joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400d3f00
Capabilities:
Delete directory
Delete file

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x250
mov rax, qword [0x140209b48]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbx, rcx
lea rcx, [rsp + 0x20]
mov edi, edx
call fcn.1400012c0
lea rcx, [rsp + 0x20]
mov rdx, rbx
call fcn.14017be00
test edi, edi
mov rcx, qword [rsp + 0x28]
je 0x1400d3f4c
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x1400d3f52
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rsp + 0x20]
mov ebx, eax
call fcn.140175010
mov eax, ebx
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1401a6ae0
mov rbx, qword [rsp + 0x268]
add rsp, 0x250
pop rdi
ret

Function at 0x1400d3f90
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x30
lea r9, [rsp + 0x58]
mov ebx, r8d
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1400d3fc2
cmp dword [rsp + 0x58], ebx
jne 0x1400d3fc2
mov eax, 1
add rsp, 0x30
pop rbx
ret
xor eax, eax
add rsp, 0x30
pop rbx
ret

Function at 0x1400d3fd0
Capabilities:
Check if file exists

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x278
mov rax, qword [0x140209b48]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rbp, rcx
lea rcx, [rsp + 0x40]
mov ebx, r9d
mov esi, r8d
mov edi, edx
call fcn.1400012c0
lea rcx, [rsp + 0x40]
mov rdx, rbp
call fcn.14017be00
mov eax, dword [rsp + 0x2c0]
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], eax
xor r9d, r9d
mov r8d, esi
mov edx, edi
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
lea rcx, [rsp + 0x40]
mov rbx, rax
call fcn.140175010
cmp rbx, 0xffffffffffffffff
jne 0x1400d4070
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x1400d4070
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.CreateFileW__:__d:_Failed_to_open_file__s_n
mov r8, rbp
mov edx, eax
call fcn.1400b35e0
mov rax, rbx
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1401a6ae0
add rsp, 0x278
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400d4090
Capabilities:
Delete directory
Delete file
Move file

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x470
mov rax, qword [0x140209b48]
xor rax, rsp
mov qword [rsp + 0x460], rax
mov rsi, rcx
lea rcx, [rsp + 0x240]
mov edi, r9d
mov r12d, r8d
mov rbp, rdx
call fcn.1400012c0
lea rcx, [rsp + 0x20]
call fcn.1400012c0
lea rcx, [rsp + 0x240]
mov rdx, rsi
call fcn.14017be00
lea rcx, [rsp + 0x20]
mov rdx, rbp
call fcn.14017be00
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x248]
xor ebx, ebx
test r12d, r12d
mov r8d, ebx
setne r8b
or r8d, 2
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x1400d4187
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
je 0x1400d4138
lea rcx, str.MoveFileExW__:_GetLastError__:__d:_Failed_to_move_file_from__s_to__s_n
mov r9, rbp
mov r8, rsi
mov edx, eax
call fcn.1400b35e0
jmp 0x1400d41b0
test r12d, r12d
je 0x1400d4154
test edi, edi
mov rcx, qword [rsp + 0x28]
je 0x1400d414e
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x1400d4154
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x248]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x1400d4187
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.MoveFileW__:_GetLastError__:__d:_Failed_to_move_file_from__s_to__s_n
mov r9, rbp
mov edx, eax
mov r8, rsi
call fcn.1400b35e0
jmp 0x1400d41b0
mov r9, qword [rsp + 0x28]
mov r8, qword [rsp + 0x248]
mov ecx, 1
mov eax, 0x20000
test edi, edi
mov ebx, ecx
cmovne ecx, eax
mov edx, 5
call qword [sym.imp.SHELL32.dll_SHChangeNotify]
lea rcx, [rsp + 0x20]
call fcn.140175010
lea rcx, [rsp + 0x240]
call fcn.140175010
mov eax, ebx
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.1401a6ae0
add rsp, 0x470
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x1400d41f0
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x270
mov rax, qword [0x140209b48]
xor rax, rsp
mov qword [rsp + 0x260], rax
cmp byte [0x14020b0f0], 0
mov rsi, rcx
mov eax, 7
lea rcx, [rsp + 0x40]
mov ebx, 3
mov edi, edx
cmovne ebx, eax
call fcn.1400012c0
lea rcx, [rsp + 0x40]
mov rdx, rsi
call fcn.14017be00
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x30], 0
neg edi
mov r8d, ebx
mov edx, 0x80000000
sbb eax, eax
xor r9d, r9d
and eax, 0x8000000
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
lea rcx, [rsp + 0x40]
mov rbx, rax
call fcn.140175010
cmp rbx, 0xffffffffffffffff
jne 0x1400d42ad
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x1400d42ad
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.CreateFileW__:__d:_Failed_to_open_file__s_n
mov r8, rsi
mov edx, eax
call fcn.1400b35e0
mov rax, rbx
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1401a6ae0
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1400d42e0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push rbx
sub rsp, 0x250
mov rax, qword [0x140209b48]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbx, rcx
lea rcx, [rsp + 0x20]
call fcn.1400012c0
mov rcx, rbx
call fcn.14016c050
test eax, eax
je 0x1400d4393
lea rcx, [rsp + 0x20]
mov r8d, eax
mov rdx, rbx
call fcn.14017bc00
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400d4338
test al, 0x10
jne 0x1400d4393
mov rbx, qword [rsp + 0x28]
cmp word [rbx], 0
je 0x1400d4388
movzx eax, word [rbx]
cmp ax, 0x5c
je 0x1400d435c
cmp ax, 0x2f
je 0x1400d435c
add rbx, 2
cmp word [rbx], 0
jne 0x1400d4343
cmp word [rbx], 0
je 0x1400d4383
mov word [rbx], 0
mov rcx, qword [rsp + 0x28]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov word [rbx], 0x5c
add rbx, 2
cmp word [rbx], 0
jne 0x1400d4343
mov rbx, qword [rsp + 0x28]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea rcx, [rsp + 0x20]
call fcn.140175010
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1401a6ae0
add rsp, 0x250
pop rbx
ret

Function at 0x1400d5990
Capabilities:
Get hostname

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x140209b48]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rbx, rcx
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
call fcn.140175fb0
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
je 0x1400d59d6
lea rdx, [rsp + 0x28]
mov rcx, rbx
call fcn.140175db0
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1401a6ae0
add rsp, 0x50
pop rbx
ret

Function at 0x1400d59f0
Capabilities:
Get session user name

Disassembly:
push rbx
sub rsp, 0x250
mov rax, qword [0x140209b48]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbx, rcx
mov dword [rsp + 0x20], 0x101
call fcn.140175fb0
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x1400d5a3c
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.140175db0
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1401a6ae0
add rsp, 0x250
pop rbx
ret
Function at 0x1400d5b70
Capabilities:
Get disk information

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x690
mov rax, qword [0x140209b48]
xor rax, rsp
mov qword [rsp + 0x680], rax
mov rdi, qword [rsp + 0x6f0]
mov r12, qword [rsp + 0x6f8]
mov rbx, rcx
lea rcx, [rsp + 0x40]
mov rbp, r9
mov rsi, r8
mov r13, rdx
call fcn.1400012c0
lea rcx, [rsp + 0x40]
mov rdx, rbx
call fcn.14017bfd0
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
mov rcx, r12
lea r10, [rsp + 0x260]
neg rcx
mov r14d, eax
mov rcx, r13
sbb r11d, r11d
xor eax, eax
lea rdx, [rsp + 0x470]
and r11d, 0x104
test r12, r12
mov r9, rsi
cmove r10, rax
neg rcx
mov rcx, qword [rsp + 0x48]
mov dword [rsp + 0x38], r11d
sbb r8d, r8d
mov qword [rsp + 0x30], r10
and r8d, 0x104
test r13, r13
mov qword [rsp + 0x28], rdi
cmove rdx, rax
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
mov ebx, eax
jne 0x1400d5c4d
mov word [rsp + 0x470], ax
mov word [rsp + 0x260], ax
lea rcx, [rsp + 0x40]
call fcn.140175010
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
test r13, r13
je 0x1400d5c75
lea rdx, [rsp + 0x470]
mov rcx, r13
call fcn.140175db0
test r12, r12
je 0x1400d5c8a
lea rdx, [rsp + 0x260]
mov rcx, r12
call fcn.140175db0
mov eax, ebx
mov rcx, qword [rsp + 0x680]
xor rcx, rsp
call fcn.1401a6ae0
add rsp, 0x690
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x1400d6430
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rdx
add rdx, 4
call qword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov dword [rbx], eax
jne 0x1400d645c
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x1400d645c
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov eax, 1
add rsp, 0x20
pop rbx
ret

Function at 0x1400d6620
Capabilities:
Delete file

Disassembly:
push rbx
sub rsp, 0x250
mov rax, qword [0x140209b48]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbx, rcx
lea rcx, [rsp + 0x20]
call fcn.1400012c0
lea rcx, [rsp + 0x20]
mov rdx, rbx
call fcn.14017be00
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
mov ebx, eax
je 0x1400d667d
mov r8, qword [rsp + 0x28]
xor r9d, r9d
mov edx, 0x1005
lea ecx, [r9 + 4]
call qword [sym.imp.SHELL32.dll_SHChangeNotify]
lea rcx, [rsp + 0x20]
call fcn.140175010
mov eax, ebx
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1401a6ae0
add rsp, 0x250
pop rbx
ret

Function at 0x1400d66b0
Capabilities:
Delete directory

Disassembly:
push rbx
sub rsp, 0x250
mov rax, qword [0x140209b48]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbx, rcx
lea rcx, [rsp + 0x20]
call fcn.1400012c0
lea rcx, [rsp + 0x20]
mov rdx, rbx
call fcn.14017be00
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
mov ebx, eax
je 0x1400d670d
mov r8, qword [rsp + 0x28]
xor r9d, r9d
mov edx, 0x1005
lea ecx, [r9 + 4]
call qword [sym.imp.SHELL32.dll_SHChangeNotify]
lea rcx, [rsp + 0x20]
call fcn.140175010
mov eax, ebx
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1401a6ae0
add rsp, 0x250
pop rbx
ret
Function at 0x1400d6c30
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x250
mov rax, qword [0x140209b48]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbx, rcx
lea rcx, [rsp + 0x20]
mov rdi, rdx
call fcn.1400012c0
lea rcx, [rsp + 0x20]
mov rdx, rbx
call fcn.14017b470
mov rcx, qword [rsp + 0x28]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea rcx, [rsp + 0x20]
mov ebx, eax
call fcn.140175010
mov eax, ebx
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1401a6ae0
mov rbx, qword [rsp + 0x270]
add rsp, 0x250
pop rdi
ret

Function at 0x1400d6d50
Capabilities:
Get disk information

Disassembly:
push rbx
sub rsp, 0x250
mov rax, qword [0x140209b48]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbx, rcx
lea rcx, [rsp + 0x20]
call fcn.1400012c0
lea rcx, [rsp + 0x20]
mov rdx, rbx
call fcn.14017bfd0
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
lea rcx, [rsp + 0x20]
mov ebx, eax
call fcn.140175010
mov eax, ebx
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1401a6ae0
add rsp, 0x250
pop rbx
ret

Function at 0x1400d6fa0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x250
mov rax, qword [0x140209b48]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbx, rcx
lea rcx, [rsp + 0x20]
call fcn.1400012c0
lea rcx, [rsp + 0x20]
mov rdx, rbx
call fcn.14017be00
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea rcx, [rsp + 0x20]
mov ebx, eax
call fcn.140175010
cmp ebx, 0xffffffff
je 0x1400d6ffd
test bl, 0x10
jne 0x1400d6ffd
mov eax, 1
jmp 0x1400d6fff
xor eax, eax
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1401a6ae0
add rsp, 0x250
pop rbx
ret

Function at 0x1400d7020
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x250
mov rax, qword [0x140209b48]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbx, rcx
lea rcx, [rsp + 0x20]
call fcn.1400012c0
lea rcx, [rsp + 0x20]
mov rdx, rbx
call fcn.14017be00
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea rcx, [rsp + 0x20]
mov ebx, eax
call fcn.140175010
xor eax, eax
cmp ebx, 0xffffffff
setne al
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1401a6ae0
add rsp, 0x250
pop rbx
ret

Function at 0x1400d7090
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x250
mov rax, qword [0x140209b48]
xor rax, rsp
mov qword [rsp + 0x240], rax
cmp byte [rcx], 0
mov rbx, rcx
je 0x1400d70f2
lea rcx, [rsp + 0x20]
call fcn.1400012c0
lea rcx, [rsp + 0x20]
mov rdx, rbx
call fcn.14017c0f0
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea rcx, [rsp + 0x20]
mov ebx, eax
call fcn.140175010
cmp ebx, 0xffffffff
je 0x1400d70f2
test bl, 0x10
je 0x1400d70f2
mov eax, 1
jmp 0x1400d70f4
xor eax, eax
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1401a6ae0
add rsp, 0x250
pop rbx
ret
Function at 0x1400d7420
Capabilities:
Delete file

Disassembly:
mov r11, rsp
sub rsp, 0x68
xor eax, eax
neg r8d
mov qword [r11 - 0x48], rax
mov qword [r11 - 0x38], rax
mov qword [r11 - 0x30], rax
mov qword [r11 - 0x40], rax
mov qword [r11 - 0x28], rax
mov qword [r11 - 0x20], rax
mov qword [r11 - 0x18], rax
mov qword [r11 - 0x48], rcx
mov dword [rsp + 0x28], 3
mov qword [r11 - 0x30], rax
sbb ax, ax
mov qword [r11 - 0x38], rdx
and ax, 0x40
lea rcx, str.Enter_SHFileOperation_n
or ax, 0x4000
mov word [rsp + 0x40], ax
call fcn.1400b35e0
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
lea rcx, str.Leave_SHFileOperation_n
call fcn.1400b35e0
add rsp, 0x68
ret

Function at 0x1400d7680
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push rdi
sub rsp, 0x250
mov rax, qword [0x140209b48]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rdi, rdx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x1400d7791
mov qword [rsp + 0x270], rbx
call qword [sym.imp.USER32.dll_EmptyClipboard]
lea rcx, [rsp + 0x20]
call fcn.1400012c0
lea rcx, [rsp + 0x20]
mov rdx, rdi
call fcn.14017b470
mov edx, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
call fcn.140001000
mov ecx, 2
add eax, 1
movsxd rdx, eax
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
test rax, rax
mov rbx, rax
je 0x1400d772a
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov r8d, dword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
mov rcx, rax
call fcn.140001150
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rdx, rbx
mov ecx, 1
call qword [sym.imp.USER32.dll_SetClipboardData]
lea rcx, [rsp + 0x20]
call fcn.140175010
mov rcx, rdi
call fcn.14017ac40
mov ecx, 2
add eax, 1
movsxd rdx, eax
add rdx, rdx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
test rax, rax
mov rbx, rax
je 0x1400d7783
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rdx, rdi
mov rcx, rax
call fcn.14017a870
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rdx, rbx
mov ecx, reloc.WS2_32.dll_listen
call qword [sym.imp.USER32.dll_SetClipboardData]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rbx, qword [rsp + 0x270]
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1401a6ae0
add rsp, 0x250
pop rdi
ret
Function at 0x1400d7d50
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x690
mov rax, qword [0x140209b48]
xor rax, rsp
mov qword [rsp + 0x680], rax
mov rbx, rcx
lea rcx, [rsp + 0x40]
mov rbp, rdx
call fcn.1400012c0
lea rcx, [rsp + 0x40]
mov rdx, rbp
call fcn.14017bfd0
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
mov rcx, rbx
lea rdx, [rsp + 0x260]
neg rcx
mov rcx, qword [rsp + 0x48]
mov esi, eax
sbb r8d, r8d
xor eax, eax
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x30], rax
and r8d, 0x104
mov qword [rsp + 0x28], rax
test rbx, rbx
mov qword [rsp + 0x20], rax
cmove rdx, rax
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
mov edi, eax
jne 0x1400d7df3
mov word [rsp + 0x260], ax
mov word [rsp + 0x470], ax
lea rcx, [rsp + 0x40]
call fcn.140175010
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
test rbx, rbx
je 0x1400d7e1a
lea rdx, [rsp + 0x260]
mov rcx, rbx
call fcn.140175db0
test edi, edi
je 0x1400d7e27
mov rax, qword [rbx + 8]
cmp byte [rax], 0
jne 0x1400d7e92
lea rcx, [rsp + 0x40]
call fcn.1400012c0
lea rcx, [rsp + 0x40]
mov rdx, rbp
call fcn.14017bfd0
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
lea rcx, [rsp + 0x40]
mov edi, eax
call fcn.140175010
cmp edi, 3
je 0x1400d7e7c
cmp edi, 6
je 0x1400d7e7c
test edi, edi
mov rax, qword [0x1401fd5f8]
jne 0x1400d7e73
mov rdx, qword [rax + 0x32e0]
jmp 0x1400d7e8a
mov rdx, qword [rax + 0x378]
jmp 0x1400d7e8a
mov rax, qword [0x1401fd5f8]
mov rdx, qword [rax + 0x370]
mov rcx, rbx
call fcn.140175d10
mov rcx, qword [rsp + 0x680]
xor rcx, rsp
call fcn.1401a6ae0
mov rbx, qword [rsp + 0x6c0]
add rsp, 0x690
pop rdi
pop rsi
pop rbp
ret

Function at 0x1400d8260
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x250
mov rax, qword [0x140209b48]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rdi, rcx
lea rcx, [rsp + 0x20]
mov rbx, rdx
call fcn.1400012c0
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov r8d, dword [rsp + 0x24]
add eax, 1
cmp eax, r8d
jle 0x1400d82b6
lea rcx, [rsp + 0x20]
mov edx, eax
call fcn.14017b180
mov r8d, dword [rsp + 0x24]
mov rdx, qword [rsp + 0x28]
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov rcx, rbx
test eax, eax
je 0x1400d82d7
mov rdx, qword [rsp + 0x28]
call fcn.140175db0
jmp 0x1400d82dc
call fcn.140175fb0
lea rcx, [rsp + 0x20]
call fcn.140175010
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1401a6ae0
mov rbx, qword [rsp + 0x270]
add rsp, 0x250
pop rdi
ret
Function at 0x1400d8310
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x250
mov rax, qword [0x140209b48]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbx, r8
call qword [sym.imp.USER32.dll_GetDlgItem]
lea rcx, [rsp + 0x20]
mov rdi, rax
call fcn.1400012c0
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov r8d, dword [rsp + 0x24]
add eax, 1
cmp eax, r8d
jle 0x1400d836c
lea rcx, [rsp + 0x20]
mov edx, eax
call fcn.14017b180
mov r8d, dword [rsp + 0x24]
mov rdx, qword [rsp + 0x28]
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov rcx, rbx
test eax, eax
je 0x1400d838d
mov rdx, qword [rsp + 0x28]
call fcn.140175db0
jmp 0x1400d8392
call fcn.140175fb0
lea rcx, [rsp + 0x20]
call fcn.140175010
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1401a6ae0
mov rbx, qword [rsp + 0x278]
add rsp, 0x250
pop rdi
ret

Function at 0x1400d8530
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x250
mov rax, qword [0x140209b48]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rdi, rcx
lea r8, [rsp + 0x20]
xor ecx, ecx
xor ebx, ebx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
js 0x1400d8596
mov rcx, qword [rsp + 0x20]
lea rdx, [rsp + 0x30]
call qword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x1400d858b
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.140175db0
mov ebx, 1
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, ebx
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1401a6ae0
mov rbx, qword [rsp + 0x270]
add rsp, 0x250
pop rdi
ret

Function at 0x1400d9130
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
call qword [sym.imp.USER32.dll_GetKeyState]
xor ecx, ecx
test ax, ax
sets cl
mov eax, ecx
add rsp, 0x28
ret
Function at 0x1400d9290
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x250
mov rax, qword [0x140209b48]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rax, r8
mov rbp, rcx
mov r9d, edx
lea rcx, [rsp + 0x30]
mov edi, edx
xor esi, esi
mov qword [rsp + 0x20], rcx
or r9d, 8
xor r8d, r8d
mov rdx, rax
mov rcx, rbp
mov qword [rsp + 0x38], rax
mov ebx, esi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400d9396
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x40]
mov r9d, 0x100
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
lea ecx, [rsi + 1]
test eax, eax
jne 0x1400d9346
nop
nop
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x40]
mov edx, edi
call fcn.1400d9290
test eax, eax
je 0x1400d9348
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x40]
mov r9d, 0x100
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
je 0x1400d9310
mov ecx, 1
mov ebx, ecx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x1400d9396
mov r10, qword [0x14020b1f8]
mov rdx, qword [rsp + 0x38]
mov rcx, rbp
test r10, r10
je 0x1400d9382
or edi, 2
xor r9d, r9d
mov r8d, edi
call r10
test eax, eax
jne 0x1400d9392
mov eax, 1
jmp 0x1400d9398
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
mov eax, 1
cmove esi, eax
mov eax, esi
jmp 0x1400d9398
mov eax, ebx
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1401a6ae0
mov rbx, qword [rsp + 0x288]
add rsp, 0x250
pop rdi
pop rsi
pop rbp
ret

Function at 0x1400d93c0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x470
mov rax, qword [0x140209b48]
xor rax, rsp
mov qword [rsp + 0x460], rax
mov r13, rcx
lea rcx, [rsp + 0x40]
mov rbx, rdx
call fcn.1400012c0
lea rcx, [rsp + 0x40]
mov rdx, rbx
call fcn.14017b470
lea rdi, [0x1401cdaa8]
mov ebp, 3
nop
mov ebx, dword [rdi]
mov r12, qword [rsp + 0x48]
lea rax, [rsp + 0x30]
mov r9d, ebx
xor r8d, r8d
mov rdx, r12
mov rcx, r13
or r9d, 8
xor esi, esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400d94d0
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x260]
mov r9d, 0x100
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x1400d9497
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x260]
mov edx, ebx
call fcn.1400d9290
test eax, eax
je 0x1400d949c
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x260]
mov r9d, 0x100
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
je 0x1400d9460
mov esi, 1
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x1400d94d0
mov rax, qword [0x14020b1f8]
mov rdx, r12
mov rcx, r13
test rax, rax
je 0x1400d94ca
or ebx, 2
xor r9d, r9d
mov r8d, ebx
call rax
jmp 0x1400d94d0
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
add rdi, 4
sub rbp, 1
jne 0x1400d9410
lea rcx, [rsp + 0x40]
call fcn.140175010
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.1401a6ae0
mov rbx, qword [rsp + 0x4b0]
add rsp, 0x470
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret