joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400045f0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x450
and word [rsp + 0x240], 0
mov rdi, rcx
mov rbx, rdx
lea rcx, [rsp + 0x242]
xor edx, edx
mov r8d, 0x208
call sub.msvcrt.dll_memset
and word [rsp + 0x30], 0
lea rcx, [rsp + 0x32]
xor edx, edx
mov r8d, 0x208
call sub.msvcrt.dll_memset
mov dx, 0x25
mov rcx, rbx
call sub.msvcrt.dll_wcschr
mov r8d, 0x104
test rax, rax
je 0x140004660
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
jmp 0x14000466d
lea rcx, [rsp + 0x30]
mov rdx, rbx
call fcn.140009208
lea rdx, [rsp + 0x240]
lea rcx, [rsp + 0x30]
call fcn.140009484
movzx eax, word [rsp + 0x30]
lea r11, [rsp + 0x30]
lea r9, [rsp + 0x30]
jmp 0x1400046a8
cmp ax, 0x5c
je 0x14000469c
cmp ax, 0x2f
jne 0x1400046a0
lea r9, [r11 + 2]
add r11, 2
mov ax, word [r11]
test ax, ax
jne 0x140004690
and dword [rsp + 0x20], 0
lea r8, [rsp + 0x240]
mov rdx, rbx
mov rcx, rdi
call fcn.14000444c
mov rbx, qword [rsp + 0x460]
add rsp, 0x450
pop rdi
ret
Function at 0x140008084
Capabilities:
Read file on windows
Timestomp file
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xa0
mov rcx, r8
mov ebp, r9d
mov rsi, r8
mov r10, rdx
call fcn.140007fcc
xor ebx, ebx
cmp eax, ebx
jne 0x1400080b9
xor eax, eax
jmp 0x140008283
mov r8d, 3
mov qword [rsp + 0x30], rbx
xor r9d, r9d
mov edx, 0xc0000000
mov rcx, r10
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], r8d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
mov rdi, rax
je 0x140008281
xor eax, eax
xor r9d, r9d
xor r8d, r8d
mov edx, ebp
mov rcx, rdi
mov byte [rsp + 0x80], bl
mov qword [rsp + 0x81], rax
mov qword [rsp + 0x89], rax
mov qword [rsp + 0x91], rax
mov dword [rsp + 0x99], eax
mov word [rsp + 0x9d], ax
mov byte [rsp + 0x9f], al
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
lea r9, [rsp + 0x50]
lea rdx, [rsp + 0x80]
mov r8d, 0x13
mov rcx, rdi
mov dword [rsp + 0x50], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, ebx
je 0x140008278
lea rcx, [rsp + 0x80]
mov r8d, 0x13
mov rdx, rsi
call sub.msvcrt.dll_memcmp
cmp eax, ebx
jne 0x140008278
mov rcx, qword [rsp + 0xd0]
xor eax, eax
lea rdx, [rsp + 0x70]
mov word [rsp + 0x70], bx
mov qword [rsp + 0x72], rax
mov dword [rsp + 0x7a], eax
mov word [rsp + 0x7e], ax
call qword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
movzx ecx, word [rsp + 0x78]
movzx edx, word [rsp + 0x76]
movzx r8d, word [rsp + 0x72]
movzx r11d, word [rsp + 0x7c]
movzx eax, word [rsp + 0x7a]
movzx r9d, word [rsp + 0x70]
mov dword [rsp + 0x40], r11d
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x28], edx
mov dword [rsp + 0x20], r8d
lea rcx, [rsp + 0x80]
lea r8, str._4.4d:_2.2d:_2.2d__2.2d:_2.2d:_2.2d
mov edx, 0x20
call sub.msvcrt.dll__snprintf
xor r9d, r9d
xor r8d, r8d
mov edx, ebp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
xor eax, eax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x68]
mov rcx, rdi
mov dword [rsp + 0x68], ebx
mov dword [rsp + 0x6c], eax
mov dword [rsp + 0x60], ebx
mov dword [rsp + 0x64], eax
mov dword [rsp + 0x58], ebx
mov dword [rsp + 0x5c], eax
call qword [sym.imp.KERNEL32.dll_GetFileTime]
lea r9, [rsp + 0x50]
lea rdx, [rsp + 0x80]
mov r8d, 0x13
mov rcx, rdi
mov dword [rsp + 0x50], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x68]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_SetFileTime]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140008f50
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rdi, rcx
mov rcx, rdx
mov rbx, rdx
call sub.msvcrt.dll_wcslen
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x50]
lea r8d, [rax + rax]
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x140009120
Capabilities:
Get file size
Read file on windows
Write clipboard data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
sub rsp, 0x30
mov rbx, rcx
xor edi, edi
call qword [sym.imp.USER32.dll_EmptyClipboard]
xor edx, edx
mov rcx, rbx
call fcn.140008ef0
cmp rax, 0xffffffffffffffff
mov rbx, rax
je 0x1400091de
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, 0x2000
mov r12d, eax
mov esi, eax
lea rdx, [r12 + 2]
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
cmp rax, rdi
mov rbp, rax
je 0x1400091cb
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
lea r9, [rsp + 0x58]
mov r8d, r12d
mov rcx, rbx
mov rdx, rax
mov qword [rsp + 0x20], rdi
mov r13, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, edi
je 0x1400091cb
shr rsi, 1
mov rcx, rbp
mov word [r13 + rsi*2], di
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea ecx, [rdi + 0xd]
mov rdx, rbp
call qword [sym.imp.USER32.dll_SetClipboardData]
jmp 0x1400091d3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400091e6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov eax, edi
add rsp, 0x30
pop r13
pop r12
pop rdi
ret

Function at 0x14000952c
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x20
cmp word [0x14001d6b0], 0
mov rbx, rcx
jne 0x140009557
lea rcx, [0x14001d6b0]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov dword [0x14001d8bc], eax
lea rdx, [0x14001d6b0]
mov rcx, rbx
call fcn.140015ac4
mov eax, dword [0x14001d8bc]
add rsp, 0x20
pop rbx
ret
Function at 0x140009708
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x60
cmp dword [0x14001d8e8], 0
mov rdi, rdx
mov rbx, rcx
mov r13d, 0x400
jne 0x1400097f0
mov ebp, InitCommonControls
lea r12, [0x14001d8f0]
mov ecx, r13d
lea edx, [rbp + 2]
mov r9d, ebp
mov r8, r12
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov rcx, r12
call sub.msvcrt.dll__wtoi
mov r9d, ebp
mov r8, r12
mov edx, ebp
mov ecx, r13d
mov dword [0x14001d8c4], eax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov rcx, r12
call sub.msvcrt.dll__wtoi
lea rsi, [0x14001d910]
lea edx, [rbp - 2]
mov r8, rsi
mov r9d, ebp
mov ecx, r13d
mov dword [0x14001d8c8], eax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov qword [0x14001d8d0], rsi
lea rsi, [0x14001d930]
lea edx, [rbp - 1]
mov r9d, ebp
mov r8, rsi
mov ecx, r13d
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov r9d, ebp
mov r8, r12
mov edx, 0x1010
mov ecx, r13d
mov qword [0x14001d8d8], rsi
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov rcx, r12
call sub.msvcrt.dll__wtoi
mov dword [0x14001d8e8], 1
mov dword [0x14001d8e0], eax
lea rdx, [0x14001d8c0]
lea rcx, [rsp + 0x30]
mov r8d, 0x28
call sub.msvcrt.dll_memcpy
and dword [rsp + 0x30], 0
lea r9, [rsp + 0x30]
mov r8, rdi
xor edx, edx
mov ecx, r13d
mov dword [rsp + 0x28], 0x20
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_GetNumberFormatW]
lea r11, [rsp + 0x60]
mov rax, rbx
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r13
pop r12
pop rdi
ret

Function at 0x140009928
Capabilities:
Create process on windows

Disassembly:
sub rsp, 0x38
lea r9, [0x140017850]
mov r8, rdx
lea rdx, str.open
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], r9
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
xor ecx, ecx
cmp rax, 0x20
seta cl
mov eax, ecx
add rsp, 0x38
ret
Function at 0x14000a938
Capabilities:
Enumerate files on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x20
or rsi, 0xffffffffffffffff
mov rbx, rcx
cmp qword [rcx], rsi
jne 0x14000a9ad
lea rax, [rcx + 8]
lea rdx, [rcx + 8]
movzx ecx, word [rcx + 8]
jmp 0x14000a982
cmp cx, 0x5c
je 0x14000a977
cmp cx, 0x2f
jne 0x14000a97b
lea rdx, [rax + 2]
add rax, 2
mov cx, word [rax]
test cx, cx
jne 0x14000a96b
mov qword [rbx + 0x290], rdx
lea rcx, [rbx + 8]
lea rdx, [rbx + 0x298]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
xor edi, edi
cmp rax, rsi
mov qword [rbx], rax
setne dil
jmp 0x14000a9d4
lea rdx, [rcx + 0x298]
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
mov edi, eax
jne 0x14000a9d8
cmp qword [rbx], rsi
je 0x14000a9d4
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_FindClose]
mov qword [rbx], rsi
test edi, edi
je 0x14000aa22
lea r12, [rbx + 0x770]
lea rsi, [rbx + 0x4e8]
lea rbp, [rbx + 0x2c4]
mov rcx, r12
call sub.msvcrt.dll_wcslen
mov rcx, rbp
mov rbx, rax
call sub.msvcrt.dll_wcslen
lea r9, [rbx + rax + 1]
cmp r9, 0x143
jae 0x14000aa1e
mov r8, rsi
mov rdx, rbp
mov rcx, r12
call fcn.1400094ec
jmp 0x14000aa22
and word [rsi], 0
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret

Function at 0x14000b2a0
Capabilities:
Read .ini file

Disassembly:
push rbx
sub rsp, 0x30
and word [rdx], 0
lea rax, [0x14001cfd0]
mov rbx, rdx
mov r9, rdx
mov qword [rsp + 0x28], rax
mov rdx, rcx
mov dword [rsp + 0x20], r8d
lea r8, [0x140017850]
lea rcx, [0x14001d1e0]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x14000b2e4
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
mov eax, 0x2040
call fcn.140015e80
sub rsp, rax
and word [rsp + 0x30], 0
mov rbx, rcx
mov rdi, rdx
lea rcx, [rsp + 0x32]
lea r8d, [rax - 0x40]
xor edx, edx
call sub.msvcrt.dll_memset
lea r11, [0x14001cfd0]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], r11
lea r8, [0x140017850]
lea rcx, [0x14001d1e0]
mov rdx, rbx
mov dword [rsp + 0x20], 0x1000
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [rsp + 0x30], 0
je 0x14000b35f
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.140015ac4
mov eax, 1
jmp 0x14000b361
xor eax, eax
mov rbx, qword [rsp + 0x2050]
add rsp, 0x2040
pop rdi
ret
Function at 0x14000b374
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x2040
call fcn.140015e80
sub rsp, rax
and word [rsp + 0x30], 0
mov ebx, r8d
mov rdi, rcx
mov rsi, rdx
lea r8d, [rax - 0x40]
lea rcx, [rsp + 0x32]
xor edx, edx
call sub.msvcrt.dll_memset
lea rbp, [0x14001cfd0]
lea r9, [rsp + 0x30]
lea r8, [0x140017850]
lea rcx, [0x14001d1e0]
mov rdx, rdi
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], 0x1000
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [rsp + 0x30], 0
je 0x14000b3f0
test ebx, ebx
jne 0x14000b3f0
xor eax, eax
jmp 0x14000b406
lea rcx, [0x14001d1e0]
mov r9, rbp
mov r8, rsi
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea r11, [rsp + 0x2040]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x14000b830
Capabilities:
Check if file exists
Get file attributes
Read .ini file

Disassembly:
push rbx
sub rsp, 0x230
lea rcx, [rsp + 0x22]
xor ebx, ebx
xor edx, edx
mov r8d, 0x208
mov word [rsp + 0x20], bx
call sub.msvcrt.dll_memset
lea rdx, [rsp + 0x20]
mov r8d, 0x104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rsp + 0x20]
mov dx, 0x2e
call sub.msvcrt.dll_wcsrchr
cmp rax, rbx
je 0x14000b87b
mov word [rax], bx
lea rdx, str._lng.ini
lea rcx, [rsp + 0x20]
call sub.msvcrt.dll_wcscat
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14000b938
lea rdx, [rsp + 0x20]
lea rcx, [0x14001cfd0]
call fcn.140015ac4
lea rdx, str.general
lea rcx, [0x14001d1e0]
call fcn.140015ac4
lea r9, [0x14001cfd0]
lea rdx, [0x140018668]
lea rcx, [0x14001d1e0]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
lea rdx, [0x14001d270]
lea rcx, str.charset
cmp eax, 1
sete bl
mov dword [0x14001cdac], ebx
mov ebx, 0x3f
mov r8d, ebx
call fcn.14000b2a0
lea rdx, [0x14001d2f0]
lea rcx, str.TranslatorName
mov r8d, ebx
call fcn.14000b2a0
lea rdx, [0x14001d370]
lea rcx, str.TranslatorURL
mov r8d, 0xff
call fcn.14000b2a0
add rsp, 0x230
pop rbx
ret

Function at 0x14000cf78
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
mov eax, 0x2040
call fcn.140015e80
sub rsp, rax
mov rdi, rcx
mov rbx, rdx
lea r8d, [rax - 0x41]
lea rcx, [rsp + 0x41]
xor edx, edx
mov byte [rsp + 0x40], 0
call sub.msvcrt.dll_memset
and qword [rsp + 0x38], 0
and qword [rsp + 0x30], 0
lea rax, [rsp + 0x40]
or r9d, 0xffffffff
mov r8, rbx
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], 0x1fff
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea rcx, [rsp + 0x40]
call sub.msvcrt.dll_strlen
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x2060]
lea rdx, [rsp + 0x40]
mov r8, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rbx, qword [rsp + 0x2050]
add rsp, 0x2040
pop rdi
ret
Function at 0x14000d010
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x40
xor edi, edi
mov r13, r8
mov rsi, rdx
cmp dword [rcx + 0x44], edi
mov rbp, rcx
jle 0x14000d164
xor r12d, r12d
mov rax, qword [rbp + 0x48]
mov r9, qword [r13]
mov r8, qword [rbp + 0x88]
mov edx, dword [r12 + rax]
mov rcx, r13
call qword [r9]
mov dx, 0x2c
mov rcx, rax
mov rbx, rax
call sub.msvcrt.dll_wcschr
test rax, rax
jne 0x14000d085
mov dx, 0x22
mov rcx, rbx
call sub.msvcrt.dll_wcschr
test rax, rax
jne 0x14000d085
mov rdx, rbx
mov rcx, rsi
call fcn.14000cf78
jmp 0x14000d13b
and qword [rsp + 0x20], 0
and dword [rsp + 0x28], 0
and dword [rsp + 0x2c], 0
lea rdx, [rsp + 0x88]
lea rcx, [rsp + 0x20]
or r8d, 0xffffffff
mov dword [rsp + 0x34], 0x100
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x88], 0x22
call fcn.14000a244
jmp 0x14000d0f0
cmp r11w, 0x22
jne 0x14000d0dc
or r8d, 0xffffffff
lea rdx, [0x1400186f4]
jmp 0x14000d0e7
mov r8d, 1
lea rdx, [rsp + 0x70]
call fcn.14000a244
add rbx, 2
movzx r11d, word [rbx]
lea rcx, [rsp + 0x20]
test r11w, r11w
mov word [rsp + 0x70], r11w
jne 0x14000d0c8
lea rdx, [rsp + 0x88]
or r8d, 0xffffffff
call fcn.14000a244
mov rax, qword [rsp + 0x20]
lea rdx, [0x140017850]
test rax, rax
mov rcx, rsi
cmovne rdx, rax
call fcn.14000cf78
lea rcx, [rsp + 0x20]
call fcn.14000a1bc
mov eax, dword [rbp + 0x44]
sub eax, 1
cmp edi, eax
jge 0x14000d154
lea rdx, [0x1400186fc]
mov rcx, rsi
call fcn.14000cf78
add edi, 1
add r12, 4
cmp edi, dword [rbp + 0x44]
jl 0x14000d037
lea rdx, [0x140018700]
mov rcx, rsi
mov rbx, qword [rsp + 0x78]
add rsp, 0x40
pop r13
pop r12
pop rdi
pop rsi
pop rbp
jmp fcn.14000cf78

Function at 0x14000d81c
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x230
mov rdi, rdx
mov rsi, rcx
lea rdx, str._item__r_n
mov rcx, rdi
mov r13, r8
call fcn.140008f50
xor r12d, r12d
cmp dword [rsi + 0x44], r12d
jle 0x14000d90d
xor ebp, ebp
and word [rsp + 0x30], 0
lea rcx, [rsp + 0x32]
xor edx, edx
mov r8d, 0x1fc
call sub.msvcrt.dll_memset
mov r11, qword [rsi + 0x48]
mov rax, qword [r13]
movsxd rbx, dword [r11 + rbp]
mov r8, qword [rsi + 0x88]
mov rcx, r13
mov edx, ebx
call qword [rax]
mov rcx, qword [rsi + 0x90]
mov rdx, rax
call fcn.140015238
mov r8, qword [rsi + 0x60]
lea rax, [rbx + rbx*2]
mov r8, qword [r8 + rax*8 + 0x10]
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.14000cd44
mov rax, qword [rsi + 0x90]
mov rcx, qword [rsi + 0x98]
lea r11, [rsp + 0x30]
lea r9, [rsp + 0x30]
lea r8, str.__s__s___s__r_n
mov qword [rsp + 0x28], r11
mov edx, 0x2000
mov qword [rsp + 0x20], rax
call sub.msvcrt.dll__snwprintf
mov rdx, qword [rsi + 0x98]
mov rcx, rdi
call fcn.140008f50
add r12d, 1
add rbp, 4
cmp r12d, dword [rsi + 0x44]
jl 0x14000d85e
lea rdx, str.__item__r_n
mov rcx, rdi
lea r11, [rsp + 0x230]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r13
pop r12
pop rdi
jmp fcn.140008f50
Function at 0x14000dc5c
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x40
mov ebp, r9d
mov esi, r8d
mov rbx, rdx
mov rdi, rcx
xor r12d, r12d
call fcn.14000c160
xor edx, edx
mov rcx, rbx
call fcn.140008f20
cmp rax, 0xffffffffffffffff
mov rbx, rax
je 0x14000de90
test ebp, ebp
jne 0x14000dccc
cmp esi, 4
je 0x14000dccc
and dword [rsp + 0x30], r12d
and qword [rsp + 0x20], r12
lea r9, [rsp + 0x30]
lea r8d, [r12 + 2]
lea rdx, [0x1400189d0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor ecx, ecx
mov edx, 0x7f02
lea r12d, [rcx + 1]
call qword [sym.imp.USER32.dll_LoadCursorW]
mov rcx, rax
call qword [sym.imp.USER32.dll_SetCursor]
cmp esi, 5
mov qword [0x14001c3a0], rax
je 0x14000dcf7
cmp esi, 6
jne 0x14000dd09
mov rax, qword [rdi]
mov r8d, esi
mov rdx, rbx
mov rcx, rdi
call qword [rax + 0xb0]
cmp esi, 7
jne 0x14000dd1a
mov rax, qword [rdi]
mov rdx, rbx
mov rcx, rdi
call qword [rax + 0x50]
cmp esi, 2
jne 0x14000dd7d
cmp dword [rdi + 0x354], 0
je 0x14000dd7d
xor ebp, ebp
cmp dword [rdi + 0x44], ebp
jle 0x14000dd6e
xor r13d, r13d
mov rax, qword [rdi + 0x48]
mov rdx, qword [rdi + 0x348]
movsxd rcx, dword [r13 + rax]
lea rax, [rcx + rcx*2]
mov rcx, rbx
mov rdx, qword [rdx + rax*8 + 0x10]
call fcn.140008f50
lea rdx, [0x140018708]
mov rcx, rbx
call fcn.140008f50
add ebp, r12d
add r13, 4
cmp ebp, dword [rdi + 0x44]
jl 0x14000dd32
lea rdx, [0x140018700]
mov rcx, rbx
call fcn.140008f50
mov rcx, qword [rdi + 0x2f8]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1004
call qword [sym.imp.USER32.dll_SendMessageW]
xor ebp, ebp
test eax, eax
mov r13, rax
jle 0x14000de4c
lea rdx, [rsp + 0x30]
mov r8d, ebp
mov rcx, rdi
call fcn.14000c58c
test eax, eax
je 0x14000de3c
cmp dword [rdi + 0x350], 0
mov rcx, qword [rdi + 0x2f8]
movsxd r8, ebp
mov edx, 0x102c
je 0x14000dde6
mov r9d, 0xf000
call qword [sym.imp.USER32.dll_SendMessageW]
shr eax, 0xc
sub eax, r12d
jmp 0x14000ddfb
mov r9d, 2
call qword [sym.imp.USER32.dll_SendMessageW]
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
cmp dword [rsp + 0x80], 0
je 0x14000de09
test eax, eax
je 0x14000de3c
mov rax, qword [rdi]
mov rdx, qword [rsp + 0x30]
mov r8d, ebp
mov rcx, rdi
call qword [rax + 0xe8]
test eax, eax
je 0x14000de3c
mov rax, qword [rdi]
mov r8, qword [rsp + 0x30]
mov r9d, esi
mov rdx, rbx
mov rcx, rdi
call qword [rax + 0x100]
test eax, eax
je 0x14000de49
add ebp, r12d
cmp ebp, r13d
jge 0x14000de4c
jmp 0x14000dda2
xor r12d, r12d
cmp esi, 5
je 0x14000de56
cmp esi, 6
jne 0x14000de68
mov rax, qword [rdi]
mov r8d, esi
mov rdx, rbx
mov rcx, rdi
call qword [rax + 0xa8]
cmp esi, 7
jne 0x14000de7a
mov r8, qword [rdi]
mov rdx, rbx
mov rcx, rdi
call qword [r8 + 0x58]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x14001c3a0]
call qword [sym.imp.USER32.dll_SetCursor]
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov eax, r12d
add rsp, 0x40
pop r13
pop r12
pop rdi
ret
Function at 0x14000e718
Capabilities:
Get file size
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
xor ebx, ebx
mov rdi, rcx
mov esi, r8d
mov dword [rcx], ebx
mov rcx, qword [rcx + 8]
mov rbp, rdx
cmp rcx, 0xffffffffffffffff
je 0x14000e74e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
or qword [rdi + 8], 0xffffffffffffffff
cmp esi, ebx
mov rcx, rbp
je 0x14000e7be
xor r9d, r9d
mov qword [rsp + 0x30], rbx
mov edx, 0xc0000000
lea r8d, [r9 + 1]
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 4
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [rdi], 1
cmp rax, 0xffffffffffffffff
mov qword [rdi + 8], rax
je 0x14000e7fb
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov rcx, qword [rdi + 8]
cmp eax, ebx
je 0x14000e7d8
mov r9d, 2
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov rcx, qword [rdi + 8]
lea rdx, str._r_n_r_n
call fcn.140008f50
jmp 0x14000e803
xor edx, edx
call fcn.140008f20
mov dword [rdi], 1
cmp rax, 0xffffffffffffffff
mov qword [rdi + 8], rax
je 0x14000e7fb
mov rcx, rax
lea rdx, [0x1400189d0]
lea r9, [rsp + 0x60]
mov r8d, 2
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x60], ebx
call qword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x14000e803
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x14000f384
Capabilities:
Get common file path
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r12
mov eax, 0x1820
call fcn.140015e80
sub rsp, rax
mov rsi, rcx
mov rcx, qword [rcx + 0x700]
or r12d, 0xffffffff
lea rdx, str._LogFile
mov r8d, r12d
xor edi, edi
call fcn.14000a79c
cmp eax, r12d
mov ebx, eax
jne 0x14000f3e9
mov rcx, qword [rsi + 0x700]
lea rdx, str._LogFileAppend
mov r8d, r12d
call fcn.14000a79c
mov ebx, eax
lea eax, [rdi + 1]
cmp ebx, r12d
cmovne edi, eax
test ebx, ebx
js 0x14000f4ff
and word [rsp + 0x20], 0
mov r12d, 0x7fe
lea rcx, [rsp + 0x22]
mov r8, r12
xor edx, edx
call sub.msvcrt.dll_memset
mov rcx, qword [rsi + 0x700]
lea edx, [rbx + 1]
call fcn.14000a770
lea rdx, [rsp + 0x20]
mov r8d, 0x3ff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea rcx, [rsp + 0x20]
mov dx, 0x5c
call sub.msvcrt.dll_wcschr
test rax, rax
jne 0x14000f4eb
and word [rsp + 0x820], ax
lea rcx, [rsp + 0x822]
mov r8, r12
xor edx, edx
call sub.msvcrt.dll_memset
and word [rsp + 0x1020], 0
lea rcx, [rsp + 0x1022]
mov r8, r12
xor edx, edx
call sub.msvcrt.dll_memset
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x820]
call fcn.140015ac4
mov esi, 0x104
lea rdx, [rsp + 0x1020]
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea rcx, [rsp + 0x1020]
call sub.msvcrt.dll_wcslen
lea rcx, [rsp + 0x820]
mov rbx, rax
call sub.msvcrt.dll_wcslen
lea rcx, [rbx + rax + 1]
cmp rcx, rsi
jae 0x14000f4e5
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x820]
lea rcx, [rsp + 0x1020]
call fcn.1400094ec
jmp 0x14000f4eb
and word [rsp + 0x20], 0
lea rdx, [rsp + 0x20]
lea rcx, [0x14001c350]
mov r8d, edi
call fcn.14000e718
lea r11, [rsp + 0x1820]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop r12
ret