joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140080640
Capabilities:
Log keystrokes via polling

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rdx
mov edi, ecx
xor eax, eax
lea rcx, [0x1402e0660]
cmp dword [rcx + rax*8 + 4], edi
je 0x1400806c9
inc rax
cmp rax, 0x4d
jne 0x140080654
lea ecx, [rdi - 0x16e]
cmp ecx, 0x13
ja case.default.0x140080680
mov ax, 0x21
lea rdx, [0x1402e10d4]
movsxd rcx, dword [rdx + rcx*4]
add rcx, rdx
jmp rcx
mov ax, 0x27
jmp case.0x140080680.380
mov ax, 0x26
jmp case.0x140080680.380
mov ax, 0x24
jmp case.0x140080680.380
mov ax, 0x22
jmp case.0x140080680.380
mov ax, 0x25
jmp case.0x140080680.380
mov ax, 0x28
jmp case.0x140080680.380
mov ax, 0x2d
jmp case.0x140080680.380
mov ax, 0x2e
jmp case.0x140080680.380
mov ax, 0x22
mov cl, 1
jmp 0x1400806c0
mov ax, 0x23
xor ecx, ecx
test rsi, rsi
je 0x1400806d9
mov byte [rsi], cl
jmp 0x1400806d9
shl rax, 3
test rsi, rsi
je 0x1400806d5
mov byte [rsi], 0
movzx eax, word [rax + rcx]
add rsp, 0x28
pop rdi
pop rsi
ret
lea eax, [rdi - 0x138]
cmp eax, 0xa
ja case.default.0x1400806f9
lea rcx, [0x1402e10a8]
movsxd rax, dword [rcx + rax*4]
add rax, rcx
jmp rax
mov ax, 0x2d
jmp case.0x140080680.366
mov ax, 0x28
jmp case.0x140080680.366
mov ax, 0x27
jmp case.0x140080680.366
mov ax, 0x26
jmp case.0x140080680.366
mov ax, 0x25
jmp case.0x140080680.366
mov ax, 0x24
jmp case.0x140080680.366
mov ax, 0x23
jmp case.0x140080680.366
cmp edi, 0x7f
jne case.0x1400806f9.318
mov ax, 0x2e
jmp case.0x140080680.366
mov ecx, edi
call qword [sym.imp.USER32.dll_VkKeyScanW]
and eax, 0xff
cmp eax, 0xff
cmove eax, edi
jmp case.0x140080680.380

Function at 0x140080750
Capabilities:
Log keystrokes via polling

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov esi, ecx
lea eax, [rsi - 1]
cmp eax, 2
setae al
cmp ecx, 4
setne cl
test cl, al
jne 0x1400807b1
cmp qword [0x14031f9c0], 0
je 0x1400807b1
lea rax, str.cant_use_wxGetKeyState___for_mouse_buttons
mov qword [rsp + 0x20], rax
lea rcx, str.....update_notifier_thirdpartywxWidgets_srcmswwindow.cpp
lea r8, str.wxGetKeyState
lea r9, str.key___0x01__key___0x02__key___0x04
mov edx, 0x1b72
call fcn.1400d8690
cmp byte [0x140331ad8], 1
jne 0x1400807b1
mov byte [0x140331ad8], 0
int3
mov ecx, esi
xor edx, edx
call fcn.140080640
mov edi, eax
add esi, 0xfffffec9
cmp esi, 0x36
ja 0x1400807ed
movabs rax, 0x60000000000001
bt rax, rsi
jae 0x1400807ed
movzx ecx, di
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
setne al
add rsp, 0x28
pop rdi
pop rsi
ret
lea eax, [rdi - 1]
cmp ax, 1
ja 0x140080812
xor esi, esi
cmp di, 1
sete sil
mov ecx, 0x17
call qword [sym.imp.USER32.dll_GetSystemMetrics]
inc esi
test eax, eax
cmovne edi, esi
movzx ecx, di
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
movzx eax, ax
shr eax, 0xf
jmp 0x1400807e6
Function at 0x140080830
Capabilities:
Log keystrokes via polling

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x30
mov rsi, rcx
mov rax, qword [0x14031d040]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov dword [rcx], 0xaaaaaaaa
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rcx, [rsp + 0x20]
mov qword [rcx], rax
call qword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x140080958
mov ecx, dword [rsp + 0x20]
mov eax, dword [rsp + 0x24]
mov dword [rsi + 4], ecx
mov dword [rsi + 8], eax
mov rbx, qword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, 0x17
call rbx
cmp eax, 1
mov ecx, 2
sbb ecx, 0
mov r14, qword [sym.imp.USER32.dll_GetAsyncKeyState]
call r14
movzx ebp, ax
shr ebp, 0xf
mov ecx, 4
call r14
mov edi, eax
shr edi, 0xe
and dil, 2
or dil, bpl
mov ecx, 0x17
call rbx
xor ecx, ecx
cmp eax, 1
adc ecx, 1
call r14
mov ebx, eax
shr ebx, 0xd
and bl, 4
or bl, dil
mov ecx, 5
call r14
mov edi, eax
shr edi, 0xc
and dil, 8
or dil, bl
mov ecx, 6
call r14
shr eax, 0xb
and al, 0x10
or al, dil
or al, 0xa0
mov byte [rsi + 1], al
mov rbx, qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, reloc.COMCTL32.dll_InitCommonControls
call rbx
movzx ebp, ax
shr ebp, 0xf
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
call rbx
mov edi, eax
shr edi, 0xe
and dil, 2
or dil, bpl
mov ecx, SafeArrayUnlock
call rbx
shr eax, 0xd
and al, 4
or al, dil
or al, 0xa0
mov byte [rsi], al
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1401f08b0
mov rax, rsi
add rsp, 0x30
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
call qword [sym.imp.USER32.dll_GetMessagePos]
movsx ecx, ax
mov dword [rsp + 0x20], ecx
sar eax, 0x10
mov dword [rsp + 0x24], eax
jmp 0x14008087a

Function at 0x140080da0
Capabilities:
Log keystrokes via application hook

Disassembly:
sub rsp, 0x28
test cl, cl
jne 0x140080dbf
mov rcx, qword [0x14032faa0]
test rcx, rcx
je 0x140080de4
add rsp, 0x28
jmp qword [sym.imp.USER32.dll_UnhookWindowsHookEx]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea rdx, [0x140080a90]
mov ecx, 2
xor r8d, r8d
mov r9d, eax
call qword [sym.imp.USER32.dll_SetWindowsHookExW]
mov qword [0x14032faa0], rax
add rsp, 0x28
ret
Function at 0x140083a40
Capabilities:
Get graphical window text

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rsi, rcx
mov rax, qword [0x14031d040]
xor rax, rsp
mov qword [rsp + 0x30], rax
xorps xmm0, xmm0
movups xmmword [rcx + 0x10], xmm0
movups xmmword [rcx], xmm0
mov qword [rcx + 0x20], 0
test rdx, rdx
je 0x140083b09
mov rdi, rdx
mov rcx, rdx
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
inc eax
movsxd rbx, eax
lea r14, [rsp + 0x20]
mov rcx, r14
mov rdx, rsi
mov r8, rbx
call fcn.140082670
mov rax, qword [r14 + 8]
mov rdx, qword [rax]
mov rcx, rdi
mov r8d, ebx
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov rcx, qword [r14]
mov rax, qword [r14 + 8]
mov rax, qword [rax]
test rax, rax
lea rdx, [0x14029d4fc]
cmovne rdx, rax
call fcn.14004d7f0
mov rdi, qword [r14 + 8]
call fcn.1400ab720
cmp rdi, rax
je 0x140083b09
mov rdi, qword [rsp + 0x28]
dec word [rdi + 0x10]
setne al
test rdi, rdi
sete cl
or cl, al
jne 0x140083b04
cmp byte [rdi + 0x12], 1
jne 0x140083afc
mov rcx, qword [rdi]
call fcn.140071eb0
mov rcx, rdi
call fcn.1401ef41c
call fcn.1400ab720
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1401f08b0
mov rax, rsi
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x140083df0
Capabilities:
Get session user name
Query environment variable

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov esi, edx
mov rdi, rcx
mov rax, qword [0x14031d040]
xor rax, rsp
mov qword [rsp + 0x30], rax
lea rdx, [rsp + 0x2c]
mov dword [rdx], esi
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x140083e34
mov sil, 1
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1401f08b0
mov eax, esi
add rsp, 0x38
pop rdi
pop rsi
ret
lea rcx, str.username
mov rdx, rdi
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
jne 0x140083e1b
xor esi, esi
jmp 0x140083e1e

Function at 0x1400843a0
Capabilities:
Query environment variable

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rbx, rdx
mov rdi, rcx
mov rax, qword [0x14031d040]
xor rax, rsp
mov qword [rsp + 0x30], rax
cmp byte [rcx + 0x17], 0
jns 0x1400843c7
mov rcx, qword [rdi]
xor edx, edx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esi, eax
test rbx, rbx
je 0x140084474
test esi, esi
je 0x140084474
mov r8d, esi
lea r14, [rsp + 0x20]
mov rcx, r14
mov rdx, rbx
call fcn.140082670
mov rax, qword [r14 + 8]
mov rdx, qword [rax]
cmp byte [rdi + 0x17], 0
jns 0x140084408
mov rdi, qword [rdi]
mov rcx, rdi
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov rcx, qword [rsp + 0x20]
mov rax, qword [rsp + 0x28]
mov rax, qword [rax]
test rax, rax
lea rdx, [0x14029d4fc]
cmovne rdx, rax
call fcn.14004d7f0
mov rdi, qword [rsp + 0x28]
call fcn.1400ab720
cmp rdi, rax
je 0x140084474
mov rdi, qword [rsp + 0x28]
dec word [rdi + 0x10]
setne al
test rdi, rdi
sete cl
or cl, al
jne 0x14008446f
cmp byte [rdi + 0x12], 1
jne 0x140084467
mov rcx, qword [rdi]
call fcn.140071eb0
mov rcx, rdi
call fcn.1401ef41c
call fcn.1400ab720
test esi, esi
setne bl
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1401f08b0
mov eax, ebx
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x140085560
Capabilities:
Get system information on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x58
mov rsi, rcx
mov rax, qword [0x14031d040]
xor rax, rsp
mov qword [rsp + 0x50], rax
movaps xmm0, xmmword [0x1402825c0]
lea rdi, [rsp + 0x20]
movaps xmmword [rdi + 0x20], xmm0
movaps xmmword [rdi + 0x10], xmm0
movaps xmmword [rdi], xmm0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx ecx, word [rdi]
lea eax, [rcx - 5]
cmp eax, 7
ja case.default.0x1400855b1
lea rcx, [0x1402e1578]
movsxd rax, dword [rcx + rax*4]
add rax, rcx
jmp rax
lea rdx, str.Itanium
jmp 0x1400855f6
lea rdx, [0x1402e13ad]
jmp 0x1400855f6
test ecx, ecx
je 0x1400855e6
xorps xmm0, xmm0
movups xmmword [rsi + 0x10], xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x20], 0
jmp 0x1400855fe
lea rdx, str.ARM64
jmp 0x1400855f6
lea rdx, [0x1402e13bf]
jmp 0x1400855f6
lea rdx, [0x1402e13a9]
mov rcx, rsi
call fcn.1400343a0
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1401f08b0
mov rax, rsi
add rsp, 0x58
pop rdi
pop rsi
ret

Function at 0x14008af50
Capabilities:
Accept command line arguments

Disassembly:
push rsi
sub rsp, 0x20
mov qword [0x14032fcc0], rcx
mov dword [reloc.WS2_32.dll_accept], r9d
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea rsi, [0x14032fcb0]
mov rcx, rax
mov rdx, rsi
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov qword [0x14032fcb8], rax
mov rcx, rsi
mov rdx, rax
add rsp, 0x20
pop rsi
jmp 0x1400bc310
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rdx
mov rdi, rcx
lea rcx, [0x1403307f0]
call sub.KERNEL32.dll_EnterCriticalSection
mov rax, qword [0x140330818]
lea rcx, [rax + 1]
mov qword [0x140330818], rcx
test rax, rax
je 0x1400bc3ab
lea rcx, [0x1403307f0]
call sub.KERNEL32.dll_LeaveCriticalSection
mov rcx, qword [0x140331aa8]
call fcn.1400318a0
mov esi, 0xffffffff
test al, al
je 0x1400bc37b
mov rcx, qword [0x140331aa8]
call fcn.1400d78b0
mov esi, eax
mov rcx, qword [0x140331aa8]
call fcn.1400d78d0
lea rcx, [0x1403307f0]
call sub.KERNEL32.dll_EnterCriticalSection
dec qword [0x140330818]
jne 0x1400bc395
call fcn.1400bc210
lea rcx, [0x1403307f0]
call sub.KERNEL32.dll_LeaveCriticalSection
mov eax, esi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
mov rcx, rdi
mov rdx, rsi
call fcn.1400bbb70
mov ebx, eax
lea rcx, [0x1403307f0]
call sub.KERNEL32.dll_LeaveCriticalSection
mov esi, 0xffffffff
test bl, bl
je 0x1400bc3a1
jmp 0x1400bc34c
Function at 0x1400ba0c0
Capabilities:
Identify system language via api

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rax, qword [0x1403307b0]
test rax, rax
jne 0x1400ba0fe
mov ecx, 0x18
call fcn.1401ef3e0
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x10], 0
mov qword [0x1403307b0], rax
call fcn.140143d00
mov rax, qword [0x1403307b0]
mov rdi, qword [rax]
mov rbx, qword [rax + 8]
mov rsi, rbx
sub rsi, rdi
sar rsi, 3
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx eax, ax
cmp eax, 0x1400
je 0x1400ba179
cmp rbx, rdi
je 0x1400ba179
mov edx, eax
and edx, 0x3ff
shr eax, 0xa
mov rcx, qword [0x1403307b0]
mov r8, qword [rcx]
mov r9, qword [rcx + 8]
sub r9, r8
sar r9, 3
cmp rsi, 1
mov r10, rsi
adc r10, 0
xor ecx, ecx
jmp 0x1400ba15b
inc rcx
cmp r10, rcx
je 0x1400ba172
cmp r9, rcx
je 0x1400ba1ad
mov r11, qword [r8 + rcx*8]
cmp dword [r11 + 0x30], edx
jne 0x1400ba153
cmp dword [r11 + 0x34], eax
jne 0x1400ba153
jmp 0x1400ba17b
mov eax, 1
jmp 0x1400ba1a5
xor ecx, ecx
mov eax, 1
cmp rcx, rsi
jae 0x1400ba1a5
mov rdx, qword [0x1403307b0]
mov rax, qword [rdx]
mov rdx, qword [rdx + 8]
sub rdx, rax
sar rdx, 3
cmp rdx, rcx
jbe 0x1400ba1ad
mov rax, qword [rax + rcx*8]
mov eax, dword [rax]
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
ud2
Function at 0x1400e0b10
Capabilities:
Encode data using xor
Hash data using sha256 via x86 extensions

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov ecx, 2
call fcn.1401d9350
bt eax, 0x1d
jae 0x1400e0b41
mov ecx, 1
call fcn.1401d9350
bt eax, 9
jb 0x1400e0b8a
mov ecx, 1
call fcn.1401d9350
mov ebp, eax
bt eax, 0x1c
jae 0x1400e0b60
xor ecx, ecx
call fcn.1401d9350
bt eax, 0x1e
jb 0x1400e0ba0
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
bt ebp, 9
jae 0x1400e0b7c
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
jmp fcn.140013f80
nop
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
jmp fcn.140012a00
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
jmp fcn.140013bc0
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
jmp fcn.140014ec0

Function at 0x1400e0d00
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov ecx, 1
call fcn.1401d9350
bt eax, 0x1c
jae 0x1400e0d2d
xor ecx, ecx
call fcn.1401d9350
bt eax, 0x1e
jb 0x1400e0d42
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.140015fc0
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.140017200

Function at 0x1400e1720
Capabilities:
Check if file exists

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
cmp dword [rcx + 0x10], 0
jne 0x1400e180e
cmp qword [rsi], 0
jne 0x1400e180e
cmp dword [rsi + 0x14], 0
jne 0x1400e180e
cmp qword [rsi + 8], 0
jne 0x1400e180e
xor eax, eax
mov r14, qword [rdi]
cmp rax, r14
je 0x1400e1790
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x1400e17e0
lea rax, [r14 + 1]
cmp rax, 2
jb 0x1400e1788
mov qword [rsi], r14
call fcn.1401bdb70
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r14, qword [rdi + 8]
cmp qword [rsi + 8], r14
je 0x1400e17ca
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi + 8]
inc rax
cmp rax, 2
jae 0x1400e17f6
lea rax, [r14 + 1]
cmp rax, 2
jb 0x1400e17c2
mov qword [rsi + 8], r14
call fcn.1401bdb70
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [rdi + 0x10]
mov dword [rsi + 0x10], eax
mov eax, dword [rdi + 0x14]
mov dword [rsi + 0x14], eax
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.1401bdb70
mov rcx, qword [rsi]
call fcn.1401ae5f0
mov qword [rsi], 0
jmp 0x1400e1776
call fcn.1401bdb70
mov rcx, qword [rsi + 8]
call fcn.1401ae5f0
mov qword [rsi + 8], 0
jmp 0x1400e17af
mov rcx, rsi
call fcn.14025a850
mov rax, qword [rsi]
jmp 0x1400e175a
Function at 0x1400eed00
Capabilities:
Get common file path

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x268
mov rsi, rdx
mov edi, ecx
mov rax, qword [0x14031d040]
xor rax, rsp
mov qword [rsp + 0x260], rax
lea rbx, [rsp + 0x50]
mov r8d, 0x208
mov rcx, rbx
mov dl, 0xaa
call fcn.140235e90
mov word [rbx], 0
mov qword [rsp + 0x20], rbx
xor ecx, ecx
mov edx, edi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov edi, eax
test eax, eax
js 0x1400eed8f
lea r14, [rsp + 0x28]
mov qword [r14], rbx
mov rcx, rbx
call fcn.14021cf84
mov qword [r14 + 8], rax
lea rbx, [rsp + 0x38]
mov rcx, rbx
mov rdx, r14
call fcn.1401be7c0
mov rcx, rsi
mov rdx, rbx
call fcn.140067bb0
mov rcx, rbx
call fcn.1401be900
test edi, edi
setns bl
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1401f08b0
mov eax, ebx
add rsp, 0x268
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x1400eedc0
Capabilities:
Get common file path

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x78
mov rsi, rcx
mov rax, qword [0x14031d040]
xor rax, rsp
mov qword [rsp + 0x70], rax
lea r9, [rsp + 0x68]
mov qword [r9], 0
lea rcx, [0x140275098]
xor edx, edx
xor r8d, r8d
call sub.SHELL32.dll_SHGetKnownFolderPath
test eax, eax
js 0x1400eef69
mov rdi, qword [rsp + 0x68]
test rdi, rdi
je 0x1400eef58
movabs r15, 0x7ffffffffffffff7
mov rcx, rdi
call fcn.14021cf84
cmp rax, r15
ja 0x1400eef5f
mov rbx, rax
lea r14, [rsp + 0x28]
cmp rax, 0xa
jbe 0x1400eef4c
lea rax, [r15 + 5]
and rax, rbx
add rax, 4
mov r12, rbx
or r12, 3
cmp r12, 0xb
cmove r12, rax
inc r12
js 0x1400eef5a
lea rcx, [r12 + r12]
call fcn.1401ef3e0
mov rcx, rax
mov qword [rsp + 0x28], rax
lea rax, [r15 + r12]
add rax, 9
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
lea r15, [rcx + rbx*2]
cmp rcx, rdi
seta al
cmp r15, rdi
setbe dl
or dl, al
je 0x1400eef58
test rbx, rbx
je 0x1400eeeb0
add rbx, rbx
mov rdx, rdi
mov r8, rbx
call fcn.1402357f0
mov word [r15], 0
movsx rax, byte [rsp + 0x3f]
test rax, rax
cmovs rax, qword [rsp + 0x30]
cmovs r14, qword [rsp + 0x28]
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x48], rax
test rax, rax
js 0x1400eef58
sete al
test r14, r14
setne cl
or cl, al
je 0x1400eef58
lea rdi, [rsp + 0x50]
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.1401be7c0
mov rcx, rsi
mov rdx, rdi
call fcn.140067bb0
mov rcx, rdi
call fcn.1401be900
cmp byte [rsp + 0x3f], 0
jns 0x1400eef1d
mov rcx, qword [rsp + 0x28]
call fcn.1401ef41c
mov bl, 1
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1400eef2f
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1401f08b0
mov eax, ebx
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov byte [rsp + 0x3f], bl
mov rcx, r14
jmp 0x1400eee85
ud2
call fcn.140236a70
lea rcx, [rsp + 0x28]
call fcn.140236a90
mov rcx, rsi
call fcn.1402609c0
mov ebx, eax
jmp 0x1400eef1f
Function at 0x1400ef850
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x68
mov rsi, rcx
mov rax, qword [0x14031d040]
xor rax, rsp
mov qword [rsp + 0x60], rax
cmp byte [rcx + 0x17], 0
jns 0x1400ef878
mov rcx, qword [rsi]
mov dx, 0x5c
call fcn.1401f2768
test rax, rax
je 0x1400efab8
mov rdi, rax
mov rcx, rax
add rcx, 2
lea rdx, str.notification_helper.exe
call fcn.140217534
mov dl, byte [rsi + 0x17]
mov rcx, qword [rsi]
test eax, eax
je 0x1400efa93
mov rbx, rdi
add rbx, 2
test dl, dl
cmovs rsi, rcx
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x50], rax
movaps xmm0, xmmword [0x1402825c0]
movaps xmmword [rsp + 0x40], xmm0
test rsi, rsi
jne 0x1400ef8e4
cmp rbx, rsi
jne 0x1400efae4
mov rdi, rbx
sub rdi, rsi
mov r15, rdi
sar r15, 1
movabs r14, 0x7ffffffffffffff7
cmp r15, r14
ja 0x1400efae6
cmp r15, 0xa
jbe 0x1400ef9ce
lea rax, [r14 + 5]
and rax, r15
add rax, 4
mov r12, r15
or r12, 3
cmp r12, 0xb
cmove r12, rax
lea rcx, [r12*2 + 2]
call fcn.1401ef3e0
mov rcx, rax
mov qword [rsp + 0x40], rax
lea rax, [r14 + r12]
add rax, 0xa
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], r15
lea r15, [rcx + r15*2]
cmp rcx, rsi
ja 0x1400ef960
cmp r15, rsi
ja 0x1400efae4
cmp rbx, rsi
je 0x1400ef970
mov rdx, rsi
mov r8, rdi
call fcn.1402357f0
mov word [r15], 0
lea rbx, str.sys.viv
mov rcx, rbx
call fcn.14021cf84
mov rdi, rax
movsx rax, byte [rsp + 0x57]
mov edx, 0xa
mov rsi, rax
test rax, rax
jns 0x1400ef9af
add r14, 8
and r14, qword [rsp + 0x50]
dec r14
mov rsi, qword [rsp + 0x48]
mov rdx, r14
mov rcx, rdx
sub rcx, rsi
cmp rcx, rdi
jb 0x1400ef9dc
test rdi, rdi
je 0x1400efa60
test al, al
js 0x1400efa0c
lea r14, [rsp + 0x40]
jmp 0x1400efa11
lea rcx, [rsp + 0x40]
mov byte [rcx + 0x17], r15b
jmp 0x1400ef94e
mov r8, rdi
add r8, rsi
sub r8, rdx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x28], 0
lea rcx, [rsp + 0x40]
mov r9, rsi
call fcn.14004d230
jmp 0x1400efa60
mov r14, qword [rsp + 0x40]
test rdi, rdi
js 0x1400efae4
lea rcx, [r14 + rsi*2]
lea rax, [rcx + rdi*2]
cmp rcx, rbx
seta dl
cmp rax, rbx
setbe al
or al, dl
je 0x1400efae4
lea r8, [rdi + rdi]
lea rdx, str.sys.viv
call fcn.1402357f0
add rsi, rdi
cmp byte [rsp + 0x57], 0
jns 0x1400efad7
mov qword [rsp + 0x48], rsi
mov word [r14 + rsi*2], 0
cmp byte [rsp + 0x57], 0
js 0x1400efa6e
lea rcx, [rsp + 0x40]
jmp 0x1400efa73
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne sil
cmp byte [rsp + 0x57], 0
jns 0x1400efaba
mov rcx, qword [rsp + 0x40]
call fcn.1401ef41c
jmp 0x1400efaba
test dl, dl
mov rax, rsi
cmovs rax, rcx
cmp rdi, rax
je 0x1400efab8
lea rbx, [rdi - 2]
cmp word [rdi - 2], 0x5c
mov rdi, rbx
jne 0x1400efa9c
test rbx, rbx
jne 0x1400ef8b1
xor esi, esi
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1401f08b0
mov eax, esi
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov eax, esi
and al, 0x7f
mov byte [rsp + 0x57], al
jmp 0x1400efa59
ud2
lea rcx, [rsp + 0x40]
call fcn.140236a90
int3
Function at 0x1400efc70
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x248
mov rax, qword [0x14031d040]
xor rax, rsp
mov qword [rsp + 0x240], rax
movaps xmm0, xmmword [0x1402825c0]
lea rcx, [rsp + 0x20]
movaps xmmword [rcx], xmm0
call sub.ntdll.dll_RtlFormatCurrentUserKeyPath
mov esi, eax
test eax, eax
js 0x1400efdf0
lea rdi, [rsp + 0x20]
mov rdx, qword [rdi + 8]
lea rbx, [0x1403322d0]
mov r14d, 0xff
mov r8d, 0xff
mov rcx, rbx
call fcn.14021dc98
mov rcx, rbx
call fcn.14021cf84
sub r14, rax
lea rdx, [0x14029d5ee]
mov rcx, rbx
mov r8, r14
call fcn.14021dc98
mov rcx, rdi
call sub.ntdll.dll_RtlFreeUnicodeString
lea rbx, [rsp + 0x30]
mov r8d, 0x208
mov rcx, rbx
xor edx, edx
call fcn.140235e90
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rdi, rax
lea rcx, str.PROGRAMFILES
mov rdx, rbx
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [rax - 1]
cmp ecx, 0x102
ja 0x1400efd4c
mov r8d, eax
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.14021dce0
test eax, eax
je 0x1400efddd
lea rcx, str.PROGRAMFILES_X86_
lea rdx, [rsp + 0x30]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [rax - 1]
cmp ecx, 0x102
ja 0x1400efd83
mov r8d, eax
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.14021dce0
test eax, eax
je 0x1400efddd
xor eax, eax
mov byte [0x140331ec1], al
mov dword [rsp + 0x30], 0
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x1402edc7c]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400efde1
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rdx, [rsp + 0x30]
mov rcx, rax
mov rax, rdi
call qword [0x14030c820]
test eax, eax
je 0x1400efde1
cmp dword [rsp + 0x30], 0
setne al
jmp 0x1400efde3
mov al, 1
jmp 0x1400efd85
xor eax, eax
mov byte [0x1403324d0], al
mov byte [0x140331ec0], 1
test esi, esi
setns bl
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1401f08b0
mov eax, ebx
add rsp, 0x248
pop rbx
pop rdi
pop rsi
pop r14
ret