joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140028c20
Capabilities:
Create new key via cryptacquirecontext
Encode data using xor
Generate random numbers via winapi

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x30
xor edi, edi
mov rbp, rcx
mov rsi, rdx
lea rcx, [rax + 0x18]
lea r9d, [rdi + 1]
xor r8d, r8d
xor edx, edx
mov qword [rax + 0x18], rdi
mov dword [rax - 0x28], 0xf0000040
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
cmp eax, edi
je 0x140028c80
mov rcx, qword [rsp + 0x60]
mov r8, rbp
mov edx, esi
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
mov rcx, qword [rsp + 0x60]
cmp eax, 1
sete bl
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
cmp bl, dil
jne 0x140028ce2
lea rcx, [rsp + 0x68]
call fcn.140083b0c
lea rcx, [rsp + 0x68]
call fcn.140083a70
lea rcx, [rsp + 0x68]
call fcn.140083a68
mov rbx, rax
call fcn.1400c7b74
movsxd rcx, eax
add rbx, rcx
cmp rsi, rdi
jbe 0x140028ce2
mov r8d, dword [0x14010f3a0]
mov cl, dil
mov rdx, rbx
and cl, 7
shl cl, 3
shr rdx, cl
xor dl, dil
add dl, r8b
inc r8d
mov byte [rdi + rbp], dl
inc rdi
cmp rdi, rsi
jb 0x140028cb8
mov dword [0x14010f3a0], r8d
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret

Function at 0x140028cf0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x20
mov ebx, dword [rcx + 0xbec]
mov r11d, dword [rcx + 0xbf0]
mov esi, dword [rdx + 8]
mov ebp, dword [rdx + 0xc]
xor r11d, dword [rdx + 4]
xor esi, dword [rcx + 0xbf4]
xor ebp, dword [rcx + 0xbf8]
mov edi, ebx
mov r9, rdx
xor edi, dword [rdx]
xor r13d, r13d
mov r10, rcx
lea r14d, [r13 + 0x20]
mov rax, r13
mov edx, ebp
inc r13
and eax, 3
rol edx, 0xb
mov r8d, dword [r10 + rax*4 + 0xbec]
add edx, esi
xor edx, r8d
mov eax, edx
shr eax, 0x10
movzx eax, al
movzx r12d, byte [rax + r10 + 0xaec]
mov eax, edx
shr eax, 0x18
movzx ecx, byte [rax + r10 + 0xaec]
mov eax, edx
shr eax, 8
shl ecx, 8
movzx eax, al
or r12d, ecx
movzx ecx, dl
movzx eax, byte [rax + r10 + 0xaec]
shl r12d, 8
mov edx, esi
or r12d, eax
movzx eax, byte [rcx + r10 + 0xaec]
shl r12d, 8
or r12d, eax
xor r12d, edi
ror edx, 0xf
mov edi, esi
xor edx, ebp
mov esi, r12d
add edx, r8d
mov eax, edx
shr eax, 0x10
movzx eax, al
movzx r8d, byte [rax + r10 + 0xaec]
mov eax, edx
shr eax, 0x18
movzx ecx, byte [rax + r10 + 0xaec]
mov eax, edx
shr eax, 8
shl ecx, 8
or r8d, ecx
movzx eax, al
movzx ecx, dl
movzx eax, byte [rax + r10 + 0xaec]
shl r8d, 8
or r8d, eax
movzx eax, byte [rcx + r10 + 0xaec]
shl r8d, 8
or r8d, eax
xor r8d, r11d
sub r14, 1
mov r11d, ebp
mov ebp, r8d
jne 0x140028d41
xor ebx, r12d
mov rdx, r9
mov rcx, r10
mov dword [r9], ebx
mov eax, dword [r10 + 0xbf0]
xor eax, r8d
mov dword [r9 + 4], eax
mov eax, dword [r10 + 0xbf4]
xor eax, edi
mov dword [r9 + 8], eax
xor r11d, dword [r10 + 0xbf8]
mov dword [r9 + 0xc], r11d
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop r13
pop r12
jmp fcn.1400280dc
Function at 0x140028e78
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov rax, qword [0x1401006f0]
xor rax, rsp
mov qword [rsp + 0x30], rax
movdqu xmm0, xmmword [rdx]
mov ebx, dword [rcx + 0xbec]
mov edi, dword [rdx]
mov r11d, dword [rcx + 0xbf0]
mov esi, dword [rdx + 8]
mov ebp, dword [rdx + 0xc]
movdqu xmmword [rsp + 0x20], xmm0
xor r11d, dword [rdx + 4]
xor esi, dword [rcx + 0xbf4]
mov r12d, 0x1f
xor edi, ebx
xor ebp, dword [rcx + 0xbf8]
mov r9, rdx
mov r10, rcx
mov r14, r12
mov rax, r14
mov edx, ebp
dec r14
and eax, 3
rol edx, 0xb
mov r8d, dword [r10 + rax*4 + 0xbec]
add edx, esi
xor edx, r8d
mov eax, edx
shr eax, 0x10
movzx eax, al
movzx r13d, byte [rax + r10 + 0xaec]
mov eax, edx
shr eax, 0x18
movzx ecx, byte [rax + r10 + 0xaec]
mov eax, edx
shr eax, 8
shl ecx, 8
movzx eax, al
or r13d, ecx
movzx ecx, dl
movzx eax, byte [rax + r10 + 0xaec]
shl r13d, 8
mov edx, esi
or r13d, eax
movzx eax, byte [rcx + r10 + 0xaec]
shl r13d, 8
or r13d, eax
xor r13d, edi
ror edx, 0xf
mov edi, esi
xor edx, ebp
mov esi, r13d
add edx, r8d
mov eax, edx
shr eax, 0x10
movzx eax, al
movzx r8d, byte [rax + r10 + 0xaec]
mov eax, edx
shr eax, 0x18
movzx ecx, byte [rax + r10 + 0xaec]
mov eax, edx
shr eax, 8
shl ecx, 8
or r8d, ecx
movzx eax, al
movzx ecx, dl
movzx eax, byte [rax + r10 + 0xaec]
shl r8d, 8
or r8d, eax
movzx eax, byte [rcx + r10 + 0xaec]
shl r8d, 8
or r8d, eax
xor r8d, r11d
sub r12d, 1
mov r11d, ebp
mov ebp, r8d
jns 0x140028edd
xor ebx, r13d
lea rdx, [rsp + 0x20]
mov rcx, r10
mov dword [r9], ebx
mov eax, dword [r10 + 0xbf0]
xor eax, r8d
mov dword [r9 + 4], eax
mov eax, dword [r10 + 0xbf4]
xor eax, edi
mov dword [r9 + 8], eax
xor r11d, dword [r10 + 0xbf8]
mov dword [r9 + 0xc], r11d
call fcn.1400280dc
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400c6350
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x14002901c
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x1401006f0]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp dword [rcx], 2
mov rdi, rdx
mov rbx, rcx
mov esi, 0x20
jne 0x1400290b4
mov edx, dword [rcx + 4]
lea r9d, [rsi - 0x1c]
lea r8, [r11 - 0x38]
mov eax, edx
mov byte [rsp + 0x30], dl
mov rcx, rdi
shr eax, 8
mov byte [rsp + 0x31], al
mov eax, edx
shr edx, 0x18
shr eax, 0x10
mov byte [rsp + 0x33], dl
mov rdx, rsi
mov byte [rsp + 0x32], al
lea rax, [r11 - 0x30]
mov qword [r11 - 0x48], rax
call fcn.1400284c8
xor r11d, r11d
mov dword [rbx + 4], r11d
mov edx, r11d
lea r8, [rsp + 0x38]
movzx eax, byte [r8]
mov ecx, r11d
inc r11d
and ecx, 3
inc r8
shl ecx, 3
shl eax, cl
xor edx, eax
cmp r11d, esi
jb 0x140029095
mov dword [rbx + 4], edx
cmp dword [rbx], 3
jne 0x1400290e6
lea rax, [rsp + 0x38]
lea r8, [rbx + 4]
mov r9, rsi
mov rdx, rsi
mov rcx, rdi
mov qword [rsp + 0x20], rax
call fcn.1400284c8
lea rcx, [rbx + 4]
lea rdx, [rsp + 0x38]
mov r8, rsi
call fcn.1400c6bb0
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400c6350
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14002df04
Capabilities:
Check mutex on windows
Log keystrokes via polling

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
cmp dword [0x140149a04], 0
jne 0x14002e0b9
lea r8, str.WinRAR_DragDrop
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov rdi, rax
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x14002df6d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x5b9
call fcn.140076080
mov rcx, rax
call fcn.1400b189c
jmp 0x14002e0b9
mov ebx, 0x10
mov ecx, ebx
call qword [sym.imp.USER32.dll_GetKeyState]
mov r11w, ax
shr r11d, 0xf
and r11b, 1
mov byte [0x140131329], r11b
jne 0x14002df9d
cmp byte [0x140148965], 0
jne 0x14002df9d
xor sil, sil
jmp 0x14002dfa0
mov sil, 1
mov rcx, rbx
call fcn.1400c78c8
mov rbx, rax
mov qword [rsp + 0x58], rax
test rax, rax
je 0x14002dfc8
lea rax, [0x1400e28f0]
mov qword [rbx], rax
mov dword [rbx + 8], 1
jmp 0x14002dfca
xor ebx, ebx
mov ecx, 0xd800
call fcn.1400c78c8
mov qword [rsp + 0x58], rax
test rax, rax
je 0x14002dff1
xor r8d, r8d
mov dl, sil
mov rcx, rax
call fcn.14002dc2c
mov rbp, rax
jmp 0x14002dff3
xor ebp, ebp
mov byte [0x14013132a], 0
mov byte [0x14013132b], 1
mov byte [0x140131328], 0
neg sil
sbb r8d, r8d
and r8d, 2
inc r8d
lea r9, [rsp + 0x50]
mov rdx, rbx
mov rcx, rbp
call qword [sym.imp.ole32.dll_DoDragDrop]
mov esi, eax
mov byte [0x14013132b], 0
mov rdx, qword [rbp]
mov rcx, rbp
call qword [rdx + 0x10]
mov r11, qword [rbx]
mov rcx, rbx
call qword [r11 + 0x10]
mov ebx, 0x40100
cmp byte [0x140131329], 0
je 0x14002e06f
cmp byte [0x140148965], 0
je 0x14002e06f
cmp esi, ebx
jne 0x14002e06f
call fcn.1400abf54
lea rcx, [0x140155380]
call fcn.140051918
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, ebx
je 0x14002e0b9
cmp byte [0x140131328], 0
jne 0x14002e0b9
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3f0
je 0x14002e0b9
mov ecx, 0x53c
call fcn.140076080
mov rcx, rax
call fcn.1400b189c
lea rcx, [0x140134b90]
call fcn.1400330fc
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
Function at 0x14002ea38
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
movsxd r9, dword [rdx]
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
cmp r9d, dword [r8]
jbe 0x14002eaa7
mov r8d, 1
cmp dword [rbx], r8d
jb 0x14002ea88
mov rcx, rdi
mov r9, rsi
lea rdx, [rbx + 4]
sub rcx, rbx
sub r9, rbx
mov eax, dword [rcx + rdx]
inc r8d
xor eax, dword [rdx]
mov dword [r9 + rdx], eax
add rdx, 4
cmp r8d, dword [rbx]
jbe 0x14002ea73
mov ecx, r8d
mov r8d, dword [rdi]
sub r8d, dword [rbx]
lea rdx, [rdi + rcx*4]
lea rcx, [rsi + rcx*4]
shl r8, 2
call fcn.1400c6bb0
mov r11d, dword [rdi]
jmp 0x14002eaf3
jae 0x14002eaf8
mov edx, 1
cmp r9d, edx
jb 0x14002ead7
lea rcx, [r8 + 4]
mov r8, rdi
mov r9, rsi
sub r8, rbx
sub r9, rbx
mov eax, dword [rcx + r8]
inc edx
xor eax, dword [rcx]
mov dword [rcx + r9], eax
add rcx, 4
cmp edx, dword [rdi]
jbe 0x14002eac3
mov r8d, dword [rbx]
mov ecx, edx
sub r8d, dword [rdi]
lea rdx, [rbx + rcx*4]
lea rcx, [rsi + rcx*4]
shl r8, 2
call fcn.1400c6bb0
mov r11d, dword [rbx]
mov dword [rsi], r11d
jmp 0x14002eb3e
or r8d, 0xffffffff
test r9d, r9d
je 0x14002eb18
lea rcx, [rbx + r9*4]
sub rdx, rbx
mov eax, dword [rcx + rdx]
xor eax, dword [rcx]
jne 0x14002eb18
sub rcx, 4
add r9d, r8d
jne 0x14002eb08
mov dword [rsi], r9d
movsxd rax, r9d
test r9d, r9d
je 0x14002eb3e
sub rdi, rbx
lea rcx, [rbx + rax*4]
sub rsi, rbx
mov eax, dword [rcx + rdi]
xor eax, dword [rcx]
mov dword [rcx + rsi], eax
sub rcx, 4
add r9d, r8d
jne 0x14002eb2d
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14002eb50
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x70
cmp dword [rdx], 0
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
je 0x14002ec6d
cmp dword [r8], 0
je 0x14002ec6d
movsxd r9, dword [r8]
mov rbp, qword [0x140131338]
test r9, r9
je 0x14002ebb0
lea rax, [rax - 0x58]
mov rdx, r8
sub rdx, rax
lea rax, [rdx + r9*4]
sub r9, 1
mov ecx, dword [rsp + rax + 0x20]
mov eax, dword [rbp + rcx*4]
mov dword [rsp + r9*4 + 0x24], eax
jne 0x14002eb99
xor edx, edx
mov r8d, 0x90
mov rcx, rbx
call fcn.1400c7170
movsxd r9, dword [rsi]
test r9, r9
je 0x14002ec20
mov r11, qword [0x140131330]
mov eax, dword [rsi + r9*4]
mov r10d, dword [rbp + rax*4]
cmp r10d, 0x7fff
je 0x14002ec1a
movsxd r8, dword [rdi]
test r8, r8
je 0x14002ec1a
mov eax, dword [rsp + r8*4 + 0x20]
cmp eax, 0x7fff
je 0x14002ec14
lea ecx, [rax + r10]
lea rdx, [r8 + r9]
cmp ecx, 0x7fff
lea eax, [rcx - 0x7fff]
cmovae ecx, eax
mov ecx, dword [r11 + rcx*4]
xor dword [rbx + rdx*4 - 4], ecx
sub r8, 1
jne 0x14002ebe9
sub r9, 1
jne 0x14002ebcf
mov eax, dword [rdi]
mov ecx, dword [rsi]
lea edx, [rcx + rax - 1]
movsxd rax, edx
mov dword [rbx], edx
cmp rax, 0x11
jle 0x14002ec52
lea rcx, [rbx + rax*4 - 0x38]
lea rdx, [rax - 0x11]
mov eax, dword [rcx + 0x38]
and dword [rcx + 0x38], 0
xor dword [rcx - 0xc], eax
xor dword [rcx], eax
sub rcx, 4
sub rdx, 1
jne 0x14002ec3c
cmp dword [rbx], 0x11
jbe 0x14002ec70
mov dword [rbx], 0x11
mov eax, dword [rbx]
cmp dword [rbx + rax*4], 0
jne 0x14002ec70
dec eax
mov dword [rbx], eax
jne 0x14002ec5d
jmp 0x14002ec70
and dword [rcx], 0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x14002ec88
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
cmp dword [rdx], 0
mov r9, rdx
mov r8, rcx
je 0x14002ed76
movsxd rdx, dword [rdx]
mov r11, qword [0x140131338]
mov rbx, qword [0x140131330]
mov eax, dword [r9 + rdx*4]
mov esi, 0x7fff
mov ecx, dword [r11 + rax*4]
cmp ecx, esi
je 0x14002ecda
add ecx, ecx
cmp ecx, esi
lea eax, [rcx - 0x7fff]
cmovae ecx, eax
mov ecx, dword [rbx + rcx*4]
mov dword [r8 + rdx*8 - 4], ecx
jmp 0x14002ece0
and dword [r8 + rdx*8 - 4], 0
mov eax, dword [r9]
sub eax, 1
movsxd rdx, eax
je 0x14002ed24
lea r10, [r8 + rdx*8 - 4]
and dword [r8 + rdx*8], 0
mov eax, dword [r9 + rdx*4]
mov ecx, dword [r11 + rax*4]
cmp ecx, esi
je 0x14002ed16
add ecx, ecx
cmp ecx, esi
lea eax, [rcx - 0x7fff]
cmovae ecx, eax
mov ecx, dword [rbx + rcx*4]
mov dword [r10], ecx
jmp 0x14002ed1a
and dword [r10], 0
sub r10, 8
sub rdx, 1
jne 0x14002ecf0
mov eax, dword [r9]
lea eax, [rax + rax - 1]
movsxd rdx, eax
mov dword [r8], eax
cmp rdx, 0x11
jle 0x14002ed56
lea rcx, [r8 + rdx*4 - 0x38]
add rdx, 0xffffffffffffffef
mov eax, dword [rcx + 0x38]
and dword [rcx + 0x38], 0
xor dword [rcx - 0xc], eax
xor dword [rcx], eax
sub rcx, 4
sub rdx, 1
jne 0x14002ed40
cmp dword [r8], 0x11
jbe 0x14002ed79
mov dword [r8], 0x11
mov eax, dword [r8]
cmp dword [r8 + rax*4], 0
jne 0x14002ed79
dec eax
mov dword [r8], eax
jne 0x14002ed63
jmp 0x14002ed79
and dword [rcx], 0
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
ret
Function at 0x140030a44
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rbx, r9
mov rsi, r8
xor r9d, r9d
mov qword [rcx], rbx
movzx eax, word [rsi]
mov r8, rdx
mov r10, rcx
mov rdx, r9
mov r15b, 1
mov ecx, r9d
jmp 0x140030a90
mov edi, 0xff
cmp ax, di
ja 0x140030a98
inc ecx
inc rdx
mov ax, word [rsi + rdx*2]
cmp ax, r9w
jne 0x140030a7d
jmp 0x140030aa0
movsxd rax, ecx
mov r15b, byte [rsi + rax*2 + 1]
mov rax, qword [r10 + 0x18]
or rcx, 0xffffffffffffffff
mov rdi, r8
mov byte [rbx + rax], r15b
mov rax, qword [r10 + 0x18]
mov r11, r9
inc rax
mov qword [r10 + 0x10], rax
inc rax
mov qword [r10 + 0x18], rax
xor eax, eax
repne scasb al, byte [rdi]
not rcx
dec rcx
mov rax, rcx
mov qword [rsp + 0x60], rcx
cmp word [rsi], r9w
je 0x140030c36
lea rdx, [rsi + r11*2]
mov r12b, byte [rdx + 1]
mov r14b, byte [rdx]
cmp r11, rax
jae 0x140030bd4
lea rbp, [r11 + r8]
mov edi, r9d
xor r13d, r13d
mov r9, rbp
mov r8, rdx
cmp word [r8], r13w
je 0x140030b27
movzx ecx, word [r8]
movsx eax, byte [r9]
cmp ecx, eax
jne 0x140030b27
inc edi
add r8, 2
inc r9
cmp edi, 0x81
jl 0x140030b04
cmp edi, 2
jl 0x140030b54
movsxd rax, edi
mov edx, 3
mov rcx, r10
add r11, rax
call fcn.140030864
mov rax, qword [r10 + 0x18]
sub dil, 2
mov byte [rbx + rax], dil
inc qword [r10 + 0x18]
jmp 0x140030c1e
mov r13b, r14b
sub r13b, byte [rbp]
xor r9d, r9d
mov edi, r9d
mov r8w, word [rdx]
cmp r8w, r9w
je 0x140030b9b
movzx ecx, r8w
shr cx, 8
cmp cl, r15b
jne 0x140030b9b
movsx ecx, byte [rbp]
movzx eax, r13b
add ecx, eax
xor ecx, r8d
cmp cl, r9b
jne 0x140030b9b
inc edi
inc rbp
add rdx, 2
cmp edi, 0x81
jl 0x140030b61
cmp edi, 2
jl 0x140030bd4
movsxd rax, edi
mov edx, 3
mov rcx, r10
add r11, rax
call fcn.140030864
mov rax, qword [r10 + 0x18]
sub dil, 2
or dil, 0x80
mov byte [rbx + rax], dil
inc qword [r10 + 0x18]
mov rax, qword [r10 + 0x18]
mov byte [rax + rbx], r13b
jmp 0x140030b4b
mov rcx, r10
cmp r12b, r9b
jne 0x140030bed
xor edx, edx
call fcn.140030864
mov rcx, qword [r10 + 0x18]
mov byte [rbx + rcx], r14b
jmp 0x140030c17
cmp r12b, r15b
jne 0x140030bf9
mov edx, 1
jmp 0x140030bde
mov edx, 2
call fcn.140030864
mov rcx, qword [r10 + 0x18]
mov byte [rbx + rcx], r14b
inc qword [r10 + 0x18]
mov rax, qword [r10 + 0x18]
mov byte [rax + rbx], r12b
inc qword [r10 + 0x18]
inc r11
mov r8, qword [rsp + 0x68]
mov rax, qword [rsp + 0x60]
xor r9d, r9d
cmp word [rsi + r11*2], r9w
jne 0x140030ae0
mov dl, byte [r10 + 8]
mov rax, qword [r10 + 0x10]
mov ecx, 8
sub ecx, dword [r10 + 0xc]
shl dl, cl
mov byte [rbx + rax], dl
mov rax, qword [r10 + 0x18]
mov rbx, qword [rsp + 0x70]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140030c98
Capabilities:
Get file system object information

Disassembly:
push rbx
mov eax, 0x1300
call fcn.1400d8110
sub rsp, rax
mov rax, qword [0x1401006f0]
xor rax, rsp
mov qword [rsp + 0x12f0], rax
mov qword [rcx], rdx
mov rbx, rcx
lea r8, [rsp + 0x30]
lea rcx, [0x1400e1dd8]
mov r9d, 0x2b8
xor edx, edx
mov dword [rsp + 0x20], 0x4001
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test rax, rax
jne 0x140030d1e
lea rcx, [rsp + 0x2f0]
xor r8d, r8d
mov edx, 0x800
call fcn.1400a1d3c
lea r8, [rsp + 0x30]
lea rcx, [rsp + 0x2f0]
mov r9d, 0x2b8
xor edx, edx
mov dword [rsp + 0x20], 0x4001
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov rcx, qword [rbx]
mov r9, rax
xor r8d, r8d
mov edx, 0x1109
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rsp + 0x12f0]
xor rcx, rsp
call fcn.1400c6350
add rsp, 0x1300
pop rbx
ret

Function at 0x140031180
Capabilities:
Get file system object information

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x300
mov rax, qword [0x1401006f0]
xor rax, rsp
mov qword [rsp + 0x2f0], rax
mov rbx, rdx
mov rdi, r8
lea r8, [rsp + 0x30]
mov r9d, 0x2b8
xor edx, edx
mov rcx, rbx
mov dword [rsp + 0x20], 0x4009
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov r11d, dword [rsp + 0x38]
lea r8, [rsp + 0x30]
mov r9d, 0x2b8
xor edx, edx
mov rcx, rbx
mov dword [rdi + 0x24], r11d
mov dword [rsp + 0x20], 0x400b
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov r11d, dword [rsp + 0x38]
mov dword [rdi + 0x28], r11d
mov rcx, qword [rsp + 0x2f0]
xor rcx, rsp
call fcn.1400c6350
mov rbx, qword [rsp + 0x310]
add rsp, 0x300
pop rdi
ret
Function at 0x1400325d0
Capabilities:
Delete file
Log keystrokes via polling
Move file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x20b0
call fcn.1400d8110
sub rsp, rax
mov rax, qword [0x1401006f0]
xor rax, rsp
mov qword [rsp + 0x20a0], rax
xor r9d, r9d
mov rsi, rcx
mov rcx, qword [rcx]
lea r8d, [r9 + 9]
mov edx, 0x110a
call qword [sym.imp.USER32.dll_SendMessageW]
xor ebp, ebp
cmp rax, rbp
je 0x14003270c
mov rcx, qword [rsi]
lea r9, [rsp + 0x58]
xor r8d, r8d
mov edx, 0x113e
mov dword [rsp + 0x58], 4
mov qword [rsp + 0x60], rax
call qword [sym.imp.USER32.dll_SendMessageW]
cmp eax, ebp
je 0x14003270c
mov rcx, qword [rsp + 0x88]
cmp rcx, rbp
je 0x14003270c
mov rcx, qword [rcx + 0x10]
lea rdx, [rsp + 0x90]
call qword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
cmp eax, ebp
je 0x14003270c
lea ecx, [rbp + 0x10]
call qword [sym.imp.USER32.dll_GetKeyState]
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x1090]
mov bx, ax
mov r8d, 0x800
shr ebx, 0xf
not bl
and bl, 1
call fcn.1400805a0
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x1090]
lea r8d, [rbp + 0x38]
repne scasw ax, word [rdi]
xor edx, edx
not rcx
mov word [rsp + rcx*2 + 0x1090], bp
lea rcx, [rsp + 0x20]
call fcn.1400c7170
neg bl
lea rcx, [rsp + 0x20]
sbb ax, ax
mov dword [rsp + 0x28], 3
and ax, 0x40
mov word [rsp + 0x40], ax
lea rax, [rsp + 0x1090]
mov qword [rsp + 0x30], rax
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
mov dl, byte [rsi + 0x10]
mov rcx, rsi
call fcn.1400324dc
mov rcx, qword [rsp + 0x20a0]
xor rcx, rsp
call fcn.1400c6350
lea r11, [rsp + 0x20b0]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140032f58
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x1030
call fcn.1400d8110
sub rsp, rax
mov rax, qword [0x1401006f0]
xor rax, rsp
mov qword [rsp + 0x1020], rax
mov rsi, rdx
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
jne 0x140032ff9
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
lea rbx, [rcx - 1]
mov rcx, rsi
call fcn.140061f20
test al, al
jne 0x140032fd3
lea rdx, [rsp + 0x20]
mov ecx, 0x800
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x20]
repne scasw ax, word [rdi]
not rcx
add rbx, rcx
mov edi, 0x104
cmp rbx, rdi
jbe 0x140032ff9
mov ecx, 0x564
call fcn.140076080
lea rcx, [0x1400e2df0]
mov r8d, edi
mov rdx, rax
call fcn.1400b1ef4
mov rcx, qword [rsp + 0x1020]
xor rcx, rsp
call fcn.1400c6350
lea r11, [rsp + 0x1030]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x14003a710
Capabilities:
Move file

Disassembly:
push rsi
push rdi
push r12
mov eax, 0x5070
call fcn.1400d8110
sub rsp, rax
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x5098], rbx
mov qword [rsp + 0x50a0], rbp
mov rax, qword [0x1401006f0]
xor rax, rsp
mov qword [rsp + 0x5060], rax
mov rbx, rcx
mov r12d, 0x800
mov r8d, r12d
lea rdx, [rsp + 0x4060]
call qword [sym.imp.KERNEL32.dll_GetLongPathNameW]
xor ebp, ebp
cmp eax, ebp
je 0x14003a935
cmp eax, r12d
jae 0x14003a935
mov r8d, r12d
lea rdx, [rsp + 0x3060]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetShortPathNameW]
cmp eax, ebp
je 0x14003a931
cmp eax, r12d
jae 0x14003a931
lea rcx, [rsp + 0x4060]
call fcn.1400615e8
mov rsi, rax
lea rcx, [rsp + 0x3060]
call fcn.1400615e8
mov rdi, rax
cmp word [rax], bp
je 0x14003a92d
mov rdx, rax
mov rcx, rsi
call fcn.1400883c8
cmp eax, ebp
je 0x14003a92d
mov rcx, rbx
call fcn.1400615e8
mov rcx, rax
mov rdx, rdi
call fcn.1400883c8
cmp eax, ebp
jne 0x14003a92d
mov ax, bp
mov word [rsp + 0x1060], ax
mov edi, ebp
cmp ax, bp
jne 0x14003a87a
mov r8, r12
mov rdx, rbx
lea rcx, [rsp + 0x1060]
call fcn.1400805a0
lea rcx, [rsp + 0x1060]
call fcn.1400615e8
mov rcx, rax
mov r9d, edi
lea r8, str.rtmp_d
mov rdx, r12
call fcn.140022b7c
lea rcx, [rsp + 0x1060]
call fcn.14003c3d4
cmp al, bpl
je 0x14003a85b
mov eax, ebp
mov word [rsp + 0x1060], ax
jmp 0x14003a863
mov ax, word [rsp + 0x1060]
add edi, 0x7b
cmp edi, 0x2710
jl 0x14003a803
cmp ax, bp
jne 0x14003a87a
xor al, al
jmp 0x14003a937
mov r8, r12
mov rdx, rbx
lea rcx, [rsp + 0x2060]
call fcn.1400805a0
mov r8, r12
mov rdx, rsi
lea rcx, [rsp + 0x2060]
call fcn.1400617d0
lea rdx, [rsp + 0x1060]
lea rcx, [rsp + 0x2060]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
cmp eax, ebp
jne 0x14003a8be
xor al, al
jmp 0x14003a937
lea rcx, [rsp + 0x30]
call fcn.14003abdc
nop
mov dil, bpl
mov rcx, rbx
call fcn.14003c3d4
cmp al, bpl
jne 0x14003a8ef
mov r8d, 9
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.14003adb8
mov dil, al
lea rdx, [rsp + 0x2060]
lea rcx, [rsp + 0x1060]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
cmp dil, bpl
je 0x14003a91f
lea rcx, [rsp + 0x30]
call fcn.14003af08
lea rcx, [rsp + 0x30]
call fcn.14003af70
nop
lea rcx, [rsp + 0x30]
call fcn.14003b320
mov al, 1
jmp 0x14003a937
xor al, al
jmp 0x14003a937
xor al, al
jmp 0x14003a937
xor al, al
mov rcx, qword [rsp + 0x5060]
xor rcx, rsp
call fcn.1400c6350
lea r11, [rsp + 0x5070]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret