joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14024f488
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x30
and qword [rsp + 0x20], 0
and dword [rsp + 0x28], 0
mov rbx, rcx
test dl, dl
je 0x14024f4aa
lea rcx, [rsp + 0x20]
call fcn.14023dd4c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne bl
cmp dword [rsp + 0x28], 0
je 0x14024f4ca
mov rcx, qword [rsp + 0x20]
call fcn.14023dbec
mov al, bl
add rsp, 0x30
pop rbx
ret

Function at 0x140251388
Capabilities:
Create process on windows

Disassembly:
push rbx
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rbx, rcx
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x58], rax
mov r8, qword [rbx]
lea rdx, str._select___s_
lea rcx, [rsp + 0x58]
call fcn.14000d9c8
mov dword [rsp + 0x28], 0xa
and qword [rsp + 0x20], 0
mov rbx, qword [rsp + 0x58]
mov r9, rbx
lea r8, str.Explorer
lea rdx, str.Open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140251410
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
add rsp, 0x40
pop rbx
ret
Function at 0x140256338
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov rbx, rcx
xor edi, edi
mov dword [rsp + 0x48], edi
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbx], rax
lea r8d, [rdi + 1]
mov dword [rsp + 0x48], r8d
sub r8d, dword [rax - 8]
mov eax, dword [rax - 0xc]
mov edx, 0x106
sub eax, edx
or eax, r8d
jge 0x140256395
mov rcx, rbx
call fcn.14000c998
mov edx, 0x104
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov rcx, qword [rbx]
test rcx, rcx
jne 0x1402563af
mov eax, edi
jmp 0x1402563bc
movsxd rdx, dword [rcx - 0xc]
call fcn.1400beaac
test eax, eax
js 0x1402563d6
mov rcx, qword [rbx]
cmp eax, dword [rcx - 0xc]
jg 0x1402563d6
mov dword [rcx - 0x10], eax
movsxd rcx, eax
mov rax, qword [rbx]
mov word [rax + rcx*2], di
mov rax, rbx
jmp 0x1402563e1
mov ecx, 0x80070057
call fcn.14000cbb8
nop
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x1402567d8
Capabilities:
Create process on windows

Disassembly:
push rbx
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rbx, rcx
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x58], rax
mov r8, qword [rbx]
lea rdx, str._select___s_
lea rcx, [rsp + 0x58]
call fcn.14000d9c8
mov dword [rsp + 0x28], 0xa
and qword [rsp + 0x20], 0
mov rbx, qword [rsp + 0x58]
mov r9, rbx
lea r8, str.Explorer
lea rdx, str.Open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140256860
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
add rsp, 0x40
pop rbx
ret
Function at 0x140257828
Capabilities:
Get graphical window text

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rsi
push rdi
push r13
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x20], rbp
mov rbp, rdx
mov rsi, rcx
xor r13d, r13d
mov dword [rax + 0x18], r13d
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsi], rax
lea edi, [r13 + 1]
mov dword [rsp + 0x70], edi
mov r9d, edi
mov r8d, 0x3e8
mov rdx, rsi
lea rcx, [rsp + 0x28]
call fcn.14000bd14
mov rbx, qword [rax + 8]
mov edx, 0x4a5
mov rcx, rbp
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
mov r8d, 0x3e8
mov rdx, rbx
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov eax, dword [rsp + 0x38]
mov rbx, qword [rsp + 0x28]
cmp eax, 0xffffffff
jne 0x1402578d3
mov rcx, qword [rbx]
test rcx, rcx
jne 0x1402578ca
mov eax, r13d
jmp 0x1402578d7
movsxd rdx, dword [rcx - 0xc]
call fcn.1400beaac
test eax, eax
js 0x14025793d
mov rcx, qword [rbx]
cmp eax, dword [rcx - 0xc]
jg 0x14025793d
mov dword [rcx - 0x10], eax
movsxd rcx, eax
mov rax, qword [rbx]
mov word [rax + rcx*2], r13w
mov rcx, qword [rsi]
call fcn.1400bead8
cmp rax, rdi
jl 0x140257909
mov rdi, rax
mov ecx, 0x3e7
cmp rax, rcx
cmovg rdi, rcx
mov r8, rdi
lea rdx, [0x140357ae8]
mov rcx, rsi
call fcn.14000d9c8
mov rbx, qword [rsi]
mov edx, 0x4a5
mov rcx, rbp
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov rax, rsi
jmp 0x140257948
mov ecx, 0x80070057
call fcn.14000cbb8
nop
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r13
pop rdi
pop rsi
ret

Function at 0x140268fc8
Capabilities:
Log keystrokes via polling

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x50
mov rbp, r9
mov rsi, r8
mov r12d, edx
mov rdi, rcx
cmp r8, 9
jne 0x140269097
lea ecx, [r8 + 8]
call qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
je 0x140269097
mov rcx, qword [rdi + 8]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x130b
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rdi + 8]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1304
lea ebx, [rax + 1]
call qword [sym.imp.USER32.dll_SendMessageW]
xor ecx, ecx
mov edx, 0x130c
dec eax
cmp ebx, eax
cmovg ebx, ecx
mov rcx, qword [rdi + 8]
xor r9d, r9d
movsxd r8, ebx
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rdi + 8]
call qword [sym.imp.USER32.dll_GetDlgCtrlID]
mov rcx, qword [rdi + 8]
mov dword [rsp + 0x40], 0xfffffdd9
movsxd rbx, eax
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rbx
call qword [sym.imp.USER32.dll_GetParent]
lea r9, [rsp + 0x30]
lea edx, [rsi + 0x45]
mov r8, rbx
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
mov rdx, qword [rdi + 8]
mov rcx, qword [rdi + 0x40]
mov r9, rsi
mov r8d, r12d
mov qword [rsp + 0x20], rbp
call qword [sym.imp.USER32.dll_CallWindowProcW]
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r12
ret
Function at 0x140269930
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x90
mov rdi, rdx
xor edx, edx
mov rbx, rcx
lea r8d, [rdx + 0x70]
lea rcx, [rsp + 0x20]
call fcn.1400c7360
xor ecx, ecx
lea rax, str.runas
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x48], rcx
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], reloc.OLEAUT32.dll_VarBstrFromCy
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rdi
mov dword [rsp + 0x50], 1
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov rbx, qword [rsp + 0xa0]
add rsp, 0x90
pop rdi
ret

Function at 0x14026f60c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
lea rbp, [rax - 0x798]
sub rsp, 0x880
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rax, qword [0x14045cbf0]
xor rax, rsp
mov qword [rbp + 0x770], rax
mov edi, edx
mov rbx, rcx
mov qword [rsp + 0x48], rcx
and dword [rsp + 0x40], 0
mov r8d, 0x104
lea rdx, [rbp + 0x160]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea r11, [rbp + 0x570]
mov qword [rsp + 0x20], r11
lea r9, [rbp + 0x370]
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x58]
lea rcx, [rbp + 0x160]
call fcn.1400bf224
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbx], rax
mov dword [rsp + 0x40], 1
lea r12, [0x140357e60]
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], edi
lea rax, str.langlang_
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x60]
lea r8, [rsp + 0x58]
lea rdx, str._s_s_s_d_s
mov rcx, rbx
call fcn.14000d9c8
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14026f73d
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], edi
lea rax, str.lang_
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x60]
lea r8, [rsp + 0x58]
lea rdx, str._s_s_s_d_s
mov rcx, rbx
call fcn.14000d9c8
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14026f73d
xor r8d, r8d
lea rdx, [0x140330de8]
mov rcx, rbx
call fcn.14000c9f8
mov rax, rbx
mov rcx, qword [rbp + 0x770]
xor rcx, rsp
call fcn.1400be110
mov rbx, qword [rsp + 0x8b0]
add rsp, 0x880
pop r12
pop rdi
pop rbp
ret

Function at 0x140270ffc
Capabilities:
Enumerate gui resources

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [rcx + 0x10]
mov rbx, rdx
call qword [sym.imp.USER32.dll_KillTimer]
dec rbx
je 0x140271032
dec rbx
jne 0x14027103a
lea edx, [rbx + 5]
lea rcx, [0x1402ba51c]
call qword [sym.imp.USER32.dll_EnumWindows]
jmp 0x14027103a
mov rcx, rdi
call fcn.14026f76c
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140274a4c
Capabilities:
Enumerate gui resources

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rax, qword [0x14048abe8]
lea rdx, [rsp + 0x30]
mov rcx, qword [rax + 0x20]
mov rcx, qword [rcx + 8]
mov rax, qword [rcx]
call qword [rax + 0x300]
mov rcx, qword [rax]
call fcn.1400beacc
mov rdx, qword [rsp + 0x30]
cmp eax, 1
sete sil
add rdx, 0xffffffffffffffe8
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, ebx
test eax, eax
jg 0x140274aa9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [0x14048abe8]
lea rdx, [rsp + 0x38]
mov rcx, qword [rax + 0x20]
mov rcx, qword [rcx + 8]
mov rax, qword [rcx]
call qword [rax + 0x310]
mov rcx, qword [rax]
call fcn.1400beacc
mov rdx, qword [rsp + 0x38]
cmp eax, 1
mov eax, ebx
sete dil
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], eax
add eax, ebx
test eax, eax
jg 0x140274af4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
call fcn.1400045d4
call fcn.1402cb878
mov bl, al
test sil, sil
jne 0x140274b0a
test dil, dil
je 0x140274b35
test bl, bl
jne 0x140274b2b
call fcn.1402bbb4c
lea r8, str._MONITOR
lea rdx, str.CCleaner_Monitoring
mov ecx, 1
call fcn.1402e52dc
test sil, sil
jne 0x140274b5c
test dil, dil
jne 0x140274b5c
test bl, bl
je 0x140274b4b
lea rcx, [0x1402ba51c]
mov edx, 3
call qword [sym.imp.USER32.dll_EnumWindows]
lea rdx, str.CCleaner_Monitoring
xor r8d, r8d
xor ecx, ecx
call fcn.1402e52dc
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x14027cb88
Capabilities:
Check for unmoving mouse cursor

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x20
mov sil, dl
mov rbx, rcx
mov edi, 1
test dl, dl
je 0x14027cbfe
and dword [rax + 8], 0
and dword [rax + 0xc], 0
mov byte [rcx + 0x1e0], 0
lea rcx, [rax + 8]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov edx, dword [rsp + 0x34]
mov ecx, dword [rsp + 0x30]
call qword [sym.imp.USER32.dll_SetCursorPos]
and dword [rsp + 0x30], 0
and dword [rsp + 0x34], 0
lea rcx, [rsp + 0x30]
mov byte [rbx + 0x148], 0
call qword [sym.imp.USER32.dll_GetCursorPos]
mov edx, dword [rsp + 0x34]
mov ecx, dword [rsp + 0x30]
call qword [sym.imp.USER32.dll_SetCursorPos]
jmp 0x14027cc0c
mov byte [rcx + 0x1e0], dil
mov byte [rcx + 0x148], dil
test sil, sil
je 0x14027cc31
mov rcx, qword [rbx + 0x1a0]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x190
call qword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
jle 0x14027cc31
mov ebp, edi
jmp 0x14027cc33
xor ebp, ebp
mov rcx, qword [rbx + 0x10]
mov edx, 0x413
call qword [sym.imp.USER32.dll_GetDlgItem]
mov edx, ebp
mov rcx, rax
call qword [sym.imp.USER32.dll_EnableWindow]
test sil, sil
je 0x14027cc6e
mov rcx, qword [rbx + 0x108]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x190
call qword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
jg 0x14027cc70
xor edi, edi
mov rcx, qword [rbx + 0x10]
mov edx, 0x412
call qword [sym.imp.USER32.dll_GetDlgItem]
mov edx, edi
mov rcx, rax
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.USER32.dll_EnableWindow]
Function at 0x14027e9e8
Capabilities:
Check for unmoving mouse cursor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
add rcx, 0x520
call fcn.140003c14
lea rcx, [rdi + 0x70]
lea rdx, [rdi + 0x520]
call fcn.140037ae0
lea rcx, [rdi + 0x540]
call fcn.140003c14
lea rcx, [rdi + 0x108]
lea rdx, [rdi + 0x540]
call fcn.140037ae0
lea rcx, [rdi - 0x90]
mov dl, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.14027cb88

Function at 0x14027ea58
Capabilities:
Check for unmoving mouse cursor

Disassembly:
push rbx
sub rsp, 0x30
lea rbx, [rcx - 0x90]
lea r9, [rcx + 0x540]
lea r8, [rcx + 0x108]
lea rdx, [rcx + 0x428]
mov rcx, rbx
mov byte [rsp + 0x20], 1
call fcn.14027e5e8
mov dl, 1
mov rcx, rbx
add rsp, 0x30
pop rbx
jmp fcn.14027cb88
Function at 0x140284318
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rdx
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x20], rsi
mov rbx, rdx
mov rsi, rcx
xor edi, edi
mov dword [rax + 0x18], edi
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbx], rax
mov dword [rsp + 0x50], 1
lea ecx, [rdi + 0xd]
call qword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x1402843c4
mov rcx, qword [rsi + 8]
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x1402843c4
lea ecx, [rdi + 0xd]
call qword [sym.imp.USER32.dll_GetClipboardData]
mov rsi, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rdx, rax
test rax, rax
je 0x1402843aa
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea edi, [rcx - 1]
mov r8d, edi
mov rcx, rbx
call fcn.14000c9f8
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x14028d9a0
Capabilities:
Log keystrokes via polling

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x30
mov rbp, r9
mov rsi, r8
mov r12d, edx
mov rdi, rcx
cmp r8, 0x41
jne 0x14028da35
lea ecx, [r8 - 0x30]
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x14028da35
mov rcx, qword [rdi + 8]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x18b
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rdi + 8]
xor r8d, r8d
movsxd r9, eax
mov edx, 0x183
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rdi + 8]
call qword [sym.imp.USER32.dll_GetDlgCtrlID]
mov rcx, qword [rdi + 8]
mov ebx, eax
call qword [sym.imp.USER32.dll_GetParent]
mov r9, qword [rdi + 8]
movzx r8d, bx
mov edx, VarUI4FromDisp
mov rcx, rax
bts r8, 0x10
call qword [sym.imp.USER32.dll_PostMessageW]
mov rcx, qword [rdi + 8]
xor edx, edx
mov byte [rdi + 0x5c], 0
lea r8d, [rdx + 1]
call qword [sym.imp.USER32.dll_InvalidateRect]
mov rdx, qword [rdi + 8]
mov rcx, qword [rdi + 0x40]
mov r9, rsi
mov r8d, r12d
mov qword [rsp + 0x20], rbp
call qword [sym.imp.USER32.dll_CallWindowProcW]
mov rcx, qword [rdi + 8]
mov r9d, 0x105
xor r8d, r8d
xor edx, edx
mov byte [rdi + 0x5c], 1
mov rbx, rax
call qword [sym.imp.USER32.dll_RedrawWindow]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop r12
ret

Function at 0x14028f600
Capabilities:
Check if file exists
Delete file

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rax, qword [0x14048abe8]
mov rdx, qword [rax + 0x48]
lea rcx, [rsp + 0x40]
call fcn.14000cb18
nop
lea rdx, str.business.dat
lea rcx, [rsp + 0x40]
call fcn.14000f884
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x14028f64f
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14028f66f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
add rsp, 0x38
ret

Function at 0x14028f680
Capabilities:
Check if file exists
Delete file

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rax, qword [0x14048abe8]
mov rdx, qword [rax + 0x48]
lea rcx, [rsp + 0x40]
call fcn.14000cb18
nop
lea rdx, str.autotrial.dat
lea rcx, [rsp + 0x40]
call fcn.14000f884
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x14028f6cf
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14028f6ef
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
add rsp, 0x38
ret
Function at 0x14028fa90
Capabilities:
Check if file exists
Delete file
Enumerate gui resources

Disassembly:
push rbp
push rbx
mov rbp, rsp
sub rsp, 0x48
mov qword [rbp - 0x18], 0xfffffffffffffffe
lea rcx, [rbp + 0x30]
call fcn.14028f700
nop
mov rdx, qword [rax]
lea rcx, [rbp + 0x20]
call fcn.14000cb18
nop
mov rdx, qword [rbp + 0x30]
add rdx, 0xffffffffffffffe8
or rbx, 0xffffffffffffffff
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, ebx
test eax, eax
jg 0x14028fadb
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [rbp + 0x20]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x14028fbb2
and qword [0x14048a8b0], 0
mov edx, 1
lea rcx, [0x1402ba51c]
call qword [sym.imp.USER32.dll_EnumWindows]
and qword [0x14048a8b0], 0
mov edx, 3
lea rcx, [0x1402ba51c]
call qword [sym.imp.USER32.dll_EnumWindows]
xor r8d, r8d
lea rdx, str.CCleaner_Monitoring
xor ecx, ecx
call fcn.1402e52dc
mov rcx, qword [rbp + 0x20]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov r11, qword [0x14048abe8]
mov rdx, qword [r11 + 0x48]
lea rcx, [rbp + 0x18]
call fcn.14000cb18
nop
lea rdx, str.business.dat
lea rcx, [rbp + 0x18]
call fcn.14000f884
mov qword [rbp + 0x28], rbx
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, 0x40000000
mov rdx, qword [rbp + 0x18]
lea rcx, [rbp + 0x28]
call fcn.140021fb8
mov rcx, qword [rbp + 0x28]
cmp rcx, rbx
je 0x14028fb93
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rbp + 0x18]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, ebx
test eax, eax
jg 0x14028fbb2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp + 0x20]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, ebx
test eax, eax
jg 0x14028fbd0
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
add rsp, 0x48
pop rbx
pop rbp
ret
Function at 0x14028fbe0
Capabilities:
Check if file exists

Disassembly:
push rbx
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
lea rcx, [rsp + 0x48]
call fcn.14028f700
nop
mov rdx, qword [rax]
lea rcx, [rsp + 0x40]
call fcn.14000cb18
nop
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14028fc28
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x14028fc7d
lea rcx, [rsp + 0x50]
call fcn.14028f560
nop
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.14000c244
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14028fc70
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
setne bl
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x14028fca1
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov al, bl
add rsp, 0x30
pop rbx
ret
Function at 0x1402902b0
Capabilities:
Check if file exists

Disassembly:
push rsi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x58], rbx
xor bl, bl
call fcn.1402a64a8
mov esi, 1
cmp eax, esi
je 0x1402902dd
cmp eax, 2
jne 0x1402903a3
lea rcx, [rsp + 0x48]
call fcn.1402a60e8
nop
mov rdx, qword [rax]
lea rcx, [rsp + 0x40]
call fcn.14000cb18
nop
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140290316
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.business.dat
lea rcx, [rsp + 0x40]
call fcn.14000f884
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x140290382
lea rcx, [rsp + 0x50]
call fcn.14028f700
nop
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.14000c244
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14029036f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
movzx ebx, bl
test eax, eax
cmove ebx, esi
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x1402903a3
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov al, bl
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rsi
ret