joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003aa90
Capabilities:
Enumerate gui resources

Disassembly:
push rbx
mov eax, 0x11ce0
call fcn.1400ae8c0
sub rsp, rax
xor eax, eax
mov byte [rsp + 0x1881], 1
mov rbx, rcx
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x1884], eax
lea rcx, [0x1400bdf7c]
mov qword [rsp + 0x1888], rax
cmp edx, 6
mov rdx, qword [0x1400edaa8]
xorps xmm0, xmm0
mov dword [rsp + 0x18a0], eax
mov qword [rsp + 0x18a8], rax
mov qword [rsp + 0x18c0], rax
cmove rax, rbx
mov qword [rsp + 0x18b8], rax
mov rax, qword [rsp + 0x11d18]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x11d10]
mov qword [rsp + 0x1048], rcx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x20], rax
movdqa xmmword [rsp + 0x1890], xmm0
call fcn.14007fb60
test eax, eax
je 0x14003ab41
lea rdx, [rsp + 0x30]
lea rcx, [0x14007ee50]
call qword [sym.imp.USER32.dll_EnumWindows]
movsxd rdx, dword [rsp + 0x1884]
mov r8b, reloc.OLEAUT32.dll_SafeArrayGetElement
mov rcx, rbx
call fcn.140001460
mov eax, 1
add rsp, 0x11ce0
pop rbx
ret

Function at 0x14003b9c0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
mov eax, 0x10030
call fcn.1400ae8c0
sub rsp, rax
mov rbx, qword [0x1400f5760]
mov rbp, rdx
mov rcx, rbp
lea rdx, [rsp + 0x30]
mov r8d, 0x7fff
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov byte [rsp + 0x20], 1
mov rcx, rbx
mov esi, eax
cmp eax, 0x7fff
jb 0x14003baa2
lea r8d, [rsi - 1]
mov r9b, 1
xor edx, edx
call fcn.14007d4e0
test eax, eax
je 0x14003babf
mov qword [rsp + 0x10040], rdi
xor r8d, r8d
mov edi, 1
mov rcx, rbx
mov edx, edi
call fcn.1400015b0
mov rdx, rax
mov r8d, esi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
jne 0x14003ba60
xor r8d, r8d
mov edx, edi
mov rcx, rbx
call fcn.1400015b0
xor ecx, ecx
mov word [rax], cx
cmp byte [rbx + 0x23], 0
jne 0x14003ba6a
mov rbx, qword [rbx + 0x10]
cmp byte [rbx + 0x23], 2
jne 0x14003ba92
cmp qword [0x1400f6610], 0
je 0x14003ba92
lea rcx, [0x1400f65f8]
call fcn.140004cf0
mov edi, eax
mov rdi, qword [rsp + 0x10040]
jmp 0x14003babf
and byte [rbx + 0x21], 0x86
mov eax, edi
mov rdi, qword [rsp + 0x10040]
jmp 0x14003babf
test esi, esi
lea rax, [0x1400bdf7c]
lea rdx, [rsp + 0x30]
mov r8, rsi
cmove rdx, rax
xor r9d, r9d
call fcn.14007d4e0
lea r11, [rsp + 0x10030]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsp, r11
pop rsi
ret
Function at 0x1400422d0
Capabilities:
Get keyboard layout

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x250
mov rsi, qword [0x1400f5760]
xor ecx, ecx
mov rdi, r8
mov rbx, rdx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
mov r9b, 1
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rax
mov rcx, rbx
call fcn.140013280
movzx ebp, al
test al, al
jne 0x140042375
xor r8d, r8d
lea rdx, [rsp + 0x260]
mov rcx, rbx
call fcn.140053950
xor r9d, r9d
test eax, eax
jne 0x140042343
lea rdx, [0x1400bdf7c]
jmp 0x1400423ce
mov edx, dword [rsp + 0x260]
lea r8, [rsp + 0x30]
xor ecx, ecx
mov dword [rsp + 0x40], ecx
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x30], rcx
mov ecx, eax
call fcn.140053c60
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.14007ce60
jmp 0x1400423df
movzx ebx, word [rdi]
mov edi, 2
test ebx, 0xffffff80
jne 0x140042395
mov edx, edi
mov ecx, ebx
call fcn.14009c1d4
test eax, eax
je 0x140042395
and ebx, 0xffffffdf
movzx eax, bx
cmp eax, 0x50
je 0x1400423a7
xor ecx, ecx
cmp eax, 0x54
cmovne edi, ecx
jmp 0x1400423ac
mov edi, 1
mov edx, edi
movzx ecx, bpl
call fcn.140053bb0
test al, al
lea rcx, [0x1400d9110]
lea rdx, [0x1400d9114]
cmovne rdx, rcx
xor r9d, r9d
or r8, 0xffffffffffffffff
mov byte [rsp + 0x20], 1
mov rcx, rsi
call fcn.14007d4e0
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140042400
Capabilities:
Get disk size

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x260
movzx edi, r8b
mov byte [rsp + 0x20], 1
mov rbx, rdx
mov rsi, rcx
mov rcx, qword [0x1400f5760]
or r8, 0xffffffffffffffff
xor edx, edx
xor r9d, r9d
call fcn.14007d4e0
test rbx, rbx
je 0x1400425b8
cmp word [rbx], 0
je 0x1400425b8
mov r8d, 0x104
lea rcx, [rsp + 0x50]
mov rdx, rbx
call fcn.1400a2664
xor edx, edx
lea rcx, [rsp + 0x50]
mov word [rsp + 0x258], dx
or rax, 0xffffffffffffffff
nop
inc rax
cmp word [rcx + rax*2], dx
jne 0x140042470
lea rcx, [rax + rax]
cmp word [rsp + rcx + 0x4e], 0x5c
je 0x14004249c
inc rax
cmp rax, 0x105
jae 0x1400425b8
mov dword [rsp + rcx + 0x50], 0x5c
mov rax, qword gs:[0x58]
mov edx, 4
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x1400f8268], eax
jle 0x1400424fd
lea rcx, [0x1400f8268]
call fcn.140095414
cmp dword [0x1400f8268], 0xffffffff
jne 0x1400424fd
lea rcx, [0x1400d9130]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [0x1400d9118]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x1400f8268]
mov qword [0x1400f8270], rax
call fcn.1400953b4
mov rax, qword [0x1400f8270]
lea rcx, [rsp + 0x50]
test rax, rax
je 0x140042537
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x40]
call rax
test eax, eax
je 0x1400425b8
mov rbx, qword [rsp + 0x38]
test dil, dil
cmovne rbx, qword [rsp + 0x40]
jmp 0x14004257c
lea rax, [rsp + 0x278]
lea r9, [rsp + 0x288]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x34]
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
test eax, eax
je 0x1400425b8
mov ebx, dword [rsp + 0x278]
test dil, dil
cmovne ebx, dword [rsp + 0x288]
imul ebx, dword [rsp + 0x30]
imul ebx, dword [rsp + 0x34]
mov rcx, qword [0x1400f1518]
lea rdx, [0x1400be064]
xor r9d, r9d
shr rbx, 0x14
or r8, 0xffffffffffffffff
mov byte [rsp + 0x20], 1
call fcn.14007d4e0
mov rcx, qword [0x1400f5760]
mov r8b, reloc.OLEAUT32.dll_SafeArrayGetElement
mov rdx, rbx
call fcn.140001460
mov eax, 1
jmp 0x1400425c2
mov dl, 1
mov rcx, rsi
call fcn.140030e80
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1400445b0
Capabilities:
Get common file path
Set current directory

Disassembly:
push rbx
sub rsp, 0x250
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
jne 0x1400445e0
cmp byte [0x1400f6558], al
je 0x1400446b3
call fcn.14000a870
add rsp, 0x250
pop rbx
ret
cmp byte [0x1400f6558], 0
lea rax, [0x1400f1300]
mov qword [rsp + 0x260], rdi
mov ecx, 0x104
lea rdi, [rsp + 0x40]
cmovne rdi, rax
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x140044669
cmp word [rbx], 0
je 0x140044683
cmp word [rbx + 2], 0x3a
jne 0x140044683
cmp word [rbx + 4], 0
jne 0x140044683
mov rdx, rdi
mov rcx, rbx
call fcn.140099630
test eax, eax
je 0x140044683
mov r8, rbx
lea rdx, [0x1400d95f8]
lea rcx, [rsp + 0x30]
call fcn.140004900
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
je 0x140044683
mov rdx, rdi
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
jne 0x140044683
mov r8d, 0x103
mov rdx, rbx
mov rcx, rdi
call fcn.1400a2664
xor eax, eax
mov word [rdi + 0x206], ax
cmp byte [0x1400f6558], 0
mov rdi, qword [rsp + 0x260]
je 0x1400446b3
mov rcx, qword [0x1400f1518]
lea rdx, [0x1400be064]
xor r9d, r9d
mov byte [rsp + 0x20], 1
or r8, 0xffffffffffffffff
call fcn.14007d4e0
add rsp, 0x250
pop rbx
ret
Function at 0x140044d70
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x230
mov rdi, rdx
mov rsi, rcx
test rdx, rdx
je 0x140044eb9
cmp word [rdx], 0
je 0x140044eb9
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140044dd4
mov rcx, qword [0x1400edaa8]
shr eax, 4
not al
and al, 1
mov dword [rcx + 0x40], 0xb7
movzx edx, al
mov rcx, rsi
mov rsi, qword [rsp + 0x250]
add rsp, 0x230
pop rdi
jmp fcn.140030e80
mov edx, 0x5c
mov qword [rsp + 0x248], rbp
mov rcx, rdi
call fcn.140097a74
mov rbp, rax
cmp rax, rdi
jbe 0x140044ea0
or rcx, 0xffffffffffffffff
nop dword [rax]
inc rcx
cmp word [rdi + rcx*2], 0
jne 0x140044e00
cmp rcx, 0x104
jb 0x140044e3c
mov r8d, WSAStartup
mov dl, 1
mov rcx, rsi
call fcn.1400310a0
mov rbp, qword [rsp + 0x248]
mov rsi, qword [rsp + 0x250]
add rsp, 0x230
pop rdi
ret
mov qword [rsp + 0x240], rbx
lea rcx, [rsp + 0x20]
mov rbx, rax
mov rdx, rdi
sub rbx, rdi
sar rbx, 1
mov r8, rbx
call fcn.1400a2664
xor eax, eax
lea rdx, [rsp + 0x20]
mov rcx, rsi
mov word [rsp + rbx*2 + 0x20], ax
call fcn.140044d70
cmp word [rbp + 2], 0
mov rbx, qword [rsp + 0x240]
je 0x140044e99
mov rcx, qword [0x1400f1518]
xor r8d, r8d
lea edx, [r8 + 1]
call fcn.1400015b0
cmp word [rax], 0x31
jne 0x140044ea0
mov eax, 1
jmp 0x140044e23
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
sete dl
or r8d, 0xffffffff
jmp 0x140044e1b
mov rax, qword [0x1400edaa8]
mov dl, 1
mov dword [rax + 0x40], 0x57
mov rsi, qword [rsp + 0x250]
add rsp, 0x230
pop rdi
jmp fcn.140030e80
Function at 0x1400459d0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov rdi, r8
mov r14, rdx
mov r15, rcx
test r8, r8
je 0x140045a39
xor r8d, r8d
mov rcx, rdi
lea edx, [r8 + 1]
call fcn.1400015b0
cmp byte [rdi + 0x23], 0
mov rsi, rax
jne 0x140045a0c
mov rbx, qword [rdi + 0x10]
jmp 0x140045a0f
mov rbx, rdi
cmp byte [rbx + 0x23], 1
jne 0x140045a2d
test byte [rbx + 0x21], 8
je 0x140045a23
mov rcx, rbx
call fcn.140001500
mov rbp, qword [rbx + 0x10]
add rbx, 0x10
jmp 0x140045a83
lea rbx, [0x1400f7258]
mov rbp, qword [rbx]
jmp 0x140045a83
lea r8, [rsp + 0x88]
xor ecx, ecx
lea rdx, [rsp + 0x80]
call fcn.14007cf50
test eax, eax
jne 0x140045a73
mov rax, qword [0x1400edaa8]
xor ebx, ebx
mov dword [rax + 0x40], ebx
xor eax, eax
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov rsi, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x88]
xor ebx, ebx
xor r9d, r9d
mov qword [rsp + 0x30], rbx
xor r8d, r8d
mov dword [rsp + 0x28], ebx
mov edx, 0x40000000
mov rcx, r14
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x140045ae9
mov dword [rsp + 0x80], ebx
mov ecx, ebx
test rsi, rsi
je 0x140045ae4
lea r9, [rsp + 0x80]
mov qword [rsp + 0x20], rbx
mov r8d, ebp
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [rsp + 0x80]
cmp ecx, ebp
sete bl
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x1400edaa8]
mov dword [rcx + 0x40], eax
cmp r14, 0xffffffffffffffff
je 0x140045b08
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rdi, rdi
jne 0x140045b15
mov rcx, rsi
call fcn.14009d6d0
test ebx, ebx
mov rcx, r15
sete dl
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
pop rsi
pop rbp
jmp fcn.140030e80
Function at 0x140045e40
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x260
mov rsi, rcx
mov rdi, r9
mov rcx, r9
mov rbp, r8
mov rbx, rdx
call fcn.14000e2e0
mov rcx, rdi
test al, al
je 0x140045e7f
xor edx, edx
lea r8d, [rdx + 0x10]
call fcn.14009d670
jmp 0x140045e84
call fcn.14009d1f8
cmp eax, 1
je 0x140045e9c
mov rcx, rbp
call fcn.140058c70
test al, al
je 0x140045e9c
mov dl, 1
jmp 0x140045f95
mov qword [rsp + 0x30], 0
xor r9d, r9d
mov dword [rsp + 0x28], 0
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x20], 2
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140045e95
or r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rbx + r8*2], 0
jne 0x140045ee0
cmp r8, 0x104
lea rcx, [rsp + 0x50]
mov eax, 0x103
mov rdx, rbx
cmovae r8, rax
lea r8, [r8*2 + 2]
call fcn.1400973b0
lea rcx, [rsp + 0x50]
call fcn.1400a1b2c
mov r8d, 0xa
lea rdx, [rsp + 0x50]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbp, rax
test rax, rax
je 0x140045f85
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x140045f85
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x140045f85
mov rdx, rbp
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], 0
mov r8d, eax
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
setne bl
jmp 0x140045f87
xor bl, bl
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
sete dl
mov rcx, rsi
call fcn.140030e80
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x140045fc0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x130
mov rbx, rdx
mov byte [rsp + 0x20], 1
mov rdi, rcx
xor edx, edx
mov rcx, qword [0x1400f5760]
xor r9d, r9d
or r8, 0xffffffffffffffff
call fcn.14007d4e0
test rbx, rbx
je 0x14004606a
cmp word [rbx], 0
je 0x14004606a
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x14004601a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x1400edaa8]
mov dword [rcx + 0x40], eax
jmp 0x140046078
mov rax, qword [0x1400edaa8]
xor edx, edx
mov rcx, rdi
mov dword [rax + 0x40], 0
call fcn.140030e80
mov edx, ebx
lea rcx, [rsp + 0x30]
call fcn.14007b220
mov rcx, qword [0x1400f5760]
xor r9d, r9d
or r8, 0xffffffffffffffff
mov byte [rsp + 0x20], 1
mov rdx, rax
call fcn.14007d4e0
mov rbx, qword [rsp + 0x140]
add rsp, 0x130
pop rdi
ret
mov rax, qword [0x1400edaa8]
mov dword [rax + 0x40], 0x57
mov dl, 1
mov rcx, rdi
call fcn.140030e80
mov rbx, qword [rsp + 0x140]
add rsp, 0x130
pop rdi
ret
Function at 0x140046f20
Capabilities:
Get file size

Disassembly:
push rsi
push rdi
push r14
sub rsp, 0x290
mov r14, r8
mov byte [rsp + 0x20], 1
mov rdi, rdx
mov rsi, rcx
mov rcx, qword [0x1400f5760]
or r8, 0xffffffffffffffff
xor edx, edx
xor r9d, r9d
call fcn.14007d4e0
test rdi, rdi
je 0x1400470c4
cmp word [rdi], 0
je 0x1400470c4
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x2b0], rbx
mov edx, 0x80
mov dword [rsp + 0x28], 0
mov rcx, rdi
mov qword [rsp + 0x2c0], rbp
lea r8d, [r9 + 7]
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x140046fc9
lea rdx, [rsp + 0x2b8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov rcx, rbp
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
jne 0x140047027
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp rax, 0xffffffffffffffff
jne 0x140047007
or r8d, 0xffffffff
mov dl, 1
mov rcx, rsi
call fcn.1400310a0
mov rbx, qword [rsp + 0x2b0]
mov rbp, qword [rsp + 0x2c0]
add rsp, 0x290
pop r14
pop rdi
pop rsi
ret
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [rsp + 0x5c]
mov eax, dword [rsp + 0x60]
shl rcx, 0x20
or rcx, rax
mov qword [rsp + 0x2b8], rcx
movzx ebx, word [r14]
test ebx, 0xffffff80
jne 0x140047046
mov edx, 2
mov ecx, ebx
call fcn.14009c1d4
test eax, eax
je 0x140047046
and ebx, 0xffffffdf
movzx eax, bx
cmp eax, 0x4b
je 0x14004706c
cmp eax, 0x4d
jne 0x14004708b
mov rax, qword [rsp + 0x2b8]
cqo
and edx, 0xfffff
add rax, rdx
sar rax, 0x14
jmp 0x140047083
mov rax, qword [rsp + 0x2b8]
cqo
and edx, 0x3ff
add rax, rdx
sar rax, 0xa
mov qword [rsp + 0x2b8], rax
mov rax, qword [0x1400edaa8]
xor edx, edx
mov rcx, rsi
mov dword [rax + 0x40], 0
call fcn.140030e80
mov rdx, qword [rsp + 0x2b8]
mov r8b, reloc.OLEAUT32.dll_SafeArrayGetElement
mov rcx, qword [0x1400f5760]
call fcn.140001460
mov eax, 1
jmp 0x140046feb
mov rax, qword [0x1400edaa8]
mov dl, 1
mov rcx, rsi
mov dword [rax + 0x40], 0x57
call fcn.140030e80
add rsp, 0x290
pop r14
pop rdi
pop rsi
ret

Function at 0x140053bb0
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x20
movzx ebx, cl
test cl, cl
jne 0x140053bc5
xor al, al
add rsp, 0x20
pop rbx
ret
sub edx, 1
je 0x140053bf2
movzx ecx, bl
cmp edx, 1
je 0x140053be3
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and al, 1
add rsp, 0x20
pop rbx
ret
call qword [sym.imp.USER32.dll_GetKeyState]
and eax, 1
add rsp, 0x20
pop rbx
ret
cmp bl, 6
ja 0x140053c01
mov ecx, 0x76
bt ecx, ebx
jb 0x140053c08
lea eax, [rbx + 0x66]
cmp al, 5
ja 0x140053c26
cmp qword [0x1400f1558], 0
jne 0x140053c48
movzx ecx, bl
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
and al, 1
add rsp, 0x20
pop rbx
ret
cmp qword [0x1400f1560], 0
je 0x140053c12
xor edx, edx
xor r8d, r8d
movzx ecx, bl
call fcn.1400129f0
test al, al
je 0x140053c48
mov cl, 1
call fcn.1400127e0
movzx eax, bl
lea rcx, [0x1400f2300]
movzx eax, byte [rax + rcx]
shr al, 7
add rsp, 0x20
pop rbx
ret
Function at 0x140054070
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x230
mov rdi, rdx
mov esi, ecx
mov r8d, ecx
xor r15d, r15d
mov word [rdx], r15w
mov ecx, 0x410
xor edx, edx
movzx ebx, r9b
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r14, rax
test rax, rax
jne 0x1400540ca
mov r8d, esi
xor edx, edx
mov ecx, 0x1000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r14, rax
test rax, rax
je 0x14005421c
xor edx, edx
mov qword [rsp + 0x250], rbp
mov r9d, 0x104
mov r8, rdi
mov rcx, r14
test bl, bl
je 0x1400540ec
call qword [sym.imp.PSAPI.DLL_GetModuleBaseNameW]
jmp 0x1400540f2
call qword [sym.imp.PSAPI.DLL_GetModuleFileNameExW]
mov ebp, eax
test eax, eax
jne 0x140054209
mov rax, qword [0x1400d7638]
test rax, rax
je 0x140054209
mov r8d, 0x104
mov rdx, rdi
mov rcx, r14
call rax
mov ebp, eax
test eax, eax
je 0x140054209
test bl, bl
je 0x140054160
mov edx, 0x5c
mov rcx, rdi
call fcn.140097a74
test rax, rax
je 0x140054209
or r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], r15w
jne 0x140054142
add r8, r8
lea rdx, [rax + 2]
mov rcx, rdi
call fcn.1400973b0
jmp 0x140054209
mov eax, 0x41
mov dword [rsp + 0x25a], 0x3a
mov word [rsp + 0x258], ax
nop dword [rax + rax]
mov r8d, 0x104
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x258]
call qword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
mov ebx, eax
cmp eax, 2
jbe 0x1400541be
add ebx, 0xfffffffe
lea rcx, [rsp + 0x20]
mov r8d, ebx
mov rdx, rdi
call fcn.1400a13f8
test eax, eax
jne 0x1400541be
cmp word [rdi + rbx*2], 0x5c
je 0x1400541d9
movzx eax, word [rsp + 0x258]
inc ax
mov word [rsp + 0x258], ax
cmp ax, 0x5a
jbe 0x140054180
jmp 0x140054209
movzx eax, word [rsp + 0x258]
lea rdx, [rdi + rbx*2]
mov word [rdi], ax
lea rcx, [rdi + 4]
movzx eax, word [rsp + 0x25a]
sub ebp, ebx
mov word [rdi + 2], ax
lea r8d, [rbp + 1]
add r8, r8
call fcn.1400973b0
add ebp, 2
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebp
mov rbp, qword [rsp + 0x250]
lea r11, [rsp + 0x230]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x1400579a0
Capabilities:
Create shortcut via ishelllink
Get keyboard layout

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x40
mov rbp, rcx
mov rbx, r9
xor ecx, ecx
mov r14, r8
mov rdi, rdx
xor sil, sil
call qword [sym.imp.ole32.dll_CoInitialize]
xor edx, edx
lea rax, [rsp + 0x30]
lea r9, [0x1400b5f00]
mov qword [rsp + 0x20], rax
lea rcx, [0x1400b5f10]
lea r8d, [rdx + 1]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x140057b95
mov rcx, qword [rsp + 0x30]
mov rdx, rdi
mov rax, qword [rcx]
call qword [rax + 0xa0]
cmp word [rbx], 0
je 0x140057a22
mov rcx, qword [rsp + 0x30]
mov rdx, rbx
mov rax, qword [rcx]
call qword [rax + 0x48]
mov rdx, qword [rsp + 0x70]
cmp word [rdx], 0
je 0x140057a38
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx]
call qword [rax + 0x58]
mov rdx, qword [rsp + 0x78]
cmp word [rdx], 0
je 0x140057a4e
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx]
call qword [rax + gethostname]
mov rdi, qword [rsp + 0x80]
cmp word [rdi], 0
je 0x140057aa9
mov rbx, qword [rsp + 0x90]
cmp word [rbx], 0
je 0x140057a95
mov rcx, rbx
call fcn.14000e2e0
mov rcx, rbx
test al, al
je 0x140057a8a
xor edx, edx
lea r8d, [rdx + 0x10]
call fcn.14009d670
lea r8d, [rax - 1]
jmp 0x140057a98
call fcn.14009d1f8
lea r8d, [rax - 1]
jmp 0x140057a98
xor r8d, r8d
mov rcx, qword [rsp + 0x30]
mov rdx, rdi
mov rax, qword [rcx]
call qword [rax + 0x88]
mov rbx, qword [rsp + 0x88]
cmp word [rbx], 0
je 0x140057aef
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
mov r9b, 1
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rax
mov rcx, rbx
call fcn.140013280
test al, al
je 0x140057aef
mov rcx, qword [rsp + 0x30]
movzx edx, al
mov eax, 0x600
or dx, ax
mov r9, qword [rcx]
call qword [r9 + 0x68]
mov rbx, qword [rsp + 0x98]
cmp word [rbx], 0
je 0x140057b2b
mov rcx, rbx
call fcn.14000e2e0
mov rcx, rbx
test al, al
je 0x140057b19
xor edx, edx
lea r8d, [rdx + 0x10]
call fcn.14009d670
jmp 0x140057b1e
call fcn.14009d1f8
mov rcx, qword [rsp + 0x30]
mov edx, eax
mov rax, qword [rcx]
call qword [rax + 0x78]
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x38]
lea rdx, [0x1400b5f20]
mov rax, qword [rcx]
call qword [rax]
test eax, eax
js 0x140057b8a
mov rcx, qword [rsp + 0x38]
mov r8d, 1
mov rdx, r14
mov rax, qword [rcx]
call qword [rax + 0x30]
test eax, eax
js 0x140057b7f
mov rcx, qword [0x1400f1518]
lea rdx, [0x1400be064]
xor r9d, r9d
mov byte [rsp + 0x20], 1
or r8, 0xffffffffffffffff
call fcn.14007d4e0
mov sil, 1
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rcx]
call qword [rdx + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rcx]
call qword [rdx + reloc.OLEAUT32.dll_SafeArrayGetDim]
call qword [sym.imp.ole32.dll_CoUninitialize]
test sil, sil
je 0x140057ba7
mov eax, 1
jmp 0x140057bb1
mov dl, 1
mov rcx, rbp
call fcn.140030e80
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret