joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140040970
Capabilities:
Enumerate gui resources

Disassembly:
push rbx
mov eax, 0x11ce0
call fcn.1400bcc10
sub rsp, rax
xor eax, eax
mov byte [rsp + 0x1881], 1
mov rbx, rcx
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x1884], eax
lea rcx, [0x1400e8120]
mov qword [rsp + 0x1888], rax
cmp edx, 6
mov rdx, qword [0x1400fcaa8]
xorps xmm0, xmm0
mov dword [rsp + 0x18a0], eax
mov qword [rsp + 0x18a8], rax
mov qword [rsp + 0x18c0], rax
cmove rax, rbx
mov qword [rsp + 0x18b8], rax
mov rax, qword [rsp + 0x11d18]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x11d10]
mov qword [rsp + 0x1048], rcx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x20], rax
movdqa xmmword [rsp + 0x1890], xmm0
call fcn.14008d480
test eax, eax
je 0x140040a21
lea rdx, [rsp + 0x30]
lea rcx, [0x14008c740]
call qword [sym.imp.USER32.dll_EnumWindows]
movsxd rdx, dword [rsp + 0x1884]
mov r8b, reloc.OLEAUT32.dll_SafeArrayGetElement
mov rcx, rbx
call fcn.140001460
mov eax, 1
add rsp, 0x11ce0
pop rbx
ret
Function at 0x140041a00
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
mov eax, 0x10030
call fcn.1400bcc10
sub rsp, rax
mov rbx, qword [0x140105130]
mov rbp, rdx
mov rcx, rbp
lea rdx, [rsp + 0x30]
mov r8d, 0x7fff
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esi, eax
mov byte [rsp + 0x20], 1
cmp eax, 0x7fff
jb 0x140041b73
lea r8d, [rsi - 1]
mov r9b, 1
xor edx, edx
mov rcx, rbx
call fcn.14008ac50
test eax, eax
je 0x140041b93
cmp byte [rbx + 0x23], 0
mov qword [rsp + 0x10040], rdi
jne 0x140041a75
mov rdi, qword [rbx + 0x10]
jmp 0x140041a78
mov rdi, rbx
test byte [rdi + 0x21], 8
je 0x140041a86
mov rcx, rdi
call fcn.140001500
movzx eax, byte [rdi + 0x23]
cmp al, 1
jne 0x140041aa2
test byte [rdi + 0x21], 4
je 0x140041a9c
mov rdx, rdi
call fcn.1400366a0
mov rcx, qword [rdi + 8]
jmp 0x140041b07
cmp al, 2
jne 0x140041b00
mov rcx, qword [0x140105fe8]
test rcx, rcx
jne 0x140041b07
mov ecx, SafeArrayGetElemsize
call qword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
jne 0x140041ae0
lea ecx, [rax + 0xf]
call qword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
lea rdx, [0x1400cbfb0]
lea rcx, [0x1400e8120]
cmovne rcx, rdx
jmp 0x140041b07
xor edx, edx
call fcn.140004cf0
mov edx, 0xffffffff
lea rcx, [0x1400e8120]
cmp rax, rdx
cmovne rcx, qword [0x140105fe0]
jmp 0x140041b07
lea rcx, [0x140105300]
mov rdx, rcx
mov r8d, esi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edi, 1
test eax, eax
jne 0x140041b31
xor r8d, r8d
mov edx, edi
mov rcx, rbx
call fcn.140001630
xor ecx, ecx
mov word [rax], cx
cmp byte [rbx + 0x23], 0
jne 0x140041b3b
mov rbx, qword [rbx + 0x10]
cmp byte [rbx + 0x23], 2
jne 0x140041b63
cmp qword [0x140105fe8], 0
je 0x140041b63
lea rcx, [0x140105fd0]
call fcn.1400050c0
mov edi, eax
mov rdi, qword [rsp + 0x10040]
jmp 0x140041b93
and byte [rbx + 0x21], 0x86
mov eax, edi
mov rdi, qword [rsp + 0x10040]
jmp 0x140041b93
test eax, eax
lea rcx, [0x1400e8120]
lea rdx, [rsp + 0x30]
mov r8, rsi
cmove rdx, rcx
xor r9d, r9d
mov rcx, rbx
call fcn.14008ac50
lea r11, [rsp + 0x10030]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsp, r11
pop rsi
ret
Function at 0x140048d70
Capabilities:
Get keyboard layout

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x250
mov rsi, qword [0x140105130]
xor ecx, ecx
mov rdi, r8
mov rbx, rdx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
mov r9b, 1
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rax
mov rcx, rbx
call fcn.140014610
movzx ebp, al
test al, al
jne 0x140048e15
xor r8d, r8d
lea rdx, [rsp + 0x260]
mov rcx, rbx
call fcn.14005c980
xor r9d, r9d
test eax, eax
jne 0x140048de3
lea rdx, [0x1400e8120]
jmp 0x140048e6e
mov edx, dword [rsp + 0x260]
lea r8, [rsp + 0x30]
xor ecx, ecx
mov dword [rsp + 0x40], ecx
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x30], rcx
mov ecx, eax
call fcn.14005cd90
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.14008a4e0
jmp 0x140048e7f
movzx ebx, word [rdi]
mov edi, 2
test ebx, 0xffffff80
jne 0x140048e35
mov edx, edi
mov ecx, ebx
call fcn.1400aa514
test eax, eax
je 0x140048e35
and ebx, 0xffffffdf
movzx eax, bx
cmp eax, 0x50
je 0x140048e47
xor ecx, ecx
cmp eax, 0x54
cmovne edi, ecx
jmp 0x140048e4c
mov edi, 1
mov edx, edi
movzx ecx, bpl
call fcn.14005cce0
test al, al
lea rcx, [0x1400e7570]
lea rdx, [0x1400e7574]
cmovne rdx, rcx
xor r9d, r9d
or r8, 0xffffffffffffffff
mov byte [rsp + 0x20], 1
mov rcx, rsi
call fcn.14008ac50
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140048ea0
Capabilities:
Get disk size

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x260
movzx edi, r8b
mov byte [rsp + 0x20], 1
mov rbx, rdx
mov rsi, rcx
mov rcx, qword [0x140105130]
or r8, 0xffffffffffffffff
xor edx, edx
xor r9d, r9d
call fcn.14008ac50
test rbx, rbx
je 0x140049058
cmp word [rbx], 0
je 0x140049058
mov r8d, 0x104
lea rcx, [rsp + 0x50]
mov rdx, rbx
call fcn.1400b0a34
xor edx, edx
lea rcx, [rsp + 0x50]
mov word [rsp + 0x258], dx
or rax, 0xffffffffffffffff
nop
inc rax
cmp word [rcx + rax*2], dx
jne 0x140048f10
lea rcx, [rax + rax]
cmp word [rsp + rcx + 0x4e], 0x5c
je 0x140048f3c
inc rax
cmp rax, 0x105
jae 0x140049058
mov dword [rsp + rcx + 0x50], 0x5c
mov rax, qword gs:[0x58]
mov edx, 4
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x140107c38], eax
jle 0x140048f9d
lea rcx, [0x140107c38]
call fcn.1400a371c
cmp dword [0x140107c38], 0xffffffff
jne 0x140048f9d
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.GetDiskFreeSpaceExW
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x140107c38]
mov qword [0x140107c40], rax
call fcn.1400a36bc
mov rax, qword [0x140107c40]
lea rcx, [rsp + 0x50]
test rax, rax
je 0x140048fd7
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x40]
call rax
test eax, eax
je 0x140049058
mov rbx, qword [rsp + 0x38]
test dil, dil
cmovne rbx, qword [rsp + 0x40]
jmp 0x14004901c
lea rax, [rsp + 0x278]
lea r9, [rsp + 0x288]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x34]
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
test eax, eax
je 0x140049058
mov ebx, dword [rsp + 0x278]
test dil, dil
cmovne ebx, dword [rsp + 0x288]
imul ebx, dword [rsp + 0x30]
imul ebx, dword [rsp + 0x34]
mov rcx, qword [0x140100ee0]
lea rdx, [0x1400cc0a4]
xor r9d, r9d
shr rbx, 0x14
or r8, 0xffffffffffffffff
mov byte [rsp + 0x20], 1
call fcn.14008ac50
mov rcx, qword [0x140105130]
mov r8b, reloc.OLEAUT32.dll_SafeArrayGetElement
mov rdx, rbx
call fcn.140001460
mov eax, 1
jmp 0x14004909b
mov rax, qword [0x1400fcaa8]
lea rdx, [0x1400df6c0]
cmp byte [rax + 0x150], 0
jne 0x140049089
mov rcx, qword [0x140100ee0]
xor r9d, r9d
or r8, 0xffffffffffffffff
mov byte [rsp + 0x20], 1
call fcn.14008ac50
jmp 0x14004909b
lea r9, [0x1400e8120]
xor r8d, r8d
mov rcx, rsi
call fcn.140035600
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x14004b1d0
Capabilities:
Get common file path
Set current directory

Disassembly:
push rbx
sub rsp, 0x250
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
jne 0x14004b200
cmp byte [0x140105f30], al
je 0x14004b2d3
call fcn.14000b090
add rsp, 0x250
pop rbx
ret
cmp byte [0x140105f30], 0
lea rax, [0x140100cd0]
mov qword [rsp + 0x260], rdi
mov ecx, 0x104
lea rdi, [rsp + 0x40]
cmovne rdi, rax
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x14004b289
cmp word [rbx], 0
je 0x14004b2a3
cmp word [rbx + 2], 0x3a
jne 0x14004b2a3
cmp word [rbx + 4], 0
jne 0x14004b2a3
mov rdx, rdi
mov rcx, rbx
call fcn.1400a7970
test eax, eax
je 0x14004b2a3
mov r8, rbx
lea rdx, [0x1400e7a58]
lea rcx, [rsp + 0x30]
call fcn.140004c90
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
je 0x14004b2a3
mov rdx, rdi
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
jne 0x14004b2a3
mov r8d, 0x103
mov rdx, rbx
mov rcx, rdi
call fcn.1400b0a34
xor eax, eax
mov word [rdi + 0x206], ax
cmp byte [0x140105f30], 0
mov rdi, qword [rsp + 0x260]
je 0x14004b2d3
mov rcx, qword [0x140100ee0]
lea rdx, [0x1400cc0a4]
xor r9d, r9d
mov byte [rsp + 0x20], 1
or r8, 0xffffffffffffffff
call fcn.14008ac50
add rsp, 0x250
pop rbx
ret
Function at 0x14004bb50
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x230
mov rdi, rdx
mov rsi, rcx
test rdx, rdx
je 0x14004bca9
cmp word [rdx], 0
je 0x14004bca9
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14004bbb4
mov rdx, qword [0x1400fcaa8]
mov rcx, rsi
shr eax, 4
not al
and al, 1
mov dword [rdx + 0x40], 0xb7
movzx edx, al
mov rsi, qword [rsp + 0x250]
add rsp, 0x230
pop rdi
jmp fcn.140035720
mov qword [rsp + 0x240], rbx
mov edx, 0x5c
mov rcx, rdi
mov qword [rsp + 0x248], rbp
call fcn.1400a5db4
mov rbp, rax
cmp rax, rdi
jbe 0x14004bc81
or rcx, 0xffffffffffffffff
inc rcx
cmp word [rdi + rcx*2], 0
jne 0x14004bbe1
cmp rcx, 0x104
jb 0x14004bc2d
mov rax, qword [0x1400fcaa8]
mov dl, 1
mov dword [rax + 0x40], WSAStartup
mov rcx, rsi
call fcn.140035720
mov rbx, qword [rsp + 0x240]
mov rbp, qword [rsp + 0x248]
mov rsi, qword [rsp + 0x250]
add rsp, 0x230
pop rdi
ret
mov rbx, rax
lea rcx, [rsp + 0x20]
sub rbx, rdi
mov rdx, rdi
sar rbx, 1
mov r8, rbx
call fcn.1400b0a34
xor eax, eax
lea rdx, [rsp + 0x20]
mov rcx, rsi
mov word [rsp + rbx*2 + 0x20], ax
call fcn.14004bb50
cmp word [rbp + 2], 0
je 0x14004bc7a
mov rcx, qword [0x140100ee0]
xor r8d, r8d
lea edx, [r8 + 1]
call fcn.140001630
cmp word [rax], 0x31
jne 0x14004bc81
mov eax, 1
jmp 0x14004bc0c
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
sete bl
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x1400fcaa8]
movzx edx, bl
mov dword [rcx + 0x40], eax
jmp 0x14004bc04
mov rax, qword [0x1400fcaa8]
mov dl, 1
mov dword [rax + 0x40], 0x57
mov rsi, qword [rsp + 0x250]
add rsp, 0x230
pop rdi
jmp fcn.140035720
Function at 0x14004c950
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov rsi, r8
mov r14, rdx
mov r15, rcx
test r8, r8
je 0x14004ca48
cmp byte [r8 + 0x23], 0
jne 0x14004c97f
mov rbx, qword [r8 + 0x10]
jmp 0x14004c982
mov rbx, r8
test byte [rbx + 0x21], 8
je 0x14004c990
mov rcx, rbx
call fcn.140001500
movzx eax, byte [rbx + 0x23]
cmp al, 1
jne 0x14004c9ac
test byte [rbx + 0x21], 4
je 0x14004c9a6
mov rdx, rbx
call fcn.1400366a0
mov rbx, qword [rbx + 8]
jmp 0x14004ca0f
cmp al, 2
jne 0x14004ca08
mov rbx, qword [0x140105fe8]
test rbx, rbx
jne 0x14004ca0f
lea ecx, [rbx + 0xd]
call qword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
jne 0x14004c9e8
lea ecx, [rbx + 0xf]
call qword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
lea rcx, [0x1400cbfb0]
lea rbx, [0x1400e8120]
cmovne rbx, rcx
jmp 0x14004ca0f
xor edx, edx
call fcn.140004cf0
mov ecx, 0xffffffff
lea rbx, [0x1400e8120]
cmp rax, rcx
cmovne rbx, qword [0x140105fe0]
jmp 0x14004ca0f
lea rbx, [0x140105300]
cmp byte [rsi + 0x23], 0
jne 0x14004ca1b
mov rdi, qword [rsi + 0x10]
jmp 0x14004ca1e
mov rdi, rsi
cmp byte [rdi + 0x23], 1
jne 0x14004ca3c
test byte [rdi + 0x21], 8
je 0x14004ca32
mov rcx, rdi
call fcn.140001500
mov rbp, qword [rdi + 0x10]
add rdi, 0x10
jmp 0x14004ca92
lea rdi, [0x140106c28]
mov rbp, qword [rdi]
jmp 0x14004ca92
lea r8, [rsp + 0x88]
xor ecx, ecx
lea rdx, [rsp + 0x80]
call fcn.14008a5e0
test eax, eax
jne 0x14004ca82
mov rax, qword [0x1400fcaa8]
xor edi, edi
mov dword [rax + 0x40], edi
xor eax, eax
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov rbx, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x88]
xor edi, edi
xor r9d, r9d
mov qword [rsp + 0x30], rdi
xor r8d, r8d
mov dword [rsp + 0x28], edi
mov edx, 0x40000000
mov rcx, r14
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x14004caf9
mov ecx, edi
mov dword [rsp + 0x80], ecx
test rbx, rbx
je 0x14004caf3
lea r9, [rsp + 0x80]
mov qword [rsp + 0x20], rdi
mov r8d, ebp
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [rsp + 0x80]
cmp ecx, ebp
sete dil
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, qword [0x1400fcaa8]
mov dword [rdx + 0x40], eax
cmp r14, 0xffffffffffffffff
je 0x14004cb18
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rsi, rsi
jne 0x14004cb25
mov rcx, rbx
call fcn.1400aba10
test edi, edi
mov rcx, r15
sete dl
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
pop rsi
pop rbp
jmp fcn.140035720
Function at 0x14004ce50
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x260
mov rbp, rcx
mov rdi, r9
mov rcx, r9
mov rsi, r8
mov rbx, rdx
call fcn.14000ed20
mov rcx, rdi
test al, al
je 0x14004ce8f
xor edx, edx
lea r8d, [rdx + 0x10]
call fcn.1400ab9b0
jmp 0x14004ce94
call fcn.1400ab54c
cmp eax, 1
je 0x14004cef0
mov rcx, rsi
call fcn.140062390
test al, al
je 0x14004cef0
mov rax, qword [0x1400fcaa8]
lea rdx, [0x1400df6c0]
cmp byte [rax + 0x150], 0
jne 0x14004ced9
mov rcx, qword [0x140100ee0]
xor r9d, r9d
or r8, 0xffffffffffffffff
mov byte [rsp + 0x20], 1
call fcn.14008ac50
jmp 0x14004cfed
lea r9, [0x1400e8120]
xor r8d, r8d
mov rcx, rbp
call fcn.140035600
jmp 0x14004cfed
mov qword [rsp + 0x30], 0
xor r9d, r9d
mov dword [rsp + 0x28], 0
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x20], 2
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14004cea5
or r8, 0xffffffffffffffff
nop
inc r8
cmp word [rbx + r8*2], 0
jne 0x14004cf30
cmp r8, 0x104
lea rcx, [rsp + 0x50]
mov eax, 0x103
mov rdx, rbx
cmovae r8, rax
lea r8, [r8*2 + 2]
call fcn.1400a56f0
lea rcx, [rsp + 0x50]
call fcn.1400afef4
mov r8d, 0xa
lea rdx, [rsp + 0x50]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rsi, rax
test rax, rax
je 0x14004cfd5
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x14004cfd5
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x14004cfd5
mov rdx, rsi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], 0
mov r8d, eax
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
setne bl
jmp 0x14004cfd7
xor bl, bl
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
mov rcx, rbp
sete dl
call fcn.140035720
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x14004d010
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x130
mov rbx, rdx
mov byte [rsp + 0x20], 1
mov rdi, rcx
xor edx, edx
mov rcx, qword [0x140105130]
xor r9d, r9d
or r8, 0xffffffffffffffff
call fcn.14008ac50
test rbx, rbx
je 0x14004d0ba
cmp word [rbx], 0
je 0x14004d0ba
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x14004d06a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x1400fcaa8]
mov dword [rcx + 0x40], eax
jmp 0x14004d0c8
mov rax, qword [0x1400fcaa8]
xor edx, edx
mov rcx, rdi
mov dword [rax + 0x40], 0
call fcn.140035720
mov edx, ebx
lea rcx, [rsp + 0x30]
call fcn.1400889a0
mov rcx, qword [0x140105130]
xor r9d, r9d
or r8, 0xffffffffffffffff
mov byte [rsp + 0x20], 1
mov rdx, rax
call fcn.14008ac50
mov rbx, qword [rsp + 0x140]
add rsp, 0x130
pop rdi
ret
mov rax, qword [0x1400fcaa8]
mov dword [rax + 0x40], 0x57
mov dl, 1
mov rcx, rdi
call fcn.140035720
mov rbx, qword [rsp + 0x140]
add rsp, 0x130
pop rdi
ret
Function at 0x14004e010
Capabilities:
Get file size

Disassembly:
push rbp
push rdi
push r14
sub rsp, 0x290
mov r14, r8
mov byte [rsp + 0x20], 1
mov rdi, rdx
mov rbp, rcx
mov rcx, qword [0x140105130]
or r8, 0xffffffffffffffff
xor edx, edx
xor r9d, r9d
call fcn.14008ac50
test rdi, rdi
je 0x14004e1c0
cmp word [rdi], 0
je 0x14004e1c0
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x2b0], rbx
mov edx, 0x80
mov dword [rsp + 0x28], 0
mov rcx, rdi
mov qword [rsp + 0x2c0], rsi
lea r8d, [r9 + 7]
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x14004e0b9
lea rdx, [rsp + 0x2b8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
jne 0x14004e123
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp rax, 0xffffffffffffffff
jne 0x14004e103
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x1400fcaa8]
mov dl, 1
mov dword [rcx + 0x40], eax
mov rcx, rbp
call fcn.140035720
mov rbx, qword [rsp + 0x2b0]
mov rsi, qword [rsp + 0x2c0]
add rsp, 0x290
pop r14
pop rdi
pop rbp
ret
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [rsp + 0x5c]
mov eax, dword [rsp + 0x60]
shl rcx, 0x20
or rcx, rax
mov qword [rsp + 0x2b8], rcx
movzx ebx, word [r14]
test ebx, 0xffffff80
jne 0x14004e142
mov edx, 2
mov ecx, ebx
call fcn.1400aa514
test eax, eax
je 0x14004e142
and ebx, 0xffffffdf
movzx eax, bx
cmp eax, 0x4b
je 0x14004e168
cmp eax, 0x4d
jne 0x14004e187
mov rax, qword [rsp + 0x2b8]
cqo
and edx, 0xfffff
add rax, rdx
sar rax, 0x14
jmp 0x14004e17f
mov rax, qword [rsp + 0x2b8]
cqo
and edx, 0x3ff
add rax, rdx
sar rax, 0xa
mov qword [rsp + 0x2b8], rax
mov rax, qword [0x1400fcaa8]
xor edx, edx
mov rcx, rbp
mov dword [rax + 0x40], 0
call fcn.140035720
mov rdx, qword [rsp + 0x2b8]
mov r8b, reloc.OLEAUT32.dll_SafeArrayGetElement
mov rcx, qword [0x140105130]
call fcn.140001460
mov eax, 1
jmp 0x14004e0e7
mov rax, qword [0x1400fcaa8]
mov dl, 1
mov rcx, rbp
mov dword [rax + 0x40], 0x57
call fcn.140035720
add rsp, 0x290
pop r14
pop rdi
pop rbp
ret

Function at 0x14005cce0
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x20
movzx ebx, cl
test cl, cl
jne 0x14005ccf5
xor al, al
add rsp, 0x20
pop rbx
ret
sub edx, 1
je 0x14005cd22
movzx ecx, bl
cmp edx, 1
je 0x14005cd13
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and al, 1
add rsp, 0x20
pop rbx
ret
call qword [sym.imp.USER32.dll_GetKeyState]
and eax, 1
add rsp, 0x20
pop rbx
ret
cmp bl, 6
ja 0x14005cd31
mov ecx, 0x76
bt ecx, ebx
jb 0x14005cd38
lea eax, [rbx + 0x66]
cmp al, 5
ja 0x14005cd56
cmp qword [0x140100f20], 0
jne 0x14005cd78
movzx ecx, bl
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
and al, 1
add rsp, 0x20
pop rbx
ret
cmp qword [0x140100f28], 0
je 0x14005cd42
xor edx, edx
xor r8d, r8d
movzx ecx, bl
call fcn.140013cb0
test al, al
je 0x14005cd78
mov cl, 1
call fcn.140013aa0
movzx eax, bl
lea rcx, [0x140101cd0]
movzx eax, byte [rax + rcx]
shr al, 7
add rsp, 0x20
pop rbx
ret
Function at 0x14005d1a0
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x230
mov rdi, rdx
mov esi, ecx
mov r8d, ecx
xor r15d, r15d
mov word [rdx], r15w
mov ecx, 0x410
xor edx, edx
movzx ebx, r9b
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r14, rax
test rax, rax
jne 0x14005d1fa
mov r8d, esi
xor edx, edx
mov ecx, 0x1000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r14, rax
test rax, rax
je 0x14005d34c
xor edx, edx
mov qword [rsp + 0x250], rbp
mov r9d, 0x104
mov r8, rdi
mov rcx, r14
test bl, bl
je 0x14005d21c
call qword [sym.imp.PSAPI.DLL_GetModuleBaseNameW]
jmp 0x14005d222
call qword [sym.imp.PSAPI.DLL_GetModuleFileNameExW]
mov ebp, eax
test eax, eax
jne 0x14005d339
mov rax, qword [0x1400e5a88]
test rax, rax
je 0x14005d339
mov r8d, 0x104
mov rdx, rdi
mov rcx, r14
call rax
mov ebp, eax
test eax, eax
je 0x14005d339
test bl, bl
je 0x14005d290
mov edx, 0x5c
mov rcx, rdi
call fcn.1400a5db4
test rax, rax
je 0x14005d339
or r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], r15w
jne 0x14005d272
add r8, r8
lea rdx, [rax + 2]
mov rcx, rdi
call fcn.1400a56f0
jmp 0x14005d339
mov eax, 0x41
mov dword [rsp + 0x25a], 0x3a
mov word [rsp + 0x258], ax
nop dword [rax + rax]
mov r8d, 0x104
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x258]
call qword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
mov ebx, eax
cmp eax, 2
jbe 0x14005d2ee
add ebx, 0xfffffffe
lea rcx, [rsp + 0x20]
mov r8d, ebx
mov rdx, rdi
call fcn.1400af7c0
test eax, eax
jne 0x14005d2ee
cmp word [rdi + rbx*2], 0x5c
je 0x14005d309
movzx eax, word [rsp + 0x258]
inc ax
mov word [rsp + 0x258], ax
cmp ax, 0x5a
jbe 0x14005d2b0
jmp 0x14005d339
movzx eax, word [rsp + 0x258]
lea rdx, [rdi + rbx*2]
mov word [rdi], ax
lea rcx, [rdi + 4]
movzx eax, word [rsp + 0x25a]
sub ebp, ebx
mov word [rdi + 2], ax
lea r8d, [rbp + 1]
add r8, r8
call fcn.1400a56f0
add ebp, 2
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebp
mov rbp, qword [rsp + 0x250]
lea r11, [rsp + 0x230]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x1400611d0
Capabilities:
Delete file

Disassembly:
push rbx
sub rsp, 0x280
mov rax, rdx
mov rbx, rcx
test rdx, rdx
je 0x1400612a9
cmp word [rdx], 0
je 0x1400612a9
lea r9, [rsp + 0x298]
mov edx, 0x104
lea r8, [rsp + 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
or r8, 0xffffffffffffffff
lea rcx, [rsp + 0x70]
mov rax, r8
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140061220
xor ecx, ecx
test rax, rax
je 0x14006123e
cmp word [rsp + rax*2 + 0x6e], 0x5c
jne 0x14006123e
mov word [rsp + rax*2 + 0x6e], cx
lea rax, [rsp + 0x70]
cmp word [rax + r8*2 + 2], cx
lea r8, [r8 + 1]
jne 0x140061243
lea rax, [rsp + 0x70]
mov word [rsp + r8*2 + 0x72], cx
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
mov eax, 0x4054
mov dword [rsp + 0x54], ecx
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x48], rcx
lea rcx, [rsp + 0x30]
mov word [rsp + 0x50], ax
movdqu xmmword [rsp + 0x58], xmm0
mov dword [rsp + 0x38], 3
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
mov rcx, rbx
setne dl
call fcn.140035720
add rsp, 0x280
pop rbx
ret
mov rax, qword [0x1400fcaa8]
lea rdx, [0x1400df6c0]
cmp byte [rax + 0x150], 0
jne 0x1400612e1
mov rcx, qword [0x140100ee0]
xor r9d, r9d
or r8, 0xffffffffffffffff
mov byte [rsp + 0x20], 1
call fcn.14008ac50
add rsp, 0x280
pop rbx
ret
lea r9, [0x1400e8120]
xor r8d, r8d
call fcn.140035600
add rsp, 0x280
pop rbx
ret