joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140021230
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0x90
mov r12, rdx
mov rsi, rcx
xor r13d, r13d
mov dword [rbp - 0x49], r13d
lea rcx, vtable.CVolCommonBaseWithMemManager.0
mov qword [rbp - 0x39], rcx
lea rdi, vtable.CVolObject.0
mov qword [rbp - 0x39], rdi
mov qword [rbp - 0x31], r13
mov qword [rbp - 0x29], r13
lea rax, vtable.CWString.0
mov qword [rbp - 0x39], rax
lea rax, [rbp - 0x19]
mov qword [rbp + 0x6f], rax
mov qword [rbp - 0x19], rcx
mov qword [rbp - 0x19], rdi
mov qword [rbp - 0x11], r13
mov qword [rbp - 9], r13
lea rbx, vtable.CVolMem.0
mov qword [rbp - 0x19], rbx
mov qword [rbp - 1], r13
mov qword [rbp + 0xf], r13
mov qword [rbp + 7], r13
mov qword [rbp + 0x17], 0x40
mov qword [rbp - 0x21], r13
mov qword [rbp + 0x17], 0xfe
mov rcx, rdx
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov r14d, eax
test eax, eax
jne 0x14002133a
mov rax, qword [rbp - 0x21]
test rax, rax
jne 0x1400212f3
lea rax, [0x14005d198]
cmp qword [rbp + 0xf], r13
cmovne rax, qword [rbp - 1]
mov rdx, rax
mov rcx, rsi
call fcn.140003d10
mov dword [rbp - 0x49], 1
lea rax, [rbp - 0x19]
mov qword [rbp + 0x6f], rax
mov qword [rbp - 0x19], rbx
mov rdx, qword [rbp - 1]
test rdx, rdx
je 0x140021325
lea rcx, [rbp - 0x19]
mov rax, qword [rbp - 0x19]
call qword [rax + 0x18]
mov qword [rbp - 1], r13
mov qword [rbp + 0xf], r13
mov qword [rbp + 7], r13
mov qword [rbp - 0x19], rdi
jmp 0x140021427
inc r14d
movsxd r15, r14d
mov eax, 2
mul r15
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.140037038
mov rbx, rax
test r14d, r14d
je 0x140021377
movzx eax, r13w
mov rdi, rbx
mov rcx, r15
rep stosw word [rdi], ax
lea rdi, vtable.CVolObject.0
mov r8d, r14d
mov rdx, rbx
mov rcx, r12
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov qword [rbp - 0x21], r13
mov rdx, qword [rbp - 1]
test rdx, rdx
je 0x14002139e
lea rcx, [rbp - 0x19]
mov rax, qword [rbp - 0x19]
call qword [rax + 0x18]
mov qword [rbp - 1], r13
mov qword [rbp + 0xf], r13
mov qword [rbp + 7], r13
cmp word [rbx], 0
je 0x1400213bc
mov rdx, rbx
lea rcx, [rbp - 0x19]
call fcn.14002c350
mov rcx, rbx
call fcn.140036964
mov rax, qword [rbp - 0x21]
test rax, rax
jne 0x1400213de
lea rax, [0x14005d198]
cmp qword [rbp + 0xf], 0
cmovne rax, qword [rbp - 1]
mov rdx, rax
mov rcx, rsi
call fcn.140003d10
mov dword [rbp - 0x49], 1
lea rax, [rbp - 0x19]
mov qword [rbp + 0x6f], rax
lea rax, vtable.CVolMem.0
mov qword [rbp - 0x19], rax
mov rdx, qword [rbp - 1]
test rdx, rdx
je 0x140021417
lea rcx, [rbp - 0x19]
mov rax, qword [rbp - 0x19]
call qword [rax + 0x18]
mov qword [rbp - 1], r13
mov qword [rbp + 0xf], r13
mov qword [rbp + 7], r13
mov qword [rbp - 0x19], rdi
mov qword [rbp - 0x39], rdi
mov rax, rsi
mov rbx, qword [rsp + 0xe0]
add rsp, 0x90
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140021790
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x1a0
mov rbx, r8
xor edi, edi
mov dword [rsp + 0x30], edi
mov rax, qword [0x140072bd8]
mov r9, qword [0x140072c08]
mov rcx, qword [0x140072bf8]
test rax, rax
je 0x1400217c5
mov rdx, rax
jmp 0x1400217d3
lea rdx, [0x14005d198]
test r9, r9
cmovne rdx, rcx
cmp word [rdx], di
jne 0x140021835
mov qword [0x140072bd8], rdi
test rcx, rcx
je 0x1400217f8
mov rdx, rcx
lea rcx, [0x140072be0]
mov rax, qword [0x140072be0]
call qword [rax + 0x18]
mov qword [0x140072bf8], rdi
mov qword [0x140072c08], rdi
mov qword [0x140072c00], rdi
lea rdx, [0x14005e950]
lea rcx, [0x140072be0]
call fcn.14002c350
mov r9, qword [0x140072c08]
mov rcx, qword [0x140072bf8]
mov rax, qword [0x140072bd8]
test rax, rax
jne 0x140021848
lea rax, [0x14005d198]
test r9, r9
cmovne rax, rcx
mov r8, rax
xor edx, edx
mov ecx, 0x1f0003
call qword [sym.imp.KERNEL32.DLL_OpenEventW]
test rax, rax
je 0x140021964
lea rdx, [0x14005d198]
mov rcx, rbx
call fcn.140017ec0
test eax, eax
je 0x1400218a8
lea rdx, [0x14005e968]
lea rcx, [rsp + 0x38]
call fcn.14000b1c0
nop
mov dword [rsp + 0x30], 1
mov rdx, rax
lea rcx, [rsp + 0x140]
call fcn.140003650
mov r10, rax
mov ebx, 3
jmp 0x1400218c0
mov rdx, rbx
lea rcx, [rsp + 0xe8]
call fcn.140003650
mov r10, rax
mov ebx, 4
mov dword [rsp + 0x30], ebx
lea rdx, [0x14005e6a8]
lea rcx, [rsp + 0x90]
call fcn.14000b1c0
nop
mov r8, rax
mov rcx, r10
call fcn.140021c20
nop
lea rcx, [rsp + 0x90]
call fcn.14000ad60
nop
test bl, 4
je 0x14002190d
and ebx, 0xfffffffb
mov dword [rsp + 0x30], ebx
lea rcx, [rsp + 0xe8]
call fcn.140003d90
nop
test bl, 2
je 0x140021927
and ebx, 0xfffffffd
mov dword [rsp + 0x30], ebx
lea rcx, [rsp + 0x140]
call fcn.140003d90
nop
test bl, 1
je 0x14002193d
and ebx, 0xfffffffe
mov dword [rsp + 0x30], ebx
lea rcx, [rsp + 0x38]
call fcn.14000ad60
lea rcx, [rsp + 0x38]
call fcn.140011b60
nop
mov rcx, rax
call fcn.140024850
nop
lea rcx, [rsp + 0x38]
call fcn.140003d90
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_ExitProcess]
mov r9, qword [0x140072bd8]
test r9, r9
jne 0x140021986
lea r9, [0x14005d198]
cmp qword [0x140072c08], rdi
cmovne r9, qword [0x140072bf8]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov rbx, qword [rsp + 0x1b0]
add rsp, 0x1a0
pop rdi
jmp qword [sym.imp.KERNEL32.DLL_CreateEventW]
Function at 0x1400272d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x80
mov rbx, r8
mov edi, edx
test r8, r8
je 0x1400274a0
mov rax, qword [rcx]
call qword [rax]
mov rbp, rax
test edi, edi
je 0x140027340
cmp edi, 3
je 0x140027340
sub edi, 1
je 0x14002732f
cmp edi, 1
jne 0x1400274a0
movzx edx, bx
mov rcx, rax
call qword [sym.imp.USER32.dll_LoadIconW]
jmp 0x1400274a2
movzx edx, bx
mov rcx, rbp
call qword [sym.imp.USER32.dll_LoadCursorW]
jmp 0x1400274a2
movzx edx, bx
mov r8d, 0xa
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_FindResourceW]
mov r15, rax
test rax, rax
je 0x1400274a0
xor ebx, ebx
mov esi, ebx
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_LoadResource]
mov r14, rax
test rax, rax
je 0x1400274a0
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_LockResource]
mov r12, rax
test rax, rax
je 0x140027406
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
mov qword [rsp + 0x70], rbx
mov rdx, r15
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_SizeofResource]
mov r8d, eax
mov rdx, r12
lea rcx, [rsp + 0x50]
call fcn.1400258c0
test rax, rax
je 0x1400273df
mov rsi, qword [rsp + 0x50]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
mov qword [rsp + 0x70], rbx
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140027406
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
mov qword [rsp + 0x70], rbx
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, r14
call qword [sym.imp.KERNEL32.DLL_FreeResource]
test rsi, rsi
je 0x1400274a0
cmp edi, 3
jne 0x14002749b
lea r8, [rsp + 0x30]
lea edx, [rdi + 0x1d]
mov rcx, rsi
call qword [sym.imp.GDI32.dll_GetObjectW]
test eax, eax
je 0x14002748d
mov edx, dword [rsp + 0x38]
test edx, edx
je 0x14002748d
lea ecx, [rdx + 1]
and ecx, 0xfffffffe
mov dword [rsp + 0x20], 1
xor r9d, r9d
lea r8d, [rdi + 0x1e]
call qword [sym.imp.COMCTL32.dll_ImageList_Create]
mov rdi, rax
test rax, rax
je 0x14002748d
mov r8d, 0xff00ff
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.COMCTL32.dll_ImageList_AddMasked]
test eax, eax
jns 0x14002748a
mov rcx, rdi
call qword [sym.imp.COMCTL32.dll_ImageList_Destroy]
mov rcx, rsi
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rax, rbx
jmp 0x1400274a2
mov rbx, rdi
mov rcx, rsi
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rax, rbx
jmp 0x1400274a2
mov rax, rsi
jmp 0x1400274a2
xor eax, eax
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
Function at 0x140027560
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push r14
sub rsp, 0x20
xor esi, esi
mov r14, r9
mov qword [r8 + 0x28], rsi
mov rbx, r8
mov rbp, rdx
test rdx, rdx
jne 0x140027592
lea eax, [rdx + 1]
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rsi
pop rbp
ret
mov rax, qword [rcx]
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], r15
call qword [rax]
movzx edx, bp
mov r8, r14
mov rcx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.DLL_FindResourceW]
mov r15, rax
test rax, rax
je 0x140027687
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_LoadResource]
mov rbp, rax
test rax, rax
je 0x140027687
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_LockResource]
mov r14, rax
test rax, rax
je 0x14002767e
mov rdx, r15
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_SizeofResource]
mov edi, eax
mov qword [rbx + 0x28], rsi
cmp qword [rbx + 0x20], rdi
jl 0x14002765c
cmp rdi, 1
jne 0x14002761a
movzx ecx, byte [r14]
mov rax, qword [rbx + 0x18]
mov byte [rax], cl
inc qword [rbx + 0x28]
jmp 0x140027679
cmp rdi, 2
jne 0x140027631
movzx ecx, word [r14]
mov rax, qword [rbx + 0x18]
mov word [rax], cx
add qword [rbx + 0x28], rdi
jmp 0x140027679
cmp rdi, 4
jne 0x140027646
mov ecx, dword [r14]
mov rax, qword [rbx + 0x18]
mov dword [rax], ecx
add qword [rbx + 0x28], rdi
jmp 0x140027679
cmp rdi, 8
jne 0x14002765c
mov rcx, qword [r14]
mov rax, qword [rbx + 0x18]
mov qword [rax], rcx
add qword [rbx + 0x28], rdi
jmp 0x140027679
test eax, eax
je 0x140027679
mov rdx, rdi
mov rcx, rbx
call fcn.14002c270
mov r8, rdi
mov rdx, r14
mov rcx, rax
call fcn.14003afb0
mov esi, 1
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_FreeResource]
mov r15, qword [rsp + 0x48]
mov rax, rsi
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rsi
pop rbp
ret
Function at 0x14002ace0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x80
test rcx, rcx
je 0x14002ae1f
cmp word [rcx], 0
je 0x14002ae1f
lea rdx, vtable.CVolCommonBaseWithMemManager.0
mov qword [rbp - 0x60], rdx
lea rsi, vtable.CVolObject.0
mov qword [rbp - 0x60], rsi
xor edi, edi
mov qword [rbp - 0x58], rdi
mov qword [rbp - 0x50], rdi
lea rax, vtable.CWString.0
mov qword [rbp - 0x60], rax
lea rax, [rbp - 0x40]
mov qword [rbp + 0x20], rax
mov qword [rbp - 0x40], rdx
mov qword [rbp - 0x40], rsi
mov qword [rbp - 0x38], rdi
mov qword [rbp - 0x30], rdi
lea r14, vtable.CVolMem.0
mov qword [rbp - 0x40], r14
mov qword [rbp - 0x28], rdi
mov qword [rbp - 0x18], rdi
mov qword [rbp - 0x20], rdi
mov qword [rbp - 0x10], 0x40
mov qword [rbp - 0x48], rdi
mov qword [rbp - 0x10], 0xfe
cmp word [rcx], di
je 0x14002add6
cmp word [rcx + 2], di
je 0x14002add6
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp word [rcx + r8*2], 0
jne 0x14002ad90
cmp word [rcx + r8*2 - 2], 0x5c
jne 0x14002add6
cmp word [rcx + r8*2 - 4], 0x3a
je 0x14002add6
dec r8
mov rdx, rcx
lea rcx, [rbp - 0x60]
call fcn.14002dec0
mov rcx, qword [rbp - 0x48]
test rcx, rcx
jne 0x14002add6
lea rcx, [0x14005d198]
cmp qword [rbp - 0x18], 0
cmovne rcx, qword [rbp - 0x28]
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
mov rbx, rdi
cmp eax, 0xffffffff
setne bl
lea rax, [rbp - 0x40]
mov qword [rbp + 0x20], rax
mov qword [rbp - 0x40], r14
mov rdx, qword [rbp - 0x28]
test rdx, rdx
je 0x14002ae06
lea rcx, [rbp - 0x40]
mov r8, qword [rbp - 0x40]
call qword [r8 + 0x18]
mov qword [rbp - 0x28], rdi
mov qword [rbp - 0x18], rdi
mov qword [rbp - 0x20], rdi
mov qword [rbp - 0x40], rsi
mov qword [rbp - 0x60], rsi
mov rax, rbx
jmp 0x14002ae21
xor eax, eax
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x14002ae40
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
lea rbp, [rsp - 0x10]
sub rsp, 0x110
test rcx, rcx
je 0x14002afa3
cmp word [rcx], 0
je 0x14002afa3
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x5c], xmm0
movups xmmword [rbp - 0x4c], xmm0
movups xmmword [rbp - 0x3c], xmm0
movups xmmword [rbp - 0x2c], xmm0
movups xmmword [rbp - 0x1c], xmm0
movups xmmword [rbp - 0xc], xmm0
mov dword [rbp + 4], eax
mov dword [rbp - 0x60], 0x68
test r8, r8
js 0x14002aea9
or dword [rbp - 0x24], 1
mov word [rbp - 0x20], r8w
lea rax, vtable.CVolCommonBaseWithMemManager.0
mov qword [rsp + 0x50], rax
lea rsi, vtable.CVolObject.0
mov qword [rsp + 0x50], rsi
xor edi, edi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], rdi
lea r14, vtable.CVolMem.0
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x70], rdi
mov qword [rbp - 0x80], 0x40
mov rdx, rcx
lea rcx, [rsp + 0x50]
call fcn.14002c350
mov rdx, qword [rsp + 0x68]
cmp qword [rsp + 0x78], rdi
cmove rdx, rdi
lea rax, [rbp - 0x78]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_CreateProcessW]
test eax, eax
jne 0x14002af45
mov ebx, edi
jmp 0x14002af6d
mov edx, 0x1f4
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.USER32.dll_WaitForInputIdle]
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov ebx, 1
mov qword [rsp + 0x50], r14
mov rdx, qword [rsp + 0x68]
test rdx, rdx
je 0x14002af8a
lea rcx, [rsp + 0x50]
mov r8, qword [rsp + 0x50]
call qword [r8 + 0x18]
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x50], rsi
mov rax, rbx
jmp 0x14002afa5
xor eax, eax
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x14002afd0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x40]
sub rsp, 0x140
xor ebx, ebx
lea rdx, vtable.CVolCommonBaseWithMemManager.0
mov qword [rsp + 0x30], rdx
lea rdi, vtable.CVolObject.0
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rbx
lea r8, vtable.CWString.0
mov qword [rsp + 0x30], r8
lea rax, [rsp + 0x50]
mov qword [rbp + 0x58], rax
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rbx
lea rsi, vtable.CVolMem.0
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x70], rbx
mov qword [rbp - 0x80], 0x40
mov qword [rsp + 0x48], rbx
mov qword [rbp - 0x80], 0xfe
mov qword [rsp + 0x30], r8
mov rdx, rcx
lea rcx, [rsp + 0x30]
call fcn.14002dda0
nop
lea r8, [rsp + 0x30]
lea rcx, [rbp - 0x18]
call fcn.14002e9b0
nop
lea r8, [0x14005e590]
mov rdx, rax
lea rcx, [rbp - 0x70]
call fcn.14002e860
nop
mov r9, qword [rax + 0x18]
test r9, r9
jne 0x14002b0b9
cmp qword [rax + 0x48], r9
lea r9, [0x14005d198]
je 0x14002b0b9
mov r9, qword [rax + 0x38]
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], rbx
lea r8, str.explorer.exe
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
lea rax, [rbp - 0x50]
mov qword [rbp + 0x58], rax
mov qword [rbp - 0x50], rsi
mov rdx, qword [rbp - 0x38]
test rdx, rdx
je 0x14002b0fd
lea rcx, [rbp - 0x50]
mov rax, qword [rbp - 0x50]
call qword [rax + 0x18]
mov qword [rbp - 0x38], rbx
mov qword [rbp - 0x28], rbx
mov qword [rbp - 0x30], rbx
mov qword [rbp - 0x50], rdi
mov qword [rbp - 0x70], rdi
lea rax, [rbp + 8]
mov qword [rbp + 0x58], rax
mov qword [rbp + 8], rsi
mov rdx, qword [rbp + 0x20]
test rdx, rdx
je 0x14002b131
lea rcx, [rbp + 8]
mov rax, qword [rbp + 8]
call qword [rax + 0x18]
mov qword [rbp + 0x20], rbx
mov qword [rbp + 0x30], rbx
mov qword [rbp + 0x28], rbx
mov qword [rbp + 8], rdi
mov qword [rbp - 0x18], rdi
lea rax, [rsp + 0x50]
mov qword [rbp + 0x58], rax
mov qword [rsp + 0x50], rsi
mov rdx, qword [rsp + 0x68]
test rdx, rdx
je 0x14002b16a
lea rcx, [rsp + 0x50]
mov rax, qword [rsp + 0x50]
call qword [rax + 0x18]
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x30], rdi
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x14002ca30
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
sub rsp, 0x20
mov rax, rdx
mov rbx, rcx
test rdx, rdx
je 0x14002cb3a
cmp word [rdx], 0
je 0x14002cb3a
mov qword [rsp + 0x30], rbp
lea rdx, [0x14005f2d4]
mov rcx, rax
mov qword [rsp + 0x38], rdi
mov rsi, 0xffffffffffffffff
call fcn.14003c228
mov rdi, rax
test rax, rax
je 0x14002cb0a
xor edx, edx
lea r8d, [rsi + 3]
mov rcx, rax
call fcn.14003c494
mov rcx, rdi
call fcn.14003c990
xor r8d, r8d
movsxd rbp, eax
xor edx, edx
mov rcx, rdi
call fcn.14003c494
test rbp, rbp
jle 0x14002cb00
mov rdx, rbp
mov rcx, rbx
call fcn.14002c1f0
mov rcx, rax
lea edx, [rsi + 2]
mov r9, rdi
mov r8, rbp
call fcn.14003cce0
mov rcx, rdi
mov rbp, rax
call fcn.14003faec
test eax, eax
jne 0x14002cb02
mov rdx, rbp
mov rcx, rbx
call fcn.14002c270
mov rcx, rdi
call fcn.14003ca1c
mov rax, rbp
mov rbp, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
xor esi, esi
mov rcx, rdi
call fcn.14003ca1c
mov rdx, qword [rbx + 0x18]
test rdx, rdx
je 0x14002cb1d
mov r8, qword [rbx]
mov rcx, rbx
call qword [r8 + 0x18]
mov qword [rbx + 0x18], 0
mov rax, rsi
mov qword [rbx + 0x28], 0
mov qword [rbx + 0x20], 0
jmp 0x14002caeb
mov rbx, qword [rsp + 0x40]
mov rax, 0xffffffffffffffff
add rsp, 0x20
pop rsi
ret

Function at 0x14002cb50
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rdi, qword [rcx + 0x28]
mov rax, rdx
mov rbx, qword [rcx + 0x18]
test rdx, rdx
je 0x14002cbdb
cmp word [rdx], 0
je 0x14002cbdb
test rdi, rdi
js 0x14002cbdb
lea rdx, [0x14005e6d4]
mov qword [rsp + 0x30], rsi
mov rcx, rax
call fcn.14003c228
mov rsi, rax
test rax, rax
jne 0x14002cba5
mov rsi, qword [rsp + 0x30]
xor ebx, ebx
mov eax, ebx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov r9, rsi
mov r8, rdi
mov edx, 1
mov rcx, rbx
call fcn.14003dca0
xor ebx, ebx
mov rcx, rsi
cmp rax, rdi
sete bl
call fcn.14003ca1c
mov rsi, qword [rsp + 0x30]
mov rax, rbx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
xor ebx, ebx
mov eax, ebx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14002ec90
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x140071010]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov r15, rdx
mov rsi, rcx
xor r12d, r12d
mov dword [rsp + 0x20], r12d
mov r8d, 0x104
lea rcx, str.APPDATA
call qword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableW]
mov edi, 0x80070057
test eax, eax
cmovne edi, r12d
je 0x14002ed01
lea r8, str.MicrosoftWindowsStart_MenuPrograms_
mov edx, 0x104
mov rcx, r15
call fcn.14003fb70
neg eax
sbb edi, edi
and edi, 0x80070057
test edi, edi
js 0x14002ee95
mov r14, qword [rsi + 0x10]
movabs rcx, 0x7ffffffffffffffe
mov rax, rcx
sub rax, r14
cmp rax, 4
jb 0x14002eec3
cmp qword [rsi + 0x18], 8
jb 0x14002ed31
mov rsi, qword [rsi]
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x40], r12
lea rbp, [r14 + 4]
mov ebx, 7
lea rdi, [rsp + 0x28]
cmp rbp, rbx
jbe 0x14002eddc
mov rbx, rbp
or rbx, 7
cmp rbx, rcx
jbe 0x14002ed6a
mov rbx, rcx
mov rcx, 0xfffffffffffffffe
jmp 0x14002ed99
mov eax, 0xa
cmp rbx, rax
cmovb rbx, rax
lea rcx, [rbx + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x14002eebd
add rcx, rcx
cmp rcx, 0x1000
jb 0x14002edc5
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14002eebd
mov rcx, rax
call fcn.140036ffc
test rax, rax
je 0x14002eec9
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x14002edd7
test rcx, rcx
je 0x14002edd4
call fcn.140036ffc
mov rdi, rax
jmp 0x14002edd7
mov rdi, r12
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x40], rbx
lea rbx, [r14 + r14]
mov r8, rbx
mov rdx, rsi
mov rcx, rdi
call fcn.14003afb0
movabs rax, 0x6b006e006c002e
mov qword [rbx + rdi], rax
mov word [rdi + rbp*2], r12w
mov ebx, 1
mov dword [rsp + 0x20], ebx
lea r8, [rsp + 0x28]
cmp qword [rsp + 0x40], 8
cmovae r8, qword [rsp + 0x28]
mov edx, 0x104
mov rcx, r15
call fcn.14003fb70
neg eax
sbb edi, edi
and edi, 0x80070057
and ebx, 0xfffffffe
mov dword [rsp + 0x20], ebx
mov rdx, qword [rsp + 0x40]
cmp rdx, 8
jb 0x14002ee81
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002ee7c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002eecf
call fcn.140036964
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x40], 7
mov word [rsp + 0x28], r12w
mov eax, edi
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140036870
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
call fcn.140015420
nop
call fcn.140015150
int3
call fcn.14003c0e4
nop
call fcn.14003c0e4
int3
Function at 0x14002fbe0
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
lea rcx, str.SHELL32.DLL
call qword [sym.imp.KERNEL32.DLL_LoadLibraryW]
test rax, rax
je 0x14002fcda
lea rdx, str.SetCurrentProcessExplicitAppUserModelID
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov qword [0x1400784f0], rax
test rax, rax
je 0x14002fcda
lea rcx, str.PROPSYS.DLL
call qword [sym.imp.KERNEL32.DLL_LoadLibraryW]
test rax, rax
je 0x14002fcda
lea rdx, str.PropVariantToString
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov qword [0x1400784f8], rax
test rax, rax
je 0x14002fcda
lea rcx, str.COMBASE.DLL
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.DLL_LoadLibraryW]
mov rbx, rax
test rax, rax
je 0x14002fcd5
lea rdx, str.RoGetActivationFactory
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov qword [0x1400784e8], rax
test rax, rax
je 0x14002fcd5
lea rdx, str.WindowsCreateStringReference
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov qword [0x1400784e0], rax
test rax, rax
je 0x14002fcd5
lea rdx, str.WindowsGetStringRawBuffer
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov qword [0x140078508], rax
test rax, rax
je 0x14002fcd5
lea rdx, str.WindowsDeleteString
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov qword [0x140078500], rax
mov rbx, qword [rsp + 0x20]
cmp qword [0x1400784f0], 0
je 0x14002fd13
cmp qword [0x1400784f8], 0
je 0x14002fd13
cmp qword [0x1400784e8], 0
je 0x14002fd13
cmp qword [0x1400784e0], 0
je 0x14002fd13
cmp qword [0x140078500], 0
je 0x14002fd13
mov al, 1
add rsp, 0x28
ret
xor al, al
add rsp, 0x28
ret