joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400b9210
Capabilities:
Reference sql statements

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov r14, rcx
xor ebp, ebp
mov qword [rsp + 0x70], rbp
lea ecx, [rbp + 0x10]
call fcn.1400fa320
mov rbx, rax
test rax, rax
je 0x1400b924d
lea rax, vtable.CWMIEvent.0
mov qword [rbx], rax
mov dword [rbx + 8], ebp
jmp 0x1400b9250
mov rbx, rbp
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [r14 + 0x20]
mov rax, qword [rcx]
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x20], rdx
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
call qword [rax + 0x20]
mov edi, eax
test eax, eax
jns 0x1400b928c
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx + 0x10]
mov eax, edi
jmp 0x1400b938c
mov ecx, 0x18
call fcn.1400fa320
mov rsi, rax
mov qword [rsp + 0x78], rax
test rax, rax
je 0x1400b92bf
mov qword [rax + 8], rbp
mov dword [rax + 0x10], 1
lea rcx, str.SELECT__FROM___InstanceCreationEvent_WITHIN_1_WHERE_TargetInstance_ISA_Win32_Process
call fcn.1400f7400
mov qword [rsi], rax
jmp 0x1400b92c2
mov rsi, rbp
mov qword [rsp + 0x78], rsi
test rsi, rsi
jne 0x1400b92d7
mov ecx, 0x8007000e
call fcn.1400f73f0
nop
mov ecx, 0x18
call fcn.1400fa320
mov rdi, rax
mov qword [rsp + 0x80], rax
test rax, rax
je 0x1400b930d
mov qword [rax + 8], rbp
mov dword [rax + 0x10], 1
lea rcx, [0x140157358]
call fcn.1400f7400
mov qword [rdi], rax
jmp 0x1400b9310
mov rdi, rbp
mov qword [rsp + 0x80], rdi
test rdi, rdi
jne 0x1400b9328
mov ecx, 0x8007000e
call fcn.1400f73f0
nop
mov rcx, qword [r14 + 0x10]
mov r10, qword [rcx]
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbp
mov r9d, 0x80
mov r8, qword [rsi]
mov rdx, qword [rdi]
call qword [r10 + VarDecFix]
mov ebp, eax
mov rcx, rdi
call fcn.14003c270
nop
mov rcx, rsi
call fcn.14003c270
test ebp, ebp
jns 0x1400b937e
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx + 0x10]
mov rcx, qword [rsp + 0x70]
mov rdx, qword [rcx]
call qword [rdx + 0x10]
jmp 0x1400b938a
mov qword [r14], rbx
mov rax, qword [rsp + 0x70]
mov qword [r14 + 0x18], rax
mov eax, ebp
add rsp, 0x40
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400b95f0
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x68
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov rdi, rcx
cmp qword [rcx + 0x30], 0
jne 0x1400b9616
mov eax, 0x80041008
jmp 0x1400b97d7
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
xor ebp, ebp
mov qword [rsp + 0x90], rbp
lea rax, [rsp + 0x90]
mov qword [rsp + 0x20], rax
lea r9, [0x14016f218]
xor edx, edx
lea r8d, [rbp + 1]
lea rcx, [0x14016f2e8]
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov ebx, eax
test eax, eax
js 0x1400b9774
mov qword [rsp + 0x98], rbp
lea ecx, [rbp + 0x18]
call fcn.1400fa320
mov rbx, rax
mov qword [rsp + 0xa8], rax
test rax, rax
je 0x1400b96a6
mov qword [rax + 8], rbp
mov dword [rax + 0x10], 1
lea rcx, str.ROOTCIMV2
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
jne 0x1400b96a9
mov ecx, 0x8007000e
call fcn.1400f73f0
int3
mov rbx, rbp
mov qword [rsp + 0xa8], rbx
test rbx, rbx
jne 0x1400b96c1
mov ecx, 0x8007000e
call fcn.1400f73f0
nop
mov rcx, qword [rsp + 0x90]
mov rax, qword [rcx]
lea rdx, [rsp + 0x98]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rbp
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbx]
call qword [rax + 0x18]
mov esi, eax
mov rcx, rbx
call fcn.14003c270
test esi, esi
jns 0x1400b9721
mov rcx, qword [rsp + 0x90]
mov rdx, qword [rcx]
call qword [rdx + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov eax, esi
jmp 0x1400b97d7
mov dword [rsp + 0x38], ebp
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0xa]
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
mov ebx, eax
test eax, eax
jns 0x1400b977c
mov rcx, qword [rsp + 0x98]
mov rdx, qword [rcx]
call qword [rdx + 0x10]
mov rcx, qword [rsp + 0x90]
mov rdx, qword [rcx]
call qword [rdx + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x1400b97d5
mov qword [rsp + 0xa0], rbp
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x20], rax
lea r9, [0x14016f278]
xor edx, edx
lea r8d, [rdx + 4]
lea rcx, [0x14016f308]
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov ebx, eax
test eax, eax
js 0x1400b9758
mov rax, qword [rsp + 0xa0]
mov qword [rdi + 0x20], rax
mov rax, qword [rsp + 0x90]
mov qword [rdi + 8], rax
mov rax, qword [rsp + 0x98]
mov qword [rdi + 0x10], rax
mov eax, ebx
add rsp, 0x68
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400bf3a0
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov rdi, rcx
mov rcx, qword [rdx]
mov r14, r8
mov rsi, rdx
test rcx, rcx
jne 0x1400bf3c7
xor eax, eax
jmp 0x1400bf3db
mov rax, qword [rcx]
lea r8, [rsp + 0x58]
mov edx, 0x10000301
call qword [rax + 0x18]
mov eax, dword [rsp + 0x58]
mov rbx, qword [0x140296e90]
test rbx, rbx
je 0x1400bf428
movsxd rbp, eax
nop word [rax + rax]
cmp qword [rbx], 0
jne 0x1400bf40f
lea rdx, str.F:CheckPointsTPDrv_builderSuperMan1LibSynList.h
lea rcx, str.m_pItem
mov r8d, 0x60
call fcn.1400eb260
mov rcx, qword [rbx]
mov rdx, rbp
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test eax, eax
jne 0x1400bf44a
mov rbx, qword [rbx + 8]
test rbx, rbx
jne 0x1400bf3f0
xor eax, eax
lea rbp, [rax + 0x50]
mov rcx, rbp
call fcn.14003b7e0
test al, al
je 0x1400bf585
mov rcx, qword [rsi]
test rcx, rcx
jne 0x1400bf44f
xor eax, eax
jmp 0x1400bf463
mov rax, qword [rbx]
jmp 0x1400bf42a
mov rax, qword [rcx]
lea r8, [rsp + 0x68]
mov edx, 0x10000312
call qword [rax + 0x18]
mov eax, dword [rsp + 0x68]
shr eax, 0x16
test al, 1
jne 0x1400bf57b
mov rcx, qword [rsi]
test rcx, rcx
jne 0x1400bf47a
xor eax, eax
jmp 0x1400bf48e
mov rax, qword [rcx]
lea r8, [rsp + 0x68]
mov edx, 0x10000314
call qword [rax + 0x18]
mov eax, dword [rsp + 0x68]
test al, 1
jne 0x1400bf57b
mov rcx, qword [rsi]
test rcx, rcx
jne 0x1400bf4a2
xor eax, eax
jmp 0x1400bf4b6
mov rax, qword [rcx]
lea r8, [rsp + 0x68]
mov edx, 0x10000314
call qword [rax + 0x18]
mov eax, dword [rsp + 0x68]
shr eax, 1
test al, 1
jne 0x1400bf57b
mov rcx, r14
call fcn.140070010
test al, al
jne 0x1400bf585
mov rcx, rsi
call fcn.140070010
test al, al
je 0x1400bf585
inc dword [rdi + 0xa8]
cmp dword [rdi + 0xa8], 1
jne 0x1400bf500
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rdi + 0xac], eax
jmp 0x1400bf585
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, 0x5dc
cmp eax, dword [rdi + 0xac]
jae 0x1400bf51b
call qword [sym.imp.KERNEL32.dll_GetTickCount]
jmp 0x1400bf52b
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rdi + 0xa8], 1
cmp dword [rdi + 0xa8], 3
mov dword [rdi + 0xac], eax
jne 0x1400bf585
lea rcx, str.SynTPLpr
xor edx, edx
call qword [sym.imp.USER32.dll_FindWindowW]
mov rbx, rax
test rax, rax
je 0x1400bf57b
mov rcx, rbp
call fcn.14003b9b0
lea rcx, [0x140295650]
mov r8d, 0x4e4
mov rdx, rbx
movzx r9d, al
mov qword [rsp + 0x20], 0
call fcn.140097760
mov dword [rdi + 0xa8], 0
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x1400c8f50
Capabilities:
Get file version info

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push r14
sub rsp, 0x30
mov r14, rdx
lea rdx, [rsp + 0x68]
mov rsi, r8
mov rcx, r14
xor ebx, ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov ebp, eax
test eax, eax
je 0x1400c900d
mov ecx, ebp
mov qword [rsp + 0x50], rdi
call fcn.140102f90
mov rdi, rax
test rax, rax
je 0x1400c8ff8
mov r9, rax
mov r8d, ebp
xor edx, edx
mov rcx, r14
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x1400c8ff0
lea r9, [rsp + 0x20]
lea r8, [rsp + 0x28]
lea rdx, [0x140140710]
mov rcx, rdi
mov qword [rsp + 0x28], rbx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x1400c8ff0
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x1400c8ff0
movzx eax, word [rcx + 0xa]
mov ebx, 1
mov dword [rsi], eax
movzx eax, word [rcx + 8]
mov dword [rsi + 4], eax
movzx eax, word [rcx + 0xe]
mov dword [rsi + 8], eax
movzx eax, word [rcx + 0xc]
mov dword [rsi + 0xc], eax
mov rcx, rdi
call fcn.1400fc1ec
mov eax, ebx
mov rdi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
mov eax, ebx
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret

Function at 0x1400c9080
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
xor ebp, ebp
mov rcx, rdx
lea rdx, [rsp + 0x58]
mov rsi, r8
mov qword [rsp + 0x28], rbp
mov edi, ebp
mov dword [rsp + 0x58], ebp
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r8d, dword [rsp + 0x58]
test r8d, r8d
jne 0x1400c90c9
xor eax, eax
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
xor edx, edx
mov ecx, 0x410
mov qword [rsp + 0x40], rbx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x1400c9127
lea r9, [rsp + 0x20]
lea rdx, [rsp + 0x28]
mov r8d, 8
mov rcx, rax
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x1400c911e
mov rdx, qword [rsp + 0x28]
mov r9d, 0x104
mov r8, rsi
mov rcx, rbx
call sub.PSAPI.DLL_GetModuleFileNameExW
mov edi, eax
test eax, eax
jne 0x1400c911e
mov word [rsi], bp
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov eax, edi
add rsp, 0x30
pop rdi
ret
Function at 0x1400ccf50
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
mov qword [rsp + 0x10], rbx
mov dword [rsp + 0x20], r9d
mov dword [rsp + 0x18], r8d
mov dword [rsp + 8], ecx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xa0
mov ebp, r9d
mov r15d, r8d
mov edi, edx
mov r14d, ecx
xor esi, esi
call qword [sym.imp.USER32.dll_GetDesktopWindow]
lea ecx, [rsi + 0x4d]
mov rbx, rax
mov qword [rsp + 0x60], rax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
lea ecx, [rsi + 0x4f]
mov dword [rsp + 0x7c], eax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
lea ecx, [rsi + 0x4c]
add eax, dword [rsp + 0x7c]
mov dword [rsp + 0x84], eax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
lea ecx, [rsi + 0x4e]
mov dword [rsp + 0x78], eax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
lea r8, [rsp + 0x78]
add eax, dword [rsp + 0x78]
lea rdx, [rsp + 0x88]
lea rcx, [rsp + 0x68]
mov dword [rsp + 0x80], eax
lea eax, [rdi + rbp]
mov dword [rsp + 0x8c], edi
mov dword [rsp + 0x94], eax
lea eax, [r14 + r15]
mov dword [rsp + 0x88], r14d
mov dword [rsp + 0x90], eax
call qword [sym.imp.USER32.dll_IntersectRect]
mov ebp, dword [rsp + 0x70]
mov r14d, dword [rsp + 0x74]
sub ebp, dword [rsp + 0x68]
mov rcx, rbx
sub r14d, dword [rsp + 0x6c]
call qword [sym.imp.USER32.dll_GetDC]
mov rcx, rax
mov r12, rax
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov r8d, r14d
mov edx, ebp
mov rcx, r12
mov r15, rax
call qword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov r13, rax
test rax, rax
je 0x1400cd156
mov r9d, dword [rsp + 0x100]
cmp r9d, 1
jle 0x1400cd0db
mov eax, dword [rsp + 0xf0]
cdq
sub eax, edx
sar eax, 1
mov ecx, eax
mov eax, dword [rsp + 0xf8]
add ecx, dword [rsp + 0xe0]
cdq
sub eax, edx
sar eax, 1
lea r8d, [rdi + rax]
mov eax, dword [rsp + 0x68]
sub eax, ecx
cdq
idiv r9d
lea edi, [rcx + rax]
mov eax, dword [rsp + 0x6c]
mov rcx, r15
sub eax, r8d
cdq
idiv r9d
mov rdx, r13
lea ebx, [r8 + rax]
call qword [sym.imp.GDI32.dll_SelectObject]
call fcn.1400ccd60
mov r8d, eax
mov eax, r14d
cdq
mov dword [rsp + 0x50], r8d
idiv dword [rsp + 0x100]
mov ecx, eax
mov eax, ebp
cdq
mov dword [rsp + 0x48], ecx
idiv dword [rsp + 0x100]
mov dword [rsp + 0x40], eax
jmp 0x1400cd101
mov edi, dword [rsp + 0x68]
mov ebx, dword [rsp + 0x6c]
mov rdx, rax
mov rcx, r15
call qword [sym.imp.GDI32.dll_SelectObject]
call fcn.1400ccd60
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x48], r14d
mov dword [rsp + 0x40], ebp
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], edi
mov r9d, ebp
xor r8d, r8d
xor edx, edx
mov rcx, r15
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], r14d
call qword [sym.imp.GDI32.dll_StretchBlt]
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
call qword [sym.imp.USER32.dll_EmptyClipboard]
mov rdx, r13
mov ecx, 2
call qword [sym.imp.USER32.dll_SetClipboardData]
mov ecx, 1
test rax, rax
cmovne esi, ecx
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rbx, qword [rsp + 0x60]
mov rcx, r15
call qword [sym.imp.GDI32.dll_DeleteDC]
mov rdx, r12
mov rcx, rbx
call qword [sym.imp.USER32.dll_ReleaseDC]
mov rbx, qword [rsp + 0xe8]
mov eax, esi
add rsp, 0xa0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400d3a40
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp - 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rdi, rcx
cmp qword [rcx + 0x78], 0
je 0x1400d3c3b
cmp byte [rcx + 0x82], 0
je 0x1400d3c3b
mov rax, qword [rcx]
mov ebx, 0xffff
mov edx, ebx
call qword [rax + 0x18]
cmp bx, ax
jne 0x1400d3a92
xor al, al
jmp 0x1400d3c3d
mov edx, 0xf
mov qword [rbp - 0x10], rdx
mov byte [rbp - 0x28], 0
xor ecx, ecx
mov qword [rbp - 0x28], rcx
mov qword [rbp - 0x18], 8
lea rax, [rbp - 0x28]
cmp rdx, 0x10
cmovae rax, rcx
mov byte [rax + 8], cl
xor r14d, r14d
mov r9, qword [rbp - 0x10]
lea rdx, [rbp - 0x28]
cmp r9, 0x10
cmovae rdx, qword [rbp - 0x28]
lea r8, [rbp - 0x28]
cmovae r8, qword [rbp - 0x28]
mov rcx, qword [rdi + 0x78]
mov r10, qword [rcx]
mov r9, qword [rbp - 0x18]
add r9, rdx
lea rax, [rbp + 0x20]
mov qword [rsp + 0x20], rax
lea rdx, [rdi + 0x84]
call qword [r10 + 0x40]
test eax, eax
je 0x1400d3b09
dec eax
jne 0x1400d3bfe
jmp 0x1400d3b10
mov byte [rdi + 0x82], r14b
lea rax, [rbp - 0x28]
mov r10, qword [rbp - 0x28]
mov r9, qword [rbp - 0x10]
cmp r9, 0x10
cmovae rax, r10
mov rbx, qword [rbp + 0x20]
sub rbx, rax
je 0x1400d3b5a
lea rcx, [rbp - 0x28]
cmp r9, 0x10
cmovae rcx, r10
mov r9, qword [rdi + 0x90]
mov r8, rbx
mov edx, 1
call fcn.1400fca5c
mov r9, qword [rbp - 0x10]
cmp rbx, rax
jne 0x1400d3c07
cmp byte [rdi + 0x82], r14b
je 0x1400d3c25
test rbx, rbx
jne 0x1400d3ac3
or rax, 0xffffffffffffffff
mov r8, qword [rbp - 0x18]
sub rax, r8
cmp rax, 8
jbe 0x1400d3c18
lea rbx, [r8 + 8]
cmp rbx, 0xfffffffffffffffe
ja 0x1400d3c0b
cmp r9, rbx
jae 0x1400d3ba6
mov rdx, rbx
lea rcx, [rbp - 0x28]
call fcn.14000ff40
mov r9, qword [rbp - 0x10]
jmp 0x1400d3bc4
test rbx, rbx
jne 0x1400d3bcd
mov qword [rbp - 0x18], r14
lea rax, [rbp - 0x28]
cmp r9, 0x10
cmovae rax, qword [rbp - 0x28]
mov byte [rax], r14b
jmp 0x1400d3abf
test rbx, rbx
je 0x1400d3ac3
lea rcx, [rbp - 0x28]
cmp r9, 0x10
cmovae rcx, qword [rbp - 0x28]
mov rax, qword [rbp - 0x18]
xor edx, edx
mov qword [rax + rcx], rdx
mov qword [rbp - 0x18], rbx
lea rax, [rbp - 0x28]
cmp qword [rbp - 0x10], 0x10
cmovae rax, qword [rbp - 0x28]
mov byte [rbx + rax], dl
jmp 0x1400d3abf
mov r9, qword [rbp - 0x10]
sub eax, 2
je 0x1400d3c25
xor bl, bl
jmp 0x1400d3c27
lea rcx, str.string_too_long
call fcn.1400f93c8
int3
lea rcx, str.string_too_long
call fcn.1400f93c8
int3
mov bl, 1
cmp r9, 0x10
jb 0x1400d3c36
mov rcx, qword [rbp - 0x28]
call fcn.1400fa318
movzx eax, bl
jmp 0x1400d3c3d
mov al, 1
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x1400d5f00
Capabilities:
Get file version info

Disassembly:
push rbx
push rdi
sub rsp, 0x238
xor edi, edi
mov rbx, rcx
lea rax, [rcx + 8]
test rcx, rcx
jne 0x1400d5f1a
mov eax, edi
xor ecx, ecx
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rcx
mov qword [rax + 0x18], rcx
mov qword [rax + 0x20], rcx
mov qword [rax + 0x28], rcx
mov dword [rax + 0x30], ecx
mov rcx, qword [rbx + 0x40]
test rcx, rcx
je 0x1400d5f5b
lea rdx, [rsp + 0x20]
mov r8d, 0x104
mov dword [rbx + 0x68], 1
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x1400d5f67
xor eax, eax
add rsp, 0x238
pop rdi
pop rbx
ret
mov rcx, qword [rbx + 0x60]
mov qword [rsp + 0x230], rsi
test rcx, rcx
je 0x1400d5f81
call fcn.1400fa318
mov qword [rbx + 0x60], rdi
lea rdx, [rsp + 0x258]
lea rcx, [rsp + 0x20]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test eax, eax
je 0x1400d5fde
mov ecx, esi
call fcn.1400f9438
lea rcx, [rsp + 0x20]
mov r8d, esi
mov r9, rax
xor edx, edx
mov qword [rbx + 0x60], rax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x1400d5fde
mov rcx, qword [rbx + 0x60]
lea r9, [rsp + 0x250]
lea r8, [rsp + 0x260]
lea rdx, [0x140140710]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
jne 0x1400d5ff2
xor eax, eax
mov rsi, qword [rsp + 0x230]
add rsp, 0x238
pop rdi
pop rbx
ret
mov rax, qword [rsp + 0x260]
lea r9, [rsp + 0x250]
lea r8, [rsp + 0x260]
lea rdx, str.VarFileInfoTranslation
movups xmm0, xmmword [rax]
movups xmmword [rbx + 8], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx + 0x18], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rbx + 0x28], xmm0
mov eax, dword [rax + 0x30]
mov dword [rbx + 0x38], eax
mov rcx, qword [rbx + 0x60]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x1400d6052
cmp dword [rsp + 0x250], 4
jb 0x1400d6052
mov rcx, qword [rsp + 0x260]
mov edx, dword [rcx]
mov dword [rbx + 0x48], edx
cmp dword [rbx + 8], 0xfeef04bd
mov rsi, qword [rsp + 0x230]
sete dil
mov eax, edi
add rsp, 0x238
pop rdi
pop rbx
ret
Function at 0x1400d68c0
Capabilities:
Enumerate process modules
Enumerate processes

Disassembly:
push rsi
mov eax, 0x2cc0
call fcn.1400fbbd0
sub rsp, rax
mov rsi, rcx
call fcn.1400d66b0
test rax, rax
je 0x1400d6b0c
lea rdx, [rsp + 0x2cd8]
mov rcx, rax
mov qword [rsp + 0x2ca8], rdi
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [rsp + 0x20], 0x238
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1400d6b04
lea rdx, [rsp + 0x20]
mov rcx, rax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x1400d6afb
nop dword [rax]
mov ecx, dword [rsp + 0x2cd8]
cmp dword [rsp + 0x28], ecx
je 0x1400d6953
lea rdx, [rsp + 0x20]
mov rcx, rdi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x1400d6930
jmp 0x1400d6afb
mov rcx, qword [rsi + 0x10]
mov edx, 0x40a
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x1400d6afb
mov qword [rsp + 0x2cb8], rbx
or rbx, 0xffffffffffffffff
mov qword [rsp + 0x2cb0], rbp
mov qword [rsp + 0x2ca0], r14
lea rcx, [rsp + 0x4c]
mov rax, rbx
nop
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400d6990
lea rdx, [rsp + 0x4c]
lea rcx, [rsi + 0x28c0]
mov r8d, eax
call fcn.14000fc20
xor ecx, ecx
movzx eax, word [rsp + rcx + 0x4c]
lea rcx, [rcx + 2]
mov word [rsp + rcx + 0x25e], ax
test ax, ax
jne 0x1400d69b0
mov r8d, dword [rsp + 0x2cd8]
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbp, rax
test rax, rax
je 0x1400d6a56
lea r9, [rsp + 0x2ce0]
lea rdx, [rsp + 0x2ce8]
mov r8d, 8
mov rcx, rax
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x1400d6a51
mov rdx, qword [rsp + 0x2ce8]
lea r8, [rsp + 0x260]
mov r9d, 0x104
mov rcx, rbp
call sub.PSAPI.DLL_GetModuleFileNameExW
lea rax, [rsp + 0x260]
nop dword [rax + rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1400d6a30
lea rdx, [rsp + 0x260]
lea rcx, [rsi + 0x28c0]
mov r8d, ebx
call fcn.14000fc20
mov rcx, rbp
jmp 0x1400d6ad1
lea rcx, [0x140295650]
call fcn.140098040
test eax, eax
je 0x1400d6ad7
mov eax, dword [rsp + 0x2cd8]
lea r9, str.SynGetModulePathNameEvent
xor r8d, r8d
mov dword [rsp + 0x478], eax
mov rax, qword [rsi + 0x10]
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x470], 0xe
mov qword [rsp + 0x480], rax
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rbx, rax
test rax, rax
je 0x1400d6ad7
lea rdx, [rsp + 0x470]
lea rcx, [0x140295650]
call fcn.140098350
test rax, rax
je 0x1400d6ace
mov edx, 0x2710
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rsi + 0x10]
mov rcx, rsi
call fcn.1400d6c70
mov r14, qword [rsp + 0x2ca0]
mov rbp, qword [rsp + 0x2cb0]
mov rbx, qword [rsp + 0x2cb8]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, qword [rsp + 0x2ca8]
add rsp, 0x2cc0
pop rsi
ret
Function at 0x1400d6b60
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rdi
sub rsp, 0x2d0
mov rdi, rcx
mov rbp, rdx
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x98
call fcn.1400fa4e0
xor ebx, ebx
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x50], rax
lea rax, [0x14015a9c8]
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x98
mov qword [rsp + 0x28], rbp
mov word [rsp + 0xc0], bx
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x58], 0x208
mov dword [rsp + 0x4c], 1
mov qword [rsp + 0x60], rbx
mov dword [rsp + 0x68], ebx
mov qword [rsp + 0x70], rbx
mov dword [rsp + 0x80], 0x1800
call qword [sym.imp.COMDLG32.dll_GetOpenFileNameW]
cmp eax, 1
jne 0x1400d6c4e
mov rdx, qword [rsp + 0x50]
mov qword [rsp + 0x2e0], rsi
test rdx, rdx
je 0x1400d6c1b
or rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rdx + rax*2], bx
jne 0x1400d6c10
mov ebx, eax
lea rcx, [rdi + 0x28c0]
mov r8d, ebx
call fcn.14000fc20
mov rcx, qword [rdi + 0x28c0]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov rsi, qword [rsp + 0x2e0]
test eax, eax
je 0x1400d6c4e
mov rdx, rbp
mov rcx, rdi
call fcn.1400d6c70
lea r11, [rsp + 0x2d0]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x1400d6d40
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x230
mov rdi, rdx
mov rsi, rcx
mov edx, 0x40a
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetDlgItem]
or rbx, 0xffffffffffffffff
test rax, rax
je 0x1400d6da9
lea rdx, [rsp + 0x20]
mov r8d, 0x104
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowTextW]
lea rcx, [rsi + 0x28c0]
lea rdx, [rsp + 0x20]
mov rax, rbx
inc rax
cmp word [rdx + rax*2], 0
jne 0x1400d6d92
lea rdx, [rsp + 0x20]
mov r8d, eax
call fcn.14000fc20
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x208
call fcn.1400fa4e0
mov edx, 0x40c
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x1400d6e07
lea rdx, [rsp + 0x20]
mov r8d, 0x104
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowTextW]
lea rcx, [rsi + 0x28c8]
lea rax, [rsp + 0x20]
nop
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1400d6df0
lea rdx, [rsp + 0x20]
mov r8d, ebx
call fcn.14000fc20
lea r11, [rsp + 0x230]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret

Function at 0x1400d70b0
Capabilities:
Hide graphical window

Disassembly:
push rbx
sub rsp, 0x20
xor edx, edx
mov rbx, rcx
mov dword [rcx + 0x28d0], 0
call fcn.1400d6740
call qword [sym.imp.USER32.dll_ReleaseCapture]
mov rcx, qword [rbx + 0x28e8]
mov edx, 5
add rsp, 0x20
pop rbx
jmp qword [sym.imp.USER32.dll_ShowWindow]
Function at 0x1400d9a10
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
lea rcx, [0x140295650]
mov rdi, r9
mov rsi, r8
mov rbx, rdx
call fcn.1400983b0
test eax, eax
je 0x1400d9a4d
mov eax, 0x40
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.1400f62c0