joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140087f58
Capabilities:
Get graphical window text

Disassembly:
push rbx
sub rsp, 0x440
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rax, qword [0x1400e0920]
xor rax, rsp
mov qword [rsp + 0x430], rax
mov rcx, qword [0x1400fec08]
test rcx, rcx
je 0x140088076
mov r8d, 0x200
lea rdx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov eax, dword [0x140123d1c]
cmp eax, 8
je 0x140087fe9
lea rcx, [rsp + 0x30]
lea rdx, [0x1401242b0]
mov r9, rdx
sub r9, rcx
movzx r8d, word [rcx]
movzx r10d, word [rcx + r9]
sub r8d, r10d
jne 0x140087fd1
add rcx, 2
test r10d, r10d
jne 0x140087fba
test r8d, r8d
je 0x140087fe9
mov rcx, qword [0x1400fec08]
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov eax, dword [0x140123d1c]
test eax, eax
je 0x140087ffc
cmp eax, 1
je 0x140087ffc
cmp eax, 2
je 0x140087ffc
cmp eax, 8
jne 0x14008803a
lea r8, [0x1401241b0]
xor edx, edx
mov ecx, 0x9c
call fcn.140087c34
lea rcx, [0x140124bb0]
call fcn.140052af8
mov rbx, rax
lea rcx, [0x1401253b0]
call fcn.140052a60
mov rdx, rax
mov r8, rbx
mov ecx, 0x9b
call fcn.140087c34
mov eax, dword [0x1401257b4]
test al, 1
jne 0x140088054
or eax, 1
mov dword [0x1401257b4], eax
and dword [0x1401257b0], 0
mov edx, 0x64
lea rcx, [0x1401257b0]
call fcn.140046b64
test al, al
je 0x140088076
mov rcx, qword [0x1400fec08]
call qword [sym.imp.USER32.dll_UpdateWindow]
mov rcx, qword [rsp + 0x430]
xor rcx, rsp
call fcn.1400a86e0
add rsp, 0x440
pop rbx
ret

Function at 0x14008840c
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
sub rsp, 0x440
mov rax, qword [0x1400e0920]
xor rax, rsp
mov qword [rsp + 0x430], rax
mov rbx, rcx
mov dword [rcx], 0x3b8
mov rcx, qword [rcx + 8]
mov ebp, edx
mov esi, 0x200
lea rdx, [rsp + 0x30]
mov r8d, esi
call qword [sym.imp.USER32.dll_GetWindowTextW]
lea rcx, [rsp + 0x30]
mov edx, 0x40
call fcn.140047018
or r12, 0xffffffffffffffff
cmp word [0x140123cb0], 0
je 0x1400884d7
xor eax, eax
lea rdi, [rsp + 0x30]
mov rcx, r12
repne scasw ax, word [rdi]
mov eax, dword [0x1400c8754]
mov rcx, r12
mov dword [rdi - 2], eax
movzx eax, word [0x1400c8758]
mov word [rdi + 2], ax
xor eax, eax
lea rdi, [rsp + 0x30]
repne scasw ax, word [rdi]
not rcx
lea rdi, [rcx - 1]
mov ecx, 0x5aa
call fcn.140061d94
mov rdx, rsi
lea rcx, [rsp + rdi*2 + 0x30]
mov r9, rax
lea rax, [0x140123cb0]
lea r8, str._s:__s
sub rdx, rdi
mov qword [rsp + 0x20], rax
call fcn.1400287d0
cmp byte [0x140123d16], 0
je 0x140088535
xor eax, eax
lea rdi, [rsp + 0x30]
mov rcx, r12
repne scasw ax, word [rdi]
mov eax, dword [0x1400c8754]
mov rcx, r12
mov dword [rdi - 2], eax
movzx eax, word [0x1400c8758]
mov word [rdi + 2], ax
xor eax, eax
lea rdi, [rsp + 0x30]
repne scasw ax, word [rdi]
not rcx
lea rdi, [rcx - 1]
mov ecx, 0x2fd
call fcn.140061d94
sub rsi, rdi
lea rcx, [rsp + rdi*2 + 0x30]
mov r9d, ebp
mov rdx, rsi
mov r8, rax
call fcn.1400287d0
lea rcx, [rbx + 0x28]
lea rdx, [rsp + 0x30]
mov r8d, 0x80
call fcn.14006b658
mov rcx, qword [rsp + 0x430]
xor rcx, rsp
call fcn.1400a86e0
lea r11, [rsp + 0x440]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
Function at 0x14008abb8
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov r8d, dword [0x14010bc84]
lea rdi, str.ExtractionProfile
lea rdx, str.Overwrite
mov rcx, rdi
call fcn.14005c428
movzx r8d, byte [0x14010bca5]
lea rdx, [0x1400c8de0]
mov rcx, rdi
call fcn.14005c428
movzx r8d, byte [0x14010bca4]
lea rdx, str.Fresh
mov rcx, rdi
call fcn.14005c428
mov r8d, dword [0x14010bc84]
lea rdx, str.Overwrite
mov rcx, rdi
call fcn.14005c428
movzx r8d, byte [0x14010c299]
lea rdx, str.UnpToSubfolders
mov rcx, rdi
call fcn.14005c428
movzx r8d, byte [0x14010bcec]
lea rdx, str.KeepBroken
mov rcx, rdi
call fcn.14005c428
movzx r8d, byte [0x140126288]
lea rdx, str.ShowExplorer
mov rcx, rdi
call fcn.14005c428
mov r8d, dword [0x14010c29c]
lea rdx, str.mtime
mov rcx, rdi
call fcn.14005c428
mov r8d, dword [0x14010c2a0]
lea rdx, str.ctime
mov rcx, rdi
call fcn.14005c428
mov r8d, dword [0x14010c2a4]
lea rdx, str.atime
mov rcx, rdi
call fcn.14005c428
xor ebx, ebx
cmp dword [0x14010bca8], 2
mov r8d, ebx
lea rdx, str.PathsRel
mov rcx, rdi
sete r8b
call fcn.14005c428
cmp dword [0x14010bca8], ebx
mov r8d, ebx
lea rdx, str.PathsFull
mov rcx, rdi
sete r8b
call fcn.14005c428
cmp dword [0x14010bca8], 1
mov r8d, ebx
lea rdx, str.PathsNone
mov rcx, rdi
sete r8b
call fcn.14005c428
cmp dword [0x14010bca8], 4
mov r8d, ebx
lea rdx, str.PathsAbsDrive
mov rcx, rdi
sete r8b
call fcn.14005c428
movzx r8d, byte [0x14010bca0]
lea rdx, str.ClearArc
mov rcx, rdi
call fcn.14005c428
movzx r8d, byte [0x14010bce0]
lea rdx, str.ProcessOwners
mov rcx, rdi
call fcn.14005c428
movzx r8d, byte [0x14010bd76]
lea rdx, str.SetCompressedAttr
mov rcx, rdi
call fcn.14005c428
mov r8d, dword [0x14010d6cc]
lea rdx, str.ExtrDelArc
mov rcx, rdi
call fcn.14005c428
cmp byte [0x14010bcd5], bl
lea rdx, str.CheckAV
sete bl
mov rcx, rdi
mov r8d, ebx
call fcn.14005c428
movzx r8d, byte [0x14010d6bb]
lea rdx, [0x1400ca4d8]
mov rcx, rdi
call fcn.14005c428
movzx r8d, byte [0x14010d6bc]
lea rdx, str.WaitForOther
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.14005c428
Function at 0x14008b850
Capabilities:
Get common file path
Query environment variable

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x840
mov rax, qword [0x1400e0920]
xor rax, rsp
mov qword [rsp + 0x830], rax
xor r12d, r12d
mov sil, r9b
mov rbp, r8
mov rdi, rdx
mov rbx, rcx
cmp byte [rsp + 0x898], r12b
je 0x14008b906
mov r9, rdx
mov r8, rcx
lea rdx, str.DefFolder
lea rcx, str.Extraction
mov dword [rsp + 0x20], 0x400
call fcn.14005c464
mov rcx, rbx
cmp word [rbx], r12w
jne 0x14008b8c9
sub rcx, rdi
movzx eax, word [rdi]
mov word [rcx + rdi], ax
add rdi, 2
cmp ax, r12w
jne 0x14008b8b6
jmp 0x14008b90a
lea rdx, [rsp + 0x30]
mov r8d, 0x400
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea rax, [rsp + 0x30]
mov rdx, rbx
mov word [rsp + 0x82e], r12w
lea rcx, [rsp + 0x30]
sub rdx, rax
movzx eax, word [rcx]
mov word [rdx + rcx], ax
add rcx, 2
cmp ax, r12w
jne 0x14008b8f3
jmp 0x14008b90a
mov word [rcx], r12w
cmp word [rbx], r12w
setne dil
cmp word [rbx], r12w
jne 0x14008b926
mov rdx, rbx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov rcx, rbx
call fcn.140052588
cmp sil, r12b
jne 0x14008b93c
cmp dil, r12b
je 0x14008ba6f
lea rdx, str.AppendName
lea rcx, str.Extraction
mov r8d, 1
call fcn.14005c490
cmp eax, r12d
je 0x14008ba6f
lea rcx, [rsp + 0x30]
mov r8d, 0x400
mov rdx, rbp
call fcn.14006b658
mov rsi, r12
cmp word [rsp + 0x30], r12w
je 0x14008b9b9
mov rax, r12
lea rdi, [rsp + 0x30]
mov ebp, 0x25
cmp word [rdi], bp
jne 0x14008b9a7
lea rcx, [rsp + rax + 0x32]
mov edx, ebp
call fcn.1400a978c
cmp rax, r12
je 0x14008b9a7
mov eax, 0x5f
mov word [rdi], ax
inc rsi
lea rax, [rsi + rsi]
lea rdi, [rsp + rax + 0x30]
cmp word [rdi], r12w
jne 0x14008b989
lea rcx, [rsp + 0x30]
call fcn.140052af8
or rcx, 0xffffffffffffffff
mov rdi, rbx
mov r11, rax
xor eax, eax
repne scasw ax, word [rdi]
xor edx, edx
movzx ecx, word [r11 + rdx]
add rdx, 2
mov word [rdi + rdx - 4], cx
test cx, cx
jne 0x14008b9d4
mov rcx, rbx
call fcn.140052ebc
mov rdi, rax
cmp rax, r12
je 0x14008ba6f
cmp rax, rbx
jbe 0x14008ba6f
mov rcx, rbx
mov word [rax], r12w
call fcn.140052ebc
mov rsi, rax
cmp rax, r12
je 0x14008ba66
cmp rax, rbx
jbe 0x14008ba66
cmp byte [rsp + 0x890], r12b
je 0x14008ba42
cmp word [rdi + 2], r12w
je 0x14008ba42
movzx ecx, word [rdi + 4]
call fcn.14006b490
cmp al, r12b
jne 0x14008ba42
movzx ecx, word [rdi - 2]
call fcn.14006b490
cmp al, r12b
jne 0x14008ba56
lea rdx, str..tar
mov rcx, rsi
call fcn.140073f2c
cmp eax, r12d
jne 0x14008ba66
mov word [rsi], r12w
jmp 0x14008ba66
cmp word [rdi], 0x2e
jne 0x14008ba6f
mov word [rdi], r12w
sub rdi, 2
cmp rdi, rbx
ja 0x14008ba5c
xor edx, edx
mov rcx, rbx
call fcn.1400525c8
mov rcx, qword [rsp + 0x830]
xor rcx, rsp
call fcn.1400a86e0
add rsp, 0x840
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14008ba98
Capabilities:
Create process on windows

Disassembly:
push rdi
sub rsp, 0x850
mov rax, qword [0x1400e0920]
xor rax, rsp
mov qword [rsp + 0x840], rax
lea rdx, [rsp + 0x30]
call fcn.1400527bc
lea rcx, [rsp + 0x30]
call fcn.140052588
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x30]
lea r8, [rsp + 0x30]
lea rdx, str.open
repne scasw ax, word [rdi]
mov eax, dword [0x1400c4d00]
xor r9d, r9d
mov dword [rdi - 2], eax
lea rax, [0x1400c3f4c]
xor ecx, ecx
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rcx, qword [rsp + 0x840]
xor rcx, rsp
call fcn.1400a86e0
add rsp, 0x850
pop rdi
ret
Function at 0x14008f644
Capabilities:
Query environment variable

Disassembly:
push rbx
mov eax, 0x1100
call fcn.1400baa60
sub rsp, rax
mov rax, qword [0x1400e0920]
xor rax, rsp
mov qword [rsp + 0x10f0], rax
mov rbx, rcx
mov ecx, 0x6c
call fcn.140061d94
lea rcx, [rsp + 0x820]
mov r9, rbx
mov r8, rax
mov edx, 0x464
call fcn.1400287d0
jmp 0x14008f704
lea rdx, [rsp + 0x20]
mov r8d, 0x400
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x14008f6d7
lea rdx, [rsp + 0x20]
mov rax, rbx
sub rdx, rbx
movzx ecx, word [rax]
movzx r8d, word [rax + rdx]
sub ecx, r8d
jne 0x14008f6c5
add rax, 2
test r8d, r8d
jne 0x14008f6af
test ecx, ecx
je 0x14008f6d7
lea rcx, [rsp + 0x20]
call fcn.14008633c
test al, al
jne 0x14008f714
mov ecx, 0x66
call fcn.140061d94
mov rcx, qword [0x1400ffd80]
lea rdx, [rsp + 0x820]
mov r8, rax
mov r9d, 0x15
call qword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 2
je 0x14008f732
mov rcx, rbx
call fcn.14008633c
test al, al
je 0x14008f68c
lea rcx, [0x1401055a0]
call fcn.140042cc8
test al, al
je 0x14008f732
lea rcx, [0x1401055a0]
xor edx, edx
call fcn.1400433a8
mov rcx, qword [rsp + 0x10f0]
xor rcx, rsp
call fcn.1400a86e0
add rsp, 0x1100
pop rbx
ret
Function at 0x14008f74c
Capabilities:
Get file system object information

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push rdi
push r12
push r13
sub rsp, 0x340
mov rax, qword [0x1400e0920]
xor rax, rsp
mov qword [rsp + 0x338], rax
mov r9, qword [rcx + 0x38]
mov rbp, rcx
lea r8, [0x1400c3260]
lea rcx, [r11 - 0x38]
mov edx, 0xa
add r9, 0x41
call fcn.1400287d0
lea r8, [rsp + 0x60]
lea rcx, [rsp + 0x320]
mov r9d, 0x2b8
xor edx, edx
mov dword [rsp + 0x20], 0x301
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test byte [rbp + 0x10], 1
je 0x14008f7f8
mov ecx, 0xd
call qword [sym.imp.USER32.dll_GetSysColor]
mov rcx, qword [rbp + 0x20]
mov edx, eax
call qword [sym.imp.GDI32.dll_SetBkColor]
mov ecx, 0xe
mov r12d, eax
call qword [sym.imp.USER32.dll_GetSysColor]
mov rcx, qword [rbp + 0x20]
mov edx, eax
call qword [sym.imp.GDI32.dll_SetTextColor]
mov r13d, eax
jmp 0x14008f802
mov r12d, dword [rsp + 0x50]
mov r13d, dword [rsp + 0x50]
mov r8d, dword [rbp + 0x2c]
mov rcx, qword [rbp + 0x20]
xor edi, edi
mov qword [rsp + 0x38], rdi
lea rsi, [rbp + 0x28]
lea rax, [0x1400c3f4c]
mov edx, dword [rsi]
mov dword [rsp + 0x30], edi
mov qword [rsp + 0x28], rax
lea r9d, [rdi + 2]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.GDI32.dll_ExtTextOutW]
lea ecx, [rdi + 0x31]
call qword [sym.imp.USER32.dll_GetSystemMetrics]
lea ecx, [rdi + 0x32]
mov ebx, eax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov r9, qword [rsp + 0x60]
mov r8d, dword [rbp + 0x2c]
mov edx, dword [rsi]
mov rcx, qword [rbp + 0x20]
mov dword [rsp + 0x40], 3
mov qword [rsp + 0x38], rdi
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ebx
call qword [sym.imp.USER32.dll_DrawIconEx]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.USER32.dll_DestroyIcon]
mov r8d, dword [rbp + 0x2c]
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x70]
lea r9, [rsp + 0x70]
repne scasw ax, word [rdi]
mov eax, dword [rsi]
add r8d, 2
not rcx
lea edx, [rbx + rax + 7]
dec rcx
mov dword [rsp + 0x20], ecx
mov rcx, qword [rbp + 0x20]
call qword [sym.imp.GDI32.dll_TextOutW]
test byte [rbp + 0x10], 1
je 0x14008f8d8
mov rcx, qword [rbp + 0x20]
mov edx, r12d
call qword [sym.imp.GDI32.dll_SetBkColor]
mov rcx, qword [rbp + 0x20]
mov edx, r13d
call qword [sym.imp.GDI32.dll_SetTextColor]
mov rcx, qword [rsp + 0x338]
xor rcx, rsp
call fcn.1400a86e0
lea r11, [rsp + 0x340]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
Function at 0x140095e14
Capabilities:
Delete directory
Enumerate files on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
mov eax, 0x1a90
call fcn.1400baa60
sub rsp, rax
mov rax, qword [0x1400e0920]
xor rax, rsp
mov qword [rsp + 0x1a80], rax
xor r12d, r12d
mov bl, cl
mov dword [0x1400fec14], 1
cmp dl, r12b
je 0x140095fc4
lea rcx, [rsp + 0xa80]
mov edx, 0x400
call fcn.1400861fc
lea rcx, [rsp + 0xa80]
call fcn.140052588
lea r9, [rsp + 0xa80]
lea r8, str._sRar_
lea rcx, [rsp + 0x1280]
mov edx, 0x400
call fcn.1400287d0
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x1280]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x140095fbb
cmp dword [0x1400fec14], 1
jne 0x140095fbb
mov ecx, dword [rsp + 0x24]
sub ecx, dword [rsp + 0x38]
cmp ecx, 8
mov rcx, r12
setae sil
movzx eax, word [rsp + rcx + 0xa80]
add rcx, 2
mov word [rsp + rcx + 0x27e], ax
cmp ax, r12w
jne 0x140095eea
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x280]
repne scasw ax, word [rdi]
lea rdx, [rsp + 0x5c]
sub rdi, 2
xor ecx, ecx
movzx eax, word [rdx + rcx]
mov word [rdi + rcx], ax
add rcx, 2
test ax, ax
jne 0x140095f20
test byte [rsp + 0x30], 0x10
je 0x140095f97
lea rdx, str.Rar_DI
lea rcx, [rsp + 0x5c]
mov r8d, 6
call fcn.1400ab1b4
cmp eax, r12d
jne 0x140095f63
call fcn.14003ed2c
mov dil, 1
cmp eax, 0x400
jne 0x140095f66
mov dil, r12b
lea rcx, [rsp + 0x280]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
cmp eax, r12d
jne 0x140095fa4
cmp sil, r12b
je 0x140095f83
cmp bl, r12b
je 0x140095f88
cmp dil, r12b
je 0x140095fa4
lea rcx, [rsp + 0x280]
call fcn.140087284
jmp 0x140095fa4
lea rcx, [rsp + 0x280]
call fcn.140086fb4
lea rdx, [rsp + 0x30]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
cmp eax, r12d
jne 0x140095ecb
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindClose]
cmp bl, r12b
jne 0x140095ff0
cmp byte [0x1400ec040], r12b
je 0x140095ff0
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov cl, 1
call fcn.1400931bc
mov byte [0x1400ec040], al
mov dword [0x1400fec14], r12d
mov rcx, qword [rsp + 0x1a80]
xor rcx, rsp
call fcn.1400a86e0
lea r11, [rsp + 0x1a90]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret
Function at 0x140096b90
Capabilities:
Copy file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r12
mov eax, 0x20a0
call fcn.1400baa60
sub rsp, rax
mov rax, qword [0x1400e0920]
xor rax, rsp
mov qword [rsp + 0x2090], rax
xor esi, esi
cmp byte [0x1400fec05], sil
je 0x140096da5
lea rdx, [rsp + 0x870]
lea rcx, [0x140105fe0]
mov r8d, 0x401
call fcn.140012a08
lea r8d, [rsi + 1]
lea rdx, [0x1400c4b40]
lea rcx, [0x1400c40d8]
call fcn.14005c490
cmp eax, esi
setne bl
cmp bl, sil
je 0x140096c31
lea r9, [0x1400c3f4c]
lea r8, [rsp + 0x70]
lea rdx, str.SaveArcFolder
lea rcx, [0x1400c5f38]
mov dword [rsp + 0x20], 0x400
call fcn.14005c464
cmp word [rsp + 0x70], si
jne 0x140096c42
lea rcx, [rsp + 0x70]
call fcn.14003cff4
mov rcx, rsi
movzx eax, word [rsp + rcx + 0x70]
add rcx, 2
mov word [rsp + rcx + 0x107e], ax
cmp ax, si
jne 0x140096c45
lea rcx, [rsp + 0x1080]
call fcn.140052588
lea rcx, [rsp + 0x870]
call fcn.140052af8
or r12, 0xffffffffffffffff
lea rdi, [rsp + 0x1080]
mov r11, rax
xor eax, eax
mov rcx, r12
repne scasw ax, word [rdi]
xor edx, edx
movzx ecx, word [r11 + rdx]
add rdx, 2
mov word [rdi + rdx - 4], cx
test cx, cx
jne 0x140096c8e
mov ecx, 0x5af
call fcn.140061d94
mov rcx, qword [0x1400ffd80]
lea r8, [rsp + 0x1080]
mov rdx, rax
xor r9d, r9d
mov byte [rsp + 0x20], 1
call fcn.140019198
cmp al, sil
je 0x140096da5
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x1080]
mov r8d, 0x400
call fcn.140053040
cmp bl, sil
je 0x140096d08
lea r8, [rsp + 0x70]
lea rdx, str.SaveArcFolder
lea rcx, [0x1400c5f38]
call fcn.14005c410
xor eax, eax
lea rdi, [rsp + 0x870]
mov rcx, r12
repne scasw ax, word [rdi]
lea rdi, [rsp + 0x1080]
lea r8d, [rax + 0x38]
not rcx
xor edx, edx
mov word [rsp + rcx*2 + 0x870], si
mov rcx, r12
repne scasw ax, word [rdi]
not rcx
mov word [rsp + rcx*2 + 0x1080], si
lea rcx, [rsp + 0x30]
call fcn.1400a9314
lea rax, [rsp + 0x870]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x1080]
mov dword [rsp + 0x38], 2
mov qword [rsp + 0x48], rax
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
cmp eax, esi
je 0x140096da5
mov ecx, 0x5b0
call fcn.140061d94
mov r8, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rcx, rax
call fcn.140096028
lea rcx, [0x1400ec668]
call fcn.1400286f0
mov rcx, qword [rsp + 0x2090]
xor rcx, rsp
call fcn.1400a86e0
lea r11, [rsp + 0x20a0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop r12
ret
Function at 0x14009a048
Capabilities:
Copy file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
mov eax, 0x1890
call fcn.1400baa60
sub rsp, rax
mov rax, qword [0x1400e0920]
xor rax, rsp
mov qword [rsp + 0x1880], rax
lea rdx, str.AppDataCopied
lea rcx, [0x1400c40d8]
xor r8d, r8d
call fcn.14005c490
xor ebx, ebx
cmp eax, ebx
jne 0x14009a1d7
lea rdx, [rsp + 0x870]
mov r8d, 0x401
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rsp + 0x870]
lea rdi, [0x1400cc978]
call fcn.140052af8
movzx ecx, word [rdi]
add rdi, 2
mov word [rax], cx
add rax, 2
cmp cx, bx
jne 0x14009a0bc
lea rcx, [rsp + 0x1080]
call fcn.140053344
mov rdx, rbx
movzx eax, word [rsp + rdx + 0x1080]
add rdx, 2
mov word [rsp + rdx + 0x5e], ax
cmp ax, bx
jne 0x14009a0df
lea rcx, [rsp + 0x60]
call fcn.140052588
xor eax, eax
or rsi, 0xffffffffffffffff
lea rdi, [rsp + 0x60]
mov rcx, rsi
repne scasw ax, word [rdi]
mov rax, qword [0x1400cc978]
lea rcx, [rsp + 0x870]
mov qword [rdi - 2], rax
mov eax, dword [0x1400cc980]
mov dword [rdi + 6], eax
movzx eax, word [0x1400cc984]
mov word [rdi + 0xa], ax
call fcn.140031164
cmp al, bl
je 0x14009a1be
lea rcx, [rsp + 0x60]
call fcn.140031164
cmp al, bl
jne 0x14009a1be
xor eax, eax
lea rdi, [rsp + 0x870]
mov rcx, rsi
repne scasw ax, word [rdi]
lea rdi, [rsp + 0x60]
lea r8d, [rsi + 0x39]
not rcx
xor edx, edx
mov word [rsp + rcx*2 + 0x870], bx
mov rcx, rsi
repne scasw ax, word [rdi]
not rcx
mov word [rsp + rcx*2 + 0x60], bx
lea rcx, [rsp + 0x20]
call fcn.1400a9314
lea rax, [rsp + 0x870]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x60]
mov dword [rsp + 0x28], 2
mov qword [rsp + 0x38], rax
lea eax, [rsi + 0x15]
mov word [rsp + 0x40], ax
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
lea rdx, str.AppDataCopied
lea rcx, [0x1400c40d8]
mov r8d, 1
call fcn.14005c428
mov rcx, qword [rsp + 0x1880]
xor rcx, rsp
call fcn.1400a86e0
lea r11, [rsp + 0x1890]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x14009a1fc
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x470
mov rax, qword [0x1400e0920]
xor rax, rsp
mov qword [rsp + 0x460], rax
lea rcx, [rsp + 0x34]
mov dword [rsp + 0x30], 0x40100
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
lea r8, [rsp + 0x40]
lea rdx, str.VerInfo
lea rcx, [0x1400c40d8]
mov ebx, 0xc
xor r9d, r9d
mov dword [rsp + 0x20], ebx
call fcn.14005c4a8
lea rcx, [rsp + 0x60]
call fcn.1400532b0
lea rcx, [rsp + 0x60]
call fcn.140052fb0
and dword [rsp + 0x50], 0
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x60]
lea esi, [rbx - 0xb]
repne scasb al, byte [rdi]
mov rax, qword [str.version.dat]
lea rdx, [0x1400c378c]
sub rdi, rsi
lea rcx, [rsp + 0x60]
mov qword [rdi], rax
mov eax, dword [0x1400cc9b0]
mov dword [rdi + 8], eax
call fcn.1400abd74
mov rdi, rax
test rax, rax
je 0x14009a2ca
lea rcx, [rsp + 0x50]
mov r9, rax
mov r8, rbx
mov rdx, rsi
call fcn.1400aa184
mov rcx, rdi
call fcn.1400aa5c0
mov eax, dword [rsp + 0x30]
cmp dword [rsp + 0x40], eax
je 0x14009a371
mov r9, rbx
cmp dword [rsp + 0x50], eax
je 0x14009a339
lea r8, [rsp + 0x30]
lea rdx, str.VerInfo
lea rcx, [0x1400c40d8]
call fcn.14005c440
lea rdx, [0x1400c40f8]
lea rcx, [rsp + 0x60]
call fcn.1400abd74
mov rdi, rax
test rax, rax
je 0x14009a32d
lea rcx, [rsp + 0x30]
mov r9, rax
mov r8, rbx
mov rdx, rsi
call fcn.1400aa848
mov rcx, rdi
call fcn.1400aa5c0
and dword [0x1400fec1c], 0
jmp 0x14009a442
lea rcx, [rsp + 0x50]
lea rdx, [rsp + 0x40]
lea r8, [rsp + 0x50]
mov rax, qword [rcx]
mov qword [rdx], rax
mov eax, dword [rcx + 8]
lea rcx, [0x1400c40d8]
mov dword [rdx + 8], eax
lea rdx, str.VerInfo
call fcn.14005c440
mov eax, dword [rsp + 0x30]
cmp dword [rsp + 0x40], eax
jne 0x14009a3c1
cmp dword [rsp + 0x50], eax
je 0x14009a3c1
lea rcx, [rsp + 0x40]
lea rdx, [rsp + 0x50]
mov rax, qword [rcx]
mov qword [rdx], rax
mov eax, dword [rcx + 8]
lea rcx, [rsp + 0x60]
mov dword [rdx + 8], eax
lea rdx, [0x1400c40f8]
call fcn.1400abd74
mov rdi, rax
test rax, rax
je 0x14009a3c1
lea rcx, [rsp + 0x40]
mov r9, rax
mov r8, rbx
mov rdx, rsi
call fcn.1400aa848
mov rcx, rdi
call fcn.1400aa5c0
mov eax, dword [rsp + 0x48]
mov ecx, dword [rsp + 0x38]
sub rcx, rax
mov eax, dword [rsp + 0x44]
shl rcx, 0x20
sub rcx, rax
mov eax, dword [rsp + 0x34]
add rcx, rax
movabs rax, 0xd6bf94d5e57a42bd
imul rcx
add rdx, rcx
sar rdx, 0x17
mov rax, rdx
shr rax, 0x3f
add rdx, rax
movabs rax, 0x48d159e26af37c05
imul rdx
sar rdx, 0xa
mov rax, rdx
shr rax, 0x3f
add rdx, rax
movabs rax, 0x2aaaaaaaaaaaaaab
imul rdx
sar rdx, 2
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov eax, 0x168
test edx, edx
cmovs edx, eax
mov dword [0x1400fec1c], edx
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.1400a86e0
lea r11, [rsp + 0x470]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret