joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002160c
Capabilities:
Get file size

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x10]
sub rsp, 0x110
mov qword [rbp - 0x60], 0xfffffffffffffffe
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp], rax
mov r14, r8
mov r15, rdx
mov rdi, rcx
lea r12, vtable.micro::files::QFile.0
mov qword [rsp + 0x28], r12
xor ebx, ebx
mov qword [rsp + 0x30], rbx
lea rax, [0x1400207a0]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], rbx
lea rax, [0x1400207c8]
mov qword [rsp + 0x48], rax
lea rsi, [0x14012da68]
mov rdx, rsi
cmp qword [r15 + 8], rbx
cmovne rdx, qword [r15 + 8]
xor r8d, r8d
lea rcx, [rsp + 0x28]
call fcn.1400e82c4
test al, al
je 0x14002179a
mov rdx, rsi
cmp qword [r14 + 8], rbx
cmovne rdx, qword [r14 + 8]
mov r8d, 0x1000
lea rcx, [rsp + 0x50]
call fcn.1400e82c4
test al, al
je 0x14002179a
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.DLL_GetFileSizeEx]
mov rcx, qword [rdi + 0xa0]
test rcx, rcx
je 0x14002170a
mov rdx, rsi
cmp qword [r15 + 8], rbx
cmovne rdx, qword [r15 + 8]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
cmp qword [r14 + 8], rbx
cmovne rsi, qword [r14 + 8]
mov rcx, qword [rdi + 0xa0]
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax + 0x20]
mov qword [rbp - 0x28], rbx
mov dword [rbp - 0x4c], ebx
or eax, 0xffffffff
mov dword [rbp - 0x20], eax
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x30], eax
mov dword [rbp - 0x34], eax
mov dword [rbp - 0x38], eax
mov dword [rbp - 0x3c], eax
mov dword [rbp - 0x40], eax
mov dword [rbp - 0x44], eax
mov dword [rbp - 0x10], eax
mov qword [rbp - 0x18], rbx
mov eax, dword [rdi + 0xb4]
mov dword [rbp - 0x50], eax
or dword [rbp - 0x48], 0xffffffff
mov ecx, 4
mov dword [rbp - 0xc], ecx
lea rax, [rbp - 0x50]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rbx
mov dword [rsp + 0x78], ecx
mov rax, qword [rdi + 0xa0]
mov qword [rbp - 0x78], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x70], rax
lea rax, [0x1400207d4]
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x68], rbx
lea r9, [rbp - 0x80]
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x48]
call fcn.140023570
test eax, eax
sete bl
mov qword [rsp + 0x50], r12
lea rcx, [rsp + 0x50]
call fcn.1400e8500
nop
mov qword [rsp + 0x28], r12
lea rcx, [rsp + 0x28]
call fcn.1400e8500
mov al, bl
mov rcx, qword [rbp]
xor rcx, rsp
call fcn.140001010
add rsp, 0x110
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x14002761c
Capabilities:
Delete file
Read file on windows
Write file on windows

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xe0
mov qword [rbp + 0x17], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov r12, r8
mov rsi, rcx
lea r13, vtable.micro::utils::QString.0
mov qword [rbp - 0x69], r13
xor ebx, ebx
mov qword [rbp - 0x61], rbx
mov qword [rbp - 0x59], r13
mov qword [rbp - 0x51], rbx
mov qword [rbp - 0x49], rbx
mov qword [rbp - 0x41], rbx
mov qword [rbp - 0x39], rbx
mov qword [rbp - 0x31], rbx
mov dword [rbp - 0x29], ebx
mov qword [rbp - 0x21], rbx
mov qword [rbp - 1], rbx
mov qword [rbp + 7], rbx
lea rcx, [rsp + 0x30]
call fcn.1400ea694
nop
lea rcx, [rsi + 0x48]
cmp qword [rcx + 8], rbx
jne 0x140027699
mov dil, bl
jmp 0x1400276aa
lea r8, [rbp - 0x69]
lea rdx, [rsp + 0x30]
call fcn.1400e9958
mov dil, al
mov qword [rsp + 0x30], r13
lea rcx, [rsp + 0x30]
call fcn.1400e712c
test dil, dil
je 0x140027811
mov r15, qword [rbp - 0x49]
mov rdx, qword [rbp - 0x31]
add rdx, 0x200
lea rcx, [rsi + 0x20]
mov rax, qword [rcx]
xor r8d, r8d
call qword [rax + 0x30]
test al, al
je 0x140027811
lea rax, vtable.micro::files::QFile.0
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
lea r14, [0x14012da68]
mov rdx, r14
cmp qword [r12 + 8], rbx
cmovne rdx, qword [r12 + 8]
mov r8d, 0x1000
lea rcx, [rsp + 0x30]
call fcn.1400e82c4
test al, al
je 0x1400277fa
mov dword [rbp + 0x67], ebx
mov dword [rbp + 0x7f], ebx
mov rdi, r15
test r15, r15
je 0x1400277dd
lea r13, [rsi + 0xa8]
mov r14d, 0xfa00
mov r8d, edi
cmp rdi, r14
cmova r8d, r14d
mov dword [rbp + 0x67], ebx
mov qword [rsp + 0x20], rbx
lea r9, [rbp + 0x67]
mov rdx, r13
mov rcx, qword [rsi + 0x28]
call qword [sym.imp.KERNEL32.DLL_ReadFile]
mov dword [rbp + 0x7f], ebx
mov qword [rsp + 0x20], rbx
lea r9, [rbp + 0x7f]
mov r8d, dword [rbp + 0x67]
mov rdx, r13
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.DLL_WriteFile]
mov eax, dword [rbp + 0x67]
sub rdi, rax
mov rcx, qword [rsi + 0xa0]
test rcx, rcx
je 0x1400277c6
mov rax, qword [rcx]
mov rdx, r15
sub rdx, rdi
mov r8, r15
call qword [rax + 0x28]
mov rcx, qword [rsi + 0xa0]
mov rax, qword [rcx]
mov edx, dword [rbp + 0x67]
call qword [rax + 0x40]
mov rcx, qword [rsi + 0xa0]
mov rax, qword [rcx]
call qword [rax + 0x48]
test al, al
jne 0x1400277cf
test rdi, rdi
jne 0x140027743
lea r14, [0x14012da68]
lea r13, vtable.micro::utils::QString.0
test rdi, rdi
je 0x1400277f8
cmp qword [r12 + 8], rbx
cmovne r14, qword [r12 + 8]
mov rcx, r14
call qword [sym.imp.KERNEL32.DLL_DeleteFileW]
jmp 0x1400277fa
mov bl, 1
lea rax, vtable.micro::files::QFile.0
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x30]
call fcn.1400e8500
nop
mov qword [rbp - 0x59], r13
lea rcx, [rbp - 0x59]
call fcn.1400e712c
nop
mov qword [rbp - 0x69], r13
lea rcx, [rbp - 0x69]
call fcn.1400e712c
mov al, bl
mov rbx, qword [rsp + 0x128]
add rsp, 0xe0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140027d34
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x250
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x240], rax
xor edx, edx
mov rbx, rcx
lea rcx, [rsp + 0x41]
lea r8d, [rdx + 0x63]
mov byte [rsp + 0x40], 0
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0xa4]
xor edx, edx
mov r8d, reloc.COMCTL32.dll_RemoveWindowSubclass
call sub.msvcrt.dll_memset
mov rcx, qword [rbx + 0x28]
and dword [rsp + 0x30], 0
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x30]
lea rdx, [rsp + 0x40]
mov r8d, 0x200
call qword [sym.imp.KERNEL32.DLL_WriteFile]
mov rcx, qword [rbx + 0x28]
and dword [rsp + 0x30], 0
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x30]
lea rdx, [rsp + 0x40]
mov r8d, 0x200
call qword [sym.imp.KERNEL32.DLL_WriteFile]
lea rcx, [rbx + 0x20]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov al, 1
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.140001010
add rsp, 0x250
pop rbx
ret
Function at 0x140029c64
Capabilities:
Compute adler32 checksum

Disassembly:
mov qword [rsp + 8], rbx
xor r8d, r8d
mov rbx, rdx
mov r10, rcx
mov r9d, 1
test rdx, rdx
je 0x140029da5
mov r11d, 0x15b0
cmp rbx, r11
cmovb r11, rbx
mov rcx, r11
shr rcx, 4
test rcx, rcx
je 0x140029d5a
movzx eax, byte [r10]
add r10, 0x10
add r9d, eax
movzx eax, byte [r10 - 0xf]
add r8d, r9d
add r9d, eax
movzx eax, byte [r10 - 0xe]
add r8d, r9d
add r9d, eax
movzx eax, byte [r10 - 0xd]
add r8d, r9d
add r9d, eax
movzx eax, byte [r10 - 0xc]
add r8d, r9d
add r9d, eax
movzx eax, byte [r10 - 0xb]
add r8d, r9d
add r9d, eax
movzx eax, byte [r10 - 0xa]
add r8d, r9d
add r9d, eax
movzx eax, byte [r10 - 9]
add r8d, r9d
add r9d, eax
movzx eax, byte [r10 - 8]
add r8d, r9d
add r9d, eax
movzx eax, byte [r10 - 7]
add r8d, r9d
add r9d, eax
movzx eax, byte [r10 - 6]
add r8d, r9d
add r9d, eax
movzx eax, byte [r10 - 5]
add r8d, r9d
add r9d, eax
movzx eax, byte [r10 - 4]
add r8d, r9d
add r9d, eax
movzx eax, byte [r10 - 3]
add r8d, r9d
add r9d, eax
movzx eax, byte [r10 - 2]
add r8d, r9d
add r9d, eax
movzx eax, byte [r10 - 1]
add r8d, r9d
add r9d, eax
add r8d, r9d
dec rcx
jne 0x140029c9e
mov rcx, r11
and ecx, 0xf
je 0x140029d74
movzx eax, byte [r10]
inc r10
add r9d, eax
add r8d, r9d
dec rcx
jne 0x140029d62
mov eax, 0x80078071
mul r9d
shr edx, 0xf
imul eax, edx, 0xffff000f
add r9d, eax
mov eax, 0x80078071
mul r8d
shr edx, 0xf
imul ecx, edx, 0xffff000f
add r8d, ecx
sub rbx, r11
jne 0x140029c81
mov rbx, qword [rsp + 8]
shl r8d, 0x10
or r8d, r9d
mov eax, r8d
ret
Function at 0x14002e344
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x38
mov rcx, qword [rcx + 8]
and dword [rsp + 0x40], 0
and qword [rsp + 0x20], 0
mov rax, r8
mov r8d, edx
lea r9, [rsp + 0x40]
mov rdx, rax
call qword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
je 0x14002e377
mov eax, dword [rsp + 0x40]
test eax, eax
jne 0x14002e379
xor eax, eax
add rsp, 0x38
ret
Function at 0x140039260
Capabilities:
Hash data via bcrypt

Disassembly:
push rbx
sub rsp, 0x20
mov r9d, dword [rcx]
mov rbx, rcx
cmp r9d, 6
jg 0x1400392dd
je 0x1400392d4
dec r9d
je 0x1400392c3
dec r9d
je 0x1400392b1
dec r9d
je 0x1400392a0
dec r9d
je 0x14003929a
dec r9d
jne 0x140039314
mov rcx, qword [rcx + 0x350]
jmp 0x14003930b
mov rcx, qword [rcx + 0x48]
jmp 0x14003930b
mov r8d, r8d
add rcx, 0x30
add rsp, 0x20
pop rbx
jmp fcn.1400ea94c
mov ecx, dword [rcx + 0x20]
mov r8d, r8d
call qword [rbx + 0x28]
mov dword [rbx + 0x20], eax
add rsp, 0x20
pop rbx
ret
mov r8d, r8d
add rcx, 8
add rsp, 0x20
pop rbx
jmp fcn.1400e9028
mov rcx, qword [rcx + 0x368]
jmp 0x14003930b
sub r9d, 7
je 0x140039304
dec r9d
je 0x1400392f6
dec r9d
jne 0x140039314
add rcx, 0x1c8
jmp 0x1400392fa
add rcx, 0x50
add rsp, 0x20
pop rbx
jmp 0x1400eabfc
mov rcx, qword [rcx + 0x380]
xor r9d, r9d
call qword [sym.imp.bcrypt.dll_BCryptHashData]
add rsp, 0x20
pop rbx
ret
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
cmp dword [rcx + 0xe4], 0
mov edi, r8d
mov rsi, rdx
mov rbx, rcx
jbe 0x1400eac48
test r8d, r8d
je 0x1400eac48
mov eax, dword [rbx + 0xe4]
cmp eax, dword [rbx + 0xe0]
jae 0x1400eac48
mov ecx, eax
mov al, byte [rsi]
inc rsi
mov byte [rcx + rbx + 0xe8], al
inc dword [rbx + 0xe4]
dec edi
jne 0x1400eac22
mov eax, dword [rbx + 0xe0]
cmp dword [rbx + 0xe4], eax
jne 0x1400eac79
lea rdx, [rbx + 0xe8]
mov rcx, rbx
call fcn.1400eadb8
mov eax, dword [rbx + 0xe0]
add qword [rbx + 0xd8], rax
and dword [rbx + 0xe4], 0
test edi, edi
je 0x1400eacc0
jmp 0x1400eac9c
mov rdx, rsi
mov rcx, rbx
call fcn.1400eadb8
mov eax, dword [rbx + 0xe0]
add qword [rbx + 0xd8], rax
add rsi, rax
sub edi, eax
cmp edi, eax
jae 0x1400eac7f
test edi, edi
je 0x1400eacc0
mov al, byte [rsi]
mov ecx, dword [rbx + 0xe4]
inc rsi
mov byte [rcx + rbx + 0xe8], al
inc dword [rbx + 0xe4]
dec edi
jne 0x1400eaca4
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov al, 1
add rsp, 0x20
pop rdi
ret

Function at 0x140039bd0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rdi, rcx
mov rcx, qword [rcx + 8]
mov edx, 0x3ed
call qword [sym.imp.USER32.dll_GetDlgItem]
mov r9d, 0x10420
xor r8d, r8d
mov rcx, rax
mov edx, 0x1036
mov qword [rdi + 0x70], rax
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rdi + 0x70]
lea rdx, str.explorer
xor r8d, r8d
call qword [sym.imp.UxTheme.dll_SetWindowTheme]
xor r9d, r9d
lea rbx, [rdi + 0x68]
lea r8d, [r9 + 0x3c]
lea rdx, str.Status
mov rcx, rbx
call fcn.14003aec4
xor r9d, r9d
lea rdx, [0x140111d38]
lea r8d, [r9 + 0x64]
mov rcx, rbx
call fcn.14003aec4
lea rdx, [0x140111d40]
xor r9d, r9d
mov r8d, 0x12c
mov rcx, rbx
call fcn.14003aec4
mov rcx, rdi
call fcn.1400ec970
mov rcx, rdi
call fcn.1400ecb88
xor esi, esi
lea r8, [0x140039cc4]
mov r9, rdi
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rsi
mov bl, al
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.DLL_CreateThread]
mov qword [rdi + 0x98], rax
test bl, bl
je 0x140039cae
test rax, rax
je 0x140039cae
mov esi, 1
mov rbx, qword [rsp + 0x40]
mov al, sil
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x140039d18
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
xor eax, eax
xor edx, edx
cmp byte [rcx + 0xa0], al
jne 0x140039d4c
mov byte [rcx + 0xa0], 1
mov r9, rcx
mov qword [rsp + 0x28], rax
lea r8, [0x140039cd4]
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.DLL_CreateThread]
jmp 0x140039d56
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_EndDialog]
mov al, 1
add rsp, 0x38
ret
Function at 0x14003e640
Capabilities:
Hide graphical window

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp - 8], rax
mov r14b, r8b
mov rsi, rcx
test dl, dl
je 0x14003e74f
cmp byte [rcx + 0xc0], 0
jne 0x14003e80b
mov byte [rcx + 0xc0], 1
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x18], xmm0
lea rdx, [rbp - 0x18]
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_GetClientRect]
mov edi, dword [rbp - 0x10]
sub edi, dword [rbp - 0x18]
mov ebx, dword [rbp - 0xc]
sub ebx, dword [rbp - 0x14]
mov edx, 5
mov rcx, qword [rsi + 0x70]
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [rsi + 0x70]
call qword [sym.imp.USER32.dll_SetFocus]
movzx r9d, bx
shl r9d, 0x10
movzx eax, di
or r9, rax
xor r8d, r8d
lea edx, [r8 + 5]
mov rcx, qword [rsi + 8]
call qword [sym.imp.USER32.dll_SendMessageW]
lea rbx, vtable.micro::utils::QString.0
mov qword [rbp - 0x30], rbx
and qword [rbp - 0x28], 0
lea rcx, [rsi + 0x68]
mov rax, qword [rcx]
lea rdx, [rbp - 0x30]
call qword [rax + 0x360]
test al, al
je 0x14003e73d
mov rax, qword [rbp - 0x28]
test rax, rax
je 0x14003e73d
cmp dword [rax - 8], 0
je 0x14003e73d
mov rcx, qword [rsi + 0x60]
add rcx, 8
lea rdx, [rbp - 0x30]
call fcn.1400e7b9c
mov rcx, qword [rsi + 0x60]
mov rax, qword [rcx]
mov dl, 1
call qword [rax + 0x148]
nop
mov qword [rbp - 0x30], rbx
lea rcx, [rbp - 0x30]
call fcn.1400e712c
jmp 0x14003e80b
cmp byte [rcx + 0xc0], 1
jne 0x14003e80b
mov byte [rcx + 0xc0], 0
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x18], xmm0
lea rdx, [rbp - 0x18]
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_GetClientRect]
mov edi, dword [rbp - 0x10]
sub edi, dword [rbp - 0x18]
mov ebx, dword [rbp - 0xc]
sub ebx, dword [rbp - 0x14]
lea rcx, [rsi + 0x68]
mov rax, qword [rcx]
lea rdx, [0x14012da68]
call qword [rax + 0x350]
xor edx, edx
mov rcx, qword [rsi + 0x70]
call qword [sym.imp.USER32.dll_ShowWindow]
movzx r9d, bx
shl r9d, 0x10
movzx eax, di
or r9, rax
xor r8d, r8d
lea edx, [r8 + 5]
mov rcx, qword [rsi + 8]
call qword [sym.imp.USER32.dll_SendMessageW]
or r8d, 0xffffffff
lea rdx, [0x14012da68]
lea rcx, [rbp - 0x30]
call fcn.1400e6fc8
nop
mov r8b, r14b
lea rdx, [rbp - 0x30]
mov rcx, rsi
call fcn.14003e604
nop
lea rbx, vtable.micro::utils::QString.0
mov qword [rbp - 0x30], rbx
lea rcx, [rbp - 0x30]
call fcn.1400e712c
mov rcx, qword [rsi + 0x58]
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_SetFocus]
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140001010
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x14003fd20
Capabilities:
Set current directory

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rsi
mov rsi, rcx
lea rbx, [rcx + 0x88]
mov rcx, qword [rbx]
mov rdi, qword [rdx]
cmp rcx, rdi
je 0x14003fd69
test rcx, rcx
je 0x14003fd59
call qword [sym.imp.ole32.dll_CoTaskMemFree]
and qword [rbx], 0
mov rcx, rdi
call qword [sym.imp.SHELL32.dll_ILClone]
mov qword [rbx], rax
lea rdi, vtable.micro::utils::QString.0
mov qword [rsp + 0x28], rdi
and qword [rsp + 0x30], 0
lea rdx, [rsp + 0x28]
mov rcx, rbx
call fcn.1400ee914
test al, al
jne 0x14003fd99
lea rdx, [rsp + 0x28]
mov rcx, rbx
call fcn.140068eb0
lea rcx, [0x14012da68]
mov rax, qword [rsp + 0x30]
test rax, rax
cmovne rcx, rax
call qword [sym.imp.KERNEL32.DLL_SetCurrentDirectoryW]
xor edx, edx
lea r8d, [rdx + 1]
mov rcx, qword [rsi + 8]
call qword [sym.imp.USER32.dll_InvalidateRect]
nop
mov qword [rsp + 0x28], rdi
lea rcx, [rsp + 0x28]
call fcn.1400e712c
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x1400440f8
Capabilities:
Get disk information

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x198]
sub rsp, 0x270
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x160], rax
mov r15, rcx
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1009
mov rcx, qword [rcx + 0xe0]
call qword [sym.imp.USER32.dll_SendMessageW]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x14b
mov rcx, qword [r15 + 0xa0]
call qword [sym.imp.USER32.dll_SendMessageW]
call qword [sym.imp.KERNEL32.DLL_GetLogicalDrives]
mov r12d, eax
mov r14d, 1
lea r13, vtable.micro::utils::QString.0
mov qword [rsp + 0x20], r13
and qword [rsp + 0x28], 0
mov qword [rsp + 0x30], r13
and qword [rsp + 0x38], 0
xor esi, esi
lea r8d, [rsi + 0x41]
lea rdx, [0x140116350]
lea rcx, [rsp + 0x20]
call fcn.1400e7a18
test r12d, r14d
je 0x140044271
lea rcx, [0x14012da68]
mov rbx, qword [rsp + 0x28]
test rbx, rbx
cmovne rcx, rbx
mov r8d, 0x104
lea rdx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.DLL_QueryDosDeviceW]
test eax, eax
je 0x140044299
mov r8d, 4
lea rdx, [0x1401071e0]
lea rcx, [rsp + 0x50]
call qword [sym.imp.msvcrt.dll_wcsncmp]
test eax, eax
jne 0x140044299
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x30]
call fcn.1400e7be0
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1004
mov rcx, qword [r15 + 0xe0]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rdi, rax
lea r8, [0x14012da68]
test rbx, rbx
cmovne r8, rbx
lea rbx, [r15 + 0xd8]
mov edx, eax
mov rcx, rbx
call fcn.1400442f8
lea r9, [0x14012da68]
mov rdx, qword [rsp + 0x38]
test rdx, rdx
cmovne r9, rdx
mov r8d, 1
mov edx, edi
mov rcx, rbx
call fcn.14003adc0
jmp 0x140044299
lea r9, [0x14012da68]
mov rax, qword [rsp + 0x28]
test rax, rax
cmovne r9, rax
xor r8d, r8d
mov edx, 0x14a
mov rcx, qword [r15 + 0xa0]
call qword [sym.imp.USER32.dll_SendMessageW]
inc esi
add r14d, r14d
cmp esi, 0x1a
jl 0x140044199
mov qword [rsp + 0x30], r13
lea rcx, [rsp + 0x30]
call fcn.1400e712c
nop
mov qword [rsp + 0x20], r13
lea rcx, [rsp + 0x20]
call fcn.1400e712c
mov rcx, qword [rbp + 0x160]
xor rcx, rsp
call fcn.140001010
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x140046bb4
Capabilities:
Enumerate pe sections

Disassembly:
movzx eax, word [rcx + 0x14]
movzx r10d, word [rcx + 6]
lea r9, [rcx + 0x18]
add r9, rax
jmp 0x140046bdf
mov ecx, dword [r9 + 0xc]
dec r10d
cmp ecx, r8d
ja 0x140046bdb
add ecx, dword [r9 + 8]
cmp r8d, ecx
jb 0x140046be7
add r9, 0x28
test r10d, r10d
jne 0x140046bc6
xor r9d, r9d
test r9, r9
jne 0x140046bef
xor eax, eax
ret
mov eax, dword [r9 + 0x14]
sub eax, dword [r9 + 0xc]
add eax, r8d
add rax, rdx
ret
Function at 0x140047964
Capabilities:
Enumerate pe sections

Disassembly:
movzx eax, word [rdx + 0x14]
lea r9, [rdx + 0x18]
movzx edx, word [rdx + 6]
add r9, rax
xor r10d, r10d
mov r11d, ecx
test edx, edx
je 0x1400479a5
mov eax, dword [r9 + 8]
test eax, eax
jne 0x140047989
mov eax, dword [r9 + 0x10]
mov ecx, dword [r9 + 0xc]
cmp r11d, ecx
jb 0x140047999
add eax, ecx
cmp r11d, eax
jb 0x1400479a8
inc r10d
add r9, 0x28
cmp r10d, edx
jb 0x14004797d
xor r9d, r9d
test r9, r9
jne 0x1400479b0
xor eax, eax
ret
mov eax, dword [r9 + 0xc]
sub eax, dword [r9 + 0x14]
movsxd rcx, eax
mov rax, r11
sub rax, rcx
add rax, r8
ret

Function at 0x140048434
Capabilities:
Read file via mapping

Disassembly:
push rbx
sub rsp, 0x50
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rbx, rcx
call fcn.1400e7b9c
lea rdx, [0x14012da68]
cmp qword [rbx + 8], 0
cmovne rdx, qword [rbx + 8]
lea rcx, [rbx + 0x10]
mov rax, qword [rcx]
mov r8d, 0x20
call qword [rax]
test al, al
jne 0x140048476
xor al, al
jmp 0x1400484f8
and qword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 2]
mov rcx, qword [rbx + 0x18]
call qword [sym.imp.KERNEL32.DLL_CreateFileMappingW]
mov qword [rbx + 0x28], rax
test rax, rax
je 0x14004846f
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 4]
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_MapViewOfFile]
mov qword [rbx + 0x30], rax
test rax, rax
jne 0x1400484f6
lea rax, vtable.micro::utils::QString.0
mov qword [rsp + 0x38], rax
and qword [rsp + 0x40], 0
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov edx, eax
lea rcx, [rsp + 0x38]
call fcn.1400e7960
nop
lea rdx, [0x14016bc48]
lea rcx, [rsp + 0x38]
call sub.msvcrt.dll__CxxThrowException
int3
mov al, 1
add rsp, 0x50
pop rbx
ret

Function at 0x14004aa90
Capabilities:
Capture webcam image

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
test dl, dl
je 0x14004ab49
cmp qword [rcx + 0x60], 0
lea rdi, [0x14012da68]
mov edx, 0x416
mov rbx, rdi
cmovne rbx, qword [rcx + 0x60]
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.USER32.dll_SetWindowTextW]
cmp qword [rsi + 0x70], 0
mov rcx, qword [rsi + 8]
cmovne rdi, qword [rsi + 0x70]
mov edx, 0x417
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov rcx, qword [rsi + 8]
mov edx, 0x419
call qword [sym.imp.USER32.dll_GetDlgItem]
mov ebx, 0x160c
mov r9d, 1
mov rcx, rax
xor r8d, r8d
mov edx, ebx
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rsi + 8]
mov edx, 0x41a
call qword [sym.imp.USER32.dll_GetDlgItem]
mov r9d, 1
xor r8d, r8d
mov rcx, rax
mov edx, ebx
call qword [sym.imp.USER32.dll_SendMessageW]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov al, 1
add rsp, 0x20
pop rdi
ret
Function at 0x14004dc24
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub rsp, 0x28
cmp qword [rdx + 8], 0
lea rcx, [0x14012da68]
cmovne rcx, qword [rdx + 8]
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14004dc65
call qword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 2
je 0x14004dc5e
call qword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 3
je 0x14004dc5e
xor eax, eax
jmp 0x14004dc71
mov eax, 1
jmp 0x14004dc71
movzx eax, al
and eax, 0x10
or eax, 0x20
shr eax, 4
add rsp, 0x28
ret