joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001074
Capabilities:
Check if file exists
Get file attributes
Print debug messages

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rsi, rcx
lea rdx, [0x1401f49e8]
call fcn.140002bce
lea rdx, str.EBWebViewx64EmbeddedBrowserWebView.dll
mov rcx, rsi
call fcn.140002bce
mov rcx, rsi
call fcn.140002ce4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14000111e
mov rcx, rsi
call fcn.140002ce4
mov rsi, rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
mov rcx, rax
mov edx, 0x100021
mov r8d, 7
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x1400010fc
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x140001120
lea rcx, str.WebView2:_skipped_inaccessible
mov rdi, qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rcx, [0x1401f4a4e]
call rdi
xor eax, eax
add rsp, 0x38
pop rdi
pop rsi
ret

Function at 0x1400011f4
Capabilities:
Print debug messages

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x140231ec8]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov edx, 0x104
mov rcx, rsi
call fcn.140002a5e
mov rcx, rsi
mov rdx, rdi
call fcn.140002aee
mov rcx, rsi
call fcn.140002ce4
mov rbx, rax
mov rcx, rsi
call fcn.140002ca0
cmp rax, 3
jb 0x140001278
movzx eax, word [rbx + 2]
cmp ax, 0x3a
jne 0x140001268
cmp word [rbx + 4], 0x5c
jne 0x140001278
movzx eax, word [rbx]
and eax, 0xffffffdf
add eax, 0xffffffbf
cmp ax, 0x1a
jae 0x140001278
jmp 0x140001335
cmp ax, 0x5c
jne 0x140001278
cmp word [rbx], 0x5c
je 0x140001335
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rbx, [rsp + 0x20]
mov qword [rbx + 0x10], rax
movaps xmm0, xmmword [0x1401f4650]
movaps xmmword [rbx], xmm0
mov rcx, rbx
call fcn.1400029f0
xor ecx, ecx
mov rdx, rbx
call fcn.140001127
test eax, eax
js 0x140001374
lea rbx, [rsp + 0x20]
mov rcx, rbx
call fcn.140002ca0
mov r14, rax
mov rcx, rbx
call fcn.140002ce4
mov rcx, rsi
mov rdx, rax
mov r8, r14
call fcn.140002b20
mov rcx, rbx
call fcn.140002ce4
mov rcx, rax
mov dx, 0x5c
call fcn.1401b2e40
test rax, rax
je 0x140001385
mov rbx, rax
lea r14, [rsp + 0x20]
mov rcx, r14
call fcn.140002ce4
sub rbx, rax
add rbx, 2
sar rbx, 1
mov rcx, r14
call fcn.140002ce4
mov rcx, rsi
mov rdx, rax
mov r8, rbx
call fcn.140002b20
mov rcx, rsi
mov rdx, rdi
call fcn.140002bce
mov rcx, r14
call fcn.140002a02
mov rcx, rsi
call fcn.140001074
xor ebx, ebx
test al, al
jne 0x140001394
lea rcx, str.WebView2:_Failed_to_find_the_WebView2_client_dll_at:
mov rdi, qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call rdi
mov rcx, rsi
call fcn.140002ce4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rcx, [0x1401f4a4e]
call rdi
mov ebx, 0x80070002
jmp 0x140001394
mov ebx, eax
lea rcx, str.WebView2:_Failed_to_find_the_app_exe_path._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x14000138a
mov ebx, 0x80004005
lea rcx, [rsp + 0x20]
call fcn.140002a02
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1401afad0
mov eax, ebx
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x140002653
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x260
mov rsi, r9
mov edi, r8d
mov ebx, edx
mov r15, rcx
mov rax, qword [0x140231ec8]
xor rax, rsp
mov qword [rsp + 0x258], rax
lea r14, [rsp + 0x50]
mov r8d, 0x208
mov rcx, r14
mov dl, 0xaa
call fcn.1401b2770
mov dword [rsp + 0x3c], 0x104
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rdx, [rsp + 0x30]
mov qword [rdx], rax
movzx eax, dil
mov rcx, 0xffffffff80000002
sub rcx, rax
mov qword [rsp + 0x20], rdx
xor ebp, ebp
mov rdx, r15
xor r8d, r8d
mov r9d, 0x20219
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1400026ff
mov rcx, qword [rsp + 0x258]
xor rcx, rsp
call fcn.1401afad0
mov eax, ebp
add rsp, 0x260
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov rdi, qword [rsp + 0x2c0]
lea rax, str.location
lea rdx, str.EBWebView
test bl, bl
cmovne rdx, rax
mov rcx, qword [rsp + 0x30]
lea r12, [rsp + 0x3c]
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r14
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r14d, eax
test eax, eax
jne 0x1400027b7
cmp dword [rsp + 0x3c], 3
jb 0x1400027b7
lea r15, [rsp + 0x50]
mov rcx, rdi
mov rdx, r15
call fcn.140002aee
xor r14d, r14d
test bl, bl
je 0x1400027b7
mov dword [rsp + 0x3c], 0x104
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r15
lea rdx, [0x1401f4e22]
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r14d, eax
test eax, eax
jne 0x1400027b7
cmp dword [rsp + 0x3c], 3
jb 0x1400027b7
lea rdx, [0x1401f49e8]
mov rcx, rdi
call fcn.140002bce
lea rdx, [rsp + 0x50]
mov rcx, rdi
call fcn.140002bce
xor r14d, r14d
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebp, ebp
test r14d, r14d
jne 0x1400026db
cmp dword [rsp + 0x3c], 3
jb 0x1400026db
mov rcx, rdi
call fcn.140002ce4
mov rcx, rax
mov dx, 0x5c
call fcn.1401b2e40
test rax, rax
je 0x140002837
mov rbx, rax
add rbx, 2
movaps xmm0, xmmword [0x1401f4650]
lea rdx, [rsp + 0x40]
movaps xmmword [rdx], xmm0
mov rcx, rbx
call fcn.1400024d9
test al, al
je 0x140002837
test rsi, rsi
je 0x140002823
mov rcx, rsi
mov rdx, rbx
call fcn.140002aee
lea rcx, [rsp + 0x40]
mov rdx, rdi
call fcn.14000283e
mov ebp, eax
jmp 0x1400026db
xor ebp, ebp
jmp 0x1400026db

Function at 0x14000283e
Capabilities:
Check if file exists
Print debug messages

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rdx
xor eax, eax
lea rdx, [0x1401f4e30]
mov r8d, dword [rax + rdx]
cmp dword [rcx + rax], r8d
ja 0x140002866
jb 0x140002874
add rax, 4
cmp rax, 0x10
jne 0x140002850
mov rcx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.140001074
lea rcx, str.WebView2:_skipped_an_incompatible_version
mov rdi, qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call rdi
mov rcx, rsi
call fcn.140002ce4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rcx, [0x1401f4a4e]
call rdi
xor eax, eax
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x140003575
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x50
mov rbx, r9
mov rdi, r8
mov r14, rdx
mov r15, rcx
mov r12, qword [rsp + 0xc0]
mov r13, qword [rsp + 0xb8]
mov rsi, qword [rsp + 0xb0]
mov rax, qword [0x140231ec8]
xor rax, rsp
mov qword [rsp + 0x48], rax
test r13, r13
je 0x1400035fb
mov rcx, r15
mov rdx, r14
mov r8, rdi
mov r9, rbx
call 0x1400036cc
test al, al
je 0x140003668
mov rcx, rbx
call fcn.140002ca4
test al, al
jne 0x140003668
mov rdx, qword [rdi]
mov rcx, r13
mov r8, rsi
mov r9, r12
call fcn.1400031fe
jmp 0x1400036a6
test rsi, rsi
je 0x14000366c
lea rax, [rsp + 0x44]
mov dword [rax], 0
lea rcx, [rsp + 0x40]
mov dword [rcx], 4
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
mov rcx, r15
xor edx, edx
mov r8, r14
mov r9d, 0x10
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x140003699
mov rcx, r15
mov rdx, r14
mov r8, rdi
mov r9, rbx
call 0x1400036cc
test al, al
je 0x140003668
mov rcx, qword [rdi]
test rcx, rcx
je 0x1400036c8
call fcn.1401b7860
cmp eax, 1
jmp 0x14000369e
xor esi, esi
jmp 0x1400036a9
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1401afad0
mov rcx, r15
mov rdx, r14
mov r8, rdi
mov r9, rbx
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp 0x1400036cc
cmp dword [rsp + 0x44], 1
sete al
movzx eax, al
mov dword [rsi], eax
mov sil, 1
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1401afad0
mov eax, esi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
xor eax, eax
jmp 0x1400036a1
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x250
mov rdi, r9
mov rsi, r8
mov rbx, rdx
mov r14, rcx
mov rax, qword [0x140231ec8]
xor rax, rsp
mov qword [rsp + 0x248], rax
lea r15, [rsp + 0x40]
mov r8d, 0x208
mov rcx, r15
xor edx, edx
call fcn.1401b2770
lea rax, [rsp + 0x3c]
mov dword [rax], 0x104
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], 0
mov rcx, r14
xor edx, edx
mov r8, rbx
mov r9d, 2
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov ebx, eax
test eax, eax
jne 0x14000375d
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.140002aee
mov rcx, rdi
call fcn.140002ce4
mov qword [rsi], rax
test ebx, ebx
sete bl
mov rcx, qword [rsp + 0x248]
xor rcx, rsp
call fcn.1401afad0
mov eax, ebx
add rsp, 0x250
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x1400036cc
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x50
mov rbx, r9
mov rdi, r8
mov r14, rdx
mov r15, rcx
mov r12, qword [rsp + 0xc0]
mov r13, qword [rsp + 0xb8]
mov rsi, qword [rsp + 0xb0]
mov rax, qword [0x140231ec8]
xor rax, rsp
mov qword [rsp + 0x48], rax
test r13, r13
je 0x1400035fb
mov rcx, r15
mov rdx, r14
mov r8, rdi
mov r9, rbx
call 0x1400036cc
test al, al
je 0x140003668
mov rcx, rbx
call fcn.140002ca4
test al, al
jne 0x140003668
mov rdx, qword [rdi]
mov rcx, r13
mov r8, rsi
mov r9, r12
call fcn.1400031fe
jmp 0x1400036a6
test rsi, rsi
je 0x14000366c
lea rax, [rsp + 0x44]
mov dword [rax], 0
lea rcx, [rsp + 0x40]
mov dword [rcx], 4
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
mov rcx, r15
xor edx, edx
mov r8, r14
mov r9d, 0x10
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x140003699
mov rcx, r15
mov rdx, r14
mov r8, rdi
mov r9, rbx
call 0x1400036cc
test al, al
je 0x140003668
mov rcx, qword [rdi]
test rcx, rcx
je 0x1400036c8
call fcn.1401b7860
cmp eax, 1
jmp 0x14000369e
xor esi, esi
jmp 0x1400036a9
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1401afad0
mov rcx, r15
mov rdx, r14
mov r8, rdi
mov r9, rbx
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp 0x1400036cc
cmp dword [rsp + 0x44], 1
sete al
movzx eax, al
mov dword [rsi], eax
mov sil, 1
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1401afad0
mov eax, esi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
xor eax, eax
jmp 0x1400036a1
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x250
mov rdi, r9
mov rsi, r8
mov rbx, rdx
mov r14, rcx
mov rax, qword [0x140231ec8]
xor rax, rsp
mov qword [rsp + 0x248], rax
lea r15, [rsp + 0x40]
mov r8d, 0x208
mov rcx, r15
xor edx, edx
call fcn.1401b2770
lea rax, [rsp + 0x3c]
mov dword [rax], 0x104
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], 0
mov rcx, r14
xor edx, edx
mov r8, rbx
mov r9d, 2
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov ebx, eax
test eax, eax
jne 0x14000375d
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.140002aee
mov rcx, rdi
call fcn.140002ce4
mov qword [rsi], rax
test ebx, ebx
sete bl
mov rcx, qword [rsp + 0x248]
xor rcx, rsp
call fcn.1401afad0
mov eax, ebx
add rsp, 0x250
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x14000382d
Capabilities:
Print debug messages

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x60
mov rsi, r9
mov ebp, r8d
mov r14d, edx
mov rbx, rcx
mov rax, qword [0x140231ec8]
xor rax, rsp
mov qword [rsp + 0x58], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
je 0x1400038a3
mov rdi, rax
lea rdx, str.CreateWebViewEnvironmentWithOptionsInternal
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000393d
mov rcx, qword [rsp + 0xb8]
mov r9, qword [rsp + 0xb0]
mov qword [rsp + 0x20], rcx
mov ecx, r14d
mov edx, ebp
mov r8, rsi
call qword [case.0x1400f1dc3.0]
mov esi, eax
jmp 0x1400039c2
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
lea r14, [rsp + 0x54]
mov dword [r14], esi
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x30]
mov qword [rdi + 0x10], rax
movaps xmm0, xmmword [0x1401f4650]
movaps xmmword [rdi], xmm0
mov rcx, rdi
call fcn.1400029f0
mov edx, 4
mov rcx, r14
mov r8b, 1
mov r9, rdi
call fcn.140003784
lea rcx, str.WebView2:_CoreWebView2Environment_failed_when_trying_to_LoadLibrary:_hr0x
mov r14, qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
call r14
mov rcx, rdi
call fcn.140002ce4
mov rcx, rax
call r14
lea rcx, str._path
call r14
mov rcx, rbx
call r14
lea rcx, [0x1401f52f6]
call r14
mov rcx, rdi
call fcn.140002a02
jmp 0x1400039e0
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
lea r14, [rsp + 0x54]
mov dword [r14], esi
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rbx, [rsp + 0x30]
mov qword [rbx + 0x10], rax
movaps xmm0, xmmword [0x1401f4650]
movaps xmmword [rbx], xmm0
mov rcx, rbx
call fcn.1400029f0
mov edx, 4
mov rcx, r14
mov r8b, 1
mov r9, rbx
call fcn.140003784
lea rcx, str.WebView2:_CoreWebView2Environment_failed_when_trying_to_call_into_EmbeddedBrowserWebView.dll._hr0x
mov r14, qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
call r14
mov rcx, rbx
call fcn.140002ce4
mov rcx, rax
call r14
lea rcx, [0x1401f52f6]
call r14
mov rcx, rbx
call fcn.140002a02
lea rdx, str.DllCanUnloadNow
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400039e0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1401afad0
mov eax, esi
add rsp, 0x60
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret

Function at 0x140003a4c
Capabilities:
Query environment variable

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rdx
mov rdi, rcx
xor edx, edx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x140003aa0
mov ebx, eax
mov edx, eax
mov rcx, rsi
call fcn.140002a5e
test al, al
je 0x140003aa0
mov rcx, rsi
call fcn.140002ce4
mov rcx, rdi
mov rdx, rax
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edx, eax
mov rcx, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.140002bac
xor eax, eax
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
Function at 0x140005480
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x60
mov rbx, rcx
movsxd rdi, r8d
mov rcx, qword [rcx]
mov rsi, rdx
test rcx, rcx
je 0x1400054a6
call qword [sym.imp.USER32.dll_DestroyWindow]
and qword [rsp + 0x58], 0
lea rdx, str.ComboBoxEx32
or qword [rbx + 8], 0xffffffffffffffff
mov r9d, 0x44200046
mov rax, qword [0x14023fc58]
xor r8d, r8d
mov qword [rsp + 0x50], rax
xor ecx, ecx
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rsi
mov dword [rsp + 0x38], 0xdc
mov dword [rsp + 0x30], 0x3c
and dword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
call qword [sym.imp.USER32.dll_CreateWindowExW]
xor r9d, r9d
mov edx, 0x408
mov rcx, rax
mov qword [rbx], rax
lea r8d, [r9 + 4]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbx]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x407
call qword [sym.imp.USER32.dll_SendMessageW]
test rax, rax
je 0x140005532
mov rcx, rax
call fcn.14016406c
mov rcx, rbx
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
jmp fcn.14000554c
Function at 0x14000589c
Capabilities:
Get file system object information

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x240]
sub rsp, 0x340
mov rax, qword [0x140231ec8]
xor rax, rsp
mov qword [rbp + 0x230], rax
mov r15, r9
mov r14d, r8d
mov rsi, rdx
mov r12, rcx
mov rdi, qword [rbp + 0x2a8]
mov ecx, 0x30
call fcn.1401af980
mov rbx, rax
mov qword [rsp + 0x68], rax
xor r13d, r13d
test rax, rax
je 0x140005910
mov qword [rax + 0x10], r13
mov qword [rax + 0x20], r13
mov qword [rax + 0x28], 7
mov word [rax + 0x10], r13w
jmp 0x140005913
mov rbx, r13
mov dword [rbx], r14d
mov qword [rbx + 8], r15
lea rcx, [rbx + 0x10]
mov rdx, rsi
call fcn.140004958
mov ecx, dword [rbp + 0x2a0]
cmp byte [rbp + 0x2c0], r13b
jne 0x140005971
cmp ecx, 0xffffffff
jne 0x140005971
mov eax, 0x4003
lea ecx, [rax - 2]
cmp r14d, 2
cmovne eax, ecx
cmp qword [rsi + 0x18], 8
jb 0x140005953
mov rsi, qword [rsi]
mov dword [rsp + 0x20], eax
mov r9d, 0x2b8
lea r8, [rsp + 0x70]
xor edx, edx
mov rcx, rsi
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov ecx, dword [rsp + 0x78]
mov qword [rsp + 0x30], 0x37
mov dword [rsp + 0x48], r13d
mov dword [rsp + 0x54], r13d
mov dword [rsp + 0x5c], r13d
cmp qword [rdi + 0x10], r13
jne 0x140005997
or qword [rsp + 0x40], 0xffffffffffffffff
jmp 0x1400059a6
cmp qword [rdi + 0x18], 8
jb 0x1400059a1
mov rdi, qword [rdi]
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x60], rbx
mov rax, qword [rbp + 0x2b8]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x4c], ecx
mov dword [rsp + 0x50], ecx
mov eax, dword [rbp + 0x2b0]
mov dword [rsp + 0x58], eax
lea r9, [rsp + 0x30]
xor r8d, r8d
mov edx, 0x40b
mov rcx, qword [r12]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbp + 0x230]
xor rcx, rsp
call fcn.1401afad0
mov rbx, qword [rsp + 0x390]
add rsp, 0x340
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140005ba8
Capabilities:
Get file system object information

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x300
mov rax, qword [0x140231ec8]
xor rax, rsp
mov qword [rsp + 0x2f0], rax
mov rbx, qword [rsp + 0x340]
mov r11, r9
mov eax, r8d
mov r10, rdx
cmp r8d, 0x4e
jne 0x140005cb2
cmp dword [rbx + 0x10], 0xfffffcd9
je 0x140005c12
cmp dword [rbx + 0x10], 0xfffffcda
jne 0x140005c0b
cmp dword [rbx + 0x228], 2
jne 0x140005c0b
lea rcx, [0x140236a08]
call fcn.140005ce8
xor eax, eax
jmp 0x140005cc3
mov rdi, qword [rbx + 0x48]
mov esi, dword [rbx + 0x18]
mov ebp, dword [rdi]
cmp ebp, 4
jne 0x140005c26
mov rdi, qword [rdi + 8]
jmp 0x140005c34
add rdi, 0x10
cmp qword [rdi + 0x18], 8
jb 0x140005c34
mov rdi, qword [rdi]
test sil, 1
je 0x140005c70
mov eax, 0x200
lea r8, [rsp + 0x30]
cmp ebp, 4
mov r9d, 0x2b8
lea ecx, [rax + 8]
cmove eax, ecx
xor edx, edx
mov rcx, rdi
mov dword [rsp + 0x20], eax
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test rax, rax
je 0x140005c70
lea rax, [rsp + 0x40]
mov qword [rbx + 0x28], rax
test sil, 6
je 0x140005ca8
mov eax, 0x4001
lea r8, [rsp + 0x30]
cmp ebp, 4
mov r9d, 0x2b8
lea ecx, [rax + 8]
cmove eax, ecx
xor edx, edx
mov rcx, rdi
mov dword [rsp + 0x20], eax
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov eax, dword [rsp + 0x38]
mov dword [rbx + 0x38], eax
mov dword [rbx + 0x34], eax
bts dword [rbx + 0x18], 0x1c
jmp 0x140005c0b
mov r9, rbx
mov r8, r11
mov edx, eax
mov rcx, r10
call qword [sym.imp.USER32.dll_DefWindowProcW]
mov rcx, qword [rsp + 0x2f0]
xor rcx, rsp
call fcn.1401afad0
mov rbx, qword [rsp + 0x320]
add rsp, 0x300
pop rdi
pop rsi
pop rbp
ret
Function at 0x140012c1c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rdi, rcx
movabs rax, 0xfffffffffffffff
bsr rcx, rax
mov eax, 1
shl rax, cl
cmp rdx, rax
ja 0x140012df4
lea rax, [rdx - 1]
or rax, 1
bsr rcx, rax
inc ecx
mov ebx, 1
shl rbx, cl
mov rbp, qword [rdi + 8]
lea r12, [rdi + 0x18]
lea rdx, [rbx + rbx]
mov r8, rbp
mov rcx, r12
call fcn.140012998
lea rax, [rbx - 1]
mov qword [rdi + 0x30], rax
mov qword [rdi + 0x38], rbx
mov qword [rsp + 0x68], rdi
mov rbx, qword [rdi + 8]
mov rbx, qword [rbx]
mov rsi, rbx
cmp rbx, rbp
je 0x140012dd9
mov rsi, qword [rsi]
xor edx, edx
mov r13, qword [rbx + 0x10]
mov r15, qword [rbx + 0x18]
mov r8, r13
cmp r13, r15
je 0x140012cd7
rol rdx, 0xc
movzx eax, byte [r8]
imul rcx, rax, 0x2773
xor rdx, rcx
inc r8
cmp r8, r15
jne 0x140012cbd
mov r14, qword [rdi + 0x30]
and r14, rdx
add r14, r14
mov r12, qword [r12]
cmp qword [r12 + r14*8], rbp
jne 0x140012cf9
mov qword [r12 + r14*8], rbx
mov qword [r12 + r14*8 + 8], rbx
jmp 0x140012dc9
mov rdi, qword [r12 + r14*8 + 8]
sub r15, r13
mov rdx, qword [rdi + 0x10]
mov rax, qword [rdi + 0x18]
sub rax, rdx
cmp r15, rax
jne 0x140012d50
mov r8, r15
mov rcx, r13
call fcn.1401b2670
test eax, eax
jne 0x140012d50
mov rax, qword [rdi]
cmp rax, rbx
je 0x140012d49
mov r8, qword [rbx + 8]
mov qword [r8], rsi
mov rdx, qword [rsi + 8]
mov qword [rdx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rbx
mov qword [rax + 8], rdx
mov qword [rsi + 8], r8
mov qword [rbx + 8], rcx
mov qword [r12 + r14*8 + 8], rbx
jmp 0x140012dc4
cmp qword [r12 + r14*8], rdi
je 0x140012d9f
mov rdi, qword [rdi + 8]
mov rdx, qword [rdi + 0x10]
mov rax, qword [rdi + 0x18]
sub rax, rdx
cmp r15, rax
jne 0x140012d50
mov r8, r15
mov rcx, r13
call fcn.1401b2670
test eax, eax
jne 0x140012d50
mov rax, qword [rdi]
mov r8, qword [rbx + 8]
mov qword [r8], rsi
mov rdx, qword [rsi + 8]
mov qword [rdx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rbx
mov qword [rax + 8], rdx
mov qword [rsi + 8], r8
mov qword [rbx + 8], rcx
jmp 0x140012dc4
mov rdx, qword [rbx + 8]
mov qword [rdx], rsi
mov rcx, qword [rsi + 8]
mov qword [rcx], rdi
mov rax, qword [rdi + 8]
mov qword [rax], rbx
mov qword [rdi + 8], rcx
mov qword [rsi + 8], rdx
mov qword [rbx + 8], rax
mov qword [r12 + r14*8], rbx
mov rdi, qword [rsp + 0x60]
mov rbx, rsi
cmp rsi, rbp
lea r12, [rdi + 0x18]
jne 0x140012ca8
and qword [rsp + 0x68], 0
mov rbx, qword [rsp + 0x70]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea rcx, str.invalid_hash_bucket_count
call fcn.1401ae684
int3
Function at 0x14001a8b8
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x140231ec8]
xor rax, rsp
mov qword [rbp - 8], rax
mov rbx, rcx
mov rax, rcx
cmp qword [rcx + 0x18], 8
jb 0x14001a8ef
mov rax, qword [rcx]
lea rsi, [rcx + 0x10]
xor r14d, r14d
mov qword [rsi], r14
mov word [rax], r14w
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rbp - 0x28], r14
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x18], xmm0
or r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], r14w
jne 0x14001a913
mov rdx, rax
lea rcx, [rbp - 0x28]
call fcn.1400041b8
nop
mov qword [rbp - 0x50], r14
mov edi, r14d
mov r15d, 7
mov r12d, 0x1000
mov qword [rbp - 0x48], r14
mov qword [rbp - 0x38], r14
mov qword [rbp - 0x30], r14
mov qword [rbp - 0x38], r14
mov qword [rbp - 0x30], r15
mov word [rbp - 0x48], r14w
lea r8, [rbp - 0x48]
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x28]
call fcn.1400fdf6c
test al, al
je 0x14001a9ff
test edi, edi
jne 0x14001a9c6
mov edi, 1
mov rdx, qword [rbp - 0x30]
cmp rdx, 8
jb 0x14001a9b4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x48]
cmp rdx, r12
mov rax, rcx
jb 0x14001a9af
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001aad3
call fcn.1401af9bc
mov qword [rbp - 0x38], r14
mov qword [rbp - 0x30], r15
mov word [rbp - 0x48], r14w
jmp 0x14001a93d
lea rax, [rbp - 0x48]
cmp qword [rbp - 0x30], 8
cmovae rax, qword [rbp - 0x48]
movzx edx, word [rax]
lea rcx, [0x140234a30]
call fcn.1400b82a0
test al, al
jne 0x14001a978
cmp edi, 1
jne 0x14001a9f8
lea rdx, [rbp - 0x48]
mov rcx, rbx
call fcn.140004958
inc edi
jmp 0x14001a978
mov rdx, qword [rbp - 0x30]
cmp rdx, 8
jb 0x14001aa3b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, r12
jb 0x14001aa36
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001aad3
call fcn.1401af9bc
mov qword [rbp - 0x38], r14
mov qword [rbp - 0x30], r15
mov word [rbp - 0x48], r14w
cmp edi, 2
jne 0x14001aa5e
cmp qword [rbx + 0x18], 8
jb 0x14001aa57
mov rbx, qword [rbx]
mov qword [rsi], r14
mov word [rbx], r14w
mov rdx, qword [rbp - 0x10]
cmp rdx, 8
jb 0x14001aa96
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, r12
jb 0x14001aa91
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001aacd
call fcn.1401af9bc
movdqa xmm0, xmmword [0x1401dc090]
movdqu xmmword [rbp - 0x18], xmm0
mov word [rbp - 0x28], r14w
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1401afad0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
call fcn.1401b6b94
nop
call fcn.1401b6b94
nop
int3