joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400a0210
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push rbx
push rsi
push rdi
mov eax, 0x2030
call fcn.1400fe810
sub rsp, rax
mov rax, qword [0x140132350]
xor rax, rsp
mov qword [rsp + 0x2020], rax
mov rax, rdx
mov rbx, rcx
lea rdx, [0x140110150]
mov rcx, rax
mov rsi, r8
call fcn.1400b5c54
test rax, rax
mov rdi, rax
sete dl
mov byte [rbx + 0x3038], dl
test dl, dl
je 0x1400a0262
xor al, al
jmp 0x1400a02a4
mov r9, rax
mov ebx, 1
jmp 0x1400a0282
lea rcx, [rsp + 0x20]
mov r9, rsi
mov r8, rax
mov rdx, rbx
call fcn.1400ef054
mov r9, rdi
lea rcx, [rsp + 0x20]
mov r8d, 0x2000
mov rdx, rbx
call fcn.1400ef54c
test rax, rax
jne 0x1400a026c
mov rcx, rdi
call fcn.1400eee40
mov al, bl
mov rcx, qword [rsp + 0x2020]
xor rcx, rsp
call fcn.1400e9d80
add rsp, 0x2030
pop rdi
pop rsi
pop rbx
ret

Function at 0x1400a02c0
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x2038
call fcn.1400fe810
sub rsp, rax
mov rax, qword [0x140132350]
xor rax, rsp
mov qword [rsp + 0x2020], rax
mov rax, rdx
mov rbx, rcx
lea rdx, [0x140110150]
mov rcx, rax
mov r15, r9
mov r14, r8
call fcn.1400b5c54
test rax, rax
mov rsi, rax
sete dl
mov byte [rbx + 0x3038], dl
test dl, dl
jne 0x1400a0445
xor r13d, r13d
mov r9, rax
lea rcx, [rsp + 0x20]
mov r8d, 0x2000
mov edx, 1
call fcn.1400ef54c
mov r12, rax
cmp rax, 0x28
jbe 0x1400a043d
lea rbp, [rax - 0x28]
xor edi, edi
test rbp, rbp
je 0x1400a03f0
lea rbx, [rsp + 0x24]
cmp byte [rsp + rdi + 0x20], 0x2a
jne 0x1400a0387
cmp byte [rsp + rdi + 0x21], 0x2a
jne 0x1400a0387
lea rcx, [rsp + rdi + 0x22]
lea rdx, str.messages
mov r8d, 0xc
call fcn.1400ed110
test eax, eax
je 0x1400a040b
cmp word [rbx - 4], 0x2a
jne 0x1400a03ae
cmp word [rbx - 2], 0x2a
jne 0x1400a03ae
lea rdx, [0x14010df90]
mov r8d, 0xc
mov rcx, rbx
call fcn.1400ee530
test eax, eax
je 0x1400a040b
mov eax, 0xfeff
cmp word [rbx - 4], ax
jne 0x1400a03e0
cmp word [rbx - 2], 0x2a
jne 0x1400a03e0
cmp word [rbx], 0x2a
jne 0x1400a03e0
lea rcx, [rbx + 2]
lea rdx, [0x14010df90]
mov r8d, 0xc
call fcn.1400ee530
test eax, eax
je 0x1400a040b
inc rdi
add rbx, 2
cmp rdi, rbp
jb 0x1400a035a
lea r13d, [r13 + r12 - 0x28]
xor r8d, r8d
mov rcx, rsi
mov edx, r13d
call fcn.1400ef620
mov r9, rsi
jmp 0x1400a0324
lea edx, [rdi + r13]
xor r8d, r8d
mov rcx, rsi
call fcn.1400ef620
mov r9, rsi
mov r8, r15
mov edx, 1
mov rcx, r14
call fcn.1400ef54c
mov rcx, rsi
mov rbx, rax
call fcn.1400eee40
mov rax, rbx
jmp 0x1400a0447
mov rcx, rsi
call fcn.1400eee40
xor eax, eax
mov rcx, qword [rsp + 0x2020]
xor rcx, rsp
call fcn.1400e9d80
add rsp, 0x2038
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400a046c
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r13
push r14
mov eax, 0x2030
call fcn.1400fe810
sub rsp, rax
mov rax, qword [0x140132350]
xor rax, rsp
mov qword [rsp + 0x2020], rax
mov rax, rdx
mov rbx, rcx
lea rdx, [0x140112a18]
mov rcx, rax
call fcn.1400b5c54
test rax, rax
mov rsi, rax
sete dl
mov byte [rbx + 0x3038], dl
test dl, dl
jne 0x1400a0590
xor r13d, r13d
mov r9, rax
lea r14d, [r13 + 1]
lea rcx, [rsp + 0x20]
mov r8d, 0x2000
mov rdx, r14
call fcn.1400ef54c
mov r12, rax
cmp rax, 0x20
jbe 0x1400a0588
lea ebp, [r12 - 0x20]
xor edi, edi
test ebp, ebp
jle 0x1400a0536
lea rbx, [rsp + 0x21]
cmp byte [rbx - 1], 0x61
jne 0x1400a052c
cmp byte [rbx], 0x73
jne 0x1400a052c
movsxd rax, edi
lea rdx, str.Invoker_
mov r8d, 0x14
lea rcx, [rsp + rax + 0x22]
call fcn.1400ed110
test eax, eax
je 0x1400a054e
add edi, r14d
add rbx, r14
cmp edi, ebp
jl 0x1400a0503
lea r13d, [r13 + r12 - 0x20]
xor r8d, r8d
mov rcx, rsi
mov edx, r13d
call fcn.1400ef620
mov r9, rsi
jmp 0x1400a04d3
lea edx, [rdi + r13]
xor r8d, r8d
mov rcx, rsi
call fcn.1400ef620
lea rcx, str.requireAdministrator_
mov r9, rsi
mov r8d, 0x15
mov rdx, r14
call fcn.1400ef054
mov rcx, rsi
cmp rax, 0x15
sete bl
call fcn.1400eee40
mov al, bl
jmp 0x1400a0592
mov rcx, rsi
call fcn.1400eee40
xor al, al
mov rcx, qword [rsp + 0x2020]
xor rcx, rsp
call fcn.1400e9d80
lea r11, [rsp + 0x2030]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x1400a188c
Capabilities:
Set registry value

Disassembly:
sub rsp, 0x28
mov r8, qword [0x1401855d8]
mov rcx, qword [str.SFXDefault]
lea rdx, [0x1401106f8]
call fcn.14009b888
mov r11, qword [0x1401855d8]
mov rcx, qword [str.SFXDefault]
mov r8d, dword [r11 + 0x1000]
lea rdx, str.PathType
call fcn.14009b8a0
mov r11, qword [0x1401855d8]
mov rcx, qword [str.SFXDefault]
movzx r8d, byte [r11 + 0x1004]
lea rdx, str.SavePath
call fcn.14009b8a0
mov r8, qword [0x1401855d8]
mov rcx, qword [str.SFXDefault]
lea rdx, [0x14010eb90]
add r8, 0x1006
call fcn.14009b888
mov r8, qword [0x1401855d8]
mov rcx, qword [str.SFXDefault]
lea rdx, str.Presetup
add r8, 0x11006
call fcn.14009b888
mov r11, qword [0x1401855d8]
mov rcx, qword [str.SFXDefault]
movzx r8d, byte [r11 + 0x21006]
lea rdx, str.SetupCode
call fcn.14009b8a0
mov r11, qword [0x1401855d8]
mov rcx, qword [str.SFXDefault]
movzx r8d, byte [r11 + 0x21007]
lea rdx, str.TempMode
call fcn.14009b8a0
mov r8, qword [0x1401855d8]
mov rcx, qword [str.SFXDefault]
lea rdx, str.TempModeQuestion
add r8, 0x21008
call fcn.14009b888
mov r8, qword [0x1401855d8]
mov rcx, qword [str.SFXDefault]
lea rdx, str.TempModeTitle
add r8, 0x21808
call fcn.14009b888
mov r11, qword [0x1401855d8]
mov rcx, qword [str.SFXDefault]
mov r8d, dword [r11 + 0x21a08]
lea rdx, str.Silent
call fcn.14009b8a0
mov r11, qword [0x1401855d8]
mov rcx, qword [str.SFXDefault]
mov r8d, dword [r11 + 0x21a0c]
lea rdx, str.Overwrite
call fcn.14009b8a0
mov r11, qword [0x1401855d8]
mov rcx, qword [str.SFXDefault]
movzx r8d, byte [r11 + 0x21a11]
lea rdx, str.UpdateFiles
call fcn.14009b8a0
mov r11, qword [0x1401855d8]
mov rcx, qword [str.SFXDefault]
movzx r8d, byte [r11 + 0x21a10]
lea rdx, str.FreshFiles
call fcn.14009b8a0
mov r8, qword [0x1401855d8]
mov rcx, qword [str.SFXDefault]
lea rdx, str.DelFiles
add r8, 0x21a12
call fcn.14009b888
mov r8, qword [0x1401855d8]
mov rcx, qword [str.SFXDefault]
lea rdx, str.Title
add r8, 0x23a12
call fcn.14009b888
mov r8, qword [0x1401855d8]
mov rcx, qword [str.SFXDefault]
lea rdx, [0x140112c78]
add r8, 0x23c12
call fcn.14009b888
mov r8, qword [0x1401855d8]
add r8, 0x43c12
mov rcx, qword [str.SFXDefault]
lea rdx, str.LicenseTitle
call fcn.14009b888
mov r8, qword [0x1401855d8]
mov rcx, qword [str.SFXDefault]
lea rdx, str.LicenseText
add r8, 0x43e12
call fcn.14009b888
mov r8, qword [0x1401855d8]
mov rcx, qword [str.SFXDefault]
lea rdx, str.ShortcutText
add r8, 0x63e12
call fcn.14009b888
mov rcx, qword [str.SFXDefault]
lea r8, [0x140171efa]
lea rdx, str.SFXLogo
call fcn.14009b888
mov rcx, qword [str.SFXDefault]
lea r8, [0x140170efa]
lea rdx, str.SFXIcon
call fcn.14009b888
movzx r8d, byte [0x140172efa]
mov rcx, qword [str.SFXDefault]
lea rdx, str.SFXElevate
call fcn.14009b8a0
mov rcx, qword [str.SFXDefault]
lea r8, [0x140169b28]
lea rdx, str.SFXModule
add rsp, 0x28
jmp fcn.14009b888
Function at 0x1400a1cd4
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x2030
call fcn.1400fe810
sub rsp, rax
mov rax, qword [0x140132350]
xor rax, rsp
mov qword [rsp + 0x2020], rax
lea rdx, [0x140110150]
call fcn.1400423bc
mov rsi, rax
test rax, rax
je 0x1400a1dba
xor r12d, r12d
xor r13d, r13d
lea ebx, [r12 + 1]
lea rcx, [rsp + 0x20]
mov r9, rsi
mov r8d, 0x2000
mov rdx, rbx
call fcn.1400ef54c
cmp eax, 0x20
mov r15, rax
jle 0x1400a1dae
lea r14d, [rax - 0x20]
xor ebp, ebp
test r14d, r14d
jle 0x1400a1d8f
lea rdi, [rsp + 0x21]
cmp byte [rdi - 1], 0x72
jne 0x1400a1d85
cmp byte [rdi], 0x65
jne 0x1400a1d85
movsxd rax, ebp
lea rdx, str.quireAdministrator_
mov r8d, 0x14
lea rcx, [rsp + rax + 0x22]
call fcn.1400ed110
test eax, eax
je 0x1400a1db0
add ebp, ebx
add rdi, rbx
cmp ebp, r14d
jl 0x1400a1d5c
lea r12d, [r12 + r15 - 0x20]
xor r8d, r8d
mov rcx, rsi
mov edx, r12d
call fcn.1400ef620
add r13d, ebx
cmp r13d, 0x80
jb 0x1400a1d2e
xor bl, bl
mov rcx, rsi
call fcn.1400eee40
mov al, bl
mov rcx, qword [rsp + 0x2020]
xor rcx, rsp
call fcn.1400e9d80
lea r11, [rsp + 0x2030]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1400a3dd0
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x180
mov rax, qword [0x140132350]
xor rax, rsp
mov qword [rsp + 0x170], rax
xor ebp, ebp
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
cmp qword [0x140130550], rbp
jne 0x1400a3e45
lea r9d, [rbp + 0x64]
lea r8, [rsp + 0xa0]
lea edx, [rbp + 0xf]
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
movzx r11d, word [rsp + 0xa0]
lea rax, [0x140185600]
mov word [0x140185600], r11w
mov word [0x140185602], bp
mov qword [0x140130550], rax
lea rdx, [rsp + 0x30]
mov r8d, 0x32
mov rcx, rsi
call fcn.140065dc4
lea r9, [0x140130538]
lea r8, [rsp + 0x30]
xor edx, edx
mov ecx, 0x400
mov dword [rsp + 0x28], edi
mov word [rbx], bp
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_GetNumberFormatW]
mov word [rbx + rdi*2 - 2], bp
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1400e9d80
mov rbx, qword [rsp + 0x1b8]
add rsp, 0x180
pop rdi
pop rsi
pop rbp
ret

Function at 0x1400a4290
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, r8
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
mov rsi, rax
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
test eax, eax
jle 0x1400a430e
lea edi, [rax + 1]
mov eax, 2
movsxd rcx, edi
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.1400e9a7c
mov rbx, rax
test rax, rax
je 0x1400a430e
mov r8d, edi
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetWindowTextW]
xor r9d, r9d
xor r8d, r8d
mov rdx, rbp
mov rcx, rbx
call fcn.1400a4134
mov rcx, rbx
call fcn.1400e9b08
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400a5cbc
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x80
mov edi, edx
mov rbx, rcx
cmp edx, 0xa9
jne 0x1400a5ce7
call fcn.1400a5c64
mov al, 1
jmp 0x1400a5e0b
cmp edx, 0xaa
jne 0x1400a5d1f
mov ecx, 0x4f9
call fcn.14005fad8
xor r9d, r9d
xor edx, edx
mov r8, rax
lea rax, [0x140109540]
xor ecx, ecx
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x1400a5ce0
call fcn.1400a4324
mov rsi, rax
cmp edi, 0xab
jne 0x1400a5d3f
or dword [rbx + 0x100], 0xffffffff
lea rax, [0x140109540]
jmp 0x1400a5db8
lea eax, [rdi - 0x3e8]
cmp eax, 0x7f
ja 0x1400a5e09
xor edx, edx
lea rcx, [rsp + 0x30]
lea r8d, [rdx + 0x50]
call fcn.1400eada0
lea r9, [rsp + 0x30]
xor r8d, r8d
mov edx, edi
mov rcx, rsi
mov dword [rsp + 0x30], 0x50
mov dword [rsp + 0x34], 0x20
call qword [sym.imp.USER32.dll_GetMenuItemInfoW]
test eax, eax
je 0x1400a5e09
mov rax, qword [rbx + 0xe8]
cmp qword [rsp + 0x60], rax
jae 0x1400a5e09
movsxd rax, dword [rsp + 0x60]
mov rcx, rax
mov dword [rbx + 0x100], eax
imul rcx, rcx, 0x1304
add rcx, qword [rbx + 0xe0]
call fcn.140050ce8
lea rdx, str.ActivePath
lea rcx, str.InterfaceThemes
mov r8, rax
call fcn.14009b888
mov edx, dword [rbx + 0x1104]
cmp edx, 0xffffffff
je 0x1400a5de5
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.USER32.dll_CheckMenuItem]
mov r8d, 8
mov edx, edi
mov rcx, rsi
call qword [sym.imp.USER32.dll_CheckMenuItem]
mov rcx, rbx
mov dword [rbx + 0x1104], edi
call fcn.1400a4f44
jmp 0x1400a5ce0
xor al, al
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret

Function at 0x1400a5ea8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov ecx, r9d
mov dil, r8b
mov ebx, edx
call qword [sym.imp.USER32.dll_GetSysColor]
and dword [rsp + 0x30], 0
lea rcx, [rbx + rbx*4]
add rcx, rcx
mov dword [rsp + 0x34], eax
lea rax, [0x140130580]
test dil, dil
je 0x1400a5ee2
mov ebx, dword [rax + rcx*8 + 4]
jmp 0x1400a5ee6
mov ebx, dword [rax + rcx*8 + 8]
test dil, dil
jne 0x1400a5f25
mov rcx, qword [0x140149f18]
movsxd rdx, ebx
mov r8d, 2
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rcx, qword [0x140149f18]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x1400a5f1d
cmp word [rax + 0xe], 8
je 0x1400a5f25
mov dword [rsp + 0x30], 0x800080
mov rcx, qword [0x140149f18]
lea r9, [rsp + 0x30]
movsxd rdx, ebx
xor r8d, r8d
mov dword [rsp + 0x20], 1
call qword [sym.imp.COMCTL32.dll_CreateMappedBitmap]
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x1400a7e7c
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r14
sub rsp, 0xf0
mov rdi, rcx
mov rcx, qword [rcx + 8]
test rcx, rcx
je 0x1400a7eae
call qword [sym.imp.USER32.dll_DestroyWindow]
and qword [rdi + 8], 0
mov r14d, 1
lea rdx, str.ViewSmall
lea rcx, str.GeneralToolbar
mov r8d, r14d
call fcn.14009b908
test eax, eax
je 0x1400a80ee
and qword [rsp + 0x58], 0
mov rax, qword [0x140149f10]
lea rdx, str.ToolbarWindow32
mov qword [rsp + 0x50], rax
mov rax, qword [0x140158350]
mov qword [rsp + 0x48], 0xd
mov qword [rsp + 0x40], rax
and dword [rsp + 0x38], 0
and dword [rsp + 0x30], 0
and dword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
mov r9d, 0x56000944
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.USER32.dll_CreateWindowExW]
lea r8d, [r14 + 0x1f]
xor r9d, r9d
mov rcx, rax
mov edx, 0x41e
mov qword [rdi + 8], rax
call qword [sym.imp.USER32.dll_SendMessageW]
call fcn.1400b6a40
lea esi, [r14 + 0xf]
mov r12b, al
mov ebp, esi
test al, al
je 0x1400a7f62
mov ecx, esi
call fcn.1400b6968
mov ecx, esi
mov ebp, eax
call fcn.1400b6968
mov esi, eax
movzx edx, si
movzx ecx, bp
xor r8d, r8d
shl edx, 0x10
or edx, ecx
mov rcx, qword [rdi + 8]
movsxd rbx, edx
mov edx, 0x41f
mov r9, rbx
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rdi + 8]
mov r9, rbx
xor r8d, r8d
mov edx, 0x420
call qword [sym.imp.USER32.dll_SendMessageW]
xor r9d, r9d
lea rdx, str.FolderUp.bmp
lea r8d, [r9 + 0xf]
lea rcx, [0x1401679c0]
call fcn.1400a5758
mov rbx, rax
test rax, rax
jne 0x1400a7fc0
mov rbx, qword [rdi + 0x30]
test r12b, r12b
je 0x1400a7fe4
mov r8d, esi
mov edx, ebp
mov rcx, rbx
call fcn.1400b6ab4
lea rcx, [0x1401679c0]
mov rdx, rax
mov rbx, rax
call fcn.1400a518c
mov rcx, qword [rdi + 8]
and qword [rsp + 0x60], 0
lea r9, [rsp + 0x60]
mov r8, r14
mov edx, 0x413
mov qword [rsp + 0x68], rbx
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rdi + 8]
lea r9, [0x140130bc0]
mov r8, r14
mov edx, 0x444
call qword [sym.imp.USER32.dll_SendMessageW]
mov ebx, 2
lea r8, [rsp + 0x80]
mov edx, ebx
mov rcx, rdi
call fcn.1400a7080
mov eax, dword [rsp + 0x88]
lea ecx, [rbx + 0x10]
test eax, eax
mov dword [rsp + 0x80], 0x4c
mov dword [rsp + 0x84], 0x173
cmove eax, r14d
and dword [rsp + 0xb0], 0
mov dword [rsp + 0xc8], ebx
or eax, 4
mov dword [rsp + 0x88], eax
mov rax, qword [rdi + 8]
mov qword [rsp + 0xa8], rax
call qword [sym.imp.USER32.dll_GetSysColor]
lea ecx, [rbx + 0xd]
mov dword [rsp + 0x8c], eax
call qword [sym.imp.USER32.dll_GetSysColor]
lea ecx, [rbx + 0x26]
mov dword [rsp + 0x90], eax
mov eax, dword [rsp + 0xb8]
lea rdx, [rsp + 0x70]
test eax, eax
cmove eax, ecx
mov rcx, qword [0x140162bd0]
mov dword [rsp + 0xb8], eax
call qword [sym.imp.USER32.dll_GetClientRect]
mov r11d, dword [rsp + 0x7c]
mov rcx, qword [rdi + 0x10]
lea r9, [rsp + 0x80]
or r8, 0xffffffffffffffff
mov edx, 0x40a
mov dword [rsp + 0xb4], r11d
call qword [sym.imp.USER32.dll_SendMessageW]
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop r12
pop rdi
ret
Function at 0x1400aa8b4
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rdi
push r12
push r13
mov eax, 0x2040
call fcn.1400fe810
sub rsp, rax
mov rax, qword [0x140132350]
xor rax, rsp
mov qword [rsp + 0x2030], rax
xor ebx, ebx
mov r8, rcx
cmp dword [rcx + 0x4c], ebx
je 0x1400aaadd
cmp byte [rcx + 0x49], bl
je 0x1400aaadd
cmp dword [rdx + 0x10], 6
jb 0x1400aaadd
mov rax, qword [rdx]
mov ecx, 0x400c
cmp word [rax + 0x78], cx
jne 0x1400aaadd
mov rax, qword [rax + 8]
or ecx, 0xffffffff
lea edi, [rbx + 5]
mov word [rax], cx
cmp dword [r8 + 0x4c], 2
mov rax, qword [rdx]
mov rcx, qword [rax + 0x80]
mov rbp, qword [rcx + 8]
jne 0x1400aa93e
call fcn.1400aa054
mov edi, eax
mov edx, edi
lea r13, str.open
lea r12, [0x140109540]
cmp edi, ebx
je 0x1400aaa8a
sub edx, 1
je 0x1400aaa58
sub edx, 1
je 0x1400aaa33
cmp edx, 2
jne 0x1400aaaaf
lea r9, [rsp + 0x30]
lea rdx, str.http_shellopencommand
mov r8, r12
mov rcx, 0xffffffff80000000
mov dword [rsp + 0x28], 0x800
mov qword [rsp + 0x20], r12
call fcn.14009b0a4
mov edx, 0x22
cmp word [rsp + 0x30], dx
jne 0x1400aaabf
lea rcx, [rsp + 0x32]
call fcn.1400ed378
mov rdi, rax
cmp rax, rbx
je 0x1400aaabf
lea rcx, [rsp + 0x30]
call fcn.140050ce8
lea rdx, str.opera.exe
mov r8d, 9
mov rcx, rax
call fcn.140068d60
cmp eax, ebx
jne 0x1400aaabf
lea r8, str._newwindow__s
lea rcx, [rsp + 0x1030]
mov r9, rbp
mov edx, 0x800
mov word [rdi + 2], bx
call fcn.1400e0c0c
lea r8, [rsp + 0x30]
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x1030]
mov rdx, r13
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rbx, rax
jmp 0x1400aaab9
lea r8, str.__new_window__s
lea rcx, [rsp + 0x1030]
mov r9, rbp
mov edx, 0x800
call fcn.1400e0c0c
lea r8, str.chrome.exe
jmp 0x1400aaa0b
lea r8, str._new_window__s
lea rcx, [rsp + 0x1030]
mov r9, rbp
mov edx, 0x800
call fcn.1400e0c0c
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r12
lea r8, str.firefox.exe
jmp 0x1400aaa18
lea r8, str.iexplore.exe
mov r9, rbp
mov rdx, r13
xor ecx, ecx
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r12
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rbx, rax
cmp edi, 5
je 0x1400aaabf
cmp edi, 3
je 0x1400aaabf
cmp rbx, 0x20
ja 0x1400aaadd
xor r9d, r9d
mov r8, rbp
mov rdx, r13
xor ecx, ecx
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r12
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rcx, qword [rsp + 0x2030]
xor rcx, rsp
call fcn.1400e9d80
lea r11, [rsp + 0x2040]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
Function at 0x1400ab3b8
Capabilities:
Write file on windows

Disassembly:
test rcx, rcx
je 0x1400ab447
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
lea rdx, [0x14016bb2e]
lea rcx, str.Rar_CM
mov r8d, 0x800
call fcn.1400b5c90
mov rsi, rax
test rax, rax
je 0x1400ab438
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasw ax, word [rdi]
lea edx, [rax + 2]
mov r9, rsi
not rcx
lea r8, [rcx - 1]
lea rdi, [rcx - 1]
mov rcx, rbx
call fcn.1400ef054
mov rcx, rsi
call fcn.1400eee40
mov edx, dword [0x14016cb30]
mov eax, 3
test rdi, rdi
cmovne edx, eax
mov dword [0x14016cb30], edx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1400ab75c
Capabilities:
Get disk information
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
mov eax, 0x5460
call fcn.1400fe810
sub rsp, rax
mov rax, qword [0x140132350]
xor rax, rsp
mov qword [rsp + 0x5450], rax
mov rsi, rcx
mov rcx, rdx
mov rdi, rdx
call fcn.140050ce8
mov edx, 0x3a
mov rcx, rax
call fcn.1400ed378
xor ebp, ebp
cmp rax, rbp
je 0x1400ab7e4
cmp byte [0x140186630], bpl
jne 0x1400ab7e4
lea ecx, [rbp + 0x65]
call fcn.14005fad8
mov ecx, 0x528
mov rbx, rax
call fcn.14005fad8
lea r9d, [rbp + 0x31]
mov r8, rbx
mov rcx, rsi
mov rdx, rax
call fcn.1400b6df8
cmp eax, 1
jne 0x1400ab996
mov byte [0x140186630], al
lea rdx, [rsp + 0x1050]
mov rcx, rdi
sub rdx, rdi
movzx eax, word [rcx]
mov word [rdx + rcx], ax
add rcx, 2
cmp ax, bp
jne 0x1400ab7f2
lea rcx, [rsp + 0x1050]
call fcn.140050fc8
mov ebx, 0x800
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x1050]
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea rcx, [rsp + 0x50]
mov word [rsp + 0x104e], bp
call fcn.140050ce8
cmp word [rax], bp
je 0x1400ab8d0
jmp 0x1400ab8bd
lea rcx, [rsp + 0x50]
xor edx, edx
call fcn.140082fc8
cmp al, bpl
jne 0x1400ab8d0
mov ecx, 0x14d
call fcn.14005fad8
lea r9, [rsp + 0x50]
lea r8, str.__s__n_s
lea rcx, [rsp + 0x4050]
mov edx, 0xa00
mov qword [rsp + 0x20], rax
call fcn.1400e0c0c
mov ecx, 0x65
call fcn.14005fad8
lea rdx, [rsp + 0x4050]
mov r9d, 0x34
mov r8, rax
mov rcx, rsi
call fcn.1400b6df8
cmp eax, 6
jne 0x1400ab996
lea rcx, [rsp + 0x50]
xor edx, edx
call fcn.140042ae4
lea rcx, [rsp + 0x50]
call fcn.14004258c
cmp al, bpl
je 0x1400ab847
call fcn.140044e44
cmp eax, 0x501
jb 0x1400ab99a
lea r8, [rsp + 0x2050]
lea rcx, [0x140162be0]
mov r9, rbx
mov rdx, rdi
call fcn.14008eba0
lea rdx, [rsp + 0x3050]
lea rcx, [rsp + 0x2050]
mov r8, rbx
call fcn.14005165c
mov dword [rsp + 0x38], ebp
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x3050]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
cmp eax, ebp
je 0x1400ab99a
bt dword [rsp + 0x40], 0x13
jae 0x1400ab99a
mov ecx, 0x65e
call fcn.14005fad8
lea r9, [rsp + 0x3050]
lea rcx, [rsp + 0x4050]
mov r8, rax
mov edx, 0xa00
call fcn.1400e0c0c
mov ecx, 0x65
call fcn.14005fad8
lea rdx, [rsp + 0x4050]
mov r9d, 0x30
mov r8, rax
mov rcx, rsi
call fcn.1400b6df8
xor al, al
jmp 0x1400ab99c
mov al, 1
mov rcx, qword [rsp + 0x5450]
xor rcx, rsp
call fcn.1400e9d80
mov rbx, qword [rsp + 0x5490]
add rsp, 0x5460
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400b5094
Capabilities:
Capture screenshot

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x80
mov rbx, rcx
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, rax
mov r14, rax
call qword [sym.imp.USER32.dll_GetDC]
mov rcx, rax
mov r13, rax
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov rcx, r13
mov r12, rax
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
lea r8, [rsp + 0x60]
mov edx, 0x20
mov rcx, rbx
mov rbp, rax
call qword [sym.imp.GDI32.dll_GetObjectW]
mov r8d, dword [rsp + 0x68]
mov edx, dword [rsp + 0x64]
mov rcx, r13
call qword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov rdx, rbx
mov rcx, r12
mov rsi, rax
call qword [sym.imp.GDI32.dll_SelectObject]
mov rdx, rsi
mov rcx, rbp
mov rdi, rax
call qword [sym.imp.GDI32.dll_SelectObject]
mov edx, dword [rsp + 0x68]
mov r9d, dword [rsp + 0x64]
mov dword [rsp + 0x50], 0xcc0020
mov dword [rsp + 0x48], edx
mov ecx, r9d
lea r8d, [r9 - 1]
neg ecx
mov rbx, rax
mov dword [rsp + 0x40], ecx
and dword [rsp + 0x38], 0
mov dword [rsp + 0x30], r8d
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], edx
xor r8d, r8d
xor edx, edx
mov rcx, rbp
call qword [sym.imp.GDI32.dll_StretchBlt]
mov eax, dword [rsp + 0x68]
mov r9d, dword [rsp + 0x64]
mov dword [rsp + 0x40], 0xcc0020
and dword [rsp + 0x38], 0
and dword [rsp + 0x30], 0
xor r8d, r8d
xor edx, edx
mov rcx, r12
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], eax
call qword [sym.imp.GDI32.dll_BitBlt]
mov rdx, rdi
mov rcx, r12
call qword [sym.imp.GDI32.dll_SelectObject]
mov rdx, rbx
mov rcx, rbp
call qword [sym.imp.GDI32.dll_SelectObject]
mov rcx, rsi
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, r12
call qword [sym.imp.GDI32.dll_DeleteDC]
mov rcx, rbp
call qword [sym.imp.GDI32.dll_DeleteDC]
mov rdx, r13
mov rcx, r14
call qword [sym.imp.USER32.dll_ReleaseDC]
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop r12
ret