joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400015a0
Capabilities:
Get disk size

Disassembly:
jmp 0x1400327c0
push rbx
sub rsp, 0x80
mov rax, qword [0x1402cf318]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor ecx, ecx
mov rax, rdx
mov rbx, r8
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rcx
lea r8d, [rcx + 3]
mov dword [rsp + 0x5a], ecx
mov qword [rsp + 0x20], rcx
lea rdx, [rsp + 0x58]
xor r9d, r9d
mov rcx, rax
mov word [rsp + 0x58], 0
call fcn.1401a63d4
lea r9, [rsp + 0x50]
lea rcx, [rsp + 0x58]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x14003291c
mov rax, qword [rsp + 0x50]
test rax, rax
jne 0x140032879
lea ecx, [rax + 0x6e]
call fcn.140001a73
cmp dword [0x1402cc924], 7
mov dword [0x1402cc918], 7
jl 0x140032872
lea r8, [rsp + 0x58]
lea rdx, str.CaptureCore::HasDiskAvailableSpace:_No_available_disk__s__space.
lea rcx, [0x1402cc910]
call fcn.140002036
xor al, al
jmp 0x140032902
test rax, rax
movaps xmmword [rsp + 0x70], xmm6
cvtsi2sd xmm6, rax
jns 0x140032890
addsd xmm6, qword [0x1402563b8]
cmp rax, rbx
mulsd xmm6, qword [0x1402570c8]
jae 0x140032918
mov ecx, 0x6e
call fcn.140001a73
cmp dword [0x1402cc924], 7
mov dword [0x1402cc918], 7
jl 0x1400328fb
test rbx, rbx
cvtsi2sd xmm0, rbx
jns 0x1400328cc
addsd xmm0, qword [0x1402563b8]
mulsd xmm0, qword [0x1402570c8]
movsd xmm3, xmm6
lea r8, [rsp + 0x58]
lea rdx, str.CaptureCore::HasDiskAvailableSpace:_Free_disk__s__space__.2f__MB__is_less_than_required__.2f__MB_.
lea rcx, [0x1402cc910]
movq r9, xmm3
movsd qword [rsp + 0x20], xmm0
call fcn.140002036
xor al, al
movaps xmm6, xmmword [rsp + 0x70]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1401a5800
add rsp, 0x80
pop rbx
ret
mov al, 1
jmp 0x1400328fd
cmp dword [0x1402cc924], 7
mov dword [0x1402cc918], 7
jl 0x140032872
lea r8, [rsp + 0x58]
lea rdx, str.CaptureCore::HasDiskAvailableSpace:_GetDiskFreeSpaceEx__s__failed.
lea rcx, [0x1402cc910]
call fcn.140002036
xor al, al
jmp 0x140032902
Function at 0x1400018fc
Capabilities:
Create directory
Get common file path

Disassembly:
jmp 0x14003cd60
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov ebx, ecx
lea rsi, [0x1402d3ca0]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8023
xor ecx, ecx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rsi
xor edx, edx
repne scasb al, byte [rdi]
mov rax, qword [0x140258df0]
mov rcx, rsi
mov qword [rdi - 1], rax
mov rax, qword [0x140258df8]
mov qword [rdi + 7], rax
mov eax, dword [0x140258e00]
mov dword [rdi + 0xf], eax
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rsi
xor edx, edx
repne scasb al, byte [rdi]
mov rax, qword [str.ShadowPlay]
mov rcx, rsi
mov qword [rdi - 1], rax
mov eax, dword [0x140258de8]
mov dword [rdi + 7], eax
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea rcx, [0x1402d4060]
mov r8, rsi
mov edx, 0x104
call fcn.1401a6fd8
lea r8, str.CaptureCore_v_u.stat
lea rcx, [0x1402d4060]
mov edx, 0x104
call fcn.1401a7138
lea r8, [0x1402d4060]
lea rcx, [0x1402d4060]
mov r9d, ebx
mov edx, 0x104
call fcn.1401a80c0
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
lea rax, [0x1402d4060]
add rsp, 0x30
pop rdi
ret
Function at 0x14000191a
Capabilities:
Get common file path

Disassembly:
jmp 0x14003b9a0
push rdi
sub rsp, 0x260
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rsp + 0x278], rbx
mov rdi, rcx
cmp qword [rcx + 0x18], 0
jne 0x14003bb71
mov edx, 0x104
lea rbx, [0x1402d3a30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x14003b9e5
xor ebx, ebx
jmp 0x14003ba0e
lea rax, [0x140258140]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [0x140252768]
or r8, 0xffffffffffffffff
mov edx, 0x104
mov rcx, rbx
call fcn.1401a5928
xor edx, edx
mov rcx, rbx
call fcn.1400015d2
mov qword [rdi + 0x18], rax
test rax, rax
jne 0x14003ba79
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
lea rax, str.Cant_load_NvFBC.dll
mov qword [rsp + 0x270], rax
lea rdx, [rsp + 0x270]
lea rcx, [rsp + 0x30]
call fcn.1401a793c
nop
lea rax, [0x140257680]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x48], ebx
lea rax, [0x1402576f8]
mov qword [rsp + 0x30], rax
lea rdx, [0x1402cb278]
lea rcx, [rsp + 0x30]
call fcn.1401a5370
int3
lea rdx, str.NvFBC_GetStatusEx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rdi], rax
lea rdx, str.NvFBC_CreateEx
mov rcx, qword [rdi + 0x18]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rdi + 8], rax
lea rdx, str.NvFBC_SetGlobalFlags
mov rcx, qword [rdi + 0x18]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rdi + 0x10], rax
xor edx, edx
mov r8d, 0x200
lea rcx, [rsp + 0x60]
call fcn.1401a5ec0
mov r11, qword [rdi]
test r11, r11
je 0x14003bb0f
lea rcx, [rsp + 0x60]
call r11
test eax, eax
je 0x14003bb0f
mov dword [0x1402cc918], 7
cmp dword [0x1402cc924], 7
jl 0x14003bb05
mov r8d, eax
lea rdx, str.NvFBC_GetStatusEx_failed_with_code__d
lea rcx, [0x1402cc910]
call fcn.140002036
mov ecx, 0x70
call fcn.140001a73
test byte [rsp + 0x64], 1
je 0x14003bb1d
cmp qword [rdi + 8], 0
jne 0x14003bb71
lea rax, str.NvFBC_is_not_supported
mov qword [rsp + 0x270], rax
lea rdx, [rsp + 0x270]
lea rcx, [rsp + 0x30]
call fcn.1401a793c
nop
lea rax, [0x140257680]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x48], 0
lea rax, [0x1402576f8]
mov qword [rsp + 0x30], rax
lea rdx, [0x1402cb278]
lea rcx, [rsp + 0x30]
call fcn.1401a5370
int3
mov rbx, qword [rsp + 0x278]
add rsp, 0x260
pop rdi
ret
Function at 0x140001b8b
Capabilities:
Delete file
Get file size

Disassembly:
jmp 0x140058ca0
push rbx
sub rsp, 0x20
lea rax, [0x14025c310]
mov rbx, rcx
mov qword [rcx], rax
mov rcx, qword [rcx + 8]
test rcx, rcx
je 0x140058d89
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x38], rdi
mov dword [rsp + 0x30], 0
xor dil, dil
call qword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
je 0x140058cf9
mov ecx, dword [rsp + 0x30]
mov eax, eax
movzx edi, dil
shl rcx, 0x20
add rcx, rax
mov eax, 1
cmove edi, eax
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x140058d36
cmp dword [0x1402cc924], 7
mov dword [0x1402cc918], 7
jl 0x140058d36
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.FileWriter::FileWriter:_Cannot_close_handle___errno___d
lea rcx, [0x1402cc910]
mov r8d, eax
call fcn.140002036
test dil, dil
mov rdi, qword [rsp + 0x38]
mov qword [rbx + 8], 0xffffffffffffffff
je 0x140058d89
lea rcx, [rbx + 0x12]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x140058d89
cmp dword [0x1402cc924], 7
mov dword [0x1402cc918], 7
jl 0x140058d89
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, [rbx + 0x12]
lea rdx, str.FileWriter::FileWriter:_could_not_delete_empty_file__s__errno___d
lea rcx, [0x1402cc910]
mov r9d, eax
call fcn.140002036
add rsp, 0x20
pop rbx
ret

Function at 0x140007080
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
mov esi, eax
movabs eax, dword [0xda8b088900409214]
test ebx, ebx
jle 0x1400070a1
mov eax, 0xff
call fcn.140002680
xor byte [rsi], al
jne 0x140007091
pop rsi
pop rbx
ret
Function at 0x14001fa40
Capabilities:
Get common file path
Link many functions at runtime

Disassembly:
jmp 0x14001fa40
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
xor eax, eax
mov rbx, rcx
lea rdi, [0x1402d2320]
mov dword [rcx + 0x74], eax
mov dword [rcx + 0x78], eax
mov dword [rcx + 0x7c], eax
mov dword [rcx + 0x80], eax
mov dword [rcx + 0x84], eax
mov dword [rcx + 0x88], eax
mov dword [rcx + 0x8c], eax
mov dword [rcx + 0x90], eax
mov byte [rcx + 8], al
mov qword [rcx], rax
mov byte [rcx + 0x70], al
mov edx, 0x104
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea r11, str.mf.dll
lea r9, [0x140252768]
mov qword [rsp + 0x28], r11
or r8, 0xffffffffffffffff
mov edx, 0x104
mov rcx, rdi
mov qword [rsp + 0x20], rdi
call fcn.1401a5928
xor edx, edx
mov rcx, rdi
call fcn.1400015d2
mov edx, 0x104
mov rcx, rdi
mov qword [rbx + 0x10], rax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea r11, str.mfplat.dll
mov qword [rsp + 0x28], r11
lea r9, [0x140252768]
or r8, 0xffffffffffffffff
mov edx, 0x104
mov rcx, rdi
mov qword [rsp + 0x20], rdi
call fcn.1401a5928
xor edx, edx
mov rcx, rdi
call fcn.1400015d2
xor edx, edx
lea rcx, [rbx + 0x20]
lea r8d, [rdx + 0x50]
mov qword [rbx + 0x18], rax
call fcn.1401a5ec0
cmp qword [rbx + 0x10], 0
je 0x14001fc05
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x14001fc05
lea rdx, str.MFStartup
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 0x18]
lea rdx, str.MFShutdown
mov qword [rbx + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 0x18]
lea rdx, str.MFCreateSystemTimeSource
mov qword [rbx + 0x28], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 0x18]
lea rdx, str.MFCreateMemoryBuffer
mov qword [rbx + 0x30], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 0x18]
lea rdx, str.MFCreateSample
mov qword [rbx + 0x38], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 0x18]
lea rdx, str.MFCreateFile
mov qword [rbx + 0x40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 0x18]
lea rdx, str.MFCreateMediaType
mov qword [rbx + 0x48], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 0x18]
lea rdx, str.MFTEnum
mov qword [rbx + 0x50], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 0x10]
lea rdx, str.MFCreateMPEG4MediaSink
mov qword [rbx + 0x58], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 0x10]
lea rdx, str.MFCreatePresentationClock
mov qword [rbx + 0x60], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x68], rax
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x1400258e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
jmp 0x1400258e0
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x20
mov r12d, ecx
movzx r13d, dx
lea rcx, [0x1402dad10]
xor r14d, r14d
xor edx, edx
mov rbx, r14
call fcn.140119488
lea ebp, [r14 + 1]
test rax, rax
mov rsi, rax
je 0x1400259f6
nop
nop
test rbx, rbx
jne 0x1400259f6
mov eax, r12d
lea edx, [rbx + 6]
movzx r9d, r13w
shr eax, 4
mov rcx, rsi
add ax, 1
movzx r8d, ax
call qword [sym.imp.KERNEL32.dll_FindResourceExA]
test rax, rax
mov rdi, rax
jne 0x140025964
mov rbx, r14
jmp 0x1400259d9
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x14002597a
mov rbx, r14
jmp 0x1400259d4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
mov rbx, rax
jne 0x140025990
mov rbx, r14
jmp 0x1400259d4
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, r12d
mov r11d, eax
add r11, rbx
and ecx, 0xf
jbe 0x1400259c2
nop
nop
cmp rbx, r11
jae 0x1400259c7
add ecx, 0xffffffff
movzx eax, word [rbx]
lea rbx, [rbx + rax*2 + 2]
jne 0x1400259b0
cmp rbx, r11
jb 0x1400259cc
mov rbx, r14
jmp 0x1400259d4
cmp word [rbx], r14w
cmove rbx, r14
test rbx, rbx
jne 0x140025a17
lea rcx, [0x1402dad10]
mov edx, ebp
call fcn.140119488
add ebp, 1
test rax, rax
mov rsi, rax
jne 0x140025930
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop r13
pop r12
ret
mov rax, rsi
jmp 0x1400259f8
Function at 0x1400327c0
Capabilities:
Get disk size

Disassembly:
jmp 0x1400327c0
push rbx
sub rsp, 0x80
mov rax, qword [0x1402cf318]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor ecx, ecx
mov rax, rdx
mov rbx, r8
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rcx
lea r8d, [rcx + 3]
mov dword [rsp + 0x5a], ecx
mov qword [rsp + 0x20], rcx
lea rdx, [rsp + 0x58]
xor r9d, r9d
mov rcx, rax
mov word [rsp + 0x58], 0
call fcn.1401a63d4
lea r9, [rsp + 0x50]
lea rcx, [rsp + 0x58]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x14003291c
mov rax, qword [rsp + 0x50]
test rax, rax
jne 0x140032879
lea ecx, [rax + 0x6e]
call fcn.140001a73
cmp dword [0x1402cc924], 7
mov dword [0x1402cc918], 7
jl 0x140032872
lea r8, [rsp + 0x58]
lea rdx, str.CaptureCore::HasDiskAvailableSpace:_No_available_disk__s__space.
lea rcx, [0x1402cc910]
call fcn.140002036
xor al, al
jmp 0x140032902
test rax, rax
movaps xmmword [rsp + 0x70], xmm6
cvtsi2sd xmm6, rax
jns 0x140032890
addsd xmm6, qword [0x1402563b8]
cmp rax, rbx
mulsd xmm6, qword [0x1402570c8]
jae 0x140032918
mov ecx, 0x6e
call fcn.140001a73
cmp dword [0x1402cc924], 7
mov dword [0x1402cc918], 7
jl 0x1400328fb
test rbx, rbx
cvtsi2sd xmm0, rbx
jns 0x1400328cc
addsd xmm0, qword [0x1402563b8]
mulsd xmm0, qword [0x1402570c8]
movsd xmm3, xmm6
lea r8, [rsp + 0x58]
lea rdx, str.CaptureCore::HasDiskAvailableSpace:_Free_disk__s__space__.2f__MB__is_less_than_required__.2f__MB_.
lea rcx, [0x1402cc910]
movq r9, xmm3
movsd qword [rsp + 0x20], xmm0
call fcn.140002036
xor al, al
movaps xmm6, xmmword [rsp + 0x70]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1401a5800
add rsp, 0x80
pop rbx
ret
mov al, 1
jmp 0x1400328fd
cmp dword [0x1402cc924], 7
mov dword [0x1402cc918], 7
jl 0x140032872
lea r8, [rsp + 0x58]
lea rdx, str.CaptureCore::HasDiskAvailableSpace:_GetDiskFreeSpaceEx__s__failed.
lea rcx, [0x1402cc910]
call fcn.140002036
xor al, al
jmp 0x140032902
Function at 0x14003b9a0
Capabilities:
Get common file path

Disassembly:
jmp 0x14003b9a0
push rdi
sub rsp, 0x260
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rsp + 0x278], rbx
mov rdi, rcx
cmp qword [rcx + 0x18], 0
jne 0x14003bb71
mov edx, 0x104
lea rbx, [0x1402d3a30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x14003b9e5
xor ebx, ebx
jmp 0x14003ba0e
lea rax, [0x140258140]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [0x140252768]
or r8, 0xffffffffffffffff
mov edx, 0x104
mov rcx, rbx
call fcn.1401a5928
xor edx, edx
mov rcx, rbx
call fcn.1400015d2
mov qword [rdi + 0x18], rax
test rax, rax
jne 0x14003ba79
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
lea rax, str.Cant_load_NvFBC.dll
mov qword [rsp + 0x270], rax
lea rdx, [rsp + 0x270]
lea rcx, [rsp + 0x30]
call fcn.1401a793c
nop
lea rax, [0x140257680]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x48], ebx
lea rax, [0x1402576f8]
mov qword [rsp + 0x30], rax
lea rdx, [0x1402cb278]
lea rcx, [rsp + 0x30]
call fcn.1401a5370
int3
lea rdx, str.NvFBC_GetStatusEx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rdi], rax
lea rdx, str.NvFBC_CreateEx
mov rcx, qword [rdi + 0x18]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rdi + 8], rax
lea rdx, str.NvFBC_SetGlobalFlags
mov rcx, qword [rdi + 0x18]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rdi + 0x10], rax
xor edx, edx
mov r8d, 0x200
lea rcx, [rsp + 0x60]
call fcn.1401a5ec0
mov r11, qword [rdi]
test r11, r11
je 0x14003bb0f
lea rcx, [rsp + 0x60]
call r11
test eax, eax
je 0x14003bb0f
mov dword [0x1402cc918], 7
cmp dword [0x1402cc924], 7
jl 0x14003bb05
mov r8d, eax
lea rdx, str.NvFBC_GetStatusEx_failed_with_code__d
lea rcx, [0x1402cc910]
call fcn.140002036
mov ecx, 0x70
call fcn.140001a73
test byte [rsp + 0x64], 1
je 0x14003bb1d
cmp qword [rdi + 8], 0
jne 0x14003bb71
lea rax, str.NvFBC_is_not_supported
mov qword [rsp + 0x270], rax
lea rdx, [rsp + 0x270]
lea rcx, [rsp + 0x30]
call fcn.1401a793c
nop
lea rax, [0x140257680]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x48], 0
lea rax, [0x1402576f8]
mov qword [rsp + 0x30], rax
lea rdx, [0x1402cb278]
lea rcx, [rsp + 0x30]
call fcn.1401a5370
int3
mov rbx, qword [rsp + 0x278]
add rsp, 0x260
pop rdi
ret
Function at 0x14003cd60
Capabilities:
Create directory
Get common file path

Disassembly:
jmp 0x14003cd60
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov ebx, ecx
lea rsi, [0x1402d3ca0]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8023
xor ecx, ecx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rsi
xor edx, edx
repne scasb al, byte [rdi]
mov rax, qword [0x140258df0]
mov rcx, rsi
mov qword [rdi - 1], rax
mov rax, qword [0x140258df8]
mov qword [rdi + 7], rax
mov eax, dword [0x140258e00]
mov dword [rdi + 0xf], eax
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rsi
xor edx, edx
repne scasb al, byte [rdi]
mov rax, qword [str.ShadowPlay]
mov rcx, rsi
mov qword [rdi - 1], rax
mov eax, dword [0x140258de8]
mov dword [rdi + 7], eax
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea rcx, [0x1402d4060]
mov r8, rsi
mov edx, 0x104
call fcn.1401a6fd8
lea r8, str.CaptureCore_v_u.stat
lea rcx, [0x1402d4060]
mov edx, 0x104
call fcn.1401a7138
lea r8, [0x1402d4060]
lea rcx, [0x1402d4060]
mov r9d, ebx
mov edx, 0x104
call fcn.1401a80c0
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
lea rax, [0x1402d4060]
add rsp, 0x30
pop rdi
ret
Function at 0x14003ce90
Capabilities:
Get file version info

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x258
mov rax, qword [0x1402cf318]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rsi, rdx
lea rdx, [rsp + 0x34]
xor edi, edi
mov r13, r8
mov r12, rcx
mov dword [rsp + 0x34], edi
call sub.VERSION.dll_GetFileVersionInfoSizeW
xor bl, bl
test eax, eax
mov ebp, eax
je 0x14003d008
mov rcx, 0xffffffffffffffff
mov eax, 2
mov qword [rsp + 0x250], r14
mul rbp
cmovo rax, rcx
mov rcx, rax
call fcn.14011b374
mov edx, dword [rsp + 0x34]
mov r8d, ebp
mov r9, rax
mov rcx, r12
mov r14, rax
call sub.VERSION.dll_GetFileVersionInfoW
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x38]
lea rdx, str.VarFileInfoTranslation
mov rcx, r14
mov dword [rsp + 0x30], edi
call sub.VERSION.dll_VerQueryValueW
mov r11, qword [rsp + 0x38]
lea rax, [0x140258eb8]
movsx ecx, word [r11 + 4]
movsx r9d, word [r11]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ecx
lea r8, str.StringFileInfo_04x_04x_s
lea rcx, [rsp + 0x40]
mov edx, 0x100
call fcn.1401a5904
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x40]
mov rcx, r14
call sub.VERSION.dll_VerQueryValueW
mov r11d, dword [rsp + 0x30]
cmp r11, qword [r13]
mov rax, r11
jae 0x14003cff1
test r11d, r11d
je 0x14003cfc7
nop
nop
mov rax, qword [rsp + 0x38]
lea rcx, str._:____
movzx ebx, word [rax + rdi*2]
movzx edx, bx
call fcn.1401a82c4
mov r11d, dword [rsp + 0x30]
mov ecx, 0x20
test rax, rax
cmove cx, bx
add rdi, 1
cmp rdi, r11
mov word [rsi + rdi*2 - 2], cx
jb 0x14003cf90
lea rax, [rdi - 1]
test rax, rax
je 0x14003cfe9
lea rax, [rsi + rdi*2 - 2]
cmp word [rax], 0x20
jne 0x14003cfe9
sub rdi, 1
sub rax, 2
cmp rdi, 1
ja 0x14003cfd5
mov word [rsi + rdi*2], 0
mov bl, 1
mov ecx, r11d
mov qword [r13], rcx
mov rcx, r14
call fcn.1401a5a6c
mov r14, qword [rsp + 0x250]
mov al, bl
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1401a5800
add rsp, 0x258
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14004bd60
Capabilities:
Get common file path

Disassembly:
jmp 0x14004bd60
mov rax, rsp
push r12
sub rsp, 0x2a0
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1402cf318]
xor rax, rsp
mov qword [rsp + 0x290], rax
xor r12d, r12d
mov ebx, r12d
mov dword [rsp + 0x38], r12d
xor bpl, bpl
call fcn.14011d930
test eax, eax
jne 0x14004be6a
xor edx, edx
lea r8d, [r12 + 0x30]
lea rcx, [rsp + 0x4c]
call fcn.1401a5ec0
mov dword [rsp + 0x48], 0x20034
lea rcx, [rsp + 0x48]
call fcn.1401540a0
test eax, eax
jne 0x14004be6a
cmp dword [rsp + 0x4c], ebx
jne 0x14004bdee
mov bpl, 1
lea ebx, [rax + 0x20]
jmp 0x14004be6a
mov qword [rsp + 0x80], r12
xor edx, edx
mov r8d, 0x1f8
lea rcx, [rsp + 0x88]
call fcn.1401a5ec0
mov dword [rsp + 0x34], r12d
mov dword [rsp + 0x30], r12d
lea rdx, [rsp + 0x34]
lea rcx, [rsp + 0x80]
call fcn.140125cc0
test eax, eax
jne 0x14004be6a
mov eax, dword [rsp + 0x34]
test eax, eax
je 0x14004be6a
mov edi, r12d
test eax, eax
jle 0x14004be6a
lea rsi, [rsp + 0x80]
lea rdx, [rsp + 0x30]
mov rcx, qword [rsi]
call fcn.14012aa20
test eax, eax
jne 0x14004be5d
cmp dword [rsp + 0x30], 1
jne 0x14004be5d
or ebx, 0x10
add edi, 1
add rsi, 8
cmp edi, dword [rsp + 0x34]
jl 0x14004be42
lea rcx, [rsp + 0x38]
call fcn.140001280
test al, al
je 0x14004be8f
test bpl, bpl
jne 0x14004be8c
cmp dword [rsp + 0x38], 0x82db
jae 0x14004be8f
or ebx, 4
jmp 0x14004be8f
or ebx, 8
mov eax, dword [0x1402d7144]
test al, 1
jne 0x14004bebb
or eax, 1
mov dword [0x1402d7144], eax
lea rcx, [0x1402d59c0]
call fcn.1400026a3
lea rcx, [0x14024c140]
call fcn.1401a51b4
nop
cmp byte [0x1402d59d8], 0
jne 0x14004bf5f
mov edx, 0x104
lea rcx, [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea r11, str.dwmapi.dll
mov qword [rsp + 0x28], r11
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
lea r9, [0x140252768]
or r8, 0xffffffffffffffff
mov edx, 0x104
lea rcx, [rsp + 0x80]
call fcn.1401a5928
xor edx, edx
lea rcx, [rsp + 0x80]
call fcn.1400015d2
mov rdi, rax
test rax, rax
je 0x14004bf5f
lea rdx, str.DwmIsCompositionEnabled
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14004bf56
mov dword [rsp + 0x30], r12d
lea rcx, [rsp + 0x30]
call rax
test eax, eax
jne 0x14004bf56
cmp dword [rsp + 0x30], eax
jne 0x14004bf56
or ebx, 0x40
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 1
test ebx, ebx
cmove ebx, eax
mov eax, ebx
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.1401a5800
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret
Function at 0x1400521f0
Capabilities:
Query or enumerate registry value

Disassembly:
jmp 0x1400521f0
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
xor bl, bl
test rdx, rdx
mov rdi, r9
mov rsi, r8
mov rbp, rdx
mov qword [rsp + 0x48], 0
je 0x1400522bc
test r8, r8
je 0x1400522bc
test r9, r9
je 0x1400522bc
mov edx, dword [rcx + 0x804]
test edx, edx
je 0x140052247
sub edx, 1
je 0x1400522ac
cmp edx, 2
jne 0x1400522a8
lea rdx, [rcx + 0x400]
mov rcx, 0xffffffff80000001
lea rax, [rsp + 0x48]
mov r9d, 0x101
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1400522a8
mov rcx, qword [rsp + 0x48]
xor r9d, r9d
xor r8d, r8d
mov rdx, rbp
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x48]
mov edx, 1
test eax, eax
movzx ebx, bl
cmove ebx, edx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
jmp 0x1400522be
lea rdx, [rcx + 0x400]
mov rcx, 0xffffffff80000002
jmp 0x140052255
xor al, al
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret

Function at 0x140058bd0
Capabilities:
Delete file

Disassembly:
jmp 0x140058bd0
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x48], rbx
mov rbx, rcx
mov dword [rcx + 0x78], 0x67
mov rcx, qword [rcx]
test rcx, rcx
je 0x140058c06
call fcn.1401a5a6c
mov qword [rbx], 0
mov rdi, qword [rbx + 0x38]
test rdi, rdi
je 0x140058c37
mov rcx, qword [rdi]
test rcx, rcx
je 0x140058c1d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rdi + 8]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, rdi
call fcn.1401a46a0
mov qword [rbx + 0x38], 0
lea rcx, [rbx + 0x50]
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]