joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140063390
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x38
lea r8, str.Script_lines_most_recently_executed__oldest_first_.__Press__F5__to_refresh.__The_seconds_elapsed_between_a_line_and_the_one_after_it_is_in_parentheses_to_the_right__if_not_0_.__The_bottommost_lines_elapsed_time_is_the_number_of_seconds_since_it_executed._r_n_r_n
mov edx, 0xfffe
call fcn.1400d6690
mov r9, qword [rsp + 0x80]
lea r10, [0x140000000]
mov r8d, dword [0x140133b70]
mov ebp, 0x190
movsxd rdx, eax
mov r11d, 2
mov dword [rsp + 0x88], 0xffffffff
mov eax, r8d
lea rcx, [r9 + rdx*2]
mov qword [rsp + 0x98], rcx
nop dword [rax + rax]
xor r12b, r12b
mov r13, rcx
test ebp, ebp
jle 0x1400635d1
mov edx, ebp
mov esi, r11d
mov qword [rsp + 0x90], rdx
movsxd rcx, eax
nop
cmp eax, 0x190
lea rdi, [rcx - 0x190]
lea r14d, [rax - 0x190]
cmovl rdi, rcx
cmovl r14d, eax
cmp qword [r10 + rdi*8 + 0x1341c0], 0
je 0x1400635a6
movzx r15d, r12b
lea eax, [rsi - 1]
xor r12b, r12b
cmp eax, ebp
jge 0x1400634d2
test r15b, r15b
jne 0x1400635a6
mov edx, dword [r10 + rdi*4 + 0x133b80]
lea eax, [r14 + 1]
xor ebx, ebx
lea rcx, [rdi + 1]
cmp eax, 0x190
cmovl rbx, rcx
mov ebx, dword [r10 + rbx*4 + 0x133b80]
sub ebx, edx
cmp ebx, 0x7fffffff
jbe 0x1400634f1
mov r12b, 1
cmp esi, ebp
jne 0x1400634ae
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
lea r10, [0x140000000]
sub ebx, dword [r10 + rdi*4 + 0x133b80]
jmp 0x1400634e9
lea rax, [rdi + 2]
mov rbx, 0xfffffffffffffe72
cmp rax, 0x190
cmovl rbx, r11
add rbx, rdi
mov ebx, dword [r10 + rbx*4 + 0x133b80]
sub ebx, edx
jmp 0x1400634f1
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
lea r10, [0x140000000]
sub ebx, dword [r10 + rdi*4 + 0x133b80]
mov r9, qword [rsp + 0x80]
mov rax, qword [r10 + rdi*8 + 0x1341c0]
movzx ecx, word [rax + 2]
cmp dword [rsp + 0x88], ecx
je 0x140063546
mov edx, 0xfffe
mov dword [rsp + 0x88], ecx
mov rax, r13
lea r8, str.______s_r_n
sub rax, r9
mov r9, qword [0x140133b50]
sar rax, 1
sub edx, eax
mov r9, qword [r9 + rcx*8]
mov rcx, r13
call fcn.1400d6690
movsxd rcx, eax
lea r10, [0x140000000]
lea r13, [r13 + rcx*2]
mov rcx, qword [r10 + rdi*8 + 0x1341c0]
mov r8d, 0xc8
mov r9d, 0xfffe
mov byte [rsp + 0x28], r15b
mov rax, r13
mov dword [rsp + 0x20], ebx
sub rax, qword [rsp + 0x80]
mov rdx, r13
sar rax, 1
sub r9d, eax
cmp r9d, r8d
cmovl r8d, r9d
mov r9b, 1
call fcn.140063630
mov rdx, qword [rsp + 0x90]
lea r10, [0x140000000]
mov r9, qword [rsp + 0x80]
mov r13, rax
mov r11d, 2
inc esi
lea eax, [r14 + 1]
sub rdx, 1
lea rcx, [rdi + 1]
mov qword [rsp + 0x90], rdx
jne 0x140063420
mov r8d, dword [0x140133b70]
mov rcx, qword [rsp + 0x98]
mov rax, r13
mov edx, 0xfffe
sub rax, r9
sar rax, 1
sub edx, eax
cmp edx, 0x18
jg 0x1400635fd
cmp ebp, 0x78
jl 0x1400635fd
sub ebp, 0x64
mov eax, r8d
sub eax, ebp
add eax, 0x190
jmp 0x140063400
lea r8, str._r_nPress__F5__to_refresh.
mov rcx, r13
call fcn.1400d6690
movsxd rcx, eax
lea rax, [rcx*2]
add rax, r13
add rsp, 0x38
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140065500
Capabilities:
Print debug messages

Disassembly:
test edx, edx
je 0x14006565a
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
mov eax, 0x4030
call fcn.1400f7000
sub rsp, rax
mov qword [rsp + 0x4050], rbx
mov rbp, r9
mov rbx, qword [rsp + 0x4070]
mov r14, r8
mov qword [rsp + 0x4058], r15
mov esi, edx
mov rdi, rcx
test rbx, rbx
jne 0x140065561
mov rbx, qword [rcx + 0x6d0]
test rbx, rbx
jne 0x140065561
mov ecx, dword [rcx + 0x288]
movzx eax, word [rdi + 0x28c]
jmp 0x140065569
movzx ecx, word [rbx + 2]
movzx eax, word [rbx + 4]
mov r9, qword [0x140133b50]
lea r8, str._s___d__:___Warning:__s_n
movsxd rcx, ecx
mov r15d, 0x2000
movzx eax, ax
mov edx, r15d
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], eax
mov r9, qword [r9 + rcx*8]
lea rcx, [rsp + 0x30]
call fcn.1400d6690
cmp word [rbp], 0
je 0x1400655c4
sub r15d, eax
lea rcx, [rsp + 0x30]
cdqe
lea r8, str._____Specifically:__s_n
mov r9, rbp
mov edx, r15d
lea rcx, [rcx + rax*2]
call fcn.1400d6690
mov r15, qword [rsp + 0x4058]
lea rdx, [rsp + 0x30]
cmp esi, 3
jne 0x1400655ea
lea r9, [0x140113554]
xor r8d, r8d
mov rcx, rdi
call fcn.140064090
jmp 0x14006563f
lea rcx, [0x1401319a0]
call fcn.14000df80
test al, al
jne 0x140065605
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp esi, 2
jne 0x14006563f
test rbx, rbx
jne 0x14006562b
mov rbx, qword [rdi + 0x6d0]
test rbx, rbx
jne 0x14006562b
mov r8, rbp
mov rdx, r14
mov rcx, rdi
call fcn.140064aa0
jmp 0x14006563f
mov r9, rbp
mov r8d, 1
mov rdx, r14
mov rcx, rbx
call fcn.140064610
mov rbx, qword [rsp + 0x4050]
mov rbp, qword [rsp + 0x4060]
add rsp, 0x4030
pop r14
pop rdi
pop rsi
ret
Function at 0x14006ce60
Capabilities:
Log keystrokes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rax, qword [rsp + 0x68]
mov r10, r9
mov r9, qword [rsp + 0x60]
mov r11, r8
mov rsi, rdx
mov qword [rsp + 0x20], rax
mov r8, r10
mov rdx, r11
mov rbx, rcx
call fcn.14007d8c0
mov rdi, rax
test rax, rax
je 0x14006cf96
mov rdx, rsi
mov rcx, rax
call fcn.1400decb0
mov rsi, rax
test rax, rax
je 0x14006cf96
mov qword [rsp + 0x40], rbp
xor edx, edx
mov rcx, rdi
xor bpl, bpl
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ebx, eax
test eax, eax
je 0x14006ceff
cmp eax, dword [0x140136030]
je 0x14006ceff
mov rcx, rdi
call fcn.1400df220
test al, al
jne 0x14006ceff
mov ecx, dword [0x140136030]
mov r8d, 1
mov edx, ebx
call qword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
setne bpl
mov rcx, rsi
call qword [sym.imp.USER32.dll_SetFocus]
test rax, rax
je 0x14006cf66
mov rcx, qword [0x140132a80]
lea rdx, [0x1400f98c8]
xor r9d, r9d
mov byte [rsp + 0x20], 1
mov r8, 0xffffffffffffffff
call fcn.1400dc860
mov rax, qword [0x14012f240]
cmp dword [rax + 0x78], 0xffffffff
jle 0x14006cf66
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x140136030], eax
mov rcx, qword [0x14012f240]
mov ecx, dword [rcx + 0x78]
je 0x14006cf5c
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14006cf66
mov edx, 1
call fcn.140001b00
test bpl, bpl
mov rbp, qword [rsp + 0x40]
je 0x14006cf81
mov ecx, dword [0x140136030]
xor r8d, r8d
mov edx, ebx
call qword [sym.imp.USER32.dll_AttachThreadInput]
mov eax, 1
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov dl, 1
mov rcx, rbx
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
jmp fcn.140063df0

Function at 0x14006da20
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rax, qword [rsp + 0x68]
mov r10, r9
mov r9, qword [rsp + 0x60]
mov r11, r8
mov rdi, rdx
mov qword [rsp + 0x20], rax
mov r8, r10
mov rdx, r11
call fcn.14007d8c0
test rax, rax
je 0x14006da66
lea rdx, str.msctls_statusbar321
mov rcx, rax
call fcn.1400decb0
mov rbx, rax
jmp 0x14006da68
xor ebx, ebx
mov rcx, rdi
call fcn.14001eeb0
mov rcx, qword [0x140134e40]
lea r9, [0x1400f97e4]
mov r8d, eax
mov dword [rsp + 0x68], gethostbyname
mov rdx, rbx
mov dword [rsp + 0x60], 0xffffffff
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp fcn.1400de830
Function at 0x14006eab0
Capabilities:
Get graphical window text
Write clipboard data

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x30
mov rax, qword [rsp + 0x70]
mov rbx, qword [0x140134e40]
mov qword [rsp + 0x20], rax
call fcn.14007d8c0
mov rsi, rax
mov ebp, 1
test rax, rax
je 0x14006eaed
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea edi, [rax + 1]
jmp 0x14006eaef
mov edi, ebp
lea eax, [rdi - 1]
mov byte [rsp + 0x20], bpl
movsxd r8, eax
xor r9d, r9d
xor edx, edx
mov rcx, rbx
call fcn.1400dc860
cmp eax, ebp
je 0x14006eb1a
xor eax, eax
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
xor r8d, r8d
mov qword [rsp + 0x50], r14
mov edx, ebp
mov rcx, rbx
test rsi, rsi
je 0x14006ebcf
mov qword [rsp + 0x58], r15
call fcn.1400017a0
mov rdx, rax
mov r8d, edi
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetWindowTextW]
cmp byte [rbx + 0x23], 0
movsxd r15, eax
jne 0x14006eb58
mov rsi, qword [rbx + 0x10]
jmp 0x14006eb5b
mov rsi, rbx
lea r14, [rbx + 0x10]
lea rdi, [0x140138668]
cmp byte [rsi + 0x23], bpl
jne 0x14006eb80
test byte [rsi + 0x21], 8
je 0x14006eb7a
mov rcx, rsi
call fcn.140001640
add rsi, 0x10
jmp 0x14006eb83
mov rsi, rdi
lea rax, [r15 + r15]
mov r15, qword [rsp + 0x58]
mov qword [rsi], rax
cmp byte [rbx + 0x23], 0
jne 0x14006eb9a
mov rsi, qword [r14]
jmp 0x14006eb9d
mov rsi, rbx
cmp byte [rsi + 0x23], bpl
jne 0x14006ebb5
test byte [rsi + 0x21], 8
je 0x14006ebb1
mov rcx, rsi
call fcn.140001640
lea rdi, [rsi + 0x10]
cmp qword [rdi], 2
jae 0x14006ec13
xor r8d, r8d
mov edx, ebp
mov rcx, rbx
call fcn.1400017a0
xor esi, esi
mov word [rax], si
jmp 0x14006ec13
call fcn.1400017a0
xor esi, esi
lea r14, [rbx + 0x10]
mov word [rax], si
cmp byte [rbx + 0x23], sil
jne 0x14006ebe8
mov rdi, qword [r14]
jmp 0x14006ebeb
mov rdi, rbx
cmp byte [rdi + 0x23], bpl
jne 0x14006ec09
test byte [rdi + 0x21], 8
je 0x14006ebff
mov rcx, rdi
call fcn.140001640
add rdi, 0x10
lea r14, [rbx + 0x10]
jmp 0x14006ec10
lea rdi, [0x140138668]
mov qword [rdi], rsi
cmp byte [rbx + 0x23], 0
jne 0x14006ec1c
mov rbx, qword [r14]
cmp byte [rbx + 0x23], 2
mov r14, qword [rsp + 0x50]
jne 0x14006ec49
cmp qword [0x140136d00], 0
je 0x14006ec49
lea rcx, [0x140136ce8]
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
jmp fcn.140007740
and byte [rbx + 0x21], 0x86
mov eax, ebp
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
Function at 0x14006ecd0
Capabilities:
Enumerate gui resources

Disassembly:
push rbx
mov eax, 0x11cf0
call fcn.1400f7000
sub rsp, rax
xor eax, eax
mov byte [rsp + 0x1889], 1
mov rbx, rcx
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x188c], eax
lea rcx, [0x1400f97e4]
mov qword [rsp + 0x18a0], rax
cmp edx, 6
mov rdx, qword [0x14012f240]
xorps xmm0, xmm0
mov dword [rsp + 0x18a8], eax
mov qword [rsp + 0x18b0], rax
mov qword [rsp + 0x18c8], rax
cmove rax, rbx
mov qword [rsp + 0x18c0], rax
mov rax, qword [rsp + 0x11d28]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x11d20]
mov qword [rsp + 0x1048], rcx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x20], rax
movdqa xmmword [rsp + 0x1890], xmm0
call fcn.1400df4b0
test eax, eax
je 0x14006ed81
lea rdx, [rsp + 0x30]
lea rcx, [0x1400de4b0]
call qword [sym.imp.USER32.dll_EnumWindows]
movsxd rdx, dword [rsp + 0x188c]
mov r8b, reloc.OLEAUT32.dll_SafeArrayGetElement
mov rcx, rbx
call fcn.1400015a0
mov eax, 1
add rsp, 0x11cf0
pop rbx
ret

Function at 0x14006fd60
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
mov eax, 0x10030
call fcn.1400f7000
sub rsp, rax
mov rbx, qword [0x140134e40]
mov rbp, rdx
mov rcx, rbp
lea rdx, [rsp + 0x30]
mov r8d, 0x7fff
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov byte [rsp + 0x20], 1
mov rcx, rbx
mov esi, eax
cmp eax, 0x7fff
jb 0x14006fe42
lea r8d, [rsi - 1]
mov r9b, 1
xor edx, edx
call fcn.1400dc860
test eax, eax
je 0x14006fe5f
mov qword [rsp + 0x10040], rdi
xor r8d, r8d
mov edi, 1
mov rcx, rbx
mov edx, edi
call fcn.1400017a0
mov rdx, rax
mov r8d, esi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
jne 0x14006fe00
xor r8d, r8d
mov edx, edi
mov rcx, rbx
call fcn.1400017a0
xor ecx, ecx
mov word [rax], cx
cmp byte [rbx + 0x23], 0
jne 0x14006fe0a
mov rbx, qword [rbx + 0x10]
cmp byte [rbx + 0x23], 2
jne 0x14006fe32
cmp qword [0x140136d00], 0
je 0x14006fe32
lea rcx, [0x140136ce8]
call fcn.140007740
mov edi, eax
mov rdi, qword [rsp + 0x10040]
jmp 0x14006fe5f
and byte [rbx + 0x21], 0x86
mov eax, edi
mov rdi, qword [rsp + 0x10040]
jmp 0x14006fe5f
test esi, esi
lea rax, [0x1400f97e4]
lea rdx, [rsp + 0x30]
mov r8, rsi
cmove rdx, rax
xor r9d, r9d
call fcn.1400dc860
lea r11, [rsp + 0x10030]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsp, r11
pop rsi
ret
Function at 0x140072df0
Capabilities:
Check if file exists
Get file attributes
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
mov dword [rsp + 0x10], edx
push rdi
push r14
push r15
sub rsp, 0x250
mov rbp, r9
mov qword [rsp + 0x20], r8
mov r9, qword [0x140136c30]
mov r15, r8
lea r8, str.__s_s
mov edx, 0x800
mov r14, rcx
call fcn.1400d6690
movsxd rbx, eax
cmp ebx, 0x800
jge 0x140072e6b
lea rcx, [r14 + 2]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140072e6b
mov rcx, qword [rsp + 0x290]
mov dword [r14 + rbx*2], SafeArrayAllocDescriptor
mov rax, qword [0x140136c30]
mov qword [rcx], rax
mov al, 1
jmp 0x14007300d
xor edi, edi
mov qword [rsp + 0x270], rsi
mov esi, edi
nop word [rax + rax]
mov r9d, esi
lea rax, [rsp + 0x30]
or r9d, 1
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREAutoHotkey
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140072ff2
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x278]
mov qword [rsp + 0x28], rax
lea rdx, str.InstallDir
lea rax, [rsp + 0x40]
mov dword [rsp + 0x278], 0x208
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x30]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x140072ff2
mov edx, dword [rsp + 0x278]
test edx, edx
je 0x140072ff2
shr edx, 1
mov ecx, edx
dec edx
mov dword [rsp + 0x278], edx
cmp word [rsp + rdx*2 + 0x40], di
jne 0x140072f51
test edx, edx
je 0x140072ff9
mov ecx, edx
mov r8d, edx
nop
lea eax, [r8 - 1]
mov edx, ecx
mov r8d, eax
cmp word [rsp + rax*2 + 0x40], di
jne 0x140072f6b
mov dword [rsp + 0x278], eax
mov ecx, eax
mov edx, eax
test eax, eax
jne 0x140072f30
jmp 0x140072f6b
mov dword [rsp + 0x278], ecx
cmp ecx, 0x104
jae 0x140072ff2
mov word [rsp + rcx*2 + 0x40], di
mov edx, ecx
test edx, edx
je 0x140072ff9
mov rsi, qword [rsp + 0x270]
test rbp, rbp
je 0x140072fa1
lea rax, [rsp + 0x40]
mov r9, rbp
sub r9, rax
lea rcx, [rsp + 0x40]
movzx eax, word [rcx]
mov word [r9 + rcx], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x140072f90
test edx, edx
je 0x14007300b
mov r9, rbp
mov qword [rsp + 0x20], r15
lea r8, str.__s_s
mov edx, 0x800
mov rcx, r14
call fcn.1400d6690
movsxd rbx, eax
cmp ebx, 0x800
jge 0x14007300b
lea rcx, [r14 + 2]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14007300b
mov rax, qword [rsp + 0x290]
mov dword [r14 + rbx*2], SafeArrayAllocDescriptor
mov qword [rax], rbp
mov al, 1
jmp 0x14007300d
mov word [rsp + 0x40], di
mov edx, edi
test esi, esi
jne 0x140072f73
mov esi, 0x200
jmp 0x140072e80
xor al, al
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x140073030
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
push rsi
push rdi
mov eax, 0x2260
call fcn.1400f7000
sub rsp, rax
lea rax, [rsp + 0x2290]
mov r8, rcx
lea rcx, [rsp + 0x1260]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
movzx esi, dl
lea rbx, [rsp + 0x1260]
lea rdi, [0x1400f97e4]
call fcn.140072df0
test al, al
jne 0x140073084
add rsp, 0x2260
pop rdi
pop rsi
pop rbx
ret
mov qword [rsp + 0x2288], r14
xor r14d, r14d
test sil, sil
je 0x140073123
mov rsi, qword [rsp + 0x2290]
lea rax, [0x1401191c8]
mov r9, rsi
mov qword [rsp + 0x2280], rbp
lea r8, str.__s_s
mov qword [rsp + 0x20], rax
mov edx, 0x800
lea rcx, [rsp + 0x260]
call fcn.1400d6690
movsxd rbp, eax
cmp ebp, 0x800
jge 0x140073103
lea rcx, [rsp + 0x262]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140073103
mov dword [rsp + rbp*2 + 0x260], SafeArrayAllocDescriptor
lea rbx, [rsp + 0x260]
jmp 0x140073113
cmp rsi, qword [0x140136c30]
jne 0x14007311b
mov rbx, qword [0x140136c28]
lea rdi, [rsp + 0x1260]
mov rbp, qword [rsp + 0x2280]
mov qword [rsp + 0x48], r14
lea rcx, [0x140136060]
mov byte [rsp + 0x40], r14b
xor r9d, r9d
mov byte [rsp + 0x38], r14b
mov r8, rdi
mov qword [rsp + 0x30], r14
mov rdx, rbx
mov qword [rsp + 0x28], r14
mov byte [rsp + 0x20], r14b
call fcn.140065f10
mov r14, qword [rsp + 0x2288]
test eax, eax
setne al
add rsp, 0x2260
pop rdi
pop rsi
pop rbx
ret
Function at 0x140077e50
Capabilities:
Get keyboard layout

