joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400b1580
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x80
mov qword [rax - 0x78], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov rdi, r9
movzx esi, r8w
mov r12d, edx
mov r15, rcx
xor ebp, ebp
mov r13d, ebp
mov dword [rsp + 0x20], ebp
call fcn.140004f70
mov rcx, rax
mov r9d, ebp
test rax, rax
setne r9b
test r9d, r9d
jne 0x1400b15df
mov ecx, 0x80004005
call fcn.140004f20
int3
mov rax, qword [rax]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x28], rbx
lea rdx, [0x1401246c4]
test rdx, 0xffffffffffff0000
jne 0x1400b1623
movzx r14d, dx
xor edx, edx
mov ecx, r14d
call fcn.14000b790
test rax, rax
je 0x1400b1635
mov r8d, r14d
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.14000bc20
jmp 0x1400b1630
xor r8d, r8d
lea rcx, [rsp + 0x28]
call fcn.14000be20
mov rbx, qword [rsp + 0x28]
test si, si
jne 0x1400b1642
call fcn.1400b1d60
movzx esi, ax
test rdi, rdi
jne 0x1400b1652
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rdi, rax
movzx ecx, r12w
shr cx, 4
inc cx
movzx r8d, cx
movzx r9d, si
mov edx, 6
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
test rax, rax
je 0x1400b17af
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rdi, rax
test rax, rax
je 0x1400b17af
movzx eax, r12w
and eax, 0x8000000f
jge 0x1400b16a6
dec eax
or eax, 0xfffffff0
inc eax
test eax, eax
jle 0x1400b16c0
mov edx, eax
nop dword [rax]
movzx eax, word [rdi]
lea rdi, [rdi + rax*2]
add rdi, 2
dec rdx
jne 0x1400b16b0
movzx ebx, word [rdi]
lea ecx, [rbx + 1]
mov eax, 2
mul rcx
mov rsi, 0xffffffffffffffff
cmovo rax, rsi
mov rcx, rax
call fcn.1400e4e54
mov r14, rax
mov r8d, ebx
lea rdx, [rdi + 2]
mov rcx, rax
call fcn.1400e7e58
mov word [r14 + rbx*2], bp
cmp dword [rsp + 0xd0], 0
je 0x1400b1765
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], rbp
mov word [rsp + 0x38], bp
cmp word [r14], 0
jne 0x1400b1721
mov r8, rbp
jmp 0x1400b172f
mov r8, rsi
inc r8
cmp word [r14 + r8*2], 0
jne 0x1400b1724
mov rdx, r14
lea rcx, [rsp + 0x38]
call fcn.140007720
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x58]
call fcn.1400e00c0
mov rdx, rax
mov r13d, 2
mov dword [rsp + 0x20], r13d
cmp qword [rax + 0x18], 8
jb 0x1400b1768
mov rdx, qword [rax]
jmp 0x1400b1768
mov rdx, r14
test rdx, rdx
je 0x1400b177c
mov rax, rsi
inc rax
cmp word [rdx + rax*2], 0
jne 0x1400b1770
mov ebp, eax
mov r8d, ebp
lea rcx, [rsp + 0x28]
call fcn.14000be20
nop
test r13b, 2
je 0x1400b17a2
cmp qword [rsp + 0x70], 8
jb 0x1400b17a2
mov rcx, qword [rsp + 0x58]
call fcn.1400e5d34
mov rcx, r14
call fcn.1400e83b8
mov rbx, qword [rsp + 0x28]
lea rcx, [rbx - 0x18]
call fcn.14000b840
add rax, 0x18
mov qword [r15], rax
lock add dword [rbx - 8], 0xffffffff
jg 0x1400b17d4
mov rcx, qword [rbx - 0x18]
mov rax, qword [rcx]
lea rdx, [rbx - 0x18]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, r15
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1400b5dc0
Capabilities:
Get file version info

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push r14
sub rsp, 0x30
mov r14, rdx
lea rdx, [rsp + 0x68]
mov rsi, r8
mov rcx, r14
xor ebx, ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov ebp, eax
test eax, eax
je 0x1400b5e7d
mov ecx, ebp
mov qword [rsp + 0x50], rdi
call fcn.1400ee934
mov rdi, rax
test rax, rax
je 0x1400b5e68
mov r9, rax
mov r8d, ebp
xor edx, edx
mov rcx, r14
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x1400b5e60
lea r9, [rsp + 0x20]
lea r8, [rsp + 0x28]
lea rdx, [0x140124f70]
mov rcx, rdi
mov qword [rsp + 0x28], rbx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x1400b5e60
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x1400b5e60
movzx eax, word [rcx + 0xa]
mov ebx, 1
mov dword [rsi], eax
movzx eax, word [rcx + 8]
mov dword [rsi + 4], eax
movzx eax, word [rcx + 0xe]
mov dword [rsi + 8], eax
movzx eax, word [rcx + 0xc]
mov dword [rsi + 0xc], eax
mov rcx, rdi
call fcn.1400ebab0
mov eax, ebx
mov rdi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
mov eax, ebx
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret

Function at 0x1400b5ef0
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
xor ebp, ebp
mov rcx, rdx
lea rdx, [rsp + 0x58]
mov rsi, r8
mov qword [rsp + 0x28], rbp
mov edi, ebp
mov dword [rsp + 0x58], ebp
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r8d, dword [rsp + 0x58]
test r8d, r8d
jne 0x1400b5f39
xor eax, eax
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
xor edx, edx
mov ecx, 0x410
mov qword [rsp + 0x40], rbx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x1400b5f97
lea r9, [rsp + 0x20]
lea rdx, [rsp + 0x28]
mov r8d, 8
mov rcx, rax
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x1400b5f8e
mov rdx, qword [rsp + 0x28]
mov r9d, 0x104
mov r8, rsi
mov rcx, rbx
call sub.PSAPI.DLL_GetModuleFileNameExW
mov edi, eax
test eax, eax
jne 0x1400b5f8e
mov word [rsi], bp
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov eax, edi
add rsp, 0x30
pop rdi
ret
Function at 0x1400b9d90
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
mov qword [rsp + 0x10], rbx
mov dword [rsp + 0x20], r9d
mov dword [rsp + 0x18], r8d
mov dword [rsp + 8], ecx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xa0
mov ebp, r9d
mov r15d, r8d
mov edi, edx
mov r14d, ecx
xor esi, esi
call qword [sym.imp.USER32.dll_GetDesktopWindow]
lea ecx, [rsi + 0x4d]
mov rbx, rax
mov qword [rsp + 0x60], rax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
lea ecx, [rsi + 0x4f]
mov dword [rsp + 0x7c], eax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
lea ecx, [rsi + 0x4c]
add eax, dword [rsp + 0x7c]
mov dword [rsp + 0x84], eax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
lea ecx, [rsi + 0x4e]
mov dword [rsp + 0x78], eax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
lea r8, [rsp + 0x78]
add eax, dword [rsp + 0x78]
lea rdx, [rsp + 0x88]
lea rcx, [rsp + 0x68]
mov dword [rsp + 0x80], eax
lea eax, [rdi + rbp]
mov dword [rsp + 0x8c], edi
mov dword [rsp + 0x94], eax
lea eax, [r14 + r15]
mov dword [rsp + 0x88], r14d
mov dword [rsp + 0x90], eax
call qword [sym.imp.USER32.dll_IntersectRect]
mov ebp, dword [rsp + 0x70]
mov r14d, dword [rsp + 0x74]
sub ebp, dword [rsp + 0x68]
mov rcx, rbx
sub r14d, dword [rsp + 0x6c]
call qword [sym.imp.USER32.dll_GetDC]
mov rcx, rax
mov r12, rax
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov r8d, r14d
mov edx, ebp
mov rcx, r12
mov r15, rax
call qword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov r13, rax
test rax, rax
je 0x1400b9f96
mov r9d, dword [rsp + 0x100]
cmp r9d, 1
jle 0x1400b9f1b
mov eax, dword [rsp + 0xf0]
cdq
sub eax, edx
sar eax, 1
mov ecx, eax
mov eax, dword [rsp + 0xf8]
add ecx, dword [rsp + 0xe0]
cdq
sub eax, edx
sar eax, 1
lea r8d, [rdi + rax]
mov eax, dword [rsp + 0x68]
sub eax, ecx
cdq
idiv r9d
lea edi, [rcx + rax]
mov eax, dword [rsp + 0x6c]
mov rcx, r15
sub eax, r8d
cdq
idiv r9d
mov rdx, r13
lea ebx, [r8 + rax]
call qword [sym.imp.GDI32.dll_SelectObject]
call fcn.1400b9ba0
mov r8d, eax
mov eax, r14d
cdq
mov dword [rsp + 0x50], r8d
idiv dword [rsp + 0x100]
mov ecx, eax
mov eax, ebp
cdq
mov dword [rsp + 0x48], ecx
idiv dword [rsp + 0x100]
mov dword [rsp + 0x40], eax
jmp 0x1400b9f41
mov edi, dword [rsp + 0x68]
mov ebx, dword [rsp + 0x6c]
mov rdx, rax
mov rcx, r15
call qword [sym.imp.GDI32.dll_SelectObject]
call fcn.1400b9ba0
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x48], r14d
mov dword [rsp + 0x40], ebp
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], edi
mov r9d, ebp
xor r8d, r8d
xor edx, edx
mov rcx, r15
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], r14d
call qword [sym.imp.GDI32.dll_StretchBlt]
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
call qword [sym.imp.USER32.dll_EmptyClipboard]
mov rdx, r13
mov ecx, 2
call qword [sym.imp.USER32.dll_SetClipboardData]
mov ecx, 1
test rax, rax
cmovne esi, ecx
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rbx, qword [rsp + 0x60]
mov rcx, r15
call qword [sym.imp.GDI32.dll_DeleteDC]
mov rdx, r12
mov rcx, rbx
call qword [sym.imp.USER32.dll_ReleaseDC]
mov rbx, qword [rsp + 0xe8]
mov eax, esi
add rsp, 0xa0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400c08c0
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp - 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rdi, rcx
cmp qword [rcx + 0x78], 0
je 0x1400c0abb
cmp byte [rcx + 0x82], 0
je 0x1400c0abb
mov rax, qword [rcx]
mov ebx, 0xffff
mov edx, ebx
call qword [rax + 0x18]
cmp bx, ax
jne 0x1400c0912
xor al, al
jmp 0x1400c0abd
mov edx, 0xf
mov qword [rbp - 0x10], rdx
mov byte [rbp - 0x28], 0
xor ecx, ecx
mov qword [rbp - 0x28], rcx
mov qword [rbp - 0x18], 8
lea rax, [rbp - 0x28]
cmp rdx, 0x10
cmovae rax, rcx
mov byte [rax + 8], cl
xor r14d, r14d
mov r9, qword [rbp - 0x10]
lea rdx, [rbp - 0x28]
cmp r9, 0x10
cmovae rdx, qword [rbp - 0x28]
lea r8, [rbp - 0x28]
cmovae r8, qword [rbp - 0x28]
mov rcx, qword [rdi + 0x78]
mov r10, qword [rcx]
mov r9, qword [rbp - 0x18]
add r9, rdx
lea rax, [rbp + 0x20]
mov qword [rsp + 0x20], rax
lea rdx, [rdi + 0x84]
call qword [r10 + 0x40]
test eax, eax
je 0x1400c0989
dec eax
jne 0x1400c0a7e
jmp 0x1400c0990
mov byte [rdi + 0x82], r14b
lea rax, [rbp - 0x28]
mov r10, qword [rbp - 0x28]
mov r9, qword [rbp - 0x10]
cmp r9, 0x10
cmovae rax, r10
mov rbx, qword [rbp + 0x20]
sub rbx, rax
je 0x1400c09da
lea rcx, [rbp - 0x28]
cmp r9, 0x10
cmovae rcx, r10
mov r9, qword [rdi + 0x90]
mov r8, rbx
mov edx, 1
call fcn.1400ec320
mov r9, qword [rbp - 0x10]
cmp rbx, rax
jne 0x1400c0a87
cmp byte [rdi + 0x82], r14b
je 0x1400c0aa5
test rbx, rbx
jne 0x1400c0943
or rax, 0xffffffffffffffff
mov r8, qword [rbp - 0x18]
sub rax, r8
cmp rax, 8
jbe 0x1400c0a98
lea rbx, [r8 + 8]
cmp rbx, 0xfffffffffffffffe
ja 0x1400c0a8b
cmp r9, rbx
jae 0x1400c0a26
mov rdx, rbx
lea rcx, [rbp - 0x28]
call fcn.14000c1b0
mov r9, qword [rbp - 0x10]
jmp 0x1400c0a44
test rbx, rbx
jne 0x1400c0a4d
mov qword [rbp - 0x18], r14
lea rax, [rbp - 0x28]
cmp r9, 0x10
cmovae rax, qword [rbp - 0x28]
mov byte [rax], r14b
jmp 0x1400c093f
test rbx, rbx
je 0x1400c0943
lea rcx, [rbp - 0x28]
cmp r9, 0x10
cmovae rcx, qword [rbp - 0x28]
mov rax, qword [rbp - 0x18]
xor edx, edx
mov qword [rax + rcx], rdx
mov qword [rbp - 0x18], rbx
lea rax, [rbp - 0x28]
cmp qword [rbp - 0x10], 0x10
cmovae rax, qword [rbp - 0x28]
mov byte [rbx + rax], dl
jmp 0x1400c093f
mov r9, qword [rbp - 0x10]
sub eax, 2
je 0x1400c0aa5
xor bl, bl
jmp 0x1400c0aa7
lea rcx, str.string_too_long
call fcn.1400e4de4
int3
lea rcx, str.string_too_long
call fcn.1400e4de4
int3
mov bl, 1
cmp r9, 0x10
jb 0x1400c0ab6
mov rcx, qword [rbp - 0x28]
call fcn.1400e5d34
movzx eax, bl
jmp 0x1400c0abd
mov al, 1
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x1400c2d20
Capabilities:
Get file version info

Disassembly:
push rbx
push rdi
sub rsp, 0x238
xor edi, edi
mov rbx, rcx
lea rax, [rcx + 8]
test rcx, rcx
jne 0x1400c2d3a
mov eax, edi
xor ecx, ecx
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rcx
mov qword [rax + 0x18], rcx
mov qword [rax + 0x20], rcx
mov qword [rax + 0x28], rcx
mov dword [rax + 0x30], ecx
mov rcx, qword [rbx + 0x40]
test rcx, rcx
je 0x1400c2d7b
lea rdx, [rsp + 0x20]
mov r8d, 0x104
mov dword [rbx + 0x68], 1
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x1400c2d87
xor eax, eax
add rsp, 0x238
pop rdi
pop rbx
ret
mov rcx, qword [rbx + 0x60]
mov qword [rsp + 0x230], rsi
test rcx, rcx
je 0x1400c2da1
call fcn.1400e5d34
mov qword [rbx + 0x60], rdi
lea rdx, [rsp + 0x258]
lea rcx, [rsp + 0x20]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test eax, eax
je 0x1400c2dfe
mov ecx, esi
call fcn.1400e4e54
lea rcx, [rsp + 0x20]
mov r8d, esi
mov r9, rax
xor edx, edx
mov qword [rbx + 0x60], rax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x1400c2dfe
mov rcx, qword [rbx + 0x60]
lea r9, [rsp + 0x250]
lea r8, [rsp + 0x260]
lea rdx, [0x140124f70]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
jne 0x1400c2e12
xor eax, eax
mov rsi, qword [rsp + 0x230]
add rsp, 0x238
pop rdi
pop rbx
ret
mov rax, qword [rsp + 0x260]
lea r9, [rsp + 0x250]
lea r8, [rsp + 0x260]
lea rdx, str.VarFileInfoTranslation
movups xmm0, xmmword [rax]
movups xmmword [rbx + 8], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx + 0x18], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rbx + 0x28], xmm0
mov eax, dword [rax + 0x30]
mov dword [rbx + 0x38], eax
mov rcx, qword [rbx + 0x60]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x1400c2e72
cmp dword [rsp + 0x250], 4
jb 0x1400c2e72
mov rcx, qword [rsp + 0x260]
mov edx, dword [rcx]
mov dword [rbx + 0x48], edx
cmp dword [rbx + 8], 0xfeef04bd
mov rsi, qword [rsp + 0x230]
sete dil
mov eax, edi
add rsp, 0x238
pop rdi
pop rbx
ret
Function at 0x1400c3710
Capabilities:
Enumerate process modules
Enumerate processes

Disassembly:
push rsi
mov eax, 0x2cc0
call fcn.1400e75f0
sub rsp, rax
mov rsi, rcx
call fcn.1400c3500
test rax, rax
je 0x1400c395c
lea rdx, [rsp + 0x2cd8]
mov rcx, rax
mov qword [rsp + 0x2ca8], rdi
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [rsp + 0x20], 0x238
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1400c3954
lea rdx, [rsp + 0x20]
mov rcx, rax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x1400c394b
nop dword [rax]
mov ecx, dword [rsp + 0x2cd8]
cmp dword [rsp + 0x28], ecx
je 0x1400c37a3
lea rdx, [rsp + 0x20]
mov rcx, rdi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x1400c3780
jmp 0x1400c394b
mov rcx, qword [rsi + 0x10]
mov edx, 0x40a
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x1400c394b
mov qword [rsp + 0x2cb8], rbx
or rbx, 0xffffffffffffffff
mov qword [rsp + 0x2cb0], rbp
mov qword [rsp + 0x2ca0], r14
lea rcx, [rsp + 0x4c]
mov rax, rbx
nop
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400c37e0
lea rdx, [rsp + 0x4c]
lea rcx, [rsi + 0x28c0]
mov r8d, eax
call fcn.14000be20
xor ecx, ecx
movzx eax, word [rsp + rcx + 0x4c]
lea rcx, [rcx + 2]
mov word [rsp + rcx + 0x25e], ax
test ax, ax
jne 0x1400c3800
mov r8d, dword [rsp + 0x2cd8]
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbp, rax
test rax, rax
je 0x1400c38a6
lea r9, [rsp + 0x2ce0]
lea rdx, [rsp + 0x2ce8]
mov r8d, 8
mov rcx, rax
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x1400c38a1
mov rdx, qword [rsp + 0x2ce8]
lea r8, [rsp + 0x260]
mov r9d, 0x104
mov rcx, rbp
call sub.PSAPI.DLL_GetModuleFileNameExW
lea rax, [rsp + 0x260]
nop dword [rax + rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1400c3880
lea rdx, [rsp + 0x260]
lea rcx, [rsi + 0x28c0]
mov r8d, ebx
call fcn.14000be20
mov rcx, rbp
jmp 0x1400c3921
lea rcx, [0x1402707e0]
call fcn.140084750
test eax, eax
je 0x1400c3927
mov eax, dword [rsp + 0x2cd8]
lea r9, str.SynGetModulePathNameEvent
xor r8d, r8d
mov dword [rsp + 0x478], eax
mov rax, qword [rsi + 0x10]
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x470], 0xe
mov qword [rsp + 0x480], rax
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rbx, rax
test rax, rax
je 0x1400c3927
lea rdx, [rsp + 0x470]
lea rcx, [0x1402707e0]
call fcn.140084a50
test rax, rax
je 0x1400c391e
mov edx, 0x2710
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rsi + 0x10]
mov rcx, rsi
call fcn.1400c3ac0
mov r14, qword [rsp + 0x2ca0]
mov rbp, qword [rsp + 0x2cb0]
mov rbx, qword [rsp + 0x2cb8]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, qword [rsp + 0x2ca8]
add rsp, 0x2cc0
pop rsi
ret
Function at 0x1400c39b0
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rdi
sub rsp, 0x2d0
mov rdi, rcx
mov rbp, rdx
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x98
call fcn.1400e5f00
xor ebx, ebx
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x50], rax
lea rax, [0x14013b388]
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x98
mov qword [rsp + 0x28], rbp
mov word [rsp + 0xc0], bx
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x58], 0x208
mov dword [rsp + 0x4c], 1
mov qword [rsp + 0x60], rbx
mov dword [rsp + 0x68], ebx
mov qword [rsp + 0x70], rbx
mov dword [rsp + 0x80], 0x1800
call qword [sym.imp.COMDLG32.dll_GetOpenFileNameW]
cmp eax, 1
jne 0x1400c3a9e
mov rdx, qword [rsp + 0x50]
mov qword [rsp + 0x2e0], rsi
test rdx, rdx
je 0x1400c3a6b
or rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rdx + rax*2], bx
jne 0x1400c3a60
mov ebx, eax
lea rcx, [rdi + 0x28c0]
mov r8d, ebx
call fcn.14000be20
mov rcx, qword [rdi + 0x28c0]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov rsi, qword [rsp + 0x2e0]
test eax, eax
je 0x1400c3a9e
mov rdx, rbp
mov rcx, rdi
call fcn.1400c3ac0
lea r11, [rsp + 0x2d0]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x1400c3b90
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x230
mov rdi, rdx
mov rsi, rcx
mov edx, 0x40a
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetDlgItem]
or rbx, 0xffffffffffffffff
test rax, rax
je 0x1400c3bf9
lea rdx, [rsp + 0x20]
mov r8d, 0x104
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowTextW]
lea rcx, [rsi + 0x28c0]
lea rdx, [rsp + 0x20]
mov rax, rbx
inc rax
cmp word [rdx + rax*2], 0
jne 0x1400c3be2
lea rdx, [rsp + 0x20]
mov r8d, eax
call fcn.14000be20
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x208
call fcn.1400e5f00
mov edx, 0x40c
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x1400c3c57
lea rdx, [rsp + 0x20]
mov r8d, 0x104
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowTextW]
lea rcx, [rsi + 0x28c8]
lea rax, [rsp + 0x20]
nop
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1400c3c40
lea rdx, [rsp + 0x20]
mov r8d, ebx
call fcn.14000be20
lea r11, [rsp + 0x230]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret

Function at 0x1400c3f00
Capabilities:
Hide graphical window

Disassembly:
push rbx
sub rsp, 0x20
xor edx, edx
mov rbx, rcx
mov dword [rcx + 0x28d0], 0
call fcn.1400c3590
call qword [sym.imp.USER32.dll_ReleaseCapture]
mov rcx, qword [rbx + 0x28e8]
mov edx, 5
add rsp, 0x20
pop rbx
jmp qword [sym.imp.USER32.dll_ShowWindow]
Function at 0x1400c66c0
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
lea rcx, [0x1402707e0]
mov rdi, r9
mov rsi, r8
mov rbx, rdx
call fcn.140084ab0
test eax, eax
je 0x1400c66fd
mov eax, 0x40
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.1400e1d50
Function at 0x1400c73b0
Capabilities:
Log keystrokes via polling

Disassembly:
push rsi
push rdi
push r12
sub rsp, 0x40
mov eax, dword [rcx + 0x58]
mov edi, r9d
movzx r12d, r8b
cdq
mov rsi, rcx
xor eax, edx
cmp eax, edx
jne 0x1400c73d8
xor eax, eax
add rsp, 0x40
pop r12
pop rdi
pop rsi
ret
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x70], r13
mov ecx, 0x11
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r15
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
xor r14d, r14d
mov ecx, 0x10
test ax, ax
sets r14b
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
xor r15d, r15d
test ax, ax
mov eax, dword [rsp + 0x80]
mov r9d, edi
sets r15b
mov edx, r14d
mov rcx, rsi
mov r8d, r15d
mov dword [rsp + 0x20], eax
call fcn.1400c75c0
mov r13d, 1
mov ebx, eax
mov eax, 0x5dc
cmp ebx, eax
cmovg ebx, eax
mov eax, 0xfffffa24
cmp ebx, eax
cmovl ebx, eax
test edi, edi
jne 0x1400c7468
mov eax, dword [rsi + 0x34]
test al, 2
jne 0x1400c7468
bt eax, 0x13
jb 0x1400c7468
xor ebp, ebp
jmp 0x1400c746b
mov ebp, r13d
test r14d, r14d
mov r14, qword [rsp + 0x38]
jne 0x1400c747a
test r15d, r15d
je 0x1400c74bd
test edi, edi
jne 0x1400c74bd
test dword [rsi + 0x34], 0x80000
jne 0x1400c74bd
xor ebp, ebp
mov eax, ebx
cdq
xor eax, edx
sub eax, edx
cmp eax, 0x78
jl 0x1400c74dc
mov eax, 0x88888889
imul ebx
add ebx, edx
sar ebx, 6
mov eax, ebx
shr eax, 0x1f
add ebx, eax
mov eax, ebx
cdq
xor eax, edx
sub eax, edx
cmp eax, 0x7f
jl 0x1400c7519
test ebx, ebx
jns 0x1400c750f
or eax, 0xffffffff
jmp 0x1400c7516
test ebp, ebp
je 0x1400c7489
test edi, edi
je 0x1400c74e3
xor edx, edx
mov rcx, rsi
call fcn.1400c9670
mov ecx, eax
mov eax, ebx
cdq
xor eax, edx
sub eax, edx
cmp eax, ecx
jge 0x1400c7519
xor eax, eax
jmp 0x1400c758e
mov eax, ebx
cdq
xor eax, edx
sub eax, edx
cmp eax, 0x168
jle 0x1400c7519
test ebx, ebx
jns 0x1400c7500
or eax, 0xffffffff
imul ebx, eax, 0x168
jmp 0x1400c7519
xor eax, eax
test ebx, ebx
setg al
imul ebx, eax, 0x168
jmp 0x1400c7519
xor eax, eax
test ebx, ebx
setg al
imul ebx, eax, 0x7f
mov eax, dword [rsi + 0x58]
neg ebx
cdq
mov edi, eax
mov rax, qword [0x140271ff8]
xor edi, edx
sub edi, edx
test rax, rax
je 0x1400c7582
mov rax, qword [rax]
test rax, rax
je 0x1400c7582
xor ecx, ecx
test r12b, r12b
cmove ecx, r13d
test ebp, ebp
je 0x1400c7549
or ecx, 2
mov r10, qword [rax + 0x58]
test r10, r10
jne 0x1400c7556
lea r10, [rax + 0x70]
mov rax, qword [r10]
mov dword [rsp + 0x28], ecx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r10
mov dword [rsp + 0x20], ebx
call qword [rax + 0xe0]
mov eax, dword [rsi + 0x58]
test eax, eax
jle 0x1400c757d
sub eax, edi
jmp 0x1400c757f
add eax, edi
mov dword [rsi + 0x58], eax
mov dword [rsi + 0x94], 0
mov eax, edi
mov r13, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov r15, qword [rsp + 0x30]
add rsp, 0x40
pop r12
pop rdi
pop rsi
ret
Function at 0x1400c9df0
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
mov eax, 0x2030
call fcn.1400e75f0
sub rsp, rax
mov r10d, dword [rsp + 0x2060]
mov rdi, r9
mov ebp, r8d
mov r14, rdx
mov rsi, rcx
sub r10d, 2
je 0x1400c9f2f
dec r10d
jne 0x1400c9f8b
cmp r8d, 0xc
jne 0x1400c9f8b
mov rcx, rdx
call qword [sym.imp.USER32.dll_GetDlgCtrlID]
mov rbx, qword [rsp + 0x2068]
mov r8d, eax
test rbx, rbx
je 0x1400c9f8b
test rdi, rdi
je 0x1400c9f8b
test eax, eax
je 0x1400c9f8b
mov ecx, dword [rdi]
xor esi, esi
mov r10d, esi
mov edx, esi
test ecx, ecx
je 0x1400c9e9f
mov eax, esi
cmp ecx, r8d
je 0x1400c9e97
mov ecx, dword [rdi + rax*4 + 8]
add rax, 2
add edx, 2
test ecx, ecx
jne 0x1400c9e81
jmp 0x1400c9e9f
movsxd rax, edx
mov r10d, dword [rdi + rax*4 + 4]
lea r8, [rsp + 0x30]
mov r9d, 0x1000
mov edx, r10d
mov rcx, rbx
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x1400c9f14
lea r9, [0x1400c9fb0]
mov r8, r14
mov edx, 0xaa
mov rcx, rbx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.USER32.dll_CreateDialogParamW]
mov qword [0x140272bd0], rax
call fcn.1400b1180
test eax, eax
je 0x1400c9ef3
mov rcx, qword [0x140272bd0]
call fcn.1400b1490
mov r9, qword [rsp + 0x2070]
mov rcx, qword [0x140272bd0]
lea r8, [rsp + 0x30]
mov edx, 0x401
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x1400c9f8b
mov rcx, qword [0x140272bd0]
test rcx, rcx
je 0x1400c9f8b
call qword [sym.imp.USER32.dll_DestroyWindow]
mov qword [0x140272bd0], rsi
jmp 0x1400c9f8b
add rcx, 0x418
or rbx, 0xffffffffffffffff
mov rax, rbx
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400c9f40
test rax, rax
je 0x1400c9f55
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rsi + 0x620]
nop dword [rax]
inc rbx
cmp word [rcx + rbx*2], 0
jne 0x1400c9f60
test rbx, rbx
je 0x1400c9f75
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rdx, str.Mouse.hlp
mov r9, rdi
mov r8d, ebp
mov rcx, r14
call qword [sym.imp.USER32.dll_WinHelpW]
lea r11, [rsp + 0x2030]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret