joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000e7c8
Capabilities:
Read clipboard data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rdx
xor ebx, ebx
call fcn.140010088
test eax, eax
je 0x14000e823
lea ecx, [rbx + 1]
call qword [sym.imp.USER32.dll_GetClipboardData]
mov rdi, rax
test rax, rax
je 0x14000e81d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
test rax, rax
je 0x14000e81d
mov rdx, rax
mov rcx, rsi
call fcn.1400024bc
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov ebx, 1
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rsi, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140010094
Capabilities:
Write clipboard data

Disassembly:
push rbp
sub rsp, 0x30
lea rbp, [rsp + 0x20]
mov qword [rbp + 0x20], rbx
mov qword [rbp + 0x28], rsi
mov qword [rbp + 0x30], rdi
mov qword [rbp + 0x38], r14
mov rax, qword [0x141719df0]
xor rax, rbp
mov qword [rbp + 8], rax
xor ebx, ebx
mov rdi, rdx
mov rsi, rcx
test rdx, rdx
je 0x1400101cb
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x1400101cb
lea rcx, [rbp]
call fcn.14000e6cc
mov rcx, rsi
call fcn.140010088
test eax, eax
je 0x1400101be
call qword [sym.imp.USER32.dll_EmptyClipboard]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
mov ecx, 0x2002
movsxd rdx, eax
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov r14, rax
test rax, rax
je 0x1400101b8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rsi, rax
call fcn.140002adc
mov r9d, eax
or rcx, 0xffffffffffffffff
inc rcx
cmp word [rdi + rcx*2], bx
jne 0x14001013b
inc ecx
cmp ecx, 0x3fffffff
jle 0x140010153
mov rax, rbx
jmp 0x14001018c
movsxd rax, ecx
lea r8d, [rcx + rcx]
add rax, rax
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x140010170
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1401d7280
sub rsp, rcx
mov rdx, rdi
lea rcx, [rsp + 0x20]
call fcn.1400068e8
sub rsi, rax
mov dl, byte [rax]
mov byte [rsi + rax], dl
inc rax
test dl, dl
jne 0x14001018f
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rdx, r14
mov ecx, 1
call qword [sym.imp.USER32.dll_SetClipboardData]
test rax, rax
setne bl
call qword [sym.imp.USER32.dll_CloseClipboard]
lea rcx, [rbp]
call fcn.14000e6ec
mov eax, ebx
jmp 0x1400101cd
xor eax, eax
mov rcx, qword [rbp + 8]
xor rcx, rbp
call fcn.1401d72f0
mov rbx, qword [rbp + 0x20]
mov rsi, qword [rbp + 0x28]
mov rdi, qword [rbp + 0x30]
mov r14, qword [rbp + 0x38]
lea rsp, [rbp + 0x10]
pop rbp
ret
Function at 0x140014564
Capabilities:
Extract resource via kernel32 functions

Disassembly:
movzx edx, dx
jmp 0x140049100
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x20
mov r15, rdx
mov r14, rcx
call fcn.140029cf0
mov r8d, 0xf1
mov rdx, r15
mov rbx, qword [rax + 0x18]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
xor r12d, r12d
test rax, rax
jne 0x140049146
xor eax, eax
jmp 0x14004921e
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rdi, rax
test rax, rax
je 0x14004913f
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x14004913f
movzx ecx, word [rax + 6]
mov eax, 4
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.140003cfc
mov rbp, rax
mov r9d, r12d
cmp r12w, word [rbx + 6]
jae 0x1400491b8
mov rdx, rax
lea r8, [rbx + 8]
movzx ecx, word [r8]
inc r9d
mov dword [rdx], ecx
lea r8, [r8 + 2]
movzx eax, word [rbx + 6]
lea rdx, [rdx + 4]
cmp r9d, eax
jl 0x14004919e
movzx r8d, word [rbx + 6]
mov rdx, rbp
mov rcx, r14
call fcn.140049a58
mov rcx, rbp
mov esi, eax
call fcn.1400122c8
test esi, esi
je 0x140049213
movzx ecx, word [rbx + 4]
movzx eax, word [rbx + 2]
mov dword [rsp + 0x60], eax
add eax, 7
mov dword [rsp + 0x68], eax
lea eax, [rcx + 7]
mov dword [rsp + 0x64], ecx
mov r8, qword [rsp + 0x60]
mov rcx, r14
mov dword [rsp + 0x6c], eax
mov rdx, qword [rsp + 0x68]
call fcn.140049c78
mov rdx, r15
mov rcx, r14
call fcn.140049084
mov esi, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret

Function at 0x140014bfc
Capabilities:
Encode data using xor

Disassembly:
xor r11d, r11d
mov word [rsp + 0x10], r8w
movsxd r10, edx
mov r9, rcx
movzx r8d, r11w
test edx, edx
jle 0x140014c43
lea edx, [r11 + 1]
mov cl, byte [r9]
cmp dx, r8w
mov eax, r11d
cmovne ax, r8w
add cl, 9
movzx r8d, ax
mov al, byte [rsp + r8*2 + 0x10]
add r8w, dx
xor al, cl
mov byte [r9], al
add r9, rdx
sub r10, rdx
jne 0x140014c17
ret
Function at 0x140018408
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x260
mov rax, qword [0x141719df0]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov r10, r8
lea rcx, [rsp + 0x38]
mov rax, rdx
mov qword [rsp + 0x20], rcx
mov rbx, r9
mov rcx, rax
mov r9d, 1
xor r8d, r8d
mov rdx, r10
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test eax, eax
jne 0x14001849a
mov rcx, qword [rsp + 0x38]
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x40]
mov dword [rsp + 0x30], 0x104
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueW]
lea rax, [rsp + 0x40]
sub rbx, rax
lea rcx, [rsp + 0x40]
movzx eax, word [rcx]
mov word [rbx + rcx], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x14001847f
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1401d72f0
add rsp, 0x260
pop rdi
pop rsi
pop rbx
ret

Function at 0x14001a224
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rbx, rcx
mov rsi, rdx
mov rcx, rdx
call fcn.140002528
mov rcx, rbx
mov rdi, rax
call fcn.1400184c0
xor ebx, ebx
mov dword [rsp + 0x28], 5
mov rcx, rax
mov qword [rsp + 0x20], rbx
xor r9d, r9d
lea rdx, str.open
mov r8, rdi
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jle 0x14001a27b
mov ebx, 1
mov rcx, rsi
call fcn.140002488
mov rsi, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x140020560
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
xor edi, edi
xor ebx, ebx
mov rsi, rdx
mov r14, rcx
test rdx, rdx
je 0x1400205c8
call fcn.140029cf0
mov r8d, 0xf0
mov rdx, rsi
mov rbp, qword [rax + 0x18]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x1400205c8
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbx, rax
test rax, rax
je 0x1400205ea
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
mov rdx, rdi
mov rcx, r14
call fcn.140059254
mov esi, eax
test rdi, rdi
je 0x1400205e8
test rbx, rbx
je 0x1400205e8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140021528
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rsi, rdx
mov rbx, rcx
test rcx, rcx
je 0x140021600
mov rcx, qword [rcx + 0x40]
test rcx, rcx
je 0x140021600
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x140021600
test rsi, rsi
je 0x140021600
xor r15d, r15d
xor ebp, ebp
xor edi, edi
call fcn.140029cf0
lea r8, str.AFX_DIALOG_LAYOUT
mov rdx, rsi
mov r14, qword [rax + 0x18]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rsi, rax
test rax, rax
je 0x1400215cd
mov rdx, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rdx, rsi
mov rcx, r14
mov r15d, eax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rdi, rax
test rax, rax
je 0x140021600
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbp, rax
mov r8d, r15d
mov rdx, rbp
mov rcx, rbx
call fcn.140059fe0
mov esi, eax
test rbp, rbp
je 0x1400215f0
test rdi, rdi
je 0x1400215f0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeResource]
test esi, esi
je 0x1400215fc
mov rcx, rbx
call fcn.140021190
mov eax, esi
jmp 0x140021602
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret

Function at 0x14002272c
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, rcx
mov rbx, r8
mov rcx, qword [rcx + 0x40]
call fcn.140057534
mov rdi, rax
test rax, rax
je 0x1400227a8
mov rcx, rax
call qword [sym.imp.USER32.dll_GetDlgCtrlID]
mov esi, eax
test rbx, rbx
je 0x1400227a3
cmp dword [rbx], 0x40
jb 0x1400227a3
mov rcx, qword [rbp + 0x40]
xor r9d, r9d
or dword [rbx + 4], 1
xor r8d, r8d
or qword [rbx + 0x30], 0xffffffffffffffff
mov edx, 0x87
mov qword [rbx + 8], rcx
mov rcx, rdi
mov qword [rbx + 0x10], rdi
call qword [sym.imp.USER32.dll_SendMessageW]
bt rax, 0xd
jb 0x1400227a3
or dword [rbx + 4], 0x80000002
mov rax, rsi
jmp 0x1400227ac
or rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140027200
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x70
mov edi, r9d
mov rsi, r8
mov r14, rdx
mov r15d, ecx
and qword [rax - 0x10], 0
and qword [rax - 0x18], 0
xor ebx, ebx
mov eax, dword [0x141720c50]
test eax, eax
je 0x140027252
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x141720c50]
test eax, eax
jne 0x14002725b
call fcn.140027788
test eax, eax
je 0x140027277
lea rdx, [rsp + 0x60]
mov rcx, qword [0x141718878]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne ebx, ecx
test ebx, ebx
jne 0x140027282
xor eax, eax
jmp 0x140027330
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0xb8]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0xb0]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0xa8]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0xa0]
mov dword [rsp + 0x20], eax
mov r9d, edi
mov r8, rsi
mov rdx, r14
mov ecx, r15d
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov rsi, rax
mov qword [rsp + 0x68], rax
xor ebx, ebx
test rsi, rsi
sete bl
test ebx, ebx
je 0x140027312
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x140027314
xor edi, edi
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x14002732d
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rsi
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret
Function at 0x14002734c
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push r14
sub rsp, 0x30
mov rdi, r8
mov rsi, rdx
mov r14, rcx
and dword [rax - 0x18], 0
and qword [rax + 0x20], 0
xor ebx, ebx
mov eax, dword [0x141720c50]
test eax, eax
je 0x140027396
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x141720c50]
test eax, eax
jne 0x14002739f
call fcn.140027788
test eax, eax
je 0x1400273bb
lea rdx, [rsp + 0x58]
mov rcx, qword [0x141718878]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne ebx, ecx
test ebx, ebx
jne 0x1400273c3
xor eax, eax
jmp 0x14002740a
mov r8, rdi
mov rdx, rsi
mov rcx, r14
call qword [sym.imp.USER32.dll_GetClassInfoExW]
mov edi, eax
mov dword [rsp + 0x20], eax
xor ebx, ebx
test edi, edi
sete bl
test ebx, ebx
je 0x1400273ed
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x1400273ef
xor esi, esi
mov rdx, qword [rsp + 0x58]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x140027408
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r14
ret

Function at 0x140027420
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
xor edi, edi
mov dword [rax - 0x18], edi
mov rbx, qword [0x141724038]
and qword [rax + 0x10], rdi
xor esi, esi
mov eax, dword [0x141720c50]
test eax, eax
je 0x14002746b
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x141720c50]
test eax, eax
jne 0x140027474
call fcn.140027788
test eax, eax
je 0x140027490
lea rdx, [rsp + 0x48]
mov rcx, qword [0x141718878]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne 0x140027498
xor eax, eax
jmp 0x1400274fd
test rbx, rbx
jne 0x1400274b8
lea rcx, str.InitCommonControlsEx
call fcn.14002716c
mov rbx, rax
test rax, rax
je 0x1400274cb
mov qword [0x141724038], rax
mov rcx, rbx
call fcn.1401d7c94
mov rcx, r14
call rbx
mov edi, eax
mov dword [rsp + 0x20], eax
xor ebx, ebx
test edi, edi
sete bl
test ebx, ebx
je 0x1400274e0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x1400274e2
xor esi, esi
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x1400274fb
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x1400276b0
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov rdi, rcx
xor r14d, r14d
mov word [rax - 0x18], r14w
mov qword [rax + 0x10], r14
mov ebx, r14d
mov eax, dword [0x141720c50]
test eax, eax
je 0x1400276f8
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x141720c50]
test eax, eax
jne 0x140027701
call fcn.140027788
test eax, eax
je 0x14002771d
lea rdx, [rsp + 0x48]
mov rcx, qword [0x141718878]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne ebx, ecx
test ebx, ebx
jne 0x140027727
movzx eax, r14w
jmp 0x14002776f
mov rcx, rdi
call qword [sym.imp.USER32.dll_RegisterClassW]
movzx ebx, ax
mov word [rsp + 0x20], ax
mov edi, r14d
test bx, bx
sete dil
test edi, edi
je 0x140027750
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x140027753
mov esi, r14d
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test edi, edi
je 0x14002776c
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
movzx eax, bx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret

Function at 0x140027cd8
Capabilities:
Get graphical window text

Disassembly:
push rsi
push rdi
push r14
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rbp
movsxd rbp, r8d
mov rsi, rdx
mov rdi, rcx
cmp qword [rcx + 0xd0], 0
jne 0x140027d19
mov r8d, ebp
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x140027df6
call fcn.14001cc54
mov r14, rax
test rax, rax
jne 0x140027d31
mov ecx, 0x80004005
call fcn.140002570
int3
mov rax, qword [rax]
mov rbx, qword [rax + 0x18]
mov rcx, rbx
call fcn.1401d7c94
mov rcx, r14
call rbx
add rax, 0x18
mov qword [rsp + 0x50], rax
mov rdi, qword [rdi + 0xd0]
mov rax, qword [rdi]
mov rbx, qword [rax + 0x118]
mov rcx, rbx
call fcn.1401d7c94
lea rdx, [rsp + 0x50]
mov rcx, rdi
call rbx
mov rdx, rbp
or rbx, 0xffffffffffffffff
mov r9, rbx
mov r8, qword [rsp + 0x50]
mov rcx, rsi
call fcn.1401ef4a4
test eax, eax
je 0x140027db2
cmp eax, 0xc
je 0x140027dac
cmp eax, 0x16
je 0x140027da6
cmp eax, 0x22
je 0x140027da6
cmp eax, 0x50
je 0x140027db2
call fcn.14001bcc0
int3
call fcn.14001bcc0
int3
call fcn.14001bce4
int3
test rsi, rsi
jne 0x140027dbb
xor ebp, ebp
jmp 0x140027dc6
mov rcx, rsi
call fcn.1401ef5f0
mov rbp, rax
mov rsi, qword [rsp + 0x50]
mov ecx, ebx
lock xadd dword [rsi - 8], ecx
add ecx, ebx
test ecx, ecx
jg 0x140027df4
mov rdi, qword [rsi - 0x18]
mov rax, qword [rdi]
mov rbx, qword [rax + 8]
mov rcx, rbx
call fcn.1401d7c94
lea rdx, [rsi - 0x18]
mov rcx, rdi
call rbx
mov eax, ebp
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x140028760
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov qword [rcx + 0xf0], rdx
mov rbp, r8
mov rdi, rdx
mov rsi, rcx
cmp rdx, 0x10000
jae 0x14002879f
cmp dword [rcx + 0xe8], 0
jne 0x14002879f
movzx eax, di
mov dword [rcx + 0xe8], eax
call fcn.140029cf0
mov r8d, 5
mov rdx, rdi
mov rbx, qword [rax + 0x18]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r9, rbx
mov r8, rbp
mov rdx, rax
mov rcx, rsi
mov rdi, rax
call fcn.140028b58
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rbp, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1400287fc
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov r14, r8
mov rbx, rdx
mov r15, rcx
xor edi, edi
call fcn.140029cf0
lea r8d, [rdi + 5]
mov rdx, rbx
mov rbp, qword [rax + 0x18]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
test rax, rax
je 0x140028858
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
mov r9, rbp
mov r8, r14
mov rdx, rdi
mov rcx, r15
call fcn.140028890
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rbp, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x140029568
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x40
mov rdi, r9
mov rsi, r8
mov r14, rdx
mov r15, rcx
and qword [rax - 0x10], 0
and qword [rax - 0x18], 0
xor ebx, ebx
mov eax, dword [0x141720c50]
test eax, eax
je 0x1400295ba
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x141720c50]
test eax, eax
jne 0x1400295c3
call fcn.140027788
test eax, eax
je 0x1400295df
lea rdx, [rsp + 0x30]
mov rcx, qword [0x141718878]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne ebx, ecx
test ebx, ebx
jne 0x1400295e7
xor eax, eax
jmp 0x14002963f
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9, rdi
mov r8, rsi
mov rdx, r14
mov rcx, r15
call qword [sym.imp.USER32.dll_CreateDialogIndirectParamW]
mov rsi, rax
mov qword [rsp + 0x38], rax
xor ebx, ebx
test rsi, rsi
sete bl
test ebx, ebx
je 0x140029621
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x140029623
xor edi, edi
mov rdx, qword [rsp + 0x30]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x14002963c
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
mov r14, qword [rsp + 0x68]
add rsp, 0x40
pop r15
ret

Function at 0x140030cf0
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x28
cmp qword [rcx + 8], 0
jne 0x1400303da
xor eax, eax
add rsp, 0x28
ret
call fcn.1400303ec
mov rcx, rax
add rsp, 0x28
jmp 0x140030cf0
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
xor edi, edi
mov dword [rax - 0x18], edi
mov rbx, qword [0x141724358]
and qword [rax + 0x10], rdi
xor esi, esi
mov eax, dword [0x141720c50]
test eax, eax
je 0x140030d3b
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x141720c50]
test eax, eax
jne 0x140030d44
call fcn.140027788
test eax, eax
je 0x140030d60
lea rdx, [rsp + 0x48]
mov rcx, qword [0x141718878]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne 0x140030d68
xor eax, eax
jmp 0x140030dcd
test rbx, rbx
jne 0x140030d88
lea rcx, str.ImageList_Destroy
call fcn.14002716c
mov rbx, rax
test rax, rax
je 0x140030d9b
mov qword [0x141724358], rax
mov rcx, rbx
call fcn.1401d7c94
mov rcx, r14
call rbx
mov edi, eax
mov dword [rsp + 0x20], eax
xor ebx, ebx
test edi, edi
sete bl
test ebx, ebx
je 0x140030db0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x140030db2
xor esi, esi
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x140030dcb
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x140030de4
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push r13
push r14
push r15
sub rsp, 0x50
mov r14d, r9d
mov r15d, r8d
mov r12, rdx
mov r13, rcx
xor esi, esi
mov qword [rax - 0x20], rsi
mov rbx, qword [0x141724360]
and qword [rax - 0x28], rsi
xor edi, edi
mov eax, dword [0x141720c50]
test eax, eax
je 0x140030e41
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x141720c50]
test eax, eax
jne 0x140030e4a
call fcn.140027788
test eax, eax
je 0x140030e66
lea rdx, [rsp + 0x40]
mov rcx, qword [0x141718878]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne edi, ecx
test edi, edi
jne 0x140030e71
xor eax, eax
jmp 0x140030f04
test rbx, rbx
jne 0x140030e91
lea rcx, str.ImageList_LoadImageW
call fcn.14002716c
mov rbx, rax
test rax, rax
je 0x140030ed0
mov qword [0x141724360], rax
mov rcx, rbx
call fcn.1401d7c94
mov eax, dword [rsp + 0xa0]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x98]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x90]
mov dword [rsp + 0x20], eax
mov r9d, r14d
mov r8d, r15d
mov rdx, r12
mov rcx, r13
call rbx
mov rsi, rax
mov qword [rsp + 0x48], rax
xor ebx, ebx
test rsi, rsi
sete bl
test ebx, ebx
je 0x140030ee6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x140030ee8
xor edi, edi
mov rdx, qword [rsp + 0x40]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x140030f01
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rsi
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret