joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14009f200
Capabilities:
Enumerate files on windows

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x1c8]
sub rsp, 0x2c0
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov rdi, rcx
mov qword [rsp + 0x58], 7
xor esi, esi
mov qword [rsp + 0x50], rsi
mov word [rsp + 0x40], si
lea rdx, [rcx + 0x30]
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rcx, [rsp + 0x40]
call fcn.14000d1f0
nop
mov r8d, esi
cmp word [0x14017782c], r8w
setne r8b
lea rdx, [0x14017782c]
lea rcx, [rsp + 0x40]
call fcn.140041570
movzx eax, word [str..syn]
neg ax
sbb r8, r8
and r8d, 4
lea rdx, str..syn
lea rcx, [rsp + 0x40]
call fcn.140041570
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rcx, qword [rsp + 0x40]
lea rdx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14009f3c6
mov qword [rsp + 0x38], 7
mov qword [rsp + 0x30], rsi
mov word [rsp + 0x20], si
cmp word [rbp - 0x64], si
jne 0x14009f2de
mov r8d, esi
jmp 0x14009f2fb
lea rax, [rbp - 0x64]
or r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x14009f2f0
lea rdx, [rbp - 0x64]
lea rcx, [rsp + 0x20]
call fcn.14000d340
nop
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.14009fa40
nop
cmp qword [rsp + 0x38], 8
jb 0x14009f32a
mov rcx, qword [rsp + 0x20]
call fcn.14011f898
lea rdx, [rsp + 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x14009f3bc
mov qword [rsp + 0x38], 7
mov qword [rsp + 0x30], rsi
mov word [rsp + 0x20], si
cmp word [rbp - 0x64], 0
jne 0x14009f35f
mov r8, rsi
jmp 0x14009f37b
lea rax, [rbp - 0x64]
or r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x14009f370
lea rdx, [rbp - 0x64]
lea rcx, [rsp + 0x20]
call fcn.14000d340
nop
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.14009fa40
nop
cmp qword [rsp + 0x38], 8
jb 0x14009f3aa
mov rcx, qword [rsp + 0x20]
call fcn.14011f898
lea rdx, [rsp + 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x14009f340
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
cmp qword [rsp + 0x58], 8
jb 0x14009f3d8
mov rcx, qword [rsp + 0x40]
call fcn.14011f898
lea r11, [rsp + 0x2c0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x1400a9460
Capabilities:
Get common file path
Set current directory

Disassembly:
push rbx
sub rsp, 0x440
lea rcx, [rsp + 0x22]
xor ebx, ebx
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x20], bx
call fcn.14011fa60
lea rdx, [rsp + 0x20]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea rcx, [rsp + 0x230]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea rcx, [rsp + 0x230]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea edx, [rbx + 1]
lea rcx, str.control.exe_keyboard
xor r8d, r8d
call fcn.140119ff0
test eax, eax
je 0x1400a94f1
test byte [0x1402d741c], 2
je 0x1400a9501
lea r9, str.control.exe_mouse
lea r8, str.Successfully_SynExecd__s_n
lea edx, [rbx + 2]
lea rcx, str.CSynTPEnh::RunKeyboardControlPanel
call fcn.14011a590
jmp 0x1400a9501
xor edx, edx
lea r8d, [rdx + 0x10]
lea ecx, [rdx + 6]
call fcn.1400a9c70
mov ebx, eax
cmp word [rsp + 0x20], 0
je 0x1400a9514
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov eax, ebx
add rsp, 0x440
pop rbx
ret

Function at 0x1400a9530
Capabilities:
Get common file path
Set current directory

Disassembly:
push rbx
sub rsp, 0x440
lea rcx, [rsp + 0x22]
xor ebx, ebx
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x20], bx
call fcn.14011fa60
lea rdx, [rsp + 0x20]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea rcx, [rsp + 0x230]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea rcx, [rsp + 0x230]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea edx, [rbx + 1]
lea rcx, str.control.exe_mouse
xor r8d, r8d
call fcn.140119ff0
test eax, eax
je 0x1400a95c1
test byte [0x1402d741c], 2
je 0x1400a95d1
lea r9, str.control.exe_mouse
lea r8, str.Successfully_SynExecd__s_n
lea edx, [rbx + 2]
lea rcx, str.CSynTPEnh::RunMouseControlPanel
call fcn.14011a590
jmp 0x1400a95d1
xor edx, edx
lea r8d, [rdx + 0x10]
lea ecx, [rdx + 6]
call fcn.1400a9c70
mov ebx, eax
cmp word [rsp + 0x20], 0
je 0x1400a95e4
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov eax, ebx
add rsp, 0x440
pop rbx
ret
Function at 0x1400aa870
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x280
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rdi, rcx
xor ebp, ebp
mov dword [rsp + 0x30], ebp
mov eax, dword [0x1402de208]
lea rsi, str.NO_INIT
test al, 1
jne 0x1400aa93b
or eax, 1
mov dword [0x1402de208], eax
call fcn.140004fc0
mov rdx, rax
mov ecx, ebp
test rax, rax
setne cl
test ecx, ecx
jne 0x1400aa8d6
mov ecx, 0x80004005
call fcn.140004f70
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
add rax, 0x18
mov qword [0x1402de200], rax
test rsi, 0xffffffffffff0000
jne 0x1400aa918
movzx ebx, si
xor edx, edx
mov ecx, ebx
call fcn.140011240
test rax, rax
je 0x1400aa92e
mov r8d, ebx
mov rdx, rax
lea rcx, [0x1402de200]
call fcn.140011590
jmp 0x1400aa92e
mov r8d, 7
mov rdx, rsi
lea rcx, [0x1402de200]
call fcn.140011790
nop
lea rcx, [0x1401635f0]
call fcn.140120af0
nop
mov rdx, rbp
mov rax, qword [0x1402de200]
nop word [rax + rax]
movzx ecx, word [rax + rdx*2]
inc rdx
cmp cx, word [rsi + rdx*2 - 2]
jne 0x1400aa968
cmp rdx, 8
jne 0x1400aa950
mov ecx, ebp
jmp 0x1400aa96d
sbb ecx, ecx
or ecx, 1
test ecx, ecx
jne 0x1400aaa90
xor r8d, r8d
lea rdx, [0x140165848]
lea rcx, [0x1402de200]
call fcn.140011790
xor edx, edx
lea rcx, [rsp + 0x40]
call fcn.1400f7980
nop
mov dword [rsp + 0x298], 0x208
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x70]
call fcn.14011fa60
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], ebp
xor r9d, r9d
lea r8, str.SoftwareSynapticsSynTPInstall
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x40]
call fcn.1400f7af0
test eax, eax
je 0x1400aaa7f
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x298]
lea r8, [rsp + 0x70]
lea rdx, str.ProgDir
lea rcx, [rsp + 0x48]
call fcn.14011b2a0
test eax, eax
je 0x1400aaa7f
lea rcx, [rsp + 0x70]
sub rcx, 2
lea rcx, [rcx + 2]
cmp word [rcx], 0
jne 0x1400aaa15
movups xmm0, xmmword [str.SynTPHelper.exe]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [0x14018be48]
movups xmmword [rcx + 0x10], xmm1
movzx eax, word [0x14018be58]
mov word [rcx + 0x20], ax
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400aaa7f
lea rdx, [rsp + 0x70]
or rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x1400aaa60
mov r8d, eax
lea rdx, [rsp + 0x70]
lea rcx, [0x1402de200]
call fcn.140011790
nop
lea rcx, [rsp + 0x40]
call fcn.1400f7a90
mov rax, qword [0x1402de200]
lea rcx, [rax - 0x18]
call fcn.1400112f0
add rax, 0x18
mov qword [rdi], rax
mov rax, rdi
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1400aaad0
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
cmp dword [rcx + 0x9fc], 0
mov rbx, rcx
je 0x1400aab2f
cmp dword [rcx + 0xa00], 0
je 0x1400aab07
mov rcx, qword [rcx + 0x948]
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1400aab07
mov eax, 1
add rsp, 0x30
pop rbx
ret
cmp dword [rbx + 0x17b0], 0
jne 0x1400aab2f
xor eax, eax
lea r8, [0x1400b1590]
mov r9, rbx
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor eax, eax
add rsp, 0x30
pop rbx
ret

Function at 0x1400ab790
Capabilities:
Enumerate gui resources

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x240
cmp dword [rcx + 0xa04], 0
mov edi, r8d
mov esi, edx
mov rbx, rcx
je 0x1400ab7ba
xor eax, eax
jmp 0x1400ab8a9
call fcn.1400ab060
mov rcx, qword [rbx + 0x998]
test rcx, rcx
je 0x1400ab7f7
test edi, edi
jns 0x1400ab7e1
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x10]
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x1400ab7f7
mov edx, edi
call fcn.140118910
test eax, eax
je 0x1400ab7f7
mov qword [rbx + 0x998], 0
mov rcx, qword [rbx + 0x990]
test rcx, rcx
je 0x1400ab8a4
test esi, esi
je 0x1400ab8a4
test edi, edi
jns 0x1400ab88e
mov qword [rsp + 0x30], rcx
xor r8d, r8d
lea rcx, [rsp + 0x250]
xor r9d, r9d
mov edx, reloc.OLEAUT32.dll_VarDecFix
mov dword [rsp + 0x20], r8d
call fcn.1400dc6c0
lea rcx, [rsp + 0x38]
mov edx, 0x104
mov r8, qword [rax]
call fcn.140121234
mov rdx, qword [rsp + 0x250]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x1400ab863
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, [rsp + 0x30]
lea rcx, [0x1400f68f0]
call qword [sym.imp.USER32.dll_EnumWindows]
mov rcx, qword [rbx + 0x990]
xor r9d, r9d
lea edx, [r9 + 0x10]
xor r8d, r8d
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x1400ab8a4
mov edx, edi
call fcn.140118910
test eax, eax
je 0x1400ab8a4
mov qword [rbx + 0x990], 0
mov eax, 1
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1400acf70
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x280
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rdi, rcx
mov ebx, 1
mov esi, ebx
xor ecx, ecx
call fcn.140116270
xor ebp, ebp
cmp eax, 0xb
jl 0x1400ad062
cmp word [rdi + 0x1a8], bp
je 0x1400ad062
xor edx, edx
lea rcx, [rsp + 0x38]
call fcn.1400f7980
nop
mov dword [rsp + 0x298], ebp
lea r8, [rdi + 0x3b0]
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], ebp
xor r9d, r9d
mov rdx, 0xffffffff80000001
lea rcx, [rsp + 0x38]
call fcn.1400f7af0
test eax, eax
je 0x1400ad052
lea rdx, [rdi + 0x5b8]
mov qword [rsp + 0x20], rbp
xor r9d, r9d
lea r8, [rsp + 0x298]
lea rcx, [rsp + 0x40]
call fcn.14011b090
test eax, eax
je 0x1400ad052
test byte [0x1402d741c], 4
je 0x1400ad040
mov r9d, dword [rsp + 0x298]
lea r8, str.find_out_users_option:_dwValue_d_n
lea edx, [rbx + 2]
lea rcx, str.CSynTPEnh::ShouldShowOSDByUserOption
call fcn.14011a490
mov dword [rdi + 0x17e8], ebp
cmp dword [rsp + 0x298], 0
jne 0x1400ad054
mov esi, ebp
mov ebx, ebp
lea rcx, [rsp + 0x38]
call fcn.1400f7a90
test esi, esi
je 0x1400ad0d8
cmp dword [rdi + 0x17e8], 0
je 0x1400ad0d8
test byte [0x1402d741c], 4
je 0x1400ad08c
lea r8, str.run_OEM_program..._n
mov edx, 3
lea rcx, str.CSynTPEnh::ShouldShowOSDByUserOption
call fcn.14011a490
lea rcx, [rdi + 0x1a8]
mov r8d, 0x104
lea rdx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea rdx, [rsp + 0x70]
mov rcx, rdi
call fcn.1400abf30
test eax, eax
jne 0x1400ad0d8
test byte [0x1402d741c], 2
je 0x1400ad0d4
lea r8, str.cannot_run_OEM_program__not_show_OSD__n
lea edx, [rax + 2]
lea rcx, str.CSynTPEnh::ShouldShowOSDByUserOption
call fcn.14011a490
mov eax, ebp
jmp 0x1400ad0da
mov eax, ebx
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1400b0740
Capabilities:
Swap mouse buttons

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x80
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0xa0], rbx
mov ebx, r8d
mov ebp, edx
mov rdi, rcx
mov ecx, 0x17
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov esi, eax
test byte [0x1402d741c], 4
je 0x1400b0795
mov r9d, eax
lea r8, str.System:_lSwapState_x_n
mov edx, 3
lea rcx, str.CSynTPEnh::SendMouseButtonSwapState
call fcn.14011a490
test ebx, ebx
je 0x1400b0906
call fcn.140004fc0
mov rdx, rax
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
jne 0x1400b07bc
mov ecx, 0x80004005
call fcn.140004f70
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0xb8], rax
lea rcx, [rsp + 0xb8]
test ebp, ebp
jne 0x1400b07f3
mov rbp, 0xffffffff80000003
mov r8d, 0x1c
lea rdx, str..DEFAULTControl_PanelMouse
jmp 0x1400b0807
mov rbp, 0xffffffff80000001
mov r8d, 0x13
lea rdx, str.Control_PanelMouse
call fcn.140011790
mov rbx, qword [rsp + 0xb8]
test byte [0x1402d741c], 4
je 0x1400b0838
mov r9, rbx
lea r8, str.bReadConfig:_will_read_swapbutton_info_from__s_n
mov edx, 3
lea rcx, str.CSynTPEnh::SendMouseButtonSwapState
call fcn.14011a590
xor edx, edx
lea rcx, [rsp + 0x50]
call fcn.1400f7980
nop
mov dword [rsp + 0xb0], 0x14
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rbx
mov rdx, rbp
lea rcx, [rsp + 0x50]
call fcn.1400f7af0
test eax, eax
je 0x1400b08e7
mov qword [rsp + 0x28], 0
lea rax, [0x14018c9f0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xb0]
lea r8, [rsp + 0x38]
lea rdx, str.SwapMouseButtons
lea rcx, [rsp + 0x58]
call fcn.14011b2a0
test eax, eax
je 0x1400b08e7
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x38]
call fcn.140122eb4
mov esi, eax
mov eax, dword [rdi + 0x1690]
sub eax, 0x237c
cmp eax, 1
ja 0x1400b08e7
mov ecx, 0x17
call qword [sym.imp.USER32.dll_GetSystemMetrics]
cmp esi, eax
je 0x1400b08e7
mov ecx, esi
call qword [sym.imp.USER32.dll_SwapMouseButton]
nop
lea rcx, [rsp + 0x50]
call fcn.1400f7a90
nop
lea rdx, [rbx - 0x18]
lock add dword [rdx + 0x10], 0xffffffff
jg 0x1400b0906
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, dword [rdi + 0x1690]
sub eax, 0x237c
cmp eax, 1
jbe 0x1400b0928
cmp dword [rdi + 0x9e0], 0
je 0x1400b0932
cmp dword [rdi + 0x7e0], 0
jne 0x1400b0932
mov edx, esi
mov rcx, rdi
call fcn.1400b0d50
test byte [0x1402d741c], 4
je 0x1400b0956
mov r9d, esi
lea r8, str.Notify_kernel_by_calling_SetProperty_TP_SwapState___d__n
mov edx, 3
lea rcx, str.CSynTPEnh::SendMouseButtonSwapState
call fcn.14011a490
mov rcx, qword [rdi + 0x16b0]
test rcx, rcx
jne 0x1400b0969
lea rcx, [rdi + 0x16b8]
mov rax, qword [rcx]
mov r8d, esi
mov edx, 0x1000097
mov rbx, qword [rsp + 0xa0]
add rsp, 0x80
pop rdi
pop rsi
pop rbp
jmp qword [rax + 0x40]
Function at 0x1400b1600
Capabilities:
Enumerate gui resources

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x240
mov rbx, rcx
dec edx
je 0x1400b1670
dec edx
jne 0x1400b1771
mov edx, 1
call fcn.1400adf50
mov edx, 1
mov rcx, rbx
call fcn.1400ae050
test eax, eax
je 0x1400b1648
lea rcx, [rbx + 0x1888]
mov edx, 1
call fcn.1400380e0
lea rcx, [rbx + 0x1888]
or edx, 0xffffffff
call fcn.1400376b0
test byte [0x1402d741c], 2
je 0x1400b1771
lea r8, str.Entering_workspace_n
jmp 0x1400b1760
cmp dword [rcx + 0x1740], 0
je 0x1400b168b
mov rcx, qword [0x1402dd258]
mov edx, 0xfffd
call qword [sym.imp.USER32.dll_KillTimer]
lea rcx, [rbx + 0x1888]
or edx, 0xffffffff
call fcn.140037590
cmp dword [rbx + 0xa04], 0
jne 0x1400b1750
mov rcx, rbx
call fcn.1400ab060
mov rcx, qword [rbx + 0x998]
test rcx, rcx
je 0x1400b16cb
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x10]
call qword [sym.imp.USER32.dll_PostMessageW]
mov rax, qword [rbx + 0x990]
test rax, rax
je 0x1400b1750
xor r8d, r8d
lea rcx, [rsp + 0x260]
xor r9d, r9d
mov edx, reloc.OLEAUT32.dll_VarDecFix
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x20], r8d
call fcn.1400dc6c0
lea rcx, [rsp + 0x38]
mov edx, 0x104
mov r8, qword [rax]
call fcn.140121234
mov rdx, qword [rsp + 0x260]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x1400b1727
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, [rsp + 0x30]
lea rcx, [0x1400f68f0]
call qword [sym.imp.USER32.dll_EnumWindows]
mov rcx, qword [rbx + 0x990]
xor r9d, r9d
lea edx, [r9 + 0x10]
xor r8d, r8d
call qword [sym.imp.USER32.dll_PostMessageW]
test byte [0x1402d741c], 2
je 0x1400b1771
lea r8, str.Leaving_workspace_n
lea rcx, str.CSynTPEnh::PrepareForWorkspaceSwitch
mov edx, 2
call fcn.14011a490
mov rbx, qword [rsp + 0x250]
add rsp, 0x240
pop rdi
ret
Function at 0x1400b2d50
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x230
mov rsi, rcx
xor ecx, ecx
xor edi, edi
call fcn.140116270
cmp eax, 7
jl 0x1400b2e8c
lea rcx, [rsp + 0x22]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x20], di
call fcn.14011fa60
lea rcx, [rsp + 0x20]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea rcx, [rsp + 0x20]
sub rcx, 2
nop word [rax + rax]
cmp word [rcx + 2], di
lea rcx, [rcx + 2]
jne 0x1400b2db0
movups xmm0, xmmword [str.WtsApi32.dll]
movsd xmm1, qword [0x1401899a0]
mov eax, dword [0x1401899a8]
movups xmmword [rcx], xmm0
movsd qword [rcx + 0x10], xmm1
mov dword [rcx + 0x18], eax
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
test rax, rax
jne 0x1400b2e10
test byte [0x1402d741c], 1
je 0x1400b2e0c
lea r8, str.Couldnt_get_handle_to_WtsApi32.DLL_n
lea edx, [rax + 1]
lea rcx, str.CSynTPEnh::RegisterForSystemNotification
call fcn.14011a490
xor eax, eax
jmp 0x1400b2e8e
lea rdx, str.WTSRegisterSessionNotification
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x1400b2e51
test byte [0x1402d741c], 1
je 0x1400b2e44
lea r8, str.Couldnt_get_address_of_WTSRegisterSessionNotification_n
lea edx, [rax + 1]
lea rcx, str.CSynTPEnh::RegisterForSystemNotification
call fcn.14011a490
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
jmp 0x1400b2e8e
mov rcx, qword [rsi + 0xa18]
xor edx, edx
call rax
mov edi, eax
test eax, eax
je 0x1400b2e83
test byte [0x1402d741c], 1
je 0x1400b2e83
lea r8, str.Registered_for_Session_Notification_n
lea rcx, str.CSynTPEnh::RegisterForSystemNotification
mov edx, 1
call fcn.14011a490
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, edi
lea r11, [rsp + 0x230]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x1400b2eb0
Capabilities:
Get common file path

Disassembly:
push rdi
sub rsp, 0x230
mov rdi, rcx
xor ecx, ecx
call fcn.140116270
cmp eax, 7
jl 0x1400b2fe8
cmp qword [rdi + 0xa18], 0
je 0x1400b2fe8
xor eax, eax
lea rcx, [rsp + 0x22]
xor edx, edx
mov r8d, 0x206
mov qword [rsp + 0x240], rbx
mov word [rsp + 0x20], ax
call fcn.14011fa60
lea rcx, [rsp + 0x20]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea rcx, [rsp + 0x20]
sub rcx, 2
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x1400b2f14
movups xmm0, xmmword [str.WtsApi32.dll]
movsd xmm1, qword [0x1401899a0]
mov eax, dword [0x1401899a8]
movups xmmword [rcx], xmm0
movsd qword [rcx + 0x10], xmm1
mov dword [rcx + 0x18], eax
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
test rax, rax
jne 0x1400b2f86
test byte [0x1402d741c], 1
je 0x1400b2fe0
lea r8, str.Couldnt_get_handle_to_WtsApi32.DLL_n
lea edx, [rax + 1]
lea rcx, str.CSynTPEnh::UnRegisterForSystemNotification
call fcn.14011a490
mov rbx, qword [rsp + 0x240]
add rsp, 0x230
pop rdi
ret
lea rdx, str.WTSUnRegisterSessionNotification
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x1400b2fad
test byte [0x1402d741c], 1
je 0x1400b2fd7
lea r8, str.Couldnt_get_address_of_WTSUnRegisterSessionNotification_n
jmp 0x1400b2fc6
mov rcx, qword [rdi + 0xa18]
call rax
test byte [0x1402d741c], 1
je 0x1400b2fd7
lea r8, str.UnRegistered_for_Session_Notification_n
lea rcx, str.CSynTPEnh::UnRegisterForSystemNotification
mov edx, 1
call fcn.14011a490
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rbx, qword [rsp + 0x240]
add rsp, 0x230
pop rdi
ret
Function at 0x1400b4980
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x80
xor eax, eax
mov rsi, rdx
mov rdi, rcx
mov qword [rcx], rax
mov qword [rsp + 0x90], rax
or rbx, 0xffffffffffffffff
call fcn.14003dfa0
cmp word [rax], 0
je 0x1400b4a10
xor eax, eax
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x40], 0x38
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
call fcn.14003dfa0
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x48], rax
call qword [sym.imp.KERNEL32.dll_CreateActCtxW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400b4a10
lea rdx, [rsp + 0x90]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov eax, dword [0x1402de1dc]
test al, 1
jne 0x1400b4a31
or eax, 1
mov dword [0x1402de1dc], eax
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x1402de1d8], eax
jmp 0x1400b4a37
mov eax, dword [0x1402de1d8]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
jne 0x1400b4a5d
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
mov ecx, dword [0x1402de1d8]
mov edx, 1
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea rdx, [rsp + 0x30]
mov rcx, rsi
call qword [sym.imp.ole32.dll_CLSIDFromProgID]
test eax, eax
js 0x1400b4a8c
xor edx, edx
lea r9, str.c_a2A
lea rcx, [rsp + 0x30]
lea r8d, [rdx + 0x15]
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov rdx, qword [rsp + 0x90]
test rdx, rdx
je 0x1400b4aa1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
cmp rbx, 0xffffffffffffffff
je 0x1400b4ab0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReleaseActCtx]
lea r11, [rsp + 0x80]
mov rax, rdi
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1400b8ff0
Capabilities:
Accept command line arguments

Disassembly:
mov qword [0x1402dc818], rcx
mov qword [0x1402dc820], rdx
lea rcx, [0x1402dc7b0]
mov edx, r9d
mov qword [0x1402dc828], r8
mov dword [0x1402dc830], r9d
jmp 0x1400b8ff0
push rbx
sub rsp, 0x30
cmp byte [0x1402de189], 0
mov rbx, rcx
je 0x1400b900b
or eax, 0xffffffff
add rsp, 0x30
pop rbx
ret
xor ecx, ecx
mov qword [rsp + 0x40], rdi
call qword [sym.imp.ole32.dll_CoInitialize]
mov edi, eax
mov dword [rsp + 0x50], eax
test eax, eax
jns 0x1400b9048
cmp eax, 0x80010106
jne 0x1400b90a4
lea rcx, str.Mscoree.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
jne 0x1400b904c
mov eax, edi
mov rdi, qword [rsp + 0x40]
add rsp, 0x30
pop rbx
ret
mov byte [rbx + 0x62], 1
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea r8, [rsp + 0x50]
mov rcx, rbx
mov rdx, rax
call fcn.1400b74c0
cmp al, 1
jne 0x1400b9094
mov eax, dword [rbx + 0x80]
mov r9, qword [rbx + 0x78]
mov r8, qword [rbx + 0x70]
mov rdx, qword [rbx + 0x68]
lea rcx, [0x1402dc840]
mov dword [rsp + 0x20], eax
call fcn.1400ad570
mov rcx, rbx
call fcn.1400b79a0
mov edi, eax
jmp 0x1400b9098
mov edi, dword [rsp + 0x50]
cmp byte [rbx + 0x62], 0
je 0x1400b90a4
call qword [sym.imp.ole32.dll_CoUninitialize]
mov eax, edi
mov rdi, qword [rsp + 0x40]
add rsp, 0x30
pop rbx
ret

Function at 0x1400c2800
Capabilities:
Find taskbar

Disassembly:
sub rsp, 0x28
lea rcx, str.Shell_TrayWnd
xor edx, edx
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
je 0x1400c287b
lea r8, str.TrayNotifyWnd
xor r9d, r9d
xor edx, edx
mov rcx, rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.USER32.dll_FindWindowExW]
mov rbx, rax
test rax, rax
je 0x1400c2876
lea r8, str.SysPager
xor r9d, r9d
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_FindWindowExW]
xor r9d, r9d
xor edx, edx
lea r8, str.ToolbarWindow32
mov rcx, rax
test rax, rax
jne 0x1400c2866
mov rcx, rbx
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
jmp qword [sym.imp.USER32.dll_FindWindowExW]
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret

Function at 0x1400c2b80
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov ecx, 2
mov edi, r8d
call qword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
test eax, eax
jne 0x1400c2c01
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x1400c2c01
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x5b4
je 0x1400c2c01
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x80004005
je 0x1400c2c01
cmp dword [rbx + 0x868], 0
je 0x1400c2bf4
inc dword [rbx + 0x86c]
cmp dword [rbx + 0x86c], 0xa
jb 0x1400c2bf4
mov rcx, qword [0x1402dd258]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x47c
call qword [sym.imp.USER32.dll_PostMessageW]
mov eax, edi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret