joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18001bda8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rbx, rcx
mov ebp, 0x7ff
movzx ecx, word [rcx + 6]
mov esi, edx
shr cx, 4
and cx, bp
cmp cx, bp
jne 0x18001be08
test byte [rbx + 6], 0xf
jne 0x18001bdf9
xor edi, edi
cmp word [rbx + 4], di
jne 0x18001bdf9
cmp word [rbx + 2], di
jne 0x18001bdf9
cmp word [rbx], di
jne 0x18001bdf9
lea r10d, [rdi + 1]
jmp 0x18001bdff
mov r10d, 2
movzx eax, r10w
jmp 0x18001c013
xor edi, edi
test cx, cx
jne 0x18001be23
mov rcx, rbx
call fcn.18001daf8
movzx ecx, ax
cmp di, ax
jl 0x18001c010
test esi, esi
jle 0x18001be58
movsx eax, cx
sub ebp, eax
cmp ebp, esi
jg 0x18001be58
movsd xmm0, qword [0x1800550f0]
mov ebp, 0x8000
test word [rbx + 6], bp
je 0x18001be4a
xorps xmm0, xmmword [0x180041060]
movsd qword [rbx], xmm0
mov eax, 1
jmp 0x18001c013
movsx edx, cx
mov eax, edx
neg eax
cmp eax, esi
jge 0x18001be7f
add si, cx
mov eax, 0x800f
and word [rbx + 6], ax
shl si, 4
or word [rbx + 6], si
or eax, 0xffffffff
jmp 0x18001c013
movzx ecx, word [rbx + 6]
lea r11d, [rsi - 1]
movzx r14d, cx
add r11d, edx
and cx, 0xf
mov ebp, 0x8000
mov r15d, 0x10
and r14w, bp
or cx, r15w
lea eax, [r11 + 0x35]
mov word [rbx + 6], cx
cmp eax, 0x34
ja 0x18001c005
lea r10d, [r15 - 0xf]
movzx esi, di
cmp r11w, 0xfff0
jg 0x18001bf1d
movzx edx, word [rbx + 2]
mov eax, 0xfff0
sub ax, r11w
movzx r9d, cx
movzx ecx, word [rbx + 4]
shr ax, 4
add ax, r10w
movzx r8d, ax
movzx eax, r8w
shl ax, 4
add r11w, ax
test si, si
mov eax, edi
setne al
movzx esi, ax
or si, word [rbx]
mov word [rbx], dx
movzx edx, cx
movzx ecx, r9w
mov r9d, edi
sub r8, r10
jne 0x18001bef1
mov word [rbx + 6], di
mov word [rbx + 4], cx
mov word [rbx + 2], dx
neg r11w
je 0x18001bfa7
movzx r8d, word [rbx]
mov eax, edi
movzx edx, r8w
movsx r9d, r11w
sub r15d, r9d
mov ecx, r15d
shl dx, cl
test si, si
movzx esi, dx
movzx edx, word [rbx + 2]
setne al
or si, ax
movzx eax, dx
shl ax, cl
movzx ecx, r11w
shr r8w, cl
mov ecx, r15d
or ax, r8w
movzx r8d, word [rbx + 4]
mov word [rbx], ax
movzx eax, r8w
shl ax, cl
movzx ecx, r11w
shr dx, cl
mov ecx, r15d
or ax, dx
movzx edx, word [rbx + 6]
mov word [rbx + 2], ax
movzx eax, dx
shl ax, cl
movzx ecx, r11w
shr r8w, cl
mov ecx, r9d
or ax, r8w
shr dx, cl
mov word [rbx + 6], dx
mov word [rbx + 4], ax
or word [rbx + 6], r14w
movzx eax, word [rbx + 6]
cmp bp, si
jb 0x18001bfbc
jne 0x18001bfdd
test byte [rbx], r10b
je 0x18001bfdd
add word [rbx], r10w
jne 0x18001bfdd
add word [rbx + 2], r10w
jne 0x18001bfdd
add word [rbx + 4], r10w
jne 0x18001bfdd
add ax, r10w
mov word [rbx + 6], ax
jmp 0x18001be77
cmp ax, r14w
jne 0x18001be77
cmp word [rbx + 4], di
jne 0x18001be77
cmp word [rbx + 2], di
jne 0x18001be77
cmp word [rbx], di
je 0x18001c010
jmp 0x18001be77
mov word [rbx + 6], r14w
mov dword [rbx + 2], edi
mov word [rbx], di
movzx eax, di
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x18001e584
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
sub rsp, 0x18
mov r8, rcx
mov eax, 0x5a4d
cmp word [0x180000000], ax
jne 0x18001e615
movsxd rax, dword [0x18000003c]
lea rdx, [0x180000000]
lea rcx, [rax + rdx]
cmp dword [rcx], 0x4550
jne 0x18001e615
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x18001e615
sub r8, rdx
movzx eax, word [rcx + 0x14]
lea rdx, [rcx + 0x18]
add rdx, rax
movzx eax, word [rcx + 6]
lea rcx, [rax + rax*4]
lea r9, [rdx + rcx*8]
mov qword [rsp], rdx
cmp rdx, r9
je 0x18001e5f9
mov ecx, dword [rdx + 0xc]
cmp r8, rcx
jb 0x18001e5f3
mov eax, dword [rdx + 8]
add eax, ecx
cmp r8, rax
jb 0x18001e5fb
add rdx, 0x28
jmp 0x18001e5d8
xor edx, edx
test rdx, rdx
jne 0x18001e604
xor al, al
jmp 0x18001e61b
test dword [rdx + 0x24], 0x80000000
je 0x18001e611
xor al, al
jmp 0x18001e61b
mov al, 1
jmp 0x18001e61b
xor al, al
jmp 0x18001e61b
add rsp, 0x18
ret
Function at 0x14000bfe0
Capabilities:
Hash data with md5
Read file on windows

Disassembly:
push rbp
push rdi
sub rsp, 0x438
mov rax, qword [0x14028e6b0]
xor rax, rsp
mov qword [rsp + 0x420], rax
mov rax, rdx
mov qword [rcx + 0x10], 0
mov rdi, rcx
mov dword [rcx], 0x67452301
mov dword [rcx + 4], 0xefcdab89
lea rdx, [0x1401d25a0]
mov dword [rcx + 8], 0x98badcfe
mov dword [rcx + 0xc], 0x10325476
mov rcx, rax
call fcn.14018f354
mov rbp, rax
test rax, rax
je 0x14000c15a
mov r9, rbp
mov qword [rsp + 0x430], rsi
mov edx, 1
lea rcx, [rsp + 0x20]
mov r8d, 0x400
call fcn.14018f5e0
mov rsi, rax
test eax, eax
je 0x14000c13e
mov qword [rsp + 0x460], rbx
mov ecx, dword [rdi + 0x10]
lea eax, [rsi*8]
mov r9d, ecx
shr r9d, 3
and r9d, 0x3f
lea ecx, [rcx + rsi*8]
mov dword [rdi + 0x10], ecx
cmp ecx, eax
jae 0x14000c095
inc dword [rdi + 0x14]
mov eax, esi
mov ebx, 0x40
shr eax, 0x1d
sub ebx, r9d
add dword [rdi + 0x14], eax
cmp esi, ebx
jb 0x14000c0f4
mov eax, r9d
lea rcx, [rdi + 0x18]
add rcx, rax
mov r8d, ebx
lea rdx, [rsp + 0x20]
call fcn.140187210
lea rdx, [rdi + 0x18]
mov rcx, rdi
call fcn.14000b2b0
lea eax, [rbx + 0x3f]
cmp eax, esi
jae 0x14000c0ef
mov eax, ebx
lea rdx, [rsp + 0x20]
add rdx, rax
mov rcx, rdi
call fcn.14000b2b0
add ebx, 0x40
lea eax, [rbx + 0x3f]
cmp eax, esi
jb 0x14000c0d3
xor r9d, r9d
jmp 0x14000c0f6
xor ebx, ebx
mov eax, ebx
lea rdx, [rsp + 0x20]
add rdx, rax
lea rcx, [rdi + 0x18]
mov eax, r9d
sub esi, ebx
add rcx, rax
mov r8d, esi
call fcn.140187210
mov r9, rbp
lea rcx, [rsp + 0x20]
mov edx, 1
mov r8d, 0x400
call fcn.14018f5e0
mov esi, eax
test eax, eax
jne 0x14000c073
mov rbx, qword [rsp + 0x460]
mov rcx, rdi
call fcn.14000b030
mov rcx, rbp
call fcn.14018f120
mov rsi, qword [rsp + 0x430]
lea rax, [rdi + 0x68]
mov rcx, qword [rsp + 0x420]
xor rcx, rsp
call fcn.140168660
add rsp, 0x438
pop rdi
pop rbp
ret
Function at 0x14000c3f0
Capabilities:
Hash data with md5

Disassembly:
push rsi
sub rsp, 0xf0
mov rax, qword [0x14028e6b0]
xor rax, rsp
mov qword [rsp + 0xe0], rax
cmp dword [rcx + 0x30], 1
mov rsi, rcx
ja 0x14000c5e2
mov rcx, qword [rcx + 0x18]
mov edx, 0x78b
call qword [sym.imp.USER32.dll_GetDlgItem]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 0xe]
call qword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x14000c5cc
mov qword [rsp + 0x108], rbx
mov rbx, 0xffffffffffffffff
mov qword [rsp + 0x110], rbp
mov qword [rsp + 0x118], rdi
lea edi, [rax + 1]
movsxd rcx, edi
mov eax, 2
mul rcx
cmovo rax, rbx
mov rcx, rax
call fcn.140167f6c
mov rcx, qword [rsi + 0x18]
mov r9d, edi
mov r8, rax
mov edx, 0x78b
mov rbp, rax
call qword [sym.imp.USER32.dll_GetDlgItemTextW]
call fcn.14000cd40
xor edi, edi
mov r9d, ebx
mov r8d, 0xfde9
mov qword [rsp + 0x20], rdi
mov rdx, rbp
mov rcx, rax
call fcn.14002d430
mov ecx, dword [rsi + 0x30]
test ecx, ecx
jne 0x14000c51f
mov qword [rsp + 0x40], rdi
mov dword [rsp + 0x30], 0x67452301
mov dword [rsp + 0x34], 0xefcdab89
mov dword [rsp + 0x38], 0x98badcfe
mov dword [rsp + 0x3c], 0x10325476
nop
inc rbx
cmp byte [rax + rbx], dil
jne 0x14000c4e0
mov r8, rbx
lea rcx, [rsp + 0x30]
mov rdx, rax
call fcn.14000bb80
lea rcx, [rsp + 0x30]
call fcn.14000b030
mov rcx, qword [rsi + 0x18]
lea r8, [rsp + 0x98]
mov edx, 0x78d
call qword [sym.imp.USER32.dll_SetDlgItemTextA]
jmp 0x14000c5aa
cmp ecx, 1
jne 0x14000c5aa
nop dword [rax + rax]
inc rbx
cmp byte [rax + rbx], dil
jne 0x14000c530
mov r8, rbx
lea rcx, [rsp + 0xc0]
mov rdx, rax
call fcn.14000db50
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x82
call fcn.140187ea0
lea rbx, [rsp + 0x30]
nop dword [rax]
nop word [rax + rax]
movzx r8d, byte [rsp + rdi + 0xc0]
lea rdx, [0x1401d1918]
mov rcx, rbx
call qword [sym.imp.USER32.dll_wsprintfW]
inc rdi
add rbx, 4
cmp rdi, 0x20
jb 0x14000c570
mov rcx, qword [rsi + 0x18]
lea r8, [rsp + 0x30]
mov edx, 0x78d
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
mov rcx, rbp
call fcn.140167f64
mov rdi, qword [rsp + 0x118]
mov rbp, qword [rsp + 0x110]
mov rbx, qword [rsp + 0x108]
jmp 0x14000c5e2
mov rcx, qword [rsi + 0x18]
lea r8, [0x1401d1168]
mov edx, 0x78d
call qword [sym.imp.USER32.dll_SetDlgItemTextA]
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.140168660
add rsp, 0xf0
pop rsi
ret
Function at 0x1400119b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp byte [rcx], 0
je 0x1400119d9
cmp rdx, 1
jne 0x1400119c7
add rcx, 0x90
jmp 0x140059c10
cmp rdx, 2
jne 0x1400119d9
add rcx, 0x90
jmp 0x140059bc0
ret
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx]
test rcx, rcx
je 0x140059c05
xor r9d, r9d
xor r8d, r8d
mov edx, 0x89a
call fcn.14000f5d0
xor edx, edx
cmp rax, 1
jne 0x140059c05
mov rax, qword [rbx + 0x78]
mov rcx, rbx
inc rax
div qword [rbx + 0x70]
mov qword [rbx + 0x78], rdx
add rsp, 0x20
pop rbx
jmp fcn.1400594e0
add rsp, 0x20
pop rbx
ret
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx]
test rcx, rcx
je 0x140059c58
xor r9d, r9d
xor r8d, r8d
mov edx, 0x89a
call fcn.14000f5d0
cmp rax, 1
jne 0x140059c58
mov rax, qword [rbx + 0x78]
test rax, rax
jne 0x140059c44
mov rax, qword [rbx + 0x70]
dec rax
mov rcx, rbx
mov qword [rbx + 0x78], rax
add rsp, 0x20
pop rbx
jmp fcn.1400594e0
add rsp, 0x20
pop rbx
ret
Function at 0x140011d80
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov qword [rbp - 0x58], 0xfffffffffffffffe
mov qword [rsp + 0xc8], rbx
mov rax, qword [0x14028e6b0]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r14, r8
mov rdi, rdx
xor r15d, r15d
mov ebx, r15d
mov dword [rbp - 0x60], ebx
mov qword [rbp - 0x40], r15
mov qword [rbp - 0x38], r15
mov qword [rbp - 0x38], 7
mov qword [rbp - 0x40], r15
mov word [rbp - 0x50], r15w
lea rdx, [rbp - 0x50]
call fcn.140011fc0
test al, al
je 0x140011f69
lea rcx, [rbp - 0x50]
cmp qword [rbp - 0x38], 8
cmovae rcx, qword [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140011e06
test al, 0x10
je 0x140011e38
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x30]
call fcn.140012fe0
nop
mov ebx, 1
mov dword [rbp - 0x60], ebx
cmp qword [rax + 0x18], 8
jb 0x140011e26
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140011e3d
test al, 0x10
jne 0x140011e3d
mov sil, 1
jmp 0x140011e40
xor sil, sil
test bl, 1
je 0x140011e76
and ebx, 0xfffffffe
mov dword [rbp - 0x60], ebx
mov r8, qword [rbp - 0x18]
cmp r8, 8
jb 0x140011e65
inc r8
mov rdx, qword [rbp - 0x30]
lea rcx, [rbp - 0x30]
call fcn.140007680
mov qword [rbp - 0x18], 7
mov qword [rbp - 0x20], r15
mov word [rbp - 0x30], r15w
test sil, sil
jne 0x140011f69
lea rcx, [rbp - 0x50]
cmp qword [rbp - 0x38], 8
cmovae rcx, qword [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140011edb
test al, 0x10
je 0x140011edb
lea rax, [rbp - 0x50]
cmp rdi, rax
je 0x140011eb8
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rbp - 0x50]
mov rcx, rdi
call fcn.140006dd0
lea rax, [rbp - 0x50]
cmp r14, rax
je 0x140011ed4
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rbp - 0x50]
mov rcx, r14
call fcn.140006dd0
mov bl, 1
jmp 0x140011f6b
mov r9d, 1
or r8, 0xffffffffffffffff
lea rdx, [0x1401d3668]
lea rcx, [rbp - 0x50]
call fcn.140013070
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140011f69
lea rax, [rbp - 0x50]
cmp rdi, rax
je 0x140011f1a
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rbp - 0x50]
mov rcx, rdi
call fcn.140006dd0
mov r9, rbx
xor r8d, r8d
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x50]
call fcn.14000d950
nop
mov rdx, rax
mov rcx, r14
call fcn.140003d30
nop
mov r8, qword [rbp - 0x18]
cmp r8, 8
jb 0x140011f54
inc r8
mov rdx, qword [rbp - 0x30]
lea rcx, [rbp - 0x30]
call fcn.140007680
mov qword [rbp - 0x18], 7
mov qword [rbp - 0x20], r15
mov word [rbp - 0x30], r15w
mov bl, 1
jmp 0x140011f6b
xor bl, bl
mov r8, qword [rbp - 0x38]
cmp r8, 8
jb 0x140011f85
inc r8
mov rdx, qword [rbp - 0x50]
lea rcx, [rbp - 0x50]
call fcn.140007680
mov qword [rbp - 0x38], 7
mov qword [rbp - 0x40], r15
mov word [rbp - 0x50], r15w
movzx eax, bl
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140168660
mov rbx, qword [rsp + 0xc8]
add rsp, 0x80
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140017f50
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x220
mov rax, qword [0x14028e6b0]
xor rax, rsp
mov qword [rsp + 0x210], rax
mov rdi, rcx
mov rbx, rdx
lea rcx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_GetKeyboardState]
sar rbx, 0x10
lea r9, [rsp + 0x30]
xor esi, esi
movzx edx, bl
lea r8, [rsp + 0x40]
mov dword [rsp + 0x20], esi
mov ecx, edi
call qword [sym.imp.USER32.dll_ToAscii]
movzx edi, word [rsp + 0x30]
lea rdx, str.return_value___d
test edi, edi
lea rcx, [rsp + 0x140]
mov ebx, eax
cmovs edi, esi
mov r8d, edi
call qword [sym.imp.USER32.dll_wsprintfW]
cmp ebx, 1
cmovne edi, esi
movzx eax, di
mov rcx, qword [rsp + 0x210]
xor rcx, rsp
call fcn.140168660
lea r11, [rsp + 0x220]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14001e300
Capabilities:
Delete file

Disassembly:
mov rax, rsp
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x50], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x14028e6b0]
xor rax, rsp
mov qword [rbp - 8], rax
mov rdi, rdx
mov bl, 1
lea rdx, [rbp - 0x28]
mov rcx, rdi
call fcn.14001ef50
nop
xor esi, esi
cmp qword [rbp - 0x18], rsi
je 0x14001e3c4
mov qword [rbp - 0x38], rsi
mov qword [rbp - 0x30], rsi
mov r8d, 7
mov qword [rbp - 0x30], r8
mov qword [rbp - 0x38], rsi
mov word [rbp - 0x48], si
lea rcx, [rdi + 0xe0]
lea rax, [rbp - 0x48]
cmp rcx, rax
je 0x14001e385
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rbp - 0x48]
call fcn.140006dd0
mov r8, qword [rbp - 0x30]
cmp r8, 8
jb 0x14001e39b
inc r8
mov rdx, qword [rbp - 0x48]
lea rcx, [rbp - 0x48]
call fcn.140007680
mov qword [rbp - 0x30], 7
mov qword [rbp - 0x38], rsi
mov word [rbp - 0x48], si
lea rcx, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae rcx, qword [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne bl
mov r8, qword [rbp - 0x10]
cmp r8, 8
jb 0x14001e3de
inc r8
mov rdx, qword [rbp - 0x28]
lea rcx, [rbp - 0x28]
call fcn.140007680
mov qword [rbp - 0x10], 7
mov qword [rbp - 0x18], rsi
mov word [rbp - 0x28], si
movzx eax, bl
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140168660
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x14001e420
Capabilities:
Check if file exists
Delete file

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0x90
mov qword [rbp + 0x1f], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rdi
mov rax, qword [0x14028e6b0]
xor rax, rsp
mov qword [rbp + 0x47], rax
add rdx, 0xb0
cmp qword [rdx + 0x18], 8
jb 0x14001e45e
mov rdx, qword [rdx]
xor edi, edi
mov qword [rbp + 0x37], rdi
mov qword [rbp + 0x3f], rdi
mov qword [rbp + 0x3f], 7
mov qword [rbp + 0x37], rdi
mov word [rbp + 0x27], di
or rbx, 0xffffffffffffffff
cmp word [rdx], di
jne 0x14001e486
mov r8d, edi
jmp 0x14001e49a
mov r8, rbx
nop dword [rax]
inc r8
cmp word [rdx + r8*2], di
jne 0x14001e490
lea rcx, [rbp + 0x27]
call fcn.140006f10
nop
mov rcx, qword [rbp + 0x37]
sub rbx, rcx
cmp rbx, 1
ja 0x14001e4be
lea rcx, str.string_too_long
call fcn.140145858
int3
lea rbx, [rcx + 1]
movabs rax, 0x7ffffffffffffffe
cmp rbx, rax
jbe 0x14001e4de
lea rcx, str.string_too_long
call fcn.140145858
int3
mov rdx, qword [rbp + 0x3f]
cmp rdx, rbx
jae 0x14001e4f8
mov r8, rcx
mov rdx, rbx
lea rcx, [rbp + 0x27]
call fcn.140004af0
jmp 0x14001e511
test rbx, rbx
jne 0x14001e51e
mov qword [rbp + 0x37], rdi
lea rax, [rbp + 0x27]
cmp rdx, 8
cmovae rax, qword [rbp + 0x27]
mov word [rax], di
mov rcx, qword [rbp + 0x37]
mov rdx, qword [rbp + 0x3f]
test rbx, rbx
je 0x14001e549
lea rax, [rbp + 0x27]
cmp rdx, 8
cmovae rax, qword [rbp + 0x27]
mov word [rax + rcx*2], di
mov qword [rbp + 0x37], rbx
lea rax, [rbp + 0x27]
cmp qword [rbp + 0x3f], 8
cmovae rax, qword [rbp + 0x27]
mov word [rax + rbx*2], di
mov rdx, qword [rbp + 0x3f]
lea rcx, [rbp + 0x27]
cmp rdx, 8
cmovae rcx, qword [rbp + 0x27]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x14001e564
xor bl, bl
jmp 0x14001e5b2
xor eax, eax
mov qword [rbp - 0x11], rax
mov qword [rbp + 7], rax
mov qword [rbp - 0x19], rdi
lea rax, [rbp + 0x27]
cmp qword [rbp + 0x3f], 8
cmovae rax, qword [rbp + 0x27]
mov qword [rbp - 9], rax
mov qword [rbp - 1], rdi
mov dword [rbp - 0x11], 3
mov eax, 0x40
mov word [rbp + 7], ax
mov dword [rbp + 0xb], edi
xorps xmm0, xmm0
movdqu xmmword [rbp + 0xf], xmm0
lea rcx, [rbp - 0x19]
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
sete bl
mov r8, qword [rbp + 0x3f]
cmp r8, 8
jb 0x14001e5cc
inc r8
mov rdx, qword [rbp + 0x27]
lea rcx, [rbp + 0x27]
call fcn.140007680
mov qword [rbp + 0x3f], 7
mov qword [rbp + 0x37], rdi
mov word [rbp + 0x27], di
movzx eax, bl
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.140168660
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x14001ffd0
Capabilities:
Move file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
lea rcx, [rdx + 0xb0]
mov rdi, r8
cmp qword [rcx + 0x18], 8
mov rbx, rdx
jb 0x14001fff1
mov rcx, qword [rcx]
mov r8d, 3
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x14002000f
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
xor r8d, r8d
mov rdx, rdi
mov rcx, rbx
call fcn.140020f30
mov rbx, qword [rsp + 0x30]
mov al, 1
add rsp, 0x20
pop rdi
ret
Function at 0x14002a610
Capabilities:
Get common file path

Disassembly:
sub rsp, 0x248
mov rax, qword [0x14028e6b0]
xor rax, rsp
mov qword [rsp + 0x230], rax
lea rdx, [rsp + 0x20]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHLWAPI.dll_PathGetDriveNumberW]
cmp eax, 0xffffffff
je 0x14002a663
add al, 0x41
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.140168660
add rsp, 0x248
ret
xor al, al
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.140168660
add rsp, 0x248
ret

Function at 0x14002a680
Capabilities:
Check if file exists
Read file on windows

Disassembly:
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x370]
sub rsp, 0x470
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x4a0], rbx
mov rax, qword [0x14028e6b0]
xor rax, rsp
mov qword [rbp + 0x360], rax
mov rdi, rdx
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
mov dword [rsp + 0x20], esi
mov rcx, rdx
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
xor r8d, r8d
lea rdx, [0x1401d1168]
test eax, eax
jne 0x14002a702
mov qword [rbx + 0x18], InitCommonControls
mov qword [rbx + 0x10], rsi
mov byte [rbx], sil
mov rcx, rbx
call fcn.140006ca0
nop
mov dword [rsp + 0x20], 1
jmp 0x14002a852
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x50], InitCommonControls
mov qword [rsp + 0x48], rsi
mov byte [rsp + 0x38], sil
lea rcx, [rsp + 0x38]
call fcn.140006ca0
nop
lea rdx, [0x1401d4adc]
mov rcx, rdi
call fcn.14018f348
mov rdi, rax
nop dword [rax]
mov r9, rdi
mov edx, 1
mov r8d, 0x400
lea rcx, [rsp + 0x60]
call fcn.14018f5e0
test rax, rax
je 0x14002a771
mov r8, rax
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x38]
call fcn.140006670
jmp 0x14002a740
mov rcx, rdi
call fcn.14018f120
mov qword [rbx + 0x18], InitCommonControls
mov qword [rbx + 0x10], rsi
mov byte [rbx], 0
mov rcx, qword [rsp + 0x50]
cmp rcx, 0x10
jae 0x14002a7b2
mov r8, qword [rsp + 0x48]
add r8, 1
je 0x14002a7bf
lea rdx, [rsp + 0x38]
mov rcx, rbx
call fcn.140187210
mov rcx, qword [rsp + 0x50]
jmp 0x14002a7bf
mov rax, qword [rsp + 0x38]
mov qword [rbx], rax
mov qword [rsp + 0x38], rsi
mov rax, qword [rsp + 0x48]
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x18], rcx
mov qword [rsp + 0x50], InitCommonControls
mov qword [rsp + 0x48], rsi
mov byte [rsp + 0x38], 0
mov dword [rsp + 0x20], 1
mov rax, qword [rsp + 0x50]
cmp rax, 0x10
jb 0x14002a83f
inc rax
mov rcx, qword [rsp + 0x38]
cmp rax, 0x1000
jb 0x14002a83a
test cl, 0x1f
je 0x14002a80d
call fcn.14018acfc
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x14002a81c
call fcn.14018acfc
int3
sub rcx, rax
cmp rcx, 8
jae 0x14002a82b
call fcn.14018acfc
int3
cmp rcx, 0x27
jbe 0x14002a837
call fcn.14018acfc
int3
mov rcx, rax
call fcn.140167f5c
mov qword [rsp + 0x50], InitCommonControls
mov qword [rsp + 0x48], rsi
mov byte [rsp + 0x38], 0
mov rax, rbx
mov rcx, qword [rbp + 0x360]
xor rcx, rsp
call fcn.140168660
mov rbx, qword [rsp + 0x4a0]
add rsp, 0x470
pop rdi
pop rsi
pop rbp
ret
Function at 0x14002b2c0
Capabilities:
Check if file exists

Disassembly:
push rbx
sub rsp, 0x260
mov rax, qword [0x14028e6b0]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rbx, rcx
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x14002b355
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x208
mov rbx, rax
call fcn.140187ea0
xor r9d, r9d
mov dword [rsp + 0x30], 0x104
lea rax, [rsp + 0x30]
mov r8, rbx
mov qword [rsp + 0x28], rax
mov ecx, 0x440
lea rax, [rsp + 0x40]
lea edx, [r9 + 1]
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHLWAPI.dll_AssocQueryStringW]
test eax, eax
jne 0x14002b355
lea rdx, str.notepad.exe
lea rcx, [rsp + 0x40]
call fcn.1401883c8
test rax, rax
jne 0x14002b355
mov al, 1
jmp 0x14002b357
xor al, al
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140168660
add rsp, 0x260
pop rbx
ret

Function at 0x14002c040
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rax, qword [rcx + 0x10]
mov rbp, rdx
mov rdi, rcx
mov ecx, 2
lea rsi, [rax*2 + 2]
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rbx, rax
test rax, rax
je 0x14002c0b9
mov rcx, rbp
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x14002c0aa
call qword [sym.imp.USER32.dll_EmptyClipboard]
mov rcx, rbx
test eax, eax
je 0x14002c0ad
call qword [sym.imp.KERNEL32.dll_GlobalLock]
test rax, rax
jne 0x14002c0bd
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalFree]
call qword [sym.imp.USER32.dll_CloseClipboard]
xor al, al
jmp 0x14002c0ff
cmp qword [rdi + 0x18], 8
jb 0x14002c0c7
mov rdi, qword [rdi]
shr rsi, 1
mov r8, rdi
mov rdx, rsi
mov rcx, rax
call fcn.14018fc10
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rdx, rbx
mov ecx, InitCommonControls
call qword [sym.imp.USER32.dll_SetClipboardData]
test rax, rax
je 0x14002c0aa
call qword [sym.imp.USER32.dll_CloseClipboard]
test eax, eax
setne al
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x14002d6d0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
lea rdx, [0x1401e0400]
call fcn.14018f348
mov rdi, rax
or r8, 0xffffffffffffffff
inc r8
cmp byte [rbx + r8], 0
jne 0x14002d6f0
mov r9, rdi
mov edx, 1
mov rcx, rbx
call fcn.140199688
mov rcx, rdi
call fcn.1401992cc
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.14018f120