joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002c330
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rsi, rax
lea rdi, [0x14002c24e]
mov rcx, qword [rdi + 0x1c]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov r15, rax
mov ecx, dword [rdi + 0x6c]
mov r14, qword [rsi + 0x2e5e0]
call r14
mov r12, rax
xor ecx, ecx
mov rdx, r12
loop 0x14002c356
mov eax, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov rcx, r12
call fcn.14002c422
mov r12, qword [rdi + 4]
mov r13, rax
cmp dword [r12], 0
je 0x14002c36c
mov rcx, r13
call fcn.14002c446
movzx eax, al
cmp al, byte [r12]
je 0x14002c352
cmp al, byte [r12 + 1]
jne 0x14002c417
mov rcx, r13
call fcn.14002c45a
cmp eax, dword [r12 + 4]
je 0x14002c36c
cmp eax, dword [r12 + 8]
jne 0x14002c417
mov ecx, dword [rdi + 0x6c]
mov dword [rsp + 0x20], 0
call r14
mov rdx, rax
xor r9d, r9d
mov rax, qword [rdi + 0x3c]
mov r8d, dword [rax + r9]
mov dword [r9 + rdx], r8d
add r9, 4
cmp r9, 0x40
jl 0x14002c380
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r13, rax
test r13, r13
je 0x14002c417
mov r12, qword [rdi + 0x7c]
mov rcx, r12
mov edx, 0x7000
lea r9, [rsp + 0x20]
mov r8d, dword [rdi + 0x58]
call r13
mov eax, dword [rdi + 0x5c]
push 8
pop rdx
add rsi, rax
mov r8d, dword [rsi + 4]
mov eax, dword [rdx + rsi]
add eax, r8d
mov dword [rdx + r12], eax
add rdx, 4
cmp rdx, 0x7000
jl 0x14002c3cc
mov eax, dword [rdi + 0x54]
mov rcx, r12
mov dword [r12 + 8], eax
mov edx, 0x7000
mov r8d, dword [rsp + 0x20]
lea r9, [rsp + 0x20]
call r13
mov eax, dword [rdi]
mov edi, dword [rdi]
mov edx, dword [r12 + 0xc]
add rdx, r12
add r12, rdi
add rdx, rax
mov rcx, r12
call rdx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x2fc4d5650
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc4d6730
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc4d6052
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4f8108]
test eax, eax
je 0x2fc4d60ea
lea rax, [0x2fc4f80e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4f8110]
mov qword [rbp - 8], rax
jmp 0x2fc4d60ce
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4d60c2
cmp qword [rbp - 0x10], 0
je 0x2fc4d60c2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4d6088
lea rax, [0x2fc4f80e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4d60eb
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4d61f0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4d6218
mov eax, 0
jmp 0x2fc4d6266
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4d6241
mov eax, 0
jmp 0x2fc4d6266
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4d6261
mov eax, 0
jmp 0x2fc4d6266
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d626c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4d62ea
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4d62e1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4d62e1
mov rax, qword [rbp - 8]
jmp 0x2fc4d62ff
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4d62b4
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d46c0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc4d57a0
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc4d50c2
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4f7108]
test eax, eax
je 0x2fc4d515a
lea rax, [0x2fc4f70e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4f7110]
mov qword [rbp - 8], rax
jmp 0x2fc4d513e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4d5132
cmp qword [rbp - 0x10], 0
je 0x2fc4d5132
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4d50f8
lea rax, [0x2fc4f70e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4d515b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4d5260
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4d5288
mov eax, 0
jmp 0x2fc4d52d6
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4d52b1
mov eax, 0
jmp 0x2fc4d52d6
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4d52d1
mov eax, 0
jmp 0x2fc4d52d6
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d52dc
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4d535a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4d5351
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4d5351
mov rax, qword [rbp - 8]
jmp 0x2fc4d536f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4d5324
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x1400155a0
Capabilities:
Print debug messages
Write file on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x20], r9
push rsi
sub rsp, 0x460
mov rax, qword [0x1401b7030]
xor rax, rsp
mov qword [rsp + 0x440], rax
mov rsi, rcx
cmp edx, dword [rcx + 0xc]
jg 0x14001569e
mov edx, 0x400
mov qword [r11 - 0x10], rbx
lea rax, [r11 + 0x20]
mov r9, r8
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea r8d, [rdx - 1]
call fcn.140015250
cmp byte [rsi + 9], 0
je 0x140015605
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp byte [rsi + 0xa], 0
mov rbx, 0xffffffffffffffff
je 0x14001565d
mov qword [rsp + 0x450], rdi
lea rax, [rsp + 0x40]
mov rdi, rbx
inc rdi
cmp byte [rax + rdi], 0
jne 0x140015622
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], 0
mov rcx, rax
lea rdx, [rsp + 0x40]
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_WriteConsoleA]
mov rdi, qword [rsp + 0x450]
cmp byte [rsi + 8], 0
je 0x140015696
mov rcx, qword [rsi + 0x10]
test rcx, rcx
je 0x140015696
lea rax, [rsp + 0x40]
inc rbx
cmp byte [rax + rbx], 0
jne 0x140015671
mov r8, rbx
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x30]
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rbx, qword [rsp + 0x458]
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.14011c340
add rsp, 0x460
pop rsi
ret
Function at 0x140020050
Capabilities:
Print debug messages
Write file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx + 0xd748]
mov rbx, rcx
mov ecx, dword [rax + 0x328]
test ecx, ecx
je 0x1400200df
dec ecx
cmp ecx, 5
ja case.default.0x140020085
movsxd rax, ecx
lea rcx, [0x140000000]
mov edx, dword [rcx + rax*4 + 0x20130]
add rdx, rcx
jmp rdx
movups xmm0, xmmword [0x14018a3c0]
jmp 0x1400200bb
movups xmm0, xmmword [0x14018a380]
jmp 0x1400200bb
movups xmm0, xmmword [0x14018a390]
jmp 0x1400200bb
movups xmm0, xmmword [0x14018a3a0]
jmp 0x1400200bb
movups xmm0, xmmword [0x14018a3b0]
jmp 0x1400200bb
movups xmm0, xmmword [0x14018a370]
movups xmmword [rbx + 0x5210], xmm0
lea r8, str.Requesting_8_bit_truecolour_n
mov edx, 2
lea rcx, vtable.Log.0
add rsp, 0x20
pop rbx
jmp fcn.1400155a0
cmp byte [rbx + 0x2d3], 0
jne 0x140020114
lea r8, str.Requesting_16_bit_truecolour_n
mov edx, 2
lea rcx, vtable.Log.0
call fcn.1400155a0
movups xmm0, xmmword [0x14018a360]
movups xmmword [rbx + 0x5210], xmm0
add rsp, 0x20
pop rbx
ret
movups xmm0, xmmword [rbx + 0x2d0]
movups xmmword [rbx + 0x5210], xmm0
mov byte [rbx + 0x5212], 0
add rsp, 0x20
pop rbx
ret
Function at 0x140023470
Capabilities:
Check for time delay via gettickcount

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x1401b7030]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rax, qword [rcx + 0x4d38]
mov rbx, rcx
test rax, rax
je 0x1400234b1
cmp byte [rax + 0x71], 0
je 0x1400234b1
cmp byte [rax + 0x72], 0
jne 0x1400235a1
cmp dword [rax + 0xb54], 1
je 0x1400235a1
mov rax, qword [rcx + 0x4d40]
cmp byte [rax + 0x28], 0
je 0x1400234c8
cmp byte [rax + 0x29], 0
jne 0x1400235a1
cmp byte [rcx + 0xd770], 0
mov qword [rsp + 0x68], rdi
mov byte [rsp + 0x30], 3
je 0x1400234e9
movzx eax, byte [rsp + 0x88]
mov byte [rsp + 0x31], al
jmp 0x140023506
cmp byte [rsp + 0x88], 0
jne 0x140023501
cmp byte [rcx + 0xd700], 0
mov byte [rsp + 0x31], 0
je 0x140023506
mov byte [rsp + 0x31], 1
mov byte [rcx + 0xd700], 0
mov eax, r9d
inc dword [rbx + 0x704]
mov edx, 0xff
sar eax, 8
xor edi, edi
and ax, dx
shl r9w, 8
or ax, r9w
mov dword [rsp + 0x32], edi
mov word [rsp + 0x36], ax
mov eax, dword [rsp + 0x80]
mov ecx, eax
sar ecx, 8
and cx, dx
shl ax, 8
or cx, ax
mov word [rsp + 0x38], cx
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [rbx + 0x710]
cmp eax, 0x3e8
jbe 0x140023581
mov eax, dword [rbx + 0x704]
mov dword [rbx + 0x700], eax
mov dword [rbx + 0x704], edi
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rbx + 0x710], eax
mov r9b, 3
mov byte [rsp + 0x28], dil
mov r8d, 0xa
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.140026710
mov rdi, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14011c340
add rsp, 0x50
pop rbx
ret

Function at 0x140026500
Capabilities:
Print debug messages
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ebx, r8d
mov rdi, rdx
test r8d, r8d
je 0x14002651d
mov r8d, ebx
call fcn.140025f70
mov r9d, ebx
mov byte [rbx + rdi], 0
lea r8, str.Read_a__d_byte_string_n
mov edx, 0xa
lea rcx, vtable.Log.0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1400155a0

Function at 0x140026550
Capabilities:
Get socket status
Send data
Send data on socket

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x268
mov rax, qword [0x1401b7030]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov eax, dword [rcx + 0x748]
mov rbx, rcx
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov rsi, rdx
mov dword [rsp + 0x30], r9d
xor edi, edi
mov dword [rsp + 0x40], 1
lea ecx, [rax + 1]
mov dword [rsp + 0x34], edi
lea rax, [rsp + 0x30]
xor r9d, r9d
lea r8, [rsp + 0x40]
mov qword [rsp + 0x20], rax
xor edx, edx
call qword [sym.imp.WS2_32.dll_select]
test eax, eax
je 0x1400265fd
cmp eax, 1
ja 0x1400265f8
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [rbx + 0x748]
lea rdx, [rsp + 0x40]
mov dword [rbx + 0x12b0], eax
call qword [sym.imp.WS2_32.dll___WSAFDIsSet]
test eax, eax
je 0x1400265f4
mov rcx, qword [rbx + 0x748]
xor r9d, r9d
mov r8d, ebp
mov rdx, rsi
call qword [sym.imp.WS2_32.dll_send]
mov edi, eax
mov eax, edi
jmp 0x1400265fd
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.14011c340
add rsp, 0x268
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14002f370
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov rbx, rdx
mov r15, rcx
mov rax, qword [rcx + 0xd748]
cmp byte [rax + 0x357], 0
jne 0x14002f524
cmp byte [rax + 0x31e], 0
jne 0x14002f524
lea eax, [r8*2 + 1]
movsxd rcx, eax
call fcn.14011c740
mov rsi, rax
xor r8d, r8d
movzx edx, byte [rbx]
test dl, dl
je 0x14002f3f6
mov rcx, rax
cmp dl, 0xa
jne 0x14002f3e4
mov byte [rcx], reloc.WS2_32.dll_listen
inc r8d
inc rcx
movzx edx, byte [rbx]
mov byte [rcx], dl
inc rbx
inc r8d
inc rcx
movzx edx, byte [rbx]
test dl, dl
jne 0x14002f3d3
movsxd rax, r8d
mov byte [rax + rsi], 0
lea rbp, [r15 + 0x15e8]
mov qword [rsp + 0x20], rbp
mov dword [rsp + 0x28], 0
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
mov rcx, qword [r15 + 0x12b8]
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
setne bl
mov byte [rsp + 0x60], bl
test bl, bl
jne 0x14002f444
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, str.UpdateLocalClipboard:_Failed_to_open_clipboard__Last_error_0x_08x
jmp 0x14002f45b
call qword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
jne 0x14002f485
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, str.UpdateLocalClipboard:_Failed_to_empty_clipboard__Last_error_0x_08x
mov r9d, eax
mov edx, 2
lea rcx, vtable.Log.0
call fcn.1400155a0
mov rcx, rsi
call fcn.14011c3a0
nop
test bl, bl
je 0x14002f51b
jmp 0x14002f514
mov rdi, 0xffffffffffffffff
mov rax, rdi
nop
lea rax, [rax + 1]
cmp byte [rsi + rax], 0
jne 0x14002f490
lea r12d, [rax + 1]
movsxd r13, r12d
mov rdx, r13
mov ecx, 0x2000
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov r14, rax
test rax, rax
je 0x14002f50b
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rbx, rax
mov r8, r13
mov rdx, rsi
mov rcx, rax
call fcn.140121290
movsxd rcx, r12d
mov byte [rcx + rbx - 1], 0
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
inc rdi
cmp byte [rsi + rdi], 0
jne 0x14002f4e2
lea rcx, [r15 + 0x14f0]
mov r8, rdi
mov rdx, rsi
call fcn.14002dc40
mov rdx, r14
mov ecx, 1
call qword [sym.imp.USER32.dll_SetClipboardData]
mov rcx, rsi
call fcn.14011c3a0
nop
call qword [sym.imp.USER32.dll_CloseClipboard]
nop
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14003b740
Capabilities:
Inspect load icon resource

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x1401b7030]
xor rax, rsp
mov qword [rsp + 0x30], rax
cmp byte [reloc.WS2_32.dll_accept], 0
mov rbx, rcx
mov rax, qword [rcx + 0x10]
mov ebp, edx
mov qword [rcx + 0x30], rax
mov edx, reloc.WS2_32.dll_WSAAsyncSelect
mov dword [rcx + 0x28], 0x210
mov dword [rcx + 0x38], reloc.WS2_32.dll_WSAAsyncSelect
mov rcx, qword [0x1401bc5b8]
mov rcx, qword [rcx + 0xb98]
jne 0x14003b797
mov edx, 0xb1
call qword [sym.imp.USER32.dll_LoadIconA]
mov qword [rbx + 0x48], rax
mov r9d, 0x80
mov rcx, qword [0x1401bc5b8]
lea r8, [rbx + 0x50]
mov dword [rbx + 0x3c], 3
mov dword [rbx + 0x40], 0x8002
mov byte [rbx + 0x50], 0
lea edx, [r9 - 0x1b]
mov rcx, qword [rcx + 0xb98]
call qword [sym.imp.USER32.dll_LoadStringA]
test eax, eax
je 0x14003b7dd
or dword [rbx + 0x3c], 4
mov r8d, dword [rbx + 0x238]
lea rdx, str.___Port:_ld
lea rcx, [rsp + 0x20]
call fcn.14003bb60
lea r8, [rsp + 0x20]
mov edx, 0x80
lea rcx, [rbx + 0x50]
call fcn.1401252ac
lea rdx, [rbx + 0x28]
mov ecx, ebp
call qword [sym.imp.SHELL32.dll_Shell_NotifyIconA]
test eax, eax
setne al
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14011c340
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x14003c3a0
Capabilities:
Delete file

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x310]
test rcx, rcx
je 0x14003c3bb
call qword [rbx + 0x2e8]
mov rcx, qword [rbx + 0x318]
test rcx, rcx
je 0x14003c3cd
call qword [rbx + 0x2e8]
xor eax, eax
mov qword [rbx + 0x310], rax
mov qword [rbx + 0x318], rax
mov byte [rbx + 0x38], al
call qword [rbx + 0x2b8]
test eax, eax
je 0x14003c423
mov rcx, qword [rbx + 0x1a0]
mov qword [rsp + 0x30], rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test eax, eax
lea rcx, [rbx + 0x1a8]
setne dil
cmp byte [rcx], 0
je 0x14003c414
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
movzx eax, dil
mov rdi, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
ret
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x14003ec20
Capabilities:
Hide graphical window

Disassembly:
push rdi
sub rsp, 0x50
mov rax, qword [0x1401b7030]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rdi, rcx
cmp edx, 0xffffffff
jne 0x14003ed19
mov byte [rcx + 0x73], 0
mov edx, 0x428
mov rcx, qword [rcx + 0x40]
mov qword [rsp + 0x68], rbx
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, qword [rdi + 0x40]
xor r9d, r9d
mov edx, 0x42a
mov qword [rsp + 0x20], 0
mov r8d, 0x184
mov rbx, rax
call qword [sym.imp.USER32.dll_SendDlgItemMessageA]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1009
mov rcx, rbx
call qword [sym.imp.USER32.dll_SendMessageA]
mov rcx, qword [rdi + 0x40]
lea r8, [0x1401bbe70]
mov edx, 0x411
call qword [sym.imp.USER32.dll_SetDlgItemTextA]
mov rcx, qword [rdi + 0x40]
lea r8, [0x1401bccc0]
mov edx, 0x431
call qword [sym.imp.USER32.dll_SetDlgItemTextA]
lea rdx, [0x1401bd500]
mov rcx, rdi
call fcn.140040ed0
mov rdx, qword [rdi + 0x40]
xor r8d, r8d
call fcn.140047230
mov rcx, qword [rdi + 0x40]
mov edx, 2
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
mov edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [rdi + 0x40]
mov edx, 4
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
mov edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
mov rbx, qword [rsp + 0x68]
jmp 0x14003ed89
cmp dword [rcx + 0xb54], 3
mov byte [rcx + 0x73], 1
jl 0x14003ed53
mov rcx, qword [rcx + 0x38]
lea rdx, [rsp + 0x30]
xor eax, eax
mov r9b, 7
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x38], eax
mov word [rsp + 0x30], 0xf07
lea r8d, [rax + 0xc]
call fcn.1400266a0
cmp byte [rdi + 0x73], 0
je 0x14003ed7a
mov rcx, qword [rdi + 0x38]
lea rdx, [rsp + 0x30]
mov r9b, 7
mov dword [rsp + 0x30], 0x20107
mov r8d, InitCommonControls
mov dword [rsp + 0x38], 0
call fcn.1400266a0
lea rdx, [0x1401bc900]
mov rcx, rdi
call fcn.140040ed0
mov al, 1
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14011c340
add rsp, 0x50
pop rdi
ret
Function at 0x14003f800
Capabilities:
Get common file path
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0xa0]
sub rsp, 0x1a0
mov rax, qword [0x1401b7030]
xor rax, rsp
mov qword [rbp + 0x90], rax
mov rsi, r8
lea r15, [0x14019c5a0]
mov r14, rdx
mov qword [rsp + 0x20], r15
lea r8, [0x14019c5a4]
mov rbx, 0xffffffffffffffff
lea rdx, str._s_s_s
lea r9, str.My_Documents
lea rcx, [rsp + 0x40]
call fcn.14003c490
lea rax, [rsp + 0x40]
mov r8, rbx
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14003f870
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.14012f65c
test eax, eax
mov qword [rsp + 0x20], r15
mov ecx, 5
lea r9, str.Desktop
mov edi, ebx
lea r8, [0x14019c5a4]
cmove edi, ecx
lea rdx, str._s_s_s
lea rcx, [rsp + 0x40]
call fcn.14003c490
lea rax, [rsp + 0x40]
mov r8, rbx
nop
inc r8
cmp byte [rax + r8], 0
jne 0x14003f8c0
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.14012f65c
xor ecx, ecx
mov qword [rsp + 0x20], r15
test eax, eax
lea r9, str.Network_Favorites
lea r8, [0x14019c5a4]
cmove edi, ecx
lea rdx, str._s_s_s
lea rcx, [rsp + 0x40]
call fcn.14003c490
lea rax, [rsp + 0x40]
mov r8, rbx
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14003f910
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.14012f65c
test eax, eax
jne 0x14003f930
lea edi, [rax + 0x13]
jmp 0x14003f934
cmp edi, ebx
je 0x14003f985
lea r8, [rsp + 0x30]
mov edx, edi
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x14003f981
mov rcx, qword [rsp + 0x30]
lea rdx, [rbp - 0x80]
call qword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
test eax, eax
je 0x14003f981
lea r8, [0x14019c38c]
mov edx, 0x104
lea rcx, [rbp - 0x80]
call fcn.1401252ac
lea r8, [rbp - 0x80]
mov edx, 0x40f
mov rcx, r14
call qword [sym.imp.USER32.dll_SetDlgItemTextA]
mov al, 1
jmp 0x14003fa02
mov r8, rsi
lea rcx, [rbp - 0x80]
mov edx, 0x104
call fcn.14012524c
xorps xmm0, xmm0
lea r8, [rbp - 0x80]
mov r9d, 2
lea rcx, [rsp + 0x40]
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
lea edx, [r9 + 0x3e]
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
call fcn.140125604
cmp byte [rsp + 0x40], 0x5b
jne 0x14003f9da
cmp byte [rsp + 0x41], 0x20
jne 0x14003f9da
cmp byte [rsp + 0x42], 0
je 0x14003fa00
lea rax, [rbp - 0x80]
nop
inc rbx
cmp byte [rax + rbx], 0
jne 0x14003f9e0
cmp ebx, 2
jle 0x14003fa00
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 0x10
jne 0x14003f96f
xor al, al
mov rcx, qword [rbp + 0x90]
xor rcx, rsp
call fcn.14011c340
mov rbx, qword [rsp + 0x1d0]
add rsp, 0x1a0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret