joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400d9628
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x14049e048]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov ebx, edx
mov rdi, rcx
and qword [rsp + 0x28], 0
call qword [sym.imp.acdb24.dll_class_AcDbHostApplicationServices____ptr64___cdecl_acdbHostApplicationServices_void_]
mov rdx, qword [rax]
mov r8, qword [rdx + 0x190]
lea rdx, [rsp + 0x28]
mov rcx, rax
call r8
nop
lea rcx, [rsp + 0x28]
call qword [sym.imp.AcPal.dll_public:_static_int___cdecl_AcLocaleService::getWinLCIDFromLocaleClass_class_AcLocale_const____ptr64_]
mov ecx, eax
mov r9d, 1
lea r8, [rsp + 0x20]
mov edx, 0x20000001
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
lea rdx, [rsp + 0x20]
mov ecx, ebx
call qword [sym.imp.AdDownloaderCore.dll_Ordinal_8]
mov rdx, rax
mov rcx, rax
call fcn.14000f130
lea rcx, [rdi + 0x68]
test eax, eax
je 0x1400d96b3
call qword [sym.imp.mfc140u.dll_CMFCControlRendererInfo::CMFCControlRendererInfo]
jmp 0x1400d96be
mov edx, 0x41a5
call qword [sym.imp.mfc140u.dll_CRuntimeClass::IsDerivedFrom]
mov dword [rdi + 8], 5
lea rcx, [rsp + 0x28]
call qword [sym.imp.AcPal.dll_public:_void___cdecl_AcLocale::destructor_void____ptr64]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140088c50
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x1400db068
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rdi, r9
mov esi, r8d
mov rbp, rdx
mov rbx, rcx
cmp r9, 0x28
ja 0x1400db0e3
mov eax, edi
sub eax, 9
je 0x1400db179
sub eax, 4
je 0x1400db160
sub eax, 0xe
je 0x1400db154
sub eax, 5
je 0x1400db160
sub eax, 1
je 0x1400db12f
sub eax, 1
je 0x1400db12f
sub eax, 4
je 0x1400db0c8
cmp eax, 2
jne 0x1400db0e3
mov rax, qword [rcx]
call qword [rax + 0xe0]
or edx, 0xffffffff
test al, al
jne 0x1400db115
mov rcx, rbx
mov byte [rbx + 0x31], al
call fcn.14006b780
mov rax, qword [rsp + 0x60]
mov r9, rdi
mov rcx, qword [rbx + 0x18]
mov r8d, esi
mov rdx, rbp
mov qword [rsp + 0x20], rax
call qword [sym.imp.USER32.dll_CallWindowProcW]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov rax, qword [rbx]
cmp rdi, 0x26
mov ecx, 1
cmovne edx, ecx
mov rcx, rbx
call qword [rax + 0xf0]
jmp 0x1400db150
mov rax, qword [rcx]
call qword [rax + 0xe0]
test al, al
je 0x1400db0e3
mov rax, qword [rbx]
mov rdx, rdi
mov r8, qword [rsp + 0x60]
mov rcx, rbx
call qword [rax + Ordinal_285]
xor eax, eax
jmp 0x1400db100
mov rax, qword [rcx]
mov r10, qword [rax + 0xc8]
jmp 0x1400db16a
mov rax, qword [rcx]
mov r10, qword [rax + 0xc0]
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
call r10
jmp 0x1400db100
mov rax, qword [rcx]
call qword [rax + 0xe0]
test al, al
je 0x1400db0e3
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
call qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
and ax, cx
mov rcx, rbx
mov rax, qword [rbx]
mov r8, qword [rax + 0xf0]
je 0x1400db1b1
or edx, 0xffffffff
jmp 0x1400db1b6
mov edx, 1
call r8
jmp 0x1400db150
Function at 0x1400dbb28
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x14049e048]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rdi, rdx
mov rsi, rcx
mov qword [rsp + 0x28], rdx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x1400dbbc4
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov ebx, eax
test eax, eax
je 0x1400dbbc4
lea rcx, [rsp + 0x28]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea edx, [rbx + 1]
lea rcx, [rsp + 0x28]
call qword [sym.imp.mfc140u.dll_Ordinal_4946]
lea r8d, [rbx + 1]
mov rdx, rax
mov rcx, qword [rsi + 0x10]
call qword [sym.imp.USER32.dll_GetWindowTextW]
or edx, 0xffffffff
lea rcx, [rsp + 0x28]
call qword [sym.imp.mfc140u.dll_CDialogImpl::ProcessMouseClick]
lea rcx, [rsp + 0x28]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___2]
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.ac1st24.dll_public:_void___cdecl_AcString::constructor_wchar_t_const____ptr64____ptr64]
nop
lea rcx, [rsp + 0x28]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
jmp 0x1400dbbd4
lea rdx, [0x14032f730]
mov rcx, rdi
call qword [sym.imp.ac1st24.dll_public:_void___cdecl_AcString::constructor_wchar_t_const____ptr64____ptr64]
mov rax, rdi
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140088c50
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x1400e7504
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x14049e048]
xor rax, rsp
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x20]
call qword [sym.imp.acdb24.dll_class_AcLocale___cdecl_acrxProductLocale_void_]
nop
mov rcx, rax
call qword [sym.imp.AcPal.dll_public:_static_int___cdecl_AcLocaleService::getWinLCIDFromLocaleClass_class_AcLocale_const____ptr64_]
mov ebx, eax
lea rcx, [rsp + 0x20]
call qword [sym.imp.AcPal.dll_public:_void___cdecl_AcLocale::destructor_void____ptr64]
xor edi, edi
lea r9d, [rdi + 0xa]
lea r8, [rsp + 0x28]
mov edx, 0x1004
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1400e7568
lea rcx, [rsp + 0x28]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoi]
mov edi, eax
mov edx, edi
lea rcx, [rsp + 0x20]
call qword [sym.imp.AcPal.dll_public:_void___cdecl_code_page_id_ex::constructor_unsigned_int____ptr64]
mov rcx, rax
call qword [sym.imp.AcPal.dll_public:_enum_code_page_id___cdecl_code_page_id_ex::operator_enum_code_page_id_void____ptr64]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140088c50
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret

Function at 0x1400e8cdc
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
mov eax, 0x1040
call fcn.140089690
sub rsp, rax
mov rax, qword [0x14049e048]
xor rax, rsp
mov qword [rsp + reloc.mfc140u.dll_CMFCMaskedEdit::DoUpdate], rax
cmp dword [rcx + 8], 0x100
mov rdi, rcx
jne 0x1400e8da6
cmp qword [rcx + 0x10], 0xd
jne 0x1400e8da6
mov rcx, qword [rcx]
call fcn.1400eae8c
mov rbx, rax
test rax, rax
je 0x1400e8da6
cmp word [rax + 0x26], 5
jne 0x1400e8d76
mov rcx, rax
call fcn.1400e8dcc
test eax, eax
jne 0x1400e8d6f
mov rcx, qword [rbx + 0x10]
lea rdx, [rsp + 0x30]
mov r8d, 0x800
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov r9d, dword [0x1404bcc68]
lea rdx, [rsp + 0x30]
mov rcx, qword [rbx + 8]
mov r8d, 1
call fcn.1400e4734
mov eax, 1
jmp 0x1400e8da8
cmp word [rax + 0x26], 8
jne 0x1400e8da6
test dword [rax + 0x18], 0x8000
jne 0x1400e8da6
mov rax, qword [rax]
mov edx, ATL::CStringT<wchar_t,StrTraitMFC_DLL<wchar_t,ATL::ChTraitsCRT<wchar_t>
mov r9, qword [rdi]
mov r8d, 0x20000
mov rcx, qword [rax + 0x40]
mov rcx, qword [rcx]
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x1400e8d6f
xor eax, eax
mov rcx, qword [rsp + reloc.mfc140u.dll_CMFCMaskedEdit::DoUpdate]
xor rcx, rsp
call fcn.140088c50
mov rbx, qword [rsp + 0x1058]
add rsp, 0x1040
pop rdi
ret

Function at 0x1400ea568
Capabilities:
Get graphical window text

Disassembly:
push rbx
mov eax, 0x1040
call fcn.140089690
sub rsp, rax
mov rax, qword [0x14049e048]
xor rax, rsp
mov qword [rsp + reloc.mfc140u.dll_CMFCMaskedEdit::DoUpdate], rax
mov rbx, rcx
lea rdx, [rsp + 0x30]
mov rcx, qword [rcx + 0x10]
mov r8d, 0x800
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov r9d, dword [0x1404bcc68]
lea rdx, [rsp + 0x30]
mov rcx, qword [rbx + 8]
mov r8d, 2
call fcn.1400e4734
mov rcx, qword [rsp + reloc.mfc140u.dll_CMFCMaskedEdit::DoUpdate]
xor rcx, rsp
call fcn.140088c50
add rsp, 0x1040
pop rbx
ret
Function at 0x140108ff0
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, r9
mov rdi, r8
mov ebx, edx
mov rsi, rcx
cmp edx, 0x200
je 0x14010906d
lea eax, [rdx - 0x200]
cmp eax, 0xe
ja 0x140109026
xor eax, eax
jmp 0x14010907e
mov eax, ebx
sub eax, 0xc
je 0x140109052
sub eax, 1
je 0x140109039
cmp eax, 0x23
je 0x14010905b
jmp 0x14010906d
mov rcx, qword [rcx + 0x160]
test rcx, rcx
je 0x14010906d
mov edx, SafeArrayDestroy
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x14010907e
cmp rdi, 0x300
je 0x14010906d
mov rcx, qword [rcx + 0x160]
test rcx, rcx
je 0x14010906d
call qword [sym.imp.USER32.dll_SendMessageW]
mov r9, rbp
mov r8, rdi
mov edx, ebx
mov rcx, rsi
call qword [sym.imp.mfc140u.dll_CMFCRibbonPanel::ShowPopup]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x14012ee58
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x250
mov rax, qword [0x14049e048]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov r9, rcx
mov rdi, rdx
lea rcx, str.file:__
call fcn.14000f130
mov r8d, eax
lea rdx, [rsp + 0x20]
mov rcx, r9
call qword [sym.imp.mfc140u.dll_CMFCToolBar::LoadState]
mov rcx, rax
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___2]
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.14002a14c
lea rcx, [rsp + 0x20]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
mov r14d, 0x2f
lea rbx, [rsp + 0x30]
cmp r14w, word [rsp + 0x30]
jne 0x14012eee8
mov rcx, rbx
call qword [sym.imp.USER32.dll_CharNextW]
mov rbx, rax
cmp r14w, word [rax]
je 0x14012eed6
mov ebp, VarDateFromDisp
cmp bp, word [rbx]
jne 0x14012ef0c
movzx ecx, word [rbx + 2]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_iswalpha]
test eax, eax
je 0x14012ef0c
mov rcx, rbx
call qword [sym.imp.USER32.dll_CharNextW]
mov rbx, rax
movzx eax, word [rbx]
mov rcx, rbx
jmp 0x14012ef3b
mov edx, 0x7c
cmp dx, ax
jne 0x14012ef26
lea eax, [rdx - 0x42]
mov word [rcx], ax
jmp 0x14012ef2f
cmp r14w, ax
jne 0x14012ef2f
mov word [rcx], bp
call qword [sym.imp.USER32.dll_CharNextW]
mov rcx, rax
movzx eax, word [rax]
test ax, ax
jne 0x14012ef14
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14012ef62
test al, 0x10
je 0x14012ef62
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.mfc140u.dll_CMFCControlRendererInfo::CMFCControlRendererInfo]
mov al, 1
jmp 0x14012ef64
xor al, al
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.140088c50
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x140131440
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rax, qword [0x14049e048]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rdi, rcx
call qword [sym.imp.accore.dll_public:_static_class_CProxyInet____ptr64___cdecl_CProxyInet::GetProxyInet_void_]
mov rbx, rax
xor esi, esi
mov qword [rsp + 0x20], rsi
lea rcx, [rsp + 0x20]
call qword [sym.imp.ac1st24.dll_public:_void___cdecl_AcString::constructor_void____ptr64]
nop
mov rcx, qword [rbx]
mov r8, qword [rcx + 0x40]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call r8
test al, al
je 0x1401315b9
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1401315b9
test al, 0x10
je 0x1401315b9
mov rcx, qword [0x1404bdcd8]
call qword [sym.imp.mfc140u.dll_Ordinal_6006]
mov qword [rax + 0x50], rsi
mov rbx, qword [rsp + 0x20]
mov rcx, qword [0x1404bdcd8]
call qword [sym.imp.mfc140u.dll_Ordinal_6006]
mov rcx, qword [rax + 0x30]
sub rcx, rbx
movzx eax, word [rbx]
mov word [rcx + rbx], ax
lea rbx, [rbx + 2]
test ax, ax
jne 0x1401314dd
mov rbx, qword [rsp + 0x20]
mov rcx, qword [0x1404bdcd8]
call qword [sym.imp.mfc140u.dll_Ordinal_6006]
mov rcx, qword [rax + 0x40]
sub rcx, rbx
movzx eax, word [rbx]
mov word [rcx + rbx], ax
lea rbx, [rbx + 2]
test ax, ax
jne 0x140131506
mov rcx, qword [0x1404bdcd8]
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_GetParent]
mov rcx, rax
call qword [sym.imp.mfc140u.dll_CMFCRibbonComboBox::FindItem]
mov r9, qword [rsp + 0x20]
mov edx, CDragListBox::~CDragListBox
lea r8d, [rdx + 0x18]
mov rcx, qword [rax + 0x40]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [0x1404bdcd8]
call qword [sym.imp.mfc140u.dll_Ordinal_6006]
btr dword [rax + 0x60], 8
mov rcx, qword [0x1404bdcd8]
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_GetParent]
mov rcx, rax
call qword [sym.imp.mfc140u.dll_CMFCRibbonComboBox::FindItem]
mov rbx, rax
mov esi, 1
mov edx, esi
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetDlgItem]
mov r9, rax
mov r8d, esi
mov edx, ATL::CStringT<wchar_t,StrTraitMFC_DLL<wchar_t,ATL::ChTraitsCRT<wchar_t>
mov rcx, qword [rbx + 0x40]
call qword [sym.imp.USER32.dll_PostMessageW]
xor r9d, r9d
xor r8d, r8d
mov edx, reloc.mfc140u.dll_AFX_MODULE_STATE::AFX_MODULE_STATE
mov rcx, qword [0x1404bdcd8]
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_PostMessageW]
nop
lea rcx, [rsp + 0x20]
call qword [sym.imp.ac1st24.dll_public:_void___cdecl_AcString::destructor_void____ptr64]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140088c50
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x140135248
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x480
mov rax, qword [0x14049e048]
xor rax, rsp
mov qword [rsp + 0x470], rax
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140135279
test al, 0x10
jne 0x14013530e
mov ecx, SerializeElements<ATL::CStringT<wchar_t,StrTraitMFC_DLL<wchar_t,ATL::ChTraitsCRT<wchar_t>
lea rax, [rsp + 0x260]
mov qword [rsp + 0x40], rcx
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov qword [rsp + 0x30], rcx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
xor edx, edx
and qword [rsp + 0x20], 0
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wsplitpath_s]
mov edx, 0x3f
lea rcx, [rsp + 0x50]
call qword [sym.imp.VCRUNTIME140.dll_wcschr]
test rax, rax
jne 0x14013530e
lea ebx, [rax + 0x2a]
mov edx, ebx
lea rcx, [rsp + 0x50]
call qword [sym.imp.VCRUNTIME140.dll_wcschr]
test rax, rax
jne 0x14013530e
lea edx, [rbx + 0x15]
lea rcx, [rsp + 0x260]
call qword [sym.imp.VCRUNTIME140.dll_wcschr]
test rax, rax
jne 0x14013530e
mov edx, ebx
lea rcx, [rsp + 0x260]
call qword [sym.imp.VCRUNTIME140.dll_wcschr]
test rax, rax
sete al
jmp 0x140135310
xor al, al
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.140088c50
add rsp, 0x480
pop rbx
ret
Function at 0x1401585d8
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x30
mov rax, qword [0x14049e048]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rsi, rdx
mov rdi, rcx
cmp dword [rdx + 8], 0x100
je 0x140158645
cmp dword [rdx + 8], 0x203
jne 0x1401586ce
call qword [sym.imp.USER32.dll_GetFocus]
mov rcx, rax
call qword [sym.imp.mfc140u.dll_CMFCRibbonComboBox::FindItem]
mov rbx, rax
mov rcx, qword [rdi + 0x17e0]
call qword [sym.imp.mfc140u.dll_CMFCRibbonComboBox::FindItem]
cmp rbx, rax
jne 0x1401586ce
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x310]
jmp 0x1401586bc
lea rcx, [rsp + 0x20]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
mov edx, CMFCToolBarsCustomizeDialog::FillCategoriesListBox
lea rcx, [rsp + 0x20]
call qword [sym.imp.mfc140u.dll_CRuntimeClass::IsDerivedFrom]
lea rdx, [rsi + 0x10]
lea rcx, [rsp + 0x20]
call qword [sym.imp.mfc140u.dll_CFileFind::CloseContext]
test eax, eax
jne 0x1401586c3
call qword [sym.imp.USER32.dll_GetFocus]
mov rcx, rax
call qword [sym.imp.mfc140u.dll_CMFCRibbonComboBox::FindItem]
mov rbx, rax
mov rcx, qword [rdi + 0x17e0]
call qword [sym.imp.mfc140u.dll_CMFCRibbonComboBox::FindItem]
cmp rbx, rax
jne 0x1401586c3
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElemsize
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x1401586c3
mov rcx, rdi
call fcn.140158560
nop
lea rcx, [rsp + 0x20]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
mov eax, 1
jmp 0x1401586da
lea rcx, [rsp + 0x20]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.adui24.dll_public_virtual:_int___cdecl_CAdUiBaseDialog::PreTranslateMessage_struct_tagMSG____ptr64____ptr64]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140088c50
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
Function at 0x14017953c
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x14049e048]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x1401795ab
cmp byte [rcx + 0x71], 0
je 0x1401795ab
mov rax, qword [rcx]
or edx, 0xffffffff
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
cmp eax, 0xffffffff
je 0x140179600
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1401795c5
sub eax, 1
je 0x1401795c9
cmp eax, 2
jne 0x140179600
mov byte [rbx + 0x71], 0
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140088c50
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x1401795f7
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x140179600
cmp byte [rbx + 0x71], 0
sete al
jmp 0x1401795ad
xor al, al
jmp 0x1401795ad
Function at 0x1401799ec
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x14049e048]
xor rax, rsp
mov qword [rbp - 8], rax
or edi, 0xffffffff
mov r14d, edx
mov rsi, rcx
cmp edx, edi
jne 0x140179a26
xor eax, eax
jmp 0x140179b21
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
test rax, rax
je 0x140179a5f
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::epptr_void_const___ptr64]
mov rcx, rsi
mov rbx, rax
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
cmp rax, rbx
jae 0x140179a5f
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], r14b
mov eax, r14d
jmp 0x140179b21
cmp qword [rsi + 0x80], 0
je 0x140179b1f
mov rcx, rsi
call fcn.140179708
mov rcx, qword [rsi + 0x68]
test rcx, rcx
jne 0x140179a96
movsx ecx, r14b
mov rdx, qword [rsi + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
cmp eax, edi
jmp 0x140179b1b
lea rax, [rbp - 0x40]
mov byte [rbp - 0x30], r14b
mov qword [rsp + 0x38], rax
lea rdx, [rsi + 0x74]
lea rax, [rbp - 8]
mov qword [rsp + 0x30], rax
lea r9, [rbp - 0x2f]
lea rax, [rbp - 0x28]
mov qword [rsp + 0x28], rax
lea r8, [rbp - 0x30]
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140179ae4
sub eax, 1
je 0x140179ae4
cmp eax, 2
jne 0x140179b1f
movsx ecx, byte [rbp - 0x30]
jmp 0x140179a82
mov rbx, qword [rbp - 0x40]
lea rax, [rbp - 0x28]
sub rbx, rax
je 0x140179b0f
mov r9, qword [rsi + 0x80]
lea rcx, [rbp - 0x28]
mov r8, rbx
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rbx, rax
jne 0x140179b1f
lea rax, [rbp - 0x30]
mov byte [rsi + 0x71], 1
cmp qword [rbp - 0x38], rax
cmovne edi, r14d
mov eax, edi
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140088c50
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x14017a0c8
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rbx, r8
mov r14, rdx
mov rbp, rcx
test r8, r8
jg 0x14017a0ed
xor eax, eax
jmp 0x14017a1ae
cmp qword [rcx + 0x68], 0
je 0x14017a0ff
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
jmp 0x14017a1ae
mov rdi, rbx
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Gnavail_void_const___ptr64]
mov rsi, rax
test rax, rax
je 0x14017a140
cmp rax, rbx
jb 0x14017a118
mov rsi, rbx
mov rcx, rbp
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gptr_void_const___ptr64]
mov r8, rsi
mov rcx, r14
mov rdx, rax
call sub.VCRUNTIME140.dll_memcpy
mov edx, esi
mov rcx, rbp
add r14, rsi
sub rdi, rsi
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gbump_int____ptr64]
cmp qword [rbp + 0x80], 0
mov rsi, rdi
je 0x14017a1a8
mov rcx, rbp
call fcn.140179708
mov r15d, reloc.mfc140u.dll_COleBusyDialog::DoModal
jmp 0x14017a183
mov r9, qword [rbp + 0x80]
mov r8, r15
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rdi, rax
add r14, rax
mov rsi, rdi
cmp rax, r15
jne 0x14017a1bf
cmp rdi, r15
ja 0x14017a15d
test rsi, rsi
je 0x14017a1a8
mov r9, qword [rbp + 0x80]
mov r8, rdi
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rsi, rax
sub rbx, rsi
mov rax, rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
sub rbx, rdi
jmp 0x14017a1ab
Function at 0x14017a1c4
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r14, rdx
mov rdi, rcx
je 0x14017a1ee
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x14017a25e
mov rsi, rbx
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov rbp, rax
test rbx, rbx
jle 0x14017a258
test rax, rax
jle 0x14017a238
cmp rbx, rax
mov rcx, rdi
cmovl rbp, rbx
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, rbp
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov edx, ebp
mov rcx, rdi
add r14, rbp
sub rbx, rbp
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
test rbx, rbx
jle 0x14017a258
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x14017a258
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
sub rsi, rbx
mov rax, rsi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret

Function at 0x1401966f0
Capabilities:
Get graphical window text

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [rcx + 0x2f8], 0
mov rbx, rcx
mov dword [rcx + CWnd::accDoDefaultAction], 1
je 0x140196730
add rcx, 0x200
call fcn.14018af8c
xor r9d, r9d
mov edx, CMapStringToOb::HashKey
mov rcx, qword [rax + 0x40]
lea r8d, [r9 + 0xd]
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x140196736
call qword [sym.imp.adui24.dll_protected_virtual:_void___cdecl_CAdUiTabChildDialog::OnOK_void____ptr64]
and dword [rbx + 0x6bc], 0
add rsp, 0x20
pop rbx
ret