joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400c7330
Capabilities:
Enumerate files on windows
Move file

Disassembly:
push rbx
push rsi
push rdi
mov eax, 0x14f0
call fcn.1400f9a20
sub rsp, rax
mov rax, qword [0x1401f7280]
xor rax, rsp
mov qword [rsp + 0x14e0], rax
mov rax, rdx
mov rbx, r8
mov rsi, rcx
lea rdx, [rsp + 0x280]
mov r8d, 4
mov rcx, rax
call fcn.1400ed200
lea r9, [rsp + 0x280]
lea rdx, str._s_s.
lea rcx, [rsp + 0x10d0]
mov r8, rsi
call fcn.1400f98c8
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x10d0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1400c7504
lea rdx, [rsp + 0xab0]
mov r8d, 4
mov rcx, rbx
call fcn.1400ed200
xor ebx, ebx
nop dword [rax]
mov eax, dword [rsp + 0x30]
test al, 0x10
jne 0x1400c74e5
test al, 2
jne 0x1400c74e5
lea rcx, [rsp + 0x490]
xor edx, edx
mov r8d, 0x208
call fcn.1400f9ab0
lea rcx, [rsp + 0x280]
or rax, 0xffffffffffffffff
cmp word [rcx + rax*2 + 2], bx
lea rax, [rax + 1]
jne 0x1400c7405
lea rdx, [rsp + 0x5c]
lea rax, [rdx + rax*2]
lea rdx, [rsp + 0x490]
sub rdx, rax
nop dword [rax]
nop dword [rax + rax]
movzx ecx, word [rax]
lea rax, [rax + 2]
mov word [rdx + rax - 2], cx
test cx, cx
jne 0x1400c7430
lea r9, [rsp + 0x5c]
lea rdx, str._s_s
lea rcx, [rsp + 0xcc0]
mov r8, rsi
call fcn.1400f98c8
lea rax, [rsp + 0x490]
lea r9, [rsp + 0xab0]
lea rdx, [0x14018e078]
lea rcx, [rsp + 0x6a0]
mov r8, rsi
mov qword [rsp + 0x20], rax
call fcn.1400f98c8
lea rdx, [rsp + 0x6a0]
lea rcx, [rsp + 0xcc0]
call fcn.1400fa7c0
test eax, eax
je 0x1400c74c9
mov rcx, qword [0x1401fbba0]
lea r9, [rsp + 0x6a0]
xor r8d, r8d
mov edx, 0x4d8
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
call fcn.1400f11b0
jmp 0x1400c74e5
mov rcx, qword [0x1401fbab8]
lea r8, [rsp + 0x6a0]
lea rdx, [rsp + 0xcc0]
call fcn.1400c25f0
lea rdx, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1400c73d0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, qword [rsp + 0x14e0]
xor rcx, rsp
call fcn.1400f9a80
add rsp, 0x14f0
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400c7520
Capabilities:
Move file
Read .ini file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x90
mov r11, r8
mov esi, r9d
mov rbx, r8
mov rdi, rdx
mov rbp, rcx
mov rax, rdx
sub r11, rdx
nop dword [rax]
movzx r10d, word [rax]
movzx r8d, word [rax + r11]
sub r10d, r8d
jne 0x1400c7567
add rax, 2
test r8d, r8d
jne 0x1400c7550
test r10d, r10d
je 0x1400c7764
xor ecx, ecx
call fcn.14007e7b0
xor ecx, ecx
call fcn.14005bb00
mov rdx, rbx
mov rcx, rdi
call fcn.1400fa7c0
test eax, eax
je 0x1400c75b6
mov rcx, qword [0x1401fbba0]
xor eax, eax
mov r9, rbx
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov edx, 0x4d8
mov qword [rsp + 0x20], rax
call fcn.1400f11b0
xor eax, eax
jmp 0x1400c7769
mov rcx, qword [0x1401fbab8]
mov r8, rbx
mov rdx, rdi
call fcn.1400c25f0
cmp dword [rsp + 0xc0], 0
je 0x1400c75e4
lea rcx, [0x140208ca0]
mov r8, rbx
mov rdx, rdi
call fcn.1400c7330
mov rcx, qword [0x1401fbab8]
or rdi, 0xffffffffffffffff
lea r9, [rsp + 0x30]
mov r8, rdi
mov edx, 0x102b
mov dword [rsp + 0x40], 2
mov dword [rsp + 0x3c], 0xfffffffd
call qword [sym.imp.USER32.dll_SendMessageW]
lea r9, [0x140208860]
lea rdx, str.NotUpdateDirIndex
lea rcx, str.Others
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
jne 0x1400c7754
mov rcx, qword [0x1401fbb48]
mov esi, dword [0x1401f714c]
call qword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x1400c7675
lea r9, [0x140208860]
lea r8d, [rdi + 2]
lea rdx, str.FullSort
lea rcx, [0x140185d88]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
jne 0x1400c7675
add esi, 0x64
cmp dword [0x1401f714c], 0x1e
je 0x1400c769a
mov rcx, qword [0x1401fbab8]
lea r9, [fcn.1400c1970]
movsxd r8, esi
mov edx, 0x1030
call qword [sym.imp.USER32.dll_SendMessageW]
lea r9, [0x140209940]
inc rdi
cmp word [r9 + rdi*2], 0
jne 0x1400c76a1
test rdi, rdi
je 0x1400c773d
mov r8, rbx
mov rax, r9
sub r8, r9
nop
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x1400c76d4
add rax, 2
test ecx, ecx
jne 0x1400c76c0
test edx, edx
je 0x1400c773d
mov rcx, r9
sub rcx, rbx
nop
movzx eax, word [rbx]
lea rbx, [rbx + 2]
mov word [rcx + rbx - 2], ax
test ax, ax
jne 0x1400c76e0
mov rcx, qword [0x1401fbab8]
mov rdx, r9
call fcn.1400c1630
mov rcx, qword [0x1401fbb00]
mov dword [0x1401fbc74], eax
call qword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x1400c7732
mov rcx, qword [0x1401fbb00]
xor r9d, r9d
mov edx, 0x111
mov r8d, 0x472
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, rbp
call qword [sym.imp.USER32.dll_SetActiveWindow]
jmp 0x1400c775a
mov rcx, qword [0x1401fbab8]
mov rdx, r9
call fcn.1400c1630
mov dword [0x1401fbc74], eax
jmp 0x1400c775a
mov dword [0x1401fbc74], esi
mov ecx, 2
call fcn.1400d8990
mov eax, 1
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1400c7a40
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0xb0
mov rax, qword [0x1401f7280]
xor rax, rsp
mov qword [rsp + 0xa0], rax
movsxd rbx, ecx
mov ecx, InitCommonControls
mov esi, r9d
mov ebp, r8d
movsxd rdi, edx
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x1400c7ac3
mov rcx, qword [0x1401fbab8]
mov r8, rbx
mov edx, 0x102c
mov r9d, 2
call qword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 2
jne 0x1400c7ac3
mov rcx, qword [0x1401fbab8]
lea r9, [rsp + 0x30]
mov r8, rdi
mov edx, 0x102b
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x3c], 0xfffffffd
call qword [sym.imp.USER32.dll_SendMessageW]
mov ecx, InitCommonControls
call qword [sym.imp.USER32.dll_GetKeyState]
xor edx, edx
mov r8d, esi
test ax, ax
mov ecx, ebx
setns dl
call fcn.1400c7bb0
cmp ebp, 1
jne 0x1400c7b7f
mov rcx, qword [0x1401fbab8]
lea r9, [rsp + 0x20]
mov r8, rbx
mov edx, 0x1010
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [0x1401fbab8]
lea r9, [rsp + 0x90]
mov r8, rbx
mov edx, 0x100e
mov dword [rsp + 0x90], ebp
call qword [sym.imp.USER32.dll_SendMessageW]
lea ecx, [rbp + 0xe]
call fcn.1400e9140
mov edx, dword [rsp + 0x98]
lea ecx, [rbp + 0xe]
sub edx, dword [rsp + 0x90]
sub edx, eax
add dword [rsp + 0x20], edx
call fcn.1400e9140
mov ecx, dword [rsp + 0x9c]
sub ecx, dword [rsp + 0x94]
lea rdx, [rsp + 0x20]
sub ecx, eax
add dword [rsp + 0x24], ecx
mov rcx, qword [0x1401fbab8]
call qword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [rsp + 0x24]
mov ecx, dword [rsp + 0x20]
call qword [sym.imp.USER32.dll_SetCursorPos]
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.1400f9a80
mov rbx, qword [rsp + 0xe0]
add rsp, 0xb0
pop rdi
pop rsi
pop rbp
ret

Function at 0x1400c7ff0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x90
mov rdi, rdx
xor edx, edx
mov esi, r8d
mov rbx, rcx
lea rcx, [rsp + 0x20]
lea r8d, [rdx + 0x70]
call fcn.1400f9ab0
lea rcx, str.properties
test esi, esi
lea rax, str.explore
mov dword [rsp + 0x20], 0x70
mov qword [rsp + 0x28], rbx
cmove rax, rcx
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x38], rdi
mov dword [rsp + 0x24], InitCommonControls
mov dword [rsp + 0x50], 1
mov qword [rsp + 0x30], rax
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x1400c8080
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0xd0
mov rax, qword [0x1401f7280]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov ebx, ecx
mov rcx, qword [0x1401fbab8]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1037
call qword [sym.imp.USER32.dll_SendMessageW]
lea r9, [rsp + 0x40]
lea r8, str.100_100
mov rdi, rax
lea rax, [0x140208860]
lea rdx, str.ThumbW
mov qword [rsp + 0x28], rax
lea rcx, [0x140185d88]
mov dword [rsp + 0x20], 0x40
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x34]
lea rdx, [0x14018ea20]
lea rcx, [rsp + 0x40]
call fcn.1400fb8b4
lea rcx, [rsp + 0x40]
mov dx, 0x2c
call fcn.1400f9cdc
mov ecx, dword [rsp + 0x30]
test rax, rax
cmove ecx, dword [rsp + 0x34]
mov dword [rsp + 0x30], ecx
test ebx, ebx
je 0x1400c814c
mov ecx, 0xa
btr edi, 0x11
mov dword [0x1401f7264], 0xa
call fcn.1400e9140
mov ecx, 0x24
jmp 0x1400c8169
mov ecx, 2
bts edi, 0x11
mov dword [0x1401f7264], 2
call fcn.1400e9140
mov ecx, 2
add ax, word [rsp + 0x34]
movzx ebx, ax
call fcn.1400e9140
xor r8d, r8d
add ax, word [rsp + 0x30]
mov edx, 0x1035
movzx ecx, ax
shl ecx, 0x10
movsxd r9, ecx
mov rcx, qword [0x1401fbab8]
or r9, rbx
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [0x1401fbab8]
mov r9d, edi
xor r8d, r8d
mov edx, 0x1036
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.1400f9a80
mov rbx, qword [rsp + 0xe0]
add rsp, 0xd0
pop rdi
ret
Function at 0x1400cd220
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x90
mov rax, qword [0x1401f7280]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rcx, qword [0x1401fbb58]
lea rdx, [rsp + 0x30]
xor ebx, ebx
call qword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [rsp + 0x3c]
mov rcx, qword [0x1401fbb50]
sub eax, dword [rsp + 0x34]
cdq
mov edi, eax
xor edi, edx
sub edi, edx
call qword [sym.imp.USER32.dll_GetParent]
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetClientRect]
mov rcx, qword [0x1401fbb50]
call qword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x1400cd2d4
lea r9, [0x140208860]
lea rdx, str.TreeW
lea rcx, [0x140185d88]
or r8d, 0xffffffff
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ebx, eax
test eax, eax
jg 0x1400cd2d4
mov eax, dword [rsp + 0x38]
sub eax, dword [rsp + 0x30]
cdq
mov ecx, eax
mov eax, 0x66666667
xor ecx, edx
sub ecx, edx
imul ecx
mov ebx, edx
sar ebx, 1
mov eax, ebx
shr eax, 0x1f
add ebx, eax
mov eax, dword [rsp + 0x3c]
mov rcx, qword [0x1401fbb50]
lea r8d, [rdi - 2]
sub eax, dword [rsp + 0x34]
mov r9d, ebx
xor edx, edx
sub eax, edi
mov dword [rsp + 0x28], 1
add eax, 2
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_MoveWindow]
mov rcx, qword [0x1401fbb50]
call qword [sym.imp.USER32.dll_IsWindowVisible]
mov rcx, qword [0x1401fbb50]
test eax, eax
je 0x1400cd31f
xor edx, edx
jmp 0x1400cd324
mov edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
lea rdx, [0x140182ce0]
lea rcx, [rsp + 0x40]
mov r8d, ebx
call fcn.1400f98c8
lea r9, [0x140208860]
lea r8, [rsp + 0x40]
lea rdx, str.TreeW
lea rcx, [0x140185d88]
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov rcx, qword [0x1401fbb50]
call qword [sym.imp.USER32.dll_GetParent]
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 5]
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [0x1401fbb50]
call qword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x1400cd3db
mov rcx, qword [0x1401fbb48]
call qword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x1400cd3db
mov rcx, qword [0x1401fbb50]
call qword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x1400cd3db
mov eax, dword [0x1401fcb3c]
test eax, eax
jne 0x1400cd3db
mov dword [0x1401fcb3c], 1
lea rcx, [0x140208ca0]
call fcn.1400d1cc0
mov dword [0x1401fcb3c], 0
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1400f9a80
mov rbx, qword [rsp + 0xa0]
add rsp, 0x90
pop rdi
ret
Function at 0x1400cd590
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x2468
call fcn.1400f9a20
sub rsp, rax
mov rax, qword [0x1401f7280]
xor rax, rsp
mov qword [rsp + 0x2450], rax
test dword [0x1401f7180], 0x2000
je 0x1400cd72e
lea rcx, [rsp + 0x240]
xor r9d, r9d
mov edx, 0x104
mov r8d, 0x2000
mov qword [rsp + 0x2460], rdi
call fcn.14001eac0
lea rdx, [0x14018eac4]
lea rcx, [rsp + 0x240]
call fcn.1400fafe4
mov rdi, rax
test rax, rax
je 0x1400cd70c
lea rax, [0x140208860]
lea r9, [rsp + 0x30]
lea r8, str._D_F__X_W_x__H_pixels_B_bpp_S_T_E36867
mov qword [rsp + 0x28], rax
lea rdx, str.Text
lea rcx, [0x140185d88]
mov dword [rsp + 0x20], 0x104
mov qword [rsp + 0x2470], rbx
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov rcx, qword [0x1401fbab8]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1004
xor ebx, ebx
call qword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
jle 0x1400cd6fc
mov rcx, qword [0x1401fbab8]
movsxd r8, ebx
mov edx, 0x102c
mov r9d, 2
call qword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 2
jne 0x1400cd6da
mov rcx, qword [0x1401fbab8]
lea rax, [rsp + 0x30]
lea r8, [rsp + 0x450]
mov r9d, 0x1000
mov edx, ebx
mov qword [rsp + 0x20], rax
call fcn.1400c2c90
mov edx, 0xa
lea rcx, [rsp + 0x450]
lea r8d, [rdx + 0x72]
call fcn.1400ef610
lea r9, [rsp + 0x450]
lea r8, [0x140208ca0]
lea rdx, str._s_s_n
mov rcx, rdi
call fcn.1400fbc58
mov rcx, qword [0x1401fbab8]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1004
inc ebx
call qword [sym.imp.USER32.dll_SendMessageW]
cmp ebx, eax
jl 0x1400cd660
mov rcx, rdi
call fcn.1400fa904
mov rbx, qword [rsp + 0x2470]
xor eax, eax
mov rdi, qword [rsp + 0x2460]
mov rcx, qword [rsp + 0x2450]
xor rcx, rsp
call fcn.1400f9a80
add rsp, 0x2468
ret
mov eax, 1
mov rcx, qword [rsp + 0x2450]
xor rcx, rsp
call fcn.1400f9a80
add rsp, 0x2468
ret
Function at 0x1400cfb10
Capabilities:
Write file on windows

Disassembly:
push rbx
push rbp
push rdi
sub rsp, 0x570
mov rax, qword [0x1401f7280]
xor rax, rsp
mov qword [rsp + 0x560], rax
mov rdi, rdx
mov rbp, r9
mov rbx, rcx
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1032
mov rcx, rdi
call qword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
jne 0x1400cfb73
xor ebx, ebx
xor r9d, r9d
xor r8d, r8d
mov edx, 0x50f
mov rcx, rbp
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
call fcn.1400f11b0
xor eax, eax
jmp 0x1400cfca8
lea r8, [0x1401872e8]
lea rcx, [rsp + 0x40]
mov r9d, 1
mov rdx, rbx
mov qword [rsp + 0x5a0], rsi
mov dword [rsp + 0x20], 4
call fcn.14002ef20
test eax, eax
je 0x1400cfc9b
mov eax, 0xfeff
lea rdx, [0x140183390]
lea rcx, [rsp + 0x40]
mov word [rsp + 0x30], ax
call fcn.1400fafe4
mov rsi, rax
test rax, rax
jne 0x1400cfbf3
lea r9, [rsp + 0x40]
xor ebx, ebx
xor r8d, r8d
mov edx, 0x4e71
mov rcx, rbp
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x20], rbx
call fcn.1400f11b0
xor eax, eax
jmp 0x1400cfca0
mov edx, 2
lea rcx, [rsp + 0x30]
mov r9, rax
lea r8d, [rdx - 1]
call fcn.1400faf54
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1004
mov rcx, rdi
xor ebx, ebx
call qword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
jle 0x1400cfc93
nop dword [rax]
nop word [rax + rax]
movsxd r8, ebx
mov edx, 0x102c
mov r9d, 2
mov rcx, rdi
call qword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 2
jne 0x1400cfc79
lea r9d, [rax - 1]
lea r8, [rsp + 0x2d0]
mov edx, ebx
mov rcx, rdi
call fcn.1400c13c0
lea r8, [rsp + 0x2d0]
lea rdx, [0x14018ee98]
mov rcx, rsi
call fcn.1400fbc58
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1004
mov rcx, rdi
inc ebx
call qword [sym.imp.USER32.dll_SendMessageW]
cmp ebx, eax
jl 0x1400cfc30
mov rcx, rsi
call fcn.1400fa904
mov eax, 1
mov rsi, qword [rsp + 0x5a0]
mov rcx, qword [rsp + 0x560]
xor rcx, rsp
call fcn.1400f9a80
add rsp, 0x570
pop rdi
pop rbp
pop rbx
ret
Function at 0x1400cfcd0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push rbx
push rbp
push rsi
push r14
push r15
sub rsp, 0x570
mov rax, qword [0x1401f7280]
xor rax, rsp
mov qword [rsp + 0x560], rax
mov rsi, rdx
mov r14, r9
mov ebp, ecx
mov r15d, 0xfeff
xor r9d, r9d
xor r8d, r8d
mov rcx, rsi
mov edx, 0x1032
mov word [rsp + 0x30], r15w
call qword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
jne 0x1400cfd42
xor ebx, ebx
xor r9d, r9d
xor r8d, r8d
mov edx, 0x50f
mov rcx, r14
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
call fcn.1400f11b0
xor eax, eax
jmp 0x1400cff08
lea r8, [0x140209500]
lea rdx, str.Slideshow.lst
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x5a0], rdi
call fcn.1400ec0a0
xor ebx, ebx
mov ecx, ebx
lea rdx, [0x140000000]
nop dword [rax]
movzx eax, word [rcx + rdx + 0x183390]
lea rcx, [rcx + 2]
mov word [rsp + rcx + 0x36], ax
test ax, ax
jne 0x1400cfd70
test ebp, ebp
je 0x1400cfda6
mov rcx, rbx
nop dword [rax]
movzx eax, word [rcx + rdx + 0x183d70]
lea rcx, [rcx + 2]
mov word [rsp + rcx + 0x36], ax
test ax, ax
jne 0x1400cfd90
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x40]
call fcn.1400fafe4
mov rdi, rax
test rax, rax
jne 0x1400cfde6
lea r9, [rsp + 0x40]
xor r8d, r8d
mov edx, 0x4e71
mov rcx, r14
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x20], rbx
call fcn.1400f11b0
xor eax, eax
jmp 0x1400cff00
test ebp, ebp
jne 0x1400cfe0f
lea edx, [rbp + 2]
lea r8d, [rbp + 1]
lea rcx, [rsp + 0x30]
mov r9, rax
call fcn.1400faf54
lea rcx, str.__UNICODE_FILE___edit_with_care_____r_n_r_n
mov rdx, rdi
call fcn.1400ff480
jmp 0x1400cfe6d
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.1400fad50
mov edx, 2
lea rcx, [rsp + 0x34]
lea r8d, [rdx - 1]
mov r9, rdi
call fcn.1400fabdc
cmp word [rsp + 0x34], r15w
je 0x1400cfe5f
mov edx, 2
lea rcx, [rsp + 0x30]
mov r9, rdi
lea r8d, [rdx - 1]
call fcn.1400faf54
lea rcx, str.__UNICODE_FILE___edit_with_care_____r_n_r_n
mov rdx, rdi
call fcn.1400ff480
xor edx, edx
mov rcx, rdi
lea r8d, [rdx + 2]
call fcn.1400fad50
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1004
mov rcx, rsi
call qword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
jle 0x1400cfef3
nop word [rax + rax]
movsxd r8, ebx
mov edx, 0x102c
mov r9d, 2
mov rcx, rsi
call qword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 2
jne 0x1400cfed9
lea r9d, [rax - 1]
lea r8, [rsp + 0x2d0]
mov edx, ebx
mov rcx, rsi
call fcn.1400c13c0
lea r8, [rsp + 0x2d0]
lea rdx, str._s_r_n
mov rcx, rdi
call fcn.1400fbc58
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1004
mov rcx, rsi
inc ebx
call qword [sym.imp.USER32.dll_SendMessageW]
cmp ebx, eax
jl 0x1400cfe90
mov rcx, rdi
call fcn.1400fa904
mov eax, 1
mov rdi, qword [rsp + 0x5a0]
mov rcx, qword [rsp + 0x560]
xor rcx, rsp
call fcn.1400f9a80
add rsp, 0x570
pop r15
pop r14
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400d0350
Capabilities:
Get file system object information

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
lea rbp, [rsp - 0x680]
sub rsp, 0x780
mov rax, qword [0x1401f7280]
xor rax, rsp
mov qword [rbp + 0x670], rax
xor edx, edx
mov ebx, ecx
lea rcx, [rsp + 0x30]
lea r8d, [rdx + 0x60]
call fcn.1400f9ab0
lea rcx, [rbp + 0x250]
xor edx, edx
movdqa xmm0, xmmword [0x14018ef90]
movdqa xmmword [rsp + 0x30], xmm0
mov r8d, 0x208
mov dword [rsp + 0x40], 0x67
call fcn.1400f9ab0
lea rcx, [rbp + 0x250]
mov edx, ebx
call fcn.140094e80
test eax, eax
je 0x1400d052e
lea rcx, [rbp - 0x70]
xor edx, edx
mov r8d, 0x2b8
call fcn.1400f9ab0
lea r8, [rbp - 0x70]
lea rcx, [rbp + 0x250]
mov r9d, 0x2b8
xor edx, edx
mov dword [rsp + 0x20], 0x200
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
js 0x1400d0529
lea rcx, [rbp + 0x460]
xor edx, edx
mov r8d, 0x208
mov qword [rsp + 0x798], rdi
call fcn.1400f9ab0
or rbx, 0xffffffffffffffff
mov r8, rbx
lea rax, [rbp - 0x60]
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x1400d0430
mov eax, 0x103
lea rdx, [rbp - 0x60]
lea rcx, [rbp + 0x460]
cmp r8, rax
cmova r8, rax
call fcn.1400fb86c
mov edx, 2
mov ecx, 0x105
call fcn.1400f97a4
mov rdi, rax
test rax, rax
je 0x1400d0521
lea rax, [rbp + 0x250]
mov r8, rbx
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x1400d0480
mov eax, 0x104
lea rdx, [rbp + 0x250]
mov rcx, rdi
cmp r8, rax
cmova r8, rax
call fcn.1400fb86c
lea r8, [rbp + 0x460]
lea rdx, [0x14018ef30]
lea rcx, [rbp + 0x250]
call fcn.1400f98c8
lea rax, [rbp + 0x250]
mov qword [rsp + 0x58], rax
lea rax, [rbp + 0x250]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1400d04d3
mov rcx, qword [0x1401fbb50]
lea r9, [rsp + 0x30]
xor r8d, r8d
mov edx, 0x1132
mov dword [rsp + 0x60], ebx
mov dword [rsp + 0x64], 4
mov dword [rsp + 0x68], 5
mov qword [rsp + 0x70], rdi
call qword [sym.imp.USER32.dll_SendMessageW]
mov r8d, 1
mov rdx, rdi
mov rcx, rax
call fcn.1400d1790
mov rdi, qword [rsp + 0x798]
mov eax, 1
mov rcx, qword [rbp + 0x670]
xor rcx, rsp
call fcn.1400f9a80
mov rbx, qword [rsp + 0x7a0]
add rsp, 0x780
pop rbp
ret

Function at 0x1400d09b0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
xor edi, edi
lea rax, [rsp + 0x30]
mov rbx, rcx
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
lea r9d, [rdi + 1]
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x58], edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400d0a36
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x58]
xor r8d, r8d
mov rdx, rbx
mov dword [rsp + 0x60], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [rsp + 0x58]
test eax, eax
cmovne ecx, edi
mov dword [rsp + 0x58], ecx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x1400d1cc0
Capabilities:
Get disk information
Read .ini file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x660
mov rax, qword [0x1401f7280]
xor rax, rsp
mov qword [rsp + 0x640], rax
mov rbx, rcx
lea rcx, [rsp + 0x230]
xor edx, edx
mov r8d, 0x410
xor edi, edi
call fcn.1400f9ab0
or rax, 0xffffffffffffffff
inc rax
cmp word [rbx + rax*2], di
jne 0x1400d1d02
mov r8d, 0x207
cmp rax, r8
ja 0x1400d1d2a
or r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rbx + r8*2], di
jne 0x1400d1d20
lea rcx, [rsp + 0x230]
mov rdx, rbx
call fcn.1400fb86c
mov rcx, qword [0x1401fbb50]
call fcn.1400d06e0
lea rcx, str.NoDrives
call fcn.1400d09b0
lea r9, [0x140208860]
lea rdx, str.ShowShell
lea rcx, [0x140185d88]
mov r8d, 1
mov esi, eax
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
je 0x1400d1d97
mov ecx, InitCommonControls
call fcn.1400d0350
mov ecx, 5
call fcn.1400d0350
mov ecx, 0x27
call fcn.1400d0350
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x208
mov ebx, eax
call fcn.1400f9ab0
lea rdx, [0x14018ef58]
lea rcx, [rsp + 0x20]
call fcn.1400f98c8
test ebx, ebx
je 0x1400d1e14
movaps xmmword [rsp + 0x650], xmm6
movsd xmm6, qword [0x14018ef88]
test bl, 1
je 0x1400d1e06
movd xmm1, edi
lea eax, [rdi + 0x41]
movaps xmm0, xmm6
mov word [rsp + 0x20], ax
cvtdq2pd xmm1, xmm1
call fcn.1400fc760
cvttsd2si rax, xmm0
test esi, eax
jne 0x1400d1e06
lea rcx, [rsp + 0x20]
call fcn.1400d0110
inc edi
shr ebx, 1
jne 0x1400d1dd6
movaps xmm6, xmmword [rsp + 0x650]
lea rcx, [rsp + 0x230]
call fcn.1400d0fb0
mov rcx, qword [0x1401fbb58]
call qword [sym.imp.USER32.dll_UpdateWindow]
xor eax, eax
mov rcx, qword [rsp + 0x640]
xor rcx, rsp
call fcn.1400f9a80
lea r11, [rsp + 0x660]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret