joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14009d4e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
sub rsp, 0x40
mov rbp, rcx
test rcx, rcx
jne 0x14009d4f6
xor eax, eax
add rsp, 0x40
pop rbp
ret
mov qword [rsp + 0x50], rbx
call qword [sym.imp.KERNEL32.dll_GlobalLock]
cmp word [rax + 0xe], 8
mov rbx, rax
je 0x14009d521
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rbx, qword [rsp + 0x50]
xor eax, eax
add rsp, 0x40
pop rbp
ret
mov qword [rsp + 0x58], rsi
movsxd rsi, dword [rax + 4]
mov eax, dword [rax + 8]
cdq
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x38], r12
xor eax, edx
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x20], r15
sub eax, edx
movsxd rdi, eax
lea eax, [rsi*8 + 0x1f]
cdq
mov r8d, edi
and edx, 0x1f
add eax, edx
sar eax, 5
shl eax, 2
movsxd r13, eax
lea eax, [rsi + rsi*2]
lea eax, [rax*8 + 0x1f]
mov r9d, r13d
cdq
and edx, 0x1f
add eax, edx
mov edx, esi
sar eax, 5
shl eax, 2
movsxd r12, eax
mov r15, r12
mov ecx, r12d
imul r15, rdi
call fcn.14009b440
test eax, eax
jne 0x14009d5a3
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
xor eax, eax
jmp 0x14009d688
lea rdx, [r15 + 0x28]
mov ecx, 0x40
mov qword [rsp + 0x28], r14
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov r14, rax
test rax, rax
jne 0x14009d5cf
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
xor eax, eax
jmp 0x14009d683
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rdx, rax
mov dword [rax], 0x28
mov dword [rax + 4], esi
mov dword [rax + 8], edi
mov qword [rax + 0xc], 0x180001
mov dword [rdx + 0x14], r15d
mov ecx, dword [rbx + 0x18]
mov dword [rdx + 0x18], ecx
mov ecx, dword [rbx + 0x1c]
xor eax, eax
mov qword [rdx + 0x20], rax
mov dword [rdx + 0x1c], ecx
mov r10d, dword [rbx + 0x20]
add r10, 0xa
lea r11, [rdx + 0x28]
lea r10, [rbx + r10*4]
test rdi, rdi
je 0x14009d66e
nop word [rax + rax]
mov r8, r10
mov rax, r11
test rsi, rsi
je 0x14009d663
mov r9, rsi
nop
movzx ecx, byte [r8]
lea rax, [rax + 3]
lea r8, [r8 + 1]
movzx edx, byte [rbx + rcx*4 + 0x28]
mov byte [rax - 3], dl
movzx ecx, byte [r8 - 1]
movzx edx, byte [rbx + rcx*4 + 0x29]
mov byte [rax - 2], dl
movzx ecx, byte [r8 - 1]
movzx edx, byte [rbx + rcx*4 + 0x2a]
mov byte [rax - 1], dl
dec r9
jne 0x14009d630
add r10, r13
add r11, r12
dec rdi
jne 0x14009d620
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rax, r14
mov r14, qword [rsp + 0x28]
mov r13, qword [rsp + 0x30]
mov r12, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x58]
mov r15, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x1400a0bc0
Capabilities:
Read .ini file

Disassembly:
push rbx
sub rsp, 0x20
mov rcx, qword [0x1401fbb10]
mov ebx, dword [0x1402094a0]
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x1400a0bf6
mov rcx, qword [0x1401fbb18]
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x1400a0bf6
mov eax, ebx
add rsp, 0x20
pop rbx
ret
lea r9, [0x140208860]
lea rdx, str.FullBackColor
lea rcx, str.Viewing
xor r8d, r8d
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
Function at 0x1400a0cd0
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
xor eax, eax
mov rbx, r8
mov rdi, rdx
mov dword [r8], eax
mov dword [rdx], eax
test ecx, ecx
je 0x1400a0d62
mov rcx, qword [0x1401fbb10]
mov qword [rsp + 0x30], rsi
mov esi, dword [0x1402094a0]
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x1400a0d18
mov rcx, qword [0x1401fbb18]
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1400a0d38
lea r9, [0x140208860]
lea rdx, str.FullBackColor
lea rcx, str.Viewing
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov esi, eax
lea r9, [0x140208860]
lea rdx, str.ShowPNGAlpha
lea rcx, str.Others
mov r8d, 1
mov dword [rdi], esi
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov rsi, qword [rsp + 0x30]
mov dword [rbx], eax
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1400a3470
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xe0
mov rax, qword [0x1401f7280]
xor rax, rsp
mov qword [rsp + 0xd0], rax
xor eax, eax
mov edi, edx
mov rbx, rcx
mov word [rcx], ax
lea rsi, [0x140208860]
lea rdx, str.CRW_AWB
lea rcx, str.Plugins
xor r8d, r8d
mov r9, rsi
mov word [rsp + 0x30], ax
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
lea rdx, [0x14018cf10]
lea rcx, [rsp + 0x50]
mov r8d, eax
call fcn.1400f98c8
lea rcx, [rbx - 2]
nop dword [rax]
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x1400a34e0
lea r8, [rsp + 0x50]
xor edx, edx
movzx eax, word [r8 + rdx*2]
lea rdx, [rdx + 1]
mov word [rcx + rdx*2 - 2], ax
test ax, ax
jne 0x1400a34f2
lea rdx, str.CRW_CWB
lea rcx, str.Plugins
mov r9, rsi
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
lea rdx, [0x14018cf20]
lea rcx, [rsp + 0x50]
mov r8d, eax
call fcn.1400f98c8
lea rcx, [rbx - 2]
nop word [rax + rax]
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x1400a3540
lea r8, [rsp + 0x50]
xor edx, edx
movzx eax, word [r8 + rdx*2]
lea rdx, [rdx + 1]
mov word [rcx + rdx*2 - 2], ax
test ax, ax
jne 0x1400a3552
lea r9, [rsp + 0x30]
lea r8, str.1.00
lea rdx, str.CRW_Bright
lea rcx, str.Plugins
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], InitCommonControls
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea r8, [rsp + 0x30]
lea rdx, [0x14018cf30]
lea rcx, [rsp + 0x50]
call fcn.1400f98c8
lea rcx, [rbx - 2]
nop dword [rax]
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x1400a35b0
lea r9, [rsp + 0x50]
xor edx, edx
movzx eax, word [r9 + rdx*2]
lea rdx, [rdx + 1]
mov word [rcx + rdx*2 - 2], ax
test ax, ax
jne 0x1400a35c2
test edi, edi
jne 0x1400a35f8
lea r8d, [rdi + 1]
lea rdx, str.CRW_HALF
lea rcx, str.Plugins
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
je 0x1400a3620
lea rcx, [rbx - 2]
nop dword [rax]
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x1400a3600
movsd xmm0, qword [str.half]
movsd qword [rcx], xmm0
mov eax, dword [0x14018cf48]
mov dword [rcx + 8], eax
lea rdx, str.CRW_Highlight
lea rcx, str.Plugins
mov r9, rsi
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
lea rdx, str.h_d
lea rcx, [rsp + 0x50]
mov r8d, eax
call fcn.1400f98c8
lea rdx, [rbx - 2]
cmp word [rdx + 2], 0
lea rdx, [rdx + 2]
jne 0x1400a3652
lea r10, [rsp + 0x50]
xor r8d, r8d
nop word [rax + rax]
movzx eax, word [r10 + r8*2]
lea r8, [r8 + 1]
mov word [rdx + r8*2 - 2], ax
test ax, ax
jne 0x1400a3670
lea rdx, str.CRW_NoBright
lea rcx, str.Plugins
mov r9, rsi
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
lea rdx, str.W_d
lea rcx, [rsp + 0x50]
mov r8d, eax
call fcn.1400f98c8
sub rbx, 2
nop word [rax + rax]
cmp word [rbx + 2], 0
lea rbx, [rbx + 2]
jne 0x1400a36c0
lea rdx, [rsp + 0x50]
xor ecx, ecx
nop dword [rax]
nop word [rax + rax]
movzx eax, word [rdx + rcx*2]
lea rcx, [rcx + 1]
mov word [rbx + rcx*2 - 2], ax
test ax, ax
jne 0x1400a36e0
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.1400f9a80
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1400a4cd0
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov esi, ecx
mov rcx, qword [0x1401fc158]
mov ebx, r8d
xor ebp, ebp
mov rdi, rdx
mov dword [rsp + 0x40], ebx
test rcx, rcx
je 0x1400a4d1a
cmp esi, 0x7d5
je 0x1400a4d1a
call qword [sym.imp.USER32.dll_DestroyWindow]
mov qword [0x1401fc158], rbp
mov qword [0x1401fc160], rbp
mov rcx, qword [0x1401fc170]
test rcx, rcx
je 0x1400a4d33
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [0x1401fc170], rbp
lea eax, [rsi - 4]
cmp eax, 0x10
ja case.0x1400a4d52.6
lea rdx, [0x140000000]
cdqe
mov ecx, dword [rdx + rax*4 + 0xa4ed0]
add rcx, rdx
jmp rcx
lea r9, [0x1400a8120]
mov edx, 0x4c6
mov rcx, qword [0x1401fbba0]
mov r8, rdi
test ebx, ebx
je 0x1400a4d83
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
call qword [sym.imp.USER32.dll_DialogBoxParamW]
jmp case.0x1400a4d52.6
mov qword [rsp + 0x20], rbp
call qword [sym.imp.USER32.dll_CreateDialogParamW]
jmp 0x1400a4e3d
lea r8, [0x140189f08]
jmp 0x1400a4e20
lea r8, [0x140189f48]
jmp 0x1400a4e20
lea r9, [0x140208860]
lea rdx, [0x140189e48]
lea rcx, [0x140183078]
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
lea r8, [0x140189500]
jmp 0x1400a4e20
lea r9, [0x1400a9290]
mov edx, 0x53c
jmp 0x1400a4d60
lea r8, [0x1401892f8]
jmp 0x1400a4e20
mov rcx, qword [0x1401fbba0]
lea rax, [rsp + 0x40]
lea r9, [0x1400ab7a0]
mov qword [rsp + 0x20], rax
mov r8, rdi
mov edx, 0x53d
test ebx, ebx
je 0x1400a4d88
call qword [sym.imp.USER32.dll_DialogBoxParamW]
jmp case.0x1400a4d52.6
lea r8, [0x1401893e0]
lea r9, [0x140208860]
mov edx, ebx
mov rcx, rdi
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], 1
call fcn.1400a8ba0
mov qword [0x1401fc158], rax
mov rcx, qword [0x1401fc158]
test rcx, rcx
je 0x1400a4eb4
mov edx, 5
call qword [sym.imp.USER32.dll_GetWindow]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
mov edx, 0x87
mov qword [0x1401fc160], rax
call qword [sym.imp.USER32.dll_SendMessageW]
bt rax, 8
jae 0x1400a4eb4
nop dword [rax]
mov rcx, qword [0x1401fc160]
mov edx, 2
call qword [sym.imp.USER32.dll_GetWindow]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
mov edx, 0x87
mov qword [0x1401fc160], rax
call qword [sym.imp.USER32.dll_SendMessageW]
bt rax, 8
jb 0x1400a4e80
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov eax, 1
add rsp, 0x30
pop rdi
ret
Function at 0x1400a4fe0
Capabilities:
Get file system object information

Disassembly:
push rbx
sub rsp, 0x940
mov rax, qword [0x1401f7280]
xor rax, rsp
mov qword [rsp + 0x930], rax
mov rbx, rcx
lea rcx, [rsp + 0x2f0]
call fcn.140094e80
test eax, eax
je 0x1400a50ad
xor eax, eax
nop word [rax + rax]
movzx ecx, word [rsp + rax + 0x2f0]
lea rax, [rax + 2]
mov word [rsp + rax + 0x51e], cx
test cx, cx
jne 0x1400a5020
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, 0x2b8
call fcn.1400f9ab0
lea r8, [rsp + 0x30]
lea rcx, [rsp + 0x2f0]
mov r9d, 0x2b8
xor edx, edx
mov dword [rsp + 0x20], 0x200
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test rax, rax
je 0x1400a5094
lea r9, [rsp + 0x2f0]
lea r8, [rsp + 0x40]
lea rdx, str._s_______s_
lea rcx, [rsp + 0x520]
call fcn.1400f98c8
lea r9, [rsp + 0x520]
xor r8d, r8d
mov edx, 0x143
mov rcx, rbx
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rsp + 0x930]
xor rcx, rsp
call fcn.1400f9a80
add rsp, 0x940
pop rbx
ret

Function at 0x1400a50d0
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x540
mov rax, qword [0x1401f7280]
xor rax, rsp
mov qword [rsp + 0x530], rax
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
lea rbp, [0x140208860]
lea rdx, str.CommonFolders
mov r8d, 1
mov r9, rbp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
je 0x1400a515f
mov edx, 0x27
mov rcx, rbx
call fcn.1400a4fe0
mov edx, 0x36
mov rcx, rbx
call fcn.1400a4fe0
mov edx, 5
mov rcx, rbx
call fcn.1400a4fe0
mov edx, InitCommonControls
mov rcx, rbx
call fcn.1400a4fe0
mov edx, 6
mov rcx, rbx
call fcn.1400a4fe0
cmp word [0x140209940], 0
je 0x1400a51e6
lea rdx, [0x140185d68]
mov rcx, rdi
call fcn.1400f92fc
test eax, eax
jne 0x1400a51e6
lea rcx, [0x140209940]
call fcn.1400e7210
test eax, eax
je 0x1400a51e6
lea rdx, [rsp + 0x2e0]
lea rcx, [0x140209940]
mov r8d, 3
call fcn.1400ed200
cmp word [rsp + 0x2e0], 0
je 0x1400a51e6
lea r8, [rsp + 0x2e0]
lea rdx, str.___s_
lea rcx, [rsp + 0xb0]
call fcn.1400f98c8
lea r9, [rsp + 0xb0]
xor r8d, r8d
mov edx, 0x143
mov rcx, rbx
call qword [sym.imp.USER32.dll_SendMessageW]
lea rdx, str.UseMRUDs
lea rcx, str.Others
mov r9, rbp
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
je 0x1400a5290
xor edi, edi
nop dword [rax]
inc edi
lea rdx, str._s_d
lea rcx, [rsp + 0x30]
mov r9d, edi
mov r8, rsi
call fcn.1400f98c8
lea r9, [rsp + 0xb0]
lea r8, [0x140181e34]
lea rdx, [rsp + 0x30]
lea rcx, str.MRUD
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], 0x104
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea rcx, [rsp + 0xb0]
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400a5263
test rax, rax
je 0x1400a528b
lea r9, [rsp + 0xb0]
xor r8d, r8d
mov edx, 0x143
mov rcx, rbx
call qword [sym.imp.USER32.dll_SendMessageW]
cmp edi, 0x14
jl 0x1400a5210
xor r9d, r9d
xor r8d, r8d
mov edx, 0x14e
mov rcx, rbx
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rsp + 0x530]
xor rcx, rsp
call fcn.1400f9a80
mov rbx, qword [rsp + 0x578]
add rsp, 0x540
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400aad70
Capabilities:
Get graphical window text

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x430
mov rax, qword [0x1401f7280]
xor rax, rsp
mov qword [rsp + 0x420], rax
mov r14d, r8d
mov rbp, rdx
xor r9d, r9d
xor r8d, r8d
mov edx, 0x147
mov rsi, rcx
call qword [sym.imp.USER32.dll_SendMessageW]
xor r15d, r15d
mov word [rsp + 0x20], r15w
cmp eax, 0xffffffff
je 0x1400aae22
lea r9, [rsp + 0x20]
movsxd r8, eax
mov edx, 0x148
mov rcx, rsi
call qword [sym.imp.USER32.dll_SendMessageW]
mov edx, r15d
mov eax, r15d
lea r8, [rsp + 0x20]
or rcx, 0xffffffffffffffff
nop
inc rcx
cmp word [r8 + rcx*2], ax
jne 0x1400aade0
dec ecx
movsxd r8, ecx
test ecx, ecx
jle 0x1400aae18
cmp word [rsp + rax*2 + 0x20], 0x20
jne 0x1400aae03
cmp word [rsp + rax*2 + 0x22], 0x2d
je 0x1400aae0f
inc rax
inc edx
cmp rax, r8
jl 0x1400aadf3
jmp 0x1400aae18
movsxd rax, edx
mov word [rsp + rax*2 + 0x20], r15w
lea rcx, [rsp + 0x20]
call fcn.1400fa1a4
xor r9d, r9d
xor r8d, r8d
mov edx, 0x146
mov rcx, rsi
mov qword [rsp + 0x470], rbx
mov edi, r15d
call qword [sym.imp.USER32.dll_SendMessageW]
test rax, rax
jle 0x1400aaf07
mov rbx, r15
nop dword [rax]
lea r9, [rsp + 0x220]
mov r8, rbx
mov edx, 0x148
mov rcx, rsi
call qword [sym.imp.USER32.dll_SendMessageW]
mov rax, r15
lea rdx, [rsp + 0x220]
or rcx, 0xffffffffffffffff
nop dword [rax + rax]
inc rcx
cmp word [rdx + rcx*2], ax
jne 0x1400aae80
dec ecx
movsxd rdx, ecx
test ecx, ecx
jle 0x1400aaebb
cmp word [rsp + rax*2 + 0x220], 0x20
jne 0x1400aaea8
cmp word [rsp + rax*2 + 0x222], 0x2d
je 0x1400aaeb2
inc rax
cmp rax, rdx
jl 0x1400aae92
jmp 0x1400aaebb
mov word [rsp + rax*2 + 0x220], r15w
lea rcx, [rsp + 0x220]
mov rdx, rbp
call fcn.1400f92fc
test eax, eax
jne 0x1400aaee5
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x220]
call fcn.1400f92fc
test eax, eax
jne 0x1400aaf30
inc edi
xor r9d, r9d
xor r8d, r8d
mov edx, 0x146
mov rcx, rsi
movsxd rbx, edi
call qword [sym.imp.USER32.dll_SendMessageW]
cmp rbx, rax
jl 0x1400aae50
xor eax, eax
mov rbx, qword [rsp + 0x470]
mov rcx, qword [rsp + 0x420]
xor rcx, rsp
call fcn.1400f9a80
add rsp, 0x430
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
xor r9d, r9d
mov rcx, rsi
test r14d, r14d
je 0x1400aaf7a
lea r8d, [r9 + 1]
mov edx, 0x14f
call qword [sym.imp.USER32.dll_SendMessageW]
movsxd r8, edi
xor r9d, r9d
mov edx, 0x14e
mov rcx, rsi
call qword [sym.imp.USER32.dll_SendMessageW]
xor r9d, r9d
mov edx, 0x100
lea r8d, [r9 + 0xd]
mov rcx, rsi
call qword [sym.imp.USER32.dll_SendMessageW]
mov eax, 1
jmp 0x1400aaf09
movsxd r8, edi
mov edx, 0x14e
call qword [sym.imp.USER32.dll_SendMessageW]
mov eax, 1
jmp 0x1400aaf09
Function at 0x1400ab6f0
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov ebx, r8d
xor r8d, r8d
mov rsi, rdx
mov rbp, rcx
call fcn.1400a55a0
mov edi, eax
test ebx, ebx
jne 0x1400ab739
lea r9, [0x140208860]
lea rdx, str.ViewMode
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ebx, eax
test eax, eax
jle 0x1400ab771
test edi, edi
jle 0x1400ab771
cmp ebx, edi
je 0x1400ab771
lea r8, str.SHELLDLL_DefView
xor r9d, r9d
xor edx, edx
mov rcx, rbp
call qword [sym.imp.USER32.dll_FindWindowExW]
test rax, rax
je 0x1400ab771
movsxd r8, ebx
xor r9d, r9d
mov edx, 0x111
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
xor r8d, r8d
mov rdx, rsi
mov rcx, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp fcn.1400a55a0
Function at 0x1400afe50
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x6c8
mov rax, qword [0x1401f7280]
xor rax, rsp
mov qword [rsp + 0x6b0], rax
mov eax, dword [rsp + 0x718]
mov ebx, r9d
mov r9d, dword [rsp + 0x710]
mov dword [rsp + 0x30], ebx
mov rbp, r8
mov rdi, rdx
mov dword [rsp + 0x20], eax
mov rsi, rcx
call fcn.1400b0060
test ebx, ebx
je 0x1400aff54
mov rcx, rdi
call fcn.1400e47e0
lea rdx, [0x140186bd0]
lea rcx, [rsp + 0x290]
mov r8, rdi
call fcn.1400f98c8
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x290]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400aff54
nop dword [rax]
cmp word [rsp + 0x6c], 0x2e
je 0x1400aff39
test byte [rsp + 0x40], 0x10
je 0x1400aff39
lea r9, [rsp + 0x6c]
lea rdx, str._s_s
lea rcx, [rsp + 0x4a0]
mov r8, rdi
call fcn.1400f98c8
mov eax, dword [rsp + 0x718]
mov r9d, dword [rsp + 0x30]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x710]
lea rdx, [rsp + 0x4a0]
mov r8, rbp
mov rcx, rsi
mov dword [rsp + 0x20], eax
call fcn.1400afe50
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1400afee0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, qword [rsp + 0x6b0]
xor rcx, rsp
call fcn.1400f9a80
add rsp, 0x6c8
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x1400aff70
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push rbx
push rsi
sub rsp, 0x38
mov rax, rdx
mov rsi, rcx
lea rdx, [0x140183378]
mov rcx, rax
call fcn.1400fafe4
mov rbx, rax
test rax, rax
jne 0x1400aff9b
add rsp, 0x38
pop rsi
pop rbx
ret
xor edx, edx
mov qword [rsp + 0x50], rbp
mov rcx, rax
lea r8d, [rdx + 2]
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x30], r14
call fcn.1400fe870
mov rcx, rbx
call fcn.1400ff110
xor r8d, r8d
xor edx, edx
mov rcx, rbx
mov rbp, rax
call fcn.1400fe870
mov ecx, ebp
mov r14d, ebp
call fcn.1400fa250
mov rdi, rax
test rax, rax
jne 0x1400affee
mov rcx, rbx
call fcn.1400fa904
xor eax, eax
jmp 0x1400b003d
mov r9, rbx
mov r8d, 1
mov rdx, r14
mov rcx, rax
call fcn.1400fabdc
lea r9, [rsp + 0x60]
mov r8d, ebp
mov rdx, rdi
mov rcx, rsi
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call fcn.1400fa904
mov rcx, rdi
call fcn.1400f97e8
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov eax, 1
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x50]
mov r14, qword [rsp + 0x30]
add rsp, 0x38
pop rsi
pop rbx
ret
Function at 0x1400b0060
Capabilities:
Enumerate files on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0xac0
mov rax, qword [0x1401f7280]
xor rax, rsp
mov qword [rsp + 0xaa0], rax
mov rbx, rcx
mov rcx, rdx
mov ebp, r9d
mov rdi, r8
mov r14, rdx
call fcn.1400e47e0
lea rdx, str._s_s
lea rcx, [rsp + 0x480]
mov r9, rbx
mov r8, r14
call fcn.1400f98c8
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x480]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x1400b0210
mov qword [rsp + 0xab8], r12
mov qword [rsp + 0xab0], r15
mov r15d, dword [rsp + 0xb10]
mov r12d, 0x103
nop dword [rax]
cmp word [rsp + 0x4c], 0x2e
je 0x1400b01e1
mov eax, dword [rsp + 0x20]
test al, 0x10
jne 0x1400b01e1
test al, 2
je 0x1400b0114
test ebp, ebp
je 0x1400b01e1
lea rcx, [rsp + 0x270]
xor edx, edx
mov r8d, 0x208
call fcn.1400f9ab0
lea rax, [rsp + 0x4c]
or r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x1400b0132
cmp r8, r12
lea rdx, [rsp + 0x4c]
lea rcx, [rsp + 0x270]
cmova r8, r12
call fcn.1400fb86c
lea r9, [rsp + 0x270]
lea rdx, str._s_s
lea rcx, [rsp + 0x690]
mov r8, r14
call fcn.1400f98c8
test r15d, r15d
je 0x1400b01c8
mov rcx, rdi
call fcn.1400dfb40
cmp eax, 0xffffffff
je 0x1400b01c8
movsxd rbx, eax
lea r9, [rsp + 0x690]
mov edx, 0x181
mov r8, rbx
mov rcx, rdi
call qword [sym.imp.USER32.dll_SendMessageW]
or r9, 0xffffffffffffffff
xor r8d, r8d
mov edx, 0x185
mov rcx, rdi
call qword [sym.imp.USER32.dll_SendMessageW]
mov r9, rbx
mov edx, 0x185
mov r8d, 1
jmp 0x1400b01d8
lea r9, [rsp + 0x690]
xor r8d, r8d
mov edx, 0x180
mov rcx, rdi
call qword [sym.imp.USER32.dll_SendMessageW]
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1400b00f0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov r15, qword [rsp + 0xab0]
mov r12, qword [rsp + 0xab8]
mov rcx, qword [rsp + 0xaa0]
xor rcx, rsp
call fcn.1400f9a80
add rsp, 0xac0
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400b0230
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x8b0
mov rax, qword [0x1401f7280]
xor rax, rsp
mov qword [rsp + 0x8a0], rax
mov rsi, r8
mov r14, rdx
mov rdi, rcx
lea r9, [rdx - 2]
nop
cmp word [r9 + 2], 0
lea r9, [r9 + 2]
jne 0x1400b0260
mov eax, dword [0x14018675c]
xor ebp, ebp
mov rcx, r14
lea edx, [rbp + 0x3b]
mov dword [r9], eax
call fcn.1400e8af0
test eax, eax
jle 0x1400b03bc
mov qword [rsp + 0x8d0], rbx
nop dword [rax]
nop word [rax + rax]
lea r8, [rsp + 0x280]
mov r9d, 0x3b
mov edx, ebp
mov rcx, r14
mov dword [rsp + 0x20], 0x104
call fcn.1400ec2b0
lea rcx, [rsp + 0x280]
or rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400b02d0
test rax, rax
je 0x1400b039d
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x280]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400b039d
cmp word [rsp + 0x5c], 0x2e
je 0x1400b037e
test byte [rsp + 0x30], 0x10
jne 0x1400b037e
lea rdx, [rsp + 0x490]
mov rcx, rdi
sub rdx, rdi
movzx eax, word [rcx]
lea rcx, [rcx + 2]
mov word [rdx + rcx - 2], ax
test ax, ax
jne 0x1400b0320
lea rax, [rsp + 0x490]
sub rax, 2
nop dword [rax]
cmp word [rax + 2], 0
lea rax, [rax + 2]
jne 0x1400b0340
lea r8, [rsp + 0x5c]
xor edx, edx
movzx ecx, word [r8 + rdx*2]
lea rdx, [rdx + 1]
mov word [rax + rdx*2 - 2], cx
test cx, cx
jne 0x1400b0352
lea r9, [rsp + 0x490]
xor r8d, r8d
mov edx, 0x180
mov rcx, rsi
call qword [sym.imp.USER32.dll_SendMessageW]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1400b0303
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
mov edx, 0x3b
mov rcx, r14
inc ebp
call fcn.1400e8af0
cmp ebp, eax
jl 0x1400b02a0
mov rbx, qword [rsp + 0x8d0]
mov rcx, qword [rsp + 0x8a0]
xor rcx, rsp
call fcn.1400f9a80
mov rbp, qword [rsp + 0x8e8]
add rsp, 0x8b0
pop r14
pop rdi
pop rsi
ret