joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140041620
Capabilities:
Delete file

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x48], rbx
mov rbx, rcx
lea rax, vtable.CDataRecoveryHandler.0
mov qword [rcx], rax
cmp qword [rcx + 0x138], 0
je 0x140041693
lea rdx, [rsp + 0x40]
lea rcx, [rbx + 0x120]
call fcn.1400e2bac
nop
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140041689
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
cmp qword [rbx + 0x138], 0
jne 0x14004164b
mov rdx, qword [rbx + 0x180]
xor ecx, ecx
call qword [sym.imp.USER32.dll_KillTimer]
nop
mov rdx, qword [rbx + 0x160]
sub rdx, 0x18
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400416c5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbx + 0x158]
sub rdx, 0x18
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400416e7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rbx + 0x120]
call fcn.1400e26f8
nop
lea rcx, [rbx + 0xe8]
lea rdi, vtable.CMap_class_CDocument____ptr64__class_CDocument____ptr64__class_ATL::CStringT_wchar_t__class_StrTraitMFC_wchar_t__class_ATL::ChTraitsCRT_wchar_t_____wchar_t_const____ptr64_.0
mov qword [rcx], rdi
call fcn.140043a14
nop
lea rcx, [rbx + 0xb0]
mov qword [rcx], rdi
call fcn.140043a14
nop
lea rcx, [rbx + 0x78]
lea rax, vtable.CMap_class_ATL::CStringT_wchar_t__class_StrTraitMFC_wchar_t__class_ATL::ChTraitsCRT_wchar_t_____wchar_t_const____ptr64__bool__bool_.0
mov qword [rcx], rax
call fcn.140043c00
nop
lea rcx, [rbx + 0x40]
lea rax, vtable.CMap_class_ATL::CStringT_wchar_t__class_StrTraitMFC_wchar_t__class_ATL::ChTraitsCRT_wchar_t_____wchar_t_const____ptr64__class_CDocument____ptr64__class_CDocument____ptr64_.0
mov qword [rcx], rax
call fcn.140043ab0
nop
lea rcx, [rbx + 8]
lea rax, vtable.CMap_class_ATL::CStringT_wchar_t__class_StrTraitMFC_wchar_t__class_ATL::ChTraitsCRT_wchar_t_____wchar_t_const____ptr64__class_ATL::CStringT_wchar_t__class_StrTraitMFC_wchar_t__class_ATL::ChTraitsCRT_wchar_t_____wchar_t_const____ptr64_.0
mov qword [rcx], rax
call fcn.140043b48
nop
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x1400423a0
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rbx, rdx
mov rcx, qword [rdx]
cmp dword [rcx - 0x10], 0
je 0x1400423d2
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1400423d2
lea rcx, [rdi + 0x120]
mov rdx, rbx
call fcn.1400e27d0
mov eax, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400423e4
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rdi, rdx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x14004240a
mov r8, rdx
mov rdx, qword [rbx]
call fcn.14002ea2c
jmp 0x140042471
cmp byte [0x1402a1128], 0
jne 0x14004244e
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14004243e
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1402a1120], rax
jmp 0x140042445
mov rax, qword [0x1402a1120]
mov byte [0x1402a1128], 1
jmp 0x140042455
mov rax, qword [0x1402a1120]
mov rcx, qword [rbx]
mov rdx, rdi
test rax, rax
je 0x14004246b
mov r8d, dword [rbx + 8]
xor r9d, r9d
call rax
jmp 0x140042471
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400448e0
Capabilities:
Set registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x68
mov qword [rbp - 0x28], 0xfffffffffffffffe
mov rdi, rcx
mov esi, 1
mov rax, qword [rcx + 0x20]
neg rax
sbb rdx, rdx
mov qword [rbp + 0x38], rdx
je 0x140044ab4
xor esi, esi
and qword [rbp - 0x20], rsi
and dword [rbp - 0x18], esi
and qword [rbp - 0x10], rsi
mov rax, qword [rcx]
lea rdx, [rbp + 0x40]
call qword [rax + 0x40]
nop
mov rbx, qword [rax]
call fcn.140038f70
xor edx, edx
mov rcx, qword [rax + 8]
call fcn.140026e94
mov rdx, rax
and qword [rsp + 0x38], rsi
and qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x2001f
and dword [rsp + 0x20], esi
xor r9d, r9d
mov r8, rbx
lea rcx, [rbp - 0x20]
call fcn.140041f88
test eax, eax
sete bl
mov rdx, qword [rbp + 0x40]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140044986
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test bl, bl
je 0x140044aa5
call fcn.14002afb8
mov rdx, rax
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
je 0x140044a9a
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x28], rax
call fcn.14002afb8
mov rdx, rax
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
je 0x140044a8f
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x30], rax
lea rcx, [rdi + 8]
lea r9, [rbp + 0x30]
lea r8, [rbp + 0x28]
lea rdx, [rbp + 0x38]
call fcn.140042960
xor eax, eax
mov rbx, qword [rbp + 0x30]
test rbx, rbx
setne al
test eax, eax
je 0x140044a35
mov rcx, rbx
call fcn.1401b541c
lea ecx, [rax*2 + 2]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
mov rdx, qword [rbp + 0x28]
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140044a50
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp + 0x28]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140044a6e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
cmp qword [rbp + 0x38], 0
jne 0x14004498e
mov rcx, qword [rbp - 0x20]
test rcx, rcx
je 0x140044a88
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x140044ab6
mov ecx, 0x80004005
call fcn.14000e734
nop
mov ecx, 0x80004005
call fcn.14000e734
nop
mov rcx, qword [rbp - 0x20]
test rcx, rcx
je 0x140044ab4
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
add rsp, 0x68
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140055ad8
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
xor edi, edi
mov dword [rax - 0x18], edi
mov rbx, qword [0x1402a14f0]
and qword [rax + 0x10], rdi
xor esi, esi
mov eax, dword [0x14029d688]
test eax, eax
je 0x140055b23
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x14029d688]
test eax, eax
jne 0x140055b2c
call fcn.140023358
test eax, eax
je 0x140055b48
lea rdx, [rsp + 0x48]
mov rcx, qword [0x140295120]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne 0x140055b50
xor eax, eax
jmp 0x140055bad
test rbx, rbx
jne 0x140055b70
lea rcx, str.ImageList_GetImageCount
call fcn.140023020
mov rbx, rax
test rax, rax
je 0x140055b7b
mov qword [0x1402a14f0], rax
mov rcx, r14
call rbx
mov edi, eax
mov dword [rsp + 0x20], eax
xor ebx, ebx
test edi, edi
sete bl
test ebx, ebx
je 0x140055b90
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x140055b92
xor esi, esi
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x140055bab
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret

Function at 0x14005a684
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
xor ebx, ebx
mov rdi, r8
mov rsi, rdx
mov r15, rcx
test r8, r8
jne 0x14005a6b5
call fcn.140038f70
mov rdi, qword [rax + 0x18]
lea r8, [0x1401f2a78]
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbp, rax
test rax, rax
jne 0x14005a6d4
xor eax, eax
jmp 0x14005a720
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
test rax, rax
je 0x14005a6d0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r14, rax
test rax, rax
je 0x14005a715
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rdx, r14
mov rcx, r15
mov r8d, eax
call fcn.14005a73c
mov ebx, eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x14006c2f0
Capabilities:
Check for unmoving mouse cursor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp byte [rcx + 0x10d], 0
mov rdi, rdx
mov rbx, rcx
jne 0x14006c3c0
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_SetCapture]
mov rcx, rax
call fcn.140032028
cmp qword [rbx + 0x138], 0
jne 0x14006c330
mov qword [rbx + 0x138], rdi
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
mov byte [rbx + 0x10d], 1
call qword [rax + 0x418]
lea rcx, [rbx + 0x1d0]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x360]
test al, 1
je 0x14006c390
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x360]
test al, al
js 0x14006c390
call fcn.140038f70
mov edx, 0x7f86
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorW]
mov rcx, rax
call qword [sym.imp.USER32.dll_SetCursor]
lea rcx, [rbx + 0x178]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov rcx, qword [rbx + 0x248]
test rcx, rcx
jne 0x14006c3bb
mov rdx, rbx
lea rcx, vtable.CGlobalUtils.0
call fcn.140055388
mov rcx, rax
call fcn.14007b8a0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400bfdb8
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
cmp dword [rdx + 8], 0x100
mov rbp, rdx
mov rbx, rcx
jne 0x1400bfea0
xor edx, edx
call fcn.140061420
xor r15d, r15d
mov rcx, rbx
test rax, rax
je 0x1400bfe02
mov rdx, rbp
call fcn.140108b30
jmp 0x1400bfeab
call fcn.140061418
mov esi, eax
cmp dword [rbx + 0x1394], r15d
je 0x1400bfe18
sub esi, dword [rbx + 0x1388]
mov r14d, dword [rbx + 0x1138]
test r14d, r14d
js 0x1400bfea0
cmp r14d, esi
jge 0x1400bfea0
mov edi, dword [rbp + 0x10]
cmp edi, 9
jne 0x1400bfe46
lea ecx, [rdi + 7]
call qword [sym.imp.USER32.dll_GetKeyState]
and al, 0x80
neg al
sbb edi, edi
and edi, 0xfffffffe
add edi, 0x27
mov rcx, rbx
call fcn.1400380b0
bt eax, 0x16
jae 0x1400bfe68
mov eax, 0x25
cmp edi, eax
jne 0x1400bfe62
lea edi, [rax + 2]
jmp 0x1400bfe68
cmp edi, 0x27
cmove edi, eax
sub edi, 0xd
je 0x1400bff65
sub edi, 0xe
je 0x1400bff41
sub edi, 0xa
je 0x1400bff33
sub edi, 2
je 0x1400bfee1
mov rcx, rbx
cmp edi, 1
je 0x1400bfec4
mov rax, qword [rbx]
mov edx, dword [rbp + 0x10]
call qword [rax + 0x728]
test eax, eax
jne 0x1400bfeda
mov rdx, rbp
mov rcx, rbx
call fcn.140067178
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
mov edx, dword [rbx + 0x1138]
call fcn.1400611c0
mov rdx, rax
mov rcx, rbx
call fcn.1400607cc
mov eax, 1
jmp 0x1400bfeab
inc dword [rbx + 0x1138]
mov eax, dword [rbx + 0x1138]
cmp eax, esi
cmovge eax, r15d
mov dword [rbx + 0x1138], eax
mov edx, r14d
mov rcx, rbx
call fcn.140061c44
mov edx, dword [rbx + 0x1138]
mov rcx, rbx
call fcn.140061c44
mov rcx, qword [rbx + 0x40]
call qword [sym.imp.USER32.dll_UpdateWindow]
mov rax, qword [rbx]
mov rcx, rbx
mov edx, dword [rbx + 0x1138]
call qword [rax + 0x4b8]
jmp 0x1400bfea0
sub dword [rbx + 0x1138], 1
jns 0x1400bfef9
lea eax, [rsi - 1]
jmp 0x1400bfef3
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x6c0]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x6c8]
mov dword [0x1402a3ca0], r15d
jmp 0x1400bfea0
mov edx, dword [rbx + 0x1138]
mov rcx, rbx
call fcn.1400611c0
mov rdx, rax
mov rcx, rbx
call fcn.1400607cc
test eax, eax
jne 0x1400bfeda
mov edx, dword [rbx + 0x1138]
mov rcx, rbx
call fcn.1400611c0
mov rdx, rax
mov rcx, rbx
call fcn.14006738c
jmp 0x1400bfeda
Function at 0x1400c269c
Capabilities:
Log keystrokes via polling

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x30
xor ebx, ebx
mov r15, rdx
mov qword [rax + 8], rbx
mov rdi, rcx
mov rax, qword [rcx]
call qword [rax + 0x370]
mov edx, dword [0x1402957d4]
lea r8, [rsp + 0x50]
or ecx, 0xffffffff
and al, 0x80
mov rax, qword [rdi]
cmovne edx, ecx
mov rcx, rdi
call qword [rax + 0x568]
mov rdx, qword [rsp + 0x50]
lea rcx, str.CDockablePane
mov ebp, eax
call fcn.14003ea50
mov rsi, rax
cmp rax, rdi
je 0x1400c279c
lea ecx, [rbx + 0x11]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x1400c279c
test rsi, rsi
je 0x1400c2741
mov r8, qword [rsi]
xor edx, edx
mov rcx, rsi
call qword [r8 + 0x450]
mov rdx, rax
lea rcx, str.CMultiPaneFrameWnd
call fcn.14003ea50
mov r14, rax
jmp 0x1400c2744
mov r14, rbx
cmp ebp, 2
jne 0x1400c27b7
test r14, r14
je 0x1400c2781
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x380]
test al, 0x40
je 0x1400c279c
cmp qword [rsp + 0x50], rbx
je 0x1400c2781
mov rax, qword [r14]
mov rdx, rdi
mov rcx, r14
call qword [rax + 0x498]
test eax, eax
mov rax, rdi
sete bl
mov dword [r15], ebx
jmp 0x1400c279e
mov rax, qword [rdi]
mov r9d, 5
xor r8d, r8d
mov rdx, rsi
mov rcx, rdi
call qword [rax + 0x3f0]
mov dword [r15], eax
xor eax, eax
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
cmp ebp, 3
jne 0x1400c279c
test rsi, rsi
je 0x1400c279c
mov rax, qword [rsi]
mov rdx, rdi
mov rcx, rsi
call qword [rax + 0x308]
test eax, eax
je 0x1400c279c
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x318]
test eax, eax
je 0x1400c279c
mov rax, qword [rdi]
xor edx, edx
mov rcx, rdi
call qword [rax + 0x480]
mov rax, qword [rdi]
lea r9d, [rbp - 2]
lea r8d, [rbp + 2]
mov qword [rsp + 0x20], rbx
mov rdx, rsi
mov rcx, rdi
call qword [rax + 0x698]
test rax, rax
setne bl
mov dword [r15], ebx
jmp 0x1400c279e
Function at 0x1400c4f24
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x58]
mov rsi, rcx
mov edx, dword [0x1402a79ec]
mov rdi, r8
mov ecx, 4
mov rdx, qword [rax + rdx*8]
mov eax, dword [rcx + rdx]
cmp dword [0x1402a3d90], eax
jle 0x1400c4fab
lea rcx, [0x1402a3d90]
call fcn.1401a5a44
cmp dword [0x1402a3d90], 0xffffffff
jne 0x1400c4fab
call fcn.14002afb8
mov rcx, rax
test rax, rax
je 0x1400c507a
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
lea rcx, [0x1401e2460]
mov qword [0x1402a3d88], rax
call fcn.1401a5e30
lea rcx, [0x1402a3d90]
call fcn.1401a59e4
test rdi, rdi
je 0x1400c5085
mov rax, qword [rsi + 0x4b8]
test rax, rax
je 0x1400c5068
cmp qword [rax + 0x40], 0
je 0x1400c5068
test rax, rax
je 0x1400c4fd8
mov rax, qword [rax + 0x40]
cmp qword [rdi], rax
jne 0x1400c5068
mov rax, qword [rdi + 8]
sub rax, 1
je 0x1400c502f
sub rax, 1
je 0x1400c4ffe
cmp rax, 1
jne 0x1400c5068
mov ebx, 0x428e
jmp 0x1400c5034
mov ecx, 0x11
mov ebx, 0x3ea1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x8000
test cx, ax
je 0x1400c5034
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x680]
test eax, eax
je 0x1400c5034
mov ebx, 0x3ea4
jmp 0x1400c5034
mov ebx, 0x3ea0
mov ecx, ebx
call fcn.14003a220
test rax, rax
je 0x1400c508b
mov r8d, ebx
lea rcx, [0x1402a3d88]
mov rdx, rax
call fcn.1400140bc
test eax, eax
je 0x1400c508b
mov rax, qword [0x1402a3d88]
mov qword [rdi + 0x18], rax
mov eax, 1
jmp 0x1400c506a
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov ecx, 0x80004005
call fcn.14000e734
int3
call fcn.14002ac4c
int3
call fcn.14002ac4c
int3
Function at 0x1400c6fb4
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
xor edi, edi
mov dword [rax - 0x18], edi
mov rbx, qword [0x1402a3e08]
and qword [rax + 0x10], rdi
xor esi, esi
mov eax, dword [0x14029d688]
test eax, eax
je 0x1400c6fff
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x14029d688]
test eax, eax
jne 0x1400c7008
call fcn.140023358
test eax, eax
je 0x1400c7024
lea rdx, [rsp + 0x48]
mov rcx, qword [0x140295120]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne 0x1400c702c
xor eax, eax
jmp 0x1400c7089
test rbx, rbx
jne 0x1400c704c
lea rcx, str.ImageList_Destroy
call fcn.140023020
mov rbx, rax
test rax, rax
je 0x1400c7057
mov qword [0x1402a3e08], rax
mov rcx, r14
call rbx
mov edi, eax
mov dword [rsp + 0x20], eax
xor ebx, ebx
test edi, edi
sete bl
test ebx, ebx
je 0x1400c706c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x1400c706e
xor esi, esi
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x1400c7087
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
sub rsp, 0x28
cmp qword [rcx + 8], 0
jne 0x1401041e6
xor eax, eax
add rsp, 0x28
ret
call fcn.140104204
mov rcx, rax
add rsp, 0x28
jmp 0x1400c6fb4
Function at 0x1400daec4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
test byte [rdx + 4], 1
mov esi, r8d
mov rbx, rdx
mov rbp, rcx
je 0x1400daeed
mov rdi, qword [rdx + 0x10]
jmp 0x1400daf3e
mov rdx, qword [rdx + 0x10]
mov r8d, 5
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdi, rax
test rax, rax
jne 0x1400daf0e
call fcn.14002bcdc
mov rcx, qword [rbx + 8]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rdi, rax
test rax, rax
jne 0x1400daf28
call fcn.14002bcdc
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
test rax, rax
jne 0x1400daf3e
call fcn.14002bcdc
call fcn.140038f70
cmp qword [rax + 0x68], 0
je 0x1400daf58
mov rdx, rdi
mov rcx, rbp
call fcn.1400da3d8
mov rdi, rax
mov edx, esi
mov rcx, rdi
call fcn.1400db1bc
mov rcx, qword [rbp + 0xf8]
mov rsi, rax
test rcx, rcx
je 0x1400daf7f
call qword [sym.imp.KERNEL32.dll_GlobalFree]
and qword [rbp + 0xf8], 0
test rsi, rsi
je 0x1400daf8e
mov rdi, rsi
mov qword [rbp + 0xf8], rsi
or dword [rbx + 4], 1
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov qword [rbx + 0x10], rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1400db32c
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov rdi, rcx
xor ebx, ebx
mov qword [rax - 0x18], rbx
mov r14, qword [0x1402a43f8]
and qword [rax + 8], rbx
xor esi, esi
mov eax, dword [0x14029d688]
test eax, eax
je 0x1400db378
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x14029d688]
test eax, eax
jne 0x1400db381
call fcn.140023358
test eax, eax
je 0x1400db39d
lea rdx, [rsp + 0x40]
mov rcx, qword [0x140295120]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne 0x1400db3a8
xor eax, eax
jmp 0x1400db42c
test r14, r14
jne 0x1400db3c5
lea rcx, str.CreatePropertySheetPageW
call fcn.1400db628
test rax, rax
je 0x1400db3f7
mov qword [0x1402a43f8], rax
mov eax, dword [rdi + 4]
mov ecx, 0x4000
test ecx, eax
jne 0x1400db3e6
cmp dword [rdi], 0x60
jb 0x1400db3e6
or eax, ecx
mov dword [rdi + 4], eax
mov rax, qword [0x140295120]
mov qword [rdi + 0x58], rax
mov rcx, rdi
call qword [0x1402a43f8]
mov rbx, rax
mov qword [rsp + 0x20], rax
xor edi, edi
test rbx, rbx
sete dil
test edi, edi
je 0x1400db40e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x1400db410
xor esi, esi
mov rdx, qword [rsp + 0x40]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test edi, edi
je 0x1400db429
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rbx
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x1400db444
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
xor edi, edi
mov dword [rax - 0x18], edi
mov rbx, qword [0x1402a4400]
and qword [rax + 0x10], rdi
xor esi, esi
mov eax, dword [0x14029d688]
test eax, eax
je 0x1400db48f
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x14029d688]
test eax, eax
jne 0x1400db498
call fcn.140023358
test eax, eax
je 0x1400db4b4
lea rdx, [rsp + 0x48]
mov rcx, qword [0x140295120]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne 0x1400db4bc
xor eax, eax
jmp 0x1400db519
test rbx, rbx
jne 0x1400db4dc
lea rcx, str.DestroyPropertySheetPage
call fcn.1400db628
mov rbx, rax
test rax, rax
je 0x1400db4e7
mov qword [0x1402a4400], rax
mov rcx, r14
call rbx
mov edi, eax
mov dword [rsp + 0x20], eax
xor ebx, ebx
test edi, edi
sete bl
test ebx, ebx
je 0x1400db4fc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x1400db4fe
xor esi, esi
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x1400db517
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret

Function at 0x1400db530
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
or rdi, 0xffffffffffffffff
mov qword [rax - 0x18], rdi
mov rbx, qword [0x1402a4408]
and qword [rax + 0x10], 0
xor esi, esi
mov eax, dword [0x14029d688]
test eax, eax
je 0x1400db57f
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x14029d688]
test eax, eax
jne 0x1400db588
call fcn.140023358
test eax, eax
je 0x1400db5a4
lea rdx, [rsp + 0x48]
mov rcx, qword [0x140295120]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne 0x1400db5ae
or rax, 0xffffffffffffffff
jmp 0x1400db610
test rbx, rbx
jne 0x1400db5ce
lea rcx, str.PropertySheetW
call fcn.1400db628
mov rbx, rax
test rax, rax
je 0x1400db5db
mov qword [0x1402a4408], rax
mov rcx, r14
call rbx
mov rdi, rax
mov qword [rsp + 0x20], rax
xor ebx, ebx
cmp rdi, 0xffffffffffffffff
sete bl
test ebx, ebx
je 0x1400db5f2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x1400db5f4
xor esi, esi
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x1400db60d
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rdi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret