joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001ebc0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x140136e20]
xor rax, rsp
mov qword [rsp + 0x58], rax
movsx eax, dx
shr rdx, 0x10
mov rdi, rcx
mov rcx, qword [rcx + 0x10]
movsx ebx, dx
lea rdx, [rsp + 0x38]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x34], ebx
call qword [sym.imp.USER32.dll_GetClientRect]
mov r11d, dword [rsp + 0x3c]
add r11d, 5
cmp ebx, r11d
jg 0x14001ec3f
mov edx, 0x7f85
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorW]
mov rcx, rax
call qword [sym.imp.USER32.dll_SetCursor]
mov rcx, qword [rdi + 0x10]
mov dword [rdi + 0x250], 1
call qword [sym.imp.USER32.dll_SetFocus]
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.USER32.dll_SetCapture]
cmp dword [rdi + 0x298], 0
je 0x14001eccd
mov ecx, dword [rdi + 0x260]
mov edx, dword [rdi + 0x2a4]
mov eax, dword [rdi + 0x25c]
add ecx, 0xa
lea r9d, [rdx + rax]
mov r8d, 0xa
mov dword [rsp + 0x20], ecx
lea rcx, [rsp + 0x48]
call qword [sym.imp.USER32.dll_SetRect]
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x48]
call qword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x14001eccd
mov edx, 0x7f89
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorW]
mov rcx, rax
call qword [sym.imp.USER32.dll_SetCursor]
mov rcx, qword [rdi + 0x10]
lea r8, [rdi + 0x48]
lea rdx, str.open
xor r9d, r9d
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14004ae00
mov rbx, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret

Function at 0x14001f310
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x320
mov rax, qword [0x140136e20]
xor rax, rsp
mov qword [rsp + 0x310], rax
lea rdx, [rsp + 0x30]
mov rsi, rcx
call qword [sym.imp.USER32.dll_GetClientRect]
lea rdx, [rsp + 0x40]
mov rcx, rsi
call qword [sym.imp.USER32.dll_BeginPaint]
xor r9d, r9d
lea r8, [rsp + 0x90]
lea ecx, [r9 + 0x29]
mov edx, 0x1f4
mov dword [rsp + 0x90], 0x1f4
mov rdi, rax
call qword [sym.imp.USER32.dll_SystemParametersInfoW]
lea rcx, [rsp + 0x10c]
mov dword [rsp + 0x11c], SetWindowSubclass
call qword [sym.imp.GDI32.dll_CreateFontIndirectW]
mov rcx, rdi
mov rdx, rax
mov rbx, rax
call qword [sym.imp.GDI32.dll_SelectObject]
lea rdx, [rsp + 0x290]
mov r8d, 0x40
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov edx, 1
mov rcx, rdi
call qword [sym.imp.GDI32.dll_SetBkMode]
lea rcx, [rsp + 0x290]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov edx, 5
lea r9, [rsp + 0x290]
lea r8d, [rdx - 3]
mov rcx, rdi
mov dword [rsp + 0x20], eax
call qword [sym.imp.GDI32.dll_TextOutW]
mov rcx, rbx
call qword [sym.imp.GDI32.dll_DeleteObject]
lea rdx, [rsp + 0x40]
mov rcx, rsi
call qword [sym.imp.USER32.dll_EndPaint]
mov rcx, qword [rsp + 0x310]
xor rcx, rsp
call fcn.14004ae00
lea r11, [rsp + 0x320]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x14001f590
Capabilities:
Create thread
Get file system object information

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
sub rsp, 0x330
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov rax, qword [0x140136e20]
xor rax, rsp
mov qword [rsp + 0x320], rax
mov rsi, r9
mov rbp, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x38], rcx
lea rax, vtable.CMyTreeView.0
mov qword [rcx], rax
lea rax, vtable.CMyTreeView.1.0
mov qword [rcx + 8], rax
add rcx, 0x2c0
call fcn.140022910
nop
lea rcx, [rdi + 0x2d8]
call fcn.140022910
nop
xor r12d, r12d
mov qword [rdi + 0x528], r12
mov ecx, 0x228
call fcn.14004b164
test rax, rax
je 0x14001f7a0
mov qword [rdi + 0x520], rax
mov qword [rax], rax
mov rax, qword [rdi + 0x520]
mov qword [rax + 8], rax
mov qword [rdi + 0x18], rbx
mov qword [rdi + 0x20], rbp
mov r9, rdi
xor r8d, r8d
lea rdx, [0x14001f920]
mov rcx, rbx
call qword [sym.imp.COMCTL32.dll_SetWindowSubclass]
lea rcx, [rdi + 0x2f0]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [rdi + 0x248]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [0x1401495e8]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov r11, qword [rsp + 0x370]
mov qword [rdi + 0x270], r11
mov qword [rdi + 0x30], rsi
mov ecx, 0x190
call fcn.14004af90
mov rbx, rax
mov qword [rdi + 0x278], rax
mov ecx, 0x640
call fcn.14004af90
mov qword [rdi + 0x280], rax
mov dword [rdi + 0x288], 0x64
xor edx, edx
mov r8d, 0x190
mov rcx, rbx
call fcn.140051eb0
mov dword [rsp + 0x20], 0x4010
mov r9d, 0x2b8
lea r8, [rsp + 0x60]
mov edx, 0x90
lea rcx, [0x140104118]
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov r11d, dword [rsp + 0x68]
mov dword [rdi + 0x28c], r11d
mov rcx, rdi
call fcn.14001fc40
mov qword [rdi + 0x2a8], r12
mov dword [rdi + 0x2b0], r12d
mov dword [rdi + 0x244], 1
lea rbx, [rdi + 0x290]
mov qword [rsp + 0x20], rbx
lea r9, [0x1400fa280]
xor edx, edx
lea r8d, [r12 + 1]
lea rcx, [0x1400fa250]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x14001f769
mov rcx, qword [rbx]
mov rax, qword [rcx]
lea r8, [rdi + 0x298]
lea rdx, [0x1400fa270]
call qword [rax]
mov rdx, rdi
mov rcx, qword [rdi + 0x18]
call qword [sym.imp.ole32.dll_RegisterDragDrop]
mov dword [rdi + 0x538], r12d
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], r12d
mov r9, rdi
lea r8, [0x140022110]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rdi + 0x10], r12d
mov rax, rdi
jmp 0x14001f7d2
mov qword [rsp + 0x30], r12
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x40]
call fcn.14004b2d4
lea r11, vtable.std::bad_alloc.0
mov qword [rsp + 0x40], r11
lea rdx, [0x140132320]
lea rcx, [rsp + 0x40]
call fcn.14004d894
nop
mov rcx, qword [rsp + 0x320]
xor rcx, rsp
call fcn.14004ae00
lea r11, [rsp + 0x330]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
Function at 0x14001fc40
Capabilities:
Get common file path
Get file system object information

Disassembly:
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x6f0]
sub rsp, 0x7f0
mov rax, qword [0x140136e20]
xor rax, rsp
mov qword [rbp + 0x6e0], rax
mov rdi, rcx
mov rcx, qword [rcx + 0x18]
xor esi, esi
mov r9, 0xffffffffffff0000
xor r8d, r8d
mov edx, 0x1101
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x30], rsi
call qword [sym.imp.USER32.dll_SendMessageW]
lea r11, [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], r11
call qword [sym.imp.SHELL32.dll_SHGetFolderLocation]
test eax, eax
js 0x14001fe46
lea rdx, [rbp + 0x4d0]
xor ecx, ecx
mov qword [rsp + 0x808], rbx
call fcn.140092e10
lea rdx, [rsp + 0x38]
lea rcx, [rbp + 0x4d0]
mov qword [rsp + 0x38], rsi
call fcn.140094590
test eax, eax
js 0x14001fcfa
mov rcx, qword [rsp + 0x38]
lea r8d, [rsi + 1]
lea rdx, [rbp + 0x2c0]
call fcn.140092ff0
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [rsp + 0x30]
lea r8, [rbp]
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], 0x4008
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov rcx, rdi
call fcn.140020ab0
mov rcx, qword [rsp + 0x30]
movsxd rbx, eax
call qword [sym.imp.SHELL32.dll_ILClone]
mov rcx, qword [rdi + 0x280]
mov rdx, rbx
mov dword [rsp + 0x50], 0x67
add rdx, rdx
mov qword [rcx + rdx*8], rax
mov rax, qword [rdi + 0x278]
lea rcx, [rbp + 0x2c0]
mov dword [rax + rbx*4], 1
lea rax, [rbp + 0x2c0]
mov qword [rsp + 0x68], rax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rdi + 0x18]
movaps xmm0, xmmword [rsp + 0x50]
movaps xmm1, xmmword [rsp + 0x60]
mov dword [rsp + 0x70], eax
mov eax, dword [rbp + 8]
mov dword [rsp + 0x7c], 1
movaps xmmword [rbp - 0x50], xmm0
movaps xmmword [rbp - 0x40], xmm1
mov dword [rsp + 0x74], eax
mov dword [rsp + 0x78], eax
mov qword [rbp - 0x80], rbx
movaps xmm0, xmmword [rsp + 0x70]
movaps xmm1, xmmword [rbp - 0x80]
lea r9, [rbp - 0x60]
xor r8d, r8d
mov edx, 0x1132
movaps xmmword [rbp - 0x30], xmm0
movaps xmm0, xmmword [rbp - 0x70]
movaps xmmword [rbp - 0x20], xmm1
mov qword [rbp - 0x60], rsi
mov qword [rbp - 0x58], 0xffffffffffff0002
movaps xmmword [rbp - 0x10], xmm0
call qword [sym.imp.USER32.dll_SendMessageW]
mov rbx, rax
test rax, rax
je 0x14001fe2e
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHELL32.dll_SHGetDesktopFolder]
test eax, eax
js 0x14001fe2e
mov r8, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x40]
mov r9, rbx
mov rcx, rdi
call fcn.140020450
mov rcx, qword [rdi + 0x18]
mov r9, rbx
mov edx, 0x1102
mov r8d, 2
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
call qword [rax + reloc.SHELL32.dll_ILFindLastID]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rax, rbx
mov rbx, qword [rsp + 0x808]
jmp 0x14001fe49
mov rax, rsi
mov rcx, qword [rbp + 0x6e0]
xor rcx, rsp
call fcn.14004ae00
lea r11, [rsp + 0x7f0]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x140020df0
Capabilities:
Get file attributes

Disassembly:
push rbx
push rdi
push r12
push r13
push r14
sub rsp, 0x3c0
mov rax, qword [0x140136e20]
xor rax, rsp
mov qword [rsp + 0x3a0], rax
mov r12, rcx
xor r14d, r14d
mov rcx, r8
mov r13, r8
mov rdi, rdx
mov ebx, r14d
call qword [sym.imp.SHLWAPI.dll_PathIsRootW]
test eax, eax
je 0x140020e41
mov r8, r13
mov rdx, rdi
mov rcx, r12
call fcn.140021000
jmp 0x140020fd1
mov rcx, qword [r12 + 0x18]
mov r9, rdi
mov edx, 0x110a
mov r8d, 4
mov qword [rsp + 0x3b8], rbp
mov qword [rsp + 0x3b0], rsi
call qword [sym.imp.USER32.dll_SendMessageW]
mov rsi, rax
test rax, rax
jne 0x140020e7e
mov rax, 0xffffffffffff0001
jmp 0x140020fc1
mov rbp, 0xffffffffffff0001
nop word [rax + rax]
mov rcx, qword [r12 + 0x18]
lea r9, [rsp + 0x30]
xor r8d, r8d
mov edx, 0x113e
mov dword [rsp + 0x30], ILCombine
mov qword [rsp + 0x38], rsi
call qword [sym.imp.USER32.dll_SendMessageW]
movsxd r11, dword [rsp + 0x60]
mov rax, qword [r12 + 0x280]
add r11, r11
mov rdi, qword [rax + r11*8]
test rdi, rdi
je 0x140020f42
lea r9, [rsp + 0x28]
lea r8, [rsp + 0x20]
lea rdx, [0x1400fa1e0]
mov rcx, rdi
mov qword [rsp + 0x20], r14
mov qword [rsp + 0x28], r14
call qword [sym.imp.SHELL32.dll_SHBindToParent]
test eax, eax
js 0x140020f42
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
lea r9, [rsp + 0x80]
mov rax, qword [rcx]
mov r8d, 0x8000
call qword [rax + 0x58]
test eax, eax
js 0x140020f37
lea r8, [rsp + 0x190]
lea rcx, [rsp + 0x80]
mov r9d, 0x104
mov rdx, rdi
call qword [sym.imp.SHLWAPI.dll_StrRetToBufW]
mov rcx, qword [rsp + 0x20]
mov rax, qword [rcx]
call qword [rax + reloc.SHELL32.dll_ILFindLastID]
lea rcx, [rsp + 0x190]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea rcx, [rsp + 0x190]
mov edi, eax
call qword [sym.imp.SHLWAPI.dll_PathIsRootW]
test eax, eax
jne 0x140020f81
bt edi, 0x1e
jb 0x140020f81
lea rdx, [rsp + 0x190]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
cmovs rbx, rbp
mov rcx, qword [r12 + 0x18]
mov r9, rsi
mov edx, 0x110a
mov r8d, 1
mov rbp, rsi
call qword [sym.imp.USER32.dll_SendMessageW]
mov rsi, rax
test rax, rax
je 0x140020fb0
test rbx, rbx
je 0x140020e90
jmp 0x140020fbe
mov rax, 0xffffffffffff0002
test rbx, rbx
cmove rbx, rax
mov rax, rbx
mov rbp, qword [rsp + 0x3b8]
mov rsi, qword [rsp + 0x3b0]
mov rcx, qword [rsp + 0x3a0]
xor rcx, rsp
call fcn.14004ae00
add rsp, 0x3c0
pop r14
pop r13
pop r12
pop rdi
pop rbx
ret
Function at 0x140021a30
Capabilities:
Get common file path

Disassembly:
push rbx
push rsi
push r12
sub rsp, 0x6d0
mov rax, qword [0x140136e20]
xor rax, rsp
mov qword [rsp + 0x6c0], rax
mov rsi, rcx
xor r12d, r12d
mov rcx, rdx
mov qword [rsp + 0x30], r12
mov rbx, rdx
call fcn.140022890
test eax, eax
jne 0x140021a6f
xor eax, eax
jmp 0x140021c47
lea rax, [rsp + 0x90]
mov r8, rbx
mov qword [rsp + 0x700], rbp
mov qword [rsp + 0x708], rdi
mov edx, 0x104
lea rcx, [rsp + 0x90]
sub r8, rax
nop word [rax + rax]
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x140021ac4
movzx eax, word [r8 + rcx]
test ax, ax
je 0x140021ac4
mov word [rcx], ax
add rcx, 2
dec rdx
jne 0x140021aa0
jmp 0x140021ac9
test rdx, rdx
jne 0x140021acd
sub rcx, 2
lea rax, [rsp + 0x2a0]
mov word [rcx], r12w
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, rbx
movsxd rdx, eax
lea rdi, [rsp + rdx*2 + 0x90]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rcx, [rsp + 0x2a0]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
cmp ebx, eax
jle 0x140021b28
add rdi, 2
lea r8, [rsp + 0x30]
lea rdx, [0x14010fe10]
mov rcx, rdi
mov qword [rsp + 0x30], r12
call fcn.14004c09c
mov rcx, qword [rsi + 0x18]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x110a
mov rbp, rax
call qword [sym.imp.USER32.dll_SendMessageW]
mov rbx, rax
test rbp, rbp
je 0x140021c34
nop word [rax + rax]
mov rcx, qword [rsi + 0x18]
mov r9, rbx
mov edx, 0x110a
mov r8d, 4
call qword [sym.imp.USER32.dll_SendMessageW]
mov edi, r12d
mov rbx, rax
test rax, rax
je 0x140021c63
test edi, edi
jne 0x140021c12
mov rcx, qword [rsi + 0x18]
lea rax, [rsp + 0x4b0]
lea r9, [rsp + 0x40]
xor r8d, r8d
mov edx, 0x113e
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x40], 1
mov qword [rsp + 0x48], rbx
mov dword [rsp + 0x60], 0x104
call qword [sym.imp.USER32.dll_SendMessageW]
lea rcx, [rsp + 0x4b0]
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x140021bee
lea edi, [rax + 1]
jmp 0x140021c09
mov rcx, qword [rsi + 0x18]
mov r9, rbx
mov edx, 0x110a
mov r8d, 1
call qword [sym.imp.USER32.dll_SendMessageW]
mov rbx, rax
test rbx, rbx
jne 0x140021b97
test edi, edi
je 0x140021c63
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x30]
lea rdx, [0x14010fe10]
call fcn.14004c09c
mov rbp, rax
test rax, rax
jne 0x140021b70
mov rax, rbx
mov rbp, qword [rsp + 0x700]
mov rdi, qword [rsp + 0x708]
mov rcx, qword [rsp + 0x6c0]
xor rcx, rsp
call fcn.14004ae00
add rsp, 0x6d0
pop r12
pop rsi
pop rbx
ret
xor eax, eax
jmp 0x140021c37
Function at 0x1400221b0
Capabilities:
Get disk information

Disassembly:
push rsi
push rdi
sub rsp, 0x2c8
mov rax, qword [0x140136e20]
xor rax, rsp
mov qword [rsp + 0x2a0], rax
mov rsi, rcx
mov rcx, rdx
mov rdi, rdx
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 4
je 0x1400223ca
mov qword [rsp + 0x2c0], rbp
mov qword [rsp + 0x2b0], r13
xor r13d, r13d
mov qword [rsp + 0x30], r13
lea edx, [r13 + 1]
lea r8d, [r13 + 7]
xor r9d, r9d
mov rcx, rdi
mov dword [rsp + 0x28], 0x42000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x1400223ba
mov ecx, 0x210
mov qword [rsp + 0x2f0], rbx
mov qword [rsp + 0x2b8], r12
call fcn.14004af90
mov ebx, 0x104
mov r9, rdi
mov r11, rax
mov rdx, rax
sub r9, rax
mov r8d, ebx
nop dword [rax + rax]
lea rcx, [r8 + 0x7ffffefa]
test rcx, rcx
je 0x140022284
movzx ecx, word [r9 + rdx]
test cx, cx
je 0x140022284
mov word [rdx], cx
add rdx, 2
dec r8
jne 0x140022260
jmp 0x140022289
test r8, r8
jne 0x14002228d
sub rdx, 2
mov word [rdx], r13w
mov qword [rax + 0x208], rsi
mov rcx, qword [rsi + 0x30]
mov rax, qword [rcx]
mov qword [rsp + 0x30], r11
lea rdx, [0x140023790]
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], rdx
mov r9d, 2
mov r8, rdi
mov rdx, rbp
call qword [rax + ILCombine]
mov rcx, qword [rsi + 0x18]
lea rdx, [rsp + 0x40]
xor r8d, r8d
mov r12d, eax
mov dword [rsp + 0x40], 0x38
mov dword [rsp + 0x44], 6
mov qword [rsp + 0x50], rbp
call qword [sym.imp.USER32.dll_RegisterDeviceNotificationW]
test rax, rax
je 0x1400223aa
lea rax, [rsp + 0x80]
lea rcx, [rsp + 0x80]
sub rdi, rax
nop dword [rax]
lea rax, [rbx + 0x7ffffefa]
test rax, rax
je 0x140022333
movzx eax, word [rdi + rcx]
test ax, ax
je 0x140022333
mov word [rcx], ax
add rcx, 2
dec rbx
jne 0x140022310
jmp 0x140022338
test rbx, rbx
jne 0x14002233c
sub rcx, 2
mov rbx, qword [rsi + 0x520]
mov word [rcx], r13w
lea r8, [rsp + 0x80]
mov rdx, qword [rbx + 8]
mov rcx, rbx
mov qword [rsp + 0x288], rbp
mov dword [rsp + 0x290], r12d
call fcn.140022ac0
movabs rcx, 0x7a44c6afc2dd9b
mov r11, rax
mov rax, qword [rsi + 0x528]
sub rcx, rax
cmp rcx, 1
jae 0x140022395
lea rcx, str.list_T__too_long
call fcn.14002ba2c
int3
inc rax
mov qword [rsi + 0x528], rax
mov qword [rbx + 8], r11
mov rax, qword [r11 + 8]
mov qword [rax], r11
mov r12, qword [rsp + 0x2b8]
mov rbx, qword [rsp + 0x2f0]
mov rbp, qword [rsp + 0x2c0]
mov r13, qword [rsp + 0x2b0]
mov rcx, qword [rsp + 0x2a0]
xor rcx, rsp
call fcn.14004ae00
add rsp, 0x2c8
pop rdi
pop rsi
ret
Function at 0x140022440
Capabilities:
Get file system object information

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x350
mov rax, qword [0x140136e20]
xor rax, rsp
mov qword [rsp + 0x340], rax
mov rdi, rcx
mov rcx, qword [rcx + 0x18]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x110a
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rdi + 0x18]
lea r9, [rsp + 0x30]
xor r8d, r8d
mov edx, 0x113e
mov rbx, rax
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], ILCombine
call qword [sym.imp.USER32.dll_SendMessageW]
movsxd r11, dword [rsp + 0x60]
mov rcx, qword [rdi + 0x280]
lea r8, [rsp + 0x80]
add r11, r11
mov r9d, 0x2b8
xor edx, edx
mov rcx, qword [rcx + r11*8]
mov dword [rsp + 0x20], 0x4008
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov eax, dword [rsp + 0x88]
mov rcx, qword [rdi + 0x18]
lea r9, [rsp + 0x30]
xor r8d, r8d
mov edx, 0x113f
mov dword [rsp + 0x54], eax
mov dword [rsp + 0x58], eax
mov dword [rsp + 0x30], 0x32
mov qword [rsp + 0x38], rbx
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rdi + 0x18]
mov r9, rbx
mov edx, 0x110a
mov r8d, 4
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, rdi
mov rdx, rax
call fcn.140022550
mov rcx, qword [rsp + 0x340]
xor rcx, rsp
call fcn.14004ae00
mov rbx, qword [rsp + 0x368]
add rsp, 0x350
pop rdi
ret
Function at 0x140022550
Capabilities:
Get file system object information

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x340
mov rax, qword [0x140136e20]
xor rax, rsp
mov qword [rsp + 0x330], rax
mov rsi, rcx
mov rcx, qword [rcx + 0x18]
mov rbx, rdx
mov r9, rdx
mov r8d, 1
mov edx, 0x110a
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rsi + 0x18]
lea r9, [rsp + 0x30]
xor r8d, r8d
mov edx, 0x113e
mov rdi, rax
mov dword [rsp + 0x30], ILCombine
mov qword [rsp + 0x38], rbx
call qword [sym.imp.USER32.dll_SendMessageW]
movsxd r10, dword [rsp + 0x60]
mov rcx, qword [rsi + 0x280]
lea r8, [rsp + 0x70]
add r10, r10
mov r9d, 0x2b8
xor edx, edx
mov rcx, qword [rcx + r10*8]
mov dword [rsp + 0x20], 0x4008
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov eax, dword [rsp + 0x78]
mov rcx, qword [rsi + 0x18]
lea r9, [rsp + 0x30]
xor r8d, r8d
mov edx, 0x113f
mov dword [rsp + 0x54], eax
mov dword [rsp + 0x58], eax
mov dword [rsp + 0x30], 0x32
mov qword [rsp + 0x38], rbx
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rsi + 0x18]
mov r9, rbx
mov edx, 0x110a
mov r8d, 4
call qword [sym.imp.USER32.dll_SendMessageW]
test rax, rax
je 0x14002263f
mov rdx, rax
mov rcx, rsi
call fcn.140022550
test rdi, rdi
je 0x14002271e
nop dword [rax + rax]
mov rcx, qword [rsi + 0x18]
lea r9, [rsp + 0x30]
xor r8d, r8d
mov edx, 0x113e
mov dword [rsp + 0x30], ILCombine
mov qword [rsp + 0x38], rdi
call qword [sym.imp.USER32.dll_SendMessageW]
movsxd r11, dword [rsp + 0x60]
mov rcx, qword [rsi + 0x280]
add r11, r11
lea r8, [rsp + 0x70]
mov r9d, 0x2b8
mov rcx, qword [rcx + r11*8]
xor edx, edx
mov dword [rsp + 0x20], 0x4008
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov eax, dword [rsp + 0x78]
mov rcx, qword [rsi + 0x18]
lea r9, [rsp + 0x30]
xor r8d, r8d
mov edx, 0x113f
mov dword [rsp + 0x54], eax
mov dword [rsp + 0x58], eax
mov dword [rsp + 0x30], 0x32
mov qword [rsp + 0x38], rdi
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rsi + 0x18]
mov r9, rdi
mov edx, 0x110a
mov r8d, 4
call qword [sym.imp.USER32.dll_SendMessageW]
test rax, rax
je 0x1400226fa
mov rdx, rax
mov rcx, rsi
call fcn.140022550
mov rcx, qword [rsi + 0x18]
mov r9, rdi
mov edx, 0x110a
mov r8d, 1
call qword [sym.imp.USER32.dll_SendMessageW]
mov rdi, rax
test rax, rax
jne 0x140022650
mov rcx, qword [rsp + 0x330]
xor rcx, rsp
call fcn.14004ae00
lea r11, [rsp + 0x340]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x140022890
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x250
mov rax, qword [0x140136e20]
xor rax, rsp
mov qword [rsp + 0x240], rax
lea rax, [rsp + 0x30]
mov rbx, rcx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rdx, [rsp + 0x30]
mov rcx, rbx
movsxd r8, eax
call fcn.14004c15c
xor ecx, ecx
test eax, eax
sete cl
mov eax, ecx
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.14004ae00
add rsp, 0x250
pop rbx
ret
Function at 0x140023960
Capabilities:
Get common file path

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x260
mov rax, qword [0x140136e20]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rbx, rcx
mov rcx, rdx
mov rdi, rdx
call qword [sym.imp.SHLWAPI.dll_PathIsRootW]
test eax, eax
je 0x1400239ee
xor esi, esi
lea rax, [rsp + 0x30]
xor r9d, r9d
lea edx, [rsi + 0x11]
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderLocation]
test eax, eax
jne 0x140023ac7
mov rdx, qword [rsp + 0x30]
lea r8d, [rsi + 1]
mov rcx, rbx
call fcn.1400213f0
test rax, rax
je 0x1400239de
mov r8, rdi
mov rdx, rax
mov rcx, rbx
call fcn.140023af0
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
jmp 0x140023ac7
lea rax, [rsp + 0x40]
mov r8, rdi
mov qword [rsp + 0x290], rbp
mov edx, 0x104
lea rcx, [rsp + 0x40]
sub r8, rax
nop dword [rax + rax]
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x140023a34
movzx eax, word [r8 + rcx]
test ax, ax
je 0x140023a34
mov word [rcx], ax
add rcx, 2
dec rdx
jne 0x140023a10
jmp 0x140023a39
test rdx, rdx
jne 0x140023a3d
sub rcx, 2
xor esi, esi
mov word [rcx], si
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.140021a30
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x40]
mov rbp, rax
mov qword [rsp + 0x30], rsi
call fcn.140094590
test eax, eax
js 0x140023a99
mov rdx, qword [rsp + 0x30]
lea r8d, [rsi + 1]
mov rcx, rbx
call fcn.1400213f0
mov rcx, qword [rsp + 0x30]
mov rsi, rax
call qword [sym.imp.ole32.dll_CoTaskMemFree]
test rsi, rsi
jne 0x140023a9e
test rbp, rbp
je 0x140023abf
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
call fcn.140023af0
test rbp, rbp
je 0x140023abf
mov r8, rdi
mov rdx, rbp
mov rcx, rbx
call fcn.140023af0
mov rbp, qword [rsp + 0x290]
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.14004ae00
add rsp, 0x260
pop rdi
pop rsi
pop rbx
ret