joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140004ac4
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rdi, rdx
lea r8, [rsp + 0x60]
mov ebx, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov r8d, ebx
mov ecx, 0x1300
neg eax
sbb r9d, r9d
and qword [rsp + 0x30], 0
and r9d, dword [rsp + 0x60]
xor edx, edx
and dword [rsp + 0x28], 0
mov dword [rsp + 0x60], r9d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x140004b48
mov r8, qword [rdi]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x140016350]
cmp byte [rcx + rax], 0
je 0x140004b48
dec r8
sub rdx, 1
jne 0x140004b2e
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x140005140
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rdx, rcx
mov ecx, 0x105
call fcn.140004b60
mov ebx, eax
test eax, eax
jne 0x140005170
and dword [rsp + 0x38], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x3c], eax
jmp 0x1400051cc
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400051c3
test al, 0x10
je 0x1400051c3
bt eax, 0xa
jae 0x1400051bc
mov r9d, 0x2000000
lea rcx, [rsp + 0x38]
mov r8d, 0x80
mov rdx, rdi
call fcn.1400051e4
mov rcx, qword [rsp + 0x38]
mov edi, eax
cmp rcx, 0xffffffffffffffff
je 0x1400051b8
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x1400051dc
test edi, edi
jne 0x1400051c3
and dword [rsp + 0x3c], 0
jmp 0x1400051c8
or dword [rsp + 0x3c], 0xffffffff
mov dword [rsp + 0x38], ebx
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
call fcn.14000bad4
int3

Function at 0x140005fb4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140005ffe
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140005ffe
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140005ffe
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140005ffe
cmp dword [rcx + 0x84], 0xe
jbe 0x140005ffe
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140006000
xor al, al
add rsp, 0x28
ret

Function at 0x14000c7bc
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14000c5b8
Function at 0x14000fb14
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x14000fb44
xor eax, eax
jmp 0x14000fc07
mov rbp, rbx
cmp word [rax], si
je 0x14000fb69
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x14000fb50
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x14000fb4c
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.14000fa34
movsxd r14, eax
test eax, eax
jne 0x14000fba7
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x14000fb3d
mov rcx, r14
call fcn.14000df38
mov rdi, rax
test rax, rax
jne 0x14000fbc0
xor ecx, ecx
call fcn.14000d82c
jmp 0x14000fb9c
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.14000fa34
test eax, eax
jne 0x14000fbf1
mov rcx, rdi
call fcn.14000d82c
jmp 0x14000fbfb
xor ecx, ecx
call fcn.14000d82c
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x140014b90
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140014bb8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140014bb8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x18002ba80
Capabilities:
Check for software breakpoints

Disassembly:
xor r8d, r8d
mov edx, 0x11a
xor ecx, ecx
jmp fcn.18004a7d0
Function at 0x1800392a0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x30
imul ebp, ecx, 0x41
mov r14, r9
mov r15, r8
mov rdi, rdx
mov esi, ecx
mov ebx, ecx
cmp ecx, ebp
ja 0x1800393c0
mov eax, ebx
sub eax, 0x38
je 0x180039384
sub eax, 0x7e
je 0x180039305
sub eax, 0x31
je 0x18003932e
sub eax, 0x90d
je 0x1800392fc
cmp eax, 0x93e
jne 0x180039320
mov dword [rdi + 0x28], 0x238
jmp 0x180039320
mov byte [rdi + reloc.SHELL32.dll_SHChangeNotification_Lock], 1
jmp 0x180039320
xor edx, edx
mov r8d, 0x288
mov rcx, rdi
call sub.VCRUNTIME140.dll_memset
mov qword [rdi + 0x260], 0xffffffffffffffff
imul eax, esi, 0xd
add ebx, eax
cmp ebx, ebp
jbe 0x1800392d0
jmp 0x1800393c0
xor esi, esi
mov ebp, 0x1f
nop word [rax + rax]
mov eax, dword [r15]
lea r9, [rsp + 0x50]
mov dword [rsp + 0x50], eax
lea rdx, [rsp + 0x20]
mov eax, dword [r14]
mov ebx, ebp
xor ebx, 0x18
mov r8d, 0xd3
mov ecx, ebx
shr eax, cl
mov rcx, rdi
and eax, 1
mov dword [rsp + 0x20], eax
call fcn.18005e630
movzx edx, al
mov ecx, ebx
shl edx, cl
or esi, edx
sub ebp, 1
jns 0x180039340
mov eax, esi
jmp 0x1800393c4
mov r8, rdi
xor edx, edx
mov ecx, 0xd2
call fcn.180031d50
test al, al
jne 0x1800393c0
nop word [rax + rax]
imul ecx, dword [r14], 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r8, rdi
xor edx, edx
mov ecx, 0xd2
call fcn.180031d50
test al, al
je 0x1800393a0
mov eax, dword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
Function at 0x1800499b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov rax, r9
mov rsi, r8
mov r9d, dword [rsp + 0x50]
mov r10, rdx
mov rbp, rcx
lea edi, [r9 + 0x19c]
cmp r9d, edi
jae 0x180049a48
xor r14d, r14d
nop word [rax + rax]
mov r8d, r9d
sub r8d, 0x20
je 0x180049a67
sub r8d, 0xf
je 0x180049a3d
sub r8d, 0x4f
je 0x180049b11
cmp r8d, 0x18
jne 0x180049ab9
mov rdx, r14
lea r8, str.METAR
nop dword [rax]
movzx ecx, byte [rax + rdx]
inc rdx
cmp cl, byte [r8 + rdx - 1]
jne 0x180049ac8
cmp rdx, 6
jne 0x180049a20
jmp 0x180049aea
test rax, rax
jne 0x180049ab9
mov word [rsp + 0x50], r14w
mov eax, dword [rsp + 0x50]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov ebx, 0x17
mov qword [r10], r14
mov r11d, ebx
nop dword [rax]
nop word [rax + rax]
mov r8d, dword [rax]
mov rcx, rbx
mov rdx, qword [r10]
xor rcx, 3
add rdx, rdx
shr r8, cl
and r8d, 1
dec rbx
or r8, rdx
mov qword [r10], r8
mov edx, dword [rax + 4]
shr rdx, cl
and edx, 1
lea rcx, [r8 + r8]
or rdx, rcx
sub r11d, 1
mov qword [r10], rdx
jns 0x180049a80
add r9d, 0x67
cmp r9d, edi
jb 0x1800499f0
jmp 0x180049a48
mov rdx, r14
lea r8, str.SPECI
movzx ecx, byte [rax + rdx]
inc rdx
cmp cl, byte [r8 + rdx - 1]
jne 0x180049a42
cmp rdx, 6
jne 0x180049ad2
sub r10, rax
nop dword [rax]
movzx ecx, byte [rax]
mov byte [r10 + rax + 0xc], cl
lea rax, [rax + 1]
test cl, cl
jne 0x180049af0
inc dword [rsi]
mov eax, 1
mov word [rsp + 0x50], ax
jmp 0x180049a48
mov rcx, qword [rax + 8]
mov dword [rax + 0x528], r14d
mov r11, qword [rcx + 0x9c]
test r11, r11
je 0x180049b3c
mov r8, qword [rsi]
mov r9, rbp
mov rdx, r10
mov rcx, rax
call r11
jmp 0x180049a4c
mov dword [rax + 0x528], 0xfffffffd
mov eax, r14d
jmp 0x180049a4c
Function at 0x18004a7d0
Capabilities:
Check for software breakpoints

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov rax, qword [0x1800ab9c8]
xor rax, rsp
mov qword [rsp + 0x58], rax
lea r13d, [rdx + 0x134]
mov qword [rsp + 0x38], rcx
mov r14, r8
mov r15d, edx
mov r9, rcx
cmp edx, r13d
jae 0x18004aa1e
lea r12d, [rdx - 0xbc]
xor ebp, ebp
lea r10, [0x18009ffe4]
lea r8, [0x18009ffe0]
lea rdx, [0x180000000]
cmp r12d, 0xd4
ja case.0x18004a84f.7
movzx eax, byte [rdx + r12 + 0x4aa68]
mov ecx, dword [rdx + rax*4 + 0x4aa48]
add rcx, rdx
jmp rcx
mov qword [0x180cac018], r8
mov qword [0x180cac020], r10
jmp case.0x18004a84f.7
movzx eax, byte [r14]
lea rdx, [rsp + 0x48]
mov byte [rsp + 0x33], al
lea rdi, [rsp + 0x30]
mov ebx, ebp
test ebx, ebx
je 0x18004a895
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rdx + rax], bpl
jne 0x18004a883
add rdx, rax
mov byte [rdx], 0x2e
inc rdx
movzx ecx, byte [rdi]
mov r8d, 0xa
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__itoa]
inc ebx
inc rdi
mov rdx, rax
cmp ebx, 4
jb 0x18004a878
jmp case.0x18004a84f.7
lea rax, [rsp + 0x48]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], bpl
jne 0x18004a8c2
lea rdx, [rsp + 0x48]
mov rcx, r9
call fcn.180047840
jmp case.0x18004a84f.7
mov ecx, dword [r14]
mov eax, ecx
shr eax, 0x10
shr ecx, 8
mov byte [rsp + 0x32], cl
mov byte [rsp + 0x31], al
jmp case.0x18004a84f.7
mov esi, 0xca
nop word [rax + rax]
mov eax, esi
sub eax, 0xca
je 0x18004a951
cmp eax, 1
jne 0x18004a9a1
lea rbx, [0x180cac020]
nop dword [rax]
mov rdx, qword [rbx]
mov r8d, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
test eax, eax
je 0x18004a9d8
inc ebp
add rbx, 8
cmp ebp, 1
jb 0x18004a920
lea rax, [0x18009bfc8]
jmp 0x18004aa23
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp byte [r14 + rax], bpl
jne 0x18004a960
cmp rax, 4
jne 0x18004a9d8
mov ebx, ebp
lea rdi, [0x180cac018]
nop dword [rax + rax]
mov rdx, qword [rdi]
mov r8d, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
test eax, eax
je 0x18004a9cf
inc ebx
add rdi, 8
cmp ebx, 1
jb 0x18004a980
inc esi
cmp esi, 0xcc
jb 0x18004a900
movzx eax, byte [r14 + 3]
mov byte [rsp + 0x30], al
add r15d, 0x2c
add r12d, 0x2c
cmp r15d, r13d
jae 0x18004aa1e
mov r9, qword [rsp + 0x38]
jmp 0x18004a81a
lea rax, [0x18009bfe8]
jmp 0x18004aa23
lea rax, [0x18009bf99]
jmp 0x18004aa23
xor r9d, r9d
mov dword [rsp + 0x40], 1
lea rax, [rsp + 0x30]
mov dword [rsp + 0x38], 2
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x38]
lea rax, [rsp + 0x40]
mov dword [rsp + 0x30], ebp
lea r8d, [r9 + 0x42]
mov qword [rsp + 0x20], rax
xor ecx, ecx
call fcn.180068a40
jmp 0x18004aa23
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.180089600
mov rbx, qword [rsp + 0xa8]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x18005fe10
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
lea esi, [rcx + 4]
mov rbp, r8
mov rdi, rdx
mov ebx, ecx
cmp ecx, esi
jae 0x18005fea6
mov rcx, qword [rsp + 0x68]
xor r14d, r14d
nop dword [rax]
mov eax, ebx
sub eax, 0xc4
je 0x18005febd
sub eax, 1
je 0x18005fe9c
sub eax, 1
je 0x18005fef8
cmp eax, 2
jne 0x18005feec
mov eax, dword [0x1800aa0f8]
mov edi, r14d
test eax, eax
jle 0x18005fe95
lea rbx, [0x1800aa0a0]
mov rcx, qword [rbx]
test rcx, rcx
je 0x18005fe8b
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov eax, dword [0x1800aa0f8]
mov qword [rbx], r14
inc edi
add rbx, 0x28
cmp edi, eax
jl 0x18005fe74
mov eax, 1
jmp 0x18005feaa
test rcx, rcx
jne 0x18005feec
mov byte [rsp + 0x50], r14b
mov eax, dword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
mov qword [0x180cabbd8], rdi
lea r8, [0x180044d60]
mov qword [rsp + 0x28], r14
mov r9, rdi
xor edx, edx
mov qword [rdi + 0x80], rbp
xor ecx, ecx
mov dword [rsp + 0x20], r14d
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
inc ebx
cmp ebx, esi
jb 0x18005fe40
jmp 0x18005fea6
xchg qword [0x180cabbe0], rcx
mov byte [rsp + 0x50], 1
jmp 0x18005fea6

Function at 0x18005ff10
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
lea esi, [r8 - 4]
mov ebx, r8d
mov rbp, rdx
mov r14, rcx
cmp r8d, esi
jbe 0x18005ffbd
mov rdi, qword [rsp + 0x58]
nop dword [rax]
mov eax, ebx
sub eax, 0xfa
je 0x18005ffb8
sub eax, 1
je 0x18005ff76
sub eax, 1
je 0x18005ff61
cmp eax, 4
jne 0x18005ffa3
mov rax, qword [rbp + 0x18]
mov eax, dword [rax + 0xc]
jmp 0x18005ffc1
lea rdx, [0x1800a03e0]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov rdi, rax
jmp 0x18005ffa3
test rdi, rdi
je 0x18005ffb1
mov r9, rdi
mov edx, 0x1093
mov r8d, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rdi
cmp rax, 0x1093
jne 0x18005ffab
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
dec ebx
cmp ebx, esi
ja 0x18005ff40
jmp 0x18005ffbd
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov byte [rsp + 0x50], 0
jmp 0x18005ffbd
mov byte [rsp + 0x50], 1
mov eax, dword [rsp + 0x50]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x1800611f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov ebx, dword [rsp + 0xa8]
mov rbp, rdx
lea edx, [r9 + 0x470]
mov r13d, r9d
mov dword [rsp + 0x40], edx
mov r15, r8
mov r14, rcx
cmp r9d, edx
jae 0x18006134f
mov rdx, qword [rsp + 0x50]
mov eax, dword [rsp + 0x40]
xor r9d, r9d
cmp r13d, 0x126
ja 0x180061330
je 0x18006134f
mov eax, r13d
sub eax, 0x36
je 0x1800612d5
sub eax, 0x62
je 0x1800612bb
sub eax, 0x2c
je 0x18006134f
cmp eax, 0xf
jne 0x180061465
mov eax, dword [r15]
lea r8, [rsp + 0x50]
mov qword [rsp + 0x30], r9
lea rcx, [rsp + 0xa8]
mov qword [rsp + 0x28], r9
mov edx, 0x125
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x50], r9
mov r9, rbp
mov dword [rsp + 0xa8], eax
call fcn.180060b40
test eax, eax
js 0x180061351
mov rdx, qword [rsp + 0x50]
jmp 0x180061465
mov rcx, qword [rbp + 0x28]
mov eax, dword [rbp + 8]
cmp dword [rcx + 4], eax
jg 0x18006147e
mov ebx, 1
jmp 0x180061465
mov ebx, r9d
mov esi, r9d
nop dword [rax + rax]
mov eax, dword [r14]
lea r9, [rsp + 0x48]
mov dword [rsp + 0x48], eax
lea rdx, [rsp + 0xa8]
mov eax, dword [r15]
mov edi, esi
xor edi, 0x18
mov r8, rbp
mov ecx, edi
shr eax, cl
mov ecx, 0x38
and al, 1
mov byte [rsp + 0xa8], al
call fcn.180049470
movzx edx, al
mov ecx, edi
shl edx, cl
inc esi
or ebx, edx
cmp esi, 0x20
jb 0x1800612e0
mov rdx, qword [rsp + 0x50]
jmp 0x180061465
cmp r13d, 0x161
je 0x180061379
cmp r13d, 0x1ef
je 0x18006136f
cmp r13d, 0x27d
jne 0x180061469
mov eax, ebx
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov ebx, 0xfffffffe
jmp 0x180061469
cmp dword [rdx], 0
mov r12, r9
je 0x180061469
mov rsi, r9
nop dword [rax + rax]
mov eax, dword [r14]
cmp dword [rsi + rdx], eax
jne 0x180061450
mov edi, 0x68
mov eax, edi
sub eax, 0x68
je 0x1800613c1
sub eax, 1
je 0x1800613b7
cmp eax, 1
je 0x18006134f
jmp 0x180061445
mov ebx, 0xfffffffe
jmp 0x180061445
cmp dword [r15], 1
mov qword [rsp + 0x48], r9
mov eax, dword [rsi + rdx]
mov dword [rsp + 0xa8], eax
jne 0x1800613f3
mov r9d, 0x3a
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0xa8]
mov rcx, rbp
call fcn.1800704e0
jmp 0x180061412
mov r9d, 0x48
mov qword [rsp + 0x20], rbp
lea r8, [rsp + 0xa8]
xor ecx, ecx
lea rdx, [rsp + 0x48]
call fcn.180081d20
test eax, eax
js 0x180061351
mov rdx, qword [rsp + 0x48]
xor r9d, r9d
mov ecx, r9d
cmp dword [rdx], ecx
je 0x180061440
mov r8d, dword [r14 + 4]
mov eax, dword [rdx]
nop
cmp eax, r8d
je 0x18006147e
mov eax, dword [rdx + rcx*4 + 4]
inc rcx
test eax, eax
jne 0x180061430
mov rdx, qword [rsp + 0x50]
inc edi
cmp edi, 0x6b
jb 0x1800613a1
inc r12
lea rsi, [r12*4]
cmp dword [rsi + rdx], 0
jne 0x180061390
mov eax, dword [rsp + 0x40]
add r13d, 0x8e
cmp r13d, eax
jae 0x18006134f
jmp 0x18006123c
mov eax, r9d
jmp 0x180061351
Function at 0x1800769f0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x160
mov rax, qword [0x1800ab9c8]
xor rax, rsp
mov qword [rsp + 0x150], rax
lea esi, [rcx - 0xa]
mov rdi, rdx
cmp ecx, esi
jbe case.0x180076a56.0
mov rbp, qword [rsp + 0x38]
lea ebx, [rcx - 0x101]
mov r14d, dword [rsp + 0x38]
lea r15, [0x180000000]
cmp ebx, 0x17
ja case.0x180076a56.4
mov ecx, dword [r15 + rbx*4 + 0x76b74]
add rcx, r15
jmp rcx
xor ebp, ebp
lea r14d, [rbp + 0x36]
jmp case.0x180076a56.4
cmp qword [rdi], 0xffffffffffffffff
setne byte [rsp + 0x30]
jmp case.0x180076a56.4
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
mov ecx, 0x8a
call fcn.180050c20
test eax, eax
je 0x180076acd
js 0x180076b2e
jmp case.0x180076a56.4
lea rax, [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, r14d
mov rcx, rbp
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
jmp case.0x180076a56.4
movsxd rcx, dword [rdi + 8]
lea eax, [rcx - 1]
cmp eax, dword [rdi + 0x10]
jle 0x180076acd
mov rax, qword [rdi]
movzx edx, byte [rcx + rax - 1]
sub dl, 0x61
test dl, 0xfb
je case.0x180076a56.4
xor eax, eax
jmp 0x180076b2e
lea r9, [rsp + 0x38]
mov dword [rsp + 0x38], 2
mov r8d, reloc.SHELL32.dll_SHSetInstanceExplorer
lea rcx, reloc.SHELL32.dll_SHChangeNotifyRegister
mov rdx, rdi
call fcn.1800523c0
test eax, eax
je 0x180076acd
xor r9d, r9d
xor edx, edx
mov r8d, 0xf9
mov rcx, rdi
call fcn.18005e630
test eax, eax
je 0x180076acd
js 0x180076b2e
jmp case.0x180076a56.4
mov dword [rsp + 0x30], 1
dec ebx
lea eax, [rbx + 0x101]
cmp eax, esi
ja 0x180076a42
mov eax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.180089600
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
mov rcx, qword [rdi + 0x28]
mov eax, dword [rdi + 8]
cmp dword [rcx], eax
jg 0x180076acd
mov eax, 1
jmp 0x180076b2e
Function at 0x1800885b0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov ebx, dword [rsp + 0x48]
lea ebp, [rdx + 0x24]
mov rdi, rcx
cmp edx, ebp
jae 0x1800885f2
mov eax, edx
sub eax, 0xcd
je 0x18008874e
sub eax, 0x5a
je 0x180088610
sub eax, 9
je 0x180088609
cmp eax, 9
jne 0x180088676
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov ebx, 1
jmp 0x180088676
movsxd rsi, dword [rdi + 8]
mov dword [rdi + 0x14], esi
cmp esi, dword [rdi + 0xc]
jge 0x180088686
mov rax, qword [rdi]
movzx edx, byte [rsi + rax]
movzx eax, dl
and al, 0xe0
cmp al, 0x40
jne 0x180088686
mov ecx, edx
mov edx, 0x2200200
and ecx, 0x1f
sar edx, cl
test dl, 1
je 0x180088686
lea rax, [rsp + 0x48]
mov dword [rsp + 0x28], reloc.SHLWAPI.dll_IUnknown_GetWindow
mov r9, rdi
mov qword [rsp + 0x20], rax
lea r8, [0x180093140]
mov dword [rsp + 0x48], 4
xor edx, edx
xor ecx, ecx
call fcn.18004be60
test eax, eax
jne 0x18008868b
mov dword [rdi + 8], esi
mov edx, 0x127
add edx, 9
cmp edx, ebp
jb 0x1800885d2
jmp 0x1800885f2
mov eax, 4
mov edx, dword [rdi + 8]
mov dword [rdi + 0x18], edx
test eax, eax
je 0x18008866e
sub eax, 1
je 0x18008871f
sub eax, 1
je 0x1800886f0
sub eax, 1
je 0x1800886c1
cmp eax, 1
jne 0x180088610
cmp edx, dword [rdi + 0xc]
jge 0x18008866e
lea eax, [rdx + 1]
mov dword [rdi + 8], eax
jmp 0x180088610
mov r9, rdi
mov dword [rsp + 0x48], 1
mov r8d, 0x80
lea rdx, [rsp + 0x48]
lea rcx, [0x18008c44f]
call fcn.180080480
test eax, eax
jns 0x180088610
jmp 0x1800885f4
mov r9, rdi
mov dword [rsp + 0x48], 1
mov r8d, 0x80
lea rdx, [rsp + 0x48]
lea rcx, [0x18008c44b]
call fcn.180080480
test eax, eax
jns 0x180088610
jmp 0x1800885f4
mov r9, rdi
mov dword [rsp + 0x48], 1
mov r8d, 0x80
lea rdx, [rsp + 0x48]
lea rcx, [0x18008c447]
call fcn.180080480
test eax, eax
jns 0x180088610
jmp 0x1800885f4
mov rdx, qword [0x180cabc18]
lea rcx, str.usage:__s___l__language_____i__input_file_____o__output_file_____c__character_encoding_____p_2_____h__n_nThe_input_file_consists_of_a_list_of_words_to_be_stemmed__one_per_nline._Words_should_be_in_lower_case__but__for_English__A_Z_letters_nare_mapped_to_their_a_z_equivalents_anyway._If_omitted__stdin_is_nused._n_nIf__c_is_given__the_argument_is_the_character_encoding_of_the_input_nand_output_files.__If_it_is_omitted__the_UTF_8_encoding_is_used._n_nIf__p_is_given_the_output_file_consists_of_each_word_of_the_input_nfile_followed_by______followed_by_its_stemmed_equivalent._nIf__p2_is_given_the_output_file_is_a_two_column_layout_containing_nthe_input_words_in_the_first_column_and_the_stemmed_eqivalents_in_nthe_second_column._nOtherwise__the_output_file_consists_of_the_stemmed_words__one_per_nline._n_n_h_displays_this_help_n
call fcn.180088f50
mov ecx, dword [rdi]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x1400024f0
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x50
xor ebx, ebx
xor edx, edx
lea rcx, str.ConsoleWindowClass
call qword [sym.imp.USER32.dll_FindWindowA]
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
lea ecx, [rbx + 8]
call fcn.14000287c
lea rcx, [0x140001240]
mov qword [rax], rcx
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebx
mov r9, rax
lea r8, [0x140002770]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x40], rax
test rax, rax
je 0x1400025b9
cmp dword [rsp + 0x48], ebx
je 0x1400025ad
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x30], xmm0
lea rcx, [rsp + 0x30]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x1400025ad
call fcn.1400012a0
mov ebx, 0x186a0
nop
call fcn.140001af0
call fcn.140001bb0
call fcn.140001cb0
call fcn.140002170
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
sub rbx, 1
jne 0x140002580
xor eax, eax
add rsp, 0x50
pop rbx
ret
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rsp + 0x48], ebx
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3

Function at 0x14000326c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400032b6
mov ecx, _Query_perf_counter
cmp word [rax], cx
jne 0x1400032b6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400032b6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400032b6
cmp dword [rcx + 0x84], 0xe
jbe 0x1400032b6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400032b8
xor al, al
add rsp, 0x28
ret