joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140081b90
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x20
movzx ebx, cl
test cl, cl
jne 0x140081ba5
xor al, al
add rsp, 0x20
pop rbx
ret
sub edx, 1
je 0x140081bd0
mov ecx, ebx
cmp edx, 1
je 0x140081bc2
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and al, 1
add rsp, 0x20
pop rbx
ret
call qword [sym.imp.USER32.dll_GetKeyState]
and al, 1
add rsp, 0x20
pop rbx
ret
lea eax, [rbx - 1]
cmp al, 5
ja 0x140081bdc
cmp bl, 3
jne 0x140081be3
lea eax, [rbx + 0x66]
cmp al, 5
ja 0x140081c00
cmp qword [0x140115718], 0
jne 0x140081c22
mov ecx, ebx
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
and al, 1
add rsp, 0x20
pop rbx
ret
cmp qword [0x140115720], 0
je 0x140081bed
xor edx, edx
xor r8d, r8d
movzx ecx, bl
call fcn.14001a590
test al, al
je 0x140081c22
mov cl, 1
call fcn.14001a330
lea rcx, [0x140116560]
movzx eax, byte [rbx + rcx]
shr al, 7
add rsp, 0x20
pop rbx
ret

Function at 0x140082090
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x230
mov rdi, rdx
mov esi, ecx
mov r8d, ecx
xor r15d, r15d
mov word [rdx], r15w
mov ecx, 0x410
xor edx, edx
movzx ebx, r9b
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r14, rax
test rax, rax
jne 0x1400820ea
mov r8d, esi
xor edx, edx
mov ecx, 0x1000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r14, rax
test rax, rax
je 0x14008223d
xor edx, edx
mov qword [rsp + 0x250], rbp
mov r9d, 0x104
mov r8, rdi
mov rcx, r14
test bl, bl
je 0x14008210c
call qword [sym.imp.PSAPI.DLL_GetModuleBaseNameW]
jmp 0x140082112
call qword [sym.imp.PSAPI.DLL_GetModuleFileNameExW]
mov ebp, eax
test eax, eax
jne 0x14008222a
mov rax, qword [0x1400feee8]
test rax, rax
je 0x14008222a
mov r8d, 0x104
mov rdx, rdi
mov rcx, r14
call rax
mov ebp, eax
test eax, eax
je 0x14008222a
test bl, bl
je 0x140082184
mov edx, 0x5c
mov rcx, rdi
call qword [sym.imp.VCRUNTIME140.dll_wcsrchr]
test rax, rax
je 0x14008222a
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], r15w
jne 0x140082166
add r8, r8
lea rdx, [rax + 2]
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
jmp 0x14008222a
mov eax, 0x41
mov dword [rsp + 0x25a], 0x3a
mov word [rsp + 0x258], ax
nop dword [rax]
mov r8d, 0x104
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x258]
call qword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
mov ebx, eax
cmp eax, 2
jbe 0x1400821e3
add ebx, 0xfffffffe
lea rcx, [rsp + 0x20]
mov r8d, ebx
mov rdx, rdi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncmp]
test eax, eax
jne 0x1400821e3
cmp word [rdi + rbx*2], 0x5c
lea rdx, [rdi + rbx*2]
je 0x1400821fe
movzx eax, word [rsp + 0x258]
inc ax
mov word [rsp + 0x258], ax
cmp ax, 0x5a
jbe 0x1400821a0
jmp 0x14008222a
movzx eax, word [rsp + 0x258]
lea rcx, [rdi + 4]
mov word [rdi], ax
sub ebp, ebx
movzx eax, word [rsp + 0x25a]
mov word [rdi + 2], ax
lea r8d, [rbp + 1]
add r8, r8
call sub.VCRUNTIME140.dll_memmove
add ebp, 2
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebp
mov rbp, qword [rsp + 0x250]
lea r11, [rsp + 0x230]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x140085eb0
Capabilities:
Get keyboard layout

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x250
mov rbp, rcx
mov rbx, r9
xor ecx, ecx
mov r14, r8
mov rdi, rdx
xor sil, sil
call qword [sym.imp.ole32.dll_CoInitialize]
xor edx, edx
lea rax, [rsp + 0x30]
lea r9, [0x1400e04a0]
mov qword [rsp + 0x20], rax
lea rcx, [0x1400e04b0]
lea r8d, [rdx + 1]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x140086094
mov rcx, qword [rsp + 0x30]
mov rdx, rdi
mov rax, qword [rcx]
call qword [rax + 0xa0]
cmp word [rbx], 0
je 0x140085f35
mov rcx, qword [rsp + 0x30]
mov rdx, rbx
mov rax, qword [rcx]
call qword [rax + 0x48]
mov rdx, qword [rsp + 0x280]
cmp word [rdx], 0
je 0x140085f4e
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx]
call qword [rax + 0x58]
mov rdx, qword [rsp + 0x288]
cmp word [rdx], 0
je 0x140085f67
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx]
call qword [rax + gethostname]
mov rcx, qword [rsp + 0x2a0]
xor ebx, ebx
cmp word [rcx], bx
je 0x140085f80
call fcn.140014ec0
mov r8d, eax
jmp 0x140085f83
mov r8d, ebx
mov rdx, qword [rsp + 0x290]
cmp word [rdx], bx
je 0x140085fa7
mov rcx, qword [rsp + 0x30]
test r8d, r8d
setg bl
sub r8d, ebx
mov rax, qword [rcx]
call qword [rax + 0x88]
mov rbx, qword [rsp + 0x298]
cmp word [rbx], 0
je 0x140085fea
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
xor r8d, r8d
xor edx, edx
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.14001b0c0
test al, al
je 0x140085fea
mov rcx, qword [rsp + 0x30]
movzx edx, al
mov eax, 0x600
or dx, ax
mov r8, qword [rcx]
call qword [r8 + 0x68]
mov rcx, qword [rsp + 0x2a8]
cmp word [rcx], 0
je 0x140086012
mov rax, qword [rsp + 0x30]
mov rdx, qword [rax]
mov rbx, qword [rdx + 0x78]
call fcn.140014ec0
mov rcx, qword [rsp + 0x30]
mov edx, eax
call rbx
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x38]
lea rdx, [0x1400e04c0]
mov rax, qword [rcx]
call qword [rax]
test eax, eax
js 0x140086089
xor r9d, r9d
lea r8, [rsp + 0x40]
mov edx, 0x104
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
mov rcx, qword [rsp + 0x38]
lea rdx, [rsp + 0x40]
mov r8d, 1
mov rax, qword [rcx]
call qword [rax + 0x30]
test eax, eax
js 0x14008607e
mov rcx, qword [0x1401156c0]
lea rdx, [0x1400e0714]
xor r9d, r9d
mov byte [rsp + 0x20], 1
lea r8, [r9 - 1]
call fcn.1400c3f40
mov sil, 1
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rcx]
call qword [rdx + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rcx]
call qword [rdx + reloc.OLEAUT32.dll_SafeArrayGetDim]
call qword [sym.imp.ole32.dll_CoUninitialize]
test sil, sil
je 0x1400860a6
mov eax, 1
jmp 0x1400860e9
mov rax, qword [0x140112060]
lea rdx, [0x1400f5d6c]
test byte [rax + 0x140], 1
jne 0x1400860d7
mov rcx, qword [0x1401156c0]
xor r9d, r9d
mov byte [rsp + 0x20], 1
lea r8, [r9 - 1]
call fcn.1400c3f40
jmp 0x1400860e9
lea r9, [0x1400e0684]
xor r8d, r8d
mov rcx, rbp
call fcn.14004d4a0
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x140086110
Capabilities:
Delete file

Disassembly:
push rbx
sub rsp, 0x280
mov rax, rdx
mov rbx, rcx
test rdx, rdx
je 0x14008623c
cmp word [rdx], 0
je 0x14008623c
lea r9, [rsp + 0x298]
mov edx, 0x104
lea r8, [rsp + 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
lea rcx, [rsp + 0x70]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140086160
xor edx, edx
test rax, rax
je 0x14008617e
cmp word [rsp + rax*2 + 0x6e], 0x5c
jne 0x14008617e
mov word [rsp + rax*2 + 0x6e], dx
lea rcx, [rsp + 0x70]
mov rax, 0xffffffffffffffff
nop word [rax + rax]
cmp word [rcx + rax*2 + 2], dx
lea rax, [rax + 1]
jne 0x140086190
mov word [rsp + rax*2 + 0x72], dx
lea rcx, [rsp + 0x30]
lea rax, [rsp + 0x70]
mov dword [rsp + 0x54], edx
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
mov eax, 0x4054
mov qword [rsp + 0x30], rdx
mov word [rsp + 0x50], ax
movdqu xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x48], rdx
mov dword [rsp + 0x38], 3
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
jne 0x14008620a
mov rcx, qword [0x1401156c0]
lea rdx, [0x1400e0714]
xor r9d, r9d
mov byte [rsp + 0x20], 1
lea r8, [r9 - 1]
call fcn.1400c3f40
add rsp, 0x280
pop rbx
ret
mov rax, qword [0x140112060]
lea rdx, [0x1400f5d6c]
test byte [rax + 0x140], 1
je 0x140086253
mov rcx, rbx
lea r9, [0x1400e0684]
xor r8d, r8d
call fcn.14004d4a0
add rsp, 0x280
pop rbx
ret
mov rax, qword [0x140112060]
lea rdx, [0x1400f5d6c]
test byte [rax + 0x140], 1
jne 0x140086224
mov rcx, qword [0x1401156c0]
xor r9d, r9d
mov byte [rsp + 0x20], 1
lea r8, [r9 - 1]
call fcn.1400c3f40
add rsp, 0x280
pop rbx
ret

Function at 0x140086280
Capabilities:
Empty the recycle bin

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rcx
cmp word [rdx], ax
mov r8d, 7
cmovne rax, rdx
xor ecx, ecx
mov rdx, rax
call qword [sym.imp.SHELL32.dll_SHEmptyRecycleBinW]
test eax, eax
jne 0x1400862cc
mov rcx, qword [0x1401156c0]
lea rdx, [0x1400e0714]
xor r9d, r9d
mov byte [rsp + 0x20], 1
lea r8, [r9 - 1]
call fcn.1400c3f40
add rsp, 0x30
pop rbx
ret
mov rax, qword [0x140112060]
lea rdx, [0x1400f5d6c]
test byte [rax + 0x140], 1
jne 0x140086301
mov rcx, qword [0x1401156c0]
xor r9d, r9d
mov byte [rsp + 0x20], 1
lea r8, [r9 - 1]
call fcn.1400c3f40
add rsp, 0x30
pop rbx
ret
lea r9, [0x1400e0684]
xor r8d, r8d
mov rcx, rbx
add rsp, 0x30
pop rbx
jmp fcn.14004d4a0
Function at 0x140086320
Capabilities:
Get file version info

Disassembly:
push rbx
push rbp
sub rsp, 0x148
xor r9d, r9d
mov byte [rsp + 0x20], 1
mov rbx, rdx
mov rbp, rcx
mov rcx, qword [0x1401179f0]
xor edx, edx
lea r8, [r9 - 1]
call fcn.1400c3f40
test rbx, rbx
je 0x140086544
cmp word [rbx], 0
je 0x140086544
lea rdx, [rsp + 0x168]
mov qword [rsp + 0x140], rdi
mov rcx, rbx
call qword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov edi, eax
test eax, eax
jne 0x1400863ea
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x140112060]
lea rdx, [0x1400f5d6c]
test byte [rcx + 0x140], 1
mov dword [rcx + 0x40], eax
jne 0x1400863c6
mov rcx, qword [0x1401156c0]
xor r9d, r9d
mov byte [rsp + 0x20], 1
lea r8, [r9 - 1]
call fcn.1400c3f40
mov rdi, qword [rsp + 0x140]
add rsp, 0x148
pop rbp
pop rbx
ret
lea r9, [0x1400e0684]
xor r8d, r8d
mov rcx, rbp
call fcn.14004d4a0
mov rdi, qword [rsp + 0x140]
add rsp, 0x148
pop rbp
pop rbx
ret
mov rcx, rdi
mov qword [rsp + 0x160], rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r8d, edi
xor edx, edx
mov r9, rax
mov rcx, rbx
mov rsi, rax
call qword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x1400864eb
lea r9, [rsp + 0x170]
mov rcx, rsi
lea r8, [rsp + 0x178]
lea rdx, [0x1400f6dc0]
call qword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x1400864eb
mov rax, qword [rsp + 0x178]
lea r8, str._u._u._u._u
mov edx, dword [rax + 0xc]
mov r9d, dword [rax + 8]
movzx ecx, dx
mov dword [rsp + 0x30], ecx
lea rcx, [rsp + 0x40]
shr edx, 0x10
mov dword [rsp + 0x28], edx
mov edx, 0x80
movzx eax, r9w
shr r9d, 0x10
mov dword [rsp + 0x20], eax
call fcn.1400bf0b0
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rax, qword [0x140112060]
lea rdx, [0x1400e0714]
mov rcx, qword [0x1401156c0]
xor r9d, r9d
mov byte [rsp + 0x20], 1
mov dword [rax + 0x40], 0
lea r8, [r9 - 1]
call fcn.1400c3f40
mov rcx, qword [0x1401179f0]
lea rdx, [rsp + 0x40]
xor r9d, r9d
mov byte [rsp + 0x20], 1
lea r8, [r9 - 1]
call fcn.1400c3f40
mov rsi, qword [rsp + 0x160]
mov rdi, qword [rsp + 0x140]
add rsp, 0x148
pop rbp
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x140112060]
mov dword [rcx + 0x40], eax
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rax, qword [0x140112060]
lea rdx, [0x1400f5d6c]
test byte [rax + 0x140], 1
jne 0x140086530
mov rcx, qword [0x1401156c0]
xor r9d, r9d
mov byte [rsp + 0x20], 1
lea r8, [r9 - 1]
jmp 0x1400864cc
lea r9, [0x1400e0684]
xor r8d, r8d
mov rcx, rbp
call fcn.14004d4a0
jmp 0x1400864d1
mov rax, qword [0x140112060]
lea rdx, [0x1400f5d6c]
test byte [rax + 0x140], 1
mov dword [rax + 0x40], 0x57
jne 0x140086584
mov rcx, qword [0x1401156c0]
xor r9d, r9d
mov byte [rsp + 0x20], 1
lea r8, [r9 - 1]
call fcn.1400c3f40
add rsp, 0x148
pop rbp
pop rbx
ret
lea r9, [0x1400e0684]
xor r8d, r8d
mov rcx, rbp
call fcn.14004d4a0
add rsp, 0x148
pop rbp
pop rbx
ret
Function at 0x140086860
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x270
test dl, dl
jne 0x140086892
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x140086964
mov al, 1
mov rbx, qword [rsp + 0x280]
add rsp, 0x270
pop rdi
ret
lea r9, [rsp + 0x290]
mov edx, 0x104
lea r8, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
mov rbx, 0xffffffffffffffff
lea rcx, [rsp + 0x60]
mov rax, rbx
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400868c0
xor edi, edi
test rax, rax
je 0x1400868de
cmp word [rsp + rax*2 + 0x5e], 0x5c
jne 0x1400868de
mov word [rsp + rax*2 + 0x5e], di
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140086964
test al, 0x10
je 0x140086964
lea rax, [rsp + 0x60]
nop word [rax + rax]
cmp word [rax + rbx*2 + 2], di
lea rbx, [rbx + 1]
jne 0x140086900
lea rax, [rsp + 0x60]
mov word [rsp + rbx*2 + 0x62], di
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x20]
mov eax, 0x614
mov qword [rsp + 0x38], rdi
xorps xmm0, xmm0
mov word [rsp + 0x40], ax
movdqu xmmword [rsp + 0x48], xmm0
mov dword [rsp + 0x44], edi
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x28], 3
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
sete al
mov rbx, qword [rsp + 0x280]
add rsp, 0x270
pop rdi
ret
mov rbx, qword [rsp + 0x280]
xor al, al
add rsp, 0x270
pop rdi
ret
Function at 0x140086f80
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x270
mov edx, 0x2a
mov rbx, rcx
call qword [sym.imp.VCRUNTIME140.dll_wcschr]
test rax, rax
jne 0x140086fc6
lea edx, [rax + 0x3f]
mov rcx, rbx
call qword [sym.imp.VCRUNTIME140.dll_wcschr]
test rax, rax
jne 0x140086fc6
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140086fda
mov al, 1
add rsp, 0x270
pop rbx
ret
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp rax, 0xffffffffffffffff
jne 0x140086fe5
xor al, al
add rsp, 0x270
pop rbx
ret
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindClose]
mov al, 1
add rsp, 0x270
pop rbx
ret

Function at 0x140087000
Capabilities:
Shutdown system

Disassembly:
push rbx
sub rsp, 0x40
mov ebx, ecx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x58]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x14008708a
lea r8, [rsp + 0x34]
xor ecx, ecx
lea rdx, str.SeShutdownPrivilege
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov rcx, qword [rsp + 0x58]
lea r8, [rsp + 0x30]
xor eax, eax
mov dword [rsp + 0x30], 1
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x3c], 2
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x14008708a
xor edx, edx
mov ecx, ebx
call qword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
je 0x14008708a
mov al, 1
add rsp, 0x40
pop rbx
ret
xor al, al
add rsp, 0x40
pop rbx
ret

Function at 0x1400870a0
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x40
xor r9d, r9d
lea rax, [rsp + 0x60]
mov qword [rsp + 0x30], rax
xor r8d, r8d
mov dword [rsp + 0x28], 0x1f4
mov rbx, rcx
mov dword [rsp + 0x20], 2
lea edx, [r9 + 0x10]
call qword [sym.imp.USER32.dll_SendMessageTimeoutW]
test rax, rax
jne 0x14008711d
lea rdx, [rsp + 0x58]
mov dword [rsp + 0x58], eax
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r8d, dword [rsp + 0x58]
test r8d, r8d
je 0x14008711d
xor edx, edx
mov ecx, 0x1f0fff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x14008711d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0x40
pop rbx
ret
Function at 0x1400a4290
Capabilities:
Get keyboard layout

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
movzx eax, word [rcx]
xor bl, bl
mov rdi, rcx
test ax, ax
je 0x1400a42da
nop dword [rax]
cmp ax, 0x21
je 0x1400a42ca
cmp ax, 0x2b
je 0x1400a42c6
cmp ax, 0x5e
jne 0x1400a42da
mov al, 2
jmp 0x1400a42cc
mov al, 1
jmp 0x1400a42cc
mov al, 4
add rdi, 2
or bl, al
movzx eax, word [rdi]
test ax, ax
jne 0x1400a42b0
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
xor r8d, r8d
xor edx, edx
mov rcx, rdi
mov qword [rsp + 0x20], rax
call fcn.14001b0c0
movzx esi, al
test al, al
jne 0x1400a430d
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
xor edx, edx
mov rcx, rdi
call fcn.14001afa0
movzx edx, ax
test ax, ax
jne 0x1400a432d
xor edx, edx
movzx ecx, sil
call fcn.14001bed0
movzx edx, ax
mov eax, 0x100
and dx, ax
movzx eax, bl
or al, 8
movzx ecx, al
test dx, dx
movzx eax, bl
mov rbx, qword [rsp + 0x40]
cmove ecx, eax
movzx eax, cl
shl ax, 8
or ax, si
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x1400ad9a0
Capabilities:
Set current directory

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov esi, r9d
mov ebp, r8d
mov r14, rdx
mov rbx, rcx
mov edi, 1
xor r15d, r15d
mov qword [r11 + 8], r15
mov qword [r11 - 0x48], rcx
mov rax, qword [rcx + 8]
mov qword [r11 - 0x40], rax
mov r10d, r15d
mov dword [r11 - 0x38], r15d
mov eax, dword [rcx + 0x10]
mov dword [rsp + 0x54], eax
lea rcx, [r11 - 0x48]
mov qword [rbx + 8], rcx
test eax, eax
jle 0x1400adb48
lea r13, [0x140115550]
lea r12, [0x1400e0684]
nop dword [rax]
cmp r10d, esi
jl 0x1400adadf
mov r8, qword [0x140112060]
mov rcx, r8
mov rax, r13
mov edx, 2
nop dword [rax + rax]
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rcx - 0x10], xmm1
lea rax, [rax + 0x80]
sub rdx, 1
jne 0x1400ada30
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
mov dword [r8 + 0x3c], r15d
mov qword [0x1401197d8], r15
cmp dword [0x1401156e8], edx
je 0x1400adada
mov rax, qword [0x140114798]
mov rcx, r12
test rax, rax
je 0x1400adad4
mov rax, qword [rax]
test rax, rax
cmovne rcx, rax
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov r10d, dword [rsp + 0x50]
movsxd rax, r10d
lea rcx, [rax + rax*2]
mov rax, qword [rbx]
mov rcx, qword [rax + rcx*8]
mov dword [rsp + 0x30], r15d
lea rax, [rsp + 0x90]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebp
mov r9, r14
lea r8, [0x1400e0708]
mov rdx, rcx
call fcn.1400a9aa0
test eax, eax
je 0x1400adb45
cmp qword [rsp + 0x90], 0
jne 0x1400adb3e
mov r10d, dword [rsp + 0x50]
inc r10d
mov dword [rsp + 0x50], r10d
cmp r10d, dword [rsp + 0x54]
jl 0x1400ada10
jmp 0x1400adb48
mov edi, 3
jmp 0x1400adb48
mov edi, r15d
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
mov qword [rcx + 8], rdx
mov eax, edi
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1400b3d40
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 8], rcx
push rdi
mov eax, 0x30030
call fcn.1400ddab0
sub rsp, rax
mov rbx, qword [rsp + 0x30060]
mov rsi, r9
mov rdi, r8
mov rax, rdx
test rbx, rbx
je 0x1400b3d79
cmp word [rbx], 0
jne 0x1400b3d80
lea rbx, str.ERROR
xor ecx, ecx
lea r9, [rsp + 0x30060]
mov word [rsp + 0x10030], cx
lea r8, [rsp + 0x30]
mov word [rsp + 0x30040], cx
mov edx, 0x8000
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
cmp word [rsi], 0
movzx eax, word [rdi]
je 0x1400b3e20
test ax, ax
lea rcx, [rsp + 0x30040]
lea rax, [rsp + 0x30]
mov r8, rbx
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x10030]
cmovne rcx, rdi
mov dword [rsp + 0x20], 0xffff
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov rcx, qword [0x1401179f0]
lea rdx, [rsp + 0x10030]
xor r9d, r9d
mov byte [rsp + 0x20], 1
lea r8, [r9 - 1]
call fcn.1400c3f40
lea r11, [rsp + 0x30030]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
test ax, ax
je 0x1400b3e43
lea r9, [rsp + 0x30]
mov r8d, 0xffff
lea rdx, [rsp + 0x10030]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionW]
jmp 0x1400b3e5b
lea r8, [rsp + 0x30]
mov edx, 0xffff
lea rcx, [rsp + 0x10030]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesW]
test eax, eax
je 0x1400b3deb
lea rax, [rsp + 0x10030]
mov ecx, 0xa
nop dword [rax]
cmp word [rax], 0
jne 0x1400b3e84
cmp word [rax + 2], 0
je 0x1400b3deb
mov word [rax], cx
add rax, 2
jmp 0x1400b3e70
Function at 0x1400b3e90
Capabilities:
Write file on windows

Disassembly:
push rbp
push r12
push r13
push r14
push r15
mov eax, 0x10050
call fcn.1400ddab0
sub rsp, rax
lea rbp, [rsp + 0x40]
mov qword [rbp + 0x10040], rbx
mov rax, r8
mov rbx, rdx
mov qword [rbp + 0x10048], rsi
mov r13, rcx
mov qword [rbp + 0x10050], rdi
mov rdi, r9
lea r8, [rbp + 0x10]
lea r9, [rbp + 8]
mov edx, 0x8000
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
xor edx, edx
lea rcx, [rbp + 0x10]
lea r15d, [rdx + 1]
call fcn.1400c0080
xor r12d, r12d
test al, al
jne 0x1400b3fd0
mov qword [rsp + 0x30], r12
lea rcx, [rbp + 0x10]
mov dword [rsp + 0x28], r12d
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], r15d
mov edx, 0x40000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x1400b3fd0
mov rcx, 0xffffffffffffffff
inc rcx
cmp word [rdi + rcx*2], r12w
jne 0x1400b3f35
mov eax, ecx
lea r12d, [rcx*2 + 2]
lea r14, [rdi + rax*2]
mov qword [rsp + 0x20], 0
mov eax, 0x5d
lea r9, [rbp]
lea rdx, [0x140101548]
mov word [r14], ax
mov rcx, rsi
lea r8d, [rax - 0x59]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1400b3fa7
cmp dword [rbp], 4
jne 0x1400b3fa7
lea r9, [rbp]
mov qword [rsp + 0x20], 0
mov r8d, r12d
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1400b3fa7
cmp dword [rbp], r12d
je 0x1400b3faf
xor r12d, r12d
mov r15d, r12d
jmp 0x1400b3fb2
xor r12d, r12d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov word [r14], r12w
test eax, eax
je 0x1400b40aa
test r15d, r15d
je 0x1400b40aa
mov rdx, qword [rbp + 0x10060]
cmp word [rdx], 0
je 0x1400b3ff2
lea r9, [rbp + 0x10]
mov r8, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
jmp 0x1400b4072
xor edx, edx
mov rcx, r13
call fcn.14003cb80
lea rax, [rax*2 + 4]
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x1400b4017
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1400ddab0
movzx r8d, word [rbx]
sub rsp, rcx
lea rdx, [rsp + 0x40]
mov rcx, rdx
test r8w, r8w
je 0x1400b405f
sub rbx, rdx
nop dword [rax + rax]
cmp r8w, 0xa
mov eax, r12d
cmovne ax, r8w
mov word [rcx], ax
add rcx, 2
movzx r8d, word [rbx + rcx]
test r8w, r8w
jne 0x1400b4040
mov dword [rcx], 0
lea r8, [rbp + 0x10]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileSectionW]
lea r9, [rbp + 0x10]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
test ebx, ebx
je 0x1400b40aa
mov rcx, qword [0x1401156c0]
lea rdx, [0x1400e0714]
xor r9d, r9d
mov byte [rsp + 0x20], 1
lea r8, [r9 - 1]
call fcn.1400c3f40
jmp 0x1400b40ed
mov rax, qword [0x140112060]
lea rdx, [0x1400f5d6c]
test byte [rax + 0x140], 1
jne 0x1400b40db
mov rcx, qword [0x1401156c0]
xor r9d, r9d
mov byte [rsp + 0x20], 1
lea r8, [r9 - 1]
call fcn.1400c3f40
jmp 0x1400b40ed
lea r9, [0x1400e0684]
xor r8d, r8d
mov rcx, r13
call fcn.14004d4a0
mov rbx, qword [rbp + 0x10040]
mov rsi, qword [rbp + 0x10048]
mov rdi, qword [rbp + 0x10050]
lea rsp, [rbp + 0x10010]
pop r15
pop r14
pop r13
pop r12
pop rbp
ret