joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10002ac80
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov rcx, qword [rcx]
mov rbx, rdx
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov ecx, 1
lea edi, [rax + 1]
mov rax, qword [rbx]
sub ecx, dword [rax - 8]
mov eax, dword [rax - 0xc]
sub eax, edi
or ecx, eax
jge 0x10002acbf
mov edx, edi
mov rcx, rbx
call fcn.10001d63c
mov rdx, qword [rbx]
mov rcx, qword [rsi]
mov r8d, edi
call qword [sym.imp.USER32.dll_GetWindowTextW]
xor edx, edx
mov r11d, eax
mov ecx, eax
cmp eax, 0xffffffff
jne 0x10002acf5
mov rdi, qword [rbx]
cmp rdi, rdx
jne 0x10002ace6
mov ecx, edx
jmp 0x10002acf9
or rcx, 0xffffffffffffffff
xor eax, eax
repne scasw ax, word [rdi]
not rcx
dec rcx
cmp ecx, edx
jl 0x10002ad21
mov rax, qword [rbx]
cmp ecx, dword [rax - 0xc]
jg 0x10002ad21
mov rsi, qword [rsp + 0x38]
mov dword [rax - 0x10], ecx
mov rax, qword [rbx]
mov rbx, qword [rsp + 0x30]
movsxd rcx, ecx
mov word [rax + rcx*2], dx
mov eax, r11d
add rsp, 0x20
pop rdi
ret
mov ecx, 0x80070057
call fcn.10001db00
int3

Function at 0x10002c6bc
Capabilities:
Get graphical window text

Disassembly:
push r12
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x58], rdi
mov rsi, rdx
mov rdi, rcx
xor ebx, ebx
mov rcx, rdx
call fcn.10002d50c
mov rcx, rdi
call qword [sym.imp.USER32.dll_IsWindow]
cmp eax, ebx
je 0x10002c773
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea r12d, [rax + 1]
mov rax, qword [rsi]
lea ecx, [rbx + 1]
sub ecx, dword [rax - 8]
mov eax, dword [rax - 0xc]
sub eax, r12d
or eax, ecx
jge 0x10002c722
mov edx, r12d
mov rcx, rsi
call fcn.10001d63c
mov r8d, r12d
mov rdx, qword [rsi]
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov r11, qword [rsi]
cmp r11, rbx
jne 0x10002c73d
mov ecx, ebx
jmp 0x10002c753
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, r11
repne scasw ax, word [rdi]
not rcx
dec rcx
cmp ecx, ebx
jl 0x10002c769
cmp ecx, dword [r11 - 0xc]
jg 0x10002c769
mov dword [r11 - 0x10], ecx
movsxd rcx, ecx
mov rax, qword [rsi]
mov word [rax + rcx*2], bx
jmp 0x10002c778
mov ecx, 0x80070057
call fcn.10001db00
mov ebx, 0x80070057
jmp 0x10002c77e
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r12
ret
Function at 0x10002d23c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x20
mov r13, rcx
mov r12d, edx
lea rcx, [0x1000c69f0]
xor edx, edx
xor ebx, ebx
call fcn.10009dc68
lea r14d, [rbx + 1]
mov ebp, r14d
jmp 0x10002d322
test rbx, rbx
jne 0x10002d32e
mov eax, r12d
lea edx, [rbx + 6]
xor r9d, r9d
shr eax, 4
mov rcx, rsi
add ax, r14w
movzx r8d, ax
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
mov rbx, rax
test rax, rax
je 0x10002d311
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x10002d2be
xor ebx, ebx
jmp 0x10002d30c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
test rax, rax
je 0x10002d2ba
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, r12d
mov r11d, eax
add r11, rdi
and ecx, 0xf
jbe 0x10002d2fb
cmp rdi, r11
jae 0x10002d2ba
add ecx, 0xffffffff
movzx eax, word [rdi]
lea rdi, [rdi + rax*2 + 2]
jne 0x10002d2e9
cmp rdi, r11
jae 0x10002d2ba
movzx eax, word [rdi]
neg ax
sbb rbx, rbx
and rbx, rdi
test rbx, rbx
jne 0x10002d330
lea rcx, [0x1000c69f0]
mov edx, ebp
call fcn.10009dc68
add ebp, r14d
mov rsi, rax
test rax, rax
jne 0x10002d27b
xor esi, esi
test rsi, rsi
jne 0x10002d339
xor eax, eax
jmp 0x10002d347
mov r8d, r12d
mov rdx, rsi
mov rcx, r13
call fcn.10002d36c
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop r13
pop r12
ret
Function at 0x10002d36c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x20
mov eax, r8d
mov rbp, rdx
mov r14d, 1
shr eax, 4
mov ebx, r8d
mov rsi, rcx
add ax, r14w
lea r8d, [r14 + 5]
mov rcx, rbp
movzx edx, ax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
xor r13d, r13d
mov r12, rax
cmp rax, r13
je 0x10002d4e2
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
cmp rax, r13
je 0x10002d4e2
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
cmp rax, r13
je 0x10002d4e2
mov rdx, r12
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r11d, eax
add r11, rdi
and ebx, 0xf
jbe 0x10002d418
cmp rdi, r11
jae 0x10002d4e2
add ebx, 0xffffffff
movzx eax, word [rdi]
lea rdi, [rdi + rax*2 + 2]
jne 0x10002d402
cmp rdi, r11
jae 0x10002d4e2
cmp word [rdi], r13w
je 0x10002d4e2
mov rax, qword [rsi]
movzx ebx, word [rdi]
mov ecx, r14d
sub ecx, dword [rax - 8]
mov eax, dword [rax - 0xc]
sub eax, ebx
or ecx, eax
jge 0x10002d44a
mov edx, ebx
mov rcx, rsi
call fcn.10001d63c
movzx ecx, word [rdi]
lea r8, [rdi + 2]
cmp ecx, 0xffffffff
jne 0x10002d46b
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r8
repne scasw ax, word [rdi]
not rcx
sub rcx, r14
add ecx, r14d
movsxd r9, ecx
mov rcx, qword [rsi]
lea rdi, [rbx + rbx]
mov rdx, rdi
add r9, r9
call sub.msvcrt.dll_memcpy_s
cmp eax, r13d
je 0x10002d4ba
cmp eax, 0xc
je 0x10002d4af
cmp eax, 0x16
je 0x10002d4a4
cmp eax, 0x22
je 0x10002d4a4
cmp eax, 0x50
je 0x10002d4ba
mov ecx, 0x80004005
call fcn.10001db00
int3
mov ecx, 0x80070057
call fcn.10001db00
int3
mov ecx, 0x8007000e
call fcn.10001db00
int3
cmp ebx, r13d
jl 0x10002d4d7
mov rcx, qword [rsi]
cmp ebx, dword [rcx - 0xc]
jg 0x10002d4d7
mov dword [rcx - 0x10], ebx
mov rcx, qword [rsi]
mov eax, r14d
mov word [rdi + rcx], r13w
jmp 0x10002d4e4
mov ecx, 0x80070057
call fcn.10001db00
int3
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop r13
pop r12
ret

Function at 0x10002d97c
Capabilities:
Get geographical location
Identify system language via api

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x1000c2110]
xor rax, rsp
mov qword [rsp + 0x40], rax
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
xor ebx, ebx
cmp ax, bx
je 0x10002d9c7
lea r9d, [rbx + 0x10]
lea r8, [rsp + 0x20]
lea edx, [rbx + 0x58]
movzx ecx, ax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
cmp eax, ebx
je 0x10002d9c7
mov eax, 0x800
test word [rsp + 0x2e], ax
je 0x10002d9c7
mov al, 1
jmp 0x10002d9c9
xor al, al
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.10009d3a0
add rsp, 0x50
pop rbx
ret
Function at 0x10002d9e4
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x270
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rax, qword [0x1000c2110]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rbx, rdx
mov rdi, rcx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x24]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x10002daf6
lea rcx, [0x1000c2120]
mov rax, qword [0x1000c2120]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x30], rax
lea rcx, [0x1000c2120]
mov rax, qword [0x1000c2120]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x38], rax
lea r9, [0x100005290]
lea r8, [rsp + 0x50]
lea rdx, [0x1000062e0]
lea rcx, [rsp + 0x30]
call fcn.10002ece4
mov r8, rbx
lea rdx, [0x1000062f0]
lea rcx, [rsp + 0x38]
call fcn.10002ece4
mov rbx, qword [rsp + 0x38]
mov r8, rbx
mov rdx, qword [rsp + 0x30]
mov rcx, rdi
call fcn.10002db20
mov edi, eax
lea rdx, [rbx - 0x18]
or ebx, 0xffffffff
mov ecx, ebx
lock xadd dword [rdx + 0x10], ecx
add ecx, ebx
test ecx, ecx
jg 0x10002dad3
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
nop
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, ebx
test eax, eax
jg 0x10002daf2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, edi
jmp 0x10002daf8
xor eax, eax
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.10009d3a0
mov rbx, qword [rsp + 0x290]
add rsp, 0x270
pop rdi
ret

Function at 0x10002db20
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r12
sub rsp, 0x90
xor r12d, r12d
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
cmp r8, r12
je 0x10002db4f
cmp word [r8], r12w
jne 0x10002db52
mov rbx, r12
xor edx, edx
lea rcx, [rsp + 0x20]
lea r8d, [rdx + 0x70]
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x70
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x40], rbx
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov ebx, eax
cmp eax, r12d
jne 0x10002dbc1
call fcn.10007ec64
mov rcx, qword [0x1000c3470]
lea rdx, [0x1000c3470]
cmp rcx, rdx
je 0x10002dbc1
test byte [rcx + 0x1c], 1
je 0x10002dbc1
mov rcx, qword [rcx + 0x10]
lea r8, [0x100005270]
mov edx, 0xa
mov r9d, eax
call fcn.100040094
lea r11, [rsp + 0x90]
mov eax, ebx
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop r12
ret
Function at 0x10002df80
Capabilities:
Get geographical location

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x1000c2110]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rbp, qword [rsp + 0x90]
xor edi, edi
mov rsi, r8
lea ebx, [rdi + 0x10]
lea r8, [r11 - 0x30]
lea edx, [rdi + 0x58]
mov r9d, ebx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
cmp eax, edi
je 0x10002e03e
mov eax, 0x800
test word [rsp + 0x46], ax
je 0x10002e03e
lea r9d, [rdi + 2]
lea r8, [rsp + 0x30]
mov edx, 0x20001009
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
cmp eax, edi
je 0x10002e03e
mov ecx, 0x400
lea edi, [rbx - 0xf]
call qword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
mov ecx, 0x3ff
and ax, cx
cmp ax, 0xd
jne 0x10002e018
cmp dword [rsp + 0x30], 8
jmp 0x10002e037
mov eax, dword [rsp + 0x30]
cmp eax, edi
je 0x10002e039
cmp eax, 6
je 0x10002e039
cmp eax, 0x17
je 0x10002e039
cmp eax, 0xa
je 0x10002e039
cmp eax, 0xb
je 0x10002e039
cmp eax, 0xc
jne 0x10002e03e
mov ebx, 0x20
mov eax, dword [rsp + 0x98]
or edi, ebx
xor r9d, r9d
mov dword [rsp + 0x28], eax
mov r8, rsi
mov ecx, 0x400
mov edx, edi
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_GetDateFormatW]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.10009d3a0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x10002eb24
Capabilities:
Get common file path

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x2a0
mov rax, qword [0x1000c2110]
xor rax, rsp
mov qword [rsp + 0x290], rax
xor r14d, r14d
mov r13, r8
mov rsi, rcx
mov r12d, edx
lea rcx, [rsp + 0x48]
lea r8d, [r14 + 0x38]
xor edx, edx
mov rbp, r9
mov qword [rsp + 0x40], r14
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x82]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x80], r14w
call sub.msvcrt.dll_memset
mov qword [rsp + 0x30], r14
mov rdi, r14
cmp rbp, r14
jne 0x10002eba1
mov ebx, 0x80070057
jmp 0x10002ec93
xor r9d, r9d
lea rax, [rsp + 0x30]
xor r8d, r8d
lea edx, [r9 + 0x11]
mov rcx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderLocation]
cmp eax, r14d
mov ebx, eax
jl 0x10002ec75
mov rax, qword [rsp + 0x30]
mov ecx, 0x420b
cmp r12d, r14d
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x50], rax
mov eax, 0x20b
mov qword [rsp + 0x58], r13
cmovne eax, ecx
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x60], eax
call qword [sym.imp.SHELL32.dll_SHBrowseForFolderW]
mov rdi, rax
cmp rax, r14
jne 0x10002ec18
mov ebx, 1
jmp 0x10002ec75
lea rdx, [rsp + 0x80]
mov rcx, rax
call qword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
cmp eax, r14d
jne 0x10002ec63
mov ebx, 0x800700a1
mov rcx, qword [0x1000c3470]
lea rax, [0x1000c3470]
cmp rcx, rax
je 0x10002ec75
test byte [rcx + 0x1c], 1
je 0x10002ec75
mov rcx, qword [rcx + 0x10]
lea r8, [0x100005270]
mov edx, 0x12
call fcn.10001ea00
jmp 0x10002ec75
lea rdx, [rsp + 0x80]
mov rcx, rbp
call fcn.10002bba4
mov ebx, eax
mov rcx, qword [rsp + 0x30]
cmp rcx, r14
je 0x10002ec85
call qword [sym.imp.ole32.dll_CoTaskMemFree]
cmp rdi, r14
je 0x10002ec93
mov rcx, rdi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, ebx
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.10009d3a0
add rsp, 0x2a0
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x10002eda0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
xor ebx, ebx
mov rsi, rdx
mov rdi, rcx
cmp dword [rcx + 0x2c], ebx
jne 0x10002edcb
mov ebx, 1
jmp 0x10002ef01
movzx edx, r8w
lea r8, [0x100006300]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbp, rax
cmp rax, rbx
jne 0x10002ee1c
call fcn.10007ec64
mov dword [rdi + 0x2c], eax
mov ebx, eax
mov rcx, qword [0x1000c3470]
lea rax, [0x1000c3470]
cmp rcx, rax
je 0x10002ef01
test byte [rcx + 0x1c], 1
je 0x10002ef01
mov edx, 0xa
jmp 0x10002ee9e
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov qword [rdi + 8], rax
cmp rax, rbx
jne 0x10002ee63
call fcn.10007ec64
mov dword [rdi + 0x2c], eax
mov ebx, eax
mov rcx, qword [0x1000c3470]
lea rax, [0x1000c3470]
cmp rcx, rax
je 0x10002ef01
test byte [rcx + 0x1c], 1
je 0x10002ef01
mov edx, SafeArrayDestroy
jmp 0x10002ee9e
mov rdx, rbp
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [rdi + 0x10], eax
cmp eax, ebx
jne 0x10002eea3
call fcn.10007ec64
mov dword [rdi + 0x2c], eax
mov ebx, eax
mov rcx, qword [0x1000c3470]
lea rax, [0x1000c3470]
cmp rcx, rax
je 0x10002ef01
test byte [rcx + 0x1c], 1
je 0x10002ef01
mov edx, SafeArrayDestroy
mov r9d, ebx
jmp 0x10002eee1
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [rdi + 0x18], rax
cmp rax, rbx
jne 0x10002eef3
mov r9d, 0x80004003
mov dword [rdi + 0x2c], r9d
mov ebx, r9d
mov rcx, qword [0x1000c3470]
lea rax, [0x1000c3470]
cmp rcx, rax
je 0x10002ef01
test byte [rcx + 0x1c], 1
je 0x10002ef01
mov edx, SafeArrayDestroy
mov rcx, qword [rcx + 0x10]
lea r8, [0x1000052e8]
call fcn.100040094
jmp 0x10002ef01
mov qword [rdi + 0x20], rax
mov dword [rdi + 0x28], 1
mov dword [rdi + 0x2c], ebx
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x10002f32c
Capabilities:
Get disk size

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r14
sub rsp, 0x90
mov r12, rdx
mov rbp, rcx
mov rcx, qword [0x1000c3470]
lea r14, [0x1000c3470]
cmp rcx, r14
je 0x10002f37b
test byte [rcx + 0x1c], 4
je 0x10002f37b
mov rcx, qword [rcx + 0x10]
lea r8, [0x100005260]
mov edx, 0xa
mov r9, rbp
call fcn.10001ae7c
and qword [rsp + 0x30], 0
lea rdx, [0x1000063e8]
lea rcx, [rsp + 0x30]
mov r8, rbp
call fcn.10007fed0
mov ebx, eax
test eax, eax
jns 0x10002f3b2
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x10002f3ab
call qword [sym.imp.msvcrt.dll_free]
mov eax, ebx
jmp 0x10002f583
mov rbx, qword [rsp + 0x30]
mov rcx, rbx
call fcn.10007f9a0
mov edi, eax
test eax, eax
jns 0x10002f3da
test rbx, rbx
je 0x10002f3d3
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_free]
mov eax, edi
jmp 0x10002f583
and qword [rsp + 0x38], 0
lea rcx, [rsp + 0x38]
mov rdx, rbx
call fcn.10007fef8
mov edi, eax
test eax, eax
jns 0x10002f405
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x10002f3c5
call qword [sym.imp.msvcrt.dll_free]
jmp 0x10002f3c5
mov rdi, qword [rsp + 0x38]
lea rcx, [rsp + 0x50]
mov rdx, rdi
call fcn.100080284
mov esi, eax
test eax, eax
js 0x10002f565
mov eax, dword [rsp + 0x58]
sub eax, 0x50000
je 0x10002f48a
sub eax, 1
je 0x10002f47d
sub eax, 1
je 0x10002f470
cmp eax, 0xfffe
je 0x10002f463
test rdi, rdi
je 0x10002f44b
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_free]
test rbx, rbx
je 0x10002f459
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_free]
mov eax, 0x80070032
jmp 0x10002f583
mov dword [rsp + 0xd0], 4
jmp 0x10002f495
mov dword [rsp + 0xd0], 3
jmp 0x10002f495
mov dword [rsp + 0xd0], 2
jmp 0x10002f495
mov dword [rsp + 0xd0], 1
and dword [rsp + 0xd8], 0
lea r8, [rsp + 0x48]
xor r9d, r9d
xor edx, edx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
jne 0x10002f4ed
call fcn.10007ec64
mov rcx, qword [0x1000c3470]
cmp rcx, r14
je 0x10002f4e7
test byte [rcx + 0x1c], 2
je 0x10002f4e7
mov rcx, qword [rcx + 0x10]
lea r8, [0x100005260]
mov edx, SafeArrayDestroy
mov r9, rbp
mov dword [rsp + 0x20], eax
call fcn.10002f224
and qword [rsp + 0x48], 0
and qword [rsp + 0x40], 0
lea rax, [rsp + 0x48]
lea r9, [rsp + 0xd8]
lea r8, [rsp + 0xd0]
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x20], rax
call fcn.10002fe74
mov esi, eax
test eax, eax
jns 0x10002f55c
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x10002f565
or r8d, 0xffffffff
lock xadd dword [rcx + 8], r8d
dec r8d
test r8d, r8d
jg 0x10002f550
mov rcx, qword [rsp + 0x40]
mov edx, 1
mov rax, qword [rcx]
call qword [rax]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
jmp 0x10002f565
mov rax, qword [rsp + 0x40]
mov qword [r12], rax
test rdi, rdi
je 0x10002f573
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_free]
test rbx, rbx
je 0x10002f581
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_free]
mov eax, esi
mov rbx, qword [rsp + 0xc8]
add rsp, 0x90
pop r14
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x10002f6e4
Capabilities:
Get common file path
Get disk information

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x260
mov rax, qword [0x1000c2110]
xor rax, rsp
mov qword [rsp + 0x250], rax
xor r14d, r14d
mov r13, rcx
lea r8, [0x100006450]
lea rcx, [rsp + 0x30]
mov r9d, 0x20019
mov rdx, 0xffffffff80000002
mov r12b, r14b
movzx ebp, r14w
mov qword [rsp + 0x30], r14
call fcn.10008033c
lea rdi, [0x1000c3470]
cmp eax, r14d
mov ebx, eax
jge 0x10002f775
mov rcx, qword [0x1000c3470]
cmp rcx, rdi
je 0x10002f7bc
test byte [rcx + 0x1c], 2
je 0x10002f7bc
mov rcx, qword [rcx + 0x10]
lea edx, [r14 + 0xd]
lea r8, [0x100005260]
call fcn.10001ea00
jmp 0x10002f7bc
lea rcx, [rsp + 0x40]
mov edx, 0x104
mov r12b, 1
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
cmp eax, r14d
jne 0x10002f7c1
call fcn.10007ec64
mov rcx, qword [0x1000c3470]
cmp rcx, rdi
je 0x10002f7bc
test byte [rcx + 0x1c], 2
je 0x10002f7bc
mov rcx, qword [rcx + 0x10]
lea r8, [0x100005260]
mov edx, SafeArrayDestroy
mov r9d, eax
call fcn.100040094
mov ebx, r14d
jmp 0x10002f7c6
mov bp, word [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov esi, eax
cmp eax, r14d
jne 0x10002f811
call fcn.10007ec64
mov ebx, eax
mov rcx, qword [0x1000c3470]
cmp rcx, rdi
je 0x10002f8d2
test byte [rcx + 0x1c], 1
je 0x10002f8d2
mov rcx, qword [rcx + 0x10]
lea r8, [0x100005260]
mov edx, reloc.OLEAUT32.dll_SafeArrayDestroy
mov r9d, eax
call fcn.100040094
jmp 0x10002f8d2
mov dil, 0x41
movzx r9d, dil
mov eax, esi
lea ecx, [r9 - 0x41]
shr eax, cl
test al, 1
je 0x10002f8c5
cmp r12b, r14b
je 0x10002f83a
movzx eax, dil
cmp bp, ax
je 0x10002f8c5
lea r8, [0x1000064a0]
lea rcx, [rsp + 0x38]
mov edx, 4
call fcn.10002d1cc
lea rcx, [rsp + 0x38]
mov ebx, r14d
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, r14d
je 0x10002f8c5
sub eax, 1
je 0x10002f8c5
sub eax, 1
je 0x10002f8c5
sub eax, 1
je 0x10002f877
sub eax, 1
jmp 0x10002f8c5
lea rdx, [rsp + 0x38]
mov rcx, r13
call fcn.10002f5a0
cmp eax, r14d
mov ebx, eax
jge 0x10002f8c5
mov rcx, qword [0x1000c3470]
lea rax, [0x1000c3470]
cmp rcx, rax
je 0x10002f8c2
test byte [rcx + 0x1c], 2
je 0x10002f8c2
mov rcx, qword [rcx + 0x10]
lea r9, [rsp + 0x38]
lea r8, [0x100005260]
mov edx, SafeArrayGetElemsize
mov dword [rsp + 0x20], ebx
call fcn.10002f224
mov ebx, r14d
inc dil
cmp dil, 0x5a
jbe 0x10002f814
mov rcx, qword [rsp + 0x30]
cmp rcx, r14
je 0x10002f8e2
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.10009d3a0
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x10004551c
Capabilities:
Hide graphical window

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x50
mov r12d, edx
mov rbx, rcx
mov edx, r8d
add rcx, 0x198
mov r13d, r9d
call fcn.10002c01c
mov edi, eax
test eax, eax
js 0x100045687
mov rcx, qword [rbx + 8]
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x100045683
mov rdx, qword [rbx + 0x198]
mov rcx, qword [rbx + 0x100]
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov rcx, qword [rbx + 0x100]
mov r8d, r12d
mov edx, 0xfffffff4
call qword [sym.imp.USER32.dll_SetWindowLongW]
mov r11, qword [rbx + 0x198]
xor esi, esi
cmp dword [r11 - 0x10], esi
lea rdx, [rsp + 0x30]
lea rcx, [rbx + 0x100]
setg sil
and dword [rsp + 0x30], 0
and dword [rsp + 0x34], 0
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x3c], 1
call fcn.100042b00
mov edi, eax
test eax, eax
js 0x1000455f7
mov eax, dword [rsp + 0x38]
sub eax, dword [rsp + 0x30]
add eax, 0x28
mov dword [rbx + 0x158], eax
mov eax, dword [rsp + 0x3c]
sub eax, dword [rsp + 0x34]
add eax, 0xa
mov dword [rbx + 0x15c], eax
jmp 0x100045607
and dword [rbx + 0x158], 0
and dword [rbx + 0x15c], 0
xor esi, esi
lea rcx, [rbx + 0x100]
mov edx, r13d
call fcn.10001e7f4
mov rcx, qword [rbx + 0x100]
neg esi
sbb edx, edx
and edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [rbx + 8]
and dword [rsp + 0x40], 0
and dword [rsp + 0x44], 0
and dword [rsp + 0x48], 0
and dword [rsp + 0x4c], 0
lea rdx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_GetClientRect]
lea rcx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_IsRectEmpty]
test eax, eax
jne 0x10004566e
mov edx, dword [rsp + 0x48]
xor r8d, r8d
mov rcx, rbx
call fcn.100044c7c
mov dword [rbx + 0x48], eax
mov rcx, qword [rbx + 8]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x44a
call qword [sym.imp.USER32.dll_PostMessageW]
test edi, edi
jns 0x1000456d7
mov rcx, qword [0x1000c3470]
lea rax, [0x1000c3470]
cmp rcx, rax
je 0x1000456b8
test byte [rcx + 0x1c], 1
je 0x1000456b8
mov rcx, qword [rcx + 0x10]
lea r8, [0x100005118]
mov edx, SafeArrayDestroy
mov r9d, edi
call fcn.100040094
mov rcx, qword [0x1000c6ba0]
xor r9d, r9d
mov r8d, 0x8e
mov edx, edi
mov dword [rsp + 0x20], SafeArrayGetElemsize
call fcn.100023cc8
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r13
pop r12
pop rdi
ret

Function at 0x1000456f8
Capabilities:
Hide graphical window

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
add rcx, 0x198
call fcn.10002d50c
mov rcx, qword [rbx + 0x100]
mov edx, 0xfffffff4
lea r8d, [rdx + 0x72]
call qword [sym.imp.USER32.dll_SetWindowLongW]
test byte [rbx + 0x108], 2
je 0x100045749
mov rdi, qword [rbx + 0x100]
mov rcx, rdi
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x100045758
mov rcx, rdi
jmp 0x100045750
mov rcx, qword [rbx + 0x100]
xor edx, edx
call qword [sym.imp.USER32.dll_EnableWindow]
mov rcx, qword [rbx + 0x100]
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
and dword [rbx + 0x158], 0
and dword [rbx + 0x15c], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret