joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140007601
Capabilities:
Create directory

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
add rsp, 0xffffffffffffff80
mov rbx, rcx
call fcn.1400088a9
cmp eax, 0xffffffff
je 0x140007624
test al, 0x10
jne 0x14000781c
mov rcx, rbx
call fcn.140009f98
mov esi, eax
test al, al
jne 0x140007821
mov rcx, rbx
lea rdi, [rsp + 0x28]
call fcn.14000a022
mov rcx, rdi
mov rdx, rbx
xchg ebp, eax
call fcn.14000431c
mov rcx, rdi
call fcn.140004872
test eax, eax
js 0x14000767c
mov ecx, dword [rsp + 0x30]
lea edx, [rcx - 1]
cmp edx, eax
jne 0x14000767c
dec ecx
je 0x14000780d
mov rax, qword [rsp + 0x28]
mov dword [rsp + 0x30], edx
and word [rax + rdx*2], 0
lea rcx, [rsp + 0x38]
mov rdx, rdi
call fcn.1400043d6
mov ebx, dword [rsp + 0x30]
mov rax, qword [0x140056c50]
mov r12, qword [rsp + 0x28]
cmp byte [rax], 0
jne 0x1400076c9
lea rcx, [rsp + 0x48]
mov rdx, r12
call fcn.140004e1c
mov rcx, qword [rsp + 0x48]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov rcx, qword [rsp + 0x48]
xchg r13d, eax
call fcn.1400071fc
test r13d, r13d
jmp 0x1400076d6
xor edx, edx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1400077f3
mov r13, qword [sym.imp.KERNEL32.dll_GetLastError]
call r13
cmp eax, 0xb7
jne 0x14000775c
lea r14, [rsp + 0x48]
mov rcx, r14
call fcn.140008436
lea rcx, [rsp + 0x70]
call fcn.1400042a2
xor r8d, r8d
mov rdx, r12
mov rcx, r14
call fcn.1400089c2
mov r12d, eax
test al, al
je 0x140007726
mov r12b, byte [rsp + 0x68]
shr r12b, 4
and r12d, 1
mov rcx, qword [rsp + 0x70]
call fcn.1400071f0
test r12b, r12b
je 0x14000775c
jmp 0x1400077f3
call r13
cmp eax, 0xb7
je 0x140007801
mov rcx, rdi
call fcn.140004872
xchg ebx, eax
test ebx, ebx
jle 0x140007801
cmp ebx, 1
jne 0x140007794
mov rax, qword [rsp + 0x28]
mov ax, word [rax]
cmp ax, 0x5c
je 0x140007801
cmp ax, 0x2f
je 0x140007801
lea eax, [rbx + 1]
cmp ebp, eax
jae 0x140007801
cmp ebx, dword [rsp + 0x30]
jae 0x14000768d
mov rdx, qword [rsp + 0x28]
movsxd rax, ebx
mov dword [rsp + 0x30], ebx
and word [rdx + rax*2], 0
jmp 0x14000768d
lea eax, [rbx + 1]
add rax, rax
add rcx, rax
call fcn.140009a93
lea ebx, [rbx + rax + 1]
test eax, eax
jns 0x1400077d5
mov ebx, dword [rsp + 0x40]
mov rdx, qword [rsp + 0x38]
mov r8d, ebx
mov rcx, rdi
call fcn.14000455a
mov rcx, qword [rsp + 0x28]
call fcn.14000759d
test al, al
je 0x140007801
mov rcx, qword [rsp + 0x38]
cmp dword [rsp + 0x40], ebx
jg 0x1400077bb
mov sil, 1
mov rcx, qword [rsp + 0x38]
call fcn.1400071f0
jmp 0x140007810
mov sil, 1
mov rcx, qword [rsp + 0x28]
call fcn.1400071f0
jmp 0x140007847
mov sil, 1
jmp 0x140007847
xor esi, esi
jmp 0x140007847
mov eax, esi
sub rsp, 0xffffffffffffff80
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
Function at 0x140007858
Capabilities:
Delete file

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
call fcn.1400088a9
cmp eax, 0xffffffff
jne 0x140007878
mov rax, qword [0x140056c50]
cmp byte [rax], 0
jne 0x1400078ba
jmp 0x140007893
mov edx, eax
and edx, 0x11
dec edx
jne 0x14000786a
and eax, 0xfffffffe
mov rcx, rbx
xchg edx, eax
call fcn.1400073dd
test al, al
jne 0x14000786a
jmp 0x1400078de
lea rcx, [rsp + 0x20]
mov rdx, rbx
call fcn.140004e1c
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov rcx, qword [rsp + 0x20]
xchg ebx, eax
call fcn.1400071fc
test ebx, ebx
jmp 0x1400078c5
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne al
jmp 0x1400078de
add rsp, 0x30
pop rbx
ret
Function at 0x1400078e4
Capabilities:
Delete directory

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xa8
lea rax, [rsp + 0x68]
mov rdi, rcx
mov qword [rsp + 0x20], rax
xchg rcx, rax
call fcn.140008436
lea rax, [rsp + 0x90]
mov qword [rsp + 0x28], rax
xchg rcx, rax
call fcn.1400042a2
mov rdx, qword [rdi]
mov rcx, qword [rsp + 0x20]
xor r8d, r8d
call fcn.1400089c2
test al, al
je 0x140007968
mov ebx, dword [rsp + 0x88]
test bl, 0x10
jne 0x14000794c
mov ecx, 0x10b
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x140007968
mov rcx, qword [rsp + 0x90]
and ebx, 0x400
call fcn.1400071f0
test ebx, ebx
je 0x140007975
jmp 0x140007ad4
mov rcx, qword [rsp + 0x90]
jmp 0x140007aa1
lea rbp, [rsp + 0x38]
mov rdx, rdi
mov rcx, rbp
call fcn.1400043d6
mov eax, dword [rsp + 0x40]
cmp dword [rsp + 0x44], eax
je 0x1400079c5
mov eax, dword [rsp + 0x40]
mov rdx, qword [rsp + 0x38]
lea rcx, [rsp + 0x58]
mov word [rdx + rax*2], 0x5c
lea r12d, [rax + 1]
mov r13, r12
add r12, r12
and word [rdx + r12], 0
mov dword [rsp + 0x40], r13d
or qword [rsp + 0x50], 0xffffffffffffffff
call fcn.1400042a2
jmp 0x1400079d6
mov rcx, rbp
call fcn.140003f94
jmp 0x14000798f
lea r15, [rsp + 0x48]
mov rdx, rbp
mov rcx, r15
call fcn.140008fbe
mov rcx, qword [rsp + 0x20]
call fcn.140008436
mov rcx, qword [rsp + 0x28]
call fcn.1400042a2
xor r14d, r14d
mov rdx, qword [rsp + 0x20]
mov rcx, r15
call fcn.140009000
mov esi, eax
test al, al
je 0x140007a6b
cmp r13d, dword [rsp + 0x40]
jae 0x140007a27
mov rax, qword [rsp + 0x38]
mov dword [rsp + 0x40], r13d
and word [rax + r12], 0
mov rdx, qword [rsp + 0x28]
mov rcx, rbp
call fcn.14000471c
test byte [rsp + 0x88], 0x10
je 0x140007a4a
mov rcx, rbp
call fcn.1400078e4
test al, al
jmp 0x140007a58
mov rcx, qword [rsp + 0x38]
call fcn.140007858
mov esi, eax
test al, al
jne 0x140007a63
call qword [sym.imp.KERNEL32.dll_GetLastError]
xchg ebx, eax
jmp 0x140007a66
mov esi, r14d
mov r14d, esi
jmp 0x1400079fd
test r14b, r14b
lea rsi, [rsp + 0x50]
je 0x140007aab
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, qword [rsp + 0x90]
call fcn.1400071f0
mov rcx, qword [rsp + 0x58]
call fcn.1400071f0
mov rcx, rsi
call fcn.140008484
mov rcx, qword [rsp + 0x38]
call fcn.1400071f0
jmp 0x140007b46
mov rcx, qword [rsp + 0x90]
call fcn.1400071f0
mov rcx, qword [rsp + 0x58]
call fcn.1400071f0
mov rcx, rsi
call fcn.140008484
mov rcx, qword [rsp + 0x38]
call fcn.1400071f0
mov rcx, qword [rdi]
xor edx, edx
call fcn.1400073dd
test al, al
je 0x140007b46
mov rcx, qword [rdi]
add rsp, 0xa8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp fcn.140007451
xor eax, eax
add rsp, 0xa8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140007bc6
Capabilities:
Get common file path

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x260
mov rax, qword [rcx]
and dword [rcx + 8], 0
mov rsi, rcx
lea rdi, [rsp + 0x30]
and word [rax], 0
mov rax, qword [0x140056c50]
mov bpl, byte [rax]
test bpl, bpl
jne 0x140007c4a
mov byte [rsp + 0x30], 0
mov rdx, rdi
mov ecx, 0x114
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
dec eax
cmp eax, 0x112
ja 0x140007d19
lea rbx, [rsp + 0x20]
mov rdx, rdi
mov byte [rsp + 0x144], 0
mov rcx, rbx
call fcn.140004e81
mov rdx, rbx
mov rcx, rsi
call fcn.140004500
mov rcx, qword [rsp + 0x20]
mov bpl, 1
call fcn.1400071f0
jmp 0x140007d19
mov r12, qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
and word [rsp + 0x30], 0
mov rdx, rdi
mov ecx, 0x114
call r12
xchg ebx, eax
test ebx, ebx
je 0x140007cc0
cmp ebx, 0x113
ja 0x140007c88
and word [rsp + 0x258], 0
mov rdx, rdi
mov rcx, rsi
call fcn.1400044a4
jmp 0x140007d19
mov rcx, rdi
call fcn.1400042a2
cmp dword [rsp + 0x3c], ebx
jb 0x140007cb4
mov rdx, qword [rsp + 0x30]
mov ecx, ebx
call r12
test eax, eax
je 0x140007cee
mov rcx, qword [rsp + 0x30]
mov edx, ebx
and word [rcx + rdx*2], 0
xor edx, edx
jmp 0x140007cc4
mov edx, ebx
mov rcx, rdi
call fcn.140003f00
jmp 0x140007c96
xor ebp, ebp
jmp 0x140007d19
mov r8d, edx
cmp word [rcx + r8*2], 0
je 0x140007cd3
inc edx
jmp 0x140007cc4
mov dword [rsp + 0x38], edx
cmp eax, edx
jne 0x140007cee
dec ebx
cmp ebx, eax
jne 0x140007cee
mov rdx, rdi
mov rcx, rsi
call fcn.140004500
jmp 0x140007cf0
xor ebp, ebp
mov rcx, qword [rsp + 0x30]
call fcn.1400071f0
jmp 0x140007d19
mov eax, ebp
add rsp, 0x260
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x140007dec
Capabilities:
Get common file path

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x268
mov rax, qword [0x140056c50]
cmp byte [rax], 0
mov rsi, rcx
lea rdi, [rsp + 0x36]
jne 0x140007e46
lea rbp, [rsp + 0x20]
mov rdx, rdi
mov ecx, 0x114
mov byte [rsp + 0x36], 0
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
mov rdx, rdi
mov rcx, rbp
xchg ebx, eax
call fcn.140004e81
mov rdx, rbp
mov rcx, rsi
call fcn.140004500
mov rcx, qword [rsp + 0x20]
call fcn.1400071f0
jmp 0x140007e7c
mov rdx, rdi
and word [rsp + 0x36], 0
mov ecx, 0x114
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov rdx, rdi
mov rcx, rsi
xchg ebx, eax
call fcn.1400044a4
jmp 0x140007e7c
mov rcx, rsi
dec ebx
call fcn.140009aec
cmp ebx, 0x112
setbe al
add rsp, 0x268
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x1400088a9
Capabilities:
Get file attributes

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x140056c50]
cmp byte [rax], 0
jne 0x1400088ec
lea rax, [rsp + 0x30]
mov rdx, rcx
xchg rcx, rax
call fcn.140004e1c
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov rcx, qword [rsp + 0x30]
mov dword [rsp + 0x2c], eax
call fcn.14000842a
mov eax, dword [rsp + 0x2c]
add rsp, 0x40
pop rbx
ret
add rsp, 0x40
pop rbx
jmp qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
Function at 0x140008fe0
Capabilities:
Enumerate files on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x288
mov rax, qword [0x140056c50]
cmp byte [rax], 0
mov rcx, qword [rcx]
mov rbx, rdx
lea rdx, [rsp + 0x30]
jne 0x1400086bf
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x1400086c9
mov eax, dword [rsp + 0x30]
mov edx, dword [rsp + 0x50]
lea rsi, [rsp + 0x20]
and word [rbx + 0x24], 0
mov rcx, rsi
mov dword [rbx + 0x20], eax
mov rax, qword [rsp + 0x34]
mov qword [rbx + 8], rax
mov rax, qword [rsp + 0x3c]
mov qword [rbx + 0x10], rax
mov rax, qword [rsp + 0x44]
mov qword [rbx + 0x18], rax
mov eax, dword [rsp + 0x4c]
shl rax, 0x20
add rax, rdx
lea rdx, [rsp + 0x5c]
mov qword [rbx], rax
call fcn.140004e81
lea rcx, [rbx + 0x28]
mov rdx, rsi
call fcn.140004500
mov rcx, qword [rsp + 0x20]
call fcn.14000841e
mov al, 1
jmp 0x140008716
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1400086cd
xor eax, eax
jmp 0x140008716
mov eax, dword [rsp + 0x30]
mov edx, dword [rsp + 0x50]
and word [rbx + 0x24], 0
lea rcx, [rbx + 0x28]
mov dword [rbx + 0x20], eax
mov rax, qword [rsp + 0x34]
mov qword [rbx + 8], rax
mov rax, qword [rsp + 0x3c]
mov qword [rbx + 0x10], rax
mov rax, qword [rsp + 0x44]
mov qword [rbx + 0x18], rax
mov eax, dword [rsp + 0x4c]
shl rax, 0x20
add rax, rdx
lea rdx, [rsp + 0x5c]
mov qword [rbx], rax
call fcn.1400044a4
jmp 0x1400086a7
add rsp, 0x288
pop rbx
pop rsi
ret
cmp qword [rcx + 8], 0xffffffffffffffff
mov r8, rdx
lea rax, [rcx + 8]
je 0x140008ff5
xchg rcx, rax
jmp 0x140008614
mov rdx, qword [rcx + 0x10]
xchg rcx, rax
jmp fcn.1400084ae
Function at 0x140009175
Capabilities:
Get disk information

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
mov rdi, rcx
call fcn.140041dc0
mov rax, qword [0x140056c50]
mov bl, byte [rax]
test bl, bl
jne 0x140009247
mov rcx, rdi
call fcn.140041dc0
mov rbp, qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
xor edx, edx
xor ecx, ecx
call rbp
xchg r12d, eax
test r12d, r12d
je 0x140009316
mov ecx, r12d
call fcn.14004ed10
mov ecx, r12d
xchg rsi, rax
mov rdx, rsi
call rbp
xchg ebp, eax
lea eax, [rbp - 1]
cmp eax, r12d
jae 0x1400092ce
lea r13, [rsp + 0x20]
mov rcx, r13
call fcn.1400037c8
xor r12d, r12d
xor ebx, ebx
lea r14, [rsp + 0x30]
cmp byte [rsi + r12], 0
jne 0x14000922b
mov edx, ebx
mov rcx, r13
add rdx, rsi
call fcn.1400038ba
mov rdx, r13
mov rcx, r14
lea ebx, [r12 + 1]
call fcn.140004eb2
mov rdx, r14
mov rcx, rdi
call fcn.140008310
mov rcx, qword [rsp + 0x30]
call fcn.14000841e
inc r12
cmp r12d, ebp
jb 0x1400091f2
mov rcx, qword [rsp + 0x20]
cmp ebx, ebp
sete bl
call fcn.14000842a
jmp 0x1400092ce
mov rbp, qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
xor edx, edx
xor ecx, ecx
xor ebx, ebx
call rbp
xchg r12d, eax
test r12d, r12d
je 0x140009316
mov ecx, r12d
add rcx, rcx
call fcn.14004ed10
mov ecx, r12d
xchg rsi, rax
mov rdx, rsi
call rbp
xchg ebp, eax
lea eax, [rbp - 1]
cmp eax, r12d
jae 0x1400092ce
lea r12, [rsp + 0x30]
mov rcx, r12
call fcn.1400042a2
xor r13d, r13d
xor ebx, ebx
cmp word [rsi + r13*2], 0
jne 0x1400092b7
add rbx, rbx
mov rcx, r12
lea rdx, [rsi + rbx]
call fcn.1400044a4
mov rdx, r12
mov rcx, rdi
lea ebx, [r13 + 1]
call fcn.140008310
inc r13
cmp r13d, ebp
jb 0x140009291
mov rcx, qword [rsp + 0x30]
cmp ebx, ebp
sete bl
call fcn.14000841e
mov rcx, rsi
call fcn.14004ecd0
jmp 0x140009316
mov eax, ebx
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret

Function at 0x140009460
Capabilities:
Get file size

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rcx, qword [rcx]
mov rsi, rdx
and dword [rsp + 0x2c], 0
lea rdx, [rsp + 0x2c]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x140009495
mov eax, dword [rsp + 0x2c]
shl rax, 0x20
add rax, rbx
mov qword [rsi], rax
mov al, 1
jmp 0x1400094a1
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x140009483
xor eax, eax
add rsp, 0x38
pop rbx
pop rsi
ret

Function at 0x140009638
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x40
and qword [rsp + 0x20], 0
mov rbx, r9
mov rcx, qword [rcx]
lea r9, [rsp + 0x3c]
and dword [rsp + 0x3c], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [rsp + 0x3c]
test eax, eax
setne al
mov dword [rbx], edx
add rsp, 0x40
pop rbx
ret

Function at 0x14000966a
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x400000
cmp r8d, eax
cmova r8d, eax
jmp fcn.140009638
Function at 0x1400097b0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x40
mov eax, 0x400000
and qword [rsp + 0x20], 0
mov rbx, r9
mov rcx, qword [rcx]
lea r9, [rsp + 0x3c]
and dword [rsp + 0x3c], 0
cmp r8d, eax
cmova r8d, eax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [rsp + 0x3c]
test eax, eax
setne al
mov dword [rbx], edx
add rsp, 0x40
pop rbx
ret

Function at 0x140009896
Capabilities:
Clear file content

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
setne al
add rsp, 0x28
ret
push rsi
sub rsp, 0x40
lea r8, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov rsi, rdx
call fcn.140009566
test al, al
je 0x1400098dc
cmp qword [rsp + 0x38], rsi
mov rcx, qword [rsp + 0x28]
jne 0x1400098dc
add rsp, 0x40
pop rsi
jmp 0x140009896
xor eax, eax
add rsp, 0x40
pop rsi
ret

Function at 0x1400098ae
Capabilities:
Clear file content

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
setne al
add rsp, 0x28
ret
push rsi
sub rsp, 0x40
lea r8, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov rsi, rdx
call fcn.140009566
test al, al
je 0x1400098dc
cmp qword [rsp + 0x38], rsi
mov rcx, qword [rsp + 0x28]
jne 0x1400098dc
add rsp, 0x40
pop rsi
jmp 0x140009896
xor eax, eax
add rsp, 0x40
pop rsi
ret

Function at 0x14000bd8d
Capabilities:
Get system information on windows

Disassembly:
xor eax, eax
mov r8, rcx
xor ecx, ecx
mov rdx, r8
shr rdx, cl
inc ecx
and edx, 1
add eax, edx
cmp ecx, 0x40
jne 0x14000bd57
ret
sub rsp, 0x68
lea rcx, [rsp + 0x20]
call fcn.14000bd6a
test eax, eax
je 0x14000bdaf
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x14000bdaf
add rsp, 0x68
jmp 0x14000bd50
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x50]
add rsp, 0x68
ret

Function at 0x14000bdc3
Capabilities:
Get memory capacity

Disassembly:
push rbx
sub rsp, 0x60
mov eax, 1
shl rax, 0x20
mov qword [rcx], rax
mov rbx, rcx
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x40
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
xchg edx, eax
xor eax, eax
test edx, edx
je 0x14000be07
mov rax, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x48]
cmp rax, rdx
cmova rax, rdx
mov qword [rbx], rax
mov al, 1
add rsp, 0x60
pop rbx
ret

Function at 0x14000c3c6
Capabilities:
Get graphical window text

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rax, qword [rdx]
and dword [rdx + 8], 0
mov rdi, rcx
mov rbx, rdx
mov byte [rax], 0
mov rcx, qword [rcx]
call qword [sym.imp.USER32.dll_GetWindowTextLengthA]
xchg esi, eax
test esi, esi
je 0x14000c431
cmp dword [rbx + 0xc], esi
jae 0x14000c3fa
mov edx, esi
mov rcx, rbx
call fcn.14000348e
mov rdx, qword [rbx]
mov rcx, qword [rdi]
lea r8d, [rsi + 1]
call qword [sym.imp.USER32.dll_GetWindowTextA]
mov rcx, qword [rbx]
cmp eax, esi
cmova eax, esi
mov edx, eax
mov byte [rcx + rdx], 0
xor edx, edx
mov r8d, edx
cmp byte [rcx + r8], 0
je 0x14000c428
inc edx
jmp 0x14000c41a
mov dword [rbx + 8], edx
mov dl, 1
test eax, eax
jne 0x14000c43c
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
sete dl
mov eax, edx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
Function at 0x14000c446
Capabilities:
Get graphical window text

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rax, qword [0x140056c50]
mov dil, byte [rax]
mov rbp, rcx
mov rbx, rdx
test dil, dil
je 0x14000c4d1
mov rax, qword [rdx]
and dword [rdx + 8], 0
mov rcx, qword [rcx]
and word [rax], 0
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
xchg esi, eax
test esi, esi
je 0x14000c4c3
cmp dword [rbx + 0xc], esi
jae 0x14000c48b
mov edx, esi
mov rcx, rbx
call fcn.140003f00
mov rdx, qword [rbx]
mov rcx, qword [rbp]
lea r8d, [rsi + 1]
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov rcx, qword [rbx]
cmp eax, esi
cmova eax, esi
mov edx, eax
and word [rcx + rdx*2], 0
xor edx, edx
mov r8d, edx
cmp word [rcx + r8*2], 0
je 0x14000c4bc
inc edx
jmp 0x14000c4ad
mov dword [rbx + 8], edx
test eax, eax
jne 0x14000c519
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
sete dil
jmp 0x14000c519
lea rsi, [rsp + 0x20]
mov rcx, rsi
call fcn.1400037c8
mov rdx, rsi
mov rcx, rbp
call fcn.14000c3c6
xor r8d, r8d
mov rdx, rsi
mov rcx, rbx
mov edi, eax
call fcn.1400051cb
mov rcx, qword [rsp + 0x20]
call fcn.14000be20
jmp 0x14000c519
mov eax, edi
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x140019b40
Capabilities:
Log keystrokes via polling

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rsi, rdx
push 0x11
mov rbx, rcx
pop rcx
call qword [sym.imp.USER32.dll_GetKeyState]
mov dx, word [rsi + 0x18]
mov ecx, eax
cmp dx, 0x52
je 0x140019b79
cmp dx, 0x76
je 0x140019b8c
xor eax, eax
cmp dx, 8
jne 0x140019b96
mov rcx, rbx
call fcn.140019960
jmp 0x140019b88
xor eax, eax
test cx, cx
jns 0x140019b96
mov rcx, rbx
call fcn.14001986c
mov al, 1
jmp 0x140019b96
mov rcx, rbx
call fcn.1400199f2
jmp 0x140019b88
add rsp, 0x28
pop rbx
pop rsi
ret
Function at 0x14001b5ee
Capabilities:
Get file system object information

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x208
lea r13, [rsp + 0x48]
mov rbx, r9
mov rbp, rcx
mov r12d, edx
mov rcx, r13
mov dword [rsp + 0x260], r8d
lea rdi, [rsp + 0x98]
call fcn.1400042a2
lea rax, [rsp + 0x88]
cmp byte [rbx], 0
mov qword [rsp + 0x30], rax
je 0x14001b67b
mov rdx, qword [rbx + 8]
xchg rcx, rax
call fcn.14001b3fb
mov r8, qword [rsp + 0x30]
mov edx, 0xdb0
mov rcx, rdi
call fcn.14001b493
mov rdx, rdi
mov rcx, r13
call fcn.140004500
mov rcx, qword [rsp + 0x98]
call fcn.14001b554
mov rcx, qword [rsp + 0x88]
call fcn.14001b554
lea rax, [rbx + 0x18]
lea r15, [rsp + 0x58]
mov qword [rsp + 0x38], rax
xchg rcx, rax
call fcn.140004872
mov r8, qword [rsp + 0x38]
mov rcx, r15
lea esi, [rax + 1]
mov edx, esi
call fcn.140004128
lea r14, [rsp + 0x68]
lea rdx, [rsi + rsi]
add rdx, qword [rbx + 0x18]
mov rcx, r14
call fcn.14000431c
mov rdx, r15
mov rcx, rbp
call fcn.14001b560
mov rdx, r14
mov rcx, rbp
call fcn.14001b560
lea rsi, [rsp + 0x78]
mov rdx, r15
mov rcx, rsi
call fcn.1400043d6
mov rcx, rsi
call fcn.1400046a6
mov rdx, r14
mov rcx, rsi
call fcn.14000471c
mov rcx, rsi
call fcn.1400046a6
mov rdx, r13
mov rcx, rsi
call fcn.14000471c
mov rcx, rsi
call fcn.1400046a6
cmp byte [rbx + 1], 0
je 0x14001b775
mov edx, 0x3f4
mov rcx, rdi
call fcn.14000af3a
mov rdx, rdi
mov rcx, rsi
call fcn.14000471c
mov rcx, qword [rsp + 0x98]
call fcn.14001b554
lea rdx, [0x140052d5c]
mov rcx, rsi
call fcn.140004758
jmp 0x14001b75b
lea rcx, [rbx + 0x10]
mov rdx, rdi
xor r8d, r8d
call fcn.14000aca7
mov rdx, rdi
mov rcx, rsi
call fcn.140004758
mov rcx, qword [rbp + 8]
mov rsi, qword [sym.imp.USER32.dll_GetDlgItem]
mov edx, r12d
call rsi
mov rdx, qword [rsp + 0x78]
xchg rcx, rax
call fcn.14000c329
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
xor r8d, r8d
call fcn.14000539b
mov dword [rsp + 0x20], 0x110
mov rcx, qword [rsp + 0x88]
mov r8, rdi
mov edx, pe_nt_image_headers64
mov r9d, 0x168
call qword [sym.imp.SHELL32.dll_SHGetFileInfoA]
mov rcx, qword [rsp + 0x88]
xchg rbx, rax
test rcx, rcx
je 0x14001b7db
call fcn.14004ecd0
test rbx, rbx
jne 0x14001b81d
mov rcx, qword [rsp + 0x78]
call fcn.14001b554
mov rcx, qword [rsp + 0x68]
call fcn.14001b554
mov rcx, qword [rsp + 0x58]
call fcn.14001b554
mov rcx, qword [rsp + 0x48]
call fcn.14001b554
nop
add rsp, 0x208
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, qword [rbp + 8]
mov edx, dword [rsp + 0x260]
call rsi
mov r8, qword [rsp + 0x98]
xchg rcx, rax
xor r9d, r9d
mov edx, 0x170
call qword [sym.imp.USER32.dll_SendMessageA]
jmp 0x14001b7e0
Function at 0x14001e8dd
Capabilities:
Get file system object information

Disassembly:
push rsi
push rbx
sub rsp, 0x318
mov rax, qword [0x140056c50]
mov esi, edx
mov rbx, r8
or sil, 0x80
cmp byte [rax], 0
jne 0x14001e945
lea rax, [rsp + 0x48]
mov rdx, rcx
xchg rcx, rax
call fcn.140004e1c
mov dword [rsp + 0x20], 0x4010
mov rcx, qword [rsp + 0x48]
mov edx, esi
mov r9d, 0x168
lea r8, [rsp + 0x58]
call qword [sym.imp.SHELL32.dll_SHGetFileInfoA]
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14001e96b
mov qword [rsp + 0x38], rax
call fcn.14004ecd0
mov rax, qword [rsp + 0x38]
jmp 0x14001e96b
mov r10, qword [0x14006d580]
xor eax, eax
test r10, r10
je 0x14001e96b
mov dword [rsp + 0x20], 0x4010
mov r9d, 0x2b8
lea r8, [rsp + 0x58]
mov edx, esi
call r10
mov edx, dword [rsp + 0x60]
mov dword [rbx], edx
add rsp, 0x318
pop rbx
pop rsi
ret

Function at 0x14001e995
Capabilities:
Get file system object information

Disassembly:
sub rsp, 0x1a8
mov eax, 0x4110
test cl, cl
je 0x14001e9aa
mov eax, 0x4011
mov dword [rsp + 0x20], eax
mov r9d, 0x168
lea r8, [rsp + 0x38]
mov edx, 0x90
lea rcx, [0x140052e20]
call qword [sym.imp.SHELL32.dll_SHGetFileInfoA]
add rsp, 0x1a8
ret

Function at 0x140028ba2
Capabilities:
Check os version
Get common file path

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x2f8
call qword [sym.imp.KERNEL32.dll_GetVersion]
cmp ax, 6
jne 0x140028bdc
lea rdi, [rsp + 0x20]
mov edx, 0x106
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea edx, [rax - 1]
cmp edx, 0x103
jbe 0x140028c0a
jmp 0x140028c6c
lea rcx, [0x140053460]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.SetDefaultDllDirectories
xchg rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140028bb9
mov ecx, 0xc00
call rax
test eax, eax
je 0x140028bb9
jmp 0x140028c6c
cmp word [rsp + rdx*2 + 0x20], 0x5c
je 0x140028c1d
mov edx, eax
inc eax
mov word [rsp + rdx*2 + 0x20], 0x5c
mov eax, eax
lea rsi, str.userenv
movabs rbp, 0x6c006c0064002e
add rax, rax
lea rbx, [rdi + rax]
cmp byte [rsi], 0
je 0x140028c6c
mov rax, rbx
movzx edx, byte [rsi]
inc rsi
test dl, dl
je 0x140028c53
add rax, 2
mov word [rax - 2], dx
jmp 0x140028c3f
mov qword [rax], rbp
xor edx, edx
mov rcx, rdi
and word [rax + 8], 0
push 8
pop r8
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
jmp 0x140028c37
add rsp, 0x2f8
pop rbx
pop rsi
pop rdi
pop rbp
ret