joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140030550
Capabilities:
Check if file exists

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x60
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0xa8], rbx
mov rax, qword [0x14028e6b0]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbp, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
mov qword [rcx + 0x18], 7
xor r15d, r15d
mov qword [rcx + 0x10], r15
mov word [rcx], r15w
mov qword [rcx + 0x38], 7
mov qword [rcx + 0x30], r15
mov word [rcx + 0x20], r15w
lea rsi, [rcx + 0x40]
mov qword [rsi + 0x18], 7
mov qword [rsi + 0x10], r15
mov word [rsi], r15w
mov qword [rcx + 0x60], r15
mov qword [rcx + 0x68], r15
mov qword [rcx + 0x88], 7
mov qword [rcx + 0x80], r15
mov word [rcx + 0x70], r15w
mov qword [rcx + 0xa8], 7
mov qword [rcx + 0xa0], r15
mov word [rcx + 0x90], r15w
mov qword [rcx + 0xc8], 7
mov qword [rcx + 0xc0], r15
mov word [rcx + 0xb0], r15w
mov qword [rcx + 0xe8], 7
mov qword [rcx + 0xe0], r15
mov word [rcx + 0xd0], r15w
mov qword [rcx + 0x108], 7
mov qword [rcx + 0x100], r15
mov word [rcx + 0xf0], r15w
mov qword [rcx + 0x128], 7
mov qword [rcx + 0x120], r15
mov word [rcx + 0x110], r15w
mov byte [rcx + 0x130], 1
cmp qword [rdx + 0x18], 8
jb 0x140030676
mov rcx, qword [rdx]
jmp 0x140030679
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1400307a7
cmp rdi, rbx
je 0x14003069e
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rbx
mov rcx, rdi
call fcn.140006dd0
cmp rsi, rbp
je 0x1400306b5
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rbp
mov rcx, rsi
call fcn.140006dd0
cmp qword [rbx + 0x18], 8
jb 0x1400306c1
mov rdx, qword [rbx]
jmp 0x1400306c4
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.14002a680
nop
cmp qword [rsp + 0x40], 0
jne 0x14003072f
mov rax, qword [rsp + 0x48]
cmp rax, 0x10
jb 0x140030794
inc rax
mov rcx, qword [rsp + 0x30]
cmp rax, 0x1000
jb 0x14003078f
test cl, 0x1f
je 0x140030705
call fcn.14018acfc
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x140030714
call fcn.14018acfc
int3
sub rcx, rax
cmp rcx, 8
jae 0x140030723
call fcn.14018acfc
int3
cmp rcx, 0x27
jbe 0x14003078c
call fcn.14018acfc
nop
mov rdx, rbx
lea rcx, [rdi + 0x60]
call fcn.140039b20
nop
mov rax, qword [rsp + 0x48]
cmp rax, 0x10
jb 0x140030794
inc rax
mov rcx, qword [rsp + 0x30]
cmp rax, 0x1000
jb 0x14003078f
test cl, 0x1f
je 0x140030762
call fcn.14018acfc
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x140030771
call fcn.14018acfc
int3
sub rcx, rax
cmp rcx, 8
jae 0x140030780
call fcn.14018acfc
int3
cmp rcx, 0x27
jbe 0x14003078c
call fcn.14018acfc
int3
mov rcx, rax
call fcn.140167f5c
mov byte [rsp + 0x30], 0
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], InitCommonControls
mov rax, rdi
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140168660
mov rbx, qword [rsp + 0xa8]
add rsp, 0x60
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140036220
Capabilities:
Check if file exists

Disassembly:
push rdi
sub rsp, 0xf0
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x108], rbx
mov rax, qword [0x14028e6b0]
xor rax, rsp
mov qword [rsp + 0xe0], rax
mov rbx, rcx
call fcn.14000cdd0
cmp dword [rax + 0x332b4], 7
jg 0x140036264
xor al, al
jmp 0x1400362e7
lea rdi, [rbx + 0x70]
cmp qword [rdi + 0x18], 8
jb 0x140036274
mov rcx, qword [rdi]
jmp 0x140036277
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x14003625d
add rbx, 0x50
cmp qword [rbx + 0x18], 8
jb 0x140036291
mov rcx, qword [rbx]
jmp 0x140036294
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x14003625d
lea rcx, [rsp + 0x30]
call fcn.140002990
nop
mov r8d, 2
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.140007160
test al, al
jne 0x1400362c4
xor bl, bl
jmp 0x1400362da
mov r8d, 1
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.140007160
movzx ebx, al
lea rcx, [rsp + 0x30]
call fcn.140031ca0
movzx eax, bl
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.140168660
mov rbx, qword [rsp + 0x108]
add rsp, 0xf0
pop rdi
ret

Function at 0x140039b20
Capabilities:
Check if file exists
Get file version info

Disassembly:
push rbx
push rdi
sub rsp, 0x28
cmp qword [rdx + 0x10], 0
mov rbx, rdx
mov rdi, rcx
je 0x140039c13
cmp qword [rdx + 0x18], 8
jb 0x140039b44
mov rcx, qword [rdx]
jmp 0x140039b47
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x140039c13
cmp qword [rbx + 0x18], 8
mov qword [rsp + 0x40], rbp
mov dword [rsp + 0x48], 0
jb 0x140039b6e
mov rcx, qword [rbx]
jmp 0x140039b71
mov rcx, rbx
lea rdx, [rsp + 0x48]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov ebp, eax
test eax, eax
je 0x140039c0e
mov ecx, ebp
mov qword [rsp + 0x20], rsi
call fcn.140167f6c
cmp qword [rbx + 0x18], 8
mov rsi, rax
jb 0x140039b9e
mov rbx, qword [rbx]
mov edx, dword [rsp + 0x48]
mov r9, rsi
mov r8d, ebp
mov rcx, rbx
call sub.VERSION.dll_GetFileVersionInfoW
lea r9, [rsp + 0x50]
mov qword [rsp + 0x58], 0
lea r8, [rsp + 0x58]
mov dword [rsp + 0x50], 0
lea rdx, [0x1401d3668]
mov rcx, rsi
call sub.VERSION.dll_VerQueryValueW
cmp dword [rsp + 0x50], 0
je 0x140039c01
mov rcx, qword [rsp + 0x58]
movzx eax, word [rcx + 0xa]
mov dword [rdi], eax
movzx eax, word [rcx + 8]
mov dword [rdi + 4], eax
movzx eax, word [rcx + 0xe]
mov dword [rdi + 8], eax
movzx eax, word [rcx + 0xc]
mov dword [rdi + 0xc], eax
mov rcx, rsi
call fcn.140167f64
mov rsi, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x40]
add rsp, 0x28
pop rdi
pop rbx
ret
Function at 0x14003b030
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
push rdi
push r14
push r15
sub rsp, 0x90
mov qword [rax - 0x80], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x20], rsi
mov r14, rcx
mov qword [rsp + 0x20], 0
call fcn.140036220
test al, al
je 0x14003b1cb
mov byte [rsp + 0x30], 0
xor edx, edx
lea rcx, [rsp + 0x38]
call fcn.140031050
nop
lea rcx, [r14 + 0x70]
cmp qword [rcx + 0x18], 8
jb 0x14003b088
mov rcx, qword [rcx]
xor edx, edx
lea r8d, [rdx + 0x40]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rsi, rax
mov qword [rsp + 0x20], rax
test rax, rax
jne 0x14003b0b2
lea rcx, [rsp + 0x30]
call fcn.140031330
xor al, al
jmp 0x14003b1cb
mov edx, 0x65
mov r8d, 0x100
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
mov rcx, rsi
test rax, rax
jne 0x14003b0e9
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rcx, [rsp + 0x30]
call fcn.140031330
xor al, al
jmp 0x14003b1cb
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rdi, rax
mov rcx, rsi
test rax, rax
jne 0x14003b115
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rcx, [rsp + 0x30]
call fcn.140031330
xor al, al
jmp 0x14003b1cb
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
lea ecx, [rbx + 1]
call fcn.140167f6c
mov r15, rax
mov r8d, ebx
mov rdx, rdi
mov rcx, rax
call fcn.140187210
mov byte [rbx + r15], 0
lea rax, [rsp + 0x40]
mov qword [rsp + 0xb8], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0xc0], rax
mov qword [rsp + 0x88], 0
lea r8, [rsp + 0x50]
mov rdx, r15
lea rcx, [rsp + 0x40]
call fcn.14002fd80
nop
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.140032000
mov rcx, r15
call fcn.140167f64
lea rcx, [r14 + 0xe8]
lea rdx, [rsp + 0x30]
call fcn.140036310
mov rcx, r14
call fcn.140036f70
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rcx, [rsp + 0x30]
call fcn.140031330
mov al, 1
jmp 0x14003b1cb
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x14003bac0
Capabilities:
Hide graphical window

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x50
mov rbx, rcx
xor r9d, r9d
mov rcx, qword [rcx + 0x40]
xor r8d, r8d
mov edx, 0x1304
xor edi, edi
call qword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
jle 0x14003bb85
mov qword [rsp + 0x60], rsi
mov esi, eax
xor eax, eax
mov edx, edi
mov rcx, rbx
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
call fcn.14003dd10
mov rcx, qword [rbx + 0x40]
lea r9, [rsp + 0x20]
movsxd r8, edi
mov edx, 0x133c
mov dword [rsp + 0x20], 8
call qword [sym.imp.USER32.dll_SendMessageW]
cmp qword [rsp + 0x40], 0
je 0x14003bb6e
mov rcx, qword [rbx + 0x10]
mov r9, rbx
xor r8d, r8d
mov edx, 0x5001
call qword [sym.imp.USER32.dll_SendMessageW]
test rax, rax
jne 0x14003bb6c
mov rdx, qword [rsp + 0x40]
lea r8d, [rax + 1]
mov rcx, rbx
call fcn.14003c7d0
jmp 0x14003bb6e
inc edi
sub rsi, 1
jne 0x14003baf3
mov rsi, qword [rsp + 0x60]
test edi, edi
jne 0x14003bc0f
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x68]
test al, al
jne 0x14003bbee
mov rax, qword [rbx]
mov r9b, 1
xor r8d, r8d
mov edx, 0x8b
mov rcx, rbx
call qword [rax + 0x60]
mov rcx, qword [rbx + 0x18]
mov edx, 0xfffffff0
mov r8d, 0x40000000
mov byte [rbx + 0x34], 0
call qword [sym.imp.USER32.dll_SetWindowLongPtrW]
mov rcx, qword [rbx + 0x18]
xor r8d, r8d
lea edx, [r8 - 0x14]
call qword [sym.imp.USER32.dll_SetWindowLongPtrW]
mov rcx, qword [rbx + 0x38]
mov edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
mov ecx, reloc.COMCTL32.dll_InitCommonControls
call qword [sym.imp.GDI32.dll_GetStockObject]
mov qword [rbx + 0x48], rax
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call fcn.1401101e0
mov rcx, qword [rbx + 0x10]
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 5]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x14003e120
Capabilities:
Hide graphical window

Disassembly:
cmp r8d, 5
je fcn.14003e290
mov r8d, 1
jmp fcn.14003c7d0

Function at 0x14003e290
Capabilities:
Hide graphical window

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
push rsi
sub rsp, 0x50
xor eax, eax
mov rbp, rdx
mov rbx, rcx
mov qword [r11 - 0x38], rax
mov rcx, qword [rcx + 0x40]
mov edx, 0x1304
xor r9d, r9d
mov qword [r11 - 0x30], rax
xor r8d, r8d
mov qword [r11 - 0x28], rax
mov qword [r11 - 0x20], rax
mov qword [r11 - 0x18], rax
call qword [sym.imp.USER32.dll_SendMessageW]
mov rsi, rax
test eax, eax
jle 0x14003e325
mov rcx, qword [rbx + 0x40]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x130b
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbx + 0x40]
lea r9, [rsp + 0x20]
mov r8d, eax
mov edx, 0x133c
mov dword [rsp + 0x20], 8
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14003e425
mov rcx, qword [rcx]
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov rdx, rbp
mov qword [rsp + 0x60], rdi
mov rcx, rbx
call fcn.14003dc60
mov rcx, qword [rbx + 0x40]
lea r9, [rsp + 0x20]
movsxd rdi, eax
mov dword [rsp + 0x20], 8
mov qword [rsp + 0x40], rbp
cmp edi, 0xffffffff
jne 0x14003e365
movsxd r8, esi
mov edx, 0x133e
call qword [sym.imp.USER32.dll_SendMessageW]
mov edx, esi
jmp 0x14003e375
mov r8, rdi
mov edx, 0x133d
call qword [sym.imp.USER32.dll_SendMessageW]
mov edx, edi
mov rcx, rbx
call fcn.14003dd10
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x58]
mov rdi, qword [rsp + 0x60]
test al, al
jne 0x14003e41d
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x68]
test al, al
jne 0x14003e3fc
mov rax, qword [rbx]
mov r9b, 1
xor r8d, r8d
mov edx, 0x8b
mov rcx, rbx
call qword [rax + 0x60]
mov rcx, qword [rbx + 0x18]
mov edx, 0xfffffff0
mov r8d, 0x40000000
mov byte [rbx + 0x34], 0
call qword [sym.imp.USER32.dll_SetWindowLongPtrW]
mov rcx, qword [rbx + 0x18]
xor r8d, r8d
lea edx, [r8 - 0x14]
call qword [sym.imp.USER32.dll_SetWindowLongPtrW]
mov rcx, qword [rbx + 0x38]
mov edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
mov ecx, reloc.COMCTL32.dll_InitCommonControls
call qword [sym.imp.GDI32.dll_GetStockObject]
mov qword [rbx + 0x48], rax
xor r8d, r8d
mov dl, 1
mov rcx, rbx
call fcn.1401101e0
mov rcx, qword [rbx + 0x10]
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 5]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, rbx
call fcn.14003cbf0
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x50
pop rsi
ret
Function at 0x1400412b0
Capabilities:
Check for unmoving mouse cursor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov eax, r8d
mov rsi, r9
mov edi, r8d
mov rbp, rdx
mov rbx, rcx
sub eax, 0xa0
je 0x140041320
sub eax, 2
je 0x1400412f4
sub eax, 0x15e
je 0x140041320
sub eax, 1
je 0x140041303
cmp eax, 1
jne 0x140041376
call qword [sym.imp.USER32.dll_ReleaseCapture]
mov dword [rbx + 0x28], 0
jmp 0x140041376
mov rcx, qword [rcx + 0x18]
call qword [sym.imp.USER32.dll_SetCapture]
lea rcx, [rbx + 0x2c]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov dword [rbx + 0x28], 1
jmp 0x140041376
cmp dword [rcx + 0x28], 1
jne 0x140041376
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_GetCursorPos]
test byte [rbx + 0x34], 2
je 0x140041349
mov eax, dword [rbx + 0x30]
mov ecx, dword [rsp + 0x24]
cmp eax, ecx
je 0x140041349
sub eax, ecx
movsxd r8, eax
jmp 0x14004135a
mov rax, qword [rsp + 0x20]
mov ecx, dword [rbx + 0x2c]
cmp ecx, eax
je 0x140041372
sub ecx, eax
movsxd r8, ecx
mov r9, qword [rbx + 0x18]
mov edx, 0x500b
mov rcx, qword [rbx + 0x20]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rax, qword [rsp + 0x20]
mov qword [rbx + 0x2c], rax
mov r9, qword [rsp + 0x60]
mov r8, rsi
mov edx, edi
mov rcx, rbp
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
jmp qword [sym.imp.USER32.dll_DefWindowProcW]
Function at 0x140043190
Capabilities:
Get graphical window text

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1d0]
sub rsp, 0x2d0
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov qword [rsp + 0x328], rbx
mov rax, qword [0x14028e6b0]
xor rax, rsp
mov qword [rbp + 0x1c0], rax
mov rdi, r8
mov r12, rdx
mov r14, rcx
mov qword [rsp + 0x70], rcx
xor esi, esi
mov dword [rsp + 0x20], esi
mov r8d, 0x104
lea rdx, [rbp - 0x50]
mov rcx, r12
call qword [sym.imp.USER32.dll_GetWindowTextW]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x147
mov rcx, rdi
call qword [sym.imp.USER32.dll_SendMessageW]
mov rbx, rax
xor r9d, r9d
mov r8, rax
mov edx, 0x149
mov rcx, rdi
call qword [sym.imp.USER32.dll_SendMessageW]
lea rcx, [rax + 1]
mov eax, 2
mul rcx
mov r13, 0xffffffffffffffff
cmovo rax, r13
mov rcx, rax
call fcn.140167f6c
mov r15, rax
mov r9, rax
mov r8, rbx
mov edx, 0x148
mov rcx, rdi
call qword [sym.imp.USER32.dll_SendMessageW]
mov rbx, r15
cmp word [r15], 0x2e
je 0x14004326a
nop
add rbx, 2
cmp word [rbx], 0x2e
jne 0x140043260
add rbx, 2
mov rax, rbx
cmp word [rbx], 0x3b
je 0x140043287
cmp word [rax], 0x29
je 0x140043287
add rax, 2
cmp word [rax], 0x3b
jne 0x140043277
mov word [rax], si
cmp word [rbx], 0x2a
jne 0x140043293
mov word [rbx], si
cmp word [rbp - 0x50], si
je 0x140043383
lea rax, [rsp + 0x28]
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0x48]
mov qword [rbp - 0x80], rax
mov qword [rsp + 0x40], 7
mov qword [rsp + 0x38], rsi
mov word [rsp + 0x28], si
cmp word [rbx], si
jne 0x1400432cd
mov r8, rsi
jmp 0x1400432da
mov r8, r13
inc r8
cmp word [rbx + r8*2], si
jne 0x1400432d0
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.140006f10
nop
mov qword [rsp + 0x60], 7
mov qword [rsp + 0x58], rsi
mov word [rsp + 0x48], si
cmp word [rbp - 0x50], 0
jne 0x140043307
mov r8, rsi
jmp 0x14004331b
lea rax, [rbp - 0x50]
mov r8, r13
nop
inc r8
cmp word [rax + r8*2], 0
jne 0x140043310
lea rdx, [rbp - 0x50]
lea rcx, [rsp + 0x48]
call fcn.140006f10
nop
mov r9b, 1
lea r8, [rsp + 0x28]
lea rdx, [rsp + 0x48]
lea rcx, [rbp - 0x78]
call fcn.140043400
nop
lea rdx, [rbp - 0x78]
cmp qword [rbp - 0x60], 8
cmovae rdx, qword [rbp - 0x78]
mov rcx, r12
call qword [sym.imp.USER32.dll_SetWindowTextW]
nop
mov r8, qword [rbp - 0x60]
cmp r8, 8
jb 0x140043373
inc r8
mov rdx, qword [rbp - 0x78]
lea rcx, [rbp - 0x78]
call fcn.140007680
mov qword [rbp - 0x60], 7
mov qword [rbp - 0x68], rsi
mov word [rbp - 0x78], si
mov qword [r14 + 0x18], 7
mov qword [r14 + 0x10], rsi
mov word [r14], si
cmp word [rbx], 0
je 0x1400433aa
mov rsi, r13
nop dword [rax]
inc rsi
cmp word [rbx + rsi*2], 0
jne 0x1400433a0
mov r8, rsi
mov rdx, rbx
mov rcx, r14
call fcn.140006f10
mov dword [rsp + 0x20], 1
mov rcx, r15
call fcn.140167f64
mov rax, r14
mov rcx, qword [rbp + 0x1c0]
xor rcx, rsp
call fcn.140168660
mov rbx, qword [rsp + 0x328]
add rsp, 0x2d0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140043b80
Capabilities:
Get common file path
Set current directory

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x2c0
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov rax, qword [0x14028e6b0]
xor rax, rsp
mov qword [rsp + 0x2b0], rax
mov rbx, rcx
mov qword [rsp + 0x28], rcx
lea rdx, [r11 - 0x228]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
call fcn.14000cdd0
mov rsi, rax
lea rcx, [rax + 0x33188]
cmp qword [rcx + 0x18], 8
jb 0x140043be1
mov rcx, qword [rcx]
mov qword [rbx + 0x10d8], rcx
lea rax, [rbx + 0x1040]
cmp qword [rax + 0x18], 8
jb 0x140043bf9
mov rax, qword [rax]
mov qword [rbx + 0x10f0], rax
or dword [rbx + 0x10e8], 0x1000
cmp byte [rsi + 0x841], 0
jne 0x140043c2b
or dword [rbx + 0x10e8], 0x120
lea rax, [0x140043080]
mov qword [rbx + 0x1100], rax
xor edi, edi
mov qword [rsp + 0x20], rdi
lea rcx, [rbx + 0x1088]
call qword [sym.imp.COMDLG32.dll_GetOpenFileNameW]
test eax, eax
cmovne rdi, rbx
mov qword [rsp + 0x20], rdi
cmp dword [rsi + 0x3dc], 1
jne 0x140043c77
lea rdx, [rsp + 0xa0]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea rdx, [rsp + 0xa0]
mov rcx, rsi
call fcn.1400d8450
nop
lea rcx, [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x2b0]
xor rcx, rsp
call fcn.140168660
lea r11, [rsp + 0x2c0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x140043cb0
Capabilities:
Get common file path
Set current directory

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x2c0
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov rax, qword [0x14028e6b0]
xor rax, rsp
mov qword [rsp + 0x2b0], rax
mov rbx, rcx
mov qword [rsp + 0x28], rcx
lea rdx, [r11 - 0x228]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
call fcn.14000cdd0
mov rsi, rax
lea rcx, [rax + 0x33188]
cmp qword [rcx + 0x18], 8
jb 0x140043d11
mov rcx, qword [rcx]
mov qword [rbx + 0x10d8], rcx
lea rax, [rbx + 0x1040]
cmp qword [rax + 0x18], 8
jb 0x140043d29
mov rax, qword [rax]
mov qword [rbx + 0x10f0], rax
mov eax, dword [rbx + 0x1128]
cmp eax, 0xffffffff
je 0x140043d43
inc eax
mov dword [rbx + 0x10b4], eax
or dword [rbx + 0x10e8], 0x800006
cmp byte [rsi + 0x841], 0
jne 0x140043d6e
or dword [rbx + 0x10e8], 0x120
lea rax, [0x140043080]
mov qword [rbx + 0x1100], rax
xor edi, edi
mov qword [rsp + 0x20], rdi
lea rcx, [rbx + 0x1088]
call qword [sym.imp.COMDLG32.dll_GetSaveFileNameW]
test eax, eax
cmovne rdi, rbx
mov qword [rsp + 0x20], rdi
cmp dword [rsi + 0x3dc], 1
jne 0x140043dba
lea rdx, [rsp + 0xa0]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea rdx, [rsp + 0xa0]
mov rcx, rsi
call fcn.1400d8450
nop
lea rcx, [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x2b0]
xor rcx, rsp
call fcn.140168660
lea r11, [rsp + 0x2c0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140049470
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
xor r9d, r9d
add rcx, 0x118
xor r8d, r8d
mov edx, 0x85d
call fcn.14000f5d0
lea rax, [rbx + 0x98]
mov dword [rbx + 0x1b8], 0
cmp qword [rbx + 0xc8], rax
mov ecx, 0xb0
mov edx, 0x98
cmove edx, ecx
mov ecx, 0xe8
lea rax, [rdx + rbx]
mov edx, 0xd0
mov qword [rbx + 0xc8], rax
lea rax, [rbx + 0xd0]
cmp qword [rbx + 0x100], rax
cmove edx, ecx
xor r8d, r8d
lea rcx, [rbx + 0x118]
lea rax, [rdx + rbx]
xor edx, edx
mov qword [rbx + 0x100], rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1400f8ea0

Function at 0x14004a460
Capabilities:
Get graphical window text

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x240
mov rax, qword [0x14028e6b0]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rdi, rdx
mov r9b, 1
mov edx, dword [rcx + 0x38]
mov rsi, rcx
call fcn.14010ffe0
mov rcx, qword [rsi + 0x18]
lea rdx, [rsp + 0x20]
mov r8d, 0x104
call qword [sym.imp.USER32.dll_GetWindowTextW]
cmp word [rsp + 0x20], 0
jne 0x14004a4b0
xor r8d, r8d
jmp 0x14004a4cb
lea rax, [rsp + 0x20]
or r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x14004a4c0
lea rbx, [rsi + 0x68]
mov rcx, rbx
lea rdx, [rsp + 0x20]
call fcn.140006f10
mov rax, qword [rsi + 0x18]
mov qword [rdi], rax
cmp qword [rbx + 0x18], 8
jb 0x14004a4ed
mov rbx, qword [rbx]
mov qword [rdi + 8], rbx
mov dword [rdi + 0x14], 0
mov qword [rdi + 0x20], 0
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.140168660
add rsp, 0x240
pop rdi
pop rsi
pop rbx
ret

Function at 0x14004af80
Capabilities:
Get graphical window text

Disassembly:
push rbx
mov eax, 0x1040
call fcn.1401686c0
sub rsp, rax
mov rax, qword [0x14028e6b0]
xor rax, rsp
mov qword [rsp + 0x1030], rax
lea r9, [rsp + 0x30]
mov edx, InitCommonControls
mov r8d, 0x7ff
mov rbx, rcx
call qword [sym.imp.USER32.dll_SendMessageW]
xor r9d, r9d
lea r8, [rsp + 0x20]
mov edx, 0xb0
mov rcx, rbx
call qword [sym.imp.USER32.dll_SendMessageW]
movzx r8d, word [rsp + 0x20]
movzx eax, r8w
test r8w, r8w
je 0x14004b076
mov r9d, 0xffff
nop word [rax + rax]
movzx ecx, ax
dec ecx
movsxd rcx, ecx
movzx edx, word [rsp + rcx*2 + 0x30]
cmp dx, 0x20
je 0x14004b009
cmp dx, 9
jne 0x14004b011
add ax, r9w
jne 0x14004aff0
jmp 0x14004b03f
test ax, ax
je 0x14004b03f
nop word [rax + rax]
movzx ecx, ax
dec ecx
movsxd rcx, ecx
movzx edx, word [rsp + rcx*2 + 0x30]
cmp dx, 0x20
je 0x14004b03f
cmp dx, 9
je 0x14004b03f
add ax, r9w
jne 0x14004b020
cmp ax, r8w
jae 0x14004b076
movzx r9d, r8w
mov edx, 0xb1
movzx r8d, ax
mov rcx, rbx
call qword [sym.imp.USER32.dll_SendMessageW]
lea r9, [0x1401d3618]
mov edx, 0xc2
mov r8d, 1
mov rcx, rbx
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rsp + 0x1030]
xor rcx, rsp
call fcn.140168660
add rsp, 0x1040
pop rbx
ret