joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400c66a0
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
lea rcx, [0x1402707e0]
mov rdi, r9
mov rsi, r8
mov rbx, rdx
call fcn.140084ab0
test eax, eax
je 0x1400c66dd
mov eax, 0x40
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.1400e1d30
Function at 0x1400c7390
Capabilities:
Log keystrokes via polling

Disassembly:
push rsi
push rdi
push r12
sub rsp, 0x40
mov eax, dword [rcx + 0x58]
mov edi, r9d
movzx r12d, r8b
cdq
mov rsi, rcx
xor eax, edx
cmp eax, edx
jne 0x1400c73b8
xor eax, eax
add rsp, 0x40
pop r12
pop rdi
pop rsi
ret
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x70], r13
mov ecx, 0x11
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r15
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
xor r14d, r14d
mov ecx, 0x10
test ax, ax
sets r14b
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
xor r15d, r15d
test ax, ax
mov eax, dword [rsp + 0x80]
mov r9d, edi
sets r15b
mov edx, r14d
mov rcx, rsi
mov r8d, r15d
mov dword [rsp + 0x20], eax
call fcn.1400c75a0
mov r13d, 1
mov ebx, eax
mov eax, 0x5dc
cmp ebx, eax
cmovg ebx, eax
mov eax, 0xfffffa24
cmp ebx, eax
cmovl ebx, eax
test edi, edi
jne 0x1400c7448
mov eax, dword [rsi + 0x34]
test al, 2
jne 0x1400c7448
bt eax, 0x13
jb 0x1400c7448
xor ebp, ebp
jmp 0x1400c744b
mov ebp, r13d
test r14d, r14d
mov r14, qword [rsp + 0x38]
jne 0x1400c745a
test r15d, r15d
je 0x1400c749d
test edi, edi
jne 0x1400c749d
test dword [rsi + 0x34], 0x80000
jne 0x1400c749d
xor ebp, ebp
mov eax, ebx
cdq
xor eax, edx
sub eax, edx
cmp eax, 0x78
jl 0x1400c74bc
mov eax, 0x88888889
imul ebx
add ebx, edx
sar ebx, 6
mov eax, ebx
shr eax, 0x1f
add ebx, eax
mov eax, ebx
cdq
xor eax, edx
sub eax, edx
cmp eax, 0x7f
jl 0x1400c74f9
test ebx, ebx
jns 0x1400c74ef
or eax, 0xffffffff
jmp 0x1400c74f6
test ebp, ebp
je 0x1400c7469
test edi, edi
je 0x1400c74c3
xor edx, edx
mov rcx, rsi
call fcn.1400c9650
mov ecx, eax
mov eax, ebx
cdq
xor eax, edx
sub eax, edx
cmp eax, ecx
jge 0x1400c74f9
xor eax, eax
jmp 0x1400c756e
mov eax, ebx
cdq
xor eax, edx
sub eax, edx
cmp eax, 0x168
jle 0x1400c74f9
test ebx, ebx
jns 0x1400c74e0
or eax, 0xffffffff
imul ebx, eax, 0x168
jmp 0x1400c74f9
xor eax, eax
test ebx, ebx
setg al
imul ebx, eax, 0x168
jmp 0x1400c74f9
xor eax, eax
test ebx, ebx
setg al
imul ebx, eax, 0x7f
mov eax, dword [rsi + 0x58]
neg ebx
cdq
mov edi, eax
mov rax, qword [0x140271ff8]
xor edi, edx
sub edi, edx
test rax, rax
je 0x1400c7562
mov rax, qword [rax]
test rax, rax
je 0x1400c7562
xor ecx, ecx
test r12b, r12b
cmove ecx, r13d
test ebp, ebp
je 0x1400c7529
or ecx, 2
mov r10, qword [rax + 0x58]
test r10, r10
jne 0x1400c7536
lea r10, [rax + 0x70]
mov rax, qword [r10]
mov dword [rsp + 0x28], ecx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r10
mov dword [rsp + 0x20], ebx
call qword [rax + 0xe0]
mov eax, dword [rsi + 0x58]
test eax, eax
jle 0x1400c755d
sub eax, edi
jmp 0x1400c755f
add eax, edi
mov dword [rsi + 0x58], eax
mov dword [rsi + 0x94], 0
mov eax, edi
mov r13, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov r15, qword [rsp + 0x30]
add rsp, 0x40
pop r12
pop rdi
pop rsi
ret
Function at 0x1400c9dd0
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
mov eax, 0x2030
call fcn.1400e75d0
sub rsp, rax
mov r10d, dword [rsp + 0x2060]
mov rdi, r9
mov ebp, r8d
mov r14, rdx
mov rsi, rcx
sub r10d, 2
je 0x1400c9f0f
dec r10d
jne 0x1400c9f6b
cmp r8d, 0xc
jne 0x1400c9f6b
mov rcx, rdx
call qword [sym.imp.USER32.dll_GetDlgCtrlID]
mov rbx, qword [rsp + 0x2068]
mov r8d, eax
test rbx, rbx
je 0x1400c9f6b
test rdi, rdi
je 0x1400c9f6b
test eax, eax
je 0x1400c9f6b
mov ecx, dword [rdi]
xor esi, esi
mov r10d, esi
mov edx, esi
test ecx, ecx
je 0x1400c9e7f
mov eax, esi
cmp ecx, r8d
je 0x1400c9e77
mov ecx, dword [rdi + rax*4 + 8]
add rax, 2
add edx, 2
test ecx, ecx
jne 0x1400c9e61
jmp 0x1400c9e7f
movsxd rax, edx
mov r10d, dword [rdi + rax*4 + 4]
lea r8, [rsp + 0x30]
mov r9d, 0x1000
mov edx, r10d
mov rcx, rbx
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x1400c9ef4
lea r9, [0x1400c9f90]
mov r8, r14
mov edx, 0xaa
mov rcx, rbx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.USER32.dll_CreateDialogParamW]
mov qword [0x140272bd0], rax
call fcn.1400b1160
test eax, eax
je 0x1400c9ed3
mov rcx, qword [0x140272bd0]
call fcn.1400b1470
mov r9, qword [rsp + 0x2070]
mov rcx, qword [0x140272bd0]
lea r8, [rsp + 0x30]
mov edx, 0x401
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x1400c9f6b
mov rcx, qword [0x140272bd0]
test rcx, rcx
je 0x1400c9f6b
call qword [sym.imp.USER32.dll_DestroyWindow]
mov qword [0x140272bd0], rsi
jmp 0x1400c9f6b
add rcx, 0x418
or rbx, 0xffffffffffffffff
mov rax, rbx
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400c9f20
test rax, rax
je 0x1400c9f35
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rsi + 0x620]
nop dword [rax]
inc rbx
cmp word [rcx + rbx*2], 0
jne 0x1400c9f40
test rbx, rbx
je 0x1400c9f55
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rdx, str.Mouse.hlp
mov r9, rdi
mov r8d, ebp
mov rcx, r14
call qword [sym.imp.USER32.dll_WinHelpW]
lea r11, [rsp + 0x2030]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x1400cb760
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rbp
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
mov qword [rcx + 0x28], 7
xor r14d, r14d
mov qword [rcx + 0x20], r14
mov word [rcx + 0x10], r14w
add rcx, 0x438
lea rdx, str.SynCom.PointingDevice
call fcn.14002e400
lea rax, vtable.CDummySynDevice.0
mov qword [rsi + 0x450], rax
mov dword [rsi + 0x458], r14d
mov qword [rsi + 0x448], r14
lea rax, vtable.SynDeviceEx.0
mov qword [rsi + 0x430], rax
lea rax, vtable.SynDeviceEx.1.0
mov qword [rsi + 0x440], rax
mov dword [rsi + 0x460], 0xffffffff
mov dword [rsi + 0x464], r14d
lea rcx, [rsi + 0x480]
call fcn.1400e2d00
nop
mov qword [rsi], rbx
mov qword [rsi + 8], rdi
mov dword [rsi + 0x470], 0x800
mov qword [rsi + 0x468], r14
mov qword [rsi + 0x478], r14
mov dword [rsi + 0x474], 1
lea rdi, [rsi + 0x4a0]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor edx, edx
lea r8d, [r14 + 0x26]
lea rcx, [rsi + 0x480]
call fcn.1400e2df0
test eax, eax
jns 0x1400cb8b4
lea rcx, str.ProgramFiles
call fcn.1400ef488
test rax, rax
je 0x1400cb892
lea rcx, str.ProgramFiles
call fcn.1400ef488
mov rdx, rdi
sub rdx, rax
nop dword [rax]
movzx ecx, word [rax]
mov word [rdx + rax], cx
lea rax, [rax + 2]
test cx, cx
jne 0x1400cb880
jmp 0x1400cb8b4
lea rcx, str.C:Program_Files
mov rdx, rsi
sub rdx, rcx
nop
movzx eax, word [rcx]
mov word [rdx + rcx + 0x4a0], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x1400cb8a0
lea rbx, [rsi + 0x6a8]
mov r8, rdi
lea rdx, str._sSynapticsSynTP
mov rcx, rbx
call fcn.1400e7a5c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1400cb8e9
mov rdx, rbx
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
xor ecx, ecx
call fcn.1400dd550
cmp eax, 9
jl 0x1400cb91f
lea rax, [rsi + 0x8b0]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 5]
lea rcx, [rsi + 0x480]
call fcn.1400e2df0
test eax, eax
jns 0x1400cb940
lea rcx, [rsi + 0x8b0]
sub rcx, rbx
nop dword [rax]
movzx eax, word [rbx]
mov word [rcx + rbx], ax
lea rbx, [rbx + 2]
test ax, ax
jne 0x1400cb930
mov rax, rsi
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x1400cf1e0
Capabilities:
Get file version info

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rdx
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x88
mov qword [r11 - 0x80], 0xfffffffffffffffe
mov rdi, rdx
mov rsi, rcx
xor r15d, r15d
mov dword [rsp + 0x30], r15d
mov word [r11 - 0x78], r15w
xor eax, eax
mov qword [r11 - 0x76], rax
mov qword [r11 - 0x6e], rax
mov qword [r11 - 0x66], rax
mov qword [r11 - 0x5e], rax
mov qword [r11 - 0x56], rax
mov qword [r11 - 0x4e], rax
mov qword [r11 - 0x46], rax
mov word [rsp + 0x7a], ax
cmp qword [rdx + 0x18], 8
jb 0x1400cf240
mov rcx, qword [rdx]
jmp 0x1400cf243
mov rcx, rdx
lea rdx, [rsp + 0xc0]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov ebp, eax
or rbx, 0xffffffffffffffff
test eax, eax
je 0x1400cf300
mov eax, 2
mul rbp
cmovo rax, rbx
mov rcx, rax
call fcn.1400e4e34
mov r14, rax
cmp qword [rdi + 0x18], 8
jb 0x1400cf281
mov rcx, qword [rdi]
jmp 0x1400cf284
mov rcx, rdi
mov r9, rax
mov r8d, ebp
xor edx, edx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x1400cf2f8
mov qword [rsp + 0xd8], r15
lea r9, [rsp + 0xd0]
lea r8, [rsp + 0xd8]
lea rdx, [0x140124f70]
mov rcx, r14
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x1400cf2f8
mov rdx, qword [rsp + 0xd8]
test rdx, rdx
je 0x1400cf2f8
movzx eax, word [rdx + 0xc]
movzx ecx, word [rdx + 0xe]
movzx r9d, word [rdx + 8]
movzx r8d, word [rdx + 0xa]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
lea rdx, str.v_d._d._d._d
lea rcx, [rsp + 0x40]
call fcn.1400e7a5c
mov rcx, r14
call fcn.1400e5d14
mov qword [rsi + 0x18], 7
mov qword [rsi + 0x10], r15
mov word [rsi], r15w
cmp word [rsp + 0x40], 0
jne 0x1400cf31d
mov rbx, r15
jmp 0x1400cf32c
lea rax, [rsp + 0x40]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1400cf322
mov r8, rbx
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.140007750
nop
cmp qword [rdi + 0x18], 8
jb 0x1400cf34c
mov rcx, qword [rdi]
call fcn.1400e5d14
mov qword [rdi + 0x18], 7
mov qword [rdi + 0x10], r15
mov word [rdi], r15w
mov rax, rsi
add rsp, 0x88
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400d04b0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rsi, rax
test rax, rax
je 0x1400d0587
movzx r8d, word [rax]
mov qword [rsp + 0x30], rbx
mov rbx, rax
test r8w, r8w
je 0x1400d0530
nop dword [rax]
lea rdx, [0x14013eee0]
movzx r8d, r8w
mov rcx, rdi
call fcn.1400ed9ac
movzx r8d, word [rbx + 2]
add rbx, 2
test r8w, r8w
jne 0x1400d04f0
lea rdx, [0x1401327f4]
mov rcx, rdi
call fcn.1400ed9ac
movzx r8d, word [rbx + 2]
add rbx, 2
test r8w, r8w
jne 0x1400d04f0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rcx, qword [rbp + 0x438]
mov rbx, qword [rsp + 0x30]
xor eax, eax
mov dword [rsp + 0x40], eax
test rcx, rcx
je 0x1400d0564
mov rax, qword [rcx]
lea r8, [rsp + 0x40]
mov edx, 0x100001d2
call qword [rax + 0x18]
mov eax, dword [rsp + 0x40]
lea rcx, [0x14013e248]
test eax, eax
lea r8, [0x14013e250]
cmovne r8, rcx
lea rdx, str.IsUserAdmin_s_n
mov rcx, rdi
call fcn.1400ed9ac
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x1400d05a0
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x2020
call fcn.1400e75d0
sub rsp, rax
mov rbp, r8
mov rsi, rdx
xor edi, edi
nop word [rax + rax]
lea rdx, [0x140139fb8]
mov rcx, rbp
call fcn.1400eda40
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x1400d0604
test rbx, rbx
jne 0x1400d061f
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
inc edi
cmp edi, 0x3c
jl 0x1400d05d0
xor eax, eax
lea r11, [rsp + 0x2020]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
mov rcx, rbx
call fcn.1400ed330
test eax, eax
jne 0x1400d066c
nop dword [rax + rax]
mov rcx, rbx
call fcn.1400ed358
test eax, eax
jne 0x1400d066c
lea rcx, [rsp + 0x20]
mov r8, rbx
mov edx, 0x1000
call fcn.1400ed830
test rax, rax
je 0x1400d066c
lea rcx, [rsp + 0x20]
mov rdx, rsi
call fcn.1400ed8f8
mov rcx, rbx
call fcn.1400ed330
test eax, eax
je 0x1400d0630
mov rcx, rsi
call fcn.1400ebc88
mov rcx, rbx
call fcn.1400ebb4c
mov eax, 1
jmp 0x1400d0606
Function at 0x1400d2af0
Capabilities:
Get common file path

Disassembly:
push rdi
sub rsp, 0x270
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rsp + 0x290], rbx
cmp dword [0x140272c10], 0
jne 0x1400d2ce1
mov dword [0x140272c10], 1
call fcn.1400df0b0
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
test eax, eax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea edx, [rcx + 0x2a]
jne 0x1400d2b42
lea edx, [rcx + 0x26]
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
call fcn.140004f70
mov rdx, rax
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
jne 0x1400d2b67
mov ecx, 0x80004005
call fcn.140004f20
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x280], rax
lea rcx, [rsp + 0x60]
lea rax, [rsp + 0x60]
or rbx, 0xffffffffffffffff
test rax, 0xffffffffffff0000
jne 0x1400d2bb8
movzx edi, cx
xor edx, edx
mov ecx, edi
call fcn.14000b7c0
test rax, rax
je 0x1400d2be0
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x280]
call fcn.14000bc50
jmp 0x1400d2be0
lea rcx, [rsp + 0x60]
mov rax, rbx
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400d2bc0
mov r8d, eax
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x280]
call fcn.14000be50
nop
lea r8, str.LenovoMetricCollectionSDKMFCLenovo.MetricCollectionMFC.dll
lea rdx, [rsp + 0x280]
lea rcx, [rsp + 0x288]
call fcn.140079580
nop
mov rdx, qword [rsp + 0x280]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x1400d2c19
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [rsp + 0x288]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x140272be0], rax
test rax, rax
je 0x1400d2cc5
lea rdx, str.GetMetricCollectionCollector
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
je 0x1400d2cc5
xor r8d, r8d
mov edx, 0x104
lea rcx, [rsp + 0x60]
call fcn.1400e0d00
mov byte [rsp + 0x48], 1
lea rax, str.SynapticsAppsCollectionReport
mov qword [rsp + 0x40], rax
lea rax, str.Local_Todo
mov qword [rsp + 0x38], rax
lea rax, str.Countyr_Todo
mov qword [rsp + 0x30], rax
lea rax, str.Family_Todo
mov qword [rsp + 0x28], rax
lea rax, str.SubBrand_Todo
mov qword [rsp + 0x20], rax
lea r9, str.Brand_Todo
lea r8, str.MTM_Todo
lea rdx, str.19.0.19.63
lea rcx, [rsp + 0x60]
call rdi
mov qword [0x140272bd8], rax
mov rdx, qword [rsp + 0x288]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x1400d2ce1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [0x140272bd8]
mov rbx, qword [rsp + 0x290]
add rsp, 0x270
pop rdi
ret
Function at 0x1400d87d0
Capabilities:
Get session user name

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x670
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rsp + 0x698], rbx
mov rdi, rcx
lea rax, vtable.CSynDeviceGestureActionService.0
mov qword [rcx], rax
mov qword [rcx + 8], rdx
lea rbx, [rcx + 0x18]
xor eax, eax
mov qword [rbx], rax
mov qword [rbx + 8], rax
mov rcx, rbx
call fcn.1400d93c0
mov qword [rbx], rax
mov dword [rsp + 0x688], 0x101
lea rdx, [rsp + 0x688]
lea rcx, [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov rax, qword [rdi + 8]
mov rcx, qword [rax + 0x58]
test rcx, rcx
jne 0x1400d8846
lea rcx, [rax + 0x70]
mov rax, qword [rcx]
lea r8, [rsp + 0x690]
mov edx, 0x10000101
call qword [rax + 0x18]
or ecx, 0xffffffff
test eax, eax
cmove ecx, dword [rsp + 0x690]
mov dword [rsp + 0x20], ecx
lea r9, [rsp + 0x60]
lea r8, str..pipe_sC01BC476_A852_4dfd_B33F_E308F3497BF4_li
mov edx, 0x200
lea rcx, [rsp + 0x270]
call fcn.1400e7b20
lea r9, [0x140124f70]
lea r8, [0x140132220]
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.1400de840
cmp qword [rax + 0x10], 0
setne bl
cmp qword [rsp + 0x48], 8
jb 0x1400d88bc
mov rcx, qword [rsp + 0x30]
call fcn.1400e5d14
test bl, bl
je 0x1400d891c
lea r9, [0x140124f70]
lea r8, [0x140132220]
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.1400de840
cmp qword [rax + 0x18], 8
jb 0x1400d88e4
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x270]
lea r8, str._s_s
mov edx, 0x200
lea rcx, [rsp + 0x270]
call fcn.1400e7b20
cmp qword [rsp + 0x48], 8
jb 0x1400d891c
mov rcx, qword [rsp + 0x30]
call fcn.1400e5d14
mov edx, 0x3d
lea rcx, [rsp + 0x270]
call fcn.140002990
mov qword [rdi + 0x10], rax
test rax, rax
je 0x1400d8943
mov rdx, rdi
mov rcx, rax
call fcn.140002740
nop
mov rax, rdi
mov rbx, qword [rsp + 0x698]
add rsp, 0x670
pop rdi
ret
Function at 0x1400dc610
Capabilities:
Create shortcut via ishelllink

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x290
mov rbx, rcx
xor r15d, r15d
xor ecx, ecx
mov r14, r9
mov ebp, r8d
mov rsi, rdx
mov edi, r15d
call qword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
js 0x1400dc82c
lea rax, [rsp + 0x30]
lea r9, [0x140142d50]
lea r8d, [r15 + 1]
lea rcx, [0x140142dc0]
xor edx, edx
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x20], rax
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x1400dc826
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x38], r15
lea r8, [rsp + 0x38]
mov rax, qword [rcx]
lea rdx, [0x140142db0]
call qword [rax]
test eax, eax
js 0x1400dc81b
mov rcx, qword [rsp + 0x38]
xor r8d, r8d
mov rdx, rbx
mov rax, qword [rcx]
call qword [rax + 0x28]
test eax, eax
js 0x1400dc810
mov rax, qword [rsp + 0x30]
mov rbx, qword [rax]
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, qword [rsp + 0x30]
mov rdx, rax
cmp dword [rsp + 0x2f0], r15d
je 0x1400dc791
lea r8d, [r15 + 4]
call qword [rbx + 0x98]
test eax, eax
jne 0x1400dc810
mov rcx, qword [rsp + 0x30]
lea r9, [rsp + 0x40]
mov r8d, ebp
mov rax, qword [rcx]
mov rdx, rsi
mov dword [rsp + 0x20], r15d
call qword [rax + 0x18]
test eax, eax
jne 0x1400dc71b
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea edi, [rax + 1]
mov rcx, qword [rsp + 0x30]
mov ebx, dword [rsp + 0x2d0]
mov rdx, r14
mov rax, qword [rcx]
mov r8d, ebx
call qword [rax + 0x40]
test eax, eax
je 0x1400dc73f
test ebx, ebx
jle 0x1400dc73f
mov word [r14], r15w
mov rcx, qword [rsp + 0x30]
mov ebx, dword [rsp + 0x2e0]
mov rsi, qword [rsp + 0x2d8]
mov rax, qword [rcx]
mov r8d, ebx
mov rdx, rsi
call qword [rax + 0x50]
test eax, eax
je 0x1400dc76b
test ebx, ebx
jle 0x1400dc76b
mov word [rsi], r15w
mov rcx, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x2e8]
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + 0x70]
test eax, eax
je 0x1400dc810
mov dword [rbx], 5
jmp 0x1400dc810
mov r8d, 0x39
call qword [rbx + 0x98]
test eax, eax
js 0x1400dc810
mov rcx, qword [rsp + 0x30]
lea r9, [rsp + 0x40]
mov r8d, ebp
mov rax, qword [rcx]
mov rdx, rsi
mov dword [rsp + 0x20], r15d
call qword [rax + 0x18]
test eax, eax
jne 0x1400dc7cc
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea edi, [rax + 1]
mov rcx, qword [rsp + 0x30]
mov r8d, dword [rsp + 0x2d0]
mov rdx, r14
mov rax, qword [rcx]
call qword [rax + 0x40]
mov rcx, qword [rsp + 0x30]
mov r8d, dword [rsp + 0x2e0]
mov rax, qword [rcx]
mov rdx, qword [rsp + 0x2d8]
call qword [rax + 0x50]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x2e8]
mov rax, qword [rcx]
call qword [rax + 0x70]
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rcx]
call qword [rdx + 0x10]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rcx]
call qword [rdx + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
lea r11, [rsp + 0x290]
mov eax, edi
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x1400dd060
Capabilities:
Log keystrokes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rbx, rcx
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, rax
xor edx, edx
mov rsi, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ebp, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, 1
mov edx, eax
mov ecx, ebp
call qword [sym.imp.USER32.dll_AttachThreadInput]
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetForegroundWindow]
test rdi, rdi
je 0x1400dd0bd
mov rcx, rdi
call qword [sym.imp.USER32.dll_SetFocus]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor r8d, r8d
mov ecx, ebp
mov edx, eax
call qword [sym.imp.USER32.dll_AttachThreadInput]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rax, rsi
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1400dd0f0
Capabilities:
Get common file path

Disassembly:
push rdi
sub rsp, 0x240
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x250], rbx
mov rbx, rcx
xor edi, edi
mov dword [rsp + 0x20], edi
mov eax, dword [0x140272cb8]
test al, 1
jne 0x1400dd162
or eax, 1
mov dword [0x140272cb8], eax
mov qword [0x140272cb0], 7
mov qword [0x140272ca8], rdi
mov word [0x140272c98], di
xor r8d, r8d
lea rdx, [0x1401246c4]
lea rcx, [0x140272c98]
call fcn.140007750
lea rcx, [0x140122280]
call fcn.1400e6f70
nop
cmp dword [0x140272c94], 0
jne 0x1400dd1c6
mov r9d, 1
lea r8d, [r9 + 0x22]
lea rdx, [rsp + 0x30]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
cmp word [rsp + 0x30], 0
jne 0x1400dd18f
mov r8, rdi
jmp 0x1400dd1ab
lea rax, [rsp + 0x30]
or r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x1400dd1a0
lea rdx, [rsp + 0x30]
lea rcx, [0x140272c98]
call fcn.140007750
mov dword [0x140272c94], 1
mov qword [rbx + 0x18], 7
mov qword [rbx + 0x10], rdi
mov word [rbx], di
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [0x140272c98]
mov rcx, rbx
call fcn.140007600
mov rax, rbx
mov rbx, qword [rsp + 0x250]
add rsp, 0x240
pop rdi
ret
Function at 0x1400dd200
Capabilities:
Get session user name

Disassembly:
push rbx
push rsi
sub rsp, 0x258
mov rsi, rcx
mov dword [rcx], 1
lea rcx, [rsp + 0x42]
xor ebx, ebx
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x40], bx
call fcn.1400e5ee0
lea rdx, [rsp + 0x270]
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x270], 0x104
mov qword [rsp + 0x278], rbx
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x1400dd333
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x250], rdi
call fcn.1400519c0
cmp qword [rax + 0x18], 8
jb 0x1400dd27b
mov rax, qword [rax]
lea r9, [rsp + 0x278]
mov r8d, 1
mov rdx, rax
xor ecx, ecx
call sub.NETAPI32.dll_NetUserGetInfo
cmp qword [rsp + 0x38], 8
mov edi, eax
jb 0x1400dd2a7
mov rcx, qword [rsp + 0x20]
call fcn.1400e5d14
test edi, edi
je 0x1400dd30f
lea r8, [rsp + 0x280]
mov edx, 1
xor ecx, ecx
mov qword [rsp + 0x280], rbx
call sub.NETAPI32.dll_NetWkstaUserGetInfo
mov edi, eax
test eax, eax
jne 0x1400dd2ef
mov rcx, qword [rsp + 0x280]
lea r9, [rsp + 0x278]
lea r8d, [rax + 1]
mov rdx, qword [rcx]
mov rcx, qword [rcx + 0x18]
call sub.NETAPI32.dll_NetUserGetInfo
mov edi, eax
mov rcx, qword [rsp + 0x280]
test rcx, rcx
je 0x1400dd301
call sub.NETAPI32.dll_NetApiBufferFree
test edi, edi
je 0x1400dd30f
mov rcx, qword [rsp + 0x278]
jmp 0x1400dd321
mov rcx, qword [rsp + 0x278]
mov ebx, 1
mov eax, dword [rcx + 0x14]
mov dword [rsi], eax
mov rdi, qword [rsp + 0x250]
test rcx, rcx
je 0x1400dd333
call sub.NETAPI32.dll_NetApiBufferFree
mov eax, ebx
add rsp, 0x258
pop rsi
pop rbx
ret

Function at 0x1400dd380
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x260
mov edi, ecx
mov r14, rdx
xor esi, esi
lea ecx, [rsi + 2]
xor edx, edx
mov ebp, r8d
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [rsp + 0x20], 0x238
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400dd40a
lea rdx, [rsp + 0x20]
mov rcx, rax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x1400dd401
cmp dword [rsp + 0x28], edi
je 0x1400dd3ec
lea rdx, [rsp + 0x20]
mov rcx, rbx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x1400dd3d3
jmp 0x1400dd401
lea r8, [rsp + 0x4c]
mov rdx, rbp
mov rcx, r14
call fcn.1400e7674
mov esi, 1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r11, [rsp + 0x260]
mov eax, esi
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret