joyce8/EMBER2024-capa huggingface dataset:
Function at 0x468d20
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x404423
push rbp
mov rbp, rsp
sub rsp, 0x18
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
mov rax, rdx
call fcn.0040a240
add rsp, 0x18
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00466f20
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x404400
cmp byte [0x006724aa], 0
je 0x468d35
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp 0x465f60
jmp 0x404400

Function at 0x468d40
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
nop
mov eax, dword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x006727a0]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d124b
mul rcx
xor rax, rdx
nop
nop
ret
cmp byte [0x006724aa], 0
je 0x468d75
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x00672ac0]
aesenc xmm0, xmmword [0x00672ad0]
aesenc xmm0, xmmword [0x00672ae0]
movq rax, xmm0
ret
jmp 0x40a460

Function at 0x468d80
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
nop
mov rax, qword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x006727a0]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
xor rax, rdx
nop
nop
ret
cmp byte [0x006724aa], 0
je 0x468db6
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x00672ac0]
aesenc xmm0, xmmword [0x00672ad0]
aesenc xmm0, xmmword [0x00672ae0]
movq rax, xmm0
ret
jmp 0x40a4c0

Function at 0x46ab60
Capabilities:
Allocate thread local storage

Disassembly:
push rbp
mov rbp, rsp
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x46ab94
mov rcx, 0x28
jmp 0x46ab9f
shl rcx, 3
add rcx, 0x1480
mov qword [0x006726c0], rcx
pop rbp
ret
Function at 0x486220
Capabilities:
Hash data using fnv

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48645b
push rbp
mov rbp, rsp
sub rsp, 0x78
mov ebx, dword [rax + 0x2c]
test ebx, ebx
jne 0x4862ba
mov qword [rsp + 0x88], rax
lea rbx, [0x004f2080]
mov rcx, rax
lea rax, [0x005ed920]
call fcn.00470240
test cl, cl
jne 0x4862a3
mov rax, qword [rsp + 0x88]
call fcn.00485aa0
mov ecx, 1
mov rdi, rax
mov rsi, rbx
lea rax, [rsp + 0x28]
lea rbx, [0x005237c8]
call fcn.00451b40
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x48], rbx
call fcn.004864a0
mov rcx, qword [rsp + 0x88]
xor edx, edx
jmp 0x4862e0
lea rdx, [0x004efcc0]
cmp rax, rdx
jne 0x4862cb
test byte [rbx], al
mov rax, rbx
add rsp, 0x78
pop rbp
ret
nop
nop dword [rax + rax]
call fcn.00464b80
add rsp, 0x78
pop rbp
ret
mov rbx, rdx
lea rcx, [0x004dc640]
call fcn.0040b2c0
inc rdx
nop dword [rax]
cmp rbx, rdx
jle 0x486324
mov rsi, qword [rax + rdx*8]
cmp qword [rsi + 0x30], rcx
jne 0x4862da
lea rax, [0x005ed920]
lea rbx, [0x004f2080]
lea rdi, [0x004efcc0]
call fcn.00470400
lea rdx, [0x004efcc0]
cmp rax, rdx
jne 0x48644b
test byte [rbx], al
mov rax, rbx
add rsp, 0x78
pop rbp
ret
lea rcx, [0x004d59e0]
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], 0
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x68], rcx
lea rax, [0x004e07e0]
call fcn.0040e560
mov qword [rsp + 0x70], rax
mov rcx, qword [rsp + 0x68]
test byte [rcx], al
cmp dword [0x00672700], 0
je 0x48637d
mov rbx, rax
lea rax, [0x004e07e0]
call fcn.004137e0
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rcx]
mov qword [rax], rdx
movups xmm0, xmmword [rcx + 8]
movups xmmword [rax + 8], xmm0
movups xmm0, xmmword [rcx + 0x18]
movups xmmword [rax + 0x18], xmm0
movups xmm0, xmmword [rcx + 0x28]
movups xmmword [rax + 0x28], xmm0
nop
mov rbx, qword [rsp + 0x48]
xor ecx, ecx
xor edi, edi
xor esi, esi
mov r8d, esi
mov rax, qword [rsp + 0x60]
call fcn.004013e0
nop
call fcn.00464c40
mov rsi, qword [rsp + 0x70]
mov dword [rsi + 0x28], eax
mov dword [rsi + 0x2c], 0
mov rcx, qword [rsp + 0x88]
mov edx, dword [rcx + 0x10]
xor eax, eax
jmp 0x4863e6
imul edx, edx, 0x1000193
xor edx, 0x2a
mov eax, 1
test rax, rax
jle 0x4863d8
mov dword [rsi + 0x10], edx
cmp dword [0x00672700], 0
je 0x486407
call fcn.00468e60
mov qword [r11], rcx
mov rdx, qword [rsi + 0x30]
mov qword [r11 + 8], rdx
mov qword [rsi + 0x30], rcx
lea rax, [0x005ed920]
lea rbx, [0x004f2080]
lea rdi, [0x004efcc0]
call fcn.00470400
lea rdx, [0x004efcc0]
cmp rax, rdx
jne 0x48643c
test byte [rbx], al
mov rax, rbx
add rsp, 0x78
pop rbp
ret
mov rbx, rdx
lea rcx, [0x004dc640]
call fcn.0040b2c0
mov rbx, rdx
lea rcx, [0x004dc640]
call fcn.0040b2c0
nop
mov qword [rsp + 8], rax
call fcn.00466f20
mov rax, qword [rsp + 8]
jmp fcn.00486220
Function at 0x490e80
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x490f4a
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call fcn.00403940
xorps xmm15, xmm15
mov r14, qword [0x006726c0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x490f2f
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x004d8aa0]
xor ebx, ebx
mov rcx, rdx
call fcn.0044dd40
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call fcn.00491f60
inc rbx
cmp rcx, rbx
jae 0x490f1e
mov edi, 1
lea rsi, [0x004d8aa0]
call fcn.0044de20
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x00525338]
lea rsi, [0x00524588]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00466f20
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00490e80
Function at 0x4baf60
Capabilities:
Hash data using fnv

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4bb69f
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
movabs rcx, 0xcbf29ce484222325
jmp 0x4baf8d
lea rax, [rdx + 0x10]
dec rbx
mov rcx, rsi
test rbx, rbx
jle 0x4bb211
mov rdx, rax
mov rsi, qword [rax]
nop dword [rax]
test rsi, rsi
je 0x4bb23d
mov edi, dword [rsi + 0x10]
shr edi, 1
mov r8, qword [rax + 8]
and edi, 0x3f
lea rax, [0x00526b80]
jmp qword [rax + rdi*8]
mov rax, rcx
add rsp, 0x10
pop rbp
ret
lea rax, [0x004d89a0]
lea rbx, [0x00525110]
call fcn.00437080
inc rax
cmp rax, r8
jge 0x4bb262
mov r9, qword [rsi + rax*8]
xor r10d, r10d
nop
jmp 0x4bb297
lea rdi, [0x004d8a20]
mov rsi, rcx
movabs rcx, 0x100000001b3
jmp 0x4baf83
movzx r11d, r9b
xor rcx, r11
inc r10
shr r9, 8
movabs r11, 0x100000001b3
imul rcx, r11
cmp r10, 8
jl 0x4bb27b
jmp 0x4bb250
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.00466f20
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.004baf60

Function at 0x4bb840
Capabilities:
Hash data using fnv

Disassembly:
test byte [rax], al
mov rcx, rbx
and ebx, 0x7f
shl rbx, 5
lea rdx, [rax + rbx]
xor eax, eax
jmp 0x4bb857
inc rax
cmp rax, 4
jge 0x4bb86f
lea rbx, [rdx + rax*8]
mov rbx, qword [rbx]
cmp rbx, rcx
jne 0x4bb854
mov eax, 1
ret
xor eax, eax
movabs rbx, 0xcbf29ce484222325
jmp 0x4bb880
inc rax
cmp rax, 4
jge 0x4bb88e
mov rsi, qword [rdx + rax*8]
xor edi, edi
jmp 0x4bb8b7
and ebx, 3
lea rdx, [rdx + rbx*8]
xchg qword [rdx], rcx
xor eax, eax
ret
movzx r8d, sil
xor rbx, r8
inc rdi
shr rsi, 8
movabs r8, 0x100000001b3
imul rbx, r8
cmp rdi, 8
jl 0x4bb89b
jmp 0x4bb87d
Function at 0x18382a8
Capabilities:
Encode data using xor

Disassembly:
push qword [rsp + 0x28]
popfq
lea rsp, [rsp + 0x48]
call fcn.0232cc9b
add byte [rbp + 0x53], dl
push r10
xor esi, dword [rdx]
insb byte [rdi], dx
insb byte [rdi], dx
add byte [rax], bh
fadd st(6)
jno 0x18382e7
sbb al, 0x49
out 0x6a, eax
pop r12
mov dl, 0xb3
pop rsp
xchg edi, eax
sahf
xor cl, byte [rax - 0x2918daf0]
jb 0x18382d2
xchg rdi, rax
invalid
nop
mov byte [rsi + rax*4 + 0x24], ch
cmp al, byte [0x36305e7a]
invalid

Function at 0x1f31b71
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push qword [rsp + 0x28]
popfq
lea rsp, [rsp + 0x38]
call fcn.024068fb
add dword [rax], eax
add byte [rax], al
cmp ecx, dword [rcx - 0x710e5a72]
int1
leave
invalid

Function at 0x1f3acd5
Capabilities:
Encode data using xor

Disassembly:
cmc
imul esp, dword [rsi + 0x44], 0x8b4cd63b
insb byte [rdi], dx
and al, 0x10
call fcn.01f777ef
loopne 0x1f3acb9
int 0xa7
jge 0x1f3ad40
and eax, 0x225558a0
jge 0x1f3ace0
pop rax
add ecx, edx
push rbx
adc byte [rax + 0x67], bl
pop rbx
xchg esp, eax
xor esp, dword [rdi - 0x4a942b4a]
pop rax
lea ebp, [rdi]
test byte [rdx], dl
pop rax
mov esi, 0x58fba42f
sbb dl, byte [rcx + 0x6c58ec6d]
rcl bh, 0xf3
pop rax
test dword [0xffffffffde9ad764], ebx
jb 0x1f3acfc
cmpsd dword [rsi], dword [rdi]
stosd dword [rdi], eax
loop 0x1f3acbb
pop rax
invalid
cli
sbb al, 0x6c
add dl, al
add ebx, esp
xchg ebp, eax
cmp esp, dword [rsi]
sub dl, byte [rax + riz*8 + 0x1558fd51]
loope 0x1f3ad95
call [rdx + rdx*4 - 0x60467f3]
sti
invalid
sub dword [rsi], esp
invalid

Function at 0x1f758f5
Capabilities:
Encode data using xor

Disassembly:
push rdx
movabs rdx, 0x73bd537f58a24531
or edx, 0x308d228e
mov edx, 0xe1a7ae8
mov rdx, qword [rsp]
mov edx, dword [rsp]
push qword [rsp + 0x10]
popfq
lea rsp, [rsp + 0x18]
call fcn.023c7c25
rol byte [rbp + 1], cl
cmpsd dword [rsi], dword [rdi]
add dword [rsi], ebx
xor eax, 0x1cc35a2f
jnp 0x1f7590c
invalid
jmp 0x1f7591b
Function at 0x140001001
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x140031be0]
mov rcx, qword [0x140031b80]
xor edx, edx
mov dword [rax], 1
mov rax, qword [0x140031bf0]
cmp word [rcx], 0x5a4d
mov dword [rax], 1
mov rax, qword [0x140031c00]
mov dword [rax], 1
jne 0x140001083
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
cmp dword [rax], 0x4550
jne 0x140001083
mov ecx, dword [rax + 0x18]
cmp cx, 0x10b
je 0x14000105e
cmp cx, 0x20b
je 0x14000106d
jmp 0x140001083
cmp dword [rax + 0x74], 0xe
jbe 0x140001083
cmp dword [rax + 0xe8], 0
jmp 0x14000107d
cmp dword [rax + 0x84], 0xe
jbe 0x140001083
cmp dword [rax + 0xf8], 0
setne dl
movzx edx, dl
mov rax, qword [0x140031bd0]
mov dword [0x14003d00c], edx
mov ecx, 2
cmp dword [rax], 0
jne 0x14000109f
mov ecx, 1
call sym.__set_app_type
call sym.__p__fmode
mov rdx, qword [0x140031cb0]
mov edx, dword [rdx]
mov dword [rax], edx
call sym.__p__commode
mov rdx, qword [0x140031c90]
mov edx, dword [rdx]
mov dword [rax], edx
call sym._setargv
mov rax, qword [0x140031920]
cmp dword [rax], 1
jne 0x1400010e1
mov rcx, qword [sym._matherr]
call sym.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
Function at 0x14000306f
Capabilities:
Hide graphical window

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0xd0
mov qword [rbp + 0x10], rcx
movabs rax, 0x726170736e617254
movabs rdx, 0x6f646e6957746e65
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rdx
movabs rax, 0x7373616c43776f
mov qword [rbp - 0x11], rax
pxor xmm0, xmm0
movaps xmmword [rbp - 0x70], xmm0
movaps xmmword [rbp - 0x60], xmm0
movaps xmmword [rbp - 0x50], xmm0
movaps xmmword [rbp - 0x40], xmm0
movq qword [rbp - 0x30], xmm0
lea rax, [sym.WindowProc_HWND____unsigned_int__unsigned_long_long__long_long_]
mov qword [rbp - 0x68], rax
mov rax, qword [rbp + 0x10]
mov qword [rbp - 0x58], rax
lea rax, [rbp - 0x20]
mov qword [rbp - 0x30], rax
lea rax, [rbp - 0x70]
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_RegisterClassA]
call rax
lea rax, [rbp - 0x20]
mov qword [rsp + 0x58], 0
mov rdx, qword [rbp + 0x10]
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x38], 0x438
mov dword [rsp + 0x30], 0x780
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0x80000000
lea r8, str.Transparent_Window
mov rdx, rax
mov ecx, pe_nt_image_headers64
mov rax, qword [sym.imp.USER32.dll_CreateWindowExA]
call rax
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x140003164
mov eax, 0
jmp 0x1400031d2
mov rax, qword [rbp - 8]
mov edx, 0xffffffec
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_GetWindowLongA]
call rax
or eax, 0x80000
mov edx, eax
mov rax, qword [rbp - 8]
mov r8d, edx
mov edx, 0xffffffec
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_SetWindowLongA]
call rax
mov rax, qword [rbp - 8]
mov r9d, 2
mov r8d, 0xff
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
call rax
mov rax, qword [rbp - 8]
mov edx, 5
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_ShowWindow]
call rax
mov rax, qword [rbp - 8]
add rsp, 0xd0
pop rbp
ret

Function at 0x140006750
Capabilities:
Create process on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
mov r9d, 0
mov r8, rax
lea rax, str.open
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.SHELL32.dll_ShellExecuteA]
call rax
nop
add rsp, 0x30
pop rbp
ret
Function at 0x140006c06
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push rbp
mov eax, 0x1070
call fcn.140017780
sub rsp, rax
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x1000], rcx
mov dword [rbp + 0xfe0], 0x1000
mov qword [rbp + 0xfe8], 0
mov dword [rbp + 0xfe4], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov edx, 1
lea rax, str.WinINet_Example
mov rcx, rax
mov rax, qword [sym.imp.WININET.dll_InternetOpenA]
call rax
mov qword [rbp + 0xfd8], rax
cmp qword [rbp + 0xfd8], 0
jne 0x140006ca3
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rax, str.InternetOpen_failed:__d_n
mov rcx, rax
call sym.printf_char_const__::_
mov eax, 0
jmp 0x140006e6e
mov rdx, qword [rbp + 0x1000]
mov rax, qword [rbp + 0xfd8]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x80000000
mov r9d, 0
mov r8d, 0
mov rcx, rax
mov rax, qword [sym.imp.WININET.dll_InternetOpenUrlA]
call rax
mov qword [rbp + 0xfd0], rax
cmp qword [rbp + 0xfd0], 0
jne 0x140006dde
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rax, str.InternetOpenUrl_failed:__d_n
mov rcx, rax
call sym.printf_char_const__::_
mov rax, qword [rbp + 0xfd8]
mov rcx, rax
mov rax, qword [sym.imp.WININET.dll_InternetCloseHandle]
call rax
mov eax, 0
jmp 0x140006e6e
mov edx, dword [rbp - 0x44]
mov eax, dword [rbp + 0xfe4]
add eax, edx
add eax, 1
mov edx, eax
mov rax, qword [rbp + 0xfe8]
mov rcx, rax
call sym.realloc
mov qword [rbp + 0xfc8], rax
cmp qword [rbp + 0xfc8], 0
jne 0x140006da4
lea rax, str.Memory_allocation_failed._n
mov rcx, rax
call sym.printf_char_const__::_
mov rax, qword [rbp + 0xfd0]
mov rcx, rax
mov rax, qword [sym.imp.WININET.dll_InternetCloseHandle]
call rax
mov rax, qword [rbp + 0xfd8]
mov rcx, rax
mov rax, qword [sym.imp.WININET.dll_InternetCloseHandle]
call rax
mov rax, qword [rbp + 0xfe8]
mov rcx, rax
call sym.free
mov eax, 0
jmp 0x140006e6e
mov rax, qword [rbp + 0xfc8]
mov qword [rbp + 0xfe8], rax
mov eax, dword [rbp - 0x44]
mov r8d, eax
mov edx, dword [rbp + 0xfe4]
mov rax, qword [rbp + 0xfe8]
lea rcx, [rdx + rax]
lea rax, [rbp - 0x40]
mov rdx, rax
call sym.memcpy
mov eax, dword [rbp - 0x44]
add dword [rbp + 0xfe4], eax
lea r8, [rbp - 0x44]
mov ecx, dword [rbp + 0xfe0]
lea rdx, [rbp - 0x40]
mov rax, qword [rbp + 0xfd0]
mov r9, r8
mov r8d, ecx
mov rcx, rax
mov rax, qword [sym.imp.WININET.dll_InternetReadFile]
call rax
test eax, eax
je 0x140006e17
mov eax, dword [rbp - 0x44]
test eax, eax
je 0x140006e17
mov eax, 1
jmp 0x140006e1c
mov eax, 0
test al, al
jne 0x140006d26
cmp qword [rbp + 0xfe8], 0
je 0x140006e41
mov edx, dword [rbp + 0xfe4]
mov rax, qword [rbp + 0xfe8]
add rax, rdx
mov byte [rax], 0
mov rax, qword [rbp + 0xfd0]
mov rcx, rax
mov rax, qword [sym.imp.WININET.dll_InternetCloseHandle]
call rax
mov rax, qword [rbp + 0xfd8]
mov rcx, rax
mov rax, qword [sym.imp.WININET.dll_InternetCloseHandle]
call rax
mov rax, qword [rbp + 0xfe8]
add rsp, 0x1070
pop rbp
ret
Function at 0x140006e77
Capabilities:
Get common file path

Disassembly:
push rbp
sub rsp, 0x250
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x1e0], rcx
mov qword [rbp + 0x1e8], rdx
mov qword [rbp + 0x1c8], 0
lea rax, [rbp + 0xc0]
mov qword [rsp + 0x20], rax
mov r9d, 0
mov r8d, 0
mov edx, 0x28
mov ecx, 0
mov rax, qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
call rax
not eax
shr eax, 0x1f
test al, al
je 0x140006f7f
lea rcx, [rbp + 0xc0]
lea rax, [rbp - 0x50]
mov rdx, qword [rbp + 0x1e0]
mov qword [rsp + 0x20], rdx
mov r9, rcx
lea r8, [0x14002e33d]
mov edx, 0x104
mov rcx, rax
call sym.snprintf_char__unsigned_long_long__char_const__::_
lea rax, [rbp - 0x50]
lea rdx, [0x14002e343]
mov rcx, rax
call sym.fopen
mov qword [rbp + 0x1c8], rax
cmp qword [rbp + 0x1c8], 0
je 0x140006f67
mov rdx, qword [rbp + 0x1c8]
mov rax, qword [rbp + 0x1e8]
mov rcx, rax
call sym.fputs
mov rax, qword [rbp + 0x1c8]
mov rcx, rax
call sym.fclose
lea rax, [rbp - 0x50]
mov rdx, rax
lea rax, str.Content_successfully_written_to_file:__s_n
mov rcx, rax
call sym.printf_char_const__::_
jmp 0x140006f8e
lea rax, [rbp - 0x50]
mov rdx, rax
lea rax, str.Failed_to_open_file:__s_n
mov rcx, rax
call sym.printf_char_const__::_
jmp 0x140006f8e
lea rax, str.Failed_to_retrieve_Documents_directory_path._n
mov rcx, rax
call sym.printf_char_const__::_
nop
add rsp, 0x250
pop rbp
ret

Function at 0x140006f98
Capabilities:
Get common file path
Read file on windows

Disassembly:
push rbp
sub rsp, 0x270
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x200], rcx
mov qword [rbp + 0x1e0], 0
mov qword [rbp + 0x1e8], 0
lea rax, [rbp + 0xc0]
mov qword [rsp + 0x20], rax
mov r9d, 0
mov r8d, 0
mov edx, 0x28
mov ecx, 0
mov rax, qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
call rax
not eax
shr eax, 0x1f
test al, al
je 0x140007123
lea rcx, [rbp + 0xc0]
lea rax, [rbp - 0x50]
mov rdx, qword [rbp + 0x200]
mov qword [rsp + 0x20], rdx
mov r9, rcx
lea r8, [0x14002e33d]
mov edx, 0x104
mov rcx, rax
call sym.snprintf_char__unsigned_long_long__char_const__::_
lea rax, [rbp - 0x50]
lea rdx, [0x14002e3be]
mov rcx, rax
call sym.fopen
mov qword [rbp + 0x1e0], rax
cmp qword [rbp + 0x1e0], 0
je 0x14000711c
mov rax, qword [rbp + 0x1e0]
mov r8d, 2
mov edx, 0
mov rcx, rax
call sym.fseek
mov rax, qword [rbp + 0x1e0]
mov rcx, rax
call sym.ftell
mov dword [rbp + 0x1dc], eax
mov rax, qword [rbp + 0x1e0]
mov rcx, rax
call sym.rewind
mov eax, dword [rbp + 0x1dc]
add eax, 1
cdqe
mov rcx, rax
call sym.malloc
mov qword [rbp + 0x1e8], rax
cmp qword [rbp + 0x1e8], 0
je 0x14000710b
mov eax, dword [rbp + 0x1dc]
movsxd rdx, eax
mov rcx, qword [rbp + 0x1e0]
mov rax, qword [rbp + 0x1e8]
mov r9, rcx
mov r8, rdx
mov edx, 1
mov rcx, rax
call sym.fread
mov qword [rbp + 0x1d0], rax
mov rdx, qword [rbp + 0x1e8]
mov rax, qword [rbp + 0x1d0]
add rax, rdx
mov byte [rax], 0
mov rax, qword [rbp + 0x1e0]
mov rcx, rax
call sym.fclose
jmp 0x140007132
lea rax, str.Failed_to_allocate_memory_for_file_content._n
mov rcx, rax
call sym.printf_char_const__::_
jmp 0x140007132
mov eax, 0
jmp 0x140007139
lea rax, str.Failed_to_retrieve_Documents_directory_path._n
mov rcx, rax
call sym.printf_char_const__::_
mov rax, qword [rbp + 0x1e8]
add rsp, 0x270
pop rbp
ret
Function at 0x140007142
Capabilities:
Get graphical window text

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
cmp qword [rbp + 0x10], 0
je 0x14000717a
mov dword [rbp - 4], 0x400
mov ecx, dword [rbp - 4]
mov rdx, qword [rbp + 0x18]
mov rax, qword [rbp + 0x10]
mov r8d, ecx
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_GetWindowTextA]
call rax
nop
add rsp, 0x30
pop rbp
ret

Function at 0x14000d5e0
Capabilities:
Get common file path

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
mov dword [rbp + 0x18], edx
mov rax, qword [rbp + 0x10]
mov qword [rsp + 0x20], rax
mov r9d, 0
mov r8d, 0
mov edx, 0x10
mov ecx, 0
mov rax, qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
call rax
add rsp, 0x30
pop rbp
ret

Function at 0x14000f48b
Capabilities:
Get disk information

Disassembly:
push rbp
push rbx
sub rsp, 0x278
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x210], rcx
lea r8, [rbp - 0x34]
lea rdx, [rbp + 0xe0]
mov rax, qword [rbp + 0x210]
mov dword [rsp + 0x38], 0x105
lea rcx, [rbp - 0x30]
mov qword [rsp + 0x30], rcx
lea rcx, [rbp - 0x3c]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp - 0x38]
mov qword [rsp + 0x20], rcx
mov r9, r8
mov r8d, 0x105
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
call rax
test eax, eax
sete al
test al, al
je 0x14000f52e
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov ebx, eax
mov ecx, 2
mov rax, qword [sym.__acrt_iob_func]
call rax
mov rcx, rax
mov r8d, ebx
lea rax, str.Failed_to_get_volume_information._Error:__lu_n
mov rdx, rax
call sym.fprintf__iobuf__char_const__::_
mov ecx, 1
call sym.exit
mov ecx, 0x400
call sym.malloc
mov qword [rbp + 0x1e8], rax
mov edx, dword [rbp - 0x34]
mov rax, qword [rbp + 0x1e8]
mov r8d, edx
lea rdx, [0x14002ec36]
mov rcx, rax
call sym.sprintf_char__char_const__::_
mov rax, qword [rbp + 0x1e8]
add rsp, 0x278
pop rbx
pop rbp
ret

Function at 0x14000f56c
Capabilities:
Get common file path

Disassembly:
push rbp
push rbx
sub rsp, 0x158
lea rbp, [rsp + 0x80]
lea rax, [rbp - 0x50]
mov edx, 0x105
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
call rax
mov dword [rbp + 0xcc], eax
cmp dword [rbp + 0xcc], 0
jne 0x14000f5d9
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov ebx, eax
mov ecx, 2
mov rax, qword [sym.__acrt_iob_func]
call rax
mov rcx, rax
mov r8d, ebx
lea rax, str.Failed_to_get_Windows_directory._Error:__lu_n
mov rdx, rax
call sym.fprintf__iobuf__char_const__::_
mov ecx, 1
call sym.exit
lea rdx, [rbp - 0x50]
lea rax, [rbp - 0x54]
mov r8d, 3
mov rcx, rax
call sym.strncpy
mov byte [rbp - 0x51], 0
mov ecx, 0xa
call sym.malloc
mov qword [rbp + 0xc0], rax
lea rdx, [rbp - 0x54]
mov rax, qword [rbp + 0xc0]
mov r8, rdx
lea rdx, [0x14002ec6d]
mov rcx, rax
call sym.sprintf_char__char_const__::_
mov rax, qword [rbp + 0xc0]
add rsp, 0x158
pop rbx
pop rbp
ret