joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800012c0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [rsp + 0x78]
sub rax, 0x10000
mov rcx, rax
call fcn.1800014e0
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x70]
cmp qword [rsp + 0x20], rax
jbe 0x1800013c7
mov rax, qword [section..data]
cmp qword [rsp + 0x20], rax
jb 0x180001324
mov rax, qword [0x18001e008]
cmp qword [rsp + 0x20], rax
ja 0x180001324
mov rax, qword [rsp + 0x20]
sub rax, 0x8000000
mov qword [rsp + 0x20], rax
jmp 0x1800012e6
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.180013270
mov r8d, 0x30
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x180001353
jmp 0x1800013c7
cmp dword [rsp + 0x50], 0x10000
jne 0x1800013aa
cmp qword [rsp + 0x48], 0x10000
jb 0x1800013aa
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x180001398
mov rax, qword [rsp + 0x28]
jmp 0x1800013c9
mov rax, qword [rsp + 0x20]
sub rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x1800013c2
mov rax, qword [rsp + 0x38]
sub rax, 0x10000
mov rcx, rax
call fcn.1800014e0
mov qword [rsp + 0x20], rax
jmp 0x1800012e6
xor eax, eax
add rsp, 0x68
ret

Function at 0x1800013d0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rcx, qword [rsp + 0x70]
call fcn.180001520
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x78]
cmp qword [rsp + 0x20], rax
jae 0x1800014d3
mov rax, qword [section..data]
cmp qword [rsp + 0x20], rax
jb 0x18000142b
mov rax, qword [0x18001e008]
cmp qword [rsp + 0x20], rax
ja 0x18000142b
mov rax, qword [rsp + 0x20]
add rax, 0x8000000
mov qword [rsp + 0x20], rax
jmp 0x1800013ed
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.180013270
mov r8d, 0x30
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x18000145a
jmp 0x1800014d3
cmp dword [rsp + 0x50], 0x10000
jne 0x1800014b1
cmp qword [rsp + 0x48], 0x10000
jb 0x1800014b1
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x18000149f
mov rax, qword [rsp + 0x28]
jmp 0x1800014d5
mov rax, qword [rsp + 0x20]
add rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x1800014ce
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
mov rcx, rax
call fcn.180001520
mov qword [rsp + 0x20], rax
jmp 0x1800013ed
xor eax, eax
add rsp, 0x68
ret
Function at 0x180003710
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x38
cmp dword [0x18001ebc0], 0
je 0x180003724
xor eax, eax
jmp 0x18000398d
cmp qword [0x18001ebb8], 0
je 0x18000373a
mov rax, qword [0x18001ebb8]
jmp 0x18000398d
mov r8d, 0x48
xor edx, edx
lea rcx, [0x18001eb70]
call fcn.180013270
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [0x18001eb70], rax
xor r8d, r8d
xor edx, edx
lea rcx, str.dbghelp.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov qword [0x18001eb78], rax
cmp qword [0x18001eb78], 0
jne 0x1800037f3
mov dword [0x18001ebc0], 1
cmp qword [0x18001eb78], 0
je 0x18000379f
mov rcx, qword [0x18001eb78]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [0x18001eb80], 0
mov qword [0x18001eb88], 0
mov qword [0x18001eb90], 0
mov qword [0x18001eb98], 0
mov qword [0x18001eba0], 0
mov qword [0x18001eba8], 0
mov qword [0x18001ebb0], 0
xor eax, eax
jmp 0x18000398d
lea rdx, str.ImagehlpApiVersionEx
mov rcx, qword [0x18001eb78]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18001eb80], rax
lea rdx, str.SymInitialize
mov rcx, qword [0x18001eb78]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18001eb88], rax
lea rdx, str.SymSetOptions
mov rcx, qword [0x18001eb78]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18001eb90], rax
lea rdx, str.SymGetOptions
mov rcx, qword [0x18001eb78]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18001eb98], rax
lea rdx, str.SymLoadModule64
mov rcx, qword [0x18001eb78]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18001eba0], rax
lea rdx, str.SymGetModuleInfo64
mov rcx, qword [0x18001eb78]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18001eba8], rax
lea rdx, str.SymFromName
mov rcx, qword [0x18001eb78]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18001ebb0], rax
mov r8d, 8
xor edx, edx
lea rcx, [rsp + 0x28]
call fcn.180013270
mov eax, 0xc
mov word [rsp + 0x28], ax
cmp qword [0x18001eb80], 0
je 0x1800038fe
cmp qword [0x18001eb88], 0
je 0x1800038fe
cmp qword [0x18001eba0], 0
je 0x1800038fe
cmp qword [0x18001eba8], 0
je 0x1800038fe
cmp qword [0x18001ebb0], 0
jne 0x180003903
jmp 0x18000377e
lea rcx, [rsp + 0x28]
call qword [0x18001eb80]
movzx eax, word [rsp + 0x28]
cmp eax, 0xc
jge 0x18000391d
jmp 0x18000377e
xor r8d, r8d
xor edx, edx
mov rcx, qword [0x18001eb70]
call qword [0x18001eb88]
test eax, eax
jne 0x180003938
jmp 0x18000377e
cmp qword [0x18001eb98], 0
je 0x180003978
cmp qword [0x18001eb90], 0
je 0x180003978
call qword [0x18001eb98]
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
and eax, 0xfffffff8
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
or eax, 0x2704
mov dword [rsp + 0x20], eax
mov ecx, dword [rsp + 0x20]
call qword [0x18001eb90]
lea rax, [0x18001eb70]
mov qword [0x18001ebb8], rax
mov rax, qword [0x18001ebb8]
add rsp, 0x38
ret
Function at 0x18000d29c
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x18000d2cc
xor eax, eax
jmp 0x18000d38f
mov rbp, rbx
cmp word [rax], si
je 0x18000d2f1
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x18000d2d8
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x18000d2d4
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.18000d1bc
movsxd r14, eax
test eax, eax
jne 0x18000d32f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x18000d2c5
mov rcx, r14
call fcn.18000aabc
mov rdi, rax
test rax, rax
jne 0x18000d348
xor ecx, ecx
call fcn.18000b7f4
jmp 0x18000d324
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.18000d1bc
test eax, eax
jne 0x18000d379
mov rcx, rdi
call fcn.18000b7f4
jmp 0x18000d383
xor ecx, ecx
call fcn.18000b7f4
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x180012a00
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x180012a28
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x180012a28
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0xf73058
Capabilities:
Decompress data using aplib

Disassembly:
call 0xf731df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, pe_nt_image_headers64
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0xf73089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0xf7306f
add dl, dl
jne 0xf73096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0xf730f6
xor eax, eax
add dl, dl
jne 0xf730a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0xf731ad
add dl, dl
jne 0xf730b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xf730c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xf730d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xf730dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0xf730ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0xf7307e
mov eax, 1
add dl, dl
jne 0xf73106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xf73113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0xf730fb
sub eax, ebx
mov ebx, 1
jne 0xf7314c
mov ecx, 1
add dl, dl
jne 0xf7312e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xf7313b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0xf73123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0xf7307e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xf73168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xf73175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0xf7315d
cmp eax, 0x7d00
jae 0xf7319b
cmp eax, 0x500
jb 0xf73196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0xf7307e
cmp eax, 0x7f
ja 0xf7319e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0xf7307e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0xf731d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0xf7307e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x40104b
Capabilities:
Initialize winsock library

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x1a0
mov word [rbp - 0x198], 0
lea rax, [rbp - 0x198]
mov rdx, rax
mov rcx, 0x202
sub rsp, 0x20
call sub.WS2_32_WSAStartup
add rsp, 0x20
cmp rax, 0
je 0x401085
jmp 0x401085
mov rsp, rbp
pop rbp
ret
Function at 0x140003b30
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x140003b63
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rcx, rax
mov qword [rsp + 0x30], rbx
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x140003ba9
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
add rcx, rbx
and edi, 0xf
jbe 0x140003ba4
nop
cmp rbx, rcx
jae 0x140003ba9
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
dec edi
jne 0x140003b90
cmp rbx, rcx
jb 0x140003bad
xor eax, eax
jmp 0x140003bb9
xor eax, eax
cmp word [rbx], ax
cmove rbx, rax
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x14000a1b4
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
cmp qword [rcx + 0xb0], 0
mov edi, r9d
mov rbx, r8
mov rax, rdx
je 0x14000a22e
xor r8d, r8d
call fcn.14000a478
mov rsi, rax
test rax, rax
jne 0x14000a1ea
mov eax, edi
jmp 0x14000a244
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x34]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x30]
mov rdx, rbx
mov rcx, rsi
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
cmove edi, dword [rsp + 0x30]
jmp 0x14000a1e6
mov r9, qword [rcx + 0xd8]
mov r8d, edi
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x14000af0c
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx], 0
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
je 0x14000af6f
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000af83
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000af83
mov rcx, qword [rbx]
and qword [rsp + 0x28], 0
xor r9d, r9d
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call rax
jmp 0x14000af88
cmp dword [rcx + 8], 0
je 0x14000af83
mov rdx, r8
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x14000af88
mov eax, 1
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x14000c368
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
xor edi, edi
xor ebx, ebx
mov r14, r9
mov rsi, r8
mov rbp, rdx
mov r12, rcx
test r8, r8
je 0x14000c3da
call fcn.14000cf88
mov r8d, 0xf0
mov rdx, rsi
mov r15, qword [rax + 0x18]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x14000c3da
mov rdx, rax
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbx, rax
test rax, rax
je 0x14000c423
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
mov esi, 1
test rdi, rdi
je 0x14000c408
mov r10, qword [r12]
mov r9, r14
mov r8, rdi
mov rdx, rbp
mov rcx, r12
call qword [r10 + 0x40]
mov esi, eax
test rbx, rbx
je 0x14000c408
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rcx, qword [rbp + 0xc0]
test rcx, rcx
je 0x14000c421
mov r8, qword [rcx]
mov rdx, r14
call qword [r8 + 0x140]
mov eax, esi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x14000d11c
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
push rdi
sub rsp, 0x30
mov rdi, rdx
mov rsi, rcx
and dword [rax - 0x18], 0
and qword [rax + 0x18], 0
xor ebx, ebx
mov eax, dword [0x14025dc90]
test eax, eax
je 0x14000d15e
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x14025dc90]
test eax, eax
jne 0x14000d167
call fcn.14000d1e0
test eax, eax
je 0x14000d183
lea rdx, [rsp + 0x50]
mov rcx, qword [0x1402554d0]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne ebx, ecx
test ebx, ebx
jne 0x14000d18b
xor eax, eax
jmp 0x14000d1cf
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.USER32.dll_UnregisterClassW]
mov edi, eax
mov dword [rsp + 0x20], eax
xor ebx, ebx
test eax, eax
sete bl
test ebx, ebx
je 0x14000d1b2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x14000d1b4
xor esi, esi
mov rdx, qword [rsp + 0x50]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x14000d1cd
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x140012cd4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
xor edi, edi
xor ebx, ebx
mov rsi, rdx
mov r14, rcx
test rdx, rdx
je 0x140012d3c
call fcn.14000cf88
mov r8d, 0xf0
mov rdx, rsi
mov rbp, qword [rax + 0x18]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x140012d3c
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbx, rax
test rax, rax
je 0x140012d5e
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
mov rdx, rdi
mov rcx, r14
call fcn.14003069c
mov esi, eax
test rdi, rdi
je 0x140012d5c
test rbx, rbx
je 0x140012d5c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x140014858
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, rcx
mov rcx, qword [rcx + 0x40]
mov rbx, r8
call fcn.140019c38
mov rdi, rax
test rax, rax
je 0x1400148d4
mov rcx, rax
call qword [sym.imp.USER32.dll_GetDlgCtrlID]
mov esi, eax
test rbx, rbx
je 0x1400148cf
cmp dword [rbx], 0x40
jb 0x1400148cf
mov rcx, qword [rbp + 0x40]
or dword [rbx + 4], 1
or qword [rbx + 0x30], 0xffffffffffffffff
mov qword [rbx + 8], rcx
xor r9d, r9d
xor r8d, r8d
mov edx, 0x87
mov rcx, rdi
mov qword [rbx + 0x10], rdi
call qword [sym.imp.USER32.dll_SendMessageW]
bt rax, 0xd
jb 0x1400148cf
or dword [rbx + 4], 0x80000002
mov rax, rsi
jmp 0x1400148d8
or rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140018554
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x70
mov edi, r9d
mov rsi, r8
mov r14, rdx
mov r15d, ecx
and qword [rax - 0x10], 0
and qword [rax - 0x18], 0
xor ebx, ebx
mov eax, dword [0x14025dc90]
test eax, eax
je 0x1400185a6
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x14025dc90]
test eax, eax
jne 0x1400185af
call fcn.14000d1e0
test eax, eax
je 0x1400185cb
lea rdx, [rsp + 0x60]
mov rcx, qword [0x1402554d0]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne ebx, ecx
test ebx, ebx
jne 0x1400185d6
xor eax, eax
jmp 0x140018684
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0xb8]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0xb0]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0xa8]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0xa0]
mov dword [rsp + 0x20], eax
mov r9d, edi
mov r8, rsi
mov rdx, r14
mov ecx, r15d
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov rsi, rax
mov qword [rsp + 0x68], rax
xor ebx, ebx
test rax, rax
sete bl
test ebx, ebx
je 0x140018666
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x140018668
xor edi, edi
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x140018681
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rsi
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret
Function at 0x1400186a0
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push r14
sub rsp, 0x30
mov rdi, r8
mov rsi, rdx
mov r14, rcx
and dword [rax - 0x18], 0
and qword [rax + 0x20], 0
xor ebx, ebx
mov eax, dword [0x14025dc90]
test eax, eax
je 0x1400186ea
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x14025dc90]
test eax, eax
jne 0x1400186f3
call fcn.14000d1e0
test eax, eax
je 0x14001870f
lea rdx, [rsp + 0x58]
mov rcx, qword [0x1402554d0]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne ebx, ecx
test ebx, ebx
jne 0x140018717
xor eax, eax
jmp 0x14001875e
mov r8, rdi
mov rdx, rsi
mov rcx, r14
call qword [sym.imp.USER32.dll_GetClassInfoExW]
mov edi, eax
mov dword [rsp + 0x20], eax
xor ebx, ebx
test eax, eax
sete bl
test ebx, ebx
je 0x140018741
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x140018743
xor esi, esi
mov rdx, qword [rsp + 0x58]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x14001875c
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r14
ret

Function at 0x140018774
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
xor edi, edi
mov dword [rax - 0x18], edi
mov rbx, qword [0x140261148]
and qword [rax + 0x10], rdi
xor esi, esi
mov eax, dword [0x14025dc90]
test eax, eax
je 0x1400187bf
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x14025dc90]
test eax, eax
jne 0x1400187c8
call fcn.14000d1e0
test eax, eax
je 0x1400187e4
lea rdx, [rsp + 0x48]
mov rcx, qword [0x1402554d0]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne 0x1400187ec
xor eax, eax
jmp 0x140018849
test rbx, rbx
jne 0x14001880c
lea rcx, str.InitCommonControlsEx
call fcn.1400184a4
mov rbx, rax
test rax, rax
je 0x140018817
mov qword [0x140261148], rax
mov rcx, r14
call rbx
mov edi, eax
mov dword [rsp + 0x20], eax
xor ebx, ebx
test edi, edi
sete bl
test ebx, ebx
je 0x14001882c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x14001882e
xor esi, esi
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x140018847
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret