joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140018ce8
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x140018d6f
mov rsi, rbx
cmp word [rax], bp
je 0x140018d2e
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x140018d18
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x140018d14
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.140016518
mov rdi, rax
test rax, rax
je 0x140018d5c
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.14000d6b0
mov rbp, rdi
xor ecx, ecx
call fcn.140015628
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14001aedc
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x14001aef2
mov al, 1
jmp 0x14001af52
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x14001af03
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x14001af50
mov ecx, dword [rcx + 0x18]
nop
call fcn.140019030
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14001af50
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x14001af50
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x14001af50
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x14001af52
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x14001f170
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14001f198
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14001f198
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140003040
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x1400030b8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x1400030b8
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
add rcx, rbx
and edi, 0xf
jbe 0x1400030a5
nop
cmp rbx, rcx
jae 0x1400030b8
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
add edi, 0xffffffff
jne 0x140003090
cmp rbx, rcx
jae 0x1400030b8
xor eax, eax
cmp word [rbx], ax
cmove rbx, rax
mov rax, rbx
jmp 0x1400030ba
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1400030d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov eax, r8d
mov rbp, rdx
shr eax, 4
mov edi, r8d
inc ax
mov rsi, rcx
movzx edx, ax
mov r8d, 6
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov r14, rax
test rax, rax
je 0x1400031dd
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x1400031dd
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x1400031dd
mov rdx, r14
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
add rcx, rbx
and edi, 0xf
jbe 0x140003175
nop word [rax + rax]
cmp rbx, rcx
jae 0x1400031dd
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
add edi, 0xffffffff
jne 0x140003160
cmp rbx, rcx
jae 0x1400031dd
cmp word [rbx], 0
je 0x1400031dd
mov rax, qword [rsi]
mov ecx, 1
movzx edi, word [rbx]
sub ecx, dword [rax - 8]
mov eax, dword [rax - 0xc]
sub eax, edi
or ecx, eax
jge 0x1400031a1
mov edx, edi
mov rcx, rsi
call fcn.140003780
movzx r9d, word [rbx]
lea r8, [rbx + 2]
mov rcx, qword [rsi]
mov rdx, rdi
call fcn.1401fa6d8
xor edx, edx
test eax, eax
je 0x1400031c4
cmp eax, 0xc
je 0x140003200
cmp eax, 0x50
jne 0x1400031fa
mov rcx, qword [rsi]
cmp edi, dword [rcx - 0xc]
jg 0x140003206
mov dword [rcx - 0x10], edi
mov eax, 1
mov rcx, qword [rsi]
mov word [rcx + rdi*2], dx
jmp 0x1400031df
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
call fcn.14006ddb8
int3
call fcn.14006dddc
int3
mov ecx, 0x80070057
call fcn.1400037e0
int3
Function at 0x140003220
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov r14, rcx
mov edi, edx
mov ecx, edx
call fcn.14006e67c
mov rsi, rax
test rax, rax
jne 0x140003255
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov eax, edi
mov qword [rsp + 0x30], rbx
shr eax, 4
mov r8d, 6
inc ax
mov qword [rsp + 0x38], rbp
movzx edx, ax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbp, rax
test rax, rax
je 0x14000333f
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x14000333f
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x14000333f
mov rdx, rbp
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
add rcx, rbx
and edi, 0xf
jbe 0x1400032da
cmp rbx, rcx
jae 0x14000333f
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
add edi, 0xffffffff
jne 0x1400032c5
cmp rbx, rcx
jae 0x14000333f
cmp word [rbx], 0
je 0x14000333f
mov rax, qword [r14]
mov esi, 1
movzx edi, word [rbx]
mov ecx, esi
sub ecx, dword [rax - 8]
mov eax, dword [rax - 0xc]
sub eax, edi
or ecx, eax
jge 0x140003308
mov edx, edi
mov rcx, r14
call fcn.140003780
movzx r9d, word [rbx]
lea r8, [rbx + 2]
mov rcx, qword [r14]
mov rdx, rdi
call fcn.1401fa6d8
xor ecx, ecx
test eax, eax
je 0x14000332b
cmp eax, 0xc
je 0x140003366
cmp eax, 0x50
jne 0x140003360
mov rax, qword [r14]
cmp edi, dword [rax - 0xc]
jg 0x14000336c
mov dword [rax - 0x10], edi
mov rax, qword [r14]
mov word [rax + rdi*2], cx
jmp 0x140003343
xor ecx, ecx
mov esi, ecx
mov rbx, qword [rsp + 0x30]
mov eax, esi
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
call fcn.14006ddb8
int3
call fcn.14006dddc
int3
mov ecx, 0x80070057
call fcn.1400037e0
int3
Function at 0x140006bc0
Capabilities:
Get storage device properties

Disassembly:
push rbx
push rsi
push rdi
push r15
sub rsp, 0x108
mov rax, qword [0x1402cf910]
xor rax, rsp
mov qword [rsp + 0xf0], rax
mov ebx, edx
mov rsi, rcx
mov r8d, edx
lea rcx, [rsp + 0x70]
lea rdx, str..PhysicalDrive_d
call qword [sym.imp.USER32.dll_wsprintfW]
xor r15d, r15d
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x30], r15
xor r9d, r9d
mov dword [rsp + 0x28], 0x8000000
mov edx, 0xc0000000
mov dword [rsp + 0x20], 3
lea r8d, [r15 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsi + 4], rax
cmp rax, 0xffffffffffffffff
je 0x140006d1c
mov qword [rsp + 0x38], r15
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x30], rcx
lea r9d, [r15 + 0xc]
mov dword [rsi], ebx
lea rcx, [rsp + 0x58]
mov dword [rsp + 0x28], 8
lea r8, [rsp + 0x48]
mov qword [rsp + 0x20], rcx
mov rbx, 0xffffffffffffffff
mov rcx, rax
mov dword [rsi + 0xc], ebx
mov edx, 0x2d1400
mov qword [rsp + 0x4c], r15
mov dword [rsp + 0x48], r15d
mov qword [rsp + 0x58], r15
mov dword [rsp + 0x40], r15d
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x140006d1c
mov qword [rsp + 0x140], rbp
mov qword [rsp + 0x100], r14
mov r14d, dword [rsp + 0x5c]
mov ecx, r14d
call fcn.140037a00
mov rdi, rax
test rax, rax
je 0x140006cca
mov r8d, r14d
xor edx, edx
mov rcx, rax
call fcn.1401f0eb0
jmp 0x140006ccd
mov rdi, r15
mov rcx, qword [rsi + 4]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x38], r15
lea r8, [rsp + 0x48]
mov qword [rsp + 0x30], rax
mov r9d, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
mov dword [rsp + 0x28], r14d
mov edx, 0x2d1400
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov r14, qword [rsp + 0x100]
mov rbp, qword [rsp + 0x140]
test eax, eax
jne 0x140006d45
mov rcx, rdi
call fcn.1401fa848
mov rcx, qword [rsi + 4]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov rcx, qword [rsp + 0xf0]
xor rcx, rsp
call fcn.1401ee030
add rsp, 0x108
pop r15
pop rdi
pop rsi
pop rbx
ret
mov r9d, dword [rdi + 0x10]
add r9, rdi
nop dword [rax]
inc rbx
cmp byte [r9 + rbx], r15b
jne 0x140006d50
inc rbx
mov qword [rsp + 0x60], 0x64
mov r8, rbx
mov qword [rsp + 0x20], rbx
lea rdx, [rsi + 0x10]
lea rcx, [rsp + 0x60]
call fcn.140200aa0
mov eax, dword [rdi + 0x1c]
mov edx, 1
mov rcx, rdi
mov dword [rsi + 0xc], eax
call fcn.140003a90
mov rcx, rsi
call fcn.14004a600
test al, al
je 0x140006d1c
mov rcx, rsi
call fcn.140049cc0
test al, al
je 0x140006d1c
mov al, 1
jmp 0x140006d28
Function at 0x14000c560
Capabilities:
Extract resource via kernel32 functions

Disassembly:
movzx edx, dx
jmp method.CDialogEx.virtual_720
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov qword [rcx + 0xf0], rdx
mov rbp, r8
mov rdi, rdx
mov rbx, rcx
cmp rdx, 0x10000
jae 0x14006f1d7
cmp dword [rcx + 0xe8], 0
jne 0x14006f1d7
movzx eax, di
mov dword [rcx + 0xe8], eax
call fcn.140074f50
mov r8d, 5
mov rdx, rdi
mov rsi, qword [rax + 0x18]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x14006f21b
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x14006f21b
mov r9, rsi
mov r8, rbp
mov rdx, rax
mov rcx, rbx
call fcn.14006f550
jmp 0x14006f21d
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14000de10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0x90
movsxd r10, edx
mov rsi, rcx
mov rdi, r10
test r8d, r8d
je 0x14000dfd8
mov qword [rax + 8], rbx
sub r8d, 1
je 0x14000dfb9
sub r8d, 1
je 0x14000df72
cmp r8d, 1
jne 0x14000df39
lea eax, [r9 - 5]
cmp eax, 0x1a
ja 0x14000df56
xor ebx, ebx
mov dword [rbp - 9], 0xaa555555
mov dword [rbp - 5], 0x4992aaaa
mov dword [rbp - 1], 0x92244929
mov dword [rbp + 3], 0x499224
mov dword [rbp + 7], 0x11110000
mov dword [rbp + 0xb], 0x22222211
mov dword [rbp + 0xf], 0x44333333
mov dword [rbp + 0x13], 0x55554444
mov dword [rbp + 0x17], 0x66666655
mov dword [rbp + 0x1b], 0x88777777
mov dword [rbp + 0x1f], 0x99998888
mov dword [rbp + 0x23], 0xaaaaaa99
mov dword [rbp + 0x27], 0xccbbbbbb
mov dword [rbp + 0x2b], 0xddddcccc
mov dword [rbp + 0x2f], 0xeeeeeedd
mov dword [rbp + 0x33], 0x92ffffff
mov dword [rbp + 0x37], 0x24492449
mov dword [rbp + 0x3b], 0x49922492
mov dword [rbp + 0x3f], 0xb6dbb66d
mov dword [rbp + 0x43], 0x6ddb6ddb
mov byte [rbp + 0x47], UnRegisterTypeLib
test edx, edx
jle 0x14000df39
movsxd r8, r9d
add r8, 0xfffffffffffffffb
lea r8, [r8 + r8*2]
nop dword [rax]
mov eax, 0xaaaaaaab
lea rsi, [rsi + 1]
mul ebx
mov ecx, ebx
inc ebx
shr edx, 1
lea eax, [rdx + rdx*2]
sub ecx, eax
movsxd rax, ecx
add rax, r8
movzx eax, byte [rbp + rax - 9]
mov byte [rsi - 1], al
cmp ebx, r10d
jl 0x14000df10
mov rbx, qword [rsp + 0xa0]
lea r11, [rsp + 0x90]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
test edx, edx
jle 0x14000df39
xor ebx, ebx
nop dword [rax]
call fcn.1401fb0c0
mov byte [rbx + rsi], al
inc rbx
cmp rbx, rdi
jl 0x14000df60
jmp 0x14000df39
mov dword [rbp - 0x19], 0xff00f6
mov word [rbp - 0x15], 0xff00
mov byte [rbp - 0x13], 0
cmp r9d, 4
je 0x14000dfa1
cmp r9d, 7
je 0x14000dfa1
movsxd rax, r9d
mov r8, rdi
movzx edx, byte [rbp + rax - 0x1a]
call fcn.1401f0eb0
jmp 0x14000df39
test edx, edx
jle 0x14000df39
xor ebx, ebx
call fcn.1401fb0c0
mov byte [rbx + rsi], al
inc rbx
cmp rbx, rdi
jl 0x14000dfa7
jmp 0x14000df39
test edx, edx
jle 0x14000df39
xor ebx, ebx
call fcn.1401fb0c0
mov byte [rbx + rsi], al
inc rbx
cmp rbx, rdi
jl 0x14000dfc3
jmp 0x14000df39
mov r8, rdi
xor edx, edx
call fcn.1401f0eb0
jmp 0x14000df41
Function at 0x140015ca0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x58
mov rax, qword [0x1402cf910]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbp, qword [rsp + 0xa0]
mov rsi, rcx
mov rcx, qword [rsp + 0xa8]
mov edi, r8d
movsxd rax, r9d
lea r8, [rsp + 0x3c]
imul rax, rdx
imul edi, r9d
xor r9d, r9d
cmp dword [rcx], 1
mov edx, eax
mov qword [rsp + 0x38], rax
mov rcx, rsi
jne 0x140015d13
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
xor ebx, ebx
lea r9, [rsp + 0x30]
mov r8d, edi
mov qword [rsp + 0x20], rbx
mov rdx, rbp
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x140015d34
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
xor ebx, ebx
lea r9, [rsp + 0x30]
mov r8d, edi
mov qword [rsp + 0x20], rbx
mov rdx, rbp
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
setne bl
mov eax, ebx
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1401ee030
add rsp, 0x58
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14001b470
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov rax, qword [0x1402cf910]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov r14, r8
mov edi, edx
mov esi, ecx
call fcn.14006e454
mov rcx, rax
test rax, rax
je 0x14001b6b0
mov rax, qword [rax]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x30], rbx
mov ebp, 0xffffffff
test esi, esi
jne 0x14001b652
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x1402de108], eax
cmp eax, 0x3e3
je 0x14001b679
test edi, edi
je 0x14001b4e6
inc dword [0x1402de140]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
sub ecx, dword [0x1402de13c]
mov eax, 0x10624dd3
mul ecx
shr edx, 6
cmp edx, dword [0x1402de134]
jbe 0x14001b599
mov eax, dword [0x1402de140]
cmp dword [0x1402de144], eax
jg 0x14001b679
mov dword [0x1402de104], 1
lea rcx, [0x1402de208]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [0x1402de208]
sub rax, qword [0x1402de200]
xorps xmm1, xmm1
cvtsi2sd xmm1, rax
xorps xmm0, xmm0
cvtsi2sd xmm0, qword [0x1402de1f8]
divsd xmm1, xmm0
mov eax, ebp
xorps xmm0, xmm0
ucomisd xmm1, xmm0
jp 0x14001b566
je 0x14001b57a
movd xmm0, dword [0x1402de140]
cvtdq2pd xmm0, xmm0
divsd xmm0, xmm1
cvttsd2si eax, xmm0
cmp dword [0x1402de100], 0
jne 0x14001b58e
mov dword [0x1402de148], eax
jmp 0x14001b679
mov dword [0x1402de14c], eax
jmp 0x14001b679
inc dword [0x1402de144]
call fcn.1401fb0c0
movsxd rdi, eax
call fcn.1401fb0c0
movsxd rsi, eax
imul rsi, rdi
call fcn.1401fb0c0
movsxd r8, eax
imul r8, rsi
mov rax, qword [0x1402de118]
cqo
and edx, 0xfff
lea rcx, [rdx + rax]
sar rcx, 0xc
mov rax, r8
cqo
idiv rcx
shl rdx, 0xc
mov dword [r14 + 0x10], edx
shr rdx, 0x20
mov dword [r14 + 0x14], edx
lea rax, [fcn.14001b470]
mov r9, r14
mov r8d, dword [0x1402de130]
mov rdx, qword [0x1402de128]
mov rcx, qword [0x1402de0f8]
mov qword [rsp + 0x20], rax
cmp dword [0x1402de100], 0
jne 0x14001b623
call qword [sym.imp.KERNEL32.dll_ReadFileEx]
jmp 0x14001b629
call qword [sym.imp.KERNEL32.dll_WriteFileEx]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x1402de108], eax
test edi, edi
je 0x14001b652
test eax, eax
je 0x14001b679
cmp eax, 1
jne 0x14001b652
mov r8, r14
mov edx, eax
xor ecx, ecx
call fcn.14001b470
jmp 0x14001b679
mov rcx, qword [0x1402de0f8]
call qword [sym.imp.KERNEL32.dll_CancelIo]
test eax, eax
jne 0x14001b66f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x1402de108], eax
mov dword [0x1402de104], 4
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], ebp
sub ebp, 1
jg 0x14001b690
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1401ee030
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
mov ecx, 0x80004005
call fcn.1400037e0
int3
Function at 0x14001ee70
Capabilities:
Get common file path
Get file system object information

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x7d0
mov rax, qword [0x1402cf910]
xor rax, rsp
mov qword [rsp + 0x7c0], rax
mov rbx, rcx
call fcn.14006fc48
lea rcx, [rbx + 0x1b0]
call fcn.140042720
mov rax, qword [rbx + 0x1a8]
lea rcx, [rsp + 0x2f0]
mov r8d, 0x2b8
mov edx, dword [rax + 0x60]
mov dword [rbx + 0x2a8], edx
xor edx, edx
call fcn.1401f0eb0
mov r9d, 0x2b8
mov dword [rsp + 0x20], 0x4001
lea r8, [rsp + 0x2f0]
xor edx, edx
lea rcx, [0x140286b98]
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
xor esi, esi
test rax, rax
je 0x14001ef38
lea rdi, [rbx + 0x178]
mov rdx, rax
mov rcx, rdi
call fcn.140072318
test eax, eax
je 0x14001ef38
mov r9d, esi
test rdi, rdi
je 0x14001ef1b
mov r9, qword [rdi + 8]
mov rcx, qword [rbx + 0x470]
xor r8d, r8d
mov edx, 0x1109
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, rax
call fcn.140072870
lea rcx, [rbx + 0x430]
xor r9d, r9d
xor edx, edx
mov r8d, 0x800027
call fcn.14006a4bc
lea rdi, [rbx + 0x348]
mov dword [rsp + 0x20], 0x190
mov rcx, rdi
lea r8, str.Folder
xor r9d, r9d
xor edx, edx
call fcn.14003c980
mov r9d, 1
mov dword [rsp + 0x20], 0x50
mov edx, r9d
lea r8, str.Size
mov rcx, rdi
call fcn.14003c980
mov edx, 0x104
lea rcx, [rsp + 0x5b0]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov r9d, 0x2b8
mov qword [0x1402de160], rsi
lea r8, [rsp + 0x30]
mov qword [0x1402de168], rsi
xor edx, edx
mov dword [rsp + 0x20], 0x101
lea rcx, [rsp + 0x5b0]
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test rax, rax
je 0x14001eff1
mov eax, dword [rsp + 0x38]
mov dword [0x1402de174], eax
mov rax, qword [rsp + 0x30]
mov qword [0x1402de168], rax
mov r9d, 0x2b8
mov dword [rsp + 0x20], 0x103
lea r8, [rsp + 0x30]
xor edx, edx
lea rcx, [rsp + 0x5b0]
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test rax, rax
je 0x14001f02f
mov ecx, dword [rsp + 0x38]
mov dword [0x1402de170], ecx
mov rcx, qword [rsp + 0x30]
mov qword [0x1402de160], rcx
mov rcx, qword [rbx + 0x1a8]
mov eax, 1
mov dword [0x1402de15c], esi
mov qword [rcx + 0x5300], rsi
mov rcx, qword [rbx + 0x1a8]
mov qword [rcx + 0x52f8], rdi
mov rcx, qword [rsp + 0x7c0]
xor rcx, rsp
call fcn.1401ee030
lea r11, [rsp + 0x7d0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x14001f080
Capabilities:
Get file system object information

Disassembly:
push rbx
sub rsp, 0x300
mov rax, qword [0x1402cf910]
xor rax, rsp
mov qword [rsp + 0x2f0], rax
xor eax, eax
mov dword [rsp + 0x20], 0x101
mov r9d, 0x2b8
mov qword [0x1402de160], rax
lea r8, [rsp + 0x30]
mov qword [0x1402de168], rax
xor edx, edx
mov rbx, rcx
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test rax, rax
je 0x14001f0e4
mov eax, dword [rsp + 0x38]
mov dword [0x1402de174], eax
mov rax, qword [rsp + 0x30]
mov qword [0x1402de168], rax
mov r9d, 0x2b8
mov dword [rsp + 0x20], 0x103
lea r8, [rsp + 0x30]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test rax, rax
je 0x14001f11d
mov eax, dword [rsp + 0x38]
mov dword [0x1402de170], eax
mov rax, qword [rsp + 0x30]
mov qword [0x1402de160], rax
mov rcx, qword [rsp + 0x2f0]
xor rcx, rsp
call fcn.1401ee030
add rsp, 0x300
pop rbx
ret
Function at 0x140024fc0
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
lea r8, [rcx + 0x448]
mov rbx, rcx
mov edx, 0x438
mov rcx, rdi
call fcn.140070838
lea r8, [rbx + 0x580]
mov edx, 0x462
mov rcx, rdi
call fcn.140070838
lea r8, [rbx + 0x668]
mov edx, 0x4c3
mov rcx, rdi
call fcn.140070838
lea r8, [rbx + 0x7a0]
mov edx, 0x4c7
mov rcx, rdi
call fcn.140070e78
lea r8, [rbx + 0x7a8]
mov edx, 0x4c8
mov rcx, rdi
call fcn.140070e78
lea r8, [rbx + 0x7b0]
mov edx, 0x4c9
mov rcx, rdi
call fcn.140070e78
lea r8, [rbx + 0x7b8]
mov edx, 0x4ca
mov rcx, rdi
call fcn.140070e78
lea r8, [rbx + 0x7c0]
mov edx, 0x4d3
mov rcx, rdi
call fcn.140070e78
lea r8, [rbx + 0x7c8]
mov edx, 0x4d4
mov rcx, rdi
call fcn.140070e78
lea r8, [rbx + 0x7d0]
mov edx, 0x4d5
mov rcx, rdi
call fcn.140070e78
lea r8, [rbx + 0x7d8]
mov edx, 0x4d6
mov rcx, rdi
call fcn.140070e78
lea r8, [rbx + 0x7e8]
mov edx, 0x4c7
mov rcx, rdi
call fcn.140070838
lea r8, [rbx + 0x978]
mov edx, 0x4c8
mov rcx, rdi
call fcn.140070838
lea r8, [rbx + 0xb08]
mov edx, 0x4c9
mov rcx, rdi
call fcn.140070838
lea r8, [rbx + 0xc98]
mov edx, 0x4ca
mov rcx, rdi
call fcn.140070838
lea r8, [rbx + 0xe28]
mov edx, 0x4d3
mov rcx, rdi
call fcn.140070838
lea r8, [rbx + 0xfb8]
mov edx, 0x4d4
mov rcx, rdi
call fcn.140070838
lea r8, [rbx + 0x1148]
mov edx, 0x4d5
mov rcx, rdi
call fcn.140070838
lea r8, [rbx + 0x12d8]
mov edx, 0x4d6
mov rcx, rdi
call fcn.140070838
lea r8, [rbx + 0x1468]
mov edx, 0x442
mov rcx, rdi
call fcn.140070838
lea r8, [rbx + 0x7e0]
mov edx, 0x442
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.140070e78
Function at 0x14002ae70
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x510
mov rax, qword [0x1402cf910]
xor rax, rsp
mov qword [rsp + 0x500], rax
mov rdi, rcx
xor ebp, ebp
mov dword [rsp + 0x30], ebp
mov byte [rcx + 0x3b8], bpl
cmp byte [rcx + 0x190], bpl
je 0x14002af2f
call fcn.140025970
nop
mov qword [rsp + 0x40], rbp
call fcn.14006e454
mov rcx, rax
test rax, rax
je 0x14002b06e
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x30], 1
lea edx, [rbp + 0x6e]
lea rcx, [rsp + 0x40]
call fcn.140003220
lea rcx, [rdi + 0x580]
mov rbx, qword [rsp + 0x40]
mov rdx, rbx
call fcn.14006a6e8
nop
lea rdx, [rbx - 0x18]
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14002af23
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov byte [rdi + 0x190], 0
jmp 0x14002b03a
call fcn.140025a30
mov rcx, rdi
call fcn.140025560
mov byte [rdi + 0x3b8], 1
lea r8, [rsp + 0x40]
mov edx, 0x4b0
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_K32EnumProcesses]
test eax, eax
je 0x14002af84
mov esi, dword [rsp + 0x40]
shr rsi, 2
test rsi, rsi
je 0x14002af84
mov rbx, rbp
nop dword [rax]
mov edx, dword [rsp + rbx*4 + 0x50]
mov rcx, rdi
call fcn.140029490
inc rbx
cmp rbx, rsi
jl 0x14002af70
lea rcx, [rdi + 0x1a0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], ebp
xor r9d, r9d
lea r8d, [r9 + 2]
mov rdx, qword [rdi + 0x170]
lea rcx, [0x140029e10]
call fcn.1400712c8
nop
mov qword [rsp + 0x38], rbp
call fcn.14006e454
mov rcx, rax
test rax, rax
je 0x14002b063
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 2
mov edx, 0x6d
lea rcx, [rsp + 0x38]
call fcn.140003220
lea rcx, [rdi + 0x580]
mov rbx, qword [rsp + 0x38]
mov rdx, rbx
call fcn.14006a6e8
nop
lea rdx, [rbx - 0x18]
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14002b022
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov byte [rdi + 0x190], 1
mov rax, qword [rdi + 0x170]
mov dword [rax + 0x201a0], 1
mov rcx, qword [rsp + 0x500]
xor rcx, rsp
call fcn.1401ee030
lea r11, [rsp + 0x510]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
mov ecx, 0x80004005
call fcn.1400037e0
nop
mov ecx, 0x80004005
call fcn.1400037e0
int3

Function at 0x1400300d0
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
lea r8, [rcx + 0x5d0]
mov rbx, rcx
mov edx, 0x42b
mov rcx, rdi
call fcn.140070838
lea r8, [rbx + 0x760]
mov edx, 0x42f
mov rcx, rdi
call fcn.140070838
lea r8, [rbx + 0x8f0]
mov edx, 0x42e
mov rcx, rdi
call fcn.140070838
lea r8, [rbx + 0x9d8]
mov edx, 0x42f
mov rcx, rdi
call fcn.140070e78
lea r8, [rbx + 0x9e0]
mov edx, 0x431
mov rcx, rdi
call fcn.140070838
lea r8, [rbx + 0xb70]
mov edx, 0x431
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.140070e78