joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400c1c20
Capabilities:
Get file version info

Disassembly:
push rbx
push rdi
sub rsp, 0x238
xor edi, edi
mov rbx, rcx
lea rax, [rcx + 8]
test rcx, rcx
jne 0x1400c1c3a
mov eax, edi
xor ecx, ecx
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rcx
mov qword [rax + 0x18], rcx
mov qword [rax + 0x20], rcx
mov qword [rax + 0x28], rcx
mov dword [rax + 0x30], ecx
mov rcx, qword [rbx + 0x40]
test rcx, rcx
je 0x1400c1c7b
lea rdx, [rsp + 0x20]
mov r8d, 0x104
mov dword [rbx + 0x68], 1
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x1400c1c87
xor eax, eax
add rsp, 0x238
pop rdi
pop rbx
ret
mov rcx, qword [rbx + 0x60]
mov qword [rsp + 0x230], rsi
test rcx, rcx
je 0x1400c1ca1
call fcn.1400e4058
mov qword [rbx + 0x60], rdi
lea rdx, [rsp + 0x258]
lea rcx, [rsp + 0x20]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test eax, eax
je 0x1400c1cfe
mov ecx, esi
call fcn.1400e3178
lea rcx, [rsp + 0x20]
mov r8d, esi
mov r9, rax
xor edx, edx
mov qword [rbx + 0x60], rax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x1400c1cfe
mov rcx, qword [rbx + 0x60]
lea r9, [rsp + 0x250]
lea r8, [rsp + 0x260]
lea rdx, [0x140122f58]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
jne 0x1400c1d12
xor eax, eax
mov rsi, qword [rsp + 0x230]
add rsp, 0x238
pop rdi
pop rbx
ret
mov rax, qword [rsp + 0x260]
lea r9, [rsp + 0x250]
lea r8, [rsp + 0x260]
lea rdx, str.VarFileInfoTranslation
movups xmm0, xmmword [rax]
movups xmmword [rbx + 8], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx + 0x18], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rbx + 0x28], xmm0
mov eax, dword [rax + 0x30]
mov dword [rbx + 0x38], eax
mov rcx, qword [rbx + 0x60]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x1400c1d72
cmp dword [rsp + 0x250], 4
jb 0x1400c1d72
mov rcx, qword [rsp + 0x260]
mov edx, dword [rcx]
mov dword [rbx + 0x48], edx
cmp dword [rbx + 8], 0xfeef04bd
mov rsi, qword [rsp + 0x230]
sete dil
mov eax, edi
add rsp, 0x238
pop rdi
pop rbx
ret
Function at 0x1400c2610
Capabilities:
Enumerate process modules
Enumerate processes

Disassembly:
push rsi
mov eax, 0x2cc0
call fcn.1400e5910
sub rsp, rax
mov rsi, rcx
call fcn.1400c2400
test rax, rax
je 0x1400c285c
lea rdx, [rsp + 0x2cd8]
mov rcx, rax
mov qword [rsp + 0x2ca8], rdi
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [rsp + 0x20], 0x238
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1400c2854
lea rdx, [rsp + 0x20]
mov rcx, rax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x1400c284b
nop dword [rax]
mov ecx, dword [rsp + 0x2cd8]
cmp dword [rsp + 0x28], ecx
je 0x1400c26a3
lea rdx, [rsp + 0x20]
mov rcx, rdi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x1400c2680
jmp 0x1400c284b
mov rcx, qword [rsi + 0x10]
mov edx, 0x40a
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x1400c284b
mov qword [rsp + 0x2cb8], rbx
or rbx, 0xffffffffffffffff
mov qword [rsp + 0x2cb0], rbp
mov qword [rsp + 0x2ca0], r14
lea rcx, [rsp + 0x4c]
mov rax, rbx
nop
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400c26e0
lea rdx, [rsp + 0x4c]
lea rcx, [rsi + 0x28c0]
mov r8d, eax
call fcn.14000c250
xor ecx, ecx
movzx eax, word [rsp + rcx + 0x4c]
lea rcx, [rcx + 2]
mov word [rsp + rcx + 0x25e], ax
test ax, ax
jne 0x1400c2700
mov r8d, dword [rsp + 0x2cd8]
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbp, rax
test rax, rax
je 0x1400c27a6
lea r9, [rsp + 0x2ce0]
lea rdx, [rsp + 0x2ce8]
mov r8d, 8
mov rcx, rax
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x1400c27a1
mov rdx, qword [rsp + 0x2ce8]
lea r8, [rsp + 0x260]
mov r9d, 0x104
mov rcx, rbp
call sub.PSAPI.DLL_GetModuleFileNameExW
lea rax, [rsp + 0x260]
nop dword [rax + rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1400c2780
lea rdx, [rsp + 0x260]
lea rcx, [rsi + 0x28c0]
mov r8d, ebx
call fcn.14000c250
mov rcx, rbp
jmp 0x1400c2821
lea rcx, [0x14026d730]
call fcn.140084880
test eax, eax
je 0x1400c2827
mov eax, dword [rsp + 0x2cd8]
lea r9, str.SynGetModulePathNameEvent
xor r8d, r8d
mov dword [rsp + 0x478], eax
mov rax, qword [rsi + 0x10]
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x470], 0xe
mov qword [rsp + 0x480], rax
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rbx, rax
test rax, rax
je 0x1400c2827
lea rdx, [rsp + 0x470]
lea rcx, [0x14026d730]
call fcn.140084b80
test rax, rax
je 0x1400c281e
mov edx, 0x2710
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rsi + 0x10]
mov rcx, rsi
call fcn.1400c29c0
mov r14, qword [rsp + 0x2ca0]
mov rbp, qword [rsp + 0x2cb0]
mov rbx, qword [rsp + 0x2cb8]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, qword [rsp + 0x2ca8]
add rsp, 0x2cc0
pop rsi
ret
Function at 0x1400c28b0
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rdi
sub rsp, 0x2d0
mov rdi, rcx
mov rbp, rdx
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x98
call fcn.1400e4220
xor ebx, ebx
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x50], rax
lea rax, [0x140138d98]
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x98
mov qword [rsp + 0x28], rbp
mov word [rsp + 0xc0], bx
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x58], 0x208
mov dword [rsp + 0x4c], 1
mov qword [rsp + 0x60], rbx
mov dword [rsp + 0x68], ebx
mov qword [rsp + 0x70], rbx
mov dword [rsp + 0x80], 0x1800
call qword [sym.imp.COMDLG32.dll_GetOpenFileNameW]
cmp eax, 1
jne 0x1400c299e
mov rdx, qword [rsp + 0x50]
mov qword [rsp + 0x2e0], rsi
test rdx, rdx
je 0x1400c296b
or rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rdx + rax*2], bx
jne 0x1400c2960
mov ebx, eax
lea rcx, [rdi + 0x28c0]
mov r8d, ebx
call fcn.14000c250
mov rcx, qword [rdi + 0x28c0]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov rsi, qword [rsp + 0x2e0]
test eax, eax
je 0x1400c299e
mov rdx, rbp
mov rcx, rdi
call fcn.1400c29c0
lea r11, [rsp + 0x2d0]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x1400c2a90
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x230
mov rdi, rdx
mov rsi, rcx
mov edx, 0x40a
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetDlgItem]
or rbx, 0xffffffffffffffff
test rax, rax
je 0x1400c2af9
lea rdx, [rsp + 0x20]
mov r8d, 0x104
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowTextW]
lea rcx, [rsi + 0x28c0]
lea rdx, [rsp + 0x20]
mov rax, rbx
inc rax
cmp word [rdx + rax*2], 0
jne 0x1400c2ae2
lea rdx, [rsp + 0x20]
mov r8d, eax
call fcn.14000c250
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x208
call fcn.1400e4220
mov edx, 0x40c
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x1400c2b57
lea rdx, [rsp + 0x20]
mov r8d, 0x104
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowTextW]
lea rcx, [rsi + 0x28c8]
lea rax, [rsp + 0x20]
nop
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1400c2b40
lea rdx, [rsp + 0x20]
mov r8d, ebx
call fcn.14000c250
lea r11, [rsp + 0x230]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret

Function at 0x1400c2e00
Capabilities:
Hide graphical window

Disassembly:
push rbx
sub rsp, 0x20
xor edx, edx
mov rbx, rcx
mov dword [rcx + 0x28d0], 0
call fcn.1400c2490
call qword [sym.imp.USER32.dll_ReleaseCapture]
mov rcx, qword [rbx + 0x28e8]
mov edx, 5
add rsp, 0x20
pop rbx
jmp qword [sym.imp.USER32.dll_ShowWindow]
Function at 0x1400c5440
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
lea rcx, [0x14026d730]
mov rdi, r9
mov rsi, r8
mov rbx, rdx
call fcn.140084be0
test eax, eax
je 0x1400c547d
mov eax, 0x40
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.1400e0330
Function at 0x1400c60b0
Capabilities:
Log keystrokes via polling

Disassembly:
push rsi
push rdi
push r12
sub rsp, 0x40
mov eax, dword [rcx + 0x58]
mov edi, r9d
movzx r12d, r8b
cdq
mov rsi, rcx
xor eax, edx
cmp eax, edx
jne 0x1400c60d8
xor eax, eax
add rsp, 0x40
pop r12
pop rdi
pop rsi
ret
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x70], r13
mov ecx, 0x11
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r15
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
xor r14d, r14d
mov ecx, 0x10
test ax, ax
sets r14b
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
xor r15d, r15d
test ax, ax
mov eax, dword [rsp + 0x80]
mov r9d, edi
sets r15b
mov edx, r14d
mov rcx, rsi
mov r8d, r15d
mov dword [rsp + 0x20], eax
call fcn.1400c62c0
mov r13d, 1
mov ebx, eax
mov eax, 0x5dc
cmp ebx, eax
cmovg ebx, eax
mov eax, 0xfffffa24
cmp ebx, eax
cmovl ebx, eax
test edi, edi
jne 0x1400c6168
mov eax, dword [rsi + 0x34]
test al, 2
jne 0x1400c6168
bt eax, 0x13
jb 0x1400c6168
xor ebp, ebp
jmp 0x1400c616b
mov ebp, r13d
test r14d, r14d
mov r14, qword [rsp + 0x38]
jne 0x1400c617a
test r15d, r15d
je 0x1400c61bd
test edi, edi
jne 0x1400c61bd
test dword [rsi + 0x34], 0x80000
jne 0x1400c61bd
xor ebp, ebp
mov eax, ebx
cdq
xor eax, edx
sub eax, edx
cmp eax, 0x78
jl 0x1400c61dc
mov eax, 0x88888889
imul ebx
add ebx, edx
sar ebx, 6
mov eax, ebx
shr eax, 0x1f
add ebx, eax
mov eax, ebx
cdq
xor eax, edx
sub eax, edx
cmp eax, 0x7f
jl 0x1400c6219
test ebx, ebx
jns 0x1400c620f
or eax, 0xffffffff
jmp 0x1400c6216
test ebp, ebp
je 0x1400c6189
test edi, edi
je 0x1400c61e3
xor edx, edx
mov rcx, rsi
call fcn.1400c8360
mov ecx, eax
mov eax, ebx
cdq
xor eax, edx
sub eax, edx
cmp eax, ecx
jge 0x1400c6219
xor eax, eax
jmp 0x1400c628e
mov eax, ebx
cdq
xor eax, edx
sub eax, edx
cmp eax, 0x168
jle 0x1400c6219
test ebx, ebx
jns 0x1400c6200
or eax, 0xffffffff
imul ebx, eax, 0x168
jmp 0x1400c6219
xor eax, eax
test ebx, ebx
setg al
imul ebx, eax, 0x168
jmp 0x1400c6219
xor eax, eax
test ebx, ebx
setg al
imul ebx, eax, 0x7f
mov eax, dword [rsi + 0x58]
neg ebx
cdq
mov edi, eax
mov rax, qword [0x14026ef18]
xor edi, edx
sub edi, edx
test rax, rax
je 0x1400c6282
mov rax, qword [rax]
test rax, rax
je 0x1400c6282
xor ecx, ecx
test r12b, r12b
cmove ecx, r13d
test ebp, ebp
je 0x1400c6249
or ecx, 2
mov r10, qword [rax + 0x58]
test r10, r10
jne 0x1400c6256
lea r10, [rax + 0x70]
mov rax, qword [r10]
mov dword [rsp + 0x28], ecx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r10
mov dword [rsp + 0x20], ebx
call qword [rax + 0xe0]
mov eax, dword [rsi + 0x58]
test eax, eax
jle 0x1400c627d
sub eax, edi
jmp 0x1400c627f
add eax, edi
mov dword [rsi + 0x58], eax
mov dword [rsi + 0x94], 0
mov eax, edi
mov r13, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov r15, qword [rsp + 0x30]
add rsp, 0x40
pop r12
pop rdi
pop rsi
ret
Function at 0x1400c8ae0
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
mov eax, 0x2030
call fcn.1400e5910
sub rsp, rax
mov r10d, dword [rsp + 0x2060]
mov rdi, r9
mov ebp, r8d
mov r14, rdx
mov rsi, rcx
sub r10d, 2
je 0x1400c8c1f
dec r10d
jne 0x1400c8c7b
cmp r8d, 0xc
jne 0x1400c8c7b
mov rcx, rdx
call qword [sym.imp.USER32.dll_GetDlgCtrlID]
mov rbx, qword [rsp + 0x2068]
mov r8d, eax
test rbx, rbx
je 0x1400c8c7b
test rdi, rdi
je 0x1400c8c7b
test eax, eax
je 0x1400c8c7b
mov ecx, dword [rdi]
xor esi, esi
mov r10d, esi
mov edx, esi
test ecx, ecx
je 0x1400c8b8f
mov eax, esi
cmp ecx, r8d
je 0x1400c8b87
mov ecx, dword [rdi + rax*4 + 8]
add rax, 2
add edx, 2
test ecx, ecx
jne 0x1400c8b71
jmp 0x1400c8b8f
movsxd rax, edx
mov r10d, dword [rdi + rax*4 + 4]
lea r8, [rsp + 0x30]
mov r9d, 0x1000
mov edx, r10d
mov rcx, rbx
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x1400c8c04
lea r9, [0x1400c8ca0]
mov r8, r14
mov edx, 0xaa
mov rcx, rbx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.USER32.dll_CreateDialogParamW]
mov qword [0x14026fad0], rax
call fcn.1400b0150
test eax, eax
je 0x1400c8be3
mov rcx, qword [0x14026fad0]
call fcn.1400b0460
mov r9, qword [rsp + 0x2070]
mov rcx, qword [0x14026fad0]
lea r8, [rsp + 0x30]
mov edx, 0x401
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x1400c8c7b
mov rcx, qword [0x14026fad0]
test rcx, rcx
je 0x1400c8c7b
call qword [sym.imp.USER32.dll_DestroyWindow]
mov qword [0x14026fad0], rsi
jmp 0x1400c8c7b
add rcx, 0x418
or rbx, 0xffffffffffffffff
mov rax, rbx
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400c8c30
test rax, rax
je 0x1400c8c45
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rsi + 0x620]
nop dword [rax]
inc rbx
cmp word [rcx + rbx*2], 0
jne 0x1400c8c50
test rbx, rbx
je 0x1400c8c65
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rdx, str.Mouse.hlp
mov r9, rdi
mov r8d, ebp
mov rcx, r14
call qword [sym.imp.USER32.dll_WinHelpW]
lea r11, [rsp + 0x2030]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x1400ca470
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rbp
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
mov qword [rcx + 0x28], 7
xor r14d, r14d
mov qword [rcx + 0x20], r14
mov word [rcx + 0x10], r14w
add rcx, 0x438
lea rdx, str.SynCom.PointingDevice
call fcn.14002ed00
lea rax, vtable.CDummySynDevice.0
mov qword [rsi + 0x450], rax
mov dword [rsi + 0x458], r14d
mov qword [rsi + 0x448], r14
lea rax, vtable.SynDeviceEx.0
mov qword [rsi + 0x430], rax
lea rax, vtable.SynDeviceEx.1.0
mov qword [rsi + 0x440], rax
mov dword [rsi + 0x460], 0xffffffff
mov dword [rsi + 0x464], r14d
lea rcx, [rsi + 0x480]
call fcn.1400e1300
nop
mov qword [rsi], rbx
mov qword [rsi + 8], rdi
mov dword [rsi + 0x470], 0x800
mov qword [rsi + 0x468], r14
mov qword [rsi + 0x478], r14
mov dword [rsi + 0x474], 1
lea rdi, [rsi + 0x4a0]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor edx, edx
lea r8d, [r14 + 0x26]
lea rcx, [rsi + 0x480]
call fcn.1400e13f0
test eax, eax
jns 0x1400ca5c4
lea rcx, str.ProgramFiles
call fcn.1400ed7c8
test rax, rax
je 0x1400ca5a2
lea rcx, str.ProgramFiles
call fcn.1400ed7c8
mov rdx, rdi
sub rdx, rax
nop dword [rax]
movzx ecx, word [rax]
mov word [rdx + rax], cx
lea rax, [rax + 2]
test cx, cx
jne 0x1400ca590
jmp 0x1400ca5c4
lea rcx, str.C:Program_Files
mov rdx, rsi
sub rdx, rcx
nop
movzx eax, word [rcx]
mov word [rdx + rcx + 0x4a0], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x1400ca5b0
lea rbx, [rsi + 0x6a8]
mov r8, rdi
lea rdx, str._sSynapticsSynTP
mov rcx, rbx
call fcn.1400e5d9c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1400ca5f9
mov rdx, rbx
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
xor ecx, ecx
call fcn.1400dc0c0
cmp eax, 9
jl 0x1400ca62f
lea rax, [rsi + 0x8b0]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 5]
lea rcx, [rsi + 0x480]
call fcn.1400e13f0
test eax, eax
jns 0x1400ca650
lea rcx, [rsi + 0x8b0]
sub rcx, rbx
nop dword [rax]
movzx eax, word [rbx]
mov word [rcx + rbx], ax
lea rbx, [rbx + 2]
test ax, ax
jne 0x1400ca640
mov rax, rsi
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x1400cde70
Capabilities:
Get file version info

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rdx
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x88
mov qword [r11 - 0x80], 0xfffffffffffffffe
mov rdi, rdx
mov rsi, rcx
xor r15d, r15d
mov dword [rsp + 0x30], r15d
mov word [r11 - 0x78], r15w
xor eax, eax
mov qword [r11 - 0x76], rax
mov qword [r11 - 0x6e], rax
mov qword [r11 - 0x66], rax
mov qword [r11 - 0x5e], rax
mov qword [r11 - 0x56], rax
mov qword [r11 - 0x4e], rax
mov qword [r11 - 0x46], rax
mov word [rsp + 0x7a], ax
cmp qword [rdx + 0x18], 8
jb 0x1400cded0
mov rcx, qword [rdx]
jmp 0x1400cded3
mov rcx, rdx
lea rdx, [rsp + 0xc0]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov ebp, eax
or rbx, 0xffffffffffffffff
test eax, eax
je 0x1400cdf90
mov eax, 2
mul rbp
cmovo rax, rbx
mov rcx, rax
call fcn.1400e3178
mov r14, rax
cmp qword [rdi + 0x18], 8
jb 0x1400cdf11
mov rcx, qword [rdi]
jmp 0x1400cdf14
mov rcx, rdi
mov r9, rax
mov r8d, ebp
xor edx, edx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x1400cdf88
mov qword [rsp + 0xd8], r15
lea r9, [rsp + 0xd0]
lea r8, [rsp + 0xd8]
lea rdx, [0x140122f58]
mov rcx, r14
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x1400cdf88
mov rdx, qword [rsp + 0xd8]
test rdx, rdx
je 0x1400cdf88
movzx eax, word [rdx + 0xc]
movzx ecx, word [rdx + 0xe]
movzx r9d, word [rdx + 8]
movzx r8d, word [rdx + 0xa]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
lea rdx, str.v_d._d._d._d
lea rcx, [rsp + 0x40]
call fcn.1400e5d9c
mov rcx, r14
call fcn.1400e4058
mov qword [rsi + 0x18], 7
mov qword [rsi + 0x10], r15
mov word [rsi], r15w
cmp word [rsp + 0x40], 0
jne 0x1400cdfad
mov rbx, r15
jmp 0x1400cdfbc
lea rax, [rsp + 0x40]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1400cdfb2
mov r8, rbx
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.1400076c0
nop
cmp qword [rdi + 0x18], 8
jb 0x1400cdfdc
mov rcx, qword [rdi]
call fcn.1400e4058
mov qword [rdi + 0x18], 7
mov qword [rdi + 0x10], r15
mov word [rdi], r15w
mov rax, rsi
add rsp, 0x88
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400cf140
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rsi, rax
test rax, rax
je 0x1400cf217
movzx r8d, word [rax]
mov qword [rsp + 0x30], rbx
mov rbx, rax
test r8w, r8w
je 0x1400cf1c0
nop dword [rax]
lea rdx, [0x14013c8e0]
movzx r8d, r8w
mov rcx, rdi
call fcn.1400ebda4
movzx r8d, word [rbx + 2]
add rbx, 2
test r8w, r8w
jne 0x1400cf180
lea rdx, [0x140130314]
mov rcx, rdi
call fcn.1400ebda4
movzx r8d, word [rbx + 2]
add rbx, 2
test r8w, r8w
jne 0x1400cf180
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rcx, qword [rbp + 0x438]
mov rbx, qword [rsp + 0x30]
xor eax, eax
mov dword [rsp + 0x40], eax
test rcx, rcx
je 0x1400cf1f4
mov rax, qword [rcx]
lea r8, [rsp + 0x40]
mov edx, 0x100001d2
call qword [rax + 0x18]
mov eax, dword [rsp + 0x40]
lea rcx, [0x14013bc48]
test eax, eax
lea r8, [0x14013bc50]
cmovne r8, rcx
lea rdx, str.IsUserAdmin_s_n
mov rcx, rdi
call fcn.1400ebda4
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x1400cf230
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x2020
call fcn.1400e5910
sub rsp, rax
mov rbp, r8
mov rsi, rdx
xor edi, edi
nop word [rax + rax]
lea rdx, [0x1401379e0]
mov rcx, rbp
call fcn.1400ebe38
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x1400cf294
test rbx, rbx
jne 0x1400cf2af
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
inc edi
cmp edi, 0x3c
jl 0x1400cf260
xor eax, eax
lea r11, [rsp + 0x2020]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
mov rcx, rbx
call fcn.1400eb728
test eax, eax
jne 0x1400cf2fc
nop dword [rax + rax]
mov rcx, rbx
call fcn.1400eb750
test eax, eax
jne 0x1400cf2fc
lea rcx, [rsp + 0x20]
mov r8, rbx
mov edx, 0x1000
call fcn.1400ebc28
test rax, rax
je 0x1400cf2fc
lea rcx, [rsp + 0x20]
mov rdx, rsi
call fcn.1400ebcf0
mov rcx, rbx
call fcn.1400eb728
test eax, eax
je 0x1400cf2c0
mov rcx, rsi
call fcn.1400e9fc8
mov rcx, rbx
call fcn.1400e9e8c
mov eax, 1
jmp 0x1400cf296
Function at 0x1400d1770
Capabilities:
Get common file path

Disassembly:
push rdi
sub rsp, 0x270
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rsp + 0x290], rbx
cmp dword [0x14026fb10], 0
jne 0x1400d1961
mov dword [0x14026fb10], 1
call fcn.1400ddb20
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
test eax, eax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea edx, [rcx + 0x2a]
jne 0x1400d17c2
lea edx, [rcx + 0x26]
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
call fcn.140004e00
mov rdx, rax
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
jne 0x1400d17e7
mov ecx, 0x80004005
call fcn.140004c30
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x280], rax
lea rcx, [rsp + 0x60]
lea rax, [rsp + 0x60]
or rbx, 0xffffffffffffffff
test rax, 0xffffffffffff0000
jne 0x1400d1838
movzx edi, cx
xor edx, edx
mov ecx, edi
call fcn.14000bbc0
test rax, rax
je 0x1400d1860
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x280]
call fcn.14000c050
jmp 0x1400d1860
lea rcx, [rsp + 0x60]
mov rax, rbx
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400d1840
mov r8d, eax
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x280]
call fcn.14000c250
nop
lea r8, str.LenovoMetricCollectionSDKMFCLenovo.MetricCollectionMFC.dll
lea rdx, [rsp + 0x280]
lea rcx, [rsp + 0x288]
call fcn.140079a10
nop
mov rdx, qword [rsp + 0x280]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x1400d1899
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [rsp + 0x288]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x14026fae0], rax
test rax, rax
je 0x1400d1945
lea rdx, str.GetMetricCollectionCollector
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
je 0x1400d1945
xor r8d, r8d
mov edx, 0x104
lea rcx, [rsp + 0x60]
call fcn.1400df4c0
mov byte [rsp + 0x48], 1
lea rax, str.SynapticsAppsCollectionReport
mov qword [rsp + 0x40], rax
lea rax, str.Local_Todo
mov qword [rsp + 0x38], rax
lea rax, str.Countyr_Todo
mov qword [rsp + 0x30], rax
lea rax, str.Family_Todo
mov qword [rsp + 0x28], rax
lea rax, str.SubBrand_Todo
mov qword [rsp + 0x20], rax
lea r9, str.Brand_Todo
lea r8, str.MTM_Todo
lea rdx, str.19.0.9.5
lea rcx, [rsp + 0x60]
call rdi
mov qword [0x14026fad8], rax
mov rdx, qword [rsp + 0x288]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x1400d1961
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [0x14026fad8]
mov rbx, qword [rsp + 0x290]
add rsp, 0x270
pop rdi
ret
Function at 0x1400d74b0
Capabilities:
Get session user name

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x670
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rsp + 0x698], rbx
mov rdi, rcx
lea rax, vtable.CSynDeviceGestureActionService.0
mov qword [rcx], rax
mov qword [rcx + 8], rdx
lea rbx, [rcx + 0x18]
xor eax, eax
mov qword [rbx], rax
mov qword [rbx + 8], rax
mov rcx, rbx
call fcn.1400d80a0
mov qword [rbx], rax
mov dword [rsp + 0x688], 0x101
lea rdx, [rsp + 0x688]
lea rcx, [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov rax, qword [rdi + 8]
mov rcx, qword [rax + 0x58]
test rcx, rcx
jne 0x1400d7526
lea rcx, [rax + 0x70]
mov rax, qword [rcx]
lea r8, [rsp + 0x690]
mov edx, 0x10000101
call qword [rax + 0x18]
or ecx, 0xffffffff
test eax, eax
cmove ecx, dword [rsp + 0x690]
mov dword [rsp + 0x20], ecx
lea r9, [rsp + 0x60]
lea r8, str..pipe_sC01BC476_A852_4dfd_B33F_E308F3497BF4_li
mov edx, 0x200
lea rcx, [rsp + 0x270]
call fcn.1400e5e60
lea r9, [0x140122f58]
lea r8, [0x14012fd40]
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.1400dd3b0
cmp qword [rax + 0x10], 0
setne bl
cmp qword [rsp + 0x48], 8
jb 0x1400d759c
mov rcx, qword [rsp + 0x30]
call fcn.1400e4058
test bl, bl
je 0x1400d75fc
lea r9, [0x140122f58]
lea r8, [0x14012fd40]
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.1400dd3b0
cmp qword [rax + 0x18], 8
jb 0x1400d75c4
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x270]
lea r8, str._s_s
mov edx, 0x200
lea rcx, [rsp + 0x270]
call fcn.1400e5e60
cmp qword [rsp + 0x48], 8
jb 0x1400d75fc
mov rcx, qword [rsp + 0x30]
call fcn.1400e4058
mov edx, 0x3d
lea rcx, [rsp + 0x270]
call fcn.140002940
mov qword [rdi + 0x10], rax
test rax, rax
je 0x1400d7623
mov rdx, rdi
mov rcx, rax
call fcn.1400026f0
nop
mov rax, rdi
mov rbx, qword [rsp + 0x698]
add rsp, 0x670
pop rdi
ret