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x250
mov rbp, qword [0x140134e40]
xor ecx, ecx
mov rsi, r8
mov rbx, rdx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
xor r8d, r8d
xor edx, edx
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.140025360
movzx r14d, al
test al, al
jne 0x140077ef1
xor r8d, r8d
lea rdx, [rsp + 0x270]
mov rcx, rbx
call fcn.140099790
xor r9d, r9d
test eax, eax
jne 0x140077ebf
lea rdx, [0x1400f97e4]
jmp 0x140077f58
mov edx, dword [rsp + 0x270]
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x30], rcx
lea r8, [rsp + 0x30]
xor edi, edi
mov ecx, eax
mov dword [rsp + 0x40], edi
call fcn.140099b60
lea rdx, [rsp + 0x30]
mov rcx, rbp
call fcn.1400dbed0
jmp 0x140077f6c
movzx esi, word [rsi]
xor edi, edi
mov ecx, esi
mov ebx, 2
test esi, 0xffffff80
je 0x140077f09
mov eax, edi
jmp 0x140077f11
mov edx, ebx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__isctype]
movzx ecx, si
mov edx, 0xffdf
and cx, dx
test eax, eax
cmove cx, si
cmp cx, 0x50
je 0x140077f31
cmp cx, 0x54
cmovne ebx, edi
jmp 0x140077f36
mov ebx, 1
mov edx, ebx
movzx ecx, r14b
call fcn.140099ab0
test al, al
lea rcx, [0x1401195c8]
lea rdx, [0x1401195cc]
cmovne rdx, rcx
xor r9d, r9d
mov r8, 0xffffffffffffffff
mov byte [rsp + 0x20], 1
mov rcx, rbp
call fcn.1400dc860
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret

Function at 0x140077f90
Capabilities:
Get disk size

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x250
movzx esi, r8b
mov byte [rsp + 0x20], 1
mov rbx, rdx
mov rdi, rcx
mov rcx, qword [0x140134e40]
xor edx, edx
mov r8, 0xffffffffffffffff
xor r9d, r9d
call fcn.1400dc860
test rbx, rbx
je 0x1400780a9
cmp word [rbx], 0
je 0x1400780a9
mov r8d, 0x103
lea rcx, [rsp + 0x40]
mov rdx, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
xor edx, edx
lea rcx, [rsp + 0x40]
mov word [rsp + 0x246], dx
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], dx
jne 0x140078006
lea rcx, [rax + rax]
cmp word [rsp + rcx + 0x3e], 0x5c
je 0x140078032
inc rax
cmp rax, 0x104
jae 0x1400780a9
mov dword [rsp + rcx + 0x40], 0x5c
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x268]
lea rdx, [rsp + 0x278]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x1400780a9
mov rbx, qword [rsp + 0x268]
lea rdx, [0x1400f98c8]
mov rcx, qword [0x140132a80]
test sil, sil
mov r8, 0xffffffffffffffff
mov byte [rsp + 0x20], 1
cmovne rbx, qword [rsp + 0x278]
xor r9d, r9d
shr rbx, 0x14
call fcn.1400dc860
mov rcx, qword [0x140134e40]
mov r8b, reloc.OLEAUT32.dll_SafeArrayGetElement
mov rdx, rbx
call fcn.1400015a0
mov eax, 1
jmp 0x1400780b3
mov dl, 1
mov rcx, rdi
call fcn.140063df0
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x14007a550
Capabilities:
Set current directory

Disassembly:
push rbx
sub rsp, 0x30
movzx eax, word [rcx]
mov rbx, rcx
test ax, ax
je 0x14007a588
cmp word [rcx + 2], 0x3a
jne 0x14007a588
cmp word [rcx + 4], 0
jne 0x14007a588
mov word [rsp + 0x40], ax
lea rbx, [rsp + 0x40]
xor eax, eax
mov dword [rsp + 0x42], 0x5c003a
mov word [rsp + 0x46], ax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
jne 0x14007a5d0
cmp byte [0x140136c40], al
je 0x14007a603
mov rax, qword [0x14012f240]
lea rdx, [0x14011026c]
test byte [rax + 0x140], 1
je 0x14007a5e8
mov rcx, qword [0x140136730]
lea r9, [0x1400f97e4]
xor r8d, r8d
call fcn.140063d20
add rsp, 0x30
pop rbx
ret
cmp byte [0x140136c40], 0
je 0x14007a603
mov rcx, rbx
call fcn.14007a610
lea rdx, [0x1400f98c8]
mov rcx, qword [0x140132a80]
xor r9d, r9d
mov r8, 0xffffffffffffffff
mov byte [rsp + 0x20], 1
call fcn.1400dc860
add rsp, 0x30
pop rbx
ret

Function at 0x14007a610
Capabilities:
Get common file path

Disassembly:
push rbx
mov eax, 0x10020
call fcn.1400f7000
sub rsp, rax
mov rbx, rcx
lea rdx, [rsp + 0x20]
mov ecx, 0x8000
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
lea rdx, [rsp + 0x20]
cmove rdx, rbx
test rdx, rdx
je 0x14007a64e
lea rcx, vtable.CKuStringT_wchar_t__class_CKuStringUtilW_.0
call fcn.14009a160
add rsp, 0x10020
pop rbx
ret

Function at 0x14007a660
Capabilities:
Get common file path

Disassembly:
mov eax, 0x10028
call fcn.1400f7000
sub rsp, rax
lea rdx, [rsp + 0x20]
mov ecx, 0x8000
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x14007a694
lea rcx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsdup]
add rsp, 0x10028
ret
xor eax, eax
add rsp, 0x10028
ret
Function at 0x14007af50
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push rbp
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov qword [rbp + 0x10], rbx
mov qword [rbp + 0x18], rsi
mov qword [rbp + 0x20], rdi
mov rdi, rcx
mov qword [rbp + 0x28], r14
mov r14, rdx
test rcx, rcx
je 0x14007b05a
cmp word [rcx], 0
je 0x14007b05a
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp eax, 0xffffffff
je 0x14007afaa
mov ecx, 0xb7
call qword [sym.imp.KERNEL32.dll_SetLastError]
shr ebx, 4
and bl, 1
movzx eax, bl
jmp 0x14007b067
mov ebx, 0x5c
mov rcx, rdi
mov edx, ebx
call qword [sym.imp.VCRUNTIME140.dll_wcsrchr]
mov rsi, rax
cmp rax, rdi
jbe 0x14007b048
cmp word [rax - 2], 0x3a
je 0x14007b048
test r14, r14
je 0x14007afe7
xor eax, eax
mov rdx, rdi
mov rcx, rdi
mov word [rsi], ax
call fcn.14007af50
mov word [rsi], bx
jmp 0x14007b03d
mov r8, rsi
sub r8, rdi
sar r8, 1
lea r14, [r8 + r8]
lea rax, [r14 + 2]
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x14007b00b
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1400f7000
sub rsp, rcx
mov rdx, rdi
lea rbx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
xor eax, eax
mov rdx, rbx
mov rcx, rbx
mov word [r14 + rbx], ax
call fcn.14007af50
cmp word [rsi + 2], 0
je 0x14007b067
test al, al
je 0x14007b067
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
setne al
jmp 0x14007b067
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor al, al
mov rbx, qword [rbp + 0x10]
mov rsi, qword [rbp + 0x18]
mov rdi, qword [rbp + 0x20]
mov r14, qword [rbp + 0x28]
mov rsp, rbp
pop rbp
ret