joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14023b7d0
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rsi
push rdi
push r12
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov rbp, r8
mov esi, edx
mov rbx, rcx
xor r12d, r12d
mov dword [rax + 0x20], r12d
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbx], rax
lea edi, [r12 + 1]
mov dword [rsp + 0x78], edi
mov rax, qword [rbp]
test rax, rax
je 0x14023b833
cmp byte [rax + 0x18], r12b
je 0x14023b8c4
mov qword [rsp + 0x20], r12
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, rax
lea r8, [rsp + 0x20]
mov edx, esi
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x14023b8c4
mov rax, qword [rbx]
sub edi, dword [rax - 8]
mov eax, dword [rax - 0xc]
mov edx, 0x104
sub eax, edx
or eax, edi
jge 0x14023b86e
mov rcx, rbx
call fcn.14000c998
mov rdx, qword [rbx]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
mov rcx, qword [rbx]
test rcx, rcx
jne 0x14023b889
mov eax, r12d
jmp 0x14023b896
movsxd rdx, dword [rcx - 0xc]
call fcn.1400beaac
test eax, eax
js 0x14023b8b9
mov rcx, qword [rbx]
cmp eax, dword [rcx - 0xc]
jg 0x14023b8b9
mov dword [rcx - 0x10], eax
movsxd rcx, eax
mov rax, qword [rbx]
mov word [rax + rcx*2], r12w
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
jmp 0x14023b900
mov ecx, 0x80070057
call fcn.14000cbb8
int3
mov r8, rbp
mov edx, esi
lea rcx, [rsp + 0x28]
call fcn.14023b350
nop
mov rdx, rax
mov rcx, rbx
call fcn.14000c244
nop
mov rdx, qword [rsp + 0x28]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14023b900
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, rbx
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x40
pop r12
pop rdi
pop rsi
ret
Function at 0x14023c450
Capabilities:
Query environment variable

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r15
lea rbp, [rsp - 0x150]
sub rsp, 0x250
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov rax, qword [0x14045cbf0]
xor rax, rsp
mov qword [rbp + 0x140], rax
mov r13, r8
mov rsi, rdx
mov r12, rcx
xor r15d, r15d
mov dword [rsp + 0x20], r15d
mov rcx, qword [rdx]
cmp dword [rcx - 0x10], r15d
jl 0x14023c621
lea rdx, [0x14035a040]
call fcn.1400bee84
test rax, rax
je 0x14023c621
sub rax, qword [rsi]
sar rax, 1
cmp eax, 0xffffffff
je 0x14023c621
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
lea rdi, [rax + 0x18]
mov qword [rsp + 0x20], rdi
mov rax, qword [r13]
test rax, rax
je 0x14023c501
cmp byte [rax + 0x18], r15b
jne 0x14023c501
mov rdx, rsi
lea rcx, [rsp + 0x20]
call fcn.14000c244
jmp 0x14023c5ba
mov r8d, 0x104
lea rdx, [rsp + 0x30]
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov ebx, eax
cmp eax, 0x104
jbe 0x14023c58a
test eax, eax
jns 0x14023c52d
mov ecx, 0x80070057
call fcn.14000cbb8
int3
mov edx, 1
sub edx, dword [rdi - 8]
mov eax, dword [rdi - 0xc]
sub eax, ebx
or eax, edx
jge 0x14023c54f
mov edx, ebx
lea rcx, [rsp + 0x20]
call fcn.14000c998
mov rdi, qword [rsp + 0x20]
mov r8d, ebx
mov rdx, rdi
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
movsxd rdx, dword [rdi - 0xc]
mov rcx, rdi
call fcn.1400beaac
test eax, eax
js 0x14023c57f
cmp eax, dword [rdi - 0xc]
jg 0x14023c57f
mov dword [rdi - 0x10], eax
cdqe
mov word [rdi + rax*2], r15w
jmp 0x14023c5bf
mov ecx, 0x80070057
call fcn.14000cbb8
int3
test eax, eax
jne 0x14023c596
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x14023c5bf
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x30]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
call fcn.14000c9f8
mov rdi, qword [rsp + 0x20]
cmp dword [rdi - 0x10], r15d
jl 0x14023c5f6
lea rdx, [0x14035a040]
mov rcx, rdi
call fcn.1400bee84
test rax, rax
je 0x14023c5f6
sub rax, rdi
sar rax, 1
cmp eax, 0xffffffff
jle 0x14023c5f6
mov rdx, r13
lea rcx, [rsp + 0x20]
call fcn.14023c3e0
mov rdi, qword [rsp + 0x20]
lea rdx, [rsp + 0x20]
mov rcx, r12
call fcn.14000c4d8
nop
lea rdx, [rdi - 0x18]
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x14023c62c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x14023c62c
mov rdx, rsi
mov rcx, r12
call fcn.14000c4d8
mov rax, r12
mov rcx, qword [rbp + 0x140]
xor rcx, rsp
call fcn.1400be110
add rsp, 0x250
pop r15
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x14023e4bc
Capabilities:
Get file system object information

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
push r13
push r14
lea rbp, [rax - 0x258]
sub rsp, 0x330
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x14045cbf0]
xor rax, rsp
mov qword [rbp + 0x220], rax
mov r13, rdx
mov rbx, qword [rcx]
mov rsi, qword [rcx + 8]
or r14, 0xffffffffffffffff
mov qword [rsp + 0x30], rbx
cmp rbx, rsi
je 0x14023e47c
mov ecx, 0x20
call fcn.1400be454
mov r12, rax
test rax, rax
je 0x14023e330
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
add rax, 0x18
mov qword [r12], rax
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
add rax, 0x18
mov qword [r12 + 8], rax
and qword [r12 + 0x18], 0
jmp 0x14023e333
xor r12d, r12d
mov qword [rsp + 0x38], r12
and qword [rsp + 0x40], 0
mov rdx, r12
lea rcx, [rsp + 0x48]
call fcn.140063aac
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rax]
mov qword [rsp + 0x40], rcx
mov qword [rax], rdx
mov rdi, qword [rsp + 0x48]
test rdi, rdi
je 0x14023e396
mov eax, r14d
lock xadd dword [rdi + 8], eax
add eax, r14d
jne 0x14023e391
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, r14d
lock xadd dword [rdi + 0xc], eax
add eax, r14d
jne 0x14023e391
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x10]
mov rbx, qword [rsp + 0x30]
mov r8, r12
mov rdx, r12
lea rcx, [rsp + 0x38]
call fcn.1400020a0
nop
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14023e425
mov rdx, rbx
call fcn.14000c244
xor edx, edx
mov r8d, 0x2b8
lea rcx, [rsp + 0x60]
call fcn.1400c7360
mov rdi, qword [rsp + 0x38]
mov dword [rsp + 0x20], 0x4201
mov r9d, 0x2b8
lea r8, [rsp + 0x60]
xor edx, edx
mov rcx, qword [rbx]
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov qword [rdi + 0x18], rax
mov r9, qword [rsp + 0x38]
xor eax, eax
mov rcx, r14
lea rdi, [rsp + 0x70]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [rsp + 0x70]
lea rcx, [r9 + 8]
call fcn.14000c9f8
mov edx, dword [rsp + 0x68]
mov rax, qword [rsp + 0x38]
mov dword [rax + 0x10], edx
test r13, r13
je 0x14023e438
lea rdx, [rsp + 0x38]
mov rcx, r13
call fcn.1400356a4
nop
mov rdi, qword [rsp + 0x40]
test rdi, rdi
je 0x14023e473
mov eax, r14d
lock xadd dword [rdi + 8], eax
add eax, r14d
jne 0x14023e46e
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, r14d
lock xadd dword [rdi + 0xc], eax
add eax, r14d
jne 0x14023e46e
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x10]
mov rbx, qword [rsp + 0x30]
add rbx, 8
jmp 0x14023e2d5
mov rcx, qword [rbp + 0x220]
xor rcx, rsp
call fcn.1400be110
lea r11, [rsp + 0x330]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rbp
ret
mov rcx, rdx
mov rdx, r8
jmp 0x14023e28c
Function at 0x14023e87c
Capabilities:
Get disk information

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov rax, qword [0x14045cbf0]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rdi, rcx
movabs rax, 0x5c003a0041
mov qword [rsp + 0x38], rax
call sub.KERNEL32.dll_GetLogicalDrives
mov ebx, eax
test eax, eax
je 0x14023e946
lea rcx, section..data
mov rdx, qword [section..data]
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rsp + 0x28], rax
test bl, 1
je 0x14023e91d
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x20]
call fcn.14000cb18
nop
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.140038190
nop
mov rdx, qword [rsp + 0x20]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14023e91d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
inc word [rsp + 0x38]
shr ebx, 1
jne 0x14023e8da
mov rdx, qword [rsp + 0x28]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14023e946
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400be110
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
mov rcx, rdx
jmp 0x14023e87c

Function at 0x14023e96c
Capabilities:
Get disk information

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov rax, qword [0x14045cbf0]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rdi, rcx
movabs rax, 0x5c003a0041
mov qword [rsp + 0x38], rax
call sub.KERNEL32.dll_GetLogicalDrives
mov ebx, eax
test eax, eax
je 0x14023e946
lea rcx, section..data
mov rdx, qword [section..data]
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rsp + 0x28], rax
test bl, 1
je 0x14023e91d
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x20]
call fcn.14000cb18
nop
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.140038190
nop
mov rdx, qword [rsp + 0x20]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14023e91d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
inc word [rsp + 0x38]
shr ebx, 1
jne 0x14023e8da
mov rdx, qword [rsp + 0x28]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14023e946
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400be110
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
mov rcx, rdx
jmp 0x14023e87c
Function at 0x14023eb8c
Capabilities:
Get file version info

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x30
mov rsi, rcx
mov ecx, r8d
mov ebx, r8d
mov rdi, rdx
call fcn.1400b9290
mov r8d, ebx
xor edx, edx
mov rcx, rdi
mov r9, rax
mov qword [rsi + 0x40], rax
call qword [sym.imp.VERSION.dll_GetFileVersionInfoW]
xor ebx, ebx
test eax, eax
jne 0x14023ebc4
xor eax, eax
jmp 0x14023ec33
mov rcx, qword [rsi + 0x40]
lea r9, [rsp + 0x20]
lea r8, [rsp + 0x28]
lea rdx, [0x140352420]
call qword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x14023ebc0
mov rdx, qword [rsp + 0x28]
lea rcx, [rsi + 8]
mov r8d, 0x34
call fcn.1400be580
mov rcx, qword [rsi + 0x40]
lea r9, [rsp + 0x20]
lea r8, [rsp + 0x28]
lea rdx, str.VarFileInfoTranslation
call qword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x14023ec27
cmp dword [rsp + 0x20], 4
jb 0x14023ec27
mov rcx, qword [rsp + 0x28]
mov edx, dword [rcx]
mov dword [rsi + 0x48], edx
cmp dword [rsi + 8], 0xfeef04bd
sete bl
mov eax, ebx
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
Function at 0x14023f62c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
lea rbx, [rcx + 0x48]
lea r8, str.ccleaner.ini
mov rdx, rbx
lea rcx, [rsp + 0x40]
call fcn.14001c3e0
nop
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne al
test al, al
jne 0x14023f6bd
lea r8, str.portable.dat
mov rdx, rbx
lea rcx, [rsp + 0x48]
call fcn.14001c3e0
nop
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.14000c244
nop
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14023f6ac
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne al
movzx ebx, al
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x14023f6e1
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov eax, ebx
add rsp, 0x30
pop rbx
ret
Function at 0x14023fbcc
Capabilities:
Delete file

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp - 0x40], 0xfffffffffffffffe
mov qword [rax + 0x20], rbx
mov rdi, rcx
and qword [rcx + 0x38], 0
mov rbx, qword [rcx + 0x40]
and qword [rcx + 0x40], 0
or esi, 0xffffffff
test rbx, rbx
je 0x14023fc26
mov eax, esi
lock xadd dword [rbx + 8], eax
add eax, esi
jne 0x14023fc26
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, esi
lock xadd dword [rbx + 0xc], eax
add eax, esi
jne 0x14023fc26
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x10]
and qword [rdi + 0x28], 0
mov rbx, qword [rdi + 0x30]
and qword [rdi + 0x30], 0
test rbx, rbx
je 0x14023fc61
mov eax, esi
lock xadd dword [rbx + 8], eax
add eax, esi
jne 0x14023fc61
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, esi
lock xadd dword [rbx + 0xc], eax
add eax, esi
jne 0x14023fc61
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x10]
lea rdx, [rdi + 0x48]
lea r8, str.ccleaner.ini
lea rcx, [rbp + 0x30]
call fcn.14001c3e0
nop
mov rcx, qword [rbp + 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rdx, str.SoftwarePiriform_
lea rcx, [rbp + 0x28]
call fcn.14000cb18
nop
mov r8d, 8
lea rdx, [0x14034ee68]
lea rcx, [rbp + 0x28]
call fcn.14000c0c4
and qword [rbp - 0x30], 0
and dword [rbp - 0x28], 0
and qword [rbp - 0x20], 0
lea rax, vtable.Piriform::Registry::CRegKeyEx.0
mov qword [rbp - 0x38], rax
or eax, 0xffffffff
mov dword [rbp - 0x18], eax
mov dword [rbp - 0x14], eax
and dword [rbp - 0x10], 0
and dword [rbp + 0x20], 0
xor r9d, r9d
lea r8, [rbp + 0x20]
mov rdx, qword [rbp + 0x28]
mov rcx, 0xffffffff80000001
call fcn.1402246a8
mov rbx, qword [rdi]
mov rcx, rdi
call qword [rbx + 0x38]
mov edx, eax
mov rcx, rdi
call qword [rbx + 0x30]
nop
lea rcx, [rbp - 0x38]
call fcn.140224148
nop
mov rdx, qword [rbp + 0x28]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, esi
test eax, eax
jg 0x14023fd23
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp + 0x30]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, esi
test eax, eax
jg 0x14023fd41
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x98]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
Function at 0x14024141c
Capabilities:
Identify system language via api

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov r9, qword [rdi]
mov rdx, rbx
mov rcx, rdi
movzx r8d, ax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [r9 + 0x48]

Function at 0x140241b5c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
lea rbp, [rax - 0x798]
sub rsp, 0x880
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rax, qword [0x14045cbf0]
xor rax, rsp
mov qword [rbp + 0x770], rax
mov edi, edx
mov rbx, rcx
mov qword [rsp + 0x48], rcx
and dword [rsp + 0x40], 0
mov r8d, 0x104
lea rdx, [rbp + 0x160]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea r11, [rbp + 0x570]
mov qword [rsp + 0x20], r11
lea r9, [rbp + 0x370]
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x58]
lea rcx, [rbp + 0x160]
call fcn.1400bf224
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbx], rax
mov dword [rsp + 0x40], 1
lea r12, [0x140357e60]
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], edi
lea rax, str.langlang_
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x60]
lea r8, [rsp + 0x58]
lea rdx, str._s_s_s_d_s
mov rcx, rbx
call fcn.14000d9c8
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140241c8d
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], edi
lea rax, str.lang_
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x60]
lea r8, [rsp + 0x58]
lea rdx, str._s_s_s_d_s
mov rcx, rbx
call fcn.14000d9c8
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140241c8d
xor r8d, r8d
lea rdx, [0x140330de8]
mov rcx, rbx
call fcn.14000c9f8
mov rax, rbx
mov rcx, qword [rbp + 0x770]
xor rcx, rsp
call fcn.1400be110
mov rbx, qword [rsp + 0x8b0]
add rsp, 0x880
pop r12
pop rdi
pop rbp
ret

Function at 0x14024304c
Capabilities:
Enumerate gui resources

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0xa0
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
lea rcx, [rax - 0x68]
call fcn.1402e2ed0
nop
mov qword [rsp + 0x28], rbx
and qword [rsp + 0x20], 0
mov r9, rdi
mov r8, rsi
xor edx, edx
lea rcx, [rsp + 0x40]
call fcn.1402e3b90
mov rdx, rsi
lea rcx, [0x140242d8c]
call qword [sym.imp.USER32.dll_EnumWindows]
nop
lea rcx, [rsp + 0x40]
call fcn.1402e2e50
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret

Function at 0x1402430dc
Capabilities:
Enumerate gui resources

Disassembly:
push rbx
sub rsp, 0xa0
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rbx, rcx
lea rcx, [rsp + 0x40]
call fcn.1402e2ed0
nop
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x40]
call fcn.1402e3b90
mov rdx, rbx
lea rcx, [0x140242d8c]
call qword [sym.imp.USER32.dll_EnumWindows]
nop
lea rcx, [rsp + 0x40]
call fcn.1402e2e50
add rsp, 0xa0
pop rbx
ret
Function at 0x140244764
Capabilities:
Get system information on windows

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.GetNativeSystemInfo
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rbx + 0x128]
test rax, rax
je 0x14024479e
add rsp, 0x20
pop rbx
jmp rax
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_GetSystemInfo]

Function at 0x1402447b4
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov dword [rcx + 0xc], 0x11c
add rcx, 0xc
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x1402447e7
lea rcx, [rbx + 0xc]
mov dword [rbx + 0xc], VarUI4FromDisp
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rbx + 0x10], 6
jne 0x140244803
cmp dword [rbx + 0x14], 2
jne 0x140244803
call fcn.140244674
test eax, eax
je 0x140244803
mov dword [rbx + 0x14], 3
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1402494bc
Capabilities:
Get session information
Get session user name

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
sub rsp, 0x40
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov edi, edx
mov rsi, rcx
xor ebx, ebx
mov dword [rsp + 0x70], ebx
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsi], rax
mov dword [rsp + 0x70], 1
mov dword [rsp + 0x78], ebx
mov qword [rsp + 0x30], rbx
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
lea r8d, [rbx + 5]
mov edx, edi
xor ecx, ecx
call qword [sym.imp.WTSAPI32.dll_WTSQuerySessionInformationW]
test eax, eax
je 0x140249558
mov rdx, qword [rsp + 0x30]
test rdx, rdx
je 0x140249542
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea ebx, [rcx - 1]
mov r8d, ebx
mov rcx, rsi
call fcn.14000c9f8
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
mov rax, rsi
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x14024956c
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x48
mov qword [rbp - 0x28], 0xfffffffffffffffe
mov rbx, rcx
xor esi, esi
mov dword [rbp + 0x30], esi
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbx], rax
lea r9d, [rsi + 1]
mov dword [rbp + 0x30], r9d
mov r8d, 0x106
mov rdx, rbx
lea rcx, [rbp - 0x20]
call fcn.14000bd14
mov r8d, 0x104
mov rdx, qword [rax + 8]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, dword [rbp - 0x10]
mov rdi, qword [rbp - 0x20]
cmp eax, 0xffffffff
jne 0x1402495f1
mov rcx, qword [rdi]
test rcx, rcx
jne 0x1402495e8
mov eax, esi
jmp 0x1402495f9
movsxd rdx, dword [rcx - 0xc]
call fcn.1400beaac
test eax, eax
js 0x1402496bb
mov rcx, qword [rdi]
cmp eax, dword [rcx - 0xc]
jg 0x1402496bb
mov dword [rcx - 0x10], eax
movsxd rcx, eax
mov rax, qword [rdi]
mov word [rax + rcx*2], si
lea rdx, [0x14034e5f0]
mov rcx, qword [rbx]
call qword [sym.imp.SHLWAPI.dll_PathMatchSpecW]
test eax, eax
je 0x1402496b6
mov rdx, rbx
lea rcx, [rbp + 0x40]
call fcn.14000c4d8
nop
lea r8, [0x14034e600]
lea rdx, [0x14034e608]
lea rcx, [rbp + 0x40]
call fcn.14000b658
mov rdx, qword [rbp + 0x40]
lea rcx, [rbp + 0x38]
call fcn.14000cb18
nop
mov rcx, qword [rbp + 0x38]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x140249677
lea rdx, [rbp + 0x38]
mov rcx, rbx
call fcn.14000c244
nop
mov rdx, qword [rbp + 0x38]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140249697
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp + 0x40]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1402496b6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, rbx
jmp 0x1402496c6
mov ecx, 0x80070057
call fcn.14000cbb8
nop
add rsp, 0x48
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x14024997c
Capabilities:
Check os version

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x298]
sub rsp, 0x390
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rdi
mov rax, qword [0x14045cbf0]
xor rax, rsp
mov qword [rbp + 0x280], rax
mov rdi, rcx
mov ebx, 1
and dword [rsp + 0x28], 0
mov dword [rsp + 0x50], VarUI4FromDisp
xor edx, edx
mov r8d, VarUI4FromDisp
lea rcx, [rsp + 0x54]
call fcn.1400c7360
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x140249b0d
cmp dword [rsp + 0x54], 6
jb 0x140249b0d
and qword [rsp + 0x30], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0x30]
lea edx, [rbx + 7]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x140249b0d
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x28]
call fcn.140269850
test eax, eax
js 0x140249b0d
cmp dword [rsp + 0x28], 0
jne 0x140249b0d
mov rdx, rdi
lea rcx, [rsp + 0x20]
call fcn.14000cb18
nop
mov rax, qword [rsp + 0x20]
cmp dword [rax - 0x10], 0
je 0x140249a69
mov r8d, ebx
lea rdx, [0x14034da64]
lea rcx, [rsp + 0x20]
call fcn.14000c0c4
mov r8d, 4
lea rdx, str._uac
lea rcx, [rsp + 0x20]
call fcn.14000c0c4
lea rcx, [rsp + 0x20]
call fcn.1402496dc
test al, al
jne 0x140249aea
and qword [rsp + 0x38], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0x38]
mov edx, 8
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x140249aec
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x2c]
call fcn.1402698d0
test eax, eax
js 0x140249aec
cmp dword [rsp + 0x2c], ebx
je 0x140249aec
mov r8d, 0x104
lea rdx, [rbp + 0x70]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov rdx, qword [rsp + 0x20]
lea rcx, [rbp + 0x70]
call fcn.140269930
xor bl, bl
mov rdx, qword [rsp + 0x20]
add rdx, 0xffffffffffffffe8
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x140249b0d
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov al, bl
mov rcx, qword [rbp + 0x280]
xor rcx, rsp
call fcn.1400be110
lea r11, [rsp + 0x390]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret