joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400cf10c
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x1400cf13c
xor eax, eax
jmp 0x1400cf1ff
mov rbp, rbx
cmp word [rax], si
je 0x1400cf161
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x1400cf148
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x1400cf144
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.1400cef8c
movsxd r14, eax
test eax, eax
jne 0x1400cf19f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x1400cf135
mov rcx, r14
call fcn.1400c08f8
mov rdi, rax
test rax, rax
jne 0x1400cf1b8
xor ecx, ecx
call fcn.1400c08bc
jmp 0x1400cf194
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.1400cef8c
test eax, eax
jne 0x1400cf1e9
mov rcx, rdi
call fcn.1400c08bc
jmp 0x1400cf1f3
xor ecx, ecx
call fcn.1400c08bc
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x1400cf21c
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x1400cf2a3
mov rsi, rbx
cmp word [rax], bp
je 0x1400cf262
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x1400cf24c
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x1400cf248
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.1400c08f8
mov rdi, rax
test rax, rax
je 0x1400cf290
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.140062a60
mov rbp, rdi
xor ecx, ecx
call fcn.1400c08bc
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400d3460
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov ebx, ecx
call fcn.1400bffd4
mov ecx, ebx
lea r8, [rsp + 0x30]
and ecx, 0x3ff
mov r9d, 2
bts ecx, 0xa
mov edx, 0x20000001
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor edx, edx
test eax, eax
je 0x1400d3501
cmp ebx, dword [rsp + 0x30]
je 0x1400d34fa
test esi, esi
je 0x1400d34fa
mov r10, qword [rdi + 0x98]
mov r9d, edx
movzx r8d, word [r10]
lea rcx, [r10 + 2]
lea eax, [r8 - 0x41]
cmp ax, 0x19
jbe 0x1400d34d5
sub r8w, 0x61
cmp r8w, 0x19
ja 0x1400d34e2
movzx r8d, word [rcx]
inc r9d
add rcx, 2
jmp 0x1400d34bf
or rax, 0xffffffffffffffff
inc rax
cmp word [r10 + rax*2], dx
jne 0x1400d34e6
cmp r9d, eax
setne dl
mov eax, edx
jmp 0x1400d3503
mov eax, 1
jmp 0x1400d3503
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400dc31c
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.1400710fc
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x1400dc3a6
cmp byte [rbp - 0x21], r15b
je 0x1400dc3a1
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x1400dc3dc
call fcn.1400c35c4
test eax, eax
jne 0x1400dc3c8
cmp byte [rbp - 0x21], r15b
je 0x1400dc3c0
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x1400dc3dc
cmp byte [rbp - 0x21], r15b
je 0x1400dc3d9
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.1400ac094
test eax, eax
jne 0x1400dc47c
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.1400710fc
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x1400dc41b
cmp byte [rbp - 0x21], r15b
je 0x1400dc450
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x1400dc450
call fcn.1400c35c4
test eax, eax
jne 0x1400dc43c
cmp byte [rbp - 0x21], r15b
je 0x1400dc435
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x1400dc450
cmp byte [rbp - 0x21], r15b
je 0x1400dc44d
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.1400ac094
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x1400dc47c
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x1400dc47f
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x1400dc48d
mov rcx, rdi
call fcn.1400c08bc
cmp byte [rbp + 0x3f], r15b
je 0x1400dc49c
mov rcx, qword [rbp + 0x27]
call fcn.1400c08bc
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x1400ddd30
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.1400c7adc
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.1400c7adc
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x1400dde80
cmp rax, 0xffffffffffffffff
je 0x1400dde80
xor edi, edi
test rbp, rbp
jle 0x1400dde2b
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.1400c2854
mov rbx, rax
test rax, rax
jne 0x1400dddb8
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x1400dde21
mov edx, 0x8000
mov ecx, r14d
call fcn.1400ac79c
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.1400c93a4
cmp eax, 0xffffffff
je 0x1400dde01
cdqe
sub rbp, rax
test rbp, rbp
jg 0x1400dddc8
mov edx, r15d
mov ecx, r14d
call fcn.1400ac79c
jmp 0x1400dde21
cmp byte [rsi + 0x38], dil
je 0x1400dde18
cmp dword [rsi + 0x34], 5
jne 0x1400dde18
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x1400dde21
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.1400c08bc
jmp 0x1400dde94
jns 0x1400dde94
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.1400c7adc
cmp rax, 0xffffffffffffffff
jne 0x1400dde4c
cmp byte [rsi + 0x30], dil
je 0x1400dde94
mov edi, dword [rsi + 0x2c]
jmp 0x1400dde94
mov ecx, r14d
call fcn.1400ca2d8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1400dde94
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x1400dde94
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x1400dde8d
mov eax, dword [rsi + 0x2c]
jmp 0x1400dde92
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.1400c7adc
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x1400df548
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
movsxd r8, dword [0x14000003c]
lea rsi, [0x140000000]
add r8, rsi
mov rbx, rdx
mov rdi, rcx
cmp dword [r8 + 0x84], 0xd
jbe 0x1400df5c0
mov r10d, dword [r8 + 0xf0]
xor r9d, r9d
test r10d, r10d
je 0x1400df5c0
movzx ecx, word [r8 + 0x14]
movzx r11d, word [r8 + 6]
add rcx, 0x18
mov r10d, dword [r10 + rsi + 0xc]
add rcx, r8
test r11d, r11d
je 0x1400df5c0
mov eax, dword [rcx + 0xc]
cmp r10d, eax
jb 0x1400df5b4
mov edx, dword [rcx + 8]
add eax, edx
cmp r10d, eax
jb 0x1400df5d2
inc r9d
add rcx, 0x28
cmp r9d, r11d
jb 0x1400df5a2
xor eax, eax
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
mov dword [rdi], edx
mov eax, dword [rcx + 0x24]
mov dword [rbx], eax
mov eax, dword [rcx + 0xc]
add rax, rsi
jmp 0x1400df5c2
Function at 0x1400e5830
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400e5858
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1400e5858
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x1400032d8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140003322
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140003322
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140003322
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140003322
cmp dword [rcx + 0x84], 0xe
jbe 0x140003322
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140003324
xor al, al
add rsp, 0x28
ret

Function at 0x140001b68
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001bb2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001bb2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001bb2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001bb2
cmp dword [rcx + 0x84], 0xe
jbe 0x140001bb2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001bb4
xor al, al
add rsp, 0x28
ret
Function at 0x140001c20
Capabilities:
Get file version info

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
mov eax, 0xfa60
call fcn.14000e550
sub rsp, rax
mov rax, qword [0x140019030]
xor rax, rsp
mov qword [rsp + 0xfa50], rax
mov rdi, rdx
mov rbx, rcx
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], 0
call qword [sym.imp.mfc140u.dll_Ordinal_296]
mov dword [rsp + 0x30], 1
lea rdx, [rsp + 0x48]
mov rcx, rdi
call qword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
lea rdx, [rsp + 0x48]
mov rcx, rdi
call qword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
test eax, eax
je 0x140001ce9
lea r9, [rsp + 0x50]
xor edx, edx
mov r8d, 0xfa00
mov rcx, rdi
call qword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x140001ce9
lea r9, [rsp + 0x4c]
lea r8, [rsp + 0x40]
lea rdx, [0x140011970]
lea rcx, [rsp + 0x50]
call qword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x140001ce9
mov rcx, qword [rsp + 0x40]
mov r8d, dword [rcx + 0x10]
movzx edx, word [rcx + 0x16]
movzx r9d, r8w
shr r8d, 0x10
mov dword [rsp + 0x20], edx
lea rdx, str._d._d_d
mov rcx, rbx
call qword [sym.imp.mfc140u.dll_CMFCZoomKernel::Filter]
mov rax, rbx
mov rcx, qword [rsp + 0xfa50]
xor rcx, rsp
call fcn.14000dba0
mov rbx, qword [rsp + 0xfa80]
add rsp, 0xfa60
pop rdi
ret

Function at 0x140002980
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x20
cmp word [rcx], 0
mov rbx, rcx
je 0x140002a8f
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400029a0
cmp eax, 0x104
jge 0x140002a8f
mov edx, 0x2a
call qword [sym.imp.VCRUNTIME140.dll_wcschr]
test rax, rax
jne 0x140002a8f
lea edx, [rax + 0x3f]
mov rcx, rbx
call qword [sym.imp.VCRUNTIME140.dll_wcschr]
test rax, rax
jne 0x140002a8f
lea edx, [rax + 0x3c]
mov rcx, rbx
call qword [sym.imp.VCRUNTIME140.dll_wcschr]
test rax, rax
jne 0x140002a8f
lea edx, [rax + 0x3e]
mov rcx, rbx
call qword [sym.imp.VCRUNTIME140.dll_wcschr]
test rax, rax
jne 0x140002a8f
lea edx, [rax + 0x7c]
mov rcx, rbx
call qword [sym.imp.VCRUNTIME140.dll_wcschr]
test rax, rax
jne 0x140002a8f
lea edx, [rax + 0x22]
mov rcx, rbx
call qword [sym.imp.VCRUNTIME140.dll_wcschr]
test rax, rax
jne 0x140002a8f
lea edx, [rax + 0x3a]
mov rcx, rbx
call qword [sym.imp.VCRUNTIME140.dll_wcschr]
test rax, rax
je 0x140002a5b
mov rcx, rax
sub rcx, rbx
sar rcx, 1
cmp ecx, 1
jne 0x140002a8f
lea edx, [rcx + 0x39]
lea rcx, [rax + 2]
call qword [sym.imp.VCRUNTIME140.dll_wcschr]
test rax, rax
jne 0x140002a8f
lea rcx, [rbx + 2]
lea rdx, [0x1400119f4]
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
test rax, rax
jne 0x140002a8f
cmp word [rbx], ax
je 0x140002a8f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140002a8f
shr eax, 4
and al, 1
add rsp, 0x20
pop rbx
ret
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x140002ad0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x140019030]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbx, rcx
mov rcx, qword [rcx]
cmp rcx, 0xffffffffffffffff
je 0x140002c53
mov r9d, 1
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
test eax, eax
jne 0x140002c53
mov rcx, qword [rbx]
cmp rcx, 0xffffffffffffffff
je 0x140002c53
xor edi, edi
lea r9, [rsp + 0x30]
lea r8d, [rax + 2]
mov dword [rsp + 0x30], edi
lea rdx, [rsp + 0x38]
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [rsp + 0x30], 2
jne 0x140002c3c
movzx eax, word [rsp + 0x38]
mov ebp, 0xfeff
cmp ax, bp
jne 0x140002b70
mov dword [rbx + 0x10], 3
mov al, 1
jmp 0x140002c55
mov esi, 0xfffe
cmp ax, si
jne 0x140002b88
mov dword [rbx + 0x10], 4
mov al, 1
jmp 0x140002c55
mov ecx, 0xbbef
cmp ax, cx
jne 0x140002bd7
mov rcx, qword [rbx]
cmp rcx, 0xffffffffffffffff
je 0x140002c53
lea r9, [rsp + 0x30]
mov dword [rsp + 0x30], edi
mov r8d, 1
mov qword [rsp + 0x20], rdi
lea rdx, [rsp + 0x34]
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [rsp + 0x30], 1
jne 0x140002c3c
cmp byte [rsp + 0x34], 0xbf
jne 0x140002c3c
mov dword [rbx + 0x10], 2
mov al, 1
jmp 0x140002c55
test ax, ax
jne 0x140002c3c
mov rcx, qword [rbx]
cmp rcx, 0xffffffffffffffff
je 0x140002c53
lea r9, [rsp + 0x30]
mov dword [rsp + 0x30], edi
mov r8d, 2
mov qword [rsp + 0x20], rdi
lea rdx, [rsp + 0x3c]
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [rsp + 0x30], 2
jne 0x140002c3c
movzx eax, word [rsp + 0x38]
test ax, ax
jne 0x140002c26
cmp dword [rsp + 0x3c], esi
jne 0x140002c3c
mov dword [rbx + 0x10], 6
mov al, 1
jmp 0x140002c55
cmp ax, bp
jne 0x140002c3c
cmp dword [rsp + 0x3c], edi
jne 0x140002c3c
mov dword [rbx + 0x10], 5
mov al, 1
jmp 0x140002c55
mov rcx, qword [rbx]
cmp rcx, 0xffffffffffffffff
je 0x140002c53
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
xor al, al
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14000dba0
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x140004990
Capabilities:
Create process on windows

Disassembly:
push rbx
sub rsp, 0x8a0
mov rax, qword [0x140019030]
xor rax, rsp
mov qword [rsp + 0x890], rax
mov r9d, 2
mov rbx, rcx
mov rcx, qword [rcx + 0x998]
mov edx, 0x100c
lea r8, [r9 - 3]
call qword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0xffffffff
je 0x140004a49
lea rcx, [rbx + 0x958]
mov edx, eax
call qword [sym.imp.mfc140u.dll_CPaneContainerManager::GetFirstPane]
lea rcx, [rsp + 0x90]
mov r8, qword [rax]
mov rdx, qword [rax + 8]
call fcn.1400023a0
mov rax, qword [rbx + 0x40]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x28], rax
xorps xmm0, xmm0
lea rax, [0x140011ab8]
mov dword [rsp + 0x20], 0x70
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x24], 0xc
movdqa xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x60], 0
mov dword [rsp + 0x50], 5
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov rcx, qword [rsp + 0x890]
xor rcx, rsp
call fcn.14000dba0
add rsp, 0x8a0
pop rbx
ret
Function at 0x14000a6e0
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
mov eax, reloc.mfc140u.dll_CPaneDivider::FindPaneContainer
call fcn.14000e550
sub rsp, rax
mov rax, qword [0x140019030]
xor rax, rsp
mov qword [rsp + 0x1280], rax
mov rdi, r9
movzx r14d, r8b
mov rbp, rdx
mov rsi, rcx
mov r8, rdx
mov rdx, rcx
lea rcx, [rsp + 0x30]
call fcn.1400023a0
lea rdx, [rsp + 0x1030]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14000a7b3
nop
cmp word [rsp + 0x105c], 0x2e
je 0x14000a795
lea r8, [rsp + 0x105c]
mov rdx, rsi
lea rcx, [rsp + 0x830]
call fcn.1400023a0
lea rdx, [rsp + 0x830]
lea rcx, [rsp + 0x20]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__6]
nop
lea r8, [rsp + 0x20]
mov rdx, qword [rdi + 0x10]
mov rcx, rdi
call qword [sym.imp.mfc140u.dll_CWnd::RunModalLoop]
nop
lea rcx, [rsp + 0x20]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rdx, [rsp + 0x1030]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x14000a740
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
test r14b, r14b
je 0x14000a84d
lea r8, [0x140011e80]
mov rdx, rsi
lea rcx, [rsp + 0x830]
call fcn.1400023a0
lea rdx, [rsp + 0x1030]
lea rcx, [rsp + 0x830]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14000a84d
test byte [rsp + 0x1030], 0x10
je 0x14000a82f
cmp word [rsp + 0x105c], 0x2e
je 0x14000a82f
lea r8, [rsp + 0x105c]
mov rdx, rsi
lea rcx, [rsp + 0x30]
call fcn.1400023a0
mov r9, rdi
mov r8b, 1
mov rdx, rbp
lea rcx, [rsp + 0x30]
call fcn.14000a6e0
lea rdx, [rsp + 0x1030]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x14000a7f2
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, qword [rsp + 0x1280]
xor rcx, rsp
call fcn.14000dba0
add rsp, reloc.mfc140u.dll_CPaneDivider::FindPaneContainer
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14000c880
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x10], rdx
push rdi
push r12
sub rsp, 0x68
mov rax, r9
mov r12, r8
mov rdi, rdx
cmp rdx, 0xffffffffffffffff
jne 0x14000c8b5
mov ecx, 0x80070006
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor al, al
add rsp, 0x68
pop r12
pop rdi
ret
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x58], rsi
mov esi, 0x800
mov qword [rsp + 0x50], r13
xor r13d, r13d
mov qword [rsp + 0x40], r15
or rbp, 0xffffffffffffffff
mov dword [r9], r13d
mov r15d, r13d
inc rbp
cmp byte [r8 + rbp], r13b
jne 0x14000c8e3
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, 0x8000
mov dword [rsp + 0x34], eax
cmp eax, ecx
mov ebx, eax
cmova ebx, ecx
mov dword [rsp + 0x30], ebx
test ebx, ebx
jne 0x14000c921
mov ecx, 0x8000ffff
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor al, al
jmp 0x14000ca35
cmp ebx, esi
mov qword [rsp + 0x48], r14
cmovb esi, ebx
mov ecx, esi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r14, rax
test rax, rax
je 0x14000ca05
nop
mov edx, esi
mov r9d, 2
neg edx
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
lea r9, [rsp + 0x38]
mov qword [rsp + 0x20], r13
mov r8d, esi
mov rdx, r14
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14000c9fa
mov ebx, r13d
mov edi, esi
test r15d, r15d
jne 0x14000c985
sub edi, ebp
jmp 0x14000c988
sub edi, r15d
test edi, edi
js 0x14000c9ab
mov r15d, ebp
nop
mov edx, ebx
mov r8, r15
add rdx, r14
mov rcx, r12
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
test eax, eax
je 0x14000c9e6
inc ebx
cmp ebx, edi
jle 0x14000c990
mov ebx, dword [rsp + 0x30]
cmp ebx, esi
je 0x14000ca0b
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea eax, [rsi + rsi]
mov r15d, esi
cmp ebx, eax
mov esi, eax
cmovb esi, ebx
mov ecx, esi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r14, rax
test rax, rax
je 0x14000ca05
mov rdi, qword [rsp + 0x88]
jmp 0x14000c940
mov rax, qword [rsp + 0x98]
sub ebx, esi
add ebx, dword [rsp + 0x34]
add ebx, ebp
mov dword [rax], ebx
jmp 0x14000ca0b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r13d, eax
jmp 0x14000ca0b
mov r13d, 0x8007000e
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rsp + 0x88]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov r14, qword [rsp + 0x48]
test r13d, r13d
sete al
mov r13, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x80]
mov r15, qword [rsp + 0x40]
add rsp, 0x68
pop r12
pop rdi
ret
Function at 0x14000cba0
Capabilities:
Set file attributes

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx]
cmp rcx, 0xffffffffffffffff
je 0x14000cbf1
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x18]
mov qword [rbx], 0xffffffffffffffff
test rcx, rcx
je 0x14000cbf1
mov edx, dword [rbx + 0x20]
test edx, edx
je 0x14000cbf1
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x14000cbf1
mov rcx, qword [rbx + 0x18]
mov dword [rbx + 0x20], 0
call sub.mfc140u.dll_operator
mov qword [rbx + 0x18], 0
add rsp, 0x20
pop rbx
ret

Function at 0x14000cc00
Capabilities:
Set file attributes

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx]
cmp rcx, 0xffffffffffffffff
jne 0x14000cc1a
xor al, al
add rsp, 0x20
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x18]
mov qword [rbx], 0xffffffffffffffff
test rcx, rcx
je 0x14000cc59
mov edx, dword [rbx + 0x20]
test edx, edx
je 0x14000cc59
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x14000cc12
mov rcx, qword [rbx + 0x18]
mov dword [rbx + 0x20], 0
call sub.mfc140u.dll_operator
mov qword [rbx + 0x18], 0
mov al, 1
add rsp, 0x20
pop rbx
ret

Function at 0x14000cc80
Capabilities:
Get file attributes
Set file attributes

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x40
cmp qword [rcx], 0xffffffffffffffff
mov r15d, r9d
mov r14d, r8d
mov rdi, rdx
mov rsi, rcx
je 0x14000ccb8
call fcn.14000cc00
test al, al
jne 0x14000ccb8
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
mov qword [rsp + 0x68], rbp
bt r14d, 0x1e
jae 0x14000cd4d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebp, eax
test al, 1
je 0x14000cd4d
cmp byte [rsp + 0x80], 0
jne 0x14000ccf3
mov ecx, 0x1779
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor al, al
jmp 0x14000cd82
mov edx, ebp
mov rcx, rdi
and edx, 0xfffffffe
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x14000ccec
or rcx, 0xffffffffffffffff
mov qword [rsp + 0x60], rbx
mov rbx, rcx
inc rbx
cmp word [rdi + rbx*2], 0
jne 0x14000cd11
inc rbx
mov eax, 2
mul rbx
cmovo rax, rcx
mov rcx, rax
call sub.mfc140u.dll_operator_1
mov r8, rdi
mov qword [rsi + 0x18], rax
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
mov rbx, qword [rsp + 0x60]
mov dword [rsi + 0x20], ebp
mov qword [rsp + 0x30], 0
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
mov r8d, r15d
mov edx, r14d
mov dword [rsp + 0x20], 3
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
mov qword [rsi], rax
setne al
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret