joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400ab314
Capabilities:
Write file on windows

Disassembly:
test rcx, rcx
je 0x1400ab3a3
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
lea rdx, [0x14016bb0e]
lea rcx, str.Rar_CM
mov r8d, 0x800
call fcn.1400b5c78
mov rsi, rax
test rax, rax
je 0x1400ab394
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasw ax, word [rdi]
lea edx, [rax + 2]
mov r9, rsi
not rcx
lea r8, [rcx - 1]
lea rdi, [rcx - 1]
mov rcx, rbx
call fcn.1400ef054
mov rcx, rsi
call fcn.1400eee40
mov edx, dword [0x14016cb10]
mov eax, 3
test rdi, rdi
cmovne edx, eax
mov dword [0x14016cb10], edx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1400ab6b8
Capabilities:
Get disk information
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
mov eax, 0x5460
call fcn.1400fe810
sub rsp, rax
mov rax, qword [0x140132350]
xor rax, rsp
mov qword [rsp + 0x5450], rax
mov rsi, rcx
mov rcx, rdx
mov rdi, rdx
call fcn.140050ce0
mov edx, 0x3a
mov rcx, rax
call fcn.1400ed378
xor ebp, ebp
cmp rax, rbp
je 0x1400ab741
cmp byte [0x140186610], bpl
jne 0x1400ab741
lea ecx, [rbp + 0x65]
call fcn.14005fad0
mov ecx, 0x528
mov rbx, rax
call fcn.14005fad0
lea r9d, [rbp + 0x31]
mov r8, rbx
mov rcx, rsi
mov rdx, rax
call qword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 1
jne 0x1400ab8f5
mov byte [0x140186610], al
lea rdx, [rsp + 0x1050]
mov rcx, rdi
sub rdx, rdi
movzx eax, word [rcx]
mov word [rdx + rcx], ax
add rcx, 2
cmp ax, bp
jne 0x1400ab74f
lea rcx, [rsp + 0x1050]
call fcn.140050fc0
mov ebx, 0x800
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x1050]
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea rcx, [rsp + 0x50]
mov word [rsp + 0x104e], bp
call fcn.140050ce0
cmp word [rax], bp
je 0x1400ab82e
jmp 0x1400ab81b
lea rcx, [rsp + 0x50]
xor edx, edx
call fcn.140082f74
cmp al, bpl
jne 0x1400ab82e
mov ecx, 0x14d
call fcn.14005fad0
lea r9, [rsp + 0x50]
lea r8, str.__s__n_s
lea rcx, [rsp + 0x4050]
mov edx, 0xa00
mov qword [rsp + 0x20], rax
call fcn.140057264
mov ecx, 0x65
call fcn.14005fad0
lea rdx, [rsp + 0x4050]
mov r9d, 0x34
mov r8, rax
mov rcx, rsi
call qword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x1400ab8f5
lea rcx, [rsp + 0x50]
xor edx, edx
call fcn.140042adc
lea rcx, [rsp + 0x50]
call fcn.140042584
cmp al, bpl
je 0x1400ab7a4
call fcn.140044e3c
cmp eax, 0x501
jb 0x1400ab8f9
lea r8, [rsp + 0x2050]
lea rcx, [0x140162bc0]
mov r9, rbx
mov rdx, rdi
call fcn.14008eb24
lea rdx, [rsp + 0x3050]
lea rcx, [rsp + 0x2050]
mov r8, rbx
call fcn.140051654
mov dword [rsp + 0x38], ebp
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x3050]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
cmp eax, ebp
je 0x1400ab8f9
bt dword [rsp + 0x40], 0x13
jae 0x1400ab8f9
mov ecx, 0x65e
call fcn.14005fad0
lea r9, [rsp + 0x3050]
lea rcx, [rsp + 0x4050]
mov r8, rax
mov edx, 0xa00
call fcn.140057264
mov ecx, 0x65
call fcn.14005fad0
lea rdx, [rsp + 0x4050]
mov r9d, 0x30
mov r8, rax
mov rcx, rsi
call qword [sym.imp.USER32.dll_MessageBoxW]
xor al, al
jmp 0x1400ab8fb
mov al, 1
mov rcx, qword [rsp + 0x5450]
xor rcx, rsp
call fcn.1400e9d00
mov rbx, qword [rsp + 0x5490]
add rsp, 0x5460
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400b507c
Capabilities:
Capture screenshot

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x80
mov rbx, rcx
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, rax
mov r14, rax
call qword [sym.imp.USER32.dll_GetDC]
mov rcx, rax
mov r13, rax
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov rcx, r13
mov r12, rax
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
lea r8, [rsp + 0x60]
mov edx, 0x20
mov rcx, rbx
mov rbp, rax
call qword [sym.imp.GDI32.dll_GetObjectW]
mov r8d, dword [rsp + 0x68]
mov edx, dword [rsp + 0x64]
mov rcx, r13
call qword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov rdx, rbx
mov rcx, r12
mov rsi, rax
call qword [sym.imp.GDI32.dll_SelectObject]
mov rdx, rsi
mov rcx, rbp
mov rdi, rax
call qword [sym.imp.GDI32.dll_SelectObject]
mov edx, dword [rsp + 0x68]
mov r9d, dword [rsp + 0x64]
mov dword [rsp + 0x50], 0xcc0020
mov dword [rsp + 0x48], edx
mov ecx, r9d
lea r8d, [r9 - 1]
neg ecx
mov rbx, rax
mov dword [rsp + 0x40], ecx
and dword [rsp + 0x38], 0
mov dword [rsp + 0x30], r8d
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], edx
xor r8d, r8d
xor edx, edx
mov rcx, rbp
call qword [sym.imp.GDI32.dll_StretchBlt]
mov eax, dword [rsp + 0x68]
mov r9d, dword [rsp + 0x64]
mov dword [rsp + 0x40], 0xcc0020
and dword [rsp + 0x38], 0
and dword [rsp + 0x30], 0
xor r8d, r8d
xor edx, edx
mov rcx, r12
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], eax
call qword [sym.imp.GDI32.dll_BitBlt]
mov rdx, rdi
mov rcx, r12
call qword [sym.imp.GDI32.dll_SelectObject]
mov rdx, rbx
mov rcx, rbp
call qword [sym.imp.GDI32.dll_SelectObject]
mov rcx, rsi
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, r12
call qword [sym.imp.GDI32.dll_DeleteDC]
mov rcx, rbp
call qword [sym.imp.GDI32.dll_DeleteDC]
mov rdx, r13
mov rcx, r14
call qword [sym.imp.USER32.dll_ReleaseDC]
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop r12
ret
Function at 0x1400b51e8
Capabilities:
Check if file exists
Get common file path
Get file attributes
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
mov eax, 0x1040
call fcn.1400fe810
sub rsp, rax
mov rax, qword [0x140132350]
xor rax, rsp
mov qword [rsp + 0x1030], rax
xor ebp, ebp
mov sil, r8b
mov rdi, rdx
mov rbx, rcx
cmp word [0x1401752e8], bp
je 0x1400b5237
mov r8, rdx
lea rdx, [0x1401752e8]
call fcn.140065d2c
jmp 0x1400b52de
mov dword [rsp + 0x20], edx
mov r8, rcx
lea r9, [0x1401096a0]
lea rdx, str.TempFolder
lea rcx, [0x14010ea48]
call fcn.14009b844
movzx eax, word [rbx]
mov word [rsp + 0x30], bp
cmp ax, bp
je 0x1400b5295
lea rdx, [rsp + 0x30]
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp eax, ebp
je 0x1400b528d
lea rdx, [rsp + 0x30]
mov r8, rdi
mov rcx, rbx
call fcn.140065d2c
mov ax, word [rbx]
cmp ax, bp
jne 0x1400b529f
cmp sil, bpl
je 0x1400b52ad
cmp ax, bp
je 0x1400b52de
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1400b52de
mov rdx, rbx
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp eax, ebp
je 0x1400b52c1
cmp word [rbx], bp
jne 0x1400b52de
lea rcx, str._rartemp
mov rdx, rbx
sub rdx, rcx
movzx eax, word [rcx]
mov word [rdx + rcx], ax
add rcx, 2
cmp ax, bp
jne 0x1400b52ce
mov rdx, rdi
mov rcx, rbx
call fcn.1400504d4
mov rcx, qword [rsp + 0x1030]
xor rcx, rsp
call fcn.1400e9d00
mov rbx, qword [rsp + 0x1070]
add rsp, 0x1040
pop rdi
pop rsi
pop rbp
ret

Function at 0x1400b530c
Capabilities:
Get disk information

Disassembly:
push rbx
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
lea rdx, str.NoDrives
lea rcx, str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
xor r8d, r8d
mov ebx, eax
call fcn.14009b870
not eax
and eax, ebx
add rsp, 0x20
pop rbx
ret
Function at 0x1400b5d58
Capabilities:
Create directory

Disassembly:
push rbx
push rsi
push rdi
mov eax, 0x2030
call fcn.1400fe810
sub rsp, rax
mov rax, qword [0x140132350]
xor rax, rsp
mov qword [rsp + 0x2020], rax
mov rbx, rdx
mov rdx, rcx
mov rsi, r8
lea rcx, [rsp + 0x1020]
mov r8d, 0x7ff
mov dil, r9b
call fcn.140065d2c
test dil, dil
je 0x1400b5df2
cmp byte [0x140165370], 0
jne 0x1400b5db5
cmp byte [0x1401652bb], 0
jne 0x1400b5db5
xor eax, eax
jmp 0x1400b5dba
mov eax, 1
xor r9d, r9d
test al, al
lea rdi, [rsp + 0x1020]
setne r9b
or rcx, 0xffffffffffffffff
xor eax, eax
repne scasw ax, word [rdi]
lea r8, [0x140115090]
lea edx, [rax + 2]
not rcx
add r9d, 0x61
lea rcx, [rsp + rcx*2 + 0x101e]
call fcn.140057264
mov edi, 0x800
lea rcx, [rsp + 0x20]
xor r8d, r8d
mov rdx, rdi
call fcn.1400b51e8
lea rcx, [rsp + 0x20]
mov rdx, rdi
call fcn.1400504d4
lea rdx, [rsp + 0x1020]
lea rcx, [rsp + 0x20]
mov r8, rdi
call fcn.140065dac
lea rcx, [rsp + 0x20]
mov rdx, rdi
call fcn.140042db4
test rax, rax
je 0x1400b5e60
lea rcx, [rsp + 0x20]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x1400b5e60
lea rdx, [rsp + 0x20]
mov r8, rsi
mov rcx, rbx
call fcn.140065d2c
mov al, 1
jmp 0x1400b5e85
mov ecx, 0x1f7
call fcn.14005fad0
lea rdx, [rsp + 0x20]
mov rcx, rax
call fcn.1400c5808
lea rcx, [0x140149f00]
call fcn.14003c5cc
xor al, al
mov rcx, qword [rsp + 0x2020]
xor rcx, rsp
call fcn.1400e9d00
add rsp, 0x2030
pop rdi
pop rsi
pop rbx
ret

Function at 0x1400b6708
Capabilities:
Set current directory

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
xor ecx, ecx
cmp eax, ecx
setne al
add rsp, 0x28
ret

Function at 0x1400b6720
Capabilities:
Set current directory

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
setne bl
test bl, bl
jne 0x1400b675d
mov ecx, 0x627
call fcn.14005fad0
mov rdx, rdi
mov rcx, rax
call fcn.1400c5808
lea rcx, [0x140149f00]
call fcn.14003c5cc
mov al, bl
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1400b676c
Capabilities:
Get common file path

Disassembly:
sub rsp, 0x28
mov rax, rdx
mov rdx, rcx
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
xor ecx, ecx
cmp eax, ecx
setne al
add rsp, 0x28
ret

Function at 0x1400b740c
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
mov eax, 0x1430
call fcn.1400fe810
sub rsp, rax
mov rax, qword [0x140132350]
xor rax, rsp
mov qword [rsp + 0x1420], rax
mov rbx, rdx
mov edx, ecx
mov rcx, qword [0x1401561a8]
call qword [sym.imp.USER32.dll_GetDlgItem]
lea rdx, [rsp + 0x20]
mov r8d, 0xa00
mov rcx, rax
mov rdi, rax
call qword [sym.imp.USER32.dll_GetWindowTextW]
lea r9, [rsp + 0x20]
mov r11, rbx
sub r9, rbx
movzx ecx, word [r11]
movzx r8d, word [r11 + r9]
sub ecx, r8d
jne 0x1400b747c
add r11, 2
test r8d, r8d
jne 0x1400b7465
test ecx, ecx
je 0x1400b748c
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov rcx, qword [rsp + 0x1420]
xor rcx, rsp
call fcn.1400e9d00
mov rbx, qword [rsp + 0x1450]
add rsp, 0x1430
pop rdi
ret
Function at 0x1400b77a8
Capabilities:
Get graphical window text

Disassembly:
sub rsp, 0x448
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rax, qword [0x140132350]
xor rax, rsp
mov qword [rsp + 0x430], rax
mov rcx, qword [0x1401561a8]
test rcx, rcx
je 0x1400b78b0
mov r8d, 0x200
lea rdx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov eax, dword [0x14018796c]
cmp eax, 9
je 0x1400b7837
lea rcx, [rsp + 0x30]
lea rdx, [0x140187f60]
mov r9, rdx
sub r9, rcx
movzx r8d, word [rcx]
movzx r10d, word [rcx + r9]
sub r8d, r10d
jne 0x1400b781f
add rcx, 2
test r10d, r10d
jne 0x1400b7808
test r8d, r8d
je 0x1400b7837
mov rcx, qword [0x1401561a8]
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov eax, dword [0x14018796c]
test eax, eax
je 0x1400b784a
cmp eax, 1
je 0x1400b784a
cmp eax, 2
je 0x1400b784a
cmp eax, 9
jne 0x1400b7874
lea rdx, [0x140187e60]
mov ecx, 0x9c
call fcn.1400b740c
lea rcx, [0x140189060]
call fcn.140050ce0
mov rdx, rax
mov ecx, 0x9b
call fcn.1400b740c
mov eax, dword [0x14018a06c]
test al, 1
jne 0x1400b788e
or eax, 1
mov dword [0x14018a06c], eax
and dword [0x14018a068], 0
mov edx, reloc.SHELL32.dll_SHRestricted
lea rcx, [0x14018a068]
call fcn.14009629c
test al, al
je 0x1400b78b0
mov rcx, qword [0x1401561a8]
call qword [sym.imp.USER32.dll_UpdateWindow]
mov rcx, qword [rsp + 0x430]
xor rcx, rsp
call fcn.1400e9d00
add rsp, 0x448
ret

Function at 0x1400b7c9c
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
sub rsp, 0x440
mov rax, qword [0x140132350]
xor rax, rsp
mov qword [rsp + 0x430], rax
mov rbx, rcx
mov dword [rcx], 0x3c8
mov rcx, qword [rcx + 8]
mov ebp, edx
mov esi, 0x200
lea rdx, [rsp + 0x30]
mov r8d, esi
call qword [sym.imp.USER32.dll_GetWindowTextW]
lea rcx, [rsp + 0x30]
mov edx, 0x40
call fcn.1400965c8
or r12, 0xffffffffffffffff
cmp word [0x140187970], 0
je 0x1400b7d67
xor eax, eax
lea rdi, [rsp + 0x30]
mov rcx, r12
repne scasw ax, word [rdi]
mov eax, dword [0x14010d2b8]
mov rcx, r12
mov dword [rdi - 2], eax
movzx eax, word [0x14010d2bc]
mov word [rdi + 2], ax
xor eax, eax
lea rdi, [rsp + 0x30]
repne scasw ax, word [rdi]
not rcx
lea rdi, [rcx - 1]
mov ecx, 0x5aa
call fcn.14005fad0
mov rdx, rsi
lea rcx, [rsp + rdi*2 + 0x30]
mov r9, rax
lea rax, [0x140187970]
lea r8, str._s:__s
sub rdx, rdi
mov qword [rsp + 0x20], rax
call fcn.140057264
cmp byte [0x14018773c], 0
je 0x1400b7dc5
xor eax, eax
lea rdi, [rsp + 0x30]
mov rcx, r12
repne scasw ax, word [rdi]
mov eax, dword [0x14010d2b8]
mov rcx, r12
mov dword [rdi - 2], eax
movzx eax, word [0x14010d2bc]
mov word [rdi + 2], ax
xor eax, eax
lea rdi, [rsp + 0x30]
repne scasw ax, word [rdi]
not rcx
lea rdi, [rcx - 1]
mov ecx, 0x2fd
call fcn.14005fad0
sub rsi, rdi
lea rcx, [rsp + rdi*2 + 0x30]
mov r9d, ebp
mov rdx, rsi
mov r8, rax
call fcn.140057264
lea rcx, [rbx + 0x28]
lea rdx, [rsp + 0x30]
mov r8d, 0x80
call fcn.140065d2c
mov rcx, qword [rsp + 0x430]
xor rcx, rsp
call fcn.1400e9d00
lea r11, [rsp + 0x440]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
Function at 0x1400ba2f8
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov r8d, dword [0x14016ec2c]
lea rdi, str.ExtractionProfile
lea rdx, str.Overwrite
mov rcx, rdi
call fcn.14009b808
movzx r8d, byte [0x14016ec50]
lea rdx, [0x140112ee8]
mov rcx, rdi
call fcn.14009b808
movzx r8d, byte [0x14016ec4f]
lea rdx, str.Fresh
mov rcx, rdi
call fcn.14009b808
mov r8d, dword [0x14016ec2c]
lea rdx, str.Overwrite
mov rcx, rdi
call fcn.14009b808
movzx r8d, byte [0x14016feb0]
lea rdx, str.UnpToSubfolders
mov rcx, rdi
call fcn.14009b808
movzx r8d, byte [0x14016eca4]
lea rdx, str.KeepBroken
mov rcx, rdi
call fcn.14009b808
movzx r8d, byte [0x14018b338]
lea rdx, str.ShowExplorer
mov rcx, rdi
call fcn.14009b808
mov r8d, dword [0x14016feb4]
lea rdx, str.mtime
mov rcx, rdi
call fcn.14009b808
mov r8d, dword [0x14016feb8]
lea rdx, str.ctime
mov rcx, rdi
call fcn.14009b808
mov r8d, dword [0x14016febc]
lea rdx, str.atime
mov rcx, rdi
call fcn.14009b808
xor ebx, ebx
cmp dword [0x14016ec54], 2
mov r8d, ebx
lea rdx, str.PathsRel
mov rcx, rdi
sete r8b
call fcn.14009b808
cmp dword [0x14016ec54], ebx
mov r8d, ebx
lea rdx, str.PathsFull
mov rcx, rdi
sete r8b
call fcn.14009b808
cmp dword [0x14016ec54], 1
mov r8d, ebx
lea rdx, str.PathsNone
mov rcx, rdi
sete r8b
call fcn.14009b808
cmp dword [0x14016ec54], 4
lea rdx, str.PathsAbsDrive
sete bl
mov rcx, rdi
mov r8d, ebx
call fcn.14009b808
movzx r8d, byte [0x14016ec4c]
lea rdx, str.ClearArc
mov rcx, rdi
call fcn.14009b808
movzx r8d, byte [0x14016ec98]
lea rdx, str.ProcessOwners
mov rcx, rdi
call fcn.14009b808
movzx r8d, byte [0x14016edc5]
lea rdx, str.SetCompressedAttr
mov rcx, rdi
call fcn.14009b808
mov r8d, dword [0x140172ef4]
lea rdx, str.ExtrDelArc
mov rcx, rdi
call fcn.14009b808
movzx r8d, byte [0x140172edb]
lea rdx, [0x140114818]
mov rcx, rdi
call fcn.14009b808
movzx r8d, byte [0x140172edc]
lea rdx, str.WaitForOther
mov rcx, rdi
call fcn.14009b808
movzx r8d, byte [0x14016ec9b]
lea rdx, str.AbsoluteLinks
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.14009b808
Function at 0x1400baf9c
Capabilities:
Query environment variable

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
mov eax, 0x1048
call fcn.1400fe810
sub rsp, rax
mov rax, qword [0x140132350]
xor rax, rsp
mov qword [rsp + 0x1030], rax
xor r12d, r12d
mov rsi, r9
mov rbx, r8
mov rbp, rdx
mov rdi, rcx
mov r13d, 0x800
cmp byte [rsp + 0x10b0], r12b
je 0x1400bb047
mov r8, rcx
lea rdx, str.DefFolder
lea rcx, str.Extraction
mov r9, rbx
mov dword [rsp + 0x20], r13d
call fcn.14009b844
mov rcx, rdi
cmp word [rdi], r12w
jne 0x1400bb020
sub rcx, rbx
movzx eax, word [rbx]
mov word [rcx + rbx], ax
add rbx, 2
cmp ax, r12w
jne 0x1400bb00d
jmp 0x1400bb047
lea rdx, [rsp + 0x30]
mov r8d, r13d
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea rdx, [rsp + 0x30]
mov r8, rbp
mov rcx, rdi
mov word [rsp + 0x102e], r12w
call fcn.140065d2c
cmp word [rdi], r12w
setne bl
cmp word [rdi], r12w
jne 0x1400bb066
lea rcx, [0x140162bc0]
mov r8, rbp
mov rdx, rdi
call fcn.14008eaf0
mov rdx, rbp
mov rcx, rdi
call fcn.1400504d4
cmp byte [rsp + 0x10a0], r12b
jne 0x1400bb084
cmp bl, r12b
je 0x1400bb1a1
lea rdx, str.AppendName
lea rcx, str.Extraction
mov r8d, 1
call fcn.14009b870
cmp eax, r12d
je 0x1400bb1a1
lea rcx, [rsp + 0x30]
mov r8, r13
mov rdx, rsi
call fcn.140065d2c
mov rsi, r12
cmp word [rsp + 0x30], r12w
je 0x1400bb101
mov rax, r12
lea rbx, [rsp + 0x30]
mov r13d, 0x25
cmp word [rbx], r13w
jne 0x1400bb0ef
lea rcx, [rsp + rax + 0x32]
mov edx, r13d
call fcn.1400ed378
cmp rax, r12
je 0x1400bb0ef
mov eax, 0x5f
mov word [rbx], ax
inc rsi
lea rax, [rsi + rsi]
lea rbx, [rsp + rax + 0x30]
cmp word [rbx], r12w
jne 0x1400bb0cf
lea rcx, [rsp + 0x30]
call fcn.140050ce0
mov r8, rbp
mov rcx, rdi
mov rdx, rax
call fcn.140065dac
mov rcx, rdi
call fcn.140050efc
mov rbx, rax
cmp rax, r12
je 0x1400bb1a1
cmp rax, rdi
jbe 0x1400bb1a1
mov rcx, rdi
mov word [rax], r12w
call fcn.140050efc
mov rsi, rax
cmp rax, r12
je 0x1400bb198
cmp rax, rdi
jbe 0x1400bb198
cmp byte [rsp + 0x10a8], r12b
je 0x1400bb174
cmp word [rbx + 2], r12w
je 0x1400bb174
movzx ecx, word [rbx + 4]
call fcn.140065a08
cmp al, r12b
jne 0x1400bb174
movzx ecx, word [rbx - 2]
call fcn.140065a08
cmp al, r12b
jne 0x1400bb188
lea rdx, str..tar
mov rcx, rsi
call fcn.140068ca4
cmp eax, r12d
jne 0x1400bb198
mov word [rsi], r12w
jmp 0x1400bb198
cmp word [rbx], 0x2e
jne 0x1400bb1a1
mov word [rbx], r12w
sub rbx, 2
cmp rbx, rdi
ja 0x1400bb18e
mov rcx, rdi
call fcn.1400b53ac
xor edx, edx
mov rcx, rdi
call fcn.140050714
mov rcx, qword [rsp + 0x1030]
xor rcx, rsp
call fcn.1400e9d00
add rsp, 0x1048
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400bb1d4
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x1058
call fcn.1400fe810
sub rsp, rax
mov rax, qword [0x140132350]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov rdx, rcx
lea r8, [rsp + 0x30]
lea rcx, [0x140162bc0]
mov r9d, 0x800
call fcn.14008eb24
lea rcx, [rsp + 0x30]
mov edx, 0x802
call fcn.1400504d4
lea rdx, [0x1401098d8]
lea rcx, [rsp + 0x30]
mov r8d, 0x802
call fcn.140065dac
lea rax, [0x1401096a0]
lea r8, [rsp + 0x30]
lea rdx, str.open
xor r9d, r9d
xor ecx, ecx
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.1400e9d00
add rsp, 0x1058
ret

Function at 0x1400bcf8c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x20
xor ebx, ebx
mov rsi, rdx
mov rbp, rcx
mov byte [rdx], bl
call fcn.140050ce0
lea r12d, [rbx + 3]
lea rdx, [0x140115668]
mov r8, r12
mov rcx, rax
mov rdi, rax
call fcn.140068cd4
cmp eax, ebx
je 0x1400bcfe7
lea rdx, [0x140115660]
mov r8, r12
mov rcx, rdi
call fcn.140068cd4
cmp eax, ebx
jne 0x1400bd009
movzx ecx, word [rdi + 6]
call fcn.1400efc80
cmp eax, ebx
je 0x1400bd009
cmp word [rdi + 8], 0x2e
je 0x1400bd08f
cmp word [rdi + 8], bx
je 0x1400bd08f
lea rdx, [0x140115658]
mov r8, r12
mov rcx, rdi
call fcn.140068cd4
cmp eax, ebx
je 0x1400bd061
lea rdx, [0x140115650]
mov r8, r12
mov rcx, rdi
call fcn.140068cd4
cmp eax, ebx
je 0x1400bd061
lea rdx, [0x140115648]
mov r8, r12
mov rcx, rdi
call fcn.140068cd4
cmp eax, ebx
je 0x1400bd061
lea rdx, [0x14010c928]
mov r8, r12
mov rcx, rdi
call fcn.140068cd4
cmp eax, ebx
jne 0x1400bd06e
cmp word [rdi + 6], 0x2e
je 0x1400bd08f
cmp word [rdi + 6], bx
je 0x1400bd08f
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1400bd096
mov rcx, rbp
call fcn.140042584
cmp al, bl
je 0x1400bd096
mov ebx, 1
jmp 0x1400bd096
mov ebx, 1
mov byte [rsi], bl
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov al, bl
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop r12
ret
Function at 0x1400bd0b4
Capabilities:
Get file system object information

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
mov eax, 0x3668
call fcn.1400fe810
sub rsp, rax
mov rax, qword [0x140132350]
xor rax, rsp
mov qword [rsp + 0x3650], rax
cmp dword [0x140131018], 0xffffffff
mov rbp, r9
mov bl, r8b
mov rdi, rdx
mov rsi, rcx
mov r12d, 0x800
jne 0x1400bd173
lea r8, [rsp + 0xd0]
lea rcx, [0x1401098d8]
mov r9d, 0x2b8
xor edx, edx
mov dword [rsp + 0x20], 0x4001
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov r11d, dword [rsp + 0xd8]
lea rdx, [rsp + 0x2650]
mov r8d, r12d
xor ecx, ecx
mov dword [0x14018f630], r11d
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea r8, [rsp + 0xd0]
lea rcx, [rsp + 0x2650]
mov r9d, 0x2b8
xor edx, edx
mov dword [rsp + 0x20], 0x4001
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov r11d, dword [rsp + 0xd8]
mov dword [0x140131018], r11d
lea rcx, [rsp + 0x650]
mov r8, r12
mov rdx, rdi
call fcn.140065d2c
lea rdx, [rsp + 0x650]
lea rcx, [rsp + 0x650]
mov r8, r12
call fcn.140050830
xor r13d, r13d
lea rax, [rsp + 0x650]
cmp word [rsi], r13w
mov dword [rsp + 0x30], 3
mov dword [rsp + 0x34], 0x40000000
setne dil
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x48], rax
mov r9d, 0x2b8
lea r8, [rsp + 0x390]
lea rcx, [rsp + 0x650]
cmp dil, r13b
je 0x1400bd1f7
neg bl
mov dword [rsp + 0x20], 0x4011
sbb edx, edx
and edx, 0x10
jmp 0x1400bd201
mov dword [rsp + 0x20], 0x4001
xor edx, edx
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov eax, dword [rsp + 0x398]
mov r8, r12
lea rcx, [rsp + 0x1650]
mov dword [rsp + 0x54], eax
cmp dil, r13b
je 0x1400bd22c
mov rdx, rsi
call fcn.140065d2c
jmp 0x1400bd258
lea rdx, [rsp + 0x650]
call fcn.140065d2c
lea rcx, [rsp + 0x1650]
call fcn.140050fc0
lea rcx, [rsp + 0x650]
call fcn.140050ce0
mov qword [rsp + 0x48], rax
mov rcx, qword [0x1401561a8]
mov edx, 0x66
call qword [sym.imp.USER32.dll_GetDlgItem]
lea r9, [rsp + 0x30]
xor r8d, r8d
mov rcx, rax
mov edx, 0x104d
mov rsi, rax
call qword [sym.imp.USER32.dll_SendMessageW]
mov edx, dword [0x14018f630]
cmp dil, r13b
cmovne edx, dword [0x140131018]
mov rbx, rax
mov dword [rsp + 0x34], eax
lea rax, [rsp + 0x1650]
mov dword [rsp + 0x54], edx
lea r9, [rsp + 0x30]
mov r12d, 1
mov edx, 0x104c
xor r8d, r8d
mov rcx, rsi
mov dword [rsp + 0x30], 3
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x38], r12d
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, rbp
mov dword [rsp + 0x88], 2
call fcn.140065ee0
lea r9, [rsp + 0x80]
movsxd r8, ebx
mov edx, 0x1074
mov rcx, rsi
mov qword [rsp + 0x98], rax
call qword [sym.imp.USER32.dll_SendMessageW]
cmp ebx, r13d
jne 0x1400bd336
lea r9, [rsp + 0x80]
xor r8d, r8d
mov edx, 0x102b
mov rcx, rsi
mov dword [rsp + 0x90], r12d
mov dword [rsp + 0x8c], r12d
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rsp + 0x3650]
xor rcx, rsp
call fcn.1400e9d00
add rsp, 0x3668
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret