joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000dd10
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x240
mov rax, qword [0x140039680]
xor rax, rsp
mov qword [rsp + 0x230], rax
cmp qword [rcx + 0x70], 8
mov rbx, rcx
jb 0x14000dd44
mov r8, qword [rcx + 0x58]
jmp 0x14000dd48
lea r8, [rcx + 0x58]
lea r9, str.Config
lea rdx, [0x140030430]
lea rcx, [rsp + 0x20]
call fcn.140011ce0
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x14000dd79
lea rcx, [rsp + 0x20]
call fcn.1400109d0
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x20]
repne scasw ax, word [rdi]
mov rax, qword [str.Config.ini]
or rcx, 0xffffffffffffffff
mov qword [rdi - 2], rax
mov rax, qword [0x140030560]
add rbx, 0x78
mov rdx, qword [rbx + 0x20]
mov qword [rdi + 6], rax
mov eax, dword [0x140030568]
mov dword [rdi + 0xe], eax
movzx eax, word [0x14003056c]
mov word [rdi + 0x12], ax
xor eax, eax
lea rdi, [rsp + 0x20]
repne scasw ax, word [rdi]
cmp rdx, 8
not rcx
lea rsi, [rcx - 1]
jb 0x14000ddde
mov rax, qword [rbx + 8]
lea rdi, [rbx + 8]
jmp 0x14000dde5
lea rdi, [rbx + 8]
mov rax, rdi
lea rcx, [rsp + 0x20]
cmp rcx, rax
jb 0x14000de36
cmp rdx, 8
jb 0x14000ddfa
mov rcx, qword [rdi]
jmp 0x14000ddfd
mov rcx, rdi
mov rax, qword [rbx + 0x18]
lea rcx, [rcx + rax*2]
lea rax, [rsp + 0x20]
cmp rcx, rax
jbe 0x14000de36
cmp rdx, 8
jb 0x14000de18
mov rdi, qword [rdi]
lea r8, [rsp + 0x20]
mov r9, rsi
mov rdx, rbx
sub r8, rdi
mov rcx, rbx
sar r8, 1
call fcn.140001940
jmp 0x14000deca
movabs rax, 0x7ffffffffffffffe
cmp rsi, rax
jbe 0x14000de4a
call fcn.1400117b0
mov rax, qword [rbx + 0x20]
cmp rax, rsi
jae 0x14000de7e
mov r8, qword [rbx + 0x18]
mov rdx, rsi
mov rcx, rbx
call fcn.1400013e0
test rsi, rsi
je 0x14000deca
mov rdx, qword [rbx + 0x20]
mov qword [rsp + 0x258], rbp
cmp rdx, 8
jb 0x14000de97
mov rcx, qword [rdi]
jmp 0x14000de9a
test rsi, rsi
jne 0x14000de62
cmp rax, 8
mov qword [rbx + 0x18], rsi
jb 0x14000de90
mov rdi, qword [rdi]
mov word [rdi], 0
jmp 0x14000deca
mov rcx, rdi
lea rbp, [rsi + rsi]
lea r8, [rsp + 0x20]
add rdx, rdx
mov r9, rbp
call fcn.140011dd0
cmp qword [rbx + 0x20], 8
mov qword [rbx + 0x18], rsi
jb 0x14000debc
mov rdi, qword [rdi]
mov word [rdi + rbp], 0
mov rbp, qword [rsp + 0x258]
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.140011c90
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14000def0
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x240
mov rax, qword [0x140039680]
xor rax, rsp
mov qword [rsp + 0x230], rax
cmp qword [rcx + 0x70], 8
mov rbx, rcx
jb 0x14000df24
mov r8, qword [rcx + 0x58]
jmp 0x14000df28
lea r8, [rcx + 0x58]
lea r9, str.Config
lea rdx, [0x140030430]
lea rcx, [rsp + 0x20]
call fcn.140011ce0
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x14000df59
lea rcx, [rsp + 0x20]
call fcn.1400109d0
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x20]
repne scasw ax, word [rdi]
mov rax, qword [str.Related.ini]
or rcx, 0xffffffffffffffff
mov qword [rdi - 2], rax
mov rax, qword [0x140030588]
add rbx, 0x140
mov rdx, qword [rbx + 0x20]
mov qword [rdi + 6], rax
mov rax, qword [0x140030590]
mov qword [rdi + 0xe], rax
xor eax, eax
lea rdi, [rsp + 0x20]
repne scasw ax, word [rdi]
cmp rdx, 8
not rcx
lea rsi, [rcx - 1]
jb 0x14000dfb8
mov rax, qword [rbx + 8]
lea rdi, [rbx + 8]
jmp 0x14000dfbf
lea rdi, [rbx + 8]
mov rax, rdi
lea rcx, [rsp + 0x20]
cmp rcx, rax
jb 0x14000e010
cmp rdx, 8
jb 0x14000dfd4
mov rcx, qword [rdi]
jmp 0x14000dfd7
mov rcx, rdi
mov rax, qword [rbx + 0x18]
lea rcx, [rcx + rax*2]
lea rax, [rsp + 0x20]
cmp rcx, rax
jbe 0x14000e010
cmp rdx, 8
jb 0x14000dff2
mov rdi, qword [rdi]
lea r8, [rsp + 0x20]
mov r9, rsi
mov rdx, rbx
sub r8, rdi
mov rcx, rbx
sar r8, 1
call fcn.140001940
jmp 0x14000e0a4
movabs rax, 0x7ffffffffffffffe
cmp rsi, rax
jbe 0x14000e024
call fcn.1400117b0
mov rax, qword [rbx + 0x20]
cmp rax, rsi
jae 0x14000e058
mov r8, qword [rbx + 0x18]
mov rdx, rsi
mov rcx, rbx
call fcn.1400013e0
test rsi, rsi
je 0x14000e0a4
mov rdx, qword [rbx + 0x20]
mov qword [rsp + 0x258], rbp
cmp rdx, 8
jb 0x14000e071
mov rcx, qword [rdi]
jmp 0x14000e074
test rsi, rsi
jne 0x14000e03c
cmp rax, 8
mov qword [rbx + 0x18], rsi
jb 0x14000e06a
mov rdi, qword [rdi]
mov word [rdi], 0
jmp 0x14000e0a4
mov rcx, rdi
lea rbp, [rsi + rsi]
lea r8, [rsp + 0x20]
add rdx, rdx
mov r9, rbp
call fcn.140011dd0
cmp qword [rbx + 0x20], 8
mov qword [rbx + 0x18], rsi
jb 0x14000e096
mov rdi, qword [rdi]
mov word [rdi + rbp], 0
mov rbp, qword [rsp + 0x258]
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.140011c90
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14000e410
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x240
mov rax, qword [0x140039680]
xor rax, rsp
mov qword [rsp + 0x230], rax
cmp qword [rcx + 0x70], 8
mov rbx, rcx
jb 0x14000e444
mov r8, qword [rcx + 0x58]
jmp 0x14000e448
lea r8, [rcx + 0x58]
lea r9, str.UseData
lea rdx, [0x140030430]
lea rcx, [rsp + 0x20]
call fcn.140011ce0
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x14000e479
lea rcx, [rsp + 0x20]
call fcn.1400109d0
or rcx, 0xffffffffffffffff
xor eax, eax
add rbx, 0x208
mov rdx, qword [rbx + 0x20]
lea rdi, [rsp + 0x20]
repne scasw ax, word [rdi]
cmp rdx, 8
not rcx
lea rsi, [rcx - 1]
jb 0x14000e4a9
mov rax, qword [rbx + 8]
lea rdi, [rbx + 8]
jmp 0x14000e4b0
lea rdi, [rbx + 8]
mov rax, rdi
lea rcx, [rsp + 0x20]
cmp rcx, rax
jb 0x14000e501
cmp rdx, 8
jb 0x14000e4c5
mov rcx, qword [rdi]
jmp 0x14000e4c8
mov rcx, rdi
mov rax, qword [rbx + 0x18]
lea rcx, [rcx + rax*2]
lea rax, [rsp + 0x20]
cmp rcx, rax
jbe 0x14000e501
cmp rdx, 8
jb 0x14000e4e3
mov rdi, qword [rdi]
lea r8, [rsp + 0x20]
mov r9, rsi
mov rdx, rbx
sub r8, rdi
mov rcx, rbx
sar r8, 1
call fcn.140001940
jmp 0x14000e595
movabs rax, 0x7ffffffffffffffe
cmp rsi, rax
jbe 0x14000e515
call fcn.1400117b0
mov rax, qword [rbx + 0x20]
cmp rax, rsi
jae 0x14000e549
mov r8, qword [rbx + 0x18]
mov rdx, rsi
mov rcx, rbx
call fcn.1400013e0
test rsi, rsi
je 0x14000e595
mov rdx, qword [rbx + 0x20]
mov qword [rsp + 0x258], rbp
cmp rdx, 8
jb 0x14000e562
mov rcx, qword [rdi]
jmp 0x14000e565
test rsi, rsi
jne 0x14000e52d
cmp rax, 8
mov qword [rbx + 0x18], rsi
jb 0x14000e55b
mov rdi, qword [rdi]
mov word [rdi], 0
jmp 0x14000e595
mov rcx, rdi
lea rbp, [rsi + rsi]
lea r8, [rsp + 0x20]
add rdx, rdx
mov r9, rbp
call fcn.140011dd0
cmp qword [rbx + 0x20], 8
mov qword [rbx + 0x18], rsi
jb 0x14000e587
mov rdi, qword [rdi]
mov word [rdi + rbp], 0
mov rbp, qword [rsp + 0x258]
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.140011c90
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14000f810
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x480
mov rax, qword [0x140039680]
xor rax, rsp
mov qword [rsp + 0x470], rax
mov rbp, rcx
lea rcx, [rsp + 0x262]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x260], 0
call fcn.140011ab0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rcx, [rsp + 0x24]
xor edi, edi
xor edx, edx
mov r8d, 0x234
mov ebx, eax
mov dword [rsp + 0x20], edi
call fcn.140011ab0
lea ecx, [rdi + 2]
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
cmp rax, 0xffffffffffffffff
mov rsi, rax
je 0x14000f91e
lea rdx, [rsp + 0x20]
mov rcx, rax
mov dword [rsp + 0x20], 0x238
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x14000f8e6
nop
nop
cmp dword [rsp + 0x28], ebx
je 0x14000f8d0
lea rdx, [rsp + 0x20]
mov rcx, rsi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x14000f8b0
jmp 0x14000f8e6
movzx eax, word [rsp + rdi + 0x4c]
add rdi, 2
test ax, ax
mov word [rsp + rdi + 0x25e], ax
jne 0x14000f8d0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x260]
call fcn.140013190
or rcx, 0xffffffffffffffff
mov rdx, rax
xor eax, eax
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [rbp + 0x230]
call fcn.140001b40
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.140011c90
lea r11, [rsp + 0x480]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14000f950
Capabilities:
Check if file exists
Get common file path

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x240
mov rax, qword [0x140039680]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rbx, rcx
lea rcx, [rsp + 0x22]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x20], 0
call fcn.140011ab0
lea rdx, [rsp + 0x20]
mov r8d, 0x104
mov rcx, rbx
call fcn.14000c240
test al, al
jne 0x14000f9d3
xor r9d, r9d
lea rdx, [rsp + 0x20]
xor ecx, ecx
lea r8d, [r9 + 0x1a]
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x20]
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
test ecx, ecx
je 0x14000fb6a
mov edx, dword [0x14002ee8c]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x20]
mov qword [rsp + 0x260], rsi
repne scasw ax, word [rdi]
or rcx, 0xffffffffffffffff
mov dword [rdi - 2], edx
lea rdi, [rsp + 0x20]
repne scasw ax, word [rdi]
mov rax, qword [str.DongFangIME]
or rcx, 0xffffffffffffffff
mov qword [rdi - 2], rax
mov rax, qword [0x140030630]
mov qword [rdi + 6], rax
mov rax, qword [0x140030638]
mov qword [rdi + 0xe], rax
xor eax, eax
lea rdi, [rsp + 0x20]
repne scasw ax, word [rdi]
lea rcx, [rsp + 0x20]
mov dword [rdi - 2], edx
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x14000fa49
lea rcx, [rsp + 0x20]
call fcn.1400109d0
mov rdx, qword [rbx + 0x70]
or rcx, 0xffffffffffffffff
xor eax, eax
add rbx, 0x50
lea rdi, [rsp + 0x20]
repne scasw ax, word [rdi]
cmp rdx, 8
not rcx
lea rsi, [rcx - 1]
jb 0x14000fa76
mov rax, qword [rbx + 8]
lea rdi, [rbx + 8]
jmp 0x14000fa7d
lea rdi, [rbx + 8]
mov rax, rdi
lea rcx, [rsp + 0x20]
cmp rcx, rax
jb 0x14000face
cmp rdx, 8
jb 0x14000fa92
mov rcx, qword [rdi]
jmp 0x14000fa95
mov rcx, rdi
mov rax, qword [rbx + 0x18]
lea rcx, [rcx + rax*2]
lea rax, [rsp + 0x20]
cmp rcx, rax
jbe 0x14000face
cmp rdx, 8
jb 0x14000fab0
mov rdi, qword [rdi]
lea r8, [rsp + 0x20]
mov r9, rsi
mov rdx, rbx
sub r8, rdi
mov rcx, rbx
sar r8, 1
call fcn.140001940
jmp 0x14000fb62
movabs rax, 0x7ffffffffffffffe
cmp rsi, rax
jbe 0x14000fae2
call fcn.1400117b0
mov rax, qword [rbx + 0x20]
cmp rax, rsi
jae 0x14000fb16
mov r8, qword [rbx + 0x18]
mov rdx, rsi
mov rcx, rbx
call fcn.1400013e0
test rsi, rsi
je 0x14000fb62
mov rdx, qword [rbx + 0x20]
mov qword [rsp + 0x258], rbp
cmp rdx, 8
jb 0x14000fb2f
mov rcx, qword [rdi]
jmp 0x14000fb32
test rsi, rsi
jne 0x14000fafa
cmp rax, 8
mov qword [rbx + 0x18], rsi
jb 0x14000fb28
mov rdi, qword [rdi]
mov word [rdi], 0
jmp 0x14000fb62
mov rcx, rdi
lea rbp, [rsi + rsi]
lea r8, [rsp + 0x20]
add rdx, rdx
mov r9, rbp
call fcn.140011dd0
cmp qword [rbx + 0x20], 8
mov qword [rbx + 0x18], rsi
jb 0x14000fb54
mov rdi, qword [rdi]
mov word [rdi + rbp], 0
mov rbp, qword [rsp + 0x258]
mov rsi, qword [rsp + 0x260]
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.140011c90
mov rbx, qword [rsp + 0x268]
add rsp, 0x240
pop rdi
ret
Function at 0x14000fb90
Capabilities:
Check if file exists
Get common file path

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x240
mov rax, qword [0x140039680]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rbx, rcx
lea rcx, [rsp + 0x22]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x20], 0
call fcn.140011ab0
lea rdx, [rsp + 0x20]
mov r8d, 0x104
mov rcx, rbx
call fcn.14000c240
test al, al
jne 0x14000fc13
xor r9d, r9d
lea rdx, [rsp + 0x20]
xor ecx, ecx
lea r8d, [r9 + 0x1a]
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x20]
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
test ecx, ecx
je 0x14000fdbe
mov edx, dword [0x14002ee8c]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x20]
mov qword [rsp + 0x260], rsi
repne scasw ax, word [rdi]
or rcx, 0xffffffffffffffff
mov dword [rdi - 2], edx
lea rdi, [rsp + 0x20]
repne scasw ax, word [rdi]
mov rax, qword [str.DongFangIME.users]
or rcx, 0xffffffffffffffff
mov qword [rdi - 2], rax
mov rax, qword [0x140030648]
mov qword [rdi + 6], rax
mov rax, qword [0x140030650]
mov qword [rdi + 0xe], rax
mov rax, qword [0x140030658]
mov qword [rdi + 0x16], rax
mov eax, dword [0x140030660]
mov dword [rdi + 0x1e], eax
xor eax, eax
lea rdi, [rsp + 0x20]
repne scasw ax, word [rdi]
lea rcx, [rsp + 0x20]
mov dword [rdi - 2], edx
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x14000fc9d
lea rcx, [rsp + 0x20]
call fcn.1400109d0
mov rdx, qword [rbx + 0x48]
or rcx, 0xffffffffffffffff
xor eax, eax
add rbx, 0x28
lea rdi, [rsp + 0x20]
repne scasw ax, word [rdi]
cmp rdx, 8
not rcx
lea rsi, [rcx - 1]
jb 0x14000fcca
mov rax, qword [rbx + 8]
lea rdi, [rbx + 8]
jmp 0x14000fcd1
lea rdi, [rbx + 8]
mov rax, rdi
lea rcx, [rsp + 0x20]
cmp rcx, rax
jb 0x14000fd22
cmp rdx, 8
jb 0x14000fce6
mov rcx, qword [rdi]
jmp 0x14000fce9
mov rcx, rdi
mov rax, qword [rbx + 0x18]
lea rcx, [rcx + rax*2]
lea rax, [rsp + 0x20]
cmp rcx, rax
jbe 0x14000fd22
cmp rdx, 8
jb 0x14000fd04
mov rdi, qword [rdi]
lea r8, [rsp + 0x20]
mov r9, rsi
mov rdx, rbx
sub r8, rdi
mov rcx, rbx
sar r8, 1
call fcn.140001940
jmp 0x14000fdb6
movabs rax, 0x7ffffffffffffffe
cmp rsi, rax
jbe 0x14000fd36
call fcn.1400117b0
mov rax, qword [rbx + 0x20]
cmp rax, rsi
jae 0x14000fd6a
mov r8, qword [rbx + 0x18]
mov rdx, rsi
mov rcx, rbx
call fcn.1400013e0
test rsi, rsi
je 0x14000fdb6
mov rdx, qword [rbx + 0x20]
mov qword [rsp + 0x258], rbp
cmp rdx, 8
jb 0x14000fd83
mov rcx, qword [rdi]
jmp 0x14000fd86
test rsi, rsi
jne 0x14000fd4e
cmp rax, 8
mov qword [rbx + 0x18], rsi
jb 0x14000fd7c
mov rdi, qword [rdi]
mov word [rdi], 0
jmp 0x14000fdb6
mov rcx, rdi
lea rbp, [rsi + rsi]
lea r8, [rsp + 0x20]
add rdx, rdx
mov r9, rbp
call fcn.140011dd0
cmp qword [rbx + 0x20], 8
mov qword [rbx + 0x18], rsi
jb 0x14000fda8
mov rdi, qword [rdi]
mov word [rdi + rbp], 0
mov rbp, qword [rsp + 0x258]
mov rsi, qword [rsp + 0x260]
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.140011c90
mov rbx, qword [rsp + 0x268]
add rsp, 0x240
pop rdi
ret
Function at 0x1400109d0
Capabilities:
Check if file exists
Create directory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x20
mov rsi, rcx
xor eax, eax
or r8, 0xffffffffffffffff
mov rcx, r8
mov rdi, rsi
repne scasw ax, word [rdi]
mov eax, 2
not rcx
movsxd rdx, ecx
lea r12, [rcx - 1]
mul rdx
cmovo rax, r8
mov rcx, rax
call fcn.140011950
mov rbx, rax
sub rax, rsi
movzx ecx, word [rsi]
add rsi, 2
test cx, cx
mov word [rax + rsi - 2], cx
jne 0x140010a20
xor edi, edi
test r12d, r12d
mov bpl, 1
movsxd rsi, r12d
js 0x140010a7d
nop
cmp word [rbx + rdi*2], 0x5c
jne 0x140010a6f
mov rcx, rbx
mov word [rbx + rdi*2], 0
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x140010a69
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x140010a7a
mov word [rbx + rdi*2], 0x5c
add rdi, 1
cmp rdi, rsi
jle 0x140010a40
jmp 0x140010a7d
xor bpl, bpl
mov rcx, rbx
call fcn.1400136c0
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
movzx eax, bpl
mov rbp, qword [rsp + 0x38]
add rsp, 0x20
pop r12
ret

Function at 0x140010ab0
Capabilities:
Create process on windows

Disassembly:
push rbx
sub rsp, 0x8c0
mov rax, qword [0x140039680]
xor rax, rsp
mov qword [rsp + 0x8b0], rax
xor edx, edx
mov rbx, rcx
lea rcx, [rsp + 0x70]
lea r8d, [rdx + 0x68]
call fcn.140011ab0
xor eax, eax
lea rdx, [0x14002efd8]
lea rcx, [rsp + 0xe0]
mov r8, rbx
mov dword [rsp + 0x70], 0x68
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
call fcn.140011ce0
lea r11, [rsp + 0x50]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x48], r11
mov qword [rsp + 0x40], rax
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], eax
lea rdx, [rsp + 0xe0]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x140010b6a
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x8b0]
xor rcx, rsp
call fcn.140011c90
add rsp, 0x8c0
pop rbx
ret
Function at 0x140010b90
Capabilities:
Create process on windows

Disassembly:
push rbx
sub rsp, 0x8c0
mov rax, qword [0x140039680]
xor rax, rsp
mov qword [rsp + 0x8b0], rax
xor edx, edx
mov rbx, rcx
lea rcx, [rsp + 0x70]
lea r8d, [rdx + 0x68]
call fcn.140011ab0
xor eax, eax
lea rdx, [0x14002efd8]
lea rcx, [rsp + 0xe0]
mov r8, rbx
mov dword [rsp + 0x70], 0x68
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
call fcn.140011ce0
lea r11, [rsp + 0x50]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x48], r11
mov qword [rsp + 0x40], rax
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], eax
lea rdx, [rsp + 0xe0]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x140010c68
mov rcx, qword [rsp + 0x50]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x50]
lea rdx, [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x8b0]
xor rcx, rsp
call fcn.140011c90
add rsp, 0x8c0
pop rbx
ret

Function at 0x140010c90
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, rcx
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
cmp rcx, 1
je 0x140010ce1
lea rdx, str.open
xor r9d, r9d
mov r8, rbx
xor ecx, ecx
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
ja 0x140010ce1
mov rcx, rbx
call fcn.140010ab0
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x140010cf0
Capabilities:
Check os version
Create process on windows
Get system information on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x1f0
mov rax, qword [0x140039680]
xor rax, rsp
mov qword [rsp + 0x1e0], rax
mov rdi, rdx
xor edx, edx
mov rbx, rcx
lea rcx, [rsp + 0x24]
lea r8d, [rdx + 0x6c]
mov dword [rsp + 0x20], 0x70
call fcn.140011ab0
lea rcx, [rsp + 0x90]
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x24], 0x200
mov dword [rsp + 0x50], 1
mov qword [rsp + 0x40], rdi
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea rcx, [rsp + 0xc0]
xor edx, edx
mov r8d, 0x11c
call fcn.140011ab0
lea rcx, [rsp + 0xc0]
mov dword [rsp + 0xc0], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rsp + 0xc4], 5
jg 0x140010d97
cmp dword [rsp + 0xc8], 2
jle 0x140010da3
lea rcx, str.runas
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x140010db8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, 1
mov rcx, qword [rsp + 0x1e0]
xor rcx, rsp
call fcn.140011c90
mov rbx, qword [rsp + 0x210]
add rsp, 0x1f0
pop rdi
ret
Function at 0x140010de0
Capabilities:
Check mutex on windows

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov r8, rdx
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rbx], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor edx, edx
cmp eax, 0xb7
mov rax, rbx
setne dl
mov dword [rbx + 8], edx
add rsp, 0x20
pop rbx
ret

Function at 0x140010f10
Capabilities:
Find taskbar

Disassembly:
push rbx
sub rsp, 0x50
lea r8, [0x140010e60]
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov dword [0x14003b140], 0
call qword [sym.imp.USER32.dll_EnumDisplayMonitors]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
lea r8, [rsp + 0x20]
lea ecx, [rdx + 0x30]
xor r9d, r9d
call qword [sym.imp.USER32.dll_SystemParametersInfoW]
lea rcx, str.Shell_TrayWnd
xor edx, edx
call qword [sym.imp.USER32.dll_FindWindowW]
mov rbx, rax
call qword [sym.imp.USER32.dll_GetDesktopWindow]
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowRect]
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [rsp + 0x28]
mov ecx, dword [0x14003b140]
sub eax, dword [rsp + 0x20]
cmp ecx, 1
jle 0x140010fc1
test ecx, ecx
jle 0x140010fc1
lea rdx, [0x14003b0a8]
mov r8, rcx
nop
nop
nop
mov ecx, dword [rdx]
cmp ecx, eax
cmovg eax, ecx
add rdx, 0x10
sub r8, 1
jne 0x140010fb0
add rsp, 0x50
pop rbx
ret

Function at 0x140011050
Capabilities:
Find taskbar

Disassembly:
push rbx
sub rsp, 0x50
xor edx, edx
lea r8, [rsp + 0x30]
xor r9d, r9d
lea ecx, [rdx + 0x30]
call qword [sym.imp.USER32.dll_SystemParametersInfoW]
lea rcx, str.Shell_TrayWnd
xor edx, edx
call qword [sym.imp.USER32.dll_FindWindowW]
mov rbx, rax
call qword [sym.imp.USER32.dll_GetDesktopWindow]
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowRect]
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [rsp + 0x28]
sub eax, dword [rsp + 0x20]
add rsp, 0x50
pop rbx
ret

Function at 0x1400110b0
Capabilities:
Find taskbar

Disassembly:
push rbx
sub rsp, 0x50
xor edx, edx
lea r8, [rsp + 0x30]
xor r9d, r9d
lea ecx, [rdx + 0x30]
call qword [sym.imp.USER32.dll_SystemParametersInfoW]
lea rcx, str.Shell_TrayWnd
xor edx, edx
call qword [sym.imp.USER32.dll_FindWindowW]
mov rbx, rax
call qword [sym.imp.USER32.dll_GetDesktopWindow]
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowRect]
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [rsp + 0x2c]
sub eax, dword [rsp + 0x24]
add rsp, 0x50
pop rbx
ret

Function at 0x140011110
Capabilities:
Find taskbar

Disassembly:
push rbx
sub rsp, 0x50
xor edx, edx
lea r8, [rsp + 0x20]
xor r9d, r9d
lea ecx, [rdx + 0x30]
call qword [sym.imp.USER32.dll_SystemParametersInfoW]
lea rcx, str.Shell_TrayWnd
xor edx, edx
call qword [sym.imp.USER32.dll_FindWindowW]
mov rbx, rax
call qword [sym.imp.USER32.dll_GetDesktopWindow]
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowRect]
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [rsp + 0x2c]
sub eax, dword [rsp + 0x24]
add rsp, 0x50
pop rbx
ret