joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140117d34
Capabilities:
Delete registry value

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x40
and dword [rax - 0x20], 0
lea r8, str.SoftwareMicrosoftWindowsCurrentVersionPreviewHandlers
and qword [rax - 0x18], 0
mov rdi, rcx
mov rdx, 0xffffffff80000002
lea rcx, [rax - 0x28]
mov r9d, 0x2001f
mov qword [rax - 0x28], rdx
call fcn.140047e64
test eax, eax
jne 0x140117d99
mov rcx, qword [rsp + 0x20]
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp qword [rsp + 0x20], 0
je 0x140117d94
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
and qword [rsp + 0x20], 0
and dword [rsp + 0x28], 0
mov r9d, 0x2001f
lea r8, str.CLSID
mov rdx, 0xffffffff80000000
lea rcx, [rsp + 0x20]
call fcn.140047e64
test eax, eax
jne 0x140117ddc
mov rdx, rdi
lea rcx, [rsp + 0x20]
call fcn.140117e24
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x140117dec
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ecx, ecx
jmp 0x140117de1
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x140117dec
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
add rsp, 0x40
pop rdi
ret

Function at 0x14013b668
Capabilities:
Print debug messages

Disassembly:
mov rcx, qword [rcx + 0x40]
jmp 0x14013c1f8
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
xor edi, edi
mov dword [rax - 0x18], edi
mov rbx, qword [0x140423728]
and qword [rax + 0x10], rdi
xor esi, esi
mov eax, dword [0x14041c514]
test eax, eax
je 0x14013c243
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x14041c514]
test eax, eax
jne 0x14013c24c
call fcn.1400087bc
test eax, eax
je 0x14013c268
lea rdx, [rsp + 0x48]
mov rcx, qword [0x140412028]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne 0x14013c270
xor eax, eax
jmp 0x14013c2d5
test rbx, rbx
jne 0x14013c290
lea rcx, str.MakeDragList
call fcn.14001e2ec
mov rbx, rax
test rax, rax
je 0x14013c2a3
mov qword [0x140423728], rax
mov rcx, rbx
call fcn.1402821f0
mov rcx, r14
call rbx
mov edi, eax
mov dword [rsp + 0x20], eax
xor ebx, ebx
test edi, edi
sete bl
test ebx, ebx
je 0x14013c2b8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x14013c2ba
xor esi, esi
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x14013c2d3
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x14013bc90
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push r13
push r14
push r15
sub rsp, 0x50
mov r14d, r9d
mov r15d, r8d
mov r12, rdx
mov r13, rcx
xor esi, esi
mov qword [rax - 0x20], rsi
mov rbx, qword [0x140423708]
and qword [rax - 0x28], rsi
xor edi, edi
mov eax, dword [0x14041c514]
test eax, eax
je 0x14013bced
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x14041c514]
test eax, eax
jne 0x14013bcf6
call fcn.1400087bc
test eax, eax
je 0x14013bd12
lea rdx, [rsp + 0x40]
mov rcx, qword [0x140412028]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne edi, ecx
test edi, edi
jne 0x14013bd1d
xor eax, eax
jmp 0x14013bdb0
test rbx, rbx
jne 0x14013bd3d
lea rcx, str.ImageList_LoadImageW
call fcn.14001e2ec
mov rbx, rax
test rax, rax
je 0x14013bd7c
mov qword [0x140423708], rax
mov rcx, rbx
call fcn.1402821f0
mov eax, dword [rsp + 0xa0]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x98]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x90]
mov dword [rsp + 0x20], eax
mov r9d, r14d
mov r8d, r15d
mov rdx, r12
mov rcx, r13
call rbx
mov rsi, rax
mov qword [rsp + 0x48], rax
xor ebx, ebx
test rsi, rsi
sete bl
test ebx, ebx
je 0x14013bd92
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x14013bd94
xor edi, edi
mov rdx, qword [rsp + 0x40]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x14013bdad
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rsi
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret
Function at 0x14013bf04
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
xor edi, edi
mov qword [rax - 0x18], rdi
mov rbx, qword [0x140423710]
and qword [rax + 0x10], rdi
xor esi, esi
mov eax, dword [0x14041c514]
test eax, eax
je 0x14013bf50
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x14041c514]
test eax, eax
jne 0x14013bf59
call fcn.1400087bc
test eax, eax
je 0x14013bf75
lea rdx, [rsp + 0x48]
mov rcx, qword [0x140412028]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne 0x14013bf7d
xor eax, eax
jmp 0x14013bfe6
test rbx, rbx
jne 0x14013bf9d
lea rcx, str.ImageList_Read
call fcn.14001e2ec
mov rbx, rax
test rax, rax
je 0x14013bfb2
mov qword [0x140423710], rax
mov rcx, rbx
call fcn.1402821f0
mov rcx, r14
call rbx
mov rdi, rax
mov qword [rsp + 0x20], rax
xor ebx, ebx
test rdi, rdi
sete bl
test ebx, ebx
je 0x14013bfc8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x14013bfca
xor esi, esi
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x14013bfe3
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rdi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret

Function at 0x14013c1f8
Capabilities:
Print debug messages

Disassembly:
mov rcx, qword [rcx + 0x40]
jmp 0x14013c1f8
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
xor edi, edi
mov dword [rax - 0x18], edi
mov rbx, qword [0x140423728]
and qword [rax + 0x10], rdi
xor esi, esi
mov eax, dword [0x14041c514]
test eax, eax
je 0x14013c243
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x14041c514]
test eax, eax
jne 0x14013c24c
call fcn.1400087bc
test eax, eax
je 0x14013c268
lea rdx, [rsp + 0x48]
mov rcx, qword [0x140412028]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne 0x14013c270
xor eax, eax
jmp 0x14013c2d5
test rbx, rbx
jne 0x14013c290
lea rcx, str.MakeDragList
call fcn.14001e2ec
mov rbx, rax
test rax, rax
je 0x14013c2a3
mov qword [0x140423728], rax
mov rcx, rbx
call fcn.1402821f0
mov rcx, r14
call rbx
mov edi, eax
mov dword [rsp + 0x20], eax
xor ebx, ebx
test edi, edi
sete bl
test ebx, ebx
je 0x14013c2b8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x14013c2ba
xor esi, esi
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x14013c2d3
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x140156e50
Capabilities:
Delete registry value

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx + 8]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
xor ecx, ecx
test eax, eax
sete cl
mov eax, ecx
add rsp, 0x28
ret

Function at 0x14015709c
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
sub rsp, 0x38
mov rcx, qword [rcx + 8]
lea rax, [r11 + 8]
mov qword [r11 - 0x10], rax
lea r9, [r11 + 0x20]
mov qword [r11 - 0x18], r8
xor r8d, r8d
mov dword [rsp + 0x40], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor edx, edx
test eax, eax
jne 0x1401570de
mov ecx, dword [rsp + 0x58]
sub ecx, 4
neg ecx
sbb eax, eax
and eax, 0xd
test eax, eax
sete dl
mov eax, edx
add rsp, 0x38
ret

Function at 0x140157568
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x30
mov rdi, r9
mov rbx, r8
mov rsi, rdx
mov rbp, rcx
test rdx, rdx
je 0x14015763a
test rbx, rbx
je 0x140157640
test r9, r9
je 0x140157646
and qword [r8], 0
xor r8d, r8d
and dword [r9], 0
mov rcx, qword [rcx + 8]
mov qword [rax - 0x10], r9
lea r9, [rax + 0x10]
and qword [rax - 0x18], 0
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140157623
cmp dword [rsp + 0x48], 3
jne 0x140157623
test eax, eax
jne 0x140157623
cmp dword [rdi], eax
je 0x140157623
mov ecx, dword [rdi]
call fcn.140006460
mov qword [rbx], rax
lea r9, [rsp + 0x48]
mov rcx, qword [rbp + 8]
xor r8d, r8d
mov qword [rsp + 0x28], rdi
mov rdx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140157617
cmp dword [rsp + 0x48], 3
jne 0x140157617
test eax, eax
jne 0x140157617
mov eax, 1
jmp 0x140157625
mov rcx, qword [rbx]
call fcn.140006468
and qword [rbx], 0
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
call fcn.140030064
int3
call fcn.140030064
int3
call fcn.140030064
int3

Function at 0x1401579f8
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
cmp dword [rcx + 0x28], ebx
je 0x140157a09
xor eax, eax
jmp 0x140157a37
mov rcx, qword [rcx + 8]
lea rax, [rsp + 0x40]
mov r9d, 4
mov dword [rsp + 0x40], r8d
mov dword [rsp + 0x28], r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
sete bl
mov eax, ebx
add rsp, 0x30
pop rbx
ret

Function at 0x140157a40
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
cmp dword [rcx + 0x28], ebx
je 0x140157a51
xor eax, eax
jmp 0x140157a75
mov rcx, qword [rcx + 8]
mov dword [rsp + 0x28], r9d
mov r9d, 3
mov qword [rsp + 0x20], r8
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
sete bl
mov eax, ebx
add rsp, 0x30
pop rbx
ret
Function at 0x1401d2f28
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
xor edi, edi
mov dword [rax - 0x18], edi
mov rbx, qword [0x140424e20]
and qword [rax + 0x10], rdi
xor esi, esi
mov eax, dword [0x14041c514]
test eax, eax
je 0x1401d2f73
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x14041c514]
test eax, eax
jne 0x1401d2f7c
call fcn.1400087bc
test eax, eax
je 0x1401d2f98
lea rdx, [rsp + 0x48]
mov rcx, qword [0x140412028]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne 0x1401d2fa0
xor eax, eax
jmp 0x1401d3005
test rbx, rbx
jne 0x1401d2fc0
lea rcx, str.ChooseColorW
call fcn.1400504cc
mov rbx, rax
test rax, rax
je 0x1401d2fd3
mov qword [0x140424e20], rax
mov rcx, rbx
call fcn.1402821f0
mov rcx, r14
call rbx
mov edi, eax
mov dword [rsp + 0x20], eax
xor ebx, ebx
test edi, edi
sete bl
test ebx, ebx
je 0x1401d2fe8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x1401d2fea
xor esi, esi
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x1401d3003
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret

Function at 0x1401fc310
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
xor edi, edi
mov dword [rax - 0x18], edi
mov rbx, qword [0x140425408]
and qword [rax + 0x10], rdi
xor esi, esi
mov eax, dword [0x14041c514]
test eax, eax
je 0x1401fc35b
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x14041c514]
test eax, eax
jne 0x1401fc364
call fcn.1400087bc
test eax, eax
je 0x1401fc380
lea rdx, [rsp + 0x48]
mov rcx, qword [0x140412028]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne 0x1401fc388
xor eax, eax
jmp 0x1401fc3ed
test rbx, rbx
jne 0x1401fc3a8
lea rcx, str.ImageList_DrawIndirect
call fcn.14001e2ec
mov rbx, rax
test rax, rax
je 0x1401fc3bb
mov qword [0x140425408], rax
mov rcx, rbx
call fcn.1402821f0
mov rcx, r14
call rbx
mov edi, eax
mov dword [rsp + 0x20], eax
xor ebx, ebx
test edi, edi
sete bl
test ebx, ebx
je 0x1401fc3d0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x1401fc3d2
xor esi, esi
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x1401fc3eb
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x1401fc404
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
xor edi, edi
mov qword [rax - 0x18], rdi
mov rbx, qword [0x140425410]
and qword [rax + 0x10], rdi
xor esi, esi
mov eax, dword [0x14041c514]
test eax, eax
je 0x1401fc450
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x14041c514]
test eax, eax
jne 0x1401fc459
call fcn.1400087bc
test eax, eax
je 0x1401fc475
lea rdx, [rsp + 0x48]
mov rcx, qword [0x140412028]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne 0x1401fc47d
xor eax, eax
jmp 0x1401fc4e6
test rbx, rbx
jne 0x1401fc49d
lea rcx, str.ImageList_Duplicate
call fcn.14001e2ec
mov rbx, rax
test rax, rax
je 0x1401fc4b2
mov qword [0x140425410], rax
mov rcx, rbx
call fcn.1402821f0
mov rcx, r14
call rbx
mov rdi, rax
mov qword [rsp + 0x20], rax
xor ebx, ebx
test rdi, rdi
sete bl
test ebx, ebx
je 0x1401fc4c8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x1401fc4ca
xor esi, esi
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x1401fc4e3
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rdi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret

Function at 0x140240b60
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
test rdx, rdx
jne 0x140240b8e
xor eax, eax
jmp 0x140240c1b
test rbx, rbx
je 0x140240b87
test r9, r9
jne 0x140240ba6
call fcn.140030a38
mov r9, qword [rax + 0x18]
test r9, r9
je 0x140240b87
mov r8, rbx
mov qword [rsi + 0x10], r9
mov rdx, rdi
mov rcx, r9
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
je 0x140240b87
mov rcx, qword [rsi + 0x10]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r14d, eax
test eax, eax
je 0x140240b87
mov rcx, qword [rsi + 0x10]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbp, rax
test rax, rax
je 0x140240b87
mov rbx, qword [rsi]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rcx, qword [rbx + 8]
mov rdi, rax
call fcn.1402821f0
mov r8d, r14d
mov rdx, rdi
mov rcx, rsi
call qword [rbx + reloc.OLEAUT32.dll_VariantClear]
mov rcx, rbp
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140264c0c
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
xor edi, edi
mov dword [rax - 0x18], edi
mov rbx, qword [0x1404260b0]
and qword [rax + 0x10], rdi
xor esi, esi
mov eax, dword [0x14041c514]
test eax, eax
je 0x140264c57
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x14041c514]
test eax, eax
jne 0x140264c60
call fcn.1400087bc
test eax, eax
je 0x140264c7c
lea rdx, [rsp + 0x48]
mov rcx, qword [0x140412028]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne 0x140264c84
xor eax, eax
jmp 0x140264ce9
test rbx, rbx
jne 0x140264ca4
lea rcx, str.ChooseFontW
call fcn.1400504cc
mov rbx, rax
test rax, rax
je 0x140264cb7
mov qword [0x1404260b0], rax
mov rcx, rbx
call fcn.1402821f0
mov rcx, r14
call rbx
mov edi, eax
mov dword [rsp + 0x20], eax
xor ebx, ebx
test edi, edi
sete bl
test ebx, ebx
je 0x140264ccc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x140264cce
xor esi, esi
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x140264ce7
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret

Function at 0x14027bd60
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
xor edi, edi
mov qword [rax - 0x18], rdi
mov rbx, qword [0x140426338]
and qword [rax + 0x10], rdi
xor esi, esi
mov eax, dword [0x14041c514]
test eax, eax
je 0x14027bdac
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x14041c514]
test eax, eax
jne 0x14027bdb5
call fcn.1400087bc
test eax, eax
je 0x14027bdd1
lea rdx, [rsp + 0x48]
mov rcx, qword [0x140412028]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne 0x14027bdd9
xor eax, eax
jmp 0x14027be42
test rbx, rbx
jne 0x14027bdf9
lea rcx, str.FindTextW
call fcn.1400504cc
mov rbx, rax
test rax, rax
je 0x14027be0e
mov qword [0x140426338], rax
mov rcx, rbx
call fcn.1402821f0
mov rcx, r14
call rbx
mov rdi, rax
mov qword [rsp + 0x20], rax
xor ebx, ebx
test rdi, rdi
sete bl
test ebx, ebx
je 0x14027be24
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x14027be26
xor esi, esi
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x14027be3f
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rdi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x14027be58
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
xor edi, edi
mov qword [rax - 0x18], rdi
mov rbx, qword [0x140426340]
and qword [rax + 0x10], rdi
xor esi, esi
mov eax, dword [0x14041c514]
test eax, eax
je 0x14027bea4
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x14041c514]
test eax, eax
jne 0x14027bead
call fcn.1400087bc
test eax, eax
je 0x14027bec9
lea rdx, [rsp + 0x48]
mov rcx, qword [0x140412028]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne 0x14027bed1
xor eax, eax
jmp 0x14027bf3a
test rbx, rbx
jne 0x14027bef1
lea rcx, str.ReplaceTextW
call fcn.1400504cc
mov rbx, rax
test rax, rax
je 0x14027bf06
mov qword [0x140426340], rax
mov rcx, rbx
call fcn.1402821f0
mov rcx, r14
call rbx
mov rdi, rax
mov qword [rsp + 0x20], rax
xor ebx, ebx
test rdi, rdi
sete bl
test ebx, ebx
je 0x14027bf1c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x14027bf1e
xor esi, esi
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x14027bf37
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rdi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret

Function at 0x14027d028
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
xor edi, edi
mov dword [rax - 0x18], edi
mov rbx, qword [0x140426358]
and qword [rax + 0x10], rdi
xor esi, esi
mov eax, dword [0x14041c514]
test eax, eax
je 0x14027d073
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x14041c514]
test eax, eax
jne 0x14027d07c
call fcn.1400087bc
test eax, eax
je 0x14027d098
lea rdx, [rsp + 0x48]
mov rcx, qword [0x140412028]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne 0x14027d0a0
xor eax, eax
jmp 0x14027d105
test rbx, rbx
jne 0x14027d0c0
lea rcx, str.PageSetupDlgW
call fcn.1400504cc
mov rbx, rax
test rax, rax
je 0x14027d0d3
mov qword [0x140426358], rax
mov rcx, rbx
call fcn.1402821f0
mov rcx, r14
call rbx
mov edi, eax
mov dword [rsp + 0x20], eax
xor ebx, ebx
test edi, edi
sete bl
test ebx, ebx
je 0x14027d0e8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x14027d0ea
xor esi, esi
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x14027d103
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret