joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140029131
Capabilities:
Set file attributes

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
cmp byte [rcx], 0
mov rdi, rcx
jne 0x140029145
xor ebx, ebx
jmp 0x1400291a2
xor eax, eax
xor edx, edx
mov r8, rcx
mov rbp, qword [0x14011c6a0]
mov qword [rsp + 0x20], rdx
or r9d, 0xffffffff
xor edx, edx
mov ecx, 0xfde9
mov dword [rsp + 0x28], eax
call rbp
mov esi, eax
cmp eax, 1
jle 0x140029141
movsxd rcx, eax
mov edx, 2
call sub.msvcrt.dll_vfprintf
mov rbx, rax
test rax, rax
je 0x140029141
or r9d, 0xffffffff
xor edx, edx
mov dword [rsp + 0x28], esi
mov r8, rdi
mov qword [rsp + 0x20], rax
mov ecx, 0xfde9
call rbp
cmp eax, esi
je 0x1400291a6
xor eax, eax
jmp 0x140029219
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_SetFileAttributesW]
test rax, rax
jne 0x140029219
cmp word [0x140114880], 0x3f
jbe 0x1400291cc
lea rcx, [0x140097ccf]
call fcn.140038472
jmp 0x1400291a2
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [0x14011c648]
test rax, rax
je 0x140029200
movzx edx, word [0x140114880]
lea ecx, [rdx + 1]
mov word [0x140114880], cx
lea rcx, [0x1401148a0]
mov qword [rcx + rdx*8], rax
jmp 0x140029219
call fcn.14003893c
mov rdx, rbx
lea rcx, [0x140097cf8]
mov r8, rax
call fcn.140038472
jmp 0x1400291a2
mov rcx, rbx
mov qword [rsp + 0x38], rax
call fcn.1400796c8
mov rax, qword [rsp + 0x38]
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x140029f2b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
call fcn.14002923f
mov rsi, qword [sym.imp.KERNEL32.DLL_LoadResource]
cmp word [rax], 0x22
mov rbx, rax
jne 0x140029f6c
mov rcx, rax
call fcn.140079868
cmp word [rbx + rax*2 - 2], 0x22
jne 0x140029f6c
mov rcx, rbx
call fcn.140079868
lea rcx, [rbx + 2]
mov word [rbx + rax*2 - 2], 0
jmp 0x140029f6f
mov rcx, rbx
call rsi
mov esi, eax
call qword [sym.imp.KERNEL32.DLL_PeekNamedPipe]
mov rcx, rbx
mov edi, eax
call fcn.1400796c8
mov ecx, edi
call qword [0x14011c730]
mov eax, esi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret

Function at 0x14002ac2a
Capabilities:
Write file on windows

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
mov r13, rcx
lea rcx, [0x140114260]
call fcn.14002923f
lea rcx, [0x140097e89]
mov rbp, rax
call fcn.14002923f
mov edx, 2
mov ecx, 0x104
mov r12, rax
call sub.msvcrt.dll_vfprintf
xor r8d, r8d
mov rdx, r12
mov rcx, rbp
mov r9, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.DLL_WriteFile]
mov r14, qword [sym.imp.KERNEL32.DLL_PeekNamedPipe]
mov ebx, eax
call r14
mov esi, eax
test ebx, ebx
je 0x14002acc7
xor eax, eax
mov dword [rsp + 0x28], 0x104
or r9d, 0xffffffff
xor edx, edx
mov qword [rsp + 0x38], rax
mov r8, rdi
mov ecx, 0xfde9
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x20], r13
call qword [0x14011c7d0]
mov ebx, eax
test eax, eax
jne 0x14002acc7
call r14
mov esi, eax
test rdi, rdi
je 0x14002acd4
mov rcx, rdi
call fcn.1400796c8
test r12, r12
je 0x14002ace1
mov rcx, r12
call fcn.1400796c8
test rbp, rbp
je 0x14002acee
mov rcx, rbp
call fcn.1400796c8
mov ecx, esi
call qword [0x14011c730]
mov eax, ebx
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
Function at 0x14002b7ea
Capabilities:
Read file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
cmp dword [0x14011520c], 0
movabs rax, 0x4c4542414c5f4f4e
mov qword [rsp + 0x27], rax
mov byte [rsp + 0x2f], 0
mov byte [rsp + 0x26], 0
jne 0x14002b8f0
cmp dword [0x1401146d0], 3
mov dword [0x140115204], 1
jne 0x14002b847
cmp qword [0x1401134f0], 0
je 0x14002b847
mov rdx, qword [0x1400b67d0]
cmp byte [rdx], 0
jne 0x14002b8e3
lea rdx, [0x140097eb2]
test ecx, ecx
js 0x14002b8e3
movsxd rbx, ecx
lea rdi, [0x140112620]
lea r12, [rsp + 0x27]
mov rbp, qword [sym.imp.msvcrt.dll_fread]
imul rsi, rbx, 0x38
mov rcx, r12
add rsi, rdi
mov rdx, qword [rsi + 0x18]
call rbp
test eax, eax
jne 0x14002b890
mov rax, qword [0x1400b5f80]
lea rdx, [rax + 0x5ac]
jmp 0x14002b8e3
lea rdx, [rsp + 0x26]
mov rcx, r12
call rbp
test eax, eax
je 0x14002b880
mov rsi, qword [rsi + 0x18]
test rsi, rsi
jne 0x14002b8ae
lea rsi, [0x140097dbf]
mov ecx, 0xc87
call fcn.14001e8f5
lea rcx, [0x140097dbf]
test rax, rax
je 0x14002b8d1
mov ecx, 0xc87
call fcn.14001e8f5
mov rcx, rax
mov rdx, rsi
call rbp
test eax, eax
je 0x14002b880
imul rbx, rbx, 0x38
mov rdx, qword [rdi + rbx + 0x18]
mov rcx, qword [0x1401147b0]
call fcn.14002b7a6
nop
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x14002de86
Capabilities:
Get graphical window text

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov rcx, qword [0x1401147d8]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x147
mov rsi, qword [0x14011d030]
call rsi
mov rbp, qword [0x1400b5f80]
mov ecx, 0x184
xor edx, edx
mov rbx, rax
mov r13d, eax
xor eax, eax
mov rdi, rbp
rep stosd dword [rdi], eax
mov rcx, qword [0x1401151a8]
call qword [sym.imp.USER32.dll_GetWindowTextA]
test ebx, ebx
js 0x14002e092
movsxd rbx, ebx
xor r9d, r9d
mov edx, 0x150
mov rcx, qword [0x1401147d8]
mov dword [0x14008464c], 0xffffffff
mov r8, rbx
call rsi
lea rsi, [rsp + 0x30]
xor r9d, r9d
mov r8d, 0x20
mov ecx, eax
mov rdx, rsi
mov dword [rbp + 8], eax
call fcn.14000b883
xor ecx, ecx
call fcn.14002950e
xor ecx, ecx
cmp dword [0x140084694], 0xffffffff
jne 0x14002df32
mov rcx, rsi
call fcn.14002a20b
test eax, eax
jne 0x14002df54
or ecx, 0xffffffff
call fcn.14002b7ea
lea rcx, str.No_file_system_is_selectable_for_this_drive_n
call fcn.140038472
jmp 0x14002e09b
xor edx, edx
mov ecx, 1
lea r14, [0x140112620]
call fcn.14002da7f
mov rcx, qword [rbp]
mov r8d, 1
xor edx, edx
call fcn.140038d8b
lea rcx, [rbp + 0x5ac]
mov r12, qword [sym.imp.msvcrt.dll_clearerr]
lea r9, [0x140097dc6]
mov qword [rsp + 0x20], rax
or r8, 0xffffffffffffffff
mov edx, 0x10
call r12
imul rax, rbx, 0x38
mov byte [rbp + 0x5bb], 0
mov ecx, 0x20
mov r15, qword [r14 + rax + 8]
test r15, r15
je 0x14002dfc4
mov rcx, r15
call fcn.1400797e8
lea rcx, [rax + 0x20]
call fcn.140079730
mov rsi, rax
test rax, rax
je 0x14002e092
cmp dword [0x140114754], 0
je 0x14002e027
mov ebx, 0x20
test r15, r15
je 0x14002dff4
mov rcx, r15
call fcn.1400797e8
lea rbx, [rax + 0x20]
mov rcx, qword [rbp]
xor r8d, r8d
xor edx, edx
call fcn.140038d8b
mov qword [rsp + 0x28], r15
mov rdx, rbx
mov rcx, rsi
mov qword [rsp + 0x20], rax
lea r9, str.__s___s
or r8, 0xffffffffffffffff
call r12
mov byte [rsi + rbx - 1], 0
jmp 0x14002e077
mov edi, 0x20
test r15, r15
je 0x14002e03d
mov rcx, r15
call fcn.1400797e8
lea rdi, [rax + 0x20]
mov rcx, qword [rbp]
imul rbx, rbx, 0x38
xor r8d, r8d
xor edx, edx
call fcn.140038d8b
or r8, 0xffffffffffffffff
mov rdx, rdi
mov rcx, rsi
mov qword [rsp + 0x28], rax
mov rax, qword [r14 + rbx + 8]
lea r9, [0x140098595]
mov qword [rsp + 0x20], rax
call r12
mov byte [rsi + rdi - 1], 0
mov rcx, qword [0x1401147d8]
or r8d, 0xffffffff
mov rdx, rsi
call fcn.14003ba15
mov rcx, rsi
call fcn.1400796c8
mov ecx, r13d
call fcn.14002b7ea
nop
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140035536
Capabilities:
Set file attributes

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
cmp byte [rcx], 0
mov rdi, rcx
jne 0x14003554a
xor ebx, ebx
jmp 0x1400355a7
xor eax, eax
xor edx, edx
mov r8, rcx
mov rbp, qword [0x14011c6a0]
mov qword [rsp + 0x20], rdx
or r9d, 0xffffffff
xor edx, edx
mov ecx, 0xfde9
mov dword [rsp + 0x28], eax
call rbp
mov esi, eax
cmp eax, 1
jle 0x140035546
movsxd rcx, eax
mov edx, 2
call sub.msvcrt.dll_vfprintf
mov rbx, rax
test rax, rax
je 0x140035546
or r9d, 0xffffffff
xor edx, edx
mov dword [rsp + 0x28], esi
mov r8, rdi
mov qword [rsp + 0x20], rax
mov ecx, 0xfde9
call rbp
cmp eax, esi
je 0x1400355ab
xor eax, eax
jmp 0x140035619
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_SetFileAttributesW]
test rax, rax
jne 0x140035619
mov rsi, qword [0x1400b5f50]
cmp word [rsi], 0x3f
jbe 0x1400355d4
lea rcx, [0x14009abc0]
call fcn.140038472
jmp 0x1400355a7
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [0x14011c648]
test rax, rax
je 0x140035600
movzx edx, word [rsi]
lea ecx, [rdx + 1]
mov word [rsi], cx
mov rcx, qword [0x1400b5f40]
mov qword [rcx + rdx*8], rax
jmp 0x140035619
call fcn.14003893c
mov rdx, rbx
lea rcx, [0x14009abe9]
mov r8, rax
call fcn.140038472
jmp 0x1400355a7
mov rcx, rbx
mov qword [rsp + 0x38], rax
call fcn.1400796c8
mov rax, qword [rsp + 0x38]
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x140037da3
Capabilities:
Get token membership
Query or enumerate registry key

Disassembly:
push rbx
sub rsp, 0x90
xor ecx, ecx
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystemEnableLUA
lea rbx, [rsp + 0x88]
mov dword [rsp + 0x6c], ecx
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x7a], r8d
mov r8, rbx
mov qword [rsp + 0x80], 0xffffffffffffffff
mov word [rsp + 0x7e], 0x500
call fcn.140035bd2
cmp dword [rsp + 0x88], 1
jne 0x140037e8a
lea rcx, str.Note:_UAC_is_active
call fcn.140038472
call qword [sym.imp.KERNEL32.DLL_GetUserDefaultLCID]
lea r8, [rsp + 0x80]
mov edx, 8
mov rcx, rax
call qword [0x14011c1c0]
test eax, eax
jne 0x140037e35
call fcn.14003893c
lea rcx, str.Could_not_get_current_process_token:__s
mov rdx, rax
jmp 0x140037e70
lea rax, [rsp + 0x70]
mov r9d, 4
lea r8, [rsp + 0x74]
mov rcx, qword [rsp + 0x80]
mov qword [rsp + 0x20], rax
mov edx, 0x14
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
jne 0x140037e7a
call fcn.14003893c
lea rcx, str.Could_not_get_token_information:__s
mov rdx, rax
call fcn.140038472
jmp 0x140037f02
xor eax, eax
cmp dword [rsp + 0x74], 0
setne al
mov dword [rsp + 0x6c], eax
jmp 0x140037f02
lea rcx, str.Note:_UAC_is_either_disabled_or_not_available
call fcn.140038472
xor edx, edx
mov qword [rsp + 0x50], rbx
lea rcx, [rsp + 0x7a]
mov dword [rsp + 0x48], edx
mov r9d, 0x220
mov r8d, 0x20
mov dword [rsp + 0x40], edx
mov dword [rsp + 0x38], edx
mov dword [rsp + 0x30], edx
mov dword [rsp + 0x28], edx
mov dword [rsp + 0x20], edx
mov edx, 2
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
je 0x140037f02
xor ecx, ecx
mov rdx, qword [rsp + 0x88]
lea r8, [rsp + 0x6c]
call qword [sym.imp.ADVAPI32.dll_ConvertStringSidToSidA]
test eax, eax
jne 0x140037ef4
xor eax, eax
mov dword [rsp + 0x6c], eax
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.ADVAPI32.dll_RegLoadKeyRegQueryInfoKeyA]
mov rcx, qword [rsp + 0x80]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140037f1a
call qword [sym.imp.KERNEL32.DLL_CreateDirectorCreateEventACreateFileA]
mov eax, dword [rsp + 0x6c]
add rsp, 0x90
pop rbx
ret
Function at 0x140038b6e
Capabilities:
Set file attributes

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
cmp byte [rcx], 0
mov rdi, rcx
jne 0x140038b82
xor ebx, ebx
jmp 0x140038bdf
xor eax, eax
xor edx, edx
mov r8, rcx
mov rbp, qword [0x14011c6a0]
mov qword [rsp + 0x20], rdx
or r9d, 0xffffffff
xor edx, edx
mov ecx, 0xfde9
mov dword [rsp + 0x28], eax
call rbp
mov esi, eax
cmp eax, 1
jle 0x140038b7e
movsxd rcx, eax
mov edx, 2
call sub.msvcrt.dll_vfprintf
mov rbx, rax
test rax, rax
je 0x140038b7e
or r9d, 0xffffffff
xor edx, edx
mov dword [rsp + 0x28], esi
mov r8, rdi
mov qword [rsp + 0x20], rax
mov ecx, 0xfde9
call rbp
cmp eax, esi
je 0x140038be3
xor eax, eax
jmp 0x140038c51
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_SetFileAttributesW]
test rax, rax
jne 0x140038c51
mov rsi, qword [0x1400b5f50]
cmp word [rsi], 0x3f
jbe 0x140038c0c
lea rcx, [0x14009c2a4]
call fcn.140038472
jmp 0x140038bdf
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [0x14011c648]
test rax, rax
je 0x140038c38
movzx edx, word [rsi]
lea ecx, [rdx + 1]
mov word [rsi], cx
mov rcx, qword [0x1400b5f40]
mov qword [rcx + rdx*8], rax
jmp 0x140038c51
call fcn.14003893c
mov rdx, rbx
lea rcx, [0x14009c2cd]
mov r8, rax
call fcn.140038472
jmp 0x140038bdf
mov rcx, rbx
mov qword [rsp + 0x38], rax
call fcn.1400796c8
mov rax, qword [rsp + 0x38]
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x1400393a6
Capabilities:
Copy file

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x60
mov ebx, r8d
mov edi, edx
call fcn.14003836b
xor edx, edx
mov dword [rsp + 0x44], ebx
lea r9, [rsp + 0x38]
mov rsi, rax
mov dword [rsp + 0x20], edx
lea r8, [0x140038290]
xor edx, edx
mov qword [rsp + 0x38], rax
mov eax, dword [rsp + 0xa0]
xor ecx, ecx
mov dword [rsp + 0x40], edi
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0xa8]
mov qword [rsp + 0x50], 0xffffffffffffffff
mov dword [rsp + 0x4c], eax
xor eax, eax
mov dword [rsp + 0x58], 0x3e5
mov qword [rsp + 0x28], rax
call qword [sym.imp.KERNEL32.DLL_GetConsoleWindowGetCurrentProcessId]
mov rbx, rax
test rax, rax
je 0x140039457
mov edx, dword [rsp + 0xb8]
mov rdi, qword [0x14011c7c8]
mov rcx, rax
call rdi
cmp eax, 0x102
jne 0x14003944c
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_CopyFileA]
or edx, 0xffffffff
mov rcx, rbx
call rdi
mov dword [rsp + 0x58], 0x102
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_CreateDirectorCreateEventACreateFileA]
jmp 0x140039461
call qword [sym.imp.KERNEL32.DLL_PeekNamedPipe]
mov dword [rsp + 0x58], eax
test rsi, rsi
je 0x14003946e
mov rcx, rsi
call fcn.1400796c8
mov ecx, dword [rsp + 0x58]
call qword [0x14011c730]
mov rax, qword [rsp + 0x50]
add rsp, 0x60
pop rbx
pop rsi
pop rdi
ret
Function at 0x14003b716
Capabilities:
Hide graphical window

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x60
movups xmmword [rsp + 0x50], xmm6
movss xmm6, dword [rsp + 0xc0]
mov rbx, rdx
lea r12, [rsp + 0x40]
mov rsi, rcx
mov edi, r8d
mov ebp, r9d
mov rdx, r12
mov rcx, rbx
call qword [sym.imp.USER32.dll_ShowWindow]
mov rax, qword [0x1400b69c0]
cmp dword [rax], 0
je 0x14003b762
cmp rbx, rsi
je 0x14003b762
mov eax, dword [rsp + 0x48]
jmp 0x14003b766
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x44]
mov dword [rsp + 0x3c], eax
cmp rbx, rsi
je 0x14003b785
lea rdx, [rsp + 0x38]
mov rcx, rsi
call qword [0x14011d010]
mov rdx, r12
mov rcx, rbx
call qword [sym.imp.USER32.dll_LoadCursorW]
mov rcx, rbx
call fcn.14003b6c0
mov dword [rsp + 0x28], 1
mov rcx, rbx
cvtsi2ss xmm0, dword [rsp + 0xb0]
cvtsi2ss xmm1, eax
sar rax, 0x20
mulss xmm0, xmm6
addss xmm0, xmm1
cvtsi2ss xmm1, eax
cvttss2si r9d, xmm0
add r9d, dword [rsp + 0x48]
sub r9d, dword [rsp + 0x40]
cvtsi2ss xmm0, ebp
mulss xmm0, xmm6
cvttss2si r8d, xmm0
add r8d, dword [rsp + 0x3c]
cvtsi2ss xmm0, edi
mulss xmm0, xmm6
cvttss2si edx, xmm0
add edx, dword [rsp + 0x38]
cvtsi2ss xmm0, dword [rsp + 0xb8]
mulss xmm0, xmm6
addss xmm0, xmm1
cvttss2si eax, xmm0
add eax, dword [rsp + 0x4c]
sub eax, dword [rsp + 0x44]
mov dword [rsp + 0x20], eax
call qword [0x14011cfd0]
nop
movups xmm6, xmmword [rsp + 0x50]
add rsp, 0x60
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x14003f5d4
Capabilities:
Read file on windows

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x178
lea rbx, str.CommCheck64
call qword [0x14011c5c0]
mov r12, qword [0x1400b67f0]
mov ecx, 0x41
mov rbp, rax
xor eax, eax
cmp qword [r12], 0
lea rdi, [rsp + 0x6c]
mov word [rsp + 0x4e], 0x65
lea rsi, [rsp + 0x50]
rep stosd dword [rdi], eax
lea rdi, [rsp + 0x6c]
movabs rax, 0x78652e7375667552
mov qword [rsp + 0x46], rax
je 0x14003f663
or r8, 0xffffffffffffffff
mov rcx, rsi
mov qword [rsp + 0x20], rbp
lea r9, str._I64i
mov edx, 0x18
call qword [sym.imp.msvcrt.dll_clearerr]
mov r8, qword [r12]
mov rdx, rsi
mov rcx, rbx
mov byte [rsp + 0x67], 0
call fcn.14002390e
jmp 0x14003f67e
mov r8, rsi
mov edx, 0xb
mov rcx, rbx
mov qword [rsp + 0x50], rbp
mov r9d, 8
call fcn.14003aade
mov rdx, qword [r12]
test rdx, rdx
je 0x14003f6ba
mov rcx, rbx
mov r8d, 1
xor ebx, ebx
call fcn.140023801
mov r12, rax
test rax, rax
je 0x14003f6df
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.msvcrt.dll_fseek]
mov rcx, r12
mov rbx, rax
call fcn.1400796c8
jmp 0x14003f6df
mov dword [rsp + 0x20], 8
mov rdx, rbx
mov r9, rsi
mov r8d, 0xb
mov rcx, 0xffffffff80000001
call fcn.14003acf5
mov rbx, qword [rsp + 0x50]
cmp rbp, rbx
jne 0x14003f803
call fcn.14003aecd
test eax, eax
jne 0x14003f825
mov edx, 2
mov ecx, 0x104
call sub.msvcrt.dll_vfprintf
mov r8d, 0x104
xor ecx, ecx
mov rdx, rax
mov rbp, rax
call qword [sym.imp.KERNEL32.DLL_SetDefaultDllDirectoriSetEvent]
mov r13, qword [sym.imp.KERNEL32.DLL_PeekNamedPipe]
mov r12d, eax
call r13
mov ebx, eax
test r12d, r12d
je 0x14003f762
xor eax, eax
or r9d, 0xffffffff
xor edx, edx
mov dword [rsp + 0x28], 0x104
mov qword [rsp + 0x38], rax
mov r8, rbp
mov ecx, 0xfde9
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x20], rdi
call qword [0x14011c7d0]
test eax, eax
jne 0x14003f762
call r13
mov ebx, eax
test rbp, rbp
je 0x14003f76f
mov rcx, rbp
call fcn.1400796c8
mov ecx, ebx
lea rbp, [rsp + 0x46]
call qword [0x14011c730]
mov rcx, rdi
call fcn.1400797e8
mov rcx, rbp
mov rbx, rax
call fcn.1400797e8
cmp rax, rbx
jae 0x14003f7b6
sub rbx, rax
mov rdx, rbp
lea rcx, [rdi + rbx]
call qword [sym.imp.msvcrt.dll_fread]
test eax, eax
jne 0x14003f7b6
lea rcx, str.Short_name_used___Disabling_initial_update_policy_prompt_n
call fcn.140038472
jmp 0x14003f807
lea rax, [0x14003da0f]
mov ecx, 0xbbd
mov word [rsp + 0x50], 0x6b
mov qword [rsp + 0x58], rax
call fcn.14001e8f5
mov ecx, 0xbbc
mov rbx, rax
call fcn.14001e8f5
mov qword [rsp + 0x20], rbx
xor edx, edx
mov r8, rsi
mov r9, rax
mov ecx, 3
call fcn.14003f463
test eax, eax
jne 0x14003f807
or ecx, 0xffffffff
call fcn.14003acb3
xor eax, eax
jmp 0x14003f82f
call fcn.14003aecd
test eax, eax
jne 0x14003f81c
mov ecx, 0x15180
call fcn.14003acb3
jmp 0x14003f825
call fcn.14003aecd
inc eax
je 0x14003f810
call fcn.14003be08
mov eax, 1
add rsp, 0x178
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
Function at 0x1400417b7
Capabilities:
Set file attributes

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
cmp byte [rcx], 0
mov rdi, rcx
jne 0x1400417cb
xor ebx, ebx
jmp 0x140041828
xor eax, eax
xor edx, edx
mov r8, rcx
mov rbp, qword [0x14011c6a0]
mov qword [rsp + 0x20], rdx
or r9d, 0xffffffff
xor edx, edx
mov ecx, 0xfde9
mov dword [rsp + 0x28], eax
call rbp
mov esi, eax
cmp eax, 1
jle 0x1400417c7
movsxd rcx, eax
mov edx, 2
call sub.msvcrt.dll_vfprintf
mov rbx, rax
test rax, rax
je 0x1400417c7
or r9d, 0xffffffff
xor edx, edx
mov dword [rsp + 0x28], esi
mov r8, rdi
mov qword [rsp + 0x20], rax
mov ecx, 0xfde9
call rbp
cmp eax, esi
je 0x14004182c
xor eax, eax
jmp 0x14004189a
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_SetFileAttributesW]
test rax, rax
jne 0x14004189a
mov rsi, qword [0x1400b5f50]
cmp word [rsi], 0x3f
jbe 0x140041855
lea rcx, [0x1400a6a20]
call fcn.140038472
jmp 0x140041828
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [0x14011c648]
test rax, rax
je 0x140041881
movzx edx, word [rsi]
lea ecx, [rdx + 1]
mov word [rsi], cx
mov rcx, qword [0x1400b5f40]
mov qword [rcx + rdx*8], rax
jmp 0x14004189a
call fcn.14003893c
mov rdx, rbx
lea rcx, [0x1400a6a49]
mov r8, rax
call fcn.140038472
jmp 0x140041828
mov rcx, rbx
mov qword [rsp + 0x38], rax
call fcn.1400796c8
mov rax, qword [rsp + 0x38]
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x140043979
Capabilities:
Get graphical window text

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x68
mov rbp, qword [0x1400b66d0]
mov edi, dword [0x140118dc4]
mov edx, 0x3fa
mov r13, qword [sym.imp.USER32.dll_MessageBeep]
sub edi, dword [0x140118db8]
sub edi, dword [0x140118db0]
mov ebx, ecx
mov rcx, qword [rbp]
call r13
mov rcx, qword [rbp]
mov edx, 0x3fb
mov rsi, rax
call r13
mov edx, 0xffffffec
mov rcx, rsi
mov qword [rsp + 0x40], rax
call qword [sym.imp.USER32.dll_SetWindowLongPtrW]
mov r8, rax
and r8, 0xffffffffffffefff
test ebx, ebx
je 0x1400439ed
or ah, 0x10
mov r8, rax
mov edx, 0xffffffec
mov rcx, rsi
lea r12, [rsp + 0x50]
call qword [0x14011d068]
test ebx, ebx
mov r15, qword [sym.imp.USER32.dll_ShowWindow]
mov r14, qword [0x14011cfb0]
je 0x140043a3f
mov rcx, qword [rsp + 0x40]
mov rdx, r12
call r15
mov rdx, qword [rbp]
mov r9d, 2
mov r8, r12
xor ecx, ecx
call r14
mov eax, dword [rsp + 0x58]
sub eax, dword [rsp + 0x50]
add eax, dword [0x140118db0]
sub edi, eax
mov rdx, r12
mov rcx, rsi
call r15
mov r8, r12
xor ecx, ecx
mov rdx, qword [rbp]
mov r9d, 2
call r14
mov r9d, dword [rsp + 0x54]
mov rcx, qword [rbp]
mov edx, 0x403
mov r12d, dword [rsp + 0x5c]
mov r8d, dword [0x140118db8]
add r8d, dword [0x140118dbc]
add r8d, dword [0x140118db0]
mov dword [rsp + 0x4c], r9d
sub r12d, r9d
mov dword [rsp + 0x48], r8d
call r13
mov rcx, rsi
mov dword [rsp + 0x20], edi
mov r9d, dword [rsp + 0x4c]
mov rdx, rax
xor eax, eax
mov r8d, dword [rsp + 0x48]
xor edi, edi
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], r12d
call qword [0x14011d070]
test ebx, ebx
mov rcx, rsi
mov rsi, qword [sym.imp.USER32.dll_GetWindowTextA]
setne dil
mov edx, edi
call rsi
mov rcx, qword [rsp + 0x40]
mov edx, edi
call rsi
test ebx, ebx
je 0x140043adf
mov ebx, 5
mov rcx, qword [rsp + 0x40]
mov edx, ebx
call qword [0x14011d088]
nop
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140045e22
Capabilities:
Set file attributes

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
cmp byte [rcx], 0
mov rdi, rcx
jne 0x140045e36
xor ebx, ebx
jmp 0x140045e93
xor eax, eax
xor edx, edx
mov r8, rcx
mov rbp, qword [0x14011c6a0]
mov qword [rsp + 0x20], rdx
or r9d, 0xffffffff
xor edx, edx
mov ecx, 0xfde9
mov dword [rsp + 0x28], eax
call rbp
mov esi, eax
cmp eax, 1
jle 0x140045e32
movsxd rcx, eax
mov edx, 2
call sub.msvcrt.dll_vfprintf
mov rbx, rax
test rax, rax
je 0x140045e32
or r9d, 0xffffffff
xor edx, edx
mov dword [rsp + 0x28], esi
mov r8, rdi
mov qword [rsp + 0x20], rax
mov ecx, 0xfde9
call rbp
cmp eax, esi
je 0x140045e97
xor eax, eax
jmp 0x140045f05
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_SetFileAttributesW]
test rax, rax
jne 0x140045f05
mov rsi, qword [0x1400b5f50]
cmp word [rsi], 0x3f
jbe 0x140045ec0
lea rcx, [0x1400a7070]
call fcn.140038472
jmp 0x140045e93
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [0x14011c648]
test rax, rax
je 0x140045eec
movzx edx, word [rsi]
lea ecx, [rdx + 1]
mov word [rsi], cx
mov rcx, qword [0x1400b5f40]
mov qword [rcx + rdx*8], rax
jmp 0x140045f05
call fcn.14003893c
mov rdx, rbx
lea rcx, [0x1400a7099]
mov r8, rax
call fcn.140038472
jmp 0x140045e93
mov rcx, rbx
mov qword [rsp + 0x38], rax
call fcn.1400796c8
mov rax, qword [rsp + 0x38]
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x140049592
Capabilities:
Write file on windows

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
mov r13, rcx
mov rcx, qword [0x1400b6ac0]
call fcn.14004947c
lea rcx, [0x1400a7ef0]
mov rbp, rax
call fcn.14004947c
mov edx, 2
mov ecx, 0x104
mov r12, rax
call sub.msvcrt.dll_vfprintf
xor r8d, r8d
mov rdx, r12
mov rcx, rbp
mov r9, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.DLL_WriteFile]
mov r14, qword [sym.imp.KERNEL32.DLL_PeekNamedPipe]
mov ebx, eax
call r14
mov esi, eax
test ebx, ebx
je 0x14004962f
xor eax, eax
mov dword [rsp + 0x28], 0x104
or r9d, 0xffffffff
xor edx, edx
mov qword [rsp + 0x38], rax
mov r8, rdi
mov ecx, 0xfde9
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x20], r13
call qword [0x14011c7d0]
mov ebx, eax
test eax, eax
jne 0x14004962f
call r14
mov esi, eax
test rdi, rdi
je 0x14004963c
mov rcx, rdi
call fcn.1400796c8
test r12, r12
je 0x140049649
mov rcx, r12
call fcn.1400796c8
test rbp, rbp
je 0x140049656
mov rcx, rbp
call fcn.1400796c8
mov ecx, esi
call qword [0x14011c730]
mov eax, ebx
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret