joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14008ffc0
Capabilities:
Accept command line arguments

Disassembly:
mov qword [0x14026d788], rcx
mov qword [0x14026d790], rdx
lea rcx, [0x14026d720]
mov edx, r9d
mov qword [0x14026d798], r8
mov dword [0x14026d7a0], r9d
jmp 0x14008ffc0
push rbx
sub rsp, 0x30
cmp byte [0x14026d70b], 0
mov rbx, rcx
je 0x14008ffdb
or eax, 0xffffffff
add rsp, 0x30
pop rbx
ret
xor ecx, ecx
mov qword [rsp + 0x40], rdi
call qword [sym.imp.ole32.dll_CoInitialize]
mov edi, eax
mov dword [rsp + 0x50], eax
test eax, eax
jns 0x140090018
cmp eax, 0x80010106
jne 0x140090074
lea rcx, str.Mscoree.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
jne 0x14009001c
mov eax, edi
mov rdi, qword [rsp + 0x40]
add rsp, 0x30
pop rbx
ret
mov byte [rbx + 0x62], 1
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea r8, [rsp + 0x50]
mov rcx, rbx
mov rdx, rax
call fcn.14008e950
cmp al, 1
jne 0x140090064
mov eax, dword [rbx + 0x80]
mov r9, qword [rbx + 0x78]
mov r8, qword [rbx + 0x70]
mov rdx, qword [rbx + 0x68]
lea rcx, [0x14026d7b0]
mov dword [rsp + 0x20], eax
call fcn.1400870b0
mov rcx, rbx
call fcn.14008ee30
mov edi, eax
jmp 0x140090068
mov edi, dword [rsp + 0x50]
cmp byte [rbx + 0x62], 0
je 0x140090074
call qword [sym.imp.ole32.dll_CoUninitialize]
mov eax, edi
mov rdi, qword [rsp + 0x40]
add rsp, 0x30
pop rbx
ret
Function at 0x1400993f0
Capabilities:
Check if file exists

Disassembly:
push rdi
sub rsp, 0x70
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x80], rbx
mov rbx, rcx
call fcn.14009de60
xor edi, edi
cmp qword [rbx + 0x68], rdi
je 0x1400994ff
xor r8d, r8d
lea edx, [rdi + 3]
lea rcx, [0x14026ef98]
call fcn.14002c3c0
test rax, rax
jne 0x14009944e
lea edx, [rdi + 3]
lea r8d, [rdi + 1]
lea rcx, [0x14026ef98]
call fcn.14002c3c0
test rax, rax
je 0x1400994e2
mov rcx, rax
call fcn.140031f90
test eax, eax
je 0x1400994e2
test byte [rbx + 0xc], 0x40
mov edx, 5
cmovne edx, edi
mov rcx, qword [rbx + 0x68]
call qword [sym.imp.USER32.dll_ShowWindow]
xor edx, edx
lea rcx, [rsp + 0x38]
call fcn.1400c91f0
nop
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 0x2001f
xor r9d, r9d
lea r8, str.SoftwareSynapticsSynTPEnhShortcutConfig
mov rdx, 0xffffffff80000001
lea rcx, [rsp + 0x38]
call fcn.1400c9360
test eax, eax
je 0x1400994c4
xor r9d, r9d
lea r8d, [r9 + 1]
lea rdx, str.CheckForcePadShortcut
lea rcx, [rsp + 0x40]
call fcn.1400dfe90
mov edx, 8
lea rcx, [0x14026d7b0]
call fcn.140085dc0
nop
lea rcx, [rsp + 0x38]
call fcn.1400c9300
jmp 0x1400994ff
xor edx, edx
mov rcx, qword [rbx + 0x68]
call qword [sym.imp.USER32.dll_ShowWindow]
mov edx, 4
lea rcx, [0x14026d7b0]
call fcn.140085dc0
mov rax, qword [0x14026efa0]
test rax, rax
je 0x140099604
cmp qword [rax], 0
je 0x140099604
cmp dword [rbx + 0x548], 0
je 0x14009952f
mov rcx, rbx
call fcn.14009c680
jmp 0x140099628
cmp dword [rbx + 0x598], 0
jne 0x140099628
mov dword [rbx + 0x44], edi
cmp dword [rbx + 0x590], 0
je 0x140099591
lea rcx, [0x14026ef98]
call fcn.14000bc40
test rax, rax
jne 0x14009956a
lea rcx, [0x14026ef98]
call fcn.140030740
test rax, rax
je 0x140099575
mov rcx, rax
call fcn.140031cd0
mov dword [rbx + 0x44], eax
lea rcx, [0x14026ef98]
call fcn.14008e020
test rax, rax
je 0x140099591
mov rcx, rax
call fcn.140031cd0
or dword [rbx + 0x44], eax
cmp dword [rbx + 0x44], 0
je 0x1400995ae
test byte [rbx + 0xc], 0x20
jne 0x1400995ae
mov rdx, qword [rbx + 0xd8]
mov rcx, rbx
call fcn.14009c5a0
jmp 0x140099628
mov eax, dword [rbx + 0xc]
test al, 0x20
je 0x1400995e2
test al, 0x10
je 0x1400995c3
mov rcx, rbx
call fcn.14009c560
jmp 0x140099628
test al, 1
je 0x140099628
mov rcx, rbx
test byte [rbx + 0x5a8], 0x20
je 0x1400995bc
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call fcn.14009b9f0
jmp 0x140099628
test al, 1
je 0x1400995b9
mov rcx, rbx
test al, 0x10
je 0x1400995f6
cmp dword [rbx + 0x568], 0
je 0x1400995d3
mov rdx, qword [rbx + 0xe0]
call fcn.14009c5a0
jmp 0x140099628
lea rdx, [rbx + 0x178]
mov ecx, 2
call qword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
test eax, eax
jne 0x140099625
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x140099628
mov dword [rbx + 0x48], edi
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret
Function at 0x140099a20
Capabilities:
Check if file exists

Disassembly:
cmp dword [rcx + 0x594], 0
mov r8, rcx
je 0x140099a81
cmp dword [rcx + 0x598], 0
je 0x140099a81
lea rax, [0x1401226e8]
mov rdx, rcx
mov dword [rcx + 0x598], 0
sub rdx, rax
nop dword [rax]
movzx ecx, word [rax]
lea rax, [rax + 2]
mov word [rdx + rax + 0x2a6], cx
test cx, cx
jne 0x140099a50
mov eax, dword [r8 + 0x5a8]
test al, 0x20
je 0x140099a79
and eax, 0xffffffdf
mov dword [r8 + 0x5a8], eax
mov rcx, r8
jmp fcn.1400993f0
ret

Function at 0x14009c200
Capabilities:
Find taskbar

Disassembly:
sub rsp, 0x28
lea rcx, str.Shell_TrayWnd
xor edx, edx
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
je 0x14009c27b
lea r8, str.TrayNotifyWnd
xor r9d, r9d
xor edx, edx
mov rcx, rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.USER32.dll_FindWindowExW]
mov rbx, rax
test rax, rax
je 0x14009c276
lea r8, str.SysPager
xor r9d, r9d
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_FindWindowExW]
xor r9d, r9d
xor edx, edx
lea r8, str.ToolbarWindow32
mov rcx, rax
test rax, rax
jne 0x14009c266
mov rcx, rbx
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
jmp qword [sym.imp.USER32.dll_FindWindowExW]
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret

Function at 0x14009c560
Capabilities:
Check if file exists

Disassembly:
push rbx
sub rsp, 0x20
lea rdx, [rcx + 0x178]
mov rbx, rcx
mov ecx, 2
call qword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
test eax, eax
jne 0x14009c58a
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x14009c591
mov dword [rbx + 0x48], 0
add rsp, 0x20
pop rbx
ret

Function at 0x14009c5a0
Capabilities:
Check if file exists

Disassembly:
push rdi
sub rsp, 0x20
cmp dword [rcx + 0x48], 0
mov rdi, rcx
mov qword [rcx + 0x198], rdx
jne 0x14009c5ce
lea rdx, [rcx + 0x178]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
mov dword [rdi + 0x48], eax
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rsi
mov ebx, 0x64
nop dword [rax]
lea rdx, [rdi + 0x178]
mov ecx, 1
call qword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
test eax, eax
jne 0x14009c65c
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_Sleep]
add ebx, 0x64
cmp ebx, 0x44c
jl 0x14009c5e0
lea rdx, [rdi + 0x178]
mov ecx, 2
call qword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
test eax, eax
jne 0x14009c62a
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x14009c631
mov dword [rdi + 0x48], 0
cmp dword [rdi + 0x48], 0
jne 0x14009c649
lea rdx, [rdi + 0x178]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
mov dword [rdi + 0x48], eax
mov eax, dword [rdi + 0x48]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov dword [rdi + 0x48], 1
mov eax, 1
add rsp, 0x20
pop rdi
ret
Function at 0x14009de60
Capabilities:
Find taskbar

Disassembly:
push rdi
sub rsp, 0x70
mov rdi, rcx
mov rcx, qword [rcx + 0x68]
test rcx, rcx
je 0x14009df62
lea rdx, [rsp + 0x60]
call qword [sym.imp.USER32.dll_GetWindowRect]
lea rcx, [rdi + 0x17a0]
call qword [sym.imp.USER32.dll_IsRectEmpty]
test eax, eax
je 0x14009df62
mov ecx, 0x4f
mov qword [rsp + 0x80], rbx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
xor edx, edx
lea r8, [rsp + 0x40]
lea ecx, [rdx + 0x30]
xor r9d, r9d
mov ebx, eax
call qword [sym.imp.USER32.dll_SystemParametersInfoW]
mov ecx, dword [rsp + 0x4c]
mov r9d, dword [rsp + 0x44]
sub ecx, r9d
cmp ebx, ecx
mov rbx, qword [rsp + 0x80]
jne 0x14009df24
lea rcx, str.Shell_TrayWnd
xor edx, edx
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
je 0x14009df1f
lea rdx, [rsp + 0x50]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowRect]
mov ecx, dword [rsp + 0x54]
mov r9d, dword [rsp + 0x44]
test ecx, ecx
jns 0x14009df15
mov eax, dword [rsp + 0x5c]
sub eax, ecx
add r9d, eax
mov dword [rsp + 0x44], r9d
jmp 0x14009df24
sub ecx, dword [rsp + 0x5c]
add dword [rsp + 0x4c], ecx
jmp 0x14009df24
mov r9d, dword [rsp + 0x44]
mov r8d, dword [rsp + 0x48]
mov rcx, qword [rdi + 0x68]
xor eax, eax
mov dword [rsp + 0x30], 1
xor edx, edx
add r8d, 0xffffff06
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
test r9d, r9d
jne 0x14009df5c
mov r9d, dword [rsp + 0x64]
sub r9d, dword [rsp + 0x6c]
add r9d, dword [rsp + 0x4c]
call qword [sym.imp.USER32.dll_SetWindowPos]
add rsp, 0x70
pop rdi
ret
Function at 0x1400a6c20
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
sub rsp, 0x230
mov rbx, rcx
xor ecx, ecx
mov rsi, rdx
call fcn.1400dbe60
cmp eax, 0xb
jl 0x1400a6d4b
mov qword [rsp + 0x240], rbp
lea rcx, [rsp + 0x22]
xor ebp, ebp
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x20], bp
call fcn.1400e4040
lea rdx, [rsp + 0x20]
mov r8d, 0x104
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetWindowTextW]
cmp word [rsp + 0x20], bp
je 0x1400a6d47
lea rdx, str.Charm_Bar
lea rcx, [rsp + 0x20]
call fcn.1400e995c
test eax, eax
jne 0x1400a6d47
mov qword [rsp + 0x248], rdi
cmp qword [rbx + 0x3f0], rbp
je 0x1400a6d1f
mov rcx, qword [rbx + 0x400]
test rcx, rcx
je 0x1400a6d08
mov dword [rsp + 0x250], ebp
mov r8, qword [rcx]
lea rdx, [rsp + 0x250]
call qword [r8 + 0x130]
cmp dword [rsp + 0x250], ebp
je 0x1400a6d1f
mov rcx, qword [rbx + 0x408]
test rcx, rcx
je 0x1400a6cf4
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rbx + 0x408], rbp
mov rcx, qword [rbx + 0x400]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rbx + 0x400], rbp
mov rcx, qword [rbx + 0x3f0]
lea r8, [rbx + 0x400]
mov rdx, rsi
mov rax, qword [rcx]
call qword [rax + 0x30]
mov rax, qword [rbx + 0x400]
mov rdi, qword [rsp + 0x248]
mov rbp, qword [rsp + 0x240]
mov rbx, qword [rsp + 0x258]
add rsp, 0x230
pop rsi
ret
xor eax, eax
jmp 0x1400a6d2e
xor eax, eax
mov rbx, qword [rsp + 0x258]
add rsp, 0x230
pop rsi
ret
Function at 0x1400ac720
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov rdi, rcx
mov rcx, qword [rdx]
mov r14, r8
mov rsi, rdx
test rcx, rcx
jne 0x1400ac747
xor eax, eax
jmp 0x1400ac75b
mov rax, qword [rcx]
lea r8, [rsp + 0x58]
mov edx, 0x10000301
call qword [rax + 0x18]
mov eax, dword [rsp + 0x58]
mov rbx, qword [0x14026efa0]
test rbx, rbx
je 0x1400ac789
movsxd rbp, eax
nop word [rax + rax]
mov rcx, qword [rbx]
mov rdx, rbp
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test eax, eax
jne 0x1400ac7ab
mov rbx, qword [rbx + 8]
test rbx, rbx
jne 0x1400ac770
xor eax, eax
lea rbp, [rax + 0x50]
mov rcx, rbp
call fcn.140032350
test al, al
je 0x1400ac8e6
mov rcx, qword [rsi]
test rcx, rcx
jne 0x1400ac7b0
xor eax, eax
jmp 0x1400ac7c4
mov rax, qword [rbx]
jmp 0x1400ac78b
mov rax, qword [rcx]
lea r8, [rsp + 0x68]
mov edx, 0x10000312
call qword [rax + 0x18]
mov eax, dword [rsp + 0x68]
shr eax, 0x16
test al, 1
jne 0x1400ac8dc
mov rcx, qword [rsi]
test rcx, rcx
jne 0x1400ac7db
xor eax, eax
jmp 0x1400ac7ef
mov rax, qword [rcx]
lea r8, [rsp + 0x68]
mov edx, 0x10000314
call qword [rax + 0x18]
mov eax, dword [rsp + 0x68]
test al, 1
jne 0x1400ac8dc
mov rcx, qword [rsi]
test rcx, rcx
jne 0x1400ac803
xor eax, eax
jmp 0x1400ac817
mov rax, qword [rcx]
lea r8, [rsp + 0x68]
mov edx, 0x10000314
call qword [rax + 0x18]
mov eax, dword [rsp + 0x68]
shr eax, 1
test al, 1
jne 0x1400ac8dc
mov rcx, r14
call fcn.1400952c0
test al, al
jne 0x1400ac8e6
mov rcx, rsi
call fcn.1400952c0
test al, al
je 0x1400ac8e6
inc dword [rdi + 0xa4]
cmp dword [rdi + 0xa4], 1
jne 0x1400ac861
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rdi + 0xa8], eax
jmp 0x1400ac8e6
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, 0x5dc
cmp eax, dword [rdi + 0xa8]
jae 0x1400ac87c
call qword [sym.imp.KERNEL32.dll_GetTickCount]
jmp 0x1400ac88c
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rdi + 0xa4], 1
cmp dword [rdi + 0xa4], 3
mov dword [rdi + 0xa8], eax
jne 0x1400ac8e6
lea rcx, str.SynTPLpr
xor edx, edx
call qword [sym.imp.USER32.dll_FindWindowW]
mov rbx, rax
test rax, rax
je 0x1400ac8dc
mov rcx, rbp
call fcn.140032560
lea rcx, [0x14026d7b0]
mov r8d, 0x4e4
mov rdx, rbx
movzx r9d, al
mov qword [rsp + 0x20], 0
call fcn.140083840
mov dword [rdi + 0xa4], 0
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x1400b0300
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x80
mov qword [rax - 0x78], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov rdi, r9
movzx esi, r8w
mov r12d, edx
mov r15, rcx
xor ebp, ebp
mov r13d, ebp
mov dword [rsp + 0x20], ebp
call fcn.140005220
mov rcx, rax
mov r9d, ebp
test rax, rax
setne r9b
test r9d, r9d
jne 0x1400b035f
mov ecx, 0x80004005
call fcn.1400051c0
int3
mov rax, qword [rax]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x28], rbx
lea rdx, [0x1401226e8]
test rdx, 0xffffffffffff0000
jne 0x1400b03a3
movzx r14d, dx
xor edx, edx
mov ecx, r14d
call fcn.14000ba00
test rax, rax
je 0x1400b03b5
mov r8d, r14d
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.14000be60
jmp 0x1400b03b0
xor r8d, r8d
lea rcx, [rsp + 0x28]
call fcn.14000c060
mov rbx, qword [rsp + 0x28]
test si, si
jne 0x1400b03c2
call fcn.1400b0ae0
movzx esi, ax
test rdi, rdi
jne 0x1400b03d2
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rdi, rax
movzx ecx, r12w
shr cx, 4
inc cx
movzx r8d, cx
movzx r9d, si
mov edx, 6
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
test rax, rax
je 0x1400b052f
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rdi, rax
test rax, rax
je 0x1400b052f
movzx eax, r12w
and eax, 0x8000000f
jge 0x1400b0426
dec eax
or eax, 0xfffffff0
inc eax
test eax, eax
jle 0x1400b0440
mov edx, eax
nop dword [rax]
movzx eax, word [rdi]
lea rdi, [rdi + rax*2]
add rdi, 2
dec rdx
jne 0x1400b0430
movzx ebx, word [rdi]
lea ecx, [rbx + 1]
mov eax, 2
mul rcx
mov rsi, 0xffffffffffffffff
cmovo rax, rsi
mov rcx, rax
call fcn.1400e2f98
mov r14, rax
mov r8d, ebx
lea rdx, [rdi + 2]
mov rcx, rax
call fcn.1400e5f98
mov word [r14 + rbx*2], bp
cmp dword [rsp + 0xd0], 0
je 0x1400b04e5
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], rbp
mov word [rsp + 0x38], bp
cmp word [r14], 0
jne 0x1400b04a1
mov r8, rbp
jmp 0x1400b04af
mov r8, rsi
inc r8
cmp word [r14 + r8*2], 0
jne 0x1400b04a4
mov rdx, r14
lea rcx, [rsp + 0x38]
call fcn.1400079e0
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x58]
call fcn.1400de600
mov rdx, rax
mov r13d, 2
mov dword [rsp + 0x20], r13d
cmp qword [rax + 0x18], 8
jb 0x1400b04e8
mov rdx, qword [rax]
jmp 0x1400b04e8
mov rdx, r14
test rdx, rdx
je 0x1400b04fc
mov rax, rsi
inc rax
cmp word [rdx + rax*2], 0
jne 0x1400b04f0
mov ebp, eax
mov r8d, ebp
lea rcx, [rsp + 0x28]
call fcn.14000c060
nop
test r13b, 2
je 0x1400b0522
cmp qword [rsp + 0x70], 8
jb 0x1400b0522
mov rcx, qword [rsp + 0x58]
call fcn.1400e3e78
mov rcx, r14
call fcn.1400e64f8
mov rbx, qword [rsp + 0x28]
lea rcx, [rbx - 0x18]
call fcn.14000bab0
add rax, 0x18
mov qword [r15], rax
lock add dword [rbx - 8], 0xffffffff
jg 0x1400b0554
mov rcx, qword [rbx - 0x18]
mov rax, qword [rcx]
lea rdx, [rbx - 0x18]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, r15
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1400b4a00
Capabilities:
Get file version info

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push r14
sub rsp, 0x30
mov r14, rdx
lea rdx, [rsp + 0x68]
mov rsi, r8
mov rcx, r14
xor ebx, ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov ebp, eax
test eax, eax
je 0x1400b4abd
mov ecx, ebp
mov qword [rsp + 0x50], rdi
call fcn.1400eca74
mov rdi, rax
test rax, rax
je 0x1400b4aa8
mov r9, rax
mov r8d, ebp
xor edx, edx
mov rcx, r14
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x1400b4aa0
lea r9, [rsp + 0x20]
lea r8, [rsp + 0x28]
lea rdx, [0x140122f68]
mov rcx, rdi
mov qword [rsp + 0x28], rbx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x1400b4aa0
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x1400b4aa0
movzx eax, word [rcx + 0xa]
mov ebx, 1
mov dword [rsi], eax
movzx eax, word [rcx + 8]
mov dword [rsi + 4], eax
movzx eax, word [rcx + 0xe]
mov dword [rsi + 8], eax
movzx eax, word [rcx + 0xc]
mov dword [rsi + 0xc], eax
mov rcx, rdi
call fcn.1400e9bf0
mov eax, ebx
mov rdi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
mov eax, ebx
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret

Function at 0x1400b4b30
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
xor ebp, ebp
mov rcx, rdx
lea rdx, [rsp + 0x58]
mov rsi, r8
mov qword [rsp + 0x28], rbp
mov edi, ebp
mov dword [rsp + 0x58], ebp
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r8d, dword [rsp + 0x58]
test r8d, r8d
jne 0x1400b4b79
xor eax, eax
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
xor edx, edx
mov ecx, 0x410
mov qword [rsp + 0x40], rbx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x1400b4bd7
lea r9, [rsp + 0x20]
lea rdx, [rsp + 0x28]
mov r8d, 8
mov rcx, rax
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x1400b4bce
mov rdx, qword [rsp + 0x28]
mov r9d, 0x104
mov r8, rsi
mov rcx, rbx
call sub.PSAPI.DLL_GetModuleFileNameExW
mov edi, eax
test eax, eax
jne 0x1400b4bce
mov word [rsi], bp
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov eax, edi
add rsp, 0x30
pop rdi
ret
Function at 0x1400b89d0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
mov qword [rsp + 0x10], rbx
mov dword [rsp + 0x20], r9d
mov dword [rsp + 0x18], r8d
mov dword [rsp + 8], ecx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xa0
mov ebp, r9d
mov r15d, r8d
mov edi, edx
mov r14d, ecx
xor esi, esi
call qword [sym.imp.USER32.dll_GetDesktopWindow]
lea ecx, [rsi + 0x4d]
mov rbx, rax
mov qword [rsp + 0x60], rax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
lea ecx, [rsi + 0x4f]
mov dword [rsp + 0x7c], eax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
lea ecx, [rsi + 0x4c]
add eax, dword [rsp + 0x7c]
mov dword [rsp + 0x84], eax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
lea ecx, [rsi + 0x4e]
mov dword [rsp + 0x78], eax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
lea r8, [rsp + 0x78]
add eax, dword [rsp + 0x78]
lea rdx, [rsp + 0x88]
lea rcx, [rsp + 0x68]
mov dword [rsp + 0x80], eax
lea eax, [rdi + rbp]
mov dword [rsp + 0x8c], edi
mov dword [rsp + 0x94], eax
lea eax, [r14 + r15]
mov dword [rsp + 0x88], r14d
mov dword [rsp + 0x90], eax
call qword [sym.imp.USER32.dll_IntersectRect]
mov ebp, dword [rsp + 0x70]
mov r14d, dword [rsp + 0x74]
sub ebp, dword [rsp + 0x68]
mov rcx, rbx
sub r14d, dword [rsp + 0x6c]
call qword [sym.imp.USER32.dll_GetDC]
mov rcx, rax
mov r12, rax
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov r8d, r14d
mov edx, ebp
mov rcx, r12
mov r15, rax
call qword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov r13, rax
test rax, rax
je 0x1400b8bd6
mov r9d, dword [rsp + 0x100]
cmp r9d, 1
jle 0x1400b8b5b
mov eax, dword [rsp + 0xf0]
cdq
sub eax, edx
sar eax, 1
mov ecx, eax
mov eax, dword [rsp + 0xf8]
add ecx, dword [rsp + 0xe0]
cdq
sub eax, edx
sar eax, 1
lea r8d, [rdi + rax]
mov eax, dword [rsp + 0x68]
sub eax, ecx
cdq
idiv r9d
lea edi, [rcx + rax]
mov eax, dword [rsp + 0x6c]
mov rcx, r15
sub eax, r8d
cdq
idiv r9d
mov rdx, r13
lea ebx, [r8 + rax]
call qword [sym.imp.GDI32.dll_SelectObject]
call fcn.1400b87e0
mov r8d, eax
mov eax, r14d
cdq
mov dword [rsp + 0x50], r8d
idiv dword [rsp + 0x100]
mov ecx, eax
mov eax, ebp
cdq
mov dword [rsp + 0x48], ecx
idiv dword [rsp + 0x100]
mov dword [rsp + 0x40], eax
jmp 0x1400b8b81
mov edi, dword [rsp + 0x68]
mov ebx, dword [rsp + 0x6c]
mov rdx, rax
mov rcx, r15
call qword [sym.imp.GDI32.dll_SelectObject]
call fcn.1400b87e0
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x48], r14d
mov dword [rsp + 0x40], ebp
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], edi
mov r9d, ebp
xor r8d, r8d
xor edx, edx
mov rcx, r15
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], r14d
call qword [sym.imp.GDI32.dll_StretchBlt]
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
call qword [sym.imp.USER32.dll_EmptyClipboard]
mov rdx, r13
mov ecx, 2
call qword [sym.imp.USER32.dll_SetClipboardData]
mov ecx, 1
test rax, rax
cmovne esi, ecx
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rbx, qword [rsp + 0x60]
mov rcx, r15
call qword [sym.imp.GDI32.dll_DeleteDC]
mov rdx, r12
mov rcx, rbx
call qword [sym.imp.USER32.dll_ReleaseDC]
mov rbx, qword [rsp + 0xe8]
mov eax, esi
add rsp, 0xa0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400bf4e0
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp - 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rdi, rcx
cmp qword [rcx + 0x78], 0
je 0x1400bf6db
cmp byte [rcx + 0x82], 0
je 0x1400bf6db
mov rax, qword [rcx]
mov ebx, 0xffff
mov edx, ebx
call qword [rax + 0x18]
cmp bx, ax
jne 0x1400bf532
xor al, al
jmp 0x1400bf6dd
mov edx, 0xf
mov qword [rbp - 0x10], rdx
mov byte [rbp - 0x28], 0
xor ecx, ecx
mov qword [rbp - 0x28], rcx
mov qword [rbp - 0x18], 8
lea rax, [rbp - 0x28]
cmp rdx, 0x10
cmovae rax, rcx
mov byte [rax + 8], cl
xor r14d, r14d
mov r9, qword [rbp - 0x10]
lea rdx, [rbp - 0x28]
cmp r9, 0x10
cmovae rdx, qword [rbp - 0x28]
lea r8, [rbp - 0x28]
cmovae r8, qword [rbp - 0x28]
mov rcx, qword [rdi + 0x78]
mov r10, qword [rcx]
mov r9, qword [rbp - 0x18]
add r9, rdx
lea rax, [rbp + 0x20]
mov qword [rsp + 0x20], rax
lea rdx, [rdi + 0x84]
call qword [r10 + 0x40]
test eax, eax
je 0x1400bf5a9
dec eax
jne 0x1400bf69e
jmp 0x1400bf5b0
mov byte [rdi + 0x82], r14b
lea rax, [rbp - 0x28]
mov r10, qword [rbp - 0x28]
mov r9, qword [rbp - 0x10]
cmp r9, 0x10
cmovae rax, r10
mov rbx, qword [rbp + 0x20]
sub rbx, rax
je 0x1400bf5fa
lea rcx, [rbp - 0x28]
cmp r9, 0x10
cmovae rcx, r10
mov r9, qword [rdi + 0x90]
mov r8, rbx
mov edx, 1
call fcn.1400ea460
mov r9, qword [rbp - 0x10]
cmp rbx, rax
jne 0x1400bf6a7
cmp byte [rdi + 0x82], r14b
je 0x1400bf6c5
test rbx, rbx
jne 0x1400bf563
or rax, 0xffffffffffffffff
mov r8, qword [rbp - 0x18]
sub rax, r8
cmp rax, 8
jbe 0x1400bf6b8
lea rbx, [r8 + 8]
cmp rbx, 0xfffffffffffffffe
ja 0x1400bf6ab
cmp r9, rbx
jae 0x1400bf646
mov rdx, rbx
lea rcx, [rbp - 0x28]
call fcn.14000c3f0
mov r9, qword [rbp - 0x10]
jmp 0x1400bf664
test rbx, rbx
jne 0x1400bf66d
mov qword [rbp - 0x18], r14
lea rax, [rbp - 0x28]
cmp r9, 0x10
cmovae rax, qword [rbp - 0x28]
mov byte [rax], r14b
jmp 0x1400bf55f
test rbx, rbx
je 0x1400bf563
lea rcx, [rbp - 0x28]
cmp r9, 0x10
cmovae rcx, qword [rbp - 0x28]
mov rax, qword [rbp - 0x18]
xor edx, edx
mov qword [rax + rcx], rdx
mov qword [rbp - 0x18], rbx
lea rax, [rbp - 0x28]
cmp qword [rbp - 0x10], 0x10
cmovae rax, qword [rbp - 0x28]
mov byte [rbx + rax], dl
jmp 0x1400bf55f
mov r9, qword [rbp - 0x10]
sub eax, 2
je 0x1400bf6c5
xor bl, bl
jmp 0x1400bf6c7
lea rcx, str.string_too_long
call fcn.1400e2f28
int3
lea rcx, str.string_too_long
call fcn.1400e2f28
int3
mov bl, 1
cmp r9, 0x10
jb 0x1400bf6d6
mov rcx, qword [rbp - 0x28]
call fcn.1400e3e78
movzx eax, bl
jmp 0x1400bf6dd
mov al, 1
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret