joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002bd00
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x280
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x2a0], rbx
mov rax, qword [0x1400e2e38]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rbp, r8
mov rbx, rdx
mov rsi, rcx
mov dword [rsp + 0x30], pe_nt_image_headers64
xor edi, edi
mov rax, qword [0x1400ec150]
test rax, rax
jne 0x14002bd75
mov ecx, 0x310
call fcn.140051b7c
mov qword [rsp + 0x38], rax
test rax, rax
je 0x14002bd6b
mov rcx, rax
call fcn.140023810
jmp 0x14002bd6e
mov rax, rdi
mov qword [0x1400ec150], rax
mov r8, rbx
lea rdx, str.GetPortnameViaDevInstID__s_
mov rcx, rax
call fcn.140023be0
mov r9d, pe_nt_image_headers64
lea r8, [rsp + 0x70]
mov rdx, rbx
mov rcx, rsi
call fcn.14002b1d0
test eax, eax
je 0x14002bec1
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SETUPAPI.dll_SetupDiCreateDeviceInfoList]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x14002be02
mov rax, qword [0x1400ec150]
test rax, rax
jne 0x14002bdec
mov ecx, 0x310
call fcn.140051b7c
mov qword [rsp + 0x38], rax
test rax, rax
je 0x14002bde2
mov rcx, rax
call fcn.140023810
jmp 0x14002bde5
mov rax, rdi
mov qword [0x1400ec150], rax
lea rdx, str.SetupDiCreateDeviceInfoList_call_returned_INVALID_HANDLE_VALUE
mov rcx, rax
call fcn.140023be0
xor eax, eax
jmp 0x14002bec1
mov dword [rsp + 0x48], 0x20
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x70]
mov rcx, rbx
call qword [sym.imp.SETUPAPI.dll_SetupDiOpenDeviceInfoW]
test eax, eax
je 0x14002beb6
mov dword [rsp + 0x28], 0x20019
mov dword [rsp + 0x20], 1
xor r9d, r9d
lea r8d, [r9 + 1]
lea rdx, [rsp + 0x48]
mov rcx, rbx
call qword [sym.imp.SETUPAPI.dll_SetupDiOpenDevRegKey]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x14002beb6
mov dword [rsp + 0x38], 1
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x38]
xor r8d, r8d
lea rdx, str.PortName
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14002bead
call fcn.1400237a0
mov rcx, rax
mov r8, rbp
lea rdx, str.Found_PortName___s
call fcn.140023be0
mov edi, 1
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rbx
call qword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
mov eax, edi
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.14007d3d0
mov rbx, qword [rsp + 0x2a0]
add rsp, 0x280
pop rdi
pop rsi
pop rbp
ret
Function at 0x14002da60
Capabilities:
Resolve dns

Disassembly:
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rax, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
movzx r13d, r9w
mov qword [rbp], 0
mov r14d, r8d
mov r15d, edx
mov byte [rax], 0
call qword [sym.imp.WS2_32.dll_gethostbyname]
test rax, rax
mov r12, rax
je 0x14002db95
cmp word [rax + 0x10], 2
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], rdi
jne 0x14002db57
cmp word [rax + 0x12], 4
jne 0x14002db57
mov rdi, qword [rax + 0x18]
mov rcx, qword [rdi]
test rcx, rcx
je 0x14002db57
nop
nop
nop
mov esi, dword [rcx]
mov edx, gethostbyname
lea ecx, [rdx - 0x2f]
call fcn.140080560
test rax, rax
mov rbx, rax
je 0x14002db3d
mov edx, reloc.OLEAUT32.dll_SafeArrayGetDim
lea ecx, [rdx - 0xf]
call fcn.140080560
test rax, rax
jne 0x14002db15
mov rcx, rbx
call fcn.140080070
xor ebx, ebx
jmp 0x14002db3d
mov word [rax], 2
mov word [rax + 2], r13w
mov dword [rax + 4], esi
mov dword [rbx + 4], 2
mov dword [rbx + 8], r15d
mov dword [rbx + 0xc], r14d
mov qword [rbx + reloc.OLEAUT32.dll_SafeArrayGetDim], 0x10
mov qword [rbx + 0x20], rax
test rbx, rbx
mov qword [rbp], rbx
je 0x14002db8e
mov rcx, qword [rdi + 8]
add rdi, 8
lea rbp, [rbx + 0x28]
test rcx, rcx
jne 0x14002dae0
mov r8, qword [r12]
mov rcx, qword [rsp + 0x70]
mov r9d, 0x400
lea edx, [r9 + 1]
call fcn.140080650
xor eax, eax
mov rsi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov eax, 8
jmp 0x14002db71
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
sub eax, 0x2af9
je 0x14002dbac
sub eax, 1
je 0x14002dbd2
sub eax, 1
je 0x14002dbbf
mov eax, 0x2af9
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov eax, 0x2afb
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov eax, 0x2afa
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x14002e570
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
sub rsp, 0x280
mov rax, qword [0x1400e2e38]
xor rax, rsp
mov qword [rsp + 0x270], rax
cmp dword [0x1400ed374], 0
lea rax, [0x14002df20]
lea rbx, str.getaddrinfo
mov qword [rsp + 0x28], rax
lea rax, str.getnameinfo
movzx ebp, cx
mov qword [rsp + 0x30], rax
lea rax, [0x14002e2d0]
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x38], rax
lea rax, str.freeaddrinfo
mov qword [rsp + 0x40], rax
lea rax, [0x14002dec0]
mov qword [rsp + 0x48], rax
jne 0x14002e73f
lea rcx, [rsp + 0x160]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x14002e735
lea r8, [rsp + 0x160]
lea rcx, [rsp + 0x50]
mov edx, 0x10c
mov qword [rsp + 0x290], rsi
call fcn.14007e5a0
lea r8, str.ws2_32
lea rcx, [rsp + 0x50]
mov edx, 0x10c
call fcn.140080be0
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
mov rsi, rax
je 0x14002e664
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x14002e6c4
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea r8, [rsp + 0x160]
lea rcx, [rsp + 0x50]
mov edx, 0x10c
call fcn.14007e5a0
lea r8, str.wship6
lea rcx, [rsp + 0x50]
mov edx, 0x10c
call fcn.140080be0
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
mov rsi, rax
je 0x14002e72d
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x14002e6c4
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x14002e72d
mov qword [rsp + 0x298], rdi
lea rbx, [rsp + 0x28]
xor edi, edi
mov rdx, qword [rbx - 8]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [rbx], rax
je 0x14002e71c
add rdi, 1
add rbx, 0x10
cmp rdi, 3
jl 0x14002e6d3
mov rax, qword [rsp + 0x28]
mov qword [0x1400e6688], rax
mov rax, qword [rsp + 0x38]
mov qword [0x1400e6698], rax
mov rax, qword [rsp + 0x48]
mov qword [0x1400e66a8], rax
jmp 0x14002e725
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rdi, qword [rsp + 0x298]
mov rsi, qword [rsp + 0x290]
mov dword [0x1400ed374], 1
movzx eax, bp
lea rcx, str.getaddrinfo
add rax, rax
mov rax, qword [rcx + rax*8 + 8]
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.14007d3d0
mov rbx, qword [rsp + 0x2a0]
add rsp, 0x280
pop rbp
ret
Function at 0x1400509e0
Capabilities:
Extract resource via kernel32 functions
Identify system language via api

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov ebp, ecx
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx edi, ax
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
movzx esi, ax
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
movzx ebx, ax
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
cmp di, bx
jne 0x140050a42
cmp di, ax
jne 0x140050a42
lea r8, [0x1400e4bb0]
xor eax, eax
movzx edx, di
mov rcx, r8
cmp dword [rcx], edx
je 0x140050a66
add eax, 1
add rcx, 0x18
cmp eax, 0x26
jb 0x140050a30
jmp 0x140050a70
lea r8, [0x1400e4bb0]
xor eax, eax
movzx edx, si
mov rcx, r8
cmp dword [rcx], edx
je 0x140050a66
add eax, 1
add rcx, 0x18
cmp eax, 0x26
jb 0x140050a51
mov di, si
jmp 0x140050a70
lea rcx, [rax + rax*2]
mov di, word [r8 + rcx*8 + 4]
and di, 0x1ff
cmp di, 1
je 0x140050a81
cmp di, 0xd
jne 0x140050adf
mov ecx, 1
call qword [sym.imp.USER32.dll_SetProcessDefaultLayout]
xor ecx, ecx
movzx ebx, bp
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov r8d, 5
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
mov rbx, rax
je 0x140050adf
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x140050adf
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
je 0x140050adf
or dword [rax + 8], 0x402000
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov eax, 1
add rsp, 0x20
pop rdi
ret
Function at 0x140056b30
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0xb0], 0
mov rdi, qword [rcx + 0xc0]
mov rbp, qword [rcx + 0xb8]
mov rsi, rcx
je 0x140056b8d
call fcn.14005568c
mov rdx, qword [rsi + 0xb0]
mov r8d, 5
mov rbx, qword [rax + 0x18]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rcx, rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbp, rax
test rbp, rbp
je 0x140056b9e
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
test rdi, rdi
mov ebx, 1
je 0x140056bdb
cmp word [rdi + 2], 0xffff
mov ecx, dword [rdi]
jne 0x140056bbf
mov ecx, dword [rdi + 0xc]
movzx edx, word [rdi + 0x12]
movzx eax, word [rdi + 0x14]
jmp 0x140056bc7
mov dx, word [rdi + 0xa]
mov ax, word [rdi + 0xc]
test ecx, 0x1801
jne 0x140056bd9
test dx, dx
jne 0x140056bd9
test ax, ax
je 0x140056bdb
xor ebx, ebx
cmp qword [rsi + 0xb0], 0
je 0x140056bee
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140057344
Capabilities:
Extract resource via kernel32 functions

Disassembly:
movzx edx, dx
jmp method.CDialog.virtual_624
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
test rdx, 0xffffffffffff0000
mov rbp, r8
mov rdi, rdx
mov rsi, rcx
mov qword [rcx + 0xb0], rdx
jne 0x140057383
cmp dword [rcx + 0xa8], 0
jne 0x140057383
movzx eax, dx
mov dword [rcx + 0xa8], eax
call fcn.14005568c
mov r8d, 5
mov rdx, rdi
mov rbx, qword [rax + 0x18]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rcx, rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r9, rbx
mov r8, rbp
mov rdx, rax
mov rcx, rsi
mov rdi, rax
call fcn.1400572e8
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140058f68
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x20
xor esi, esi
xor ebx, ebx
test r8, r8
mov r12, r9
mov rdi, r8
mov rbp, rdx
mov r14, rcx
je 0x140058fda
call fcn.14005568c
mov r8d, 0xf0
mov rdx, rdi
mov r13, qword [rax + 0x18]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x140058fda
mov rdx, rax
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
mov rbx, rax
je 0x140059027
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rsi, rax
test rsi, rsi
mov edi, 1
je 0x140059007
mov r10, qword [r14]
mov r9, r12
mov r8, rsi
mov rdx, rbp
mov rcx, r14
call qword [r10 + 0x40]
test rbx, rbx
mov edi, eax
je 0x140059007
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeResource]
cmp qword [rbp + 0x98], 0
je 0x140059025
mov rcx, qword [rbp + 0x98]
mov rdx, r12
mov r8, qword [rcx]
call qword [r8 + 0x140]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop r13
pop r12
ret

Function at 0x14005a40c
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x280
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x1400e2e38]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rsi, rdx
mov rdi, rcx
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], rdx
lea r8, [rsp + 0x30]
mov rdx, qword [rdx]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov ebx, eax
test eax, eax
jne 0x14005a50b
mov r9d, 0x104
lea r8, [rsp + 0x60]
xor edx, edx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov ebx, eax
test eax, eax
jne 0x14005a4e2
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x28]
call fcn.140011290
nop
lea rdx, [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
call fcn.14005a40c
mov ebx, eax
test eax, eax
setne byte [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14005a4c9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
cmp byte [rsp + 0x20], 0
je 0x14005a4d2
jmp 0x14005a4e2
jmp 0x14005a462
cmp ebx, 0x103
je 0x14005a4f2
cmp ebx, 0x3f2
jne 0x14005a500
mov rdx, qword [rsi]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ebx, eax
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.14007d3d0
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14005be84
Capabilities:
Get graphical window text

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rsi
movsxd rsi, r8d
mov rdi, rdx
mov rbx, rcx
cmp qword [rcx + 0xa0], 0
jne 0x14005bec2
mov r8d, esi
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x14005bf76
call fcn.1400588fc
mov r11, rax
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
jne 0x14005bee1
mov ecx, 0x80004005
call fcn.140011180
int3
mov rax, qword [rax]
mov rcx, r11
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x40], rax
mov rcx, qword [rbx + 0xa0]
mov rax, qword [rcx]
lea rdx, [rsp + 0x40]
call qword [rax + 0x118]
mov rdx, rsi
or rsi, 0xffffffffffffffff
mov r9, rsi
mov r8, qword [rsp + 0x40]
mov rcx, rdi
call fcn.140082b60
test eax, eax
je 0x14005bf49
cmp eax, 0xc
je 0x14005bf43
cmp eax, 0x16
je 0x14005bf3d
cmp eax, 0x22
je 0x14005bf3d
cmp eax, 0x50
je 0x14005bf49
call fcn.1400561a4
int3
call fcn.1400561a4
int3
call fcn.14005615c
int3
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebx, eax
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov ecx, esi
lock xadd dword [rdx + 0x10], ecx
add ecx, esi
test ecx, ecx
jg 0x14005bf74
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov eax, ebx
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x14005d318
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, rcx
mov rcx, qword [rcx + 0x40]
mov rbx, r8
call fcn.140065ad8
test rax, rax
mov rsi, rax
je 0x14005d395
mov rcx, rax
call qword [sym.imp.USER32.dll_GetDlgCtrlID]
test rbx, rbx
movzx edi, ax
je 0x14005d390
cmp dword [rbx], 0x38
jb 0x14005d390
mov rax, qword [rbp + 0x40]
or dword [rbx + 4], 1
or qword [rbx + 0x30], 0xffffffffffffffff
xor r9d, r9d
xor r8d, r8d
mov edx, 0x87
mov rcx, rsi
mov qword [rbx + 8], rax
mov qword [rbx + 0x10], rsi
call qword [sym.imp.USER32.dll_SendMessageW]
bt rax, 0xd
jb 0x14005d390
or dword [rbx + 4], 0x80000002
mov rax, rdi
jmp 0x14005d399
or rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x14005e13c
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov edi, ecx
call fcn.1400556dc
mov rbx, rax
mov rax, qword [rax + 0x78]
test rax, rax
je 0x14005e173
mov rcx, qword [rax + 0x40]
test rcx, rcx
je 0x14005e173
xor r9d, r9d
xor r8d, r8d
mov edx, 0x401
call qword [sym.imp.USER32.dll_SendMessageW]
test edi, edi
mov rbx, qword [rbx + 0xa0]
je 0x14005e1a3
test rbx, rbx
je 0x14005e1a3
mov ecx, 1
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x14005e1a3
mov rax, qword [rbx]
or rdx, 0xffffffffffffffff
mov rcx, rbx
call qword [rax + 0x2d0]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400615a8
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0xa0], 0
mov rbx, rdx
mov rsi, rcx
jne 0x140061660
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov r8, qword [rbx]
mov edx, 1
mov ecx, dword [r8 - 0xc]
sub edx, dword [r8 - 8]
movsxd rdi, eax
sub ecx, edi
or edx, ecx
jge 0x1400615f8
mov edx, edi
mov rcx, rbx
call fcn.1400111a0
test edi, edi
mov rdx, qword [rbx]
js 0x140061655
cmp edi, dword [rdx - 0xc]
jg 0x140061655
mov dword [rdx - 0x10], edi
mov rax, qword [rbx]
lea r8d, [rdi + 1]
and word [rax + rdi*2], 0
mov rcx, qword [rsi + 0x40]
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov rcx, qword [rbx]
test rcx, rcx
jne 0x140061629
xor eax, eax
jmp 0x140061632
call fcn.1400820a0
test eax, eax
js 0x14006164a
mov rcx, qword [rbx]
cmp eax, dword [rcx - 0xc]
jg 0x14006164a
mov dword [rcx - 0x10], eax
movsxd rcx, eax
mov rax, qword [rbx]
and word [rax + rcx*2], 0
jmp 0x140061670
mov ecx, 0x80070057
call fcn.140011180
int3
mov ecx, 0x80070057
call fcn.140011180
int3
mov rcx, qword [rcx + 0xa0]
mov rax, qword [rcx]
call qword [rax + 0x118]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x140063978
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
lea rcx, [0x1400b7504]
mov rbx, r8
mov esi, edx
call fcn.1400820a0
lea rdx, [0x1400b7504]
mov r8d, eax
mov rcx, rbx
call fcn.140010e40
cmp qword [rdi + 0x98], 0
mov edx, esi
jne 0x140063a64
mov rcx, qword [rdi + 0x40]
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
mov rsi, rax
je 0x140063a7c
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov rcx, qword [rbx]
mov edx, 1
sub edx, dword [rcx - 8]
mov ecx, dword [rcx - 0xc]
movsxd rdi, eax
sub ecx, edi
or edx, ecx
jge 0x1400639fd
mov edx, edi
mov rcx, rbx
call fcn.1400111a0
test edi, edi
mov rdx, qword [rbx]
js 0x140063a59
cmp edi, dword [rdx - 0xc]
jg 0x140063a59
mov dword [rdx - 0x10], edi
mov rax, qword [rbx]
lea r8d, [rdi + 1]
and word [rax + rdi*2], 0
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov rcx, qword [rbx]
test rcx, rcx
jne 0x140063a2d
xor eax, eax
jmp 0x140063a36
call fcn.1400820a0
test eax, eax
js 0x140063a4e
mov rcx, qword [rbx]
cmp eax, dword [rcx - 0xc]
jg 0x140063a4e
mov dword [rcx - 0x10], eax
movsxd rcx, eax
mov rax, qword [rbx]
and word [rax + rcx*2], 0
jmp 0x140063a7c
mov ecx, 0x80070057
call fcn.140011180
int3
mov ecx, 0x80070057
call fcn.140011180
int3
mov rcx, rdi
call fcn.14005b604
test rax, rax
je 0x140063a7c
mov rdx, rbx
mov rcx, rax
call fcn.1400615a8
mov rax, qword [rbx]
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov eax, dword [rax - 0x10]
add rsp, 0x20
pop rdi
ret
Function at 0x140064128
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x20
xor edi, edi
xor ebx, ebx
test rdx, rdx
mov rsi, rdx
mov rbp, rcx
je 0x140064190
call fcn.14005568c
mov r8d, 0xf0
mov rdx, rsi
mov r12, qword [rax + 0x18]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x140064190
mov rdx, rax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
mov rbx, rax
je 0x1400641b2
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
mov rdx, rdi
mov rcx, rbp
call fcn.140063b84
test rdi, rdi
mov esi, eax
je 0x1400641b0
test rbx, rbx
je 0x1400641b0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret

Function at 0x1400658d0
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x230
mov rax, qword [0x1400e2e38]
xor rax, rsp
mov qword [rsp + 0x220], rax
test rcx, rcx
mov rbx, rdx
mov rdi, rcx
jne 0x140065905
call fcn.1400561a4
int3
test rdx, rdx
jne 0x140065910
call fcn.1400561a4
int3
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
and word [rsp + 0x20], 0
lea rcx, [rsp + 0x22]
xor edx, edx
mov r8d, 0x1fe
mov esi, eax
call fcn.140082240
mov r8d, pe_nt_image_headers64
cmp esi, r8d
ja 0x140065962
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindowTextW]
cmp eax, esi
jne 0x140065962
lea rcx, [rsp + 0x20]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x14006596e
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov rcx, qword [rsp + 0x220]
xor rcx, rsp
call fcn.14007d3d0
lea r11, [rsp + 0x230]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1400661f0
Capabilities:
Set thread local storage value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x20
mov esi, 1
mov r14, r8
mov rdi, rdx
cmp dword [rdx + 0x10], esi
mov r12, rcx
mov ebp, esi
jle 0x14006627d
lea ebx, [rsi + 7]
lea r13d, [rsi + 0xf]
test r14, r14
je 0x140066249
mov rax, qword [r12 + 0x10]
cmp qword [rax + r13 + 8], r14
je 0x140066249
mov rax, qword [rdi + 0x18]
cmp qword [rbx + rax], 0
je 0x140066269
xor esi, esi
jmp 0x140066269
mov rax, qword [rdi + 0x18]
mov rcx, qword [rbx + rax]
test rcx, rcx
je 0x140066260
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
mov rax, qword [rdi + 0x18]
and qword [rbx + rax], 0
add ebp, 1
add r13, 0x10
add rbx, 8
cmp ebp, dword [rdi + 0x10]
jl 0x140066229
test esi, esi
je 0x1400662c4
lea rcx, [r12 + 0x28]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rcx, [r12 + 0x18]
mov rdx, rdi
call fcn.140065d10
lea rcx, [r12 + 0x28]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [rdi + 0x18]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov r11, qword [rdi]
mov edx, 1
mov rcx, rdi
call qword [r11]
mov ecx, dword [r12]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop r13
pop r12
ret
Function at 0x140076ec4
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x30
test r8d, r8d
mov rbx, rcx
jne 0x140076ed6
xor eax, eax
jmp 0x140076f07
mov rcx, qword [rcx + 8]
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140076f03
mov rbx, qword [rbx + 0x18]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, rbx
mov ecx, eax
call fcn.140078dc0
mov eax, dword [rsp + 0x50]
add rsp, 0x30
pop rbx
ret