joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140002db0
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x460
mov rax, qword [0x14014dcf0]
xor rax, rsp
mov qword [rsp + 0x450], rax
mov rbx, rdx
xor edi, edi
mov r8d, 0x104
mov dword [rdx], edi
lea rdx, [rsp + 0x240]
call qword [sym.imp.KERNEL32.dll_GetVolumePathNameW]
test eax, eax
je 0x140002eb7
mov dword [rsp + 0x38], pe_nt_image_headers64
lea rax, [rsp + 0x40]
lea rcx, [rsp + 0x240]
mov qword [rsp + 0x30], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x140002eb7
lea r8d, [rdi + 4]
lea rdx, str.NTFS
lea rcx, [rsp + 0x40]
call fcn.1400a5640
test eax, eax
jne 0x140002e50
mov dword [rbx], 2
lea eax, [rdi + 1]
jmp 0x140002eb9
mov qword [rsp + 0x480], rsi
mov esi, 3
lea rdx, [0x1400ca270]
lea rcx, [rsp + 0x40]
mov r8d, esi
call fcn.1400a5640
test eax, eax
jne 0x140002e8a
mov rsi, qword [rsp + 0x480]
mov dword [rbx], 1
mov eax, 1
jmp 0x140002eb9
lea rdx, str.exFAT
lea rcx, [rsp + 0x40]
mov r8d, 5
call fcn.1400a55a8
test eax, eax
mov eax, 1
cmove edi, esi
mov rsi, qword [rsp + 0x480]
mov dword [rbx], edi
jmp 0x140002eb9
xor eax, eax
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.1400a4e70
mov rbx, qword [rsp + 0x488]
add rsp, 0x460
pop rdi
ret

Function at 0x140002ee0
Capabilities:
Get disk size

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x460
mov rax, qword [0x14014dcf0]
xor rax, rsp
mov qword [rsp + 0x450], rax
mov rbx, r9
mov qword [r9], 0xffffffffffffffff
mov rdi, r8
mov r8, rdx
lea r9, [rsp + 0x24]
lea rcx, [rsp + 0x240]
mov edx, 0x208
call fcn.14001ca70
cmp dword [rsp + 0x24], 0
je 0x140002f37
xor eax, eax
mov qword [rdi], rax
jmp 0x140002fc1
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x240]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetVolumePathNameW]
test eax, eax
jne 0x140002f5b
mov eax, 1
jmp 0x140002fc1
lea rcx, [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x140002f54
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
call fcn.140002db0
test eax, eax
je 0x140002f54
mov ecx, dword [rsp + 0x20]
dec ecx
je 0x140002fb7
dec ecx
je 0x140002fab
dec ecx
je 0x140002f9f
mov qword [rbx], 0xffffffffffffffff
jmp 0x140002fbf
movabs rax, 0x1ffffffffffffff
jmp 0x140002fbc
movabs rax, 0xfffffff0000
jmp 0x140002fbc
mov eax, 0xffffffff
mov qword [rbx], rax
xor eax, eax
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.1400a4e70
mov rbx, qword [rsp + 0x470]
add rsp, 0x460
pop rdi
ret
Function at 0x140002ff0
Capabilities:
Get disk information
Get volume information via ioctl

Disassembly:
push rbp
push rsi
sub rsp, 0x1d8
mov rax, qword [0x14014dcf0]
xor rax, rsp
mov qword [rsp + 0x1b0], rax
mov rbp, rdx
mov rsi, r8
lea rdx, [rsp + 0xb0]
mov r8d, 0x80
call qword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointW]
test eax, eax
je 0x14000313f
or rcx, 0xffffffffffffffff
xor eax, eax
mov qword [rsp + 0x1d0], rbx
mov qword [rsp + 0x1c8], rdi
lea rdi, [rsp + 0xb0]
repne scasw ax, word [rdi]
not rcx
dec rcx
je 0x14000305a
dec rcx
xor edi, edi
cmp word [rsp + rcx*2 + 0xb0], 0x5c
jne 0x14000306f
mov word [rsp + rcx*2 + 0xb0], di
xor r9d, r9d
mov qword [rsp + 0x30], rdi
lea rcx, [rsp + 0xb0]
lea r8d, [r9 + 3]
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x1400030ae
xor eax, eax
jmp 0x14000312f
mov qword [rsp + 0x38], rdi
lea rax, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x50]
xor r8d, r8d
mov edx, 0x90064
mov rcx, rbx
mov dword [rsp + 0x28], 0x60
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x1c0], r12
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov r12d, eax
test eax, eax
je 0x14000310b
test rbp, rbp
je 0x140003100
mov rcx, qword [rsp + 0x58]
mov qword [rbp], rcx
test rsi, rsi
je 0x14000310b
mov ecx, dword [rsp + 0x78]
mov dword [rsi], ecx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rbx
mov edi, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, r12d
mov r12, qword [rsp + 0x1c0]
mov rbx, qword [rsp + 0x1d0]
mov rdi, qword [rsp + 0x1c8]
mov rcx, qword [rsp + 0x1b0]
xor rcx, rsp
call fcn.1400a4e70
add rsp, 0x1d8
pop rsi
pop rbp
ret
Function at 0x140003180
Capabilities:
Get disk information

Disassembly:
push rbx
push rsi
push rdi
push r12
sub rsp, 0x178
mov rax, qword [0x14014dcf0]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov rsi, rdx
movabs rax, 0x5c003a0041
lea rdx, str.Mounting_volume_..._r_n
mov edi, r9d
mov rbx, r8
mov r12, rcx
mov dword [rsp + 0x40], 0xffffffff
mov qword [rsp + 0x50], rax
call fcn.1400011e0
mov ecx, dword [rsp + 0x1c0]
lea r8, [rsp + 0x40]
mov r9, rbx
mov dword [rsp + 0x28], ecx
mov rcx, r12
mov rdx, rsi
mov dword [rsp + 0x20], edi
call fcn.140002c80
mov edi, eax
test eax, eax
je 0x1400031fe
or ebx, 0xffffffff
jmp 0x14000336f
mov ebx, dword [rsp + 0x40]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x50]
add word [rsp + 0x50], bx
call fcn.140002db0
test eax, eax
jne 0x140003230
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor edi, edi
cmp eax, 0x3ed
setne dil
jmp 0x14000336f
mov eax, dword [rsp + 0x40]
test eax, eax
je 0x140003244
cmp eax, 2
je 0x140003244
xor edi, edi
jmp 0x14000336f
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x50]
mov r8d, 0x80
call qword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointW]
test eax, eax
jne 0x140003266
lea edi, [rax + 1]
jmp 0x14000336f
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x60]
repne scasw ax, word [rdi]
not rcx
dec rcx
je 0x14000327f
dec rcx
xor edi, edi
cmp word [rsp + rcx*2 + 0x60], 0x5c
jne 0x14000328e
mov word [rsp + rcx*2 + 0x60], di
lea r8, [rsp + 0x40]
lea rcx, [rsp + 0x50]
xor edx, edx
call fcn.140002ff0
test eax, eax
jne 0x1400032ab
lea edi, [rax + 1]
jmp 0x14000336f
lea rdx, str.Extending_file_system_..._r_n
mov rcx, r12
mov qword [rsp + 0x170], rbp
call fcn.1400011e0
mov ecx, dword [rsp + 0x40]
mov rax, qword [rsp + 0x1c8]
xor edx, edx
mov qword [rsp + 0x30], rdi
mov esi, 1
div rcx
lea r8d, [rsi + 2]
lea rcx, [rsp + 0x60]
xor r9d, r9d
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x140003346
mov qword [rsp + 0x38], rdi
lea rax, [rsp + 0x40]
lea r9d, [rsi + 7]
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x48]
mov edx, 0x900f0
mov rcx, rbp
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
cmovne esi, edi
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp rbp, 0xffffffffffffffff
je 0x14000335d
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rbp, qword [rsp + 0x170]
mov edi, esi
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test ebx, ebx
js 0x14000339a
lea rdx, str.Unmounting_volume_..._r_n
mov rcx, r12
call fcn.1400011e0
mov r8d, 1
mov edx, ebx
mov rcx, r12
call fcn.14002b0f0
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1400a4e70
add rsp, 0x178
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400043e0
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x20
xor ebx, ebx
xor r9d, r9d
xor edx, edx
lea r8d, [rbx + 1]
xor ecx, ecx
mov qword [0x14014fbb0], rbx
mov qword [0x14014fb90], rbx
mov qword [0x14014fba0], rbx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x14014fbb0], rax
test rax, rax
je 0x140004457
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x14014fb90], rax
test rax, rax
je 0x140004457
movsxd rcx, dword [0x140146178]
call fcn.1400a4fcc
mov qword [0x14014fba0], rax
test rax, rax
jne 0x1400044a4
lea ecx, [rbx + 0xe]
call qword [sym.imp.KERNEL32.dll_SetLastError]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x14014fbb0]
mov ebx, eax
test rcx, rcx
je 0x140004471
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x14014fb90]
test rcx, rcx
je 0x140004483
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x14014fba0]
test rcx, rcx
je 0x140004494
call fcn.1400a4f8c
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov dword [0x14014fb98], ebx
lea rcx, [0x1400042f0]
xor r8d, r8d
xor edx, edx
mov dword [0x14014fb9c], ebx
call fcn.1400a52f4
mov qword [0x14014fba8], rax
cmp rax, 0xffffffffffffffff
je 0x140004457
mov dword [0x14014fbbc], 1
mov eax, 1
add rsp, 0x20
pop rbx
ret

Function at 0x140004560
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rbx, r8
movsxd r8, dword [r8]
mov rdi, rdx
mov rsi, rcx
test r8d, r8d
je 0x14000468c
mov eax, dword [0x14014fbc8]
mov rcx, rdi
imul rax, qword [r9]
mov r9, qword [rsp + 0x70]
sub rax, r8
cqo
and edx, 0x1ff
add rax, rdx
sar rax, 9
mov qword [rsp + 0x30], rax
mov eax, r8d
cdq
and edx, 0x1ff
lea r8d, [rdx + rax]
lea rdx, [rsp + 0x30]
sar r8d, 9
call fcn.140014dc0
mov r11d, dword [0x14014fbbc]
test r11d, r11d
je 0x140004665
mov rcx, qword [0x14014fbb0]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0xffffffff
je 0x140004611
mov eax, dword [0x14014fb9c]
test eax, eax
je 0x140004623
mov rcx, qword [0x14014fbb0]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, dword [0x14014fb9c]
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
movsxd r8, dword [rbx]
mov rcx, qword [0x14014fba0]
mov rdx, rdi
call fcn.1400a4990
mov eax, dword [rbx]
mov rcx, qword [0x14014fb90]
mov qword [0x14014fbc0], rsi
mov dword [0x14014fbb8], eax
call qword [sym.imp.KERNEL32.dll_SetEvent]
test eax, eax
jne 0x140004686
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov r8d, dword [rbx]
lea r9, [rsp + 0x60]
mov rdx, rdi
mov rcx, rsi
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140004611
mov dword [rbx], 0
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov eax, 1
add rsp, 0x40
pop rdi
ret
Function at 0x140004bf0
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
or rcx, 0xffffffffffffffff
mov r11, rax
xor eax, eax
mov rdi, rbx
repne scasb al, byte [rdi]
mov rdi, rbx
not rcx
lea rdx, [rcx - 1]
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
mov rdi, rbx
not rcx
dec rcx
rep stosb byte [rdi], al
test rdx, rdx
je 0x140004c4a
nop word [rax + rax]
mov byte [rbx], al
inc rbx
dec rdx
jne 0x140004c40
or rcx, 0xffffffffffffffff
mov rdi, r11
repne scasw ax, word [rdi]
mov rdi, r11
not rcx
lea rdx, [rcx - 1]
or rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
mov rdi, r11
not rcx
dec rcx
add rcx, rcx
add rdx, rdx
rep stosb byte [rdi], al
je 0x140004c8b
nop dword [rax + rax]
mov byte [r11], al
inc r11
dec rdx
jne 0x140004c80
mov rcx, qword [0x140150400]
test rcx, rcx
je 0x140004ca8
call qword [sym.imp.GDI32.dll_DeleteObject]
mov qword [0x140150400], 0
mov edx, 0x88
lea r8, [0x14014fbe0]
xor eax, eax
mov rdi, r8
mov ecx, edx
mov r9d, edx
rep stosb byte [rdi], al
mov byte [r8], al
inc r8
dec r9
jne 0x140004cc0
lea r8, [0x14014fc70]
mov rcx, rdx
mov rdi, r8
rep stosb byte [rdi], al
nop word [rax + rax]
mov byte [r8], al
inc r8
dec rdx
jne 0x140004ce0
mov edx, 0xf4
lea r8, [0x1401502a0]
mov rdi, r8
mov ecx, edx
mov r9d, edx
rep stosb byte [rdi], al
mov byte [r8], al
inc r8
dec r9
jne 0x140004d01
lea r8, [0x1401501a0]
mov rcx, rdx
mov rdi, r8
rep stosb byte [rdi], al
nop dword [rax + rax]
mov byte [r8], al
inc r8
dec rdx
jne 0x140004d20
lea rdx, [0x14014ff90]
mov r8d, 0x20a
mov rdi, rdx
mov ecx, r8d
rep stosb byte [rdi], al
mov byte [rdx], al
inc rdx
dec r8
jne 0x140004d40
call fcn.140025b00
mov ecx, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.14003da80
Function at 0x14000e270
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x260
mov rax, qword [0x14014dcf0]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rbx, rdx
lea rcx, [rsp + 0x40]
xor edi, edi
mov edx, 0x104
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x14000e2e0
lea rax, [0x1400cc930]
mov qword [rsp + 0x28], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [0x140143380]
mov dword [rsp + 0x30], eax
lea rax, str.VeraCrypt::BootEncryption::GetWindowsDirectoryW:1423
lea rcx, [rsp + 0x28]
mov qword [rsp + 0x38], rax
call fcn.1400a5d24
int3
mov qword [rbx + 0x10], rdi
or rcx, 0xffffffffffffffff
mov qword [rbx + 0x18], 7
mov word [rbx], di
xor eax, eax
lea rdi, [rsp + 0x40]
repne scasw ax, word [rdi]
lea rdx, [rsp + 0x40]
not rcx
lea r8, [rcx - 1]
mov rcx, rbx
call fcn.140006260
mov rax, rbx
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1400a4e70
mov rbx, qword [rsp + 0x270]
add rsp, 0x260
pop rdi
ret
Function at 0x140013b30
Capabilities:
Accept command line arguments

Disassembly:
push rsi
push r12
sub rsp, 0x28
mov r12, rcx
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea rdx, [rsp + 0x48]
mov rcx, rax
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov rsi, rax
test rax, rax
jne 0x140013b6f
lea rdx, str.Win32CommandLine:101
xor ecx, ecx
call fcn.140025910
xor eax, eax
add rsp, 0x28
pop r12
pop rsi
ret
mov qword [rsp + 0x40], rbx
mov ebx, dword [rsp + 0x48]
dec ebx
mov dword [rsp + 0x48], ebx
cmp ebx, 1
jge 0x140013b9b
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rbx, qword [rsp + 0x40]
xor eax, eax
add rsp, 0x28
pop r12
pop rsi
ret
movsxd rcx, ebx
mov qword [rsp + 0x20], rdi
shl rcx, 3
call fcn.1400a4fcc
mov qword [r12], rax
test rax, rax
jne 0x140013bc5
lea rcx, str.OUTOFMEMORY
call fcn.140018720
mov ebx, dword [rsp + 0x48]
xor edi, edi
test ebx, ebx
jle 0x140013c0a
mov qword [rsp + 0x50], rbp
mov ebx, edi
mov rcx, qword [rsi + rbx + 8]
call fcn.1400a73e4
mov rbp, rax
test rax, rax
jne 0x140013bf0
lea rcx, str.OUTOFMEMORY
call fcn.140018720
mov rcx, qword [r12]
inc edi
add rbx, 8
mov qword [rbx + rcx - 8], rbp
cmp edi, dword [rsp + 0x48]
jl 0x140013bd2
mov rbp, qword [rsp + 0x50]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [rsp + 0x48]
mov rdi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x40]
add rsp, 0x28
pop r12
pop rsi
ret
Function at 0x1400145c0
Capabilities:
Delete file

Disassembly:
push rbx
push rbp
push r12
sub rsp, 0x6a0
mov rax, qword [0x14014dcf0]
xor rax, rsp
mov qword [rsp + 0x690], rax
xor r12d, r12d
mov rbp, rcx
mov ebx, edx
lea rcx, [rsp + 0x24]
lea r8d, [r12 + 0x4c]
xor edx, edx
mov dword [rsp + 0x20], r12d
call fcn.1400a4ea0
lea rcx, str.History.xml
test ebx, ebx
je 0x14001461a
call fcn.140023900
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x140014771
mov qword [rsp + 0x6c8], rsi
call fcn.140023900
lea rdx, str.w_ccsUTF_8
mov rcx, rax
call fcn.1400a6e30
mov rsi, rax
test rax, rax
je 0x140014769
mov rcx, rax
mov qword [rsp + 0x6d0], rdi
call fcn.14004b730
lea rcx, str._n_t_history_
mov rdx, rsi
call fcn.1400a7298
mov ebx, r12d
lea rdi, [rsp + 0x20]
nop dword [rax]
lea rdx, [rsp + 0x20]
mov r8d, ebx
mov rcx, rbp
call fcn.140014170
inc ebx
add rdi, 4
mov dword [rdi - 4], eax
cmp ebx, 0x14
jl 0x140014670
mov rbx, r12
lea rcx, [rsp + 0x72]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x70], r12w
call fcn.1400a4ea0
movsxd rdi, dword [rsp + rbx*4 + 0x20]
mov r8, rdi
xor r9d, r9d
mov edx, 0x149
mov rcx, rbp
call qword [sym.imp.USER32.dll_SendMessageW]
cmp rax, 0x104
jae 0x1400146e0
lea r9, [rsp + 0x70]
mov r8, rdi
mov edx, 0x148
mov rcx, rbp
call qword [sym.imp.USER32.dll_SendMessageW]
cmp word [rsp + 0x70], r12w
je 0x140014735
lea rcx, [rsp + 0x282]
xor edx, edx
mov r8d, 0x40e
mov word [rsp + 0x280], r12w
call fcn.1400a4ea0
lea rdx, [rsp + 0x280]
lea rcx, [rsp + 0x70]
mov r8d, 0x208
call fcn.14004b810
lea r8, [rsp + 0x280]
lea rdx, str._n_t_t_volume__s__volume_
mov rcx, rsi
call fcn.1400a6834
inc rbx
cmp rbx, 0x14
jl 0x140014691
lea rcx, str._n_t__history_
mov rdx, rsi
call fcn.1400a7298
mov rcx, rsi
call fcn.14004b740
mov rcx, rsi
call fcn.1400a6944
mov rdi, qword [rsp + 0x6d0]
mov rsi, qword [rsp + 0x6c8]
mov rcx, qword [rsp + 0x690]
xor rcx, rsp
call fcn.1400a4e70
add rsp, 0x6a0
pop r12
pop rbp
pop rbx
ret

Function at 0x1400147c0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
or r9d, 0xffffffff
mov r10, rcx
test edx, edx
je 0x140014802
lea r11, [0x140147b20]
nop word [rax + rax]
movzx r8d, byte [r10]
mov eax, r9d
mov ecx, r9d
xor r8, rax
shr ecx, 8
inc r10
movzx eax, r8b
mov r9d, dword [r11 + rax*4]
xor r9d, ecx
dec edx
jne 0x1400147e0
not r9d
mov eax, r9d
ret
Function at 0x1400180d0
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
sub rsp, 0x40
xor r9d, r9d
mov rbp, rdx
mov qword [rsp + 0x30], 0
lea r8d, [r9 + 3]
mov edx, 0x80000000
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x14001811e
xor eax, eax
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rbp
ret
xor edx, edx
mov rcx, rax
mov qword [rsp + 0x50], rsi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp eax, 0xffffffff
jne 0x140018150
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rsi, qword [rsp + 0x50]
xor eax, eax
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rbp
ret
lea ecx, [rax + 1]
mov edx, 1
mov qword [rsp + 0x58], rdi
mov dword [rbp], eax
call fcn.1400a74bc
mov rcx, rbx
mov rdi, rax
test rax, rax
jne 0x14001817a
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x1400181ac
mov r9, rbp
mov r8d, esi
mov rdx, rax
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1400181a0
mov rcx, rdi
call fcn.1400a4f8c
xor edi, edi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rdi
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rbp
ret
Function at 0x140019050
Capabilities:
Capture screenshot

Disassembly:
push rbx
push rbp
push rdi
push r13
push r15
sub rsp, 0xb0
mov rax, qword [0x14014dcf0]
xor rax, rsp
mov qword [rsp + 0x98], rax
mov ebx, dword [rsp + 0x100]
mov edi, dword [rsp + 0x108]
mov r15d, r8d
mov r8, rcx
mov rcx, qword [0x1401971c0]
mov dword [rsp + 0x60], r9d
mov rbp, rdx
call fcn.140018fc0
mov r13, rax
test rax, rax
je 0x14001926d
mov edx, 7
mov rcx, rax
mov qword [rsp + 0xa8], rsi
mov qword [rsp + 0xa0], r12
call qword [sym.imp.GDI32.dll_GetCurrentObject]
xor esi, esi
mov r12, rax
cmp dword [rsp + 0x110], esi
jne 0x14001913d
test ebx, ebx
jne 0x14001913d
test edi, edi
jne 0x14001913d
lea rdx, [rsp + 0x88]
mov rcx, rbp
call qword [sym.imp.USER32.dll_GetClientRect]
mov ecx, dword [rsp + 0x90]
cmp dword [rsp + 0x118], esi
je 0x140019128
movsd xmm0, qword [0x1401482f8]
comisd xmm0, xmmword [0x1400ce750]
jbe 0x140019113
call fcn.1400189b0
jmp 0x14001912d
call fcn.140018960
mov ecx, dword [rsp + 0x94]
mov ebx, eax
call fcn.140018960
jmp 0x14001913b
call fcn.140018960
mov ecx, dword [rsp + 0x94]
mov ebx, eax
call fcn.1400189b0
mov edi, eax
lea r8, [rsp + 0x68]
mov edx, 0x20
mov rcx, r12
call qword [sym.imp.GDI32.dll_GetObjectW]
mov rcx, r13
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov r12, rax
test rax, rax
je 0x14001925a
mov r8d, edi
mov edx, ebx
mov rcx, r13
call qword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov rcx, r12
mov rdx, rax
mov rsi, rax
call qword [sym.imp.GDI32.dll_SelectObject]
mov edx, 4
mov rcx, r12
call qword [sym.imp.GDI32.dll_SetStretchBltMode]
mov ecx, dword [rsp + 0x70]
mov dword [rsp + 0x50], 0xcc0020
mov dword [rsp + 0x48], ecx
mov ecx, dword [rsp + 0x6c]
xor eax, eax
mov dword [rsp + 0x40], ecx
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], eax
mov r9d, ebx
xor r8d, r8d
xor edx, edx
mov rcx, r12
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], edi
call qword [sym.imp.GDI32.dll_StretchBlt]
mov rcx, r13
call qword [sym.imp.GDI32.dll_DeleteDC]
cmp dword [rsp + 0x110], 0
mov rcx, rbp
je 0x14001922d
call qword [sym.imp.USER32.dll_GetDC]
mov r13, rax
test rax, rax
je 0x140019251
mov r8d, dword [rsp + 0x60]
mov dword [rsp + 0x40], 0xcc0020
xor eax, eax
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], eax
mov r9d, ebx
mov edx, r15d
mov rcx, r13
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], edi
call qword [sym.imp.GDI32.dll_BitBlt]
mov rdx, r13
mov rcx, rbp
call qword [sym.imp.USER32.dll_ReleaseDC]
jmp 0x140019251
mov r9, rsi
xor r8d, r8d
mov edx, 0x172
call qword [sym.imp.USER32.dll_SendMessageW]
test rax, rax
je 0x140019251
cmp rax, rsi
je 0x140019251
mov rcx, rax
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, r12
call qword [sym.imp.GDI32.dll_DeleteDC]
mov r12, qword [rsp + 0xa0]
mov rax, rsi
mov rsi, qword [rsp + 0xa8]
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.1400a4e70
add rsp, 0xb0
pop r15
pop r13
pop rdi
pop rbp
pop rbx
ret
Function at 0x14001a2e0
Capabilities:
Get storage device properties

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r13
sub rsp, 0x80
mov rax, qword [0x14014dcf0]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor edi, edi
mov rsi, r9
mov ebp, r8d
mov ebx, edx
mov r13, rcx
test r9, r9
jne 0x14001a316
xor eax, eax
jmp 0x14001a435
mov r8, rbp
xor edx, edx
mov rcx, r9
mov qword [rsp + 0x70], r14
call fcn.1400a4ea0
xor r11d, r11d
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x50], r11
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x48]
lea r9d, [r11 + 0xc]
lea r8, [rsp + 0x50]
mov edx, 0x2d1400
mov rcx, r13
mov dword [rsp + 0x28], 8
mov dword [rsp + 0x50], ebx
mov qword [rsp + 0x54], r11
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x48], rdi
mov dword [rsp + 0x40], edi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x14001a41e
cmp dword [rsp + 0x40], 8
jne 0x14001a419
mov ebx, dword [rsp + 0x4c]
mov qword [rsp + 0x78], r12
mov ecx, ebx
call fcn.1400a4fcc
mov qword [rsp + 0x38], rdi
lea r8, [rsp + 0x50]
mov r12, rax
lea rax, [rsp + 0x40]
mov r9d, 0xc
mov qword [rsp + 0x30], rax
mov edx, 0x2d1400
mov rcx, r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov ebx, eax
test eax, eax
je 0x14001a3f9
cmp dword [rsp + 0x40], ebp
jb 0x14001a3f2
mov r8, rbp
mov rdx, r12
mov rcx, rsi
call fcn.1400a4990
mov dword [rsi], ebp
mov dword [rsi + 4], ebp
jmp 0x14001a401
mov ebx, edi
or edi, 0xffffffff
jmp 0x14001a401
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rcx, r12
call fcn.1400a4f8c
mov r12, qword [rsp + 0x78]
test ebx, ebx
je 0x14001a426
mov eax, 1
jmp 0x14001a430
or edi, 0xffffffff
jmp 0x14001a426
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov r14, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400a4e70
add rsp, 0x80
pop r13
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x14001a9e0
Capabilities:
Get common file path

Disassembly:
sub rsp, 0x248
mov rax, qword [0x14014dcf0]
xor rax, rsp
mov qword [rsp + 0x230], rax
lea rcx, [rsp + 0x20]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x14001aa2f
movzx ecx, word [rsp + 0x20]
call fcn.1400a7290
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1400a4e70
add rsp, 0x248
ret
xor eax, eax
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1400a4e70
add rsp, 0x248
ret