joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400c19c0
Capabilities:
Get file version info

Disassembly:
push rbx
push rdi
sub rsp, 0x238
xor edi, edi
mov rbx, rcx
lea rax, [rcx + 8]
test rcx, rcx
jne 0x1400c19da
mov eax, edi
xor ecx, ecx
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rcx
mov qword [rax + 0x18], rcx
mov qword [rax + 0x20], rcx
mov qword [rax + 0x28], rcx
mov dword [rax + 0x30], ecx
mov rcx, qword [rbx + 0x40]
test rcx, rcx
je 0x1400c1a1b
lea rdx, [rsp + 0x20]
mov r8d, 0x104
mov dword [rbx + 0x68], 1
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x1400c1a27
xor eax, eax
add rsp, 0x238
pop rdi
pop rbx
ret
mov rcx, qword [rbx + 0x60]
mov qword [rsp + 0x230], rsi
test rcx, rcx
je 0x1400c1a41
call fcn.1400e3e78
mov qword [rbx + 0x60], rdi
lea rdx, [rsp + 0x258]
lea rcx, [rsp + 0x20]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test eax, eax
je 0x1400c1a9e
mov ecx, esi
call fcn.1400e2f98
lea rcx, [rsp + 0x20]
mov r8d, esi
mov r9, rax
xor edx, edx
mov qword [rbx + 0x60], rax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x1400c1a9e
mov rcx, qword [rbx + 0x60]
lea r9, [rsp + 0x250]
lea r8, [rsp + 0x260]
lea rdx, [0x140122f68]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
jne 0x1400c1ab2
xor eax, eax
mov rsi, qword [rsp + 0x230]
add rsp, 0x238
pop rdi
pop rbx
ret
mov rax, qword [rsp + 0x260]
lea r9, [rsp + 0x250]
lea r8, [rsp + 0x260]
lea rdx, str.VarFileInfoTranslation
movups xmm0, xmmword [rax]
movups xmmword [rbx + 8], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx + 0x18], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rbx + 0x28], xmm0
mov eax, dword [rax + 0x30]
mov dword [rbx + 0x38], eax
mov rcx, qword [rbx + 0x60]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x1400c1b12
cmp dword [rsp + 0x250], 4
jb 0x1400c1b12
mov rcx, qword [rsp + 0x260]
mov edx, dword [rcx]
mov dword [rbx + 0x48], edx
cmp dword [rbx + 8], 0xfeef04bd
mov rsi, qword [rsp + 0x230]
sete dil
mov eax, edi
add rsp, 0x238
pop rdi
pop rbx
ret
Function at 0x1400c23b0
Capabilities:
Enumerate process modules
Enumerate processes

Disassembly:
push rsi
mov eax, 0x2cc0
call fcn.1400e5730
sub rsp, rax
mov rsi, rcx
call fcn.1400c21a0
test rax, rax
je 0x1400c25fc
lea rdx, [rsp + 0x2cd8]
mov rcx, rax
mov qword [rsp + 0x2ca8], rdi
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [rsp + 0x20], 0x238
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1400c25f4
lea rdx, [rsp + 0x20]
mov rcx, rax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x1400c25eb
nop dword [rax]
mov ecx, dword [rsp + 0x2cd8]
cmp dword [rsp + 0x28], ecx
je 0x1400c2443
lea rdx, [rsp + 0x20]
mov rcx, rdi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x1400c2420
jmp 0x1400c25eb
mov rcx, qword [rsi + 0x10]
mov edx, 0x40a
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x1400c25eb
mov qword [rsp + 0x2cb8], rbx
or rbx, 0xffffffffffffffff
mov qword [rsp + 0x2cb0], rbp
mov qword [rsp + 0x2ca0], r14
lea rcx, [rsp + 0x4c]
mov rax, rbx
nop
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400c2480
lea rdx, [rsp + 0x4c]
lea rcx, [rsi + 0x28c0]
mov r8d, eax
call fcn.14000c060
xor ecx, ecx
movzx eax, word [rsp + rcx + 0x4c]
lea rcx, [rcx + 2]
mov word [rsp + rcx + 0x25e], ax
test ax, ax
jne 0x1400c24a0
mov r8d, dword [rsp + 0x2cd8]
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbp, rax
test rax, rax
je 0x1400c2546
lea r9, [rsp + 0x2ce0]
lea rdx, [rsp + 0x2ce8]
mov r8d, 8
mov rcx, rax
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x1400c2541
mov rdx, qword [rsp + 0x2ce8]
lea r8, [rsp + 0x260]
mov r9d, 0x104
mov rcx, rbp
call sub.PSAPI.DLL_GetModuleFileNameExW
lea rax, [rsp + 0x260]
nop dword [rax + rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1400c2520
lea rdx, [rsp + 0x260]
lea rcx, [rsi + 0x28c0]
mov r8d, ebx
call fcn.14000c060
mov rcx, rbp
jmp 0x1400c25c1
lea rcx, [0x14026d7b0]
call fcn.1400840f0
test eax, eax
je 0x1400c25c7
mov eax, dword [rsp + 0x2cd8]
lea r9, str.SynGetModulePathNameEvent
xor r8d, r8d
mov dword [rsp + 0x478], eax
mov rax, qword [rsi + 0x10]
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x470], 0xe
mov qword [rsp + 0x480], rax
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rbx, rax
test rax, rax
je 0x1400c25c7
lea rdx, [rsp + 0x470]
lea rcx, [0x14026d7b0]
call fcn.1400843f0
test rax, rax
je 0x1400c25be
mov edx, 0x2710
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rsi + 0x10]
mov rcx, rsi
call fcn.1400c2760
mov r14, qword [rsp + 0x2ca0]
mov rbp, qword [rsp + 0x2cb0]
mov rbx, qword [rsp + 0x2cb8]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, qword [rsp + 0x2ca8]
add rsp, 0x2cc0
pop rsi
ret
Function at 0x1400c2650
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rdi
sub rsp, 0x2d0
mov rdi, rcx
mov rbp, rdx
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x98
call fcn.1400e4040
xor ebx, ebx
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x50], rax
lea rax, [0x140138cc8]
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x98
mov qword [rsp + 0x28], rbp
mov word [rsp + 0xc0], bx
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x58], 0x208
mov dword [rsp + 0x4c], 1
mov qword [rsp + 0x60], rbx
mov dword [rsp + 0x68], ebx
mov qword [rsp + 0x70], rbx
mov dword [rsp + 0x80], 0x1800
call qword [sym.imp.COMDLG32.dll_GetOpenFileNameW]
cmp eax, 1
jne 0x1400c273e
mov rdx, qword [rsp + 0x50]
mov qword [rsp + 0x2e0], rsi
test rdx, rdx
je 0x1400c270b
or rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rdx + rax*2], bx
jne 0x1400c2700
mov ebx, eax
lea rcx, [rdi + 0x28c0]
mov r8d, ebx
call fcn.14000c060
mov rcx, qword [rdi + 0x28c0]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov rsi, qword [rsp + 0x2e0]
test eax, eax
je 0x1400c273e
mov rdx, rbp
mov rcx, rdi
call fcn.1400c2760
lea r11, [rsp + 0x2d0]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x1400c2830
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x230
mov rdi, rdx
mov rsi, rcx
mov edx, 0x40a
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetDlgItem]
or rbx, 0xffffffffffffffff
test rax, rax
je 0x1400c2899
lea rdx, [rsp + 0x20]
mov r8d, 0x104
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowTextW]
lea rcx, [rsi + 0x28c0]
lea rdx, [rsp + 0x20]
mov rax, rbx
inc rax
cmp word [rdx + rax*2], 0
jne 0x1400c2882
lea rdx, [rsp + 0x20]
mov r8d, eax
call fcn.14000c060
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x208
call fcn.1400e4040
mov edx, 0x40c
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x1400c28f7
lea rdx, [rsp + 0x20]
mov r8d, 0x104
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowTextW]
lea rcx, [rsi + 0x28c8]
lea rax, [rsp + 0x20]
nop
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1400c28e0
lea rdx, [rsp + 0x20]
mov r8d, ebx
call fcn.14000c060
lea r11, [rsp + 0x230]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret

Function at 0x1400c2ba0
Capabilities:
Hide graphical window

Disassembly:
push rbx
sub rsp, 0x20
xor edx, edx
mov rbx, rcx
mov dword [rcx + 0x28d0], 0
call fcn.1400c2230
call qword [sym.imp.USER32.dll_ReleaseCapture]
mov rcx, qword [rbx + 0x28e8]
mov edx, 5
add rsp, 0x20
pop rbx
jmp qword [sym.imp.USER32.dll_ShowWindow]
Function at 0x1400c5210
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
lea rcx, [0x14026d7b0]
mov rdi, r9
mov rsi, r8
mov rbx, rdx
call fcn.140084450
test eax, eax
je 0x1400c524d
mov eax, 0x40
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.1400e00d0
Function at 0x1400c5e80
Capabilities:
Log keystrokes via polling

Disassembly:
push rsi
push rdi
push r12
sub rsp, 0x40
mov eax, dword [rcx + 0x58]
mov edi, r9d
movzx r12d, r8b
cdq
mov rsi, rcx
xor eax, edx
cmp eax, edx
jne 0x1400c5ea8
xor eax, eax
add rsp, 0x40
pop r12
pop rdi
pop rsi
ret
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x70], r13
mov ecx, 0x11
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r15
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
xor r14d, r14d
mov ecx, 0x10
test ax, ax
sets r14b
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
xor r15d, r15d
test ax, ax
mov eax, dword [rsp + 0x80]
mov r9d, edi
sets r15b
mov edx, r14d
mov rcx, rsi
mov r8d, r15d
mov dword [rsp + 0x20], eax
call fcn.1400c6090
mov r13d, 1
mov ebx, eax
mov eax, 0x5dc
cmp ebx, eax
cmovg ebx, eax
mov eax, 0xfffffa24
cmp ebx, eax
cmovl ebx, eax
test edi, edi
jne 0x1400c5f38
mov eax, dword [rsi + 0x34]
test al, 2
jne 0x1400c5f38
bt eax, 0x13
jb 0x1400c5f38
xor ebp, ebp
jmp 0x1400c5f3b
mov ebp, r13d
test r14d, r14d
mov r14, qword [rsp + 0x38]
jne 0x1400c5f4a
test r15d, r15d
je 0x1400c5f8d
test edi, edi
jne 0x1400c5f8d
test dword [rsi + 0x34], 0x80000
jne 0x1400c5f8d
xor ebp, ebp
mov eax, ebx
cdq
xor eax, edx
sub eax, edx
cmp eax, 0x78
jl 0x1400c5fac
mov eax, 0x88888889
imul ebx
add ebx, edx
sar ebx, 6
mov eax, ebx
shr eax, 0x1f
add ebx, eax
mov eax, ebx
cdq
xor eax, edx
sub eax, edx
cmp eax, 0x7f
jl 0x1400c5fe9
test ebx, ebx
jns 0x1400c5fdf
or eax, 0xffffffff
jmp 0x1400c5fe6
test ebp, ebp
je 0x1400c5f59
test edi, edi
je 0x1400c5fb3
xor edx, edx
mov rcx, rsi
call fcn.1400c8130
mov ecx, eax
mov eax, ebx
cdq
xor eax, edx
sub eax, edx
cmp eax, ecx
jge 0x1400c5fe9
xor eax, eax
jmp 0x1400c605e
mov eax, ebx
cdq
xor eax, edx
sub eax, edx
cmp eax, 0x168
jle 0x1400c5fe9
test ebx, ebx
jns 0x1400c5fd0
or eax, 0xffffffff
imul ebx, eax, 0x168
jmp 0x1400c5fe9
xor eax, eax
test ebx, ebx
setg al
imul ebx, eax, 0x168
jmp 0x1400c5fe9
xor eax, eax
test ebx, ebx
setg al
imul ebx, eax, 0x7f
mov eax, dword [rsi + 0x58]
neg ebx
cdq
mov edi, eax
mov rax, qword [0x14026efa0]
xor edi, edx
sub edi, edx
test rax, rax
je 0x1400c6052
mov rax, qword [rax]
test rax, rax
je 0x1400c6052
xor ecx, ecx
test r12b, r12b
cmove ecx, r13d
test ebp, ebp
je 0x1400c6019
or ecx, 2
mov r10, qword [rax + 0x58]
test r10, r10
jne 0x1400c6026
lea r10, [rax + 0x70]
mov rax, qword [r10]
mov dword [rsp + 0x28], ecx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r10
mov dword [rsp + 0x20], ebx
call qword [rax + 0xe0]
mov eax, dword [rsi + 0x58]
test eax, eax
jle 0x1400c604d
sub eax, edi
jmp 0x1400c604f
add eax, edi
mov dword [rsi + 0x58], eax
mov dword [rsi + 0x94], 0
mov eax, edi
mov r13, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov r15, qword [rsp + 0x30]
add rsp, 0x40
pop r12
pop rdi
pop rsi
ret
Function at 0x1400c88b0
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
mov eax, 0x2030
call fcn.1400e5730
sub rsp, rax
mov r10d, dword [rsp + 0x2060]
mov rdi, r9
mov ebp, r8d
mov r14, rdx
mov rsi, rcx
sub r10d, 2
je 0x1400c89ef
dec r10d
jne 0x1400c8a4b
cmp r8d, 0xc
jne 0x1400c8a4b
mov rcx, rdx
call qword [sym.imp.USER32.dll_GetDlgCtrlID]
mov rbx, qword [rsp + 0x2068]
mov r8d, eax
test rbx, rbx
je 0x1400c8a4b
test rdi, rdi
je 0x1400c8a4b
test eax, eax
je 0x1400c8a4b
mov ecx, dword [rdi]
xor esi, esi
mov r10d, esi
mov edx, esi
test ecx, ecx
je 0x1400c895f
mov eax, esi
cmp ecx, r8d
je 0x1400c8957
mov ecx, dword [rdi + rax*4 + 8]
add rax, 2
add edx, 2
test ecx, ecx
jne 0x1400c8941
jmp 0x1400c895f
movsxd rax, edx
mov r10d, dword [rdi + rax*4 + 4]
lea r8, [rsp + 0x30]
mov r9d, 0x1000
mov edx, r10d
mov rcx, rbx
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x1400c89d4
lea r9, [0x1400c8a70]
mov r8, r14
mov edx, 0xaa
mov rcx, rbx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.USER32.dll_CreateDialogParamW]
mov qword [0x14026fb70], rax
call fcn.1400aff00
test eax, eax
je 0x1400c89b3
mov rcx, qword [0x14026fb70]
call fcn.1400b0210
mov r9, qword [rsp + 0x2070]
mov rcx, qword [0x14026fb70]
lea r8, [rsp + 0x30]
mov edx, 0x401
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x1400c8a4b
mov rcx, qword [0x14026fb70]
test rcx, rcx
je 0x1400c8a4b
call qword [sym.imp.USER32.dll_DestroyWindow]
mov qword [0x14026fb70], rsi
jmp 0x1400c8a4b
add rcx, 0x418
or rbx, 0xffffffffffffffff
mov rax, rbx
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400c8a00
test rax, rax
je 0x1400c8a15
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rsi + 0x620]
nop dword [rax]
inc rbx
cmp word [rcx + rbx*2], 0
jne 0x1400c8a20
test rbx, rbx
je 0x1400c8a35
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rdx, str.Mouse.hlp
mov r9, rdi
mov r8d, ebp
mov rcx, r14
call qword [sym.imp.USER32.dll_WinHelpW]
lea r11, [rsp + 0x2030]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x1400ca240
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rbp
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
mov qword [rcx + 0x28], 7
xor r14d, r14d
mov qword [rcx + 0x20], r14
mov word [rcx + 0x10], r14w
add rcx, 0x438
lea rdx, str.SynCom.PointingDevice
call fcn.14002e270
lea rax, vtable.CDummySynDevice.0
mov qword [rsi + 0x450], rax
mov dword [rsi + 0x458], r14d
mov qword [rsi + 0x448], r14
lea rax, vtable.SynDeviceEx.0
mov qword [rsi + 0x430], rax
lea rax, vtable.SynDeviceEx.1.0
mov qword [rsi + 0x440], rax
mov dword [rsi + 0x460], 0xffffffff
mov dword [rsi + 0x464], r14d
lea rcx, [rsi + 0x480]
call fcn.1400e10a0
nop
mov qword [rsi], rbx
mov qword [rsi + 8], rdi
mov dword [rsi + 0x470], 0x800
mov qword [rsi + 0x468], r14
mov qword [rsi + 0x478], r14
mov dword [rsi + 0x474], 1
lea rdi, [rsi + 0x4a0]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor edx, edx
lea r8d, [r14 + 0x26]
lea rcx, [rsi + 0x480]
call fcn.1400e1190
test eax, eax
jns 0x1400ca394
lea rcx, str.ProgramFiles
call fcn.1400ed5e8
test rax, rax
je 0x1400ca372
lea rcx, str.ProgramFiles
call fcn.1400ed5e8
mov rdx, rdi
sub rdx, rax
nop dword [rax]
movzx ecx, word [rax]
mov word [rdx + rax], cx
lea rax, [rax + 2]
test cx, cx
jne 0x1400ca360
jmp 0x1400ca394
lea rcx, str.C:Program_Files
mov rdx, rsi
sub rdx, rcx
nop
movzx eax, word [rcx]
mov word [rdx + rcx + 0x4a0], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x1400ca380
lea rbx, [rsi + 0x6a8]
mov r8, rdi
lea rdx, str._sSynapticsSynTP
mov rcx, rbx
call fcn.1400e5bbc
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1400ca3c9
mov rdx, rbx
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
xor ecx, ecx
call fcn.1400dbe60
cmp eax, 9
jl 0x1400ca3ff
lea rax, [rsi + 0x8b0]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 5]
lea rcx, [rsi + 0x480]
call fcn.1400e1190
test eax, eax
jns 0x1400ca420
lea rcx, [rsi + 0x8b0]
sub rcx, rbx
nop dword [rax]
movzx eax, word [rbx]
mov word [rcx + rbx], ax
lea rbx, [rbx + 2]
test ax, ax
jne 0x1400ca410
mov rax, rsi
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x1400cdc40
Capabilities:
Get file version info

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rdx
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x88
mov qword [r11 - 0x80], 0xfffffffffffffffe
mov rdi, rdx
mov rsi, rcx
xor r15d, r15d
mov dword [rsp + 0x30], r15d
mov word [r11 - 0x78], r15w
xor eax, eax
mov qword [r11 - 0x76], rax
mov qword [r11 - 0x6e], rax
mov qword [r11 - 0x66], rax
mov qword [r11 - 0x5e], rax
mov qword [r11 - 0x56], rax
mov qword [r11 - 0x4e], rax
mov qword [r11 - 0x46], rax
mov word [rsp + 0x7a], ax
cmp qword [rdx + 0x18], 8
jb 0x1400cdca0
mov rcx, qword [rdx]
jmp 0x1400cdca3
mov rcx, rdx
lea rdx, [rsp + 0xc0]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov ebp, eax
or rbx, 0xffffffffffffffff
test eax, eax
je 0x1400cdd60
mov eax, 2
mul rbp
cmovo rax, rbx
mov rcx, rax
call fcn.1400e2f98
mov r14, rax
cmp qword [rdi + 0x18], 8
jb 0x1400cdce1
mov rcx, qword [rdi]
jmp 0x1400cdce4
mov rcx, rdi
mov r9, rax
mov r8d, ebp
xor edx, edx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x1400cdd58
mov qword [rsp + 0xd8], r15
lea r9, [rsp + 0xd0]
lea r8, [rsp + 0xd8]
lea rdx, [0x140122f68]
mov rcx, r14
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x1400cdd58
mov rdx, qword [rsp + 0xd8]
test rdx, rdx
je 0x1400cdd58
movzx eax, word [rdx + 0xc]
movzx ecx, word [rdx + 0xe]
movzx r9d, word [rdx + 8]
movzx r8d, word [rdx + 0xa]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
lea rdx, str.v_d._d._d._d
lea rcx, [rsp + 0x40]
call fcn.1400e5bbc
mov rcx, r14
call fcn.1400e3e78
mov qword [rsi + 0x18], 7
mov qword [rsi + 0x10], r15
mov word [rsi], r15w
cmp word [rsp + 0x40], 0
jne 0x1400cdd7d
mov rbx, r15
jmp 0x1400cdd8c
lea rax, [rsp + 0x40]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1400cdd82
mov r8, rbx
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.1400079e0
nop
cmp qword [rdi + 0x18], 8
jb 0x1400cddac
mov rcx, qword [rdi]
call fcn.1400e3e78
mov qword [rdi + 0x18], 7
mov qword [rdi + 0x10], r15
mov word [rdi], r15w
mov rax, rsi
add rsp, 0x88
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400cef10
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rsi, rax
test rax, rax
je 0x1400cefe7
movzx r8d, word [rax]
mov qword [rsp + 0x30], rbx
mov rbx, rax
test r8w, r8w
je 0x1400cef90
nop dword [rax]
lea rdx, [0x14013c810]
movzx r8d, r8w
mov rcx, rdi
call fcn.1400ebb0c
movzx r8d, word [rbx + 2]
add rbx, 2
test r8w, r8w
jne 0x1400cef50
lea rdx, [0x140130324]
mov rcx, rdi
call fcn.1400ebb0c
movzx r8d, word [rbx + 2]
add rbx, 2
test r8w, r8w
jne 0x1400cef50
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rcx, qword [rbp + 0x438]
mov rbx, qword [rsp + 0x30]
xor eax, eax
mov dword [rsp + 0x40], eax
test rcx, rcx
je 0x1400cefc4
mov rax, qword [rcx]
lea r8, [rsp + 0x40]
mov edx, 0x100001d2
call qword [rax + 0x18]
mov eax, dword [rsp + 0x40]
lea rcx, [0x14013bb78]
test eax, eax
lea r8, [0x14013bb80]
cmovne r8, rcx
lea rdx, str.IsUserAdmin_s_n
mov rcx, rdi
call fcn.1400ebb0c
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x1400cf000
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x2020
call fcn.1400e5730
sub rsp, rax
mov rbp, r8
mov rsi, rdx
xor edi, edi
nop word [rax + rax]
lea rdx, [0x140137910]
mov rcx, rbp
call fcn.1400ebba0
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x1400cf064
test rbx, rbx
jne 0x1400cf07f
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
inc edi
cmp edi, 0x3c
jl 0x1400cf030
xor eax, eax
lea r11, [rsp + 0x2020]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
mov rcx, rbx
call fcn.1400eb490
test eax, eax
jne 0x1400cf0cc
nop dword [rax + rax]
mov rcx, rbx
call fcn.1400eb4b8
test eax, eax
jne 0x1400cf0cc
lea rcx, [rsp + 0x20]
mov r8, rbx
mov edx, 0x1000
call fcn.1400eb990
test rax, rax
je 0x1400cf0cc
lea rcx, [rsp + 0x20]
mov rdx, rsi
call fcn.1400eba58
mov rcx, rbx
call fcn.1400eb490
test eax, eax
je 0x1400cf090
mov rcx, rsi
call fcn.1400e9de8
mov rcx, rbx
call fcn.1400e9cac
mov eax, 1
jmp 0x1400cf066
Function at 0x1400d1540
Capabilities:
Get common file path

Disassembly:
push rdi
sub rsp, 0x270
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rsp + 0x290], rbx
cmp dword [0x14026fbb0], 0
jne 0x1400d1731
mov dword [0x14026fbb0], 1
call fcn.1400dd8c0
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
test eax, eax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea edx, [rcx + 0x2a]
jne 0x1400d1592
lea edx, [rcx + 0x26]
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
call fcn.140005220
mov rdx, rax
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
jne 0x1400d15b7
mov ecx, 0x80004005
call fcn.1400051c0
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x280], rax
lea rcx, [rsp + 0x60]
lea rax, [rsp + 0x60]
or rbx, 0xffffffffffffffff
test rax, 0xffffffffffff0000
jne 0x1400d1608
movzx edi, cx
xor edx, edx
mov ecx, edi
call fcn.14000ba00
test rax, rax
je 0x1400d1630
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x280]
call fcn.14000be60
jmp 0x1400d1630
lea rcx, [rsp + 0x60]
mov rax, rbx
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400d1610
mov r8d, eax
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x280]
call fcn.14000c060
nop
lea r8, str.LenovoMetricCollectionSDKMFCLenovo.MetricCollectionMFC.dll
lea rdx, [rsp + 0x280]
lea rcx, [rsp + 0x288]
call fcn.140079350
nop
mov rdx, qword [rsp + 0x280]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x1400d1669
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [rsp + 0x288]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x14026fb80], rax
test rax, rax
je 0x1400d1715
lea rdx, str.GetMetricCollectionCollector
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
je 0x1400d1715
xor r8d, r8d
mov edx, 0x104
lea rcx, [rsp + 0x60]
call fcn.1400df260
mov byte [rsp + 0x48], 1
lea rax, str.SynapticsAppsCollectionReport
mov qword [rsp + 0x40], rax
lea rax, str.Local_Todo
mov qword [rsp + 0x38], rax
lea rax, str.Countyr_Todo
mov qword [rsp + 0x30], rax
lea rax, str.Family_Todo
mov qword [rsp + 0x28], rax
lea rax, str.SubBrand_Todo
mov qword [rsp + 0x20], rax
lea r9, str.Brand_Todo
lea r8, str.MTM_Todo
lea rdx, str.19.0.12.98
lea rcx, [rsp + 0x60]
call rdi
mov qword [0x14026fb78], rax
mov rdx, qword [rsp + 0x288]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x1400d1731
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [0x14026fb78]
mov rbx, qword [rsp + 0x290]
add rsp, 0x270
pop rdi
ret
Function at 0x1400d7230
Capabilities:
Get session user name

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x670
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rsp + 0x698], rbx
mov rdi, rcx
lea rax, vtable.CSynDeviceGestureActionService.0
mov qword [rcx], rax
mov qword [rcx + 8], rdx
lea rbx, [rcx + 0x18]
xor eax, eax
mov qword [rbx], rax
mov qword [rbx + 8], rax
mov rcx, rbx
call fcn.1400d7e20
mov qword [rbx], rax
mov dword [rsp + 0x688], 0x101
lea rdx, [rsp + 0x688]
lea rcx, [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov rax, qword [rdi + 8]
mov rcx, qword [rax + 0x58]
test rcx, rcx
jne 0x1400d72a6
lea rcx, [rax + 0x70]
mov rax, qword [rcx]
lea r8, [rsp + 0x690]
mov edx, 0x10000101
call qword [rax + 0x18]
or ecx, 0xffffffff
test eax, eax
cmove ecx, dword [rsp + 0x690]
mov dword [rsp + 0x20], ecx
lea r9, [rsp + 0x60]
lea r8, str..pipe_sC01BC476_A852_4dfd_B33F_E308F3497BF4_li
mov edx, 0x200
lea rcx, [rsp + 0x270]
call fcn.1400e5c80
lea r9, [0x140122f68]
lea r8, [0x14012fd50]
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.1400dd150
cmp qword [rax + 0x10], 0
setne bl
cmp qword [rsp + 0x48], 8
jb 0x1400d731c
mov rcx, qword [rsp + 0x30]
call fcn.1400e3e78
test bl, bl
je 0x1400d737c
lea r9, [0x140122f68]
lea r8, [0x14012fd50]
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.1400dd150
cmp qword [rax + 0x18], 8
jb 0x1400d7344
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x270]
lea r8, str._s_s
mov edx, 0x200
lea rcx, [rsp + 0x270]
call fcn.1400e5c80
cmp qword [rsp + 0x48], 8
jb 0x1400d737c
mov rcx, qword [rsp + 0x30]
call fcn.1400e3e78
mov edx, 0x3d
lea rcx, [rsp + 0x270]
call fcn.140002990
mov qword [rdi + 0x10], rax
test rax, rax
je 0x1400d73a3
mov rdx, rdi
mov rcx, rax
call fcn.140002740
nop
mov rax, rdi
mov rbx, qword [rsp + 0x698]
add rsp, 0x670
pop rdi
ret