9da3
cmp qword [rbx], 0x1b
jne 0x1401b9da3
mov rcx, qword [rcx + 0x40]
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x10]
call qword [sym.imp.USER32.dll_PostMessageW]
mov rax, rbx
cmp dword [rdi + 8], 0x100
jne 0x1401b9dd7
cmp qword [rax], 9
jne 0x1401b9dd7
mov ecx, InitCommonControls
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov rcx, qword [rsi + 0x40]
xor r9d, r9d
movzx r8d, ax
mov edx, 0x8022
shr r8, 0xf
call qword [sym.imp.USER32.dll_PostMessageW]
mov rdx, rdi
mov rcx, rsi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.1401c2e50

Function at 0x1401bc114
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
movsxd r8, dword [0x14000003c]
lea rsi, [0x140000000]
add r8, rsi
mov rbx, rdx
mov rdi, rcx
cmp dword [r8 + 0x84], 0xd
jbe 0x1401bc18c
mov r10d, dword [r8 + 0xf0]
xor r9d, r9d
test r10d, r10d
je 0x1401bc18c
movzx ecx, word [r8 + 0x14]
movzx r11d, word [r8 + 6]
add rcx, 0x18
mov r10d, dword [r10 + rsi + 0xc]
add rcx, r8
test r11d, r11d
je 0x1401bc18c
mov eax, dword [rcx + 0xc]
cmp r10d, eax
jb 0x1401bc180
mov edx, dword [rcx + 8]
add eax, edx
cmp r10d, eax
jb 0x1401bc19e
inc r9d
add rcx, 0x28
cmp r9d, r11d
jb 0x1401bc16e
xor eax, eax
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
mov dword [rdi], edx
mov eax, dword [rcx + 0x24]
mov dword [rbx], eax
mov eax, dword [rcx + 0xc]
add rax, rsi
jmp 0x1401bc18e
Function at 0x1401bfae4
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
movsxd rsi, r8d
mov rbx, rdx
mov rdi, rcx
xor ebp, ebp
cmp qword [rcx + 0xd0], rbp
jne 0x1401bfb1e
mov r8d, esi
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x1401bfbc2
call fcn.1401bdd78
mov rcx, rax
test rax, rax
je 0x1401bfbdd
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x14001d845.0]
add rax, 0x18
mov qword [rsp + 0x30], rax
mov rcx, qword [rdi + 0xd0]
mov rax, qword [rcx]
lea rdx, [rsp + 0x30]
mov rax, qword [rax + 0x118]
call qword [case.0x14001d845.0]
mov rdx, rsi
or rdi, 0xffffffffffffffff
mov r9, rdi
mov r8, qword [rsp + 0x30]
mov rcx, rbx
call fcn.140287334
test eax, eax
je 0x1401bfb86
cmp eax, 0xc
je 0x1401bfbd7
cmp eax, 0x50
jne 0x1401bfbe8
test rbx, rbx
jne 0x1401bfb8f
mov ebx, ebp
jmp 0x1401bfb9a
mov rcx, rbx
call fcn.140286900
mov rbx, rax
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
mov ecx, edi
lock xadd dword [rdx + 0x10], ecx
add ecx, edi
test ecx, ecx
jg 0x1401bfbc0
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14001d845.0]
mov eax, ebx
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
call fcn.1401beaec
nop
mov ecx, 0x80004005
call fcn.14000e344
nop
call fcn.1401beac8
int3

Function at 0x1401c1750
Capabilities:
Get graphical window text

Disassembly:
sub rsp, 0x78
test rdx, rdx
je 0x1401c17b8
mov r10, qword [rcx + 0x10]
test r10, r10
je 0x1401c17a2
cmp qword [rcx + 0x18], 0
jne 0x1401c179d
mov eax, dword [rcx + 0xc]
cmp eax, dword [rcx + 0x30]
jae 0x1401c17be
mov qword [rsp + 0x58], rdx
lea r9, [rsp + 0x20]
mov dword [rsp + 0x20], 0x50
mov edx, eax
mov dword [rsp + 0x24], 0x40
mov r8d, 1
mov rcx, qword [r10 + 8]
call qword [sym.imp.USER32.dll_SetMenuItemInfoW]
add rsp, 0x78
ret
mov rcx, qword [rcx + 0x20]
test rcx, rcx
je 0x1401c17b8
mov rcx, qword [rcx + 0x40]
add rsp, 0x78
jmp fcn.140208334
call fcn.1401beac8
int3
call fcn.1401beac8
int3
Function at 0x1401c1fe0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbx, qword [rcx + 0x100]
xor r14d, r14d
mov rdi, rcx
mov rsi, qword [rcx + 0xf8]
cmp qword [rcx + 0xf0], r14
je 0x1401c2047
call fcn.1401bf5e4
mov rdx, qword [rdi + 0xf0]
lea r8d, [r14 + 5]
mov rbp, qword [rax + 0x18]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x1401c2047
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
test rsi, rsi
je 0x1401c2058
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
mov eax, 1
test rbx, rbx
je 0x1401c209d
mov edx, 0xffff
lea rcx, [rbx + 0xc]
cmp word [rbx + 2], dx
jne 0x1401c207c
movzx r8d, word [rbx + 0x12]
movzx edx, word [rbx + 0x14]
jmp 0x1401c2087
movzx edx, word [rcx]
mov rcx, rbx
movzx r8d, word [rbx + 0xa]
test dword [rcx], 0x1801
jne 0x1401c209a
test r8w, r8w
jne 0x1401c209a
test dx, dx
je 0x1401c209d
mov eax, r14d
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x1401c20c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov qword [rcx + 0xf0], rdx
mov rbp, r8
mov rdi, rdx
mov rbx, rcx
cmp rdx, 0x10000
jae 0x1401c20ff
cmp dword [rcx + 0xe8], 0
jne 0x1401c20ff
movzx eax, dx
mov dword [rcx + 0xe8], eax
call fcn.1401bf5e4
mov r8d, 5
mov rdx, rdi
mov rsi, qword [rax + 0x18]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x1401c2143
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x1401c2143
mov r9, rsi
mov r8, rbp
mov rdx, rax
mov rcx, rbx
call fcn.1401c2478
jmp 0x1401c2145
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1401c215c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rsi, r8
mov rbx, rdx
mov rbp, rcx
call fcn.1401bf5e4
mov r8d, 5
mov rdx, rbx
mov rdi, qword [rax + 0x18]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x1401c21c6
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x1401c21c6
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r9, rdi
mov r8, rsi
mov rdx, rax
mov rcx, rbp
call fcn.1401c21e0
jmp 0x1401c21c8
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1401c5d18
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
xor ebx, ebx
mov rdi, rdx
mov rsi, rcx
test rdx, rdx
je 0x1401c5d76
call fcn.1401bf5e4
mov r8d, 0xf0
mov rdx, rdi
mov rbp, qword [rax + 0x18]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x1401c5d76
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x1401c5d81
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
mov rdx, rbx
mov rcx, rsi
call fcn.1401bc678
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1401c6350
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rbx, r8
lea rcx, [0x14036ac58]
mov esi, edx
call fcn.140286900
mov r8d, eax
lea rdx, [0x14036ac58]
mov rcx, rbx
call fcn.14000df94
xor ebp, ebp
mov edx, esi
cmp qword [rdi + 0xc8], rbp
jne 0x1401c6432
mov rcx, qword [rdi + 0x40]
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rsi, rax
test rax, rax
je 0x1401c644a
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
movsxd rdi, eax
test eax, eax
js 0x1401c6465
mov rcx, qword [rbx]
lea r8d, [rbp + 1]
mov edx, dword [rcx - 0xc]
sub r8d, dword [rcx - 8]
sub edx, edi
or r8d, edx
jge 0x1401c63e4
mov edx, edi
mov rcx, rbx
call fcn.14000e2ac
mov rdx, qword [rbx]
cmp edi, dword [rdx - 0xc]
jg 0x1401c6465
mov dword [rdx - 0x10], edi
lea r8d, [rdi + 1]
mov rax, qword [rbx]
mov rcx, rsi
mov word [rax + rdi*2], bp
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov rcx, qword [rbx]
test rcx, rcx
jne 0x1401c640f
mov eax, ebp
jmp 0x1401c641c
movsxd rdx, dword [rcx - 0xc]
call fcn.140286a2c
test eax, eax
js 0x1401c6465
mov rcx, qword [rbx]
cmp eax, dword [rcx - 0xc]
jg 0x1401c6465
mov dword [rcx - 0x10], eax
mov ecx, eax
mov rax, qword [rbx]
mov word [rax + rcx*2], bp
jmp 0x1401c644a
mov rcx, rdi
call fcn.1401bf8d0
test rax, rax
je 0x1401c644a
mov rdx, rbx
mov rcx, rax
call fcn.1401c6964
mov rax, qword [rbx]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov eax, dword [rax - 0x10]
add rsp, 0x20
pop rdi
ret
mov ecx, 0x80070057
call fcn.14000e344
int3
Function at 0x1401c6964
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
xor ebp, ebp
mov rcx, qword [rcx + 0xd0]
mov rbx, rdx
test rcx, rcx
jne 0x1401c6a13
mov rcx, qword [rsi + 0x40]
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
movsxd rdi, eax
test eax, eax
js 0x1401c6a38
mov rcx, qword [rbx]
lea r8d, [rbp + 1]
mov edx, dword [rcx - 0xc]
sub r8d, dword [rcx - 8]
sub edx, edi
or r8d, edx
jge 0x1401c69c4
mov edx, edi
mov rcx, rbx
call fcn.14000e2ac
mov rdx, qword [rbx]
cmp edi, dword [rdx - 0xc]
jg 0x1401c6a38
mov dword [rdx - 0x10], edi
lea r8d, [rdi + 1]
mov rax, qword [rbx]
mov word [rax + rdi*2], bp
mov rcx, qword [rsi + 0x40]
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov rcx, qword [rbx]
test rcx, rcx
jne 0x1401c69f0
mov eax, ebp
jmp 0x1401c69fd
movsxd rdx, dword [rcx - 0xc]
call fcn.140286a2c
test eax, eax
js 0x1401c6a38
mov rcx, qword [rbx]
cmp eax, dword [rcx - 0xc]
jg 0x1401c6a38
mov dword [rcx - 0x10], eax
mov ecx, eax
mov rax, qword [rbx]
mov word [rax + rcx*2], bp
jmp 0x1401c6a23
mov rax, qword [rcx]
mov rax, qword [rax + 0x118]
call qword [case.0x14001d845.0]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov ecx, 0x80070057
call fcn.14000e344
int3

Function at 0x1401c7028
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rdi, rdx
mov rbx, rcx
test rcx, rcx
je 0x1401c70e1
mov rcx, qword [rcx + 0x40]
test rcx, rcx
je 0x1401c70e1
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1401c70e1
test rdi, rdi
je 0x1401c70e1
xor r14d, r14d
xor esi, esi
call fcn.1401bf5e4
lea r8, [0x1402f54b0]
mov rdx, rdi
mov rbp, qword [rax + 0x18]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdi, rax
test rax, rax
je 0x1401c70c1
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rdx, rdi
mov rcx, rbp
mov r14d, eax
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x1401c70e1
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rsi, rax
mov r8d, r14d
mov rdx, rsi
mov rcx, rbx
call fcn.1402096e8
mov edi, eax
test eax, eax
je 0x1401c70dd
mov rcx, rbx
call fcn.1401c6cec
mov eax, edi
jmp 0x1401c70e3
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x1401c80b0
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, rcx
mov rbx, r8
mov rcx, qword [rcx + 0x40]
call fcn.140208674
mov rdi, rax
test rax, rax
je 0x1401c812c
mov rcx, rax
call qword [sym.imp.USER32.dll_GetDlgCtrlID]
mov esi, eax
test rbx, rbx
je 0x1401c8127
cmp dword [rbx], 0x40
jb 0x1401c8127
mov rcx, qword [rbp + 0x40]
xor r9d, r9d
or dword [rbx + 4], 1
xor r8d, r8d
or qword [rbx + 0x30], 0xffffffffffffffff
mov edx, 0x87
mov qword [rbx + 8], rcx
mov rcx, rdi
mov qword [rbx + 0x10], rdi
call qword [sym.imp.USER32.dll_SendMessageW]
bt rax, 0xd
jb 0x1401c8127
or dword [rbx + 4], 0x80000002
mov rax, rsi
jmp 0x1401c8130
or rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1401e10c0
Capabilities:
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx], 0
mov edi, r8d
mov rsi, rdx
mov rbx, rcx
je 0x1401e1115
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1401e1128
lea rdx, str.SetFileAttributesTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1401e1128
mov r8, qword [rbx]
mov edx, edi
mov rcx, rsi
call qword [case.0x14001d845.0]
jmp 0x1401e112a
cmp dword [rcx + 8], 0
je 0x1401e1128
mov edx, edi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
jmp 0x1401e112a
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1401e113c
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x90
mov rax, qword [0x140412700]
xor rax, rsp
mov qword [rsp + 0x80], rax
xor r15d, r15d
xor r12d, r12d
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
test r8, r8
je 0x1401e1191
mov rdx, rcx
lea r9, [rsp + 0x58]
mov rcx, rsi
xor r8d, r8d
call fcn.1401e09e8
neg eax
sbb ebx, ebx
and ebx, dword [rsp + 0x58]
jmp 0x1401e1199
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x1401e130e
mov edx, dword [rbp + 0x20]
cmp edx, ebx
je 0x1401e11d4
test bl, 1
je 0x1401e11d4
test rsi, rsi
je 0x1401e11c3
mov r8d, edx
mov rcx, rsi
mov rdx, rdi
call fcn.1401e10c0
jmp 0x1401e11cc
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x1401e131f
lea rcx, [rbp + 8]
cmp qword [rcx], r12
je 0x1401e12ba
lea rdx, [rsp + 0x50]
call fcn.1401e07a8
lea rcx, [rbp + 0x10]
cmp qword [rcx], r12
je 0x1401e1203
lea rdx, [rsp + 0x40]
call fcn.1401e07a8
lea r12, [rsp + 0x40]
cmp qword [rbp], r15
je 0x1401e121b
lea rdx, [rsp + 0x48]
mov rcx, rbp
call fcn.1401e07a8
lea r15, [rsp + 0x48]
test rsi, rsi
je 0x1401e1255
and qword [rsp + 0x38], 0
mov r9d, 1
mov dword [rsp + 0x30], 0x80
mov r8d, 0xc0000000
mov dword [rsp + 0x28], 3
mov rdx, rdi
and qword [rsp + 0x20], 0
mov rcx, rsi
call fcn.1401e08f0
jmp 0x1401e1280
and qword [rsp + 0x30], 0
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
mov edx, 0xc0000000
mov rcx, rdi
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x1401e1330
lea r9, [rsp + 0x50]
mov r8, r12
mov rdx, r15
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFileTime]
test eax, eax
je 0x1401e1341
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x1401e135d
mov edx, dword [rbp + 0x20]
cmp edx, ebx
je 0x1401e12ec
test bl, 1
jne 0x1401e12ec
test rsi, rsi
je 0x1401e12db
mov r8d, edx
mov rcx, rsi
mov rdx, rdi
call fcn.1401e10c0
jmp 0x1401e12e4
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x1401e136e
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1402194b0
add rsp, 0x90
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
mov rdx, rdi
call fcn.14020ba2c
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
mov rdx, rdi
call fcn.14020ba2c
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
mov rdx, rdi
call fcn.14020ba2c
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, rdi
mov ecx, ebx
call fcn.14020ba2c
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
mov rdx, rdi
call fcn.14020ba2c
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
mov rdx, rdi
call fcn.14020ba2c
int3