joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140014734
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
call fcn.140013e8c
add rsp, 0x28
jmp 0x14001474c
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], r12
push r13
sub rsp, 0xb0
xor ebx, ebx
mov dword [rsp + 0x20], ebx
lea rcx, [rax - 0x78]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rdi, qword [rax + 8]
mov r12d, ebx
xor eax, eax
lock cmpxchg qword [0x1400a4e38], rdi
jne 0x140024c8f
mov eax, dword [0x1400a4e30]
cmp eax, 1
je 0x140024caf
mov eax, dword [0x1400a4e30]
cmp eax, ebx
jne 0x140024cc6
mov dword [0x1400a4e30], 1
lea r13, [0x14005ad30]
lea rdi, [0x14005ad18]
mov qword [rsp + 0x30], rdi
mov eax, ebx
mov dword [rsp + 0x24], ebx
cmp rdi, r13
jae 0x1400147f8
cmp eax, ebx
jne 0x1400147f8
mov rcx, qword [rdi]
cmp rcx, rbx
je 0x1400147ed
call rcx
mov dword [rsp + 0x24], eax
add rdi, 8
mov qword [rsp + 0x30], rdi
jmp 0x1400147d6
cmp eax, ebx
jne 0x140024cbc
mov eax, dword [0x1400a4e30]
cmp eax, 1
jne 0x140014828
lea rdx, [0x14005ad10]
lea rcx, [0x14005acc8]
call fcn.1401c7000
mov dword [0x1400a4e30], 2
cmp r12d, ebx
jne 0x140014837
mov rax, rbx
xchg qword [0x1400a4e38], rax
cmp qword [0x1400a4e50], rbx
jne 0x140024cd5
mov rcx, qword [sym.imp.msvcrt.dll__wcmdln]
cmp qword [rcx], rbx
je 0x140024cfe
mov rcx, qword [rcx]
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
cmp word [rcx], 0x20
jbe 0x14001487b
cmp word [rcx], 0x22
je 0x140024d59
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x140014860
cmp word [rcx], bx
jne 0x140024d08
cmp word [rcx], bx
jne 0x140024d15
test byte [rsp + 0x7c], 1
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rcx
xor edx, edx
lea rcx, [0x140000000]
call fcn.1400148d0
nop
jmp 0x140024d2d
cmp rax, rdi
jne 0x140024c9f
mov r12d, 1
jmp 0x140014796
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140014785
lea ecx, [rax + 0x1e]
call sub.msvcrt.dll__amsg_exit
jmp 0x140014800
mov eax, 0xff
jmp 0x140024d98
mov dword [0x1400a5048], 1
jmp 0x140014800
lea rcx, [0x1400a4e50]
call fcn.14004dd4c
cmp eax, ebx
je 0x140014844
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
call qword [0x1400a4e50]
nop
jmp 0x140014844
mov eax, 0xff
jmp 0x140024d98
cmp edx, ebx
je 0x140014884
jmp 0x140014866
cmp word [rcx], 0x20
ja 0x14001488d
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x140014884
mov dword [0x1400a5044], eax
cmp dword [0x1400a474c], ebx
jne 0x140024d43
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x1400a5048], ebx
jne 0x140024d57
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x1400a5044]
jmp 0x140024d98
mov eax, ebx
cmp edx, ebx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
jmp 0x140014870
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov r12, qword [r11 + 0x20]
mov rsp, r11
pop r13
ret
Function at 0x140b89058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.140b891df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140b89089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140b8906f
add dl, dl
jne 0x140b89096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140b890f6
xor eax, eax
add dl, dl
jne 0x140b890a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140b891ad
add dl, dl
jne 0x140b890b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140b890c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140b890d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140b890dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140b890ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140b8907e
mov eax, 1
add dl, dl
jne 0x140b89106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140b89113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140b890fb
sub eax, ebx
mov ebx, 1
jne 0x140b8914c
mov ecx, 1
add dl, dl
jne 0x140b8912e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140b8913b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140b89123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140b8907e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140b89168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140b89175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140b8915d
cmp eax, 0x7d00
jae 0x140b8919b
cmp eax, 0x500
jb 0x140b89196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140b8907e
cmp eax, 0x7f
ja 0x140b8919e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140b8907e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140b891d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140b8907e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x14000ad70
Capabilities:
Enumerate pe sections
Resolve function by parsing pe exports

Disassembly:
push r14
xor r14d, r14d
push r13
push r12
push rbp
push rdi
push rsi
push rbx
mov rbx, rcx
mov rdx, rbx
sub rsp, 0x20
movsxd rax, dword [rcx + 0x3c]
mov ecx, dword [rcx + rax + 0x88]
call 0x1400113f0
mov rdx, rbx
mov esi, eax
add rsi, rbx
mov ecx, dword [rsi + 0x20]
call 0x1400113f0
mov ecx, dword [rsi + 0x24]
mov rdx, rbx
mov r12d, eax
call 0x1400113f0
mov r13d, dword [rsi + 0x18]
add r12, rbx
mov edi, eax
cmp r13, r14
je 0x14000ae2f
mov ecx, dword [r12 + r14*4]
mov rdx, rbx
call 0x1400113f0
mov ebp, eax
add rbp, rbx
mov rcx, rbp
call fcn.14000b2c0
cmp eax, 0xa6caa1c5
jne 0x14000ae14
mov ecx, dword [rsi + 0x1c]
mov rdx, rbx
add rdi, rbx
call 0x1400113f0
movzx edx, word [rdi + r14*2]
mov eax, eax
add rax, rbx
mov ecx, dword [rax + rdx*4]
add rsp, 0x20
mov rdx, rbx
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
jmp 0x1400113f0
mov rcx, rbp
call fcn.14000b2c0
mov edx, eax
lea rax, [r14 + 1]
cmp edx, 0xffe885ef
je 0x14000ade3
mov r14, rax
jmp 0x14000adbe
add rsp, 0x20
xor eax, eax
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov eax, ecx
movsxd rcx, dword [rdx + 0x3c]
add rcx, rdx
movzx edx, word [rcx + 0x14]
lea rdx