joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140038bd0
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rax, qword [rsp + 0x60]
mov rbx, qword [0x1400f4120]
mov qword [rsp + 0x20], rax
call fcn.1400454b0
mov rsi, rax
mov ebp, 1
test rax, rax
je 0x140038c15
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea edi, [rax + 1]
jmp 0x140038c17
mov edi, ebp
lea eax, [rdi - 1]
mov byte [rsp + 0x20], bpl
movsxd r8, eax
xor r9d, r9d
xor edx, edx
mov rcx, rbx
call fcn.14007c070
cmp eax, ebp
je 0x140038c3a
xor eax, eax
jmp 0x140038d57
xor r8d, r8d
mov edx, ebp
mov rcx, rbx
test rsi, rsi
je 0x140038cea
mov qword [rsp + 0x40], r14
call fcn.1400015b0
mov rdx, rax
mov r8d, edi
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetWindowTextW]
cmp byte [rbx + 0x23], 0
movsxd r14, eax
jne 0x140038c73
mov rsi, qword [rbx + 0x10]
jmp 0x140038c76
mov rsi, rbx
lea rdi, [0x1400f5c18]
cmp byte [rsi + 0x23], bpl
jne 0x140038c97
test byte [rsi + 0x21], 8
je 0x140038c91
mov rcx, rsi
call fcn.140001500
add rsi, 0x10
jmp 0x140038c9a
mov rsi, rdi
lea rax, [r14 + r14]
mov r14, qword [rsp + 0x40]
mov qword [rsi], rax
cmp byte [rbx + 0x23], 0
jne 0x140038cb2
mov rsi, qword [rbx + 0x10]
jmp 0x140038cb5
mov rsi, rbx
cmp byte [rsi + 0x23], bpl
jne 0x140038ccd
test byte [rsi + 0x21], 8
je 0x140038cc9
mov rcx, rsi
call fcn.140001500
lea rdi, [rsi + 0x10]
test qword [rdi], 0xfffffffffffffffe
jne 0x140038d27
xor r8d, r8d
mov edx, ebp
mov rcx, rbx
call fcn.1400015b0
xor esi, esi
mov word [rax], si
jmp 0x140038d27
call fcn.1400015b0
xor esi, esi
mov word [rax], si
cmp byte [rbx + 0x23], sil
jne 0x140038d00
mov rdi, qword [rbx + 0x10]
jmp 0x140038d03
mov rdi, rbx
cmp byte [rdi + 0x23], bpl
jne 0x140038d1d
test byte [rdi + 0x21], 8
je 0x140038d17
mov rcx, rdi
call fcn.140001500
add rdi, 0x10
jmp 0x140038d24
lea rdi, [0x1400f5c18]
mov qword [rdi], rsi
cmp byte [rbx + 0x23], 0
jne 0x140038d31
mov rbx, qword [rbx + 0x10]
cmp byte [rbx + 0x23], 2
jne 0x140038d51
cmp qword [0x1400f4fd8], 0
je 0x140038d51
lea rcx, [0x1400f4fc0]
call fcn.140004d00
mov ebp, eax
jmp 0x140038d55
and byte [rbx + 0x21], 0x86
mov eax, ebp
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x140038d70
Capabilities:
Enumerate gui resources

Disassembly:
push rbx
mov eax, 0x11ce0
call fcn.1400ad480
sub rsp, rax
xor eax, eax
mov byte [rsp + 0x1881], 1
mov rbx, rcx
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x1884], eax
lea rcx, [0x1400bbf7c]
mov qword [rsp + 0x1888], rax
cmp edx, 6
mov rdx, qword [0x1400ebaa8]
xorps xmm0, xmm0
mov dword [rsp + 0x18a0], eax
mov qword [rsp + 0x18a8], rax
mov qword [rsp + 0x18c0], rax
cmove rax, rbx
mov qword [rsp + 0x18b8], rax
mov rax, qword [rsp + 0x11d18]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x11d10]
mov qword [rsp + 0x1048], rcx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x20], rax
movdqa xmmword [rsp + 0x1890], xmm0
call fcn.14007e6f0
test eax, eax
je 0x140038e21
lea rdx, [rsp + 0x30]
lea rcx, [0x14007d9e0]
call qword [sym.imp.USER32.dll_EnumWindows]
movsxd rdx, dword [rsp + 0x1884]
mov r8b, reloc.OLEAUT32.dll_SafeArrayGetElement
mov rcx, rbx
call fcn.140001460
mov eax, 1
add rsp, 0x11ce0
pop rbx
ret

Function at 0x140039ca0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
mov eax, 0x10030
call fcn.1400ad480
sub rsp, rax
mov rbx, qword [0x1400f4120]
mov rbp, rdx
mov rcx, rbp
lea rdx, [rsp + 0x30]
mov r8d, 0x7fff
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov byte [rsp + 0x20], 1
mov rcx, rbx
mov esi, eax
cmp eax, 0x7fff
jb 0x140039d82
lea r8d, [rsi - 1]
mov r9b, 1
xor edx, edx
call fcn.14007c070
test eax, eax
je 0x140039d9f
mov qword [rsp + 0x10040], rdi
xor r8d, r8d
mov edi, 1
mov rcx, rbx
mov edx, edi
call fcn.1400015b0
mov rdx, rax
mov r8d, esi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
jne 0x140039d40
xor r8d, r8d
mov edx, edi
mov rcx, rbx
call fcn.1400015b0
xor ecx, ecx
mov word [rax], cx
cmp byte [rbx + 0x23], 0
jne 0x140039d4a
mov rbx, qword [rbx + 0x10]
cmp byte [rbx + 0x23], 2
jne 0x140039d72
cmp qword [0x1400f4fd8], 0
je 0x140039d72
lea rcx, [0x1400f4fc0]
call fcn.140004d00
mov edi, eax
mov rdi, qword [rsp + 0x10040]
jmp 0x140039d9f
and byte [rbx + 0x21], 0x86
mov eax, edi
mov rdi, qword [rsp + 0x10040]
jmp 0x140039d9f
test esi, esi
lea rax, [0x1400bbf7c]
lea rdx, [rsp + 0x30]
mov r8, rsi
cmove rdx, rax
xor r9d, r9d
call fcn.14007c070
lea r11, [rsp + 0x10030]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsp, r11
pop rsi
ret
Function at 0x1400405e0
Capabilities:
Get keyboard layout

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x250
mov rsi, qword [0x1400f4120]
xor ecx, ecx
mov rdi, r8
mov rbx, rdx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
mov r9b, 1
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rax
mov rcx, rbx
call fcn.140013310
movzx ebp, al
test al, al
jne 0x140040685
xor r8d, r8d
lea rdx, [rsp + 0x260]
mov rcx, rbx
call fcn.1400522d0
xor r9d, r9d
test eax, eax
jne 0x140040653
lea rdx, [0x1400bbf7c]
jmp 0x1400406de
mov edx, dword [rsp + 0x260]
lea r8, [rsp + 0x30]
xor ecx, ecx
mov dword [rsp + 0x40], ecx
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x30], rcx
mov ecx, eax
call fcn.1400525e0
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.14007b9f0
jmp 0x1400406ef
movzx ebx, word [rdi]
mov edi, 2
test ebx, 0xffffff80
jne 0x1400406a5
mov edx, edi
mov ecx, ebx
call fcn.14009ad94
test eax, eax
je 0x1400406a5
and ebx, 0xffffffdf
movzx eax, bx
cmp eax, 0x50
je 0x1400406b7
xor ecx, ecx
cmp eax, 0x54
cmovne edi, ecx
jmp 0x1400406bc
mov edi, 1
mov edx, edi
movzx ecx, bpl
call fcn.140052530
test al, al
lea rcx, [0x1400d7470]
lea rdx, [0x1400d7474]
cmovne rdx, rcx
xor r9d, r9d
or r8, 0xffffffffffffffff
mov byte [rsp + 0x20], 1
mov rcx, rsi
call fcn.14007c070
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140040710
Capabilities:
Get disk size

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x260
movzx edi, r8b
mov byte [rsp + 0x20], 1
mov rbx, rdx
mov rsi, rcx
mov rcx, qword [0x1400f4120]
or r8, 0xffffffffffffffff
xor edx, edx
xor r9d, r9d
call fcn.14007c070
test rbx, rbx
je 0x1400408c8
cmp word [rbx], 0
je 0x1400408c8
mov r8d, 0x104
lea rcx, [rsp + 0x50]
mov rdx, rbx
call fcn.1400a1224
xor edx, edx
lea rcx, [rsp + 0x50]
mov word [rsp + 0x258], dx
or rax, 0xffffffffffffffff
nop
inc rax
cmp word [rcx + rax*2], dx
jne 0x140040780
lea rcx, [rax + rax]
cmp word [rsp + rcx + 0x4e], 0x5c
je 0x1400407ac
inc rax
cmp rax, 0x105
jae 0x1400408c8
mov dword [rsp + rcx + 0x50], 0x5c
mov rax, qword gs:[0x58]
mov edx, 4
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x1400f6c28], eax
jle 0x14004080d
lea rcx, [0x1400f6c28]
call fcn.140093fa4
cmp dword [0x1400f6c28], 0xffffffff
jne 0x14004080d
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.GetDiskFreeSpaceExW
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x1400f6c28]
mov qword [0x1400f6c30], rax
call fcn.140093f44
mov rax, qword [0x1400f6c30]
lea rcx, [rsp + 0x50]
test rax, rax
je 0x140040847
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x40]
call rax
test eax, eax
je 0x1400408c8
mov rbx, qword [rsp + 0x38]
test dil, dil
cmovne rbx, qword [rsp + 0x40]
jmp 0x14004088c
lea rax, [rsp + 0x278]
lea r9, [rsp + 0x288]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x34]
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
test eax, eax
je 0x1400408c8
mov ebx, dword [rsp + 0x278]
test dil, dil
cmovne ebx, dword [rsp + 0x288]
imul ebx, dword [rsp + 0x30]
imul ebx, dword [rsp + 0x34]
mov rcx, qword [0x1400efed8]
lea rdx, [0x1400bc064]
xor r9d, r9d
shr rbx, 0x14
or r8, 0xffffffffffffffff
mov byte [rsp + 0x20], 1
call fcn.14007c070
mov rcx, qword [0x1400f4120]
mov r8b, reloc.OLEAUT32.dll_SafeArrayGetElement
mov rdx, rbx
call fcn.140001460
mov eax, 1
jmp 0x1400408d2
mov dl, 1
mov rcx, rsi
call fcn.14002f160
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1400428c0
Capabilities:
Get common file path
Set current directory

Disassembly:
push rbx
sub rsp, 0x250
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
jne 0x1400428f0
cmp byte [0x1400f4f20], al
je 0x1400429c3
call fcn.14000a880
add rsp, 0x250
pop rbx
ret
cmp byte [0x1400f4f20], 0
lea rax, [0x1400efcc0]
mov qword [rsp + 0x260], rdi
mov ecx, 0x104
lea rdi, [rsp + 0x40]
cmovne rdi, rax
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x140042979
cmp word [rbx], 0
je 0x140042993
cmp word [rbx + 2], 0x3a
jne 0x140042993
cmp word [rbx + 4], 0
jne 0x140042993
mov rdx, rdi
mov rcx, rbx
call fcn.1400981f0
test eax, eax
je 0x140042993
mov r8, rbx
lea rdx, [0x1400d7958]
lea rcx, [rsp + 0x30]
call fcn.140004910
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
je 0x140042993
mov rdx, rdi
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
jne 0x140042993
mov r8d, 0x103
mov rdx, rbx
mov rcx, rdi
call fcn.1400a1224
xor eax, eax
mov word [rdi + 0x206], ax
cmp byte [0x1400f4f20], 0
mov rdi, qword [rsp + 0x260]
je 0x1400429c3
mov rcx, qword [0x1400efed8]
lea rdx, [0x1400bc064]
xor r9d, r9d
mov byte [rsp + 0x20], 1
or r8, 0xffffffffffffffff
call fcn.14007c070
add rsp, 0x250
pop rbx
ret
Function at 0x140043080
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x230
mov rdi, rdx
mov rsi, rcx
test rdx, rdx
je 0x1400431c9
cmp word [rdx], 0
je 0x1400431c9
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400430e4
mov rcx, qword [0x1400ebaa8]
shr eax, 4
not al
and al, 1
mov dword [rcx + 0x40], 0xb7
movzx edx, al
mov rcx, rsi
mov rsi, qword [rsp + 0x250]
add rsp, 0x230
pop rdi
jmp fcn.14002f160
mov edx, 0x5c
mov qword [rsp + 0x248], rbp
mov rcx, rdi
call fcn.140096634
mov rbp, rax
cmp rax, rdi
jbe 0x1400431b0
or rcx, 0xffffffffffffffff
nop dword [rax]
inc rcx
cmp word [rdi + rcx*2], 0
jne 0x140043110
cmp rcx, 0x104
jb 0x14004314c
mov r8d, WSAStartup
mov dl, 1
mov rcx, rsi
call fcn.14002f380
mov rbp, qword [rsp + 0x248]
mov rsi, qword [rsp + 0x250]
add rsp, 0x230
pop rdi
ret
mov qword [rsp + 0x240], rbx
lea rcx, [rsp + 0x20]
mov rbx, rax
mov rdx, rdi
sub rbx, rdi
sar rbx, 1
mov r8, rbx
call fcn.1400a1224
xor eax, eax
lea rdx, [rsp + 0x20]
mov rcx, rsi
mov word [rsp + rbx*2 + 0x20], ax
call fcn.140043080
cmp word [rbp + 2], 0
mov rbx, qword [rsp + 0x240]
je 0x1400431a9
mov rcx, qword [0x1400efed8]
xor r8d, r8d
lea edx, [r8 + 1]
call fcn.1400015b0
cmp word [rax], 0x31
jne 0x1400431b0
mov eax, 1
jmp 0x140043133
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
sete dl
or r8d, 0xffffffff
jmp 0x14004312b
mov rax, qword [0x1400ebaa8]
mov dl, 1
mov dword [rax + 0x40], 0x57
mov rsi, qword [rsp + 0x250]
add rsp, 0x230
pop rdi
jmp fcn.14002f160
Function at 0x140043ce0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov rdi, r8
mov r14, rdx
mov r15, rcx
test r8, r8
je 0x140043d49
xor r8d, r8d
mov rcx, rdi
lea edx, [r8 + 1]
call fcn.1400015b0
cmp byte [rdi + 0x23], 0
mov rsi, rax
jne 0x140043d1c
mov rbx, qword [rdi + 0x10]
jmp 0x140043d1f
mov rbx, rdi
cmp byte [rbx + 0x23], 1
jne 0x140043d3d
test byte [rbx + 0x21], 8
je 0x140043d33
mov rcx, rbx
call fcn.140001500
mov rbp, qword [rbx + 0x10]
add rbx, 0x10
jmp 0x140043d93
lea rbx, [0x1400f5c18]
mov rbp, qword [rbx]
jmp 0x140043d93
lea r8, [rsp + 0x88]
xor ecx, ecx
lea rdx, [rsp + 0x80]
call fcn.14007bae0
test eax, eax
jne 0x140043d83
mov rax, qword [0x1400ebaa8]
xor ebx, ebx
mov dword [rax + 0x40], ebx
xor eax, eax
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov rsi, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x88]
xor ebx, ebx
xor r9d, r9d
mov qword [rsp + 0x30], rbx
xor r8d, r8d
mov dword [rsp + 0x28], ebx
mov edx, 0x40000000
mov rcx, r14
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x140043df9
mov dword [rsp + 0x80], ebx
mov ecx, ebx
test rsi, rsi
je 0x140043df4
lea r9, [rsp + 0x80]
mov qword [rsp + 0x20], rbx
mov r8d, ebp
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [rsp + 0x80]
cmp ecx, ebp
sete bl
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x1400ebaa8]
mov dword [rcx + 0x40], eax
cmp r14, 0xffffffffffffffff
je 0x140043e18
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rdi, rdi
jne 0x140043e25
mov rcx, rsi
call fcn.14009c290
test ebx, ebx
mov rcx, r15
sete dl
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
pop rsi
pop rbp
jmp fcn.14002f160
Function at 0x140044150
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x260
mov rsi, rcx
mov rdi, r9
mov rcx, r9
mov rbp, r8
mov rbx, rdx
call fcn.14000e370
mov rcx, rdi
test al, al
je 0x14004418f
xor edx, edx
lea r8d, [rdx + 0x10]
call fcn.14009c230
jmp 0x140044194
call fcn.14009bdb8
cmp eax, 1
je 0x1400441ac
mov rcx, rbp
call fcn.1400575f0
test al, al
je 0x1400441ac
mov dl, 1
jmp 0x1400442a5
mov qword [rsp + 0x30], 0
xor r9d, r9d
mov dword [rsp + 0x28], 0
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x20], 2
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1400441a5
or r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rbx + r8*2], 0
jne 0x1400441f0
cmp r8, 0x104
lea rcx, [rsp + 0x50]
mov eax, 0x103
mov rdx, rbx
cmovae r8, rax
lea r8, [r8*2 + 2]
call fcn.140095f70
lea rcx, [rsp + 0x50]
call fcn.1400a06ec
mov r8d, 0xa
lea rdx, [rsp + 0x50]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbp, rax
test rax, rax
je 0x140044295
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x140044295
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x140044295
mov rdx, rbp
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], 0
mov r8d, eax
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
setne bl
jmp 0x140044297
xor bl, bl
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
sete dl
mov rcx, rsi
call fcn.14002f160
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x1400442d0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x130
mov rbx, rdx
mov byte [rsp + 0x20], 1
mov rdi, rcx
xor edx, edx
mov rcx, qword [0x1400f4120]
xor r9d, r9d
or r8, 0xffffffffffffffff
call fcn.14007c070
test rbx, rbx
je 0x14004437a
cmp word [rbx], 0
je 0x14004437a
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x14004432a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x1400ebaa8]
mov dword [rcx + 0x40], eax
jmp 0x140044388
mov rax, qword [0x1400ebaa8]
xor edx, edx
mov rcx, rdi
mov dword [rax + 0x40], 0
call fcn.14002f160
mov edx, ebx
lea rcx, [rsp + 0x30]
call fcn.140079cd0
mov rcx, qword [0x1400f4120]
xor r9d, r9d
or r8, 0xffffffffffffffff
mov byte [rsp + 0x20], 1
mov rdx, rax
call fcn.14007c070
mov rbx, qword [rsp + 0x140]
add rsp, 0x130
pop rdi
ret
mov rax, qword [0x1400ebaa8]
mov dword [rax + 0x40], 0x57
mov dl, 1
mov rcx, rdi
call fcn.14002f160
mov rbx, qword [rsp + 0x140]
add rsp, 0x130
pop rdi
ret
Function at 0x140045230
Capabilities:
Get file size

Disassembly:
push rsi
push rdi
push r14
sub rsp, 0x290
mov r14, r8
mov byte [rsp + 0x20], 1
mov rdi, rdx
mov rsi, rcx
mov rcx, qword [0x1400f4120]
or r8, 0xffffffffffffffff
xor edx, edx
xor r9d, r9d
call fcn.14007c070
test rdi, rdi
je 0x1400453d4
cmp word [rdi], 0
je 0x1400453d4
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x2b0], rbx
mov edx, 0x80
mov dword [rsp + 0x28], 0
mov rcx, rdi
mov qword [rsp + 0x2c0], rbp
lea r8d, [r9 + 7]
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x1400452d9
lea rdx, [rsp + 0x2b8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov rcx, rbp
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
jne 0x140045337
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp rax, 0xffffffffffffffff
jne 0x140045317
or r8d, 0xffffffff
mov dl, 1
mov rcx, rsi
call fcn.14002f380
mov rbx, qword [rsp + 0x2b0]
mov rbp, qword [rsp + 0x2c0]
add rsp, 0x290
pop r14
pop rdi
pop rsi
ret
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [rsp + 0x5c]
mov eax, dword [rsp + 0x60]
shl rcx, 0x20
or rcx, rax
mov qword [rsp + 0x2b8], rcx
movzx ebx, word [r14]
test ebx, 0xffffff80
jne 0x140045356
mov edx, 2
mov ecx, ebx
call fcn.14009ad94
test eax, eax
je 0x140045356
and ebx, 0xffffffdf
movzx eax, bx
cmp eax, 0x4b
je 0x14004537c
cmp eax, 0x4d
jne 0x14004539b
mov rax, qword [rsp + 0x2b8]
cqo
and edx, 0xfffff
add rax, rdx
sar rax, 0x14
jmp 0x140045393
mov rax, qword [rsp + 0x2b8]
cqo
and edx, 0x3ff
add rax, rdx
sar rax, 0xa
mov qword [rsp + 0x2b8], rax
mov rax, qword [0x1400ebaa8]
xor edx, edx
mov rcx, rsi
mov dword [rax + 0x40], 0
call fcn.14002f160
mov rdx, qword [rsp + 0x2b8]
mov r8b, reloc.OLEAUT32.dll_SafeArrayGetElement
mov rcx, qword [0x1400f4120]
call fcn.140001460
mov eax, 1
jmp 0x1400452fb
mov rax, qword [0x1400ebaa8]
mov dl, 1
mov rcx, rsi
mov dword [rax + 0x40], 0x57
call fcn.14002f160
add rsp, 0x290
pop r14
pop rdi
pop rsi
ret

Function at 0x140052530
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x20
movzx ebx, cl
test cl, cl
jne 0x140052545
xor al, al
add rsp, 0x20
pop rbx
ret
sub edx, 1
je 0x140052572
movzx ecx, bl
cmp edx, 1
je 0x140052563
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and al, 1
add rsp, 0x20
pop rbx
ret
call qword [sym.imp.USER32.dll_GetKeyState]
and eax, 1
add rsp, 0x20
pop rbx
ret
cmp bl, 6
ja 0x140052581
mov ecx, 0x76
bt ecx, ebx
jb 0x140052588
lea eax, [rbx + 0x66]
cmp al, 5
ja 0x1400525a6
cmp qword [0x1400eff18], 0
jne 0x1400525c8
movzx ecx, bl
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
and al, 1
add rsp, 0x20
pop rbx
ret
cmp qword [0x1400eff20], 0
je 0x140052592
xor edx, edx
xor r8d, r8d
movzx ecx, bl
call fcn.140012a80
test al, al
je 0x1400525c8
mov cl, 1
call fcn.140012870
movzx eax, bl
lea rcx, [0x1400f0cc0]
movzx eax, byte [rax + rcx]
shr al, 7
add rsp, 0x20
pop rbx
ret
Function at 0x1400529f0
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x230
mov rdi, rdx
mov esi, ecx
mov r8d, ecx
xor r15d, r15d
mov word [rdx], r15w
mov ecx, 0x410
xor edx, edx
movzx ebx, r9b
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r14, rax
test rax, rax
jne 0x140052a4a
mov r8d, esi
xor edx, edx
mov ecx, 0x1000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r14, rax
test rax, rax
je 0x140052b9c
xor edx, edx
mov qword [rsp + 0x250], rbp
mov r9d, 0x104
mov r8, rdi
mov rcx, r14
test bl, bl
je 0x140052a6c
call qword [sym.imp.PSAPI.DLL_GetModuleBaseNameW]
jmp 0x140052a72
call qword [sym.imp.PSAPI.DLL_GetModuleFileNameExW]
mov ebp, eax
test eax, eax
jne 0x140052b89
mov rax, qword [0x1400d5988]
test rax, rax
je 0x140052b89
mov r8d, 0x104
mov rdx, rdi
mov rcx, r14
call rax
mov ebp, eax
test eax, eax
je 0x140052b89
test bl, bl
je 0x140052ae0
mov edx, 0x5c
mov rcx, rdi
call fcn.140096634
test rax, rax
je 0x140052b89
or r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], r15w
jne 0x140052ac2
add r8, r8
lea rdx, [rax + 2]
mov rcx, rdi
call fcn.140095f70
jmp 0x140052b89
mov eax, 0x41
mov dword [rsp + 0x25a], 0x3a
mov word [rsp + 0x258], ax
nop dword [rax + rax]
mov r8d, 0x104
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x258]
call qword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
mov ebx, eax
cmp eax, 2
jbe 0x140052b3e
add ebx, 0xfffffffe
lea rcx, [rsp + 0x20]
mov r8d, ebx
mov rdx, rdi
call fcn.14009ffb8
test eax, eax
jne 0x140052b3e
cmp word [rdi + rbx*2], 0x5c
je 0x140052b59
movzx eax, word [rsp + 0x258]
inc ax
mov word [rsp + 0x258], ax
cmp ax, 0x5a
jbe 0x140052b00
jmp 0x140052b89
movzx eax, word [rsp + 0x258]
lea rdx, [rdi + rbx*2]
mov word [rdi], ax
lea rcx, [rdi + 4]
movzx eax, word [rsp + 0x25a]
sub ebp, ebx
mov word [rdi + 2], ax
lea r8d, [rbp + 1]
add r8, r8
call fcn.140095f70
add ebp, 2
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebp
mov rbp, qword [rsp + 0x250]
lea r11, [rsp + 0x230]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x140056320
Capabilities:
Create shortcut via ishelllink
Get keyboard layout

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x40
mov rbp, rcx
mov rbx, r9
xor ecx, ecx
mov r14, r8
mov rdi, rdx
xor sil, sil
call qword [sym.imp.ole32.dll_CoInitialize]
xor edx, edx
lea rax, [rsp + 0x30]
lea r9, [0x1400b3f10]
mov qword [rsp + 0x20], rax
lea rcx, [0x1400b3f20]
lea r8d, [rdx + 1]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x140056515
mov rcx, qword [rsp + 0x30]
mov rdx, rdi
mov rax, qword [rcx]
call qword [rax + 0xa0]
cmp word [rbx], 0
je 0x1400563a2
mov rcx, qword [rsp + 0x30]
mov rdx, rbx
mov rax, qword [rcx]
call qword [rax + 0x48]
mov rdx, qword [rsp + 0x70]
cmp word [rdx], 0
je 0x1400563b8
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx]
call qword [rax + 0x58]
mov rdx, qword [rsp + 0x78]
cmp word [rdx], 0
je 0x1400563ce
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx]
call qword [rax + gethostname]
mov rdi, qword [rsp + 0x80]
cmp word [rdi], 0
je 0x140056429
mov rbx, qword [rsp + 0x90]
cmp word [rbx], 0
je 0x140056415
mov rcx, rbx
call fcn.14000e370
mov rcx, rbx
test al, al
je 0x14005640a
xor edx, edx
lea r8d, [rdx + 0x10]
call fcn.14009c230
lea r8d, [rax - 1]
jmp 0x140056418
call fcn.14009bdb8
lea r8d, [rax - 1]
jmp 0x140056418
xor r8d, r8d
mov rcx, qword [rsp + 0x30]
mov rdx, rdi
mov rax, qword [rcx]
call qword [rax + 0x88]
mov rbx, qword [rsp + 0x88]
cmp word [rbx], 0
je 0x14005646f
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
mov r9b, 1
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rax
mov rcx, rbx
call fcn.140013310
test al, al
je 0x14005646f
mov rcx, qword [rsp + 0x30]
movzx edx, al
mov eax, 0x600
or dx, ax
mov r9, qword [rcx]
call qword [r9 + 0x68]
mov rbx, qword [rsp + 0x98]
cmp word [rbx], 0
je 0x1400564ab
mov rcx, rbx
call fcn.14000e370
mov rcx, rbx
test al, al
je 0x140056499
xor edx, edx
lea r8d, [rdx + 0x10]
call fcn.14009c230
jmp 0x14005649e
call fcn.14009bdb8
mov rcx, qword [rsp + 0x30]
mov edx, eax
mov rax, qword [rcx]
call qword [rax + 0x78]
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x38]
lea rdx, [0x1400b3f30]
mov rax, qword [rcx]
call qword [rax]
test eax, eax
js 0x14005650a
mov rcx, qword [rsp + 0x38]
mov r8d, 1
mov rdx, r14
mov rax, qword [rcx]
call qword [rax + 0x30]
test eax, eax
js 0x1400564ff
mov rcx, qword [0x1400efed8]
lea rdx, [0x1400bc064]
xor r9d, r9d
mov byte [rsp + 0x20], 1
or r8, 0xffffffffffffffff
call fcn.14007c070
mov sil, 1
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rcx]
call qword [rdx + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rcx]
call qword [rdx + reloc.OLEAUT32.dll_SafeArrayGetDim]
call qword [sym.imp.ole32.dll_CoUninitialize]
test sil, sil
je 0x140056527
mov eax, 1
jmp 0x140056531
mov dl, 1
mov rcx, rbp
call fcn.14002f160
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret