joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18003a030
Capabilities:
Enumerate files on windows

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x2c0
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov rax, qword [0x1801aef28]
xor rax, rsp
mov qword [rsp + 0x2b0], rax
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x58], rcx
mov rax, qword [rdx]
cmp dword [rax - 8], 0
jne 0x18003a077
call fcn.18007d270
jmp 0x18003a28e
lea rcx, [rsp + 0x40]
call fcn.180080be0
nop
lea rdx, [0x18014c618]
lea rcx, [rsp + 0x40]
call fcn.18007d580
cmp dword [0x1801df0a0], 0
je 0x18003a0d3
mov rax, qword [rbx]
mov qword [rsp + 0x30], rax
mov rax, qword [rdi]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, str.EnumeFile___s___s___s_
lea r8, str.imhookapi
or edx, 0xffffffff
lea rcx, [0x1801de7b8]
call fcn.18008da50
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
mov eax, dword [0x1801df0a0]
test eax, eax
je 0x18003a118
mov qword [rsp + 0x20], rbx
lea r9, str.EnumeFile_1___d_
lea r8, str.imhookapi
or edx, 0xffffffff
lea rcx, [0x1801de7b8]
call fcn.18008da50
mov eax, dword [0x1801df0a0]
cmp rbx, 0xffffffffffffffff
jne 0x18003a140
or rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
lea rcx, [rsp + 0x40]
call fcn.18007d270
nop
mov rcx, rdi
call fcn.18007d270
jmp 0x18003a28e
mov ecx, dword [rsp + 0x60]
test cl, 0x10
jne 0x18003a1b9
test eax, eax
je 0x18003a17b
mov dword [rsp + 0x28], ecx
lea rax, [rsp + 0x8c]
mov qword [rsp + 0x20], rax
lea r9, str.EnumeFile_2___s____08x_
lea r8, str.imhookapi
or edx, 0xffffffff
lea rcx, [0x1801de7b8]
call fcn.18008da50
mov rdx, rdi
lea rcx, [rsp + 0x48]
call fcn.180080be0
nop
lea rdx, [rsp + 0x8c]
lea rcx, [rsp + 0x48]
call fcn.18007d580
lea r8, [rsp + 0x8c]
mov edx, dword [rsi + 8]
mov rcx, rsi
call fcn.180081840
nop
lea rcx, [rsp + 0x48]
call fcn.18007d270
lea rdx, [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x18003a271
nop
cmp dword [0x1801df0a0], 0
je 0x18003a20b
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x8c]
mov qword [rsp + 0x20], rax
lea r9, str.EnumeFile_3___s____08x_
lea r8, str.imhookapi
or edx, 0xffffffff
lea rcx, [0x1801de7b8]
call fcn.18008da50
cmp word [rsp + 0x8c], 0x2e
je 0x18003a25b
test byte [rsp + 0x60], 0x10
jne 0x18003a25b
mov rdx, rdi
lea rcx, [rsp + 0x48]
call fcn.180080be0
nop
lea rdx, [rsp + 0x8c]
lea rcx, [rsp + 0x48]
call fcn.18007d580
lea r8, [rsp + 0x8c]
mov edx, dword [rsi + 8]
mov rcx, rsi
call fcn.180081840
nop
lea rcx, [rsp + 0x48]
call fcn.18007d270
lea rdx, [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x18003a1d0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
lea rcx, [rsp + 0x40]
call fcn.18007d270
nop
mov rcx, rdi
call fcn.18007d270
mov rcx, qword [rsp + 0x2b0]
xor rcx, rsp
call fcn.1800a1220
add rsp, 0x2c0
pop rdi
pop rsi
pop rbx
ret
Function at 0x18003c490
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push rbx
sub rsp, 0x50
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov rcx, qword [0x1801c9578]
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x18003c5d3
mov ecx, reloc.WS2_32.dll_listen
call qword [sym.imp.USER32.dll_GetClipboardData]
mov rbx, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.180080ca0
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
call qword [sym.imp.USER32.dll_CloseClipboard]
cmp dword [0x1801df0a0], 0
je 0x18003c529
mov qword [rsp + 0x30], rbx
mov rax, qword [0x1801c9578]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, str.clipboard___s____x____x_
lea r8, str.imhookapi
or edx, 0xffffffff
lea rcx, [0x1801de7b8]
call fcn.18008da50
mov eax, dword [0x1801c958c]
cmp eax, 0x80
jne 0x18003c55a
xor edx, edx
lea rcx, [rsp + 0x60]
call fcn.18007d610
mov rcx, rax
call fcn.18003c020
xor edx, edx
lea rcx, [0x1801ceb10]
call fcn.18003f4d0
jmp 0x18003c5c9
cmp eax, 0x8000000
jne 0x18003c59a
xor edx, edx
lea rcx, [rsp + 0x60]
call fcn.18007d610
mov r9, rax
mov r8, qword [0x1801c9578]
mov edx, dword [0x1801c1158]
mov rcx, qword [0x1801c9590]
call qword [sym.imp.USER32.dll_SendMessageW]
xor edx, edx
lea rcx, [0x1801ceb10]
call fcn.18003f4d0
jmp 0x18003c5c9
cmp eax, 4
jne 0x18003c5c9
xor edx, edx
lea rcx, [rsp + 0x60]
call fcn.18007d610
mov r9, rax
mov r8, qword [0x1801c9578]
mov edx, dword [0x1801c1158]
mov rcx, qword [0x1801c9590]
call qword [sym.imp.USER32.dll_SendMessageW]
nop
lea rcx, [rsp + 0x60]
call fcn.18007d270
add rsp, 0x50
pop rbx
ret
Function at 0x180045880
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
sub rsp, 0x40
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rcx, qword [rbx + 0x20]
mov edx, 0x1f4
mov esi, eax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x180045ae6
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], rdi
xor ebp, ebp
nop dword [rax + rax]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rdi, rax
cmp qword [0x1801cf5c0], rax
je 0x1800458fd
lea rdx, [rsp + 0x50]
mov rcx, rax
mov dword [rsp + 0x50], ebp
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [rsp + 0x50], eax
jne 0x1800458fd
inc dword [rbx + 0x94]
mov qword [0x1801cf5c0], rdi
cmp dword [0x1801df0a0], ebp
je 0x18004593a
mov eax, dword [rbx + 0x94]
lea r9, str.CTIMThread::Run____x____x____d_
lea r8, [0x180150840]
mov dword [rsp + 0x30], eax
mov eax, dword [rbx + 0x90]
lea rcx, [0x1801de7b8]
or edx, 0xffffffff
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], eax
call fcn.18008da50
call qword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [rbx + 0xac], 3
mov esi, eax
je 0x18004596a
cmp dword [rbx + 0x94], ebp
je 0x180045ac2
mov eax, dword [rbx + 0x90]
add eax, 0x3e8
cmp esi, eax
jb 0x180045ac2
mov dword [rbx + 0x90], esi
cmp dword [0x1801df0a0], ebp
je 0x1800459a1
mov rax, qword [0x1801cf5c0]
lea r9, str.CTIMThread::Run_forewindow___x_
lea r8, [0x180150840]
lea rcx, [0x1801de7b8]
or edx, 0xffffffff
mov qword [rsp + 0x20], rax
call fcn.18008da50
mov r9, qword [0x1801cf5c0]
test r9, r9
je 0x180045ac2
cmp dword [0x1801c958c], 0x22
jne 0x180045ac2
cmp dword [rbx + 0xa8], ebp
jne 0x180045ac2
mov eax, dword [rbx + 0xb0]
add eax, 0xbb8
cmp esi, eax
jbe 0x180045a7f
cmp dword [0x1801cf5b8], 3
jb 0x180045a1e
mov dword [rbx + 0x94], ebp
mov dword [0x1801cf5b8], ebp
cmp dword [0x1801df0a0], ebp
je 0x180045a1e
lea r9, str.CTIMThread::Run_Again__
lea r8, [0x180150840]
lea rcx, [0x1801de7b8]
or edx, 0xffffffff
call fcn.18008da50
mov r9, qword [0x1801cf5c0]
mov r8d, dword [rbx + 0xac]
mov edx, dword [0x1801c1094]
mov rcx, qword [0x1801c9590]
call qword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [0x1801cf5b8]
mov dword [rbx + 0xac], 2
inc eax
mov dword [rbx + 0x9c], ebp
mov dword [0x1801cf5b8], eax
cmp dword [0x1801df0a0], ebp
je 0x180045aae
lea r9, str.CTIMThread::Run_1___d_
lea r8, [0x180150840]
lea rcx, [0x1801de7b8]
or edx, 0xffffffff
mov dword [rsp + 0x20], eax
call fcn.18008da50
cmp dword [0x1801df0a0], ebp
je 0x180045aae
mov eax, dword [rbx + 0x9c]
lea r9, str.CTIMThread::Run_2___d_
lea r8, [0x180150840]
lea rcx, [0x1801de7b8]
or edx, 0xffffffff
mov dword [rsp + 0x20], eax
call fcn.18008da50
cmp dword [rbx + 0x9c], ebp
je 0x180045ac2
mov dword [0x1801cf5b8], ebp
mov dword [rbx + 0x94], ebp
mov rcx, qword [rbx + 0x20]
mov edx, 0x1f4
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x1800458c0
mov rdi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
xor eax, eax
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rsi
ret
Function at 0x18004d7e0
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x290
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x1801aef28]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov rsi, rcx
xor ebx, ebx
mov word [rsp + 0x70], bx
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x72]
call fcn.1800a1250
mov r8d, 0x104
lea rdx, [rsp + 0x70]
lea rcx, str.APPDATA
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edi, eax
cmp dword [0x1801df0a0], ebx
je 0x18004d873
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
lea r9, str.CDealWhatsApp::EnumLogFile_1___s_
lea r8, str.whatsapp
or edx, 0xffffffff
lea rcx, [0x1801de7b8]
call fcn.18008da50
lea eax, [rdi - 1]
cmp eax, 0x102
ja 0x18004d978
mov r8d, 0x103
sub r8, rdi
lea rdx, str.WhatsAppLocal_Storageleveldb
lea rcx, [rsp + 0x70]
call fcn.1800a315c
lea rcx, [rsp + 0x30]
call fcn.18007ec60
nop
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x70]
call fcn.18009a450
cmp dword [rsp + 0x38], 0
jle 0x18004d969
mov rdi, rbx
mov rax, qword [rsp + 0x30]
mov rdx, qword [rdi + rax]
movsxd rcx, dword [rdx - 8]
lea rcx, [rdx + rcx*2 - 8]
lea rdx, str..log
call fcn.1800a1a10
test eax, eax
je 0x18004d8f3
inc ebx
add rdi, 8
cmp ebx, dword [rsp + 0x38]
jl 0x18004d8c3
jmp 0x18004d969
movsxd rbx, ebx
mov rax, qword [rsp + 0x30]
lea rcx, [rsi + 0x44]
mov r8d, 0x103
mov rdx, qword [rax + rbx*8]
call fcn.1800a11c4
cmp dword [0x1801df0a0], 0
je 0x18004d942
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + rbx*8]
mov qword [rsp + 0x20], rax
lea r9, str.CDealWhatsApp::EnumLogFile_2___s_
lea r8, str.whatsapp
or edx, 0xffffffff
lea rcx, [0x1801de7b8]
call fcn.18008da50
lea rdx, [rsi + 8]
mov r8d, 1
lea rcx, [rsp + 0x50]
call fcn.180087860
nop
mov dword [rsi + 4], 1
lea rcx, [rsp + 0x50]
call fcn.1800878e0
nop
lea rcx, [rsp + 0x30]
call fcn.180081610
mov eax, dword [rsi + 4]
jmp 0x18004d97b
mov eax, dword [rsi + 4]
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.1800a1220
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x18005a0e0
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x30
cmp dword [rcx + 8], 0
mov rbx, rcx
jne 0x18005a141
xor r9d, r9d
mov dword [rcx + 8], 1
mov qword [rsp + 0x40], rdi
lea rdi, [rcx + 0xc]
lea r8d, [r9 + 8]
xor ecx, ecx
mov rdx, rdi
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
cmp dword [0x1801df0a0], 0
je 0x18005a13c
lea r9, str.CDealZalo::Init__RecentPath:__s_
lea r8, str.zalo
lea rcx, [0x1801de7b8]
or edx, 0xffffffff
mov qword [rsp + 0x20], rdi
call fcn.18008da50
mov rdi, qword [rsp + 0x40]
mov rcx, rbx
add rsp, 0x30
pop rbx
jmp method.CDeal263em.virtual_40

Function at 0x18005b730
Capabilities:
Get graphical window text

Disassembly:
push rdi
sub rsp, 0x240
mov rax, qword [0x1801aef28]
xor rax, rsp
mov qword [rsp + 0x230], rax
xor edi, edi
cmp dword [0x1801c958c], 0x21
mov rax, rcx
jne 0x18005b7fd
test rcx, rcx
jne 0x18005b770
call fcn.180014ef0
test rax, rax
je 0x18005b7fd
mov rcx, rax
mov qword [rsp + 0x258], rbx
call fcn.18006e2a0
lea rcx, [rsp + 0x22]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x20], di
mov rbx, rax
call fcn.1800a1250
lea rdx, [rsp + 0x20]
mov r8d, 0x103
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowTextW]
lea rdx, [0x180157650]
lea rcx, [rsp + 0x20]
call fcn.1800a07ec
mov rbx, qword [rsp + 0x258]
test rax, rax
jne 0x18005b7f8
lea rdx, str.WeCom_
lea rcx, [rsp + 0x20]
call fcn.1800a07ec
test rax, rax
jne 0x18005b7f8
lea rdx, str.WeCom_WeDrive
lea rcx, [rsp + 0x20]
call fcn.1800a07ec
test rax, rax
je 0x18005b7fd
mov edi, 1
mov eax, edi
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1800a1220
add rsp, 0x240
pop rdi
ret
Function at 0x180060280
Capabilities:
Copy file

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x280
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x1801aef28]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rsi, rdx
mov rbx, rcx
test rcx, rcx
je 0x1800603dd
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
cmp rcx, 1
je 0x1800603dd
cmp dword [0x1801df0a0], eax
je 0x180060300
mov qword [rsp + 0x20], rbx
lea r9, str.CBaseImageCtrl::BackupFile____s_
lea r8, str.ImageCtrl
or edx, 0xffffffff
lea rcx, [0x1801de7b8]
call fcn.18008da50
test rsi, rsi
jne 0x18006030c
xor eax, eax
jmp 0x1800603df
lea rdx, str.file:___
mov rcx, rbx
call fcn.1800a07ec
mov rdi, rax
test rax, rax
je 0x180060329
add rdi, 0x10
jmp 0x18006032c
mov rdi, rbx
lea rcx, [rsp + 0x48]
call fcn.18006cfb0
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x38]
call fcn.1800dd5f0
nop
xor eax, eax
mov word [rsp + 0x60], ax
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x62]
call fcn.1800a1250
call fcn.180010300
mov r9, rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea r8, str._s_s.dbk
mov edx, 0x103
lea rcx, [rsp + 0x60]
call fcn.1800a2084
lea rcx, [rsp + 0x30]
call fcn.180068670
nop
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CopyFileW]
mov edi, eax
test eax, eax
je 0x1800603c4
lea rax, [rsp + 0x48]
mov ecx, dword [rax]
mov dword [rsi], ecx
mov ecx, dword [rax + 4]
mov dword [rsi + 4], ecx
mov ecx, dword [rax + 8]
mov dword [rsi + 8], ecx
mov ecx, dword [rax + 0xc]
mov dword [rsi + 0xc], ecx
lea rcx, [rsp + 0x30]
call fcn.1800686a0
nop
lea rcx, [rsp + 0x38]
call fcn.18007d270
mov eax, edi
jmp 0x1800603df
xor eax, eax
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.1800a1220
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1800607c0
Capabilities:
Get file size

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x1d0
mov rax, qword [0x1801aef28]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
mov rdi, qword [rsp + 0x230]
mov esi, dword [0x1801d1f38]
mov r12d, dword [0x1801d1f3c]
xor r14d, r14d
mov r13d, r9d
mov rax, rdx
mov rbp, rcx
mov ebx, 1
test r8, r8
je 0x180060814
mov ebx, dword [r8]
jmp 0x180060836
cmp rax, 0xffffffffffffffff
je 0x180060836
test rdx, rdx
je 0x180060836
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
test eax, eax
je 0x180060833
cmp eax, 0xffffffff
jne 0x180060836
mov ebx, r14d
xor eax, eax
mov dword [rsp + 0x68], r14d
mov dword [rsp + 0x6c], eax
mov dword [rsp + 0x70], eax
mov dword [rsp + 0x74], eax
test r12d, r12d
je 0x180060861
test ebx, ebx
je 0x180060869
lea rdx, [rsp + 0x68]
mov rcx, rbp
call fcn.180060280
jmp 0x180060869
test esi, esi
je 0x180060989
lea rcx, [rsp + 0x122]
xor edx, edx
mov r8d, 0x9e
mov word [rsp + 0x120], r14w
call fcn.1800a1250
lea rcx, [rsp + 0x82]
xor edx, edx
mov r8d, 0x9e
mov word [rsp + 0x80], r14w
call fcn.1800a1250
mov dword [rsp + 0x60], r14d
cmp dword [0x1801df0a0], r14d
je 0x1800608e2
mov eax, r14d
test rdi, rdi
lea r9, str.CBaseImageCtrl::RecordPhoto___08x___d_
setne al
lea r8, str.ImageCtrl
lea rcx, [0x1801de7b8]
mov dword [rsp + 0x28], eax
or edx, 0xffffffff
mov qword [rsp + 0x20], rdi
call fcn.18008da50
call fcn.18000c8d0
mov dword [rsp + 0x38], r14d
lea r9, [rsp + 0x80]
mov rcx, rax
lea rax, [rsp + 0x60]
lea rdx, [rsp + 0x120]
mov qword [rsp + 0x30], rax
mov r8d, 0x50
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0x50
call fcn.18000cb40
lea r11, [rsp + 0x80]
lea r8, [rsp + 0x68]
mov r9d, r13d
xor edx, edx
mov rcx, rdi
mov qword [rsp + 0x20], r11
call fcn.180060020
call fcn.18000c8d0
mov dword [rsp + 0x58], r14d
mov dword [rsp + 0x50], 1
mov dword [rsp + 0x48], r12d
mov rcx, rax
lea rax, [rsp + 0x68]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], 2
mov qword [rsp + 0x30], r14
mov rdx, rdi
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
call fcn.18000d8a0
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.1800a1220
add rsp, 0x1d0
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180062780
Capabilities:
Get file size

Disassembly:
push rbp
push r12
push r15
sub rsp, 0x80
mov rax, qword [0x1801aef28]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov r15, qword [rsp + 0xc0]
mov r12d, r9d
mov qword [rsp + 0x38], r8
mov rbp, rdx
test rdx, rdx
je 0x180062958
test ecx, ecx
je 0x180062958
cmp dword [0x1801df0a0], 0
mov qword [rsp + 0xa0], rbx
mov ebx, dword [0x1801d1f38]
je 0x1800627fd
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rdx
lea r9, str.CBaseImageCtrl::ImageCtrl_1___s____d_
lea r8, str.ImageCtrl
lea rcx, [0x1801de7b8]
or edx, 0xffffffff
call fcn.18008da50
mov rcx, rbp
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x70], rdi
call fcn.1800624d0
test eax, eax
je 0x180062931
call fcn.180060580
test eax, eax
jne 0x180062931
mov esi, 1
xor edi, edi
mov qword [rsp + 0x68], r13
mov qword [rsp + 0x60], r14
mov dword [rsp + 0x30], esi
cmp r15, 0xffffffffffffffff
je 0x18006285e
test r15, r15
je 0x18006285e
xor edx, edx
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetFileSize]
test eax, eax
je 0x180062858
cmp eax, 0xffffffff
jne 0x18006285e
mov esi, edi
mov dword [rsp + 0x30], edi
call fcn.180065140
mov r13d, dword [0x1801d2230]
mov r14d, dword [0x1801d2234]
cmp dword [0x1801df0a0], edi
je 0x1800628a0
lea r9, str.CBaseImageCtrl::ImageCtrl_2__SnapShotLog:_d__SnapShotBackup:_d_
lea r8, str.ImageCtrl
lea rcx, [0x1801de7b8]
or edx, 0xffffffff
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r13d
call fcn.18008da50
test r13d, r13d
mov r13, qword [rsp + 0x68]
je 0x1800628f5
xor eax, eax
mov dword [rsp + 0x40], edi
mov dword [rsp + 0x44], eax
mov dword [rsp + 0x48], eax
mov dword [rsp + 0x4c], eax
test r14d, r14d
je 0x1800628d2
test esi, esi
je 0x1800628d2
lea rdx, [rsp + 0x40]
mov rcx, rbp
call fcn.180060280
mov rsi, qword [rsp + 0x38]
lea r8, [rsp + 0x40]
lea rdx, str.Screenshot.png
xor r9d, r9d
mov rcx, rsi
mov qword [rsp + 0x20], rdi
call fcn.180060020
jmp 0x1800628fa
mov rsi, qword [rsp + 0x38]
mov r14, qword [rsp + 0x60]
test r12d, r12d
jne 0x180062917
mov rdx, rsi
mov rcx, rbp
call fcn.180061610
test eax, eax
je 0x180062917
mov ebx, edi
jmp 0x180062942
lea r8, [rsp + 0x30]
mov r9d, r12d
mov rdx, r15
mov rcx, rbp
mov qword [rsp + 0x20], rsi
call fcn.1800607c0
jmp 0x180062942
test r12d, r12d
jne 0x180062942
call fcn.1800605f0
xor edi, edi
test eax, eax
cmovne ebx, edi
mov rdi, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
mov eax, ebx
mov rbx, qword [rsp + 0xa0]
jmp 0x18006295a
xor eax, eax
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1800a1220
add rsp, 0x80
pop r15
pop r12
pop rbp
ret
Function at 0x180066fb0
Capabilities:
Check if file exists
Get file attributes
Write file on windows

Disassembly:
push r14
push r15
sub rsp, 0x78
mov r14, rdx
mov r15, rcx
test rcx, rcx
je 0x1800671f1
test rdx, rdx
je 0x1800671f1
call fcn.180001950
test eax, eax
je 0x1800671f1
mov qword [rsp + 0x98], rbx
mov qword [rsp + 0x70], rbp
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x60], rdi
xor ebx, ebx
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x50], r13
mov dword [rsp + 0x40], 0x7d000
mov dword [rsp + 0x44], 0x4e2000
mov dword [rsp + 0x48], 0x9c4000
cmp dword [0x1801df0a0], ebx
je 0x180067047
lea r9, str.SaveBmp2Bng_1__x__s
lea r8, str.IMHookAPI
lea rcx, [0x1801de7b8]
or edx, 0xffffffff
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r15
call fcn.18008da50
xor edi, edi
lea r13, [rsp + 0x40]
nop
mov ebp, dword [r13]
mov dword [rsp + 0x90], 0
mov rcx, rbp
call fcn.1800a1b44
mov rsi, rax
test rax, rax
je 0x18006718c
mov r8, rbp
xor edx, edx
mov rcx, rax
call fcn.1800a1250
lea r9, [rsp + 0x90]
mov r8d, ebp
mov rdx, rsi
mov rcx, r15
call fcn.1800019c0
test eax, eax
je 0x180067180
cmp dword [0x1801df0a0], 0
je 0x1800670d3
mov eax, dword [rsp + 0x90]
lea r9, str.SaveBmp2Bng_2__d__d
lea r8, str.IMHookAPI
mov dword [rsp + 0x28], eax
lea rcx, [0x1801de7b8]
or edx, 0xffffffff
mov dword [rsp + 0x20], edi
call fcn.18008da50
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x18006717b
xor ebp, ebp
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x30], rbp
mov edx, 0xc0000000
mov rcx, r14
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x18006717b
test rax, rax
je 0x18006717b
mov r8d, dword [rsp + 0x90]
lea r9, [rsp + 0xa0]
mov rdx, rsi
mov rcx, rax
mov dword [rsp + 0xa0], ebp
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x1801df0a0], ebp
je 0x18006717b
mov eax, dword [rsp + 0xa0]
lea r9, str.SaveBmp2Bng_3__d
lea r8, str.IMHookAPI
lea rcx, [0x1801de7b8]
or edx, 0xffffffff
mov dword [rsp + 0x20], eax
call fcn.18008da50
mov ebx, 1
mov rcx, rsi
call fcn.1800a133c
test ebx, ebx
jne 0x18006719b
inc edi
add r13, 4
cmp edi, 3
jb 0x180067050
cmp dword [0x1801df0a0], 0
mov r13, qword [rsp + 0x50]
mov r12, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
je 0x1800671de
lea r9, str.SaveBmp2Bng_4__d
lea r8, str.IMHookAPI
lea rcx, [0x1801de7b8]
or edx, 0xffffffff
mov dword [rsp + 0x20], ebx
call fcn.18008da50
mov eax, ebx
mov rbx, qword [rsp + 0x98]
add rsp, 0x78
pop r15
pop r14
ret
xor eax, eax
add rsp, 0x78
pop r15
pop r14
ret
Function at 0x180067380
Capabilities:
Read file on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0xa0
xor r13d, r13d
xor eax, eax
mov rdi, rdx
lea r9, [r11 + 0x18]
lea rdx, [rsp + 0x30]
lea r8d, [r13 + 0xe]
mov rsi, rcx
mov qword [r11 + 0x20], r13
mov dword [r11 + 0x18], r13d
mov word [rsp + 0x30], r13w
mov qword [rsp + 0x32], rax
mov dword [rsp + 0x3a], eax
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x180067574
cmp dword [rsp + 0xe0], 0xe
jne 0x180067574
mov eax, 0x4d42
cmp word [rsp + 0x30], ax
jne 0x180067574
xor eax, eax
lea r9, [rsp + 0xe0]
lea r8d, [r13 + 0x28]
lea rdx, [rsp + 0x40]
mov rcx, rsi
mov dword [rsp + 0xe0], r13d
mov dword [rsp + 0x40], r13d
mov dword [rsp + 0x44], eax
mov dword [rsp + 0x48], eax
mov dword [rsp + 0x4c], eax
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x54], eax
mov dword [rsp + 0x58], eax
mov dword [rsp + 0x5c], eax
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x64], eax
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x180067574
cmp dword [rsp + 0xe0], 0x28
jne 0x180067574
cmp dword [rsp + 0x40], 0x28
jne 0x180067574
lea rcx, [rsp + 0x40]
lea rdx, [rsp + 0x70]
mov rax, qword [rcx]
mov qword [rdx], rax
mov rax, qword [rcx + 8]
mov qword [rdx + 8], rax
mov rax, qword [rcx + 0x10]
mov qword [rdx + 0x10], rax
mov rax, qword [rcx + 0x18]
mov qword [rdx + 0x18], rax
mov rax, qword [rcx + 0x20]
lea rcx, [rsp + 0x70]
mov qword [rdx + 0x20], rax
call fcn.180065bc0
mov ecx, eax
mov ebp, eax
call fcn.1800a1b44
mov rbx, rax
mov qword [rsp + 0xe8], rax
test rax, rax
je 0x180067574
mov r8, rbp
xor edx, edx
mov rcx, rax
call fcn.1800a1250
mov r8d, dword [rsp + 0x40]
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.1800a1360
mov rcx, rbx
mov dword [rsp + 0xe0], r13d
call fcn.180065a40
mov rcx, rbx
mov r8d, eax
call fcn.180065c60
lea r9, [rsp + 0xe0]
mov rcx, rsi
mov rdx, rax
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x180067574
mov edx, dword [rsp + 0x3a]
test edx, edx
je 0x180067574
xor r9d, r9d
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov rcx, rbx
mov dword [rsp + 0xe0], r13d
call fcn.180065b00
mov rcx, rbx
mov r11d, eax
call fcn.180065ca0
lea r9, [rsp + 0xe0]
mov r8d, r11d
mov rcx, rsi
mov rdx, rax
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x180067574
mov rax, rbx
test rdi, rdi
je 0x180067589
mov dword [rdi], ebp
jmp 0x180067589
lea rcx, [rsp + 0xe8]
call fcn.180065920
mov rax, qword [rsp + 0xe8]
mov rbx, qword [rsp + 0xd0]
add rsp, 0xa0
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret