joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18003a910
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
sub rsp, 0x20
cmp qword [rcx], 0
mov rsi, rdx
mov rbx, rcx
jne 0x18003a9be
cmp dword [rcx + 8], 0xffffffff
jne 0x18003a9be
mov qword [rsp + 0x38], rdi
lea rdi, [rcx + 0x150]
mov ecx, 0x103
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
mov rdi, qword [rsp + 0x38]
not rcx
movzx eax, byte [rcx + rbx + 0x14e]
cmp al, 0x5c
je 0x18003a978
cmp al, 0x2f
je 0x18003a978
mov word [rcx + rbx + 0x14f], reloc.ca_core.dll_Ordinal_47
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.1800392f0
test rax, rax
jne 0x18003a999
mov eax, dword [rsp + 0x30]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
mov rcx, rax
call fcn.180039840
xor ecx, ecx
mov edx, 0x200
test rax, rax
mov qword [rbx], rax
cmove ecx, edx
mov eax, ecx
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
mov eax, 0x1000000
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret

Function at 0x18003afc0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x250
mov rax, qword [0x18005b0d0]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbx, rdx
mov rsi, rcx
mov ebp, 0x104
test rcx, rcx
je 0x18003b046
mov rdx, rcx
lea rcx, [rsp + 0x20]
mov r8d, ebp
call qword [sym.imp.MSVCR100.dll__mbsnbcpy]
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x20]
repne scasb al, byte [rdi]
not rcx
dec rcx
je 0x18003b029
movzx eax, byte [rsp + rcx + 0x1f]
cmp al, 0x2f
je 0x18003b024
cmp al, 0x5c
jne 0x18003b029
mov byte [rsp + rcx + 0x1f], 0
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x18003b046
lea rcx, [rsp + 0x20]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
movzx eax, byte [rbx]
test al, al
je 0x18003b118
mov rdi, rbx
mov rcx, rbx
cmp al, 0x2f
je 0x18003b05f
cmp al, 0x5c
jne 0x18003b062
mov rdi, rcx
movzx eax, byte [rcx + 1]
inc rcx
test al, al
jne 0x18003b057
cmp rdi, rbx
je 0x18003b097
sub rdi, rbx
lea rcx, [rsp + 0x20]
mov rdx, rbx
mov r8, rdi
call sub.MSVCR100.dll_memcpy
lea rdx, [rsp + 0x20]
mov rcx, rsi
mov byte [rsp + rdi + 0x20], 0
call fcn.18003afc0
mov byte [rsp + 0x130], 0
test rsi, rsi
je 0x18003b0b8
lea rcx, [rsp + 0x130]
mov r8, rbp
mov rdx, rsi
call qword [sym.imp.MSVCR100.dll__mbsnbcpy]
or rcx, 0xffffffffffffffff
xor eax, eax
mov byte [rsp + 0x233], 0
lea rdi, [rsp + 0x130]
mov rdx, rbx
repne scasb al, byte [rdi]
not rcx
dec rcx
sub rbp, rcx
lea rcx, [rsp + rcx + 0x130]
mov r8, rbp
call qword [sym.imp.MSVCR100.dll__mbsnbcpy]
lea rcx, [rsp + 0x130]
mov byte [rsp + 0x233], 0
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x18003b118
lea rcx, [rsp + 0x130]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.18003c580
mov rbx, qword [rsp + 0x280]
add rsp, 0x250
pop rdi
pop rsi
pop rbp
ret
Function at 0x18003be90
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg
Hash data with crc32
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
cmp byte [rcx + 0x41], 0
mov edi, r8d
mov rsi, rdx
mov rbx, rcx
je 0x18003bf94
mov rcx, qword [rcx + 0x50]
mov qword [rsp + 0x48], rbp
test rcx, rcx
je 0x18003bed3
cmp dword [rbx + 0x58], edi
jae 0x18003bed3
call qword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete___void____ptr64_]
mov qword [rbx + 0x50], 0
cmp qword [rbx + 0x50], 0
jne 0x18003beea
lea ecx, [rdi + rdi]
call qword [sym.imp.MSVCR100.dll_void____ptr64___cdecl_operator_new___unsigned_long_long_unsigned___int64__]
mov dword [rbx + 0x58], edi
mov qword [rbx + 0x50], rax
mov rcx, qword [rbx + 0x50]
mov r8, rdi
mov rdx, rsi
mov rbp, rdi
call sub.MSVCR100.dll_memcpy
test edi, edi
je 0x18003bf8b
xor r11d, r11d
lea rsi, [0x180042a20]
nop
mov rax, qword [rbx + 0x50]
mov edx, dword [rbx + 0x44]
mov r8d, dword [rbx + 0x4c]
movsx r10, byte [r11 + rax]
mov ecx, edx
shr edx, 8
xor rcx, r10
mov r9d, r8d
inc r11
movzx eax, cl
and r9d, 0xfffd
mov ecx, dword [rsi + rax*4]
or r9d, 2
xor ecx, edx
mov dword [rbx + 0x44], ecx
movzx eax, cl
movzx ecx, r8b
add eax, dword [rbx + 0x48]
shr r8d, 8
imul eax, eax, 0x8088405
inc eax
mov dword [rbx + 0x48], eax
movzx eax, byte [rbx + 0x4b]
xor rcx, rax
mov eax, dword [rsi + rcx*4]
mov ecx, r9d
xor ecx, 1
xor eax, r8d
mov dword [rbx + 0x4c], eax
mov rax, qword [rbx + 0x50]
imul ecx, r9d
shr ecx, 8
xor cl, r10b
dec rbp
mov byte [r11 + rax - 1], cl
jne 0x18003bf10
mov rsi, qword [rbx + 0x50]
mov rbp, qword [rsp + 0x48]
mov rdx, qword [rbx + 0x30]
test rdx, rdx
je 0x18003bfe4
mov ecx, dword [rbx + 0x38]
lea eax, [rcx + rdi]
cmp eax, dword [rbx + 0x3c]
jb 0x18003bfc1
mov dword [rbx + 0x24], 0x30000
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
add rcx, rdx
mov r8, rdi
mov rdx, rsi
call sub.MSVCR100.dll_memcpy
add dword [rbx + 0x38], edi
mov eax, edi
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x18003c01b
lea r9, [rsp + 0x40]
mov r8d, edi
mov rdx, rsi
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [rsp + 0x40]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov rsi, qword [rsp + 0x58]
mov dword [rbx + 0x24], 0x1000000
mov rbx, qword [rsp + 0x50]
xor eax, eax
add rsp, 0x30
pop rdi
ret
Function at 0x18003cc7b
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x18005b0d0]
jne 0x18003c59a
rol rcx, 0x10
test cx, 0xffff
jne 0x18003c596
repz ret
ror rcx, 0x10
jmp 0x18003cbd4
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x18005cab0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x18005cba8]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x18003cc59
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x18005cab0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x18003cc7b
mov rax, qword [rsp + 0x88]
mov qword [0x18005cba8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x18005cb48], rax
mov rax, qword [0x18005cba8]
mov qword [0x18005ca20], rax
mov rax, qword [rsp + 0x90]
mov qword [0x18005cb30], rax
mov dword [0x18005ca10], 0xc0000409
mov dword [0x18005ca14], 1
mov rax, qword [0x18005b0d0]
mov qword [rsp + 0x68], rax
mov rax, qword [0x18005b0d8]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x18005caa8], eax
mov ecx, 1
call fcn.18003cf50
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x180041610]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x18005caa8], 0
jne 0x18003cd02
mov ecx, 1
call fcn.18003cf50
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
jmp qword [sym.imp.MSVCR100.dll___C_specific_handler]
Function at 0x18006b4b0
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x50
mov r12, r9
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
test r8, r8
jne 0x18006b4dd
xor al, al
jmp 0x18006b63f
mov rax, qword [0x18008b6b0]
lea rcx, [rsp]
xor r11d, r11d
mov qword [rcx], rax
mov rax, qword [0x18008b6b8]
mov qword [rsp + 0x60], rbp
mov qword [rcx + 8], rax
mov rax, qword [0x18008b6c0]
mov rdx, r11
mov qword [rcx + 0x10], rax
mov rax, qword [0x18008b6c8]
mov qword [rcx + 0x18], rax
mov rax, qword [0x18008b6d0]
mov qword [rcx + 0x20], rax
mov rax, qword [0x18008b6d8]
mov qword [rcx + 0x28], rax
mov rax, qword [0x18008b6e0]
mov qword [rcx + 0x30], rax
mov rax, qword [0x18008b6e8]
mov qword [rcx + 0x38], rax
movzx eax, byte [0x18008b6f0]
mov byte [rcx + 0x40], al
mov rax, qword [r9]
mov rcx, r8
lea rbp, [r8 + rax]
test rbx, rbx
je 0x18006b631
add r8, 4
nop word [rax + rax]
movzx r9d, byte [rdx + rdi]
inc rdx
shl r9d, 0x10
cmp rdx, rbx
jne 0x18006b589
mov r11d, 2
jmp 0x18006b5ad
movzx eax, byte [rdx + rdi]
inc rdx
shl eax, 8
or r9d, eax
cmp rdx, rbx
jne 0x18006b5a3
mov r11d, 1
jmp 0x18006b5ad
movzx eax, byte [rdx + rdi]
or r9d, eax
inc rdx
mov r10d, r9d
and r9d, 0x3f
cmp r8, rbp
ja 0x18006b655
mov rax, r10
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx], al
mov rax, r10
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx + 1], al
cmp r11, 1
jbe 0x18006b5f2
mov byte [rcx + 2], 0x3d
add rcx, 3
add r8, 3
jmp 0x18006b60a
shr r10, 6
add rcx, 3
and r10d, 0x3f
add r8, 3
movzx eax, byte [rsp + r10]
mov byte [rcx - 1], al
test r11, r11
je 0x18006b61a
mov byte [rcx], 0x3d
inc rcx
inc r8
jmp 0x18006b628
movzx eax, byte [rsp + r9]
inc rcx
inc r8
mov byte [rcx - 1], al
cmp rdx, rbx
jb 0x18006b570
sub rcx, rsi
mov al, 1
mov qword [r12], rcx
mov rbp, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r12
ret
xor al, al
jmp 0x18006b63a
Function at 0x140004ccc
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140004af8

Function at 0x1809ac630
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1809ac7b7
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1809ac661
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1809ac647
add dl, dl
jne 0x1809ac66e
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1809ac6ce
xor eax, eax
add dl, dl
jne 0x1809ac67d
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1809ac785
add dl, dl
jne 0x1809ac68e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1809ac69b
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1809ac6a8
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1809ac6b5
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1809ac6c2
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1809ac656
mov eax, 1
add dl, dl
jne 0x1809ac6de
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1809ac6eb
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1809ac6d3
sub eax, ebx
mov ebx, 1
jne 0x1809ac724
mov ecx, 1
add dl, dl
jne 0x1809ac706
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1809ac713
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1809ac6fb
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1809ac656
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1809ac740
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1809ac74d
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1809ac735
cmp eax, 0x7d00
jae 0x1809ac773
cmp eax, 0x500
jb 0x1809ac76e
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1809ac656
cmp eax, 0x7f
ja 0x1809ac776
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1809ac656
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1809ac7aa
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1809ac656
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x14000b990
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
sub rsp, 0x198
mov rax, qword [0x1401f7280]
mov qword [rsp + 0x150], rax
mov rax, qword [0x140207118]
mov qword [r11 - 0x10], rbp
mov qword [r11 - 0x18], rsi
test rax, rax
mov qword [r11 - 0x20], rdi
mov qword [r11 - 0x28], r12
mov qword [r11 - 0x30], r13
mov rdi, r9
mov esi, r8d
mov r12, rdx
mov rbp, rcx
mov r13d, 1
jne 0x14000baa6
cmp dword [0x140207110], eax
jne 0x14000baa6
lea rax, [rsp + 0x38]
mov qword [r11 - 8], rbx
lea rdx, str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000000
mov qword [rsp + 0x20], rax
xor ebx, ebx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14000ba79
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea rdx, [0x140188451]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x30], 0x104
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x38]
test eax, eax
cmove ebx, r13d
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x14000ba79
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x140207118], rax
jmp 0x14000ba80
mov rax, qword [0x140207118]
test rax, rax
mov rbx, qword [rsp + 0x190]
jne 0x14000baa6
lea rcx, str.hhctrl.ocx
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
mov qword [0x140207118], rax
je 0x14000bace
mov r10, qword [0x140207100]
test r10, r10
jne 0x14000bad9
lea edx, [r10 + 0xe]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov r10, rax
mov qword [0x140207100], rax
jne 0x14000bad9
mov dword [0x140207110], r13d
xor eax, eax
jmp 0x14000bae8
mov r9, rdi
mov r8d, esi
mov rdx, r12
mov rcx, rbp
call r10
mov r13, qword [rsp + 0x168]
mov r12, qword [rsp + 0x170]
mov rdi, qword [rsp + 0x178]
mov rsi, qword [rsp + 0x180]
mov rbp, qword [rsp + 0x188]
mov rcx, qword [rsp + 0x150]
call fcn.1400f9a80
add rsp, 0x198
ret
Function at 0x14000c580
Capabilities:
Create process on windows

Disassembly:
push rbx
sub rsp, 0x290
mov rax, qword [0x1401f7280]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov rbx, rcx
mov rcx, qword [0x1401fbad8]
lea r8, [rsp + 0x30]
mov r9d, InitCommonControls
mov edx, 0x543
call qword [sym.imp.USER32.dll_LoadStringW]
xor eax, eax
lea r8, [rsp + 0x30]
lea rdx, str.http:__www.irfanview.com_checkversion.php_ver_s
lea rcx, [rsp + 0x70]
mov word [rsp + 0x3a], ax
call fcn.1400f98c8
lea rax, [0x140181e34]
lea r8, [rsp + 0x70]
lea rdx, str.open
xor r9d, r9d
mov rcx, rbx
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.1400f9a80
add rsp, 0x290
pop rbx
ret

Function at 0x14000c9e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rbp
sub rsp, 0x248
mov rax, qword [0x1401f7280]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov r8, rcx
movzx edx, dx
xor ecx, ecx
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbp, rax
test rax, rax
je 0x14000caae
mov rcx, qword [0x1401fbad8]
mov rdx, rax
mov qword [rsp + 0x240], rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rdi, rax
test rax, rax
je 0x14000caa9
mov rcx, rax
mov qword [rsp + 0x270], rsi
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rsi, rax
test rax, rax
je 0x14000ca73
mov rcx, qword [0x1401fbad8]
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
lea r8, [rsp + 0x20]
mov rcx, rsi
mov edx, eax
call fcn.140054ff0
mov rbx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rsi, qword [rsp + 0x270]
mov rax, rbx
mov rdi, qword [rsp + 0x240]
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1400f9a80
add rsp, 0x248
pop rbp
pop rbx
ret
mov rax, rbx
jmp 0x14000ca87
mov rax, rbx
jmp 0x14000ca8f
Function at 0x14000cac0
Capabilities:
Get common file path

Disassembly:
push rbx
push rsi
push r12
push r13
sub rsp, 0x2f8
mov rax, qword [0x1401f7280]
xor rax, rsp
mov qword [rsp + 0x2d0], rax
xor esi, esi
mov r13, rdx
mov r12, rcx
mov word [rdx], si
test r8, r8
je 0x14000caf4
mov word [r8], si
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0x288
call fcn.1400f9ab0
lea rcx, [rsp + 0x40]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea rcx, [rsp + 0x40]
or rax, 0xffffffffffffffff
nop
cmp word [rcx + rax*2 + 2], si
lea rax, [rax + 1]
jne 0x14000cb20
cmp word [rsp + rax*2 + 0x3e], 0x5c
je 0x14000cb52
lea rcx, [rsp + 0x40]
sub rcx, 2
nop dword [rax]
cmp word [rcx + 2], si
lea rcx, [rcx + 2]
jne 0x14000cb40
mov eax, dword [0x140181e84]
mov dword [rcx], eax
lea rax, [rsp + 0x40]
sub rax, 2
nop dword [rax + rax]
cmp word [rax + 2], si
lea rax, [rax + 2]
jne 0x14000cb60
movups xmm0, xmmword [0x140181e88]
movsd xmm1, qword [0x140181e98]
mov qword [rsp + 0x338], rbp
mov qword [rsp + 0x2f0], rdi
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x2e8], r14
mov qword [rsp + 0x2e0], r15
movups xmmword [rax], xmm0
movsd qword [rax + 0x10], xmm1
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
test rax, rax
je 0x14000ccb3
lea rdx, str.GetFileVersionInfoSizeW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFileVersionInfoW
mov rcx, rbx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VerQueryValueW
mov rcx, rbx
mov r15, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rdi, rdi
je 0x14000ccaa
test r15, r15
je 0x14000ccaa
test rax, rax
je 0x14000ccaa
lea rdx, [rsp + 0x30]
mov rcx, r12
mov dword [rsp + 0x30], esi
call rdi
mov ebp, eax
test eax, eax
jne 0x14000cc30
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
jmp 0x14000ccb5
mov rcx, rbp
mov edx, 2
call fcn.1400f97a4
mov rdi, rax
test rax, rax
je 0x14000ccaa
mov r9, rax
mov r8d, ebp
xor edx, edx
mov rcx, r12
call r15
test eax, eax
je 0x14000cca2
lea r9, [rsp + 0x34]
lea r8, [rsp + 0x38]
lea rdx, [0x140181e84]
mov rcx, rdi
call r14
test eax, eax
je 0x14000cca2
mov rdx, qword [rsp + 0x38]
test rdx, rdx
je 0x14000cca2
movzx eax, word [rdx + 0xe]
movzx r9d, word [rdx + 0x10]
movzx r8d, word [rdx + 0x12]
lea rdx, str._d._d._d
mov rcx, r13
mov dword [rsp + 0x20], eax
call fcn.1400f98c8
mov esi, 1
mov rcx, rdi
call fcn.1400f97e8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, esi
mov r15, qword [rsp + 0x2e0]
mov r14, qword [rsp + 0x2e8]
mov rdi, qword [rsp + 0x2f0]
mov rbp, qword [rsp + 0x338]
mov rcx, qword [rsp + 0x2d0]
xor rcx, rsp
call fcn.1400f9a80
add rsp, 0x2f8
pop r13
pop r12
pop rsi
pop rbx
ret
Function at 0x14000e610
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x2a0
mov rax, qword [0x1401f7280]
xor rax, rsp
mov qword [rsp + 0x290], rax
mov rbx, rdx
mov rsi, rcx
lea r9, [0x140208860]
lea rdx, str.ShowPNGAlpha
lea rcx, str.Others
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
lea r9, [rsp + 0x70]
lea r8, [rsp + 0x80]
mov edi, eax
lea rax, str.BatchWatermark
lea rdx, [rsp + 0x64]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
lea rax, [rsp + 0x6c]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x60]
mov ecx, 1
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
call fcn.1400ee260
mov eax, dword [rsp + 0x6c]
mov edx, dword [rsp + 0x64]
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x7c]
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x78]
lea r8, [rsp + 0x80]
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x74]
mov r9d, edi
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x70]
mov rcx, rsi
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x68]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x20], eax
call fcn.14003c5e0
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.1400f9a80
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1400112e0
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x2500]
mov eax, 0x2600
call fcn.1400f9a20
sub rsp, rax
mov rax, qword [0x1401f7280]
xor rax, rsp
mov qword [rbp + 0x24f0], rax
lea rcx, [rbp + 0x4f0]
mov edx, 1
call fcn.14002c5a0
xor esi, esi
lea rdi, [0x140208860]
lea rdx, str.OpenIndex
lea rcx, str.Batch
lea r8d, [rsi + 1]
mov r9, rdi
mov word [rbp + 0x2e0], si
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
lea rdx, str.SaveBatchDir
lea rcx, str.Others
mov r9, rdi
xor r8d, r8d
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
je 0x14001137b
lea rcx, str.Batch
jmp 0x1400113be
lea rdx, [0x140208ca0]
or rax, 0xffffffffffffffff
inc rax
cmp word [rdx + rax*2], si
jne 0x140011386
test rax, rax
je 0x1400113b7
mov rax, rsi
nop word [rax + rax]
movzx ecx, word [rax + rdx]
lea rax, [rax + 2]
mov word [rbp + rax + 0xce], cx
test cx, cx
jne 0x1400113a0
jmp 0x1400113e6
lea rcx, [0x140182e78]
lea r9, [rbp + 0xd0]
lea r8, [0x140182e70]
lea rdx, str.OpenDir
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0x104
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, 0x98
call fcn.1400f9ab0
mov rax, qword [0x1401fbb00]
mov rcx, qword [0x1401fbba0]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x4f0]
lea r8, [rbp - 0x30]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x2e0]
mov r9d, 0x80
mov qword [rsp + 0x60], rax
lea rax, [rbp + 0xd0]
mov edx, 0x501
mov dword [rsp + 0x30], 0x98
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x50], rsi
mov qword [rbp - 0x80], rax
mov dword [rsp + 0x58], esi
mov dword [rsp + 0x5c], ebx
mov dword [rsp + 0x68], 0x104
mov qword [rsp + 0x70], rsi
mov dword [rsp + 0x78], esi
call qword [sym.imp.USER32.dll_LoadStringW]
mov ecx, dword [0x1402094d0]
lea rax, [rbp - 0x30]
mov edx, 0x64
mov qword [rbp - 0x78], rax
lea rax, [0x1400101a0]
lea r8d, [rdx - 4]
mov qword [rbp - 0x70], 0x88026c
mov qword [rbp - 0x68], rsi
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x50], 0x3f1
call qword [sym.imp.KERNEL32.dll_MulDiv]
mov r8d, 0x64
mov ecx, 0x2d8
mov edx, eax
call qword [sym.imp.KERNEL32.dll_MulDiv]
xor ecx, ecx
mov ebx, eax
call fcn.1400ebf50
cmp eax, 0x320
jg 0x1400114d6
cmp dword [0x1402094d0], 0x60
jg 0x1400114e4
xor ecx, ecx
call fcn.1400ebf50
lea ecx, [rbx - 0xa]
cmp ecx, eax
jle 0x1400114eb
mov dword [rbp - 0x3c], 1
lea rcx, [rsp + 0x30]
mov dword [0x14020bdac], 0xffffffff
call qword [sym.imp.COMDLG32.dll_GetOpenFileNameW]
test eax, eax
jne 0x14001150c
cmp dword [0x14020bdac], esi
jle 0x14001153c
mov r8d, dword [rsp + 0x5c]
lea rdx, [0x140182ce0]
lea rcx, [rbp - 0x30]
call fcn.1400f98c8
lea r8, [rbp - 0x30]
lea rdx, str.OpenIndex
lea rcx, str.Batch
mov r9, rdi
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov rcx, qword [rbp + 0x24f0]
xor rcx, rsp
call fcn.1400f9a80
lea r11, [rsp + 0x2600]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x140013e10
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
xor ebx, ebx
mov r14, rdx
mov rdi, rcx
mov dword [rdx], ebx
mov dword [rcx], ebx
lea rdx, [0x140183018]
mov rcx, r8
mov rbp, r9
mov rsi, r8
call fcn.1400f92fc
test eax, eax
je 0x140013ecb
lea rdx, [0x140183020]
mov rcx, rsi
call fcn.1400f92fc
test eax, eax
je 0x140013ecb
lea rdx, [0x140183060]
mov rcx, rsi
call fcn.1400f92fc
test eax, eax
je 0x140013e88
lea rdx, [0x140183068]
mov rcx, rsi
call fcn.1400f92fc
test eax, eax
jne 0x140013eff
mov dword [r14], 1
cmp dword [rbp + 0xf4], ebx
jne 0x140013ec3
lea r9, [0x140208860]
lea rdx, str.SaveAllPages
lea rcx, [0x140183078]
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
jne 0x140013ec3
mov dword [rdi], ebx
mov dword [r14], ebx
jmp 0x140013eff
mov dword [rdi], 1
jmp 0x140013eff
cmp dword [rbp + 0xf4], ebx
jne 0x140013ef8
lea r9, [0x140208860]
lea rdx, str.SaveAllPages
lea rcx, str.TIFF
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
je 0x140013efd
mov ebx, 1
mov dword [rdi], ebx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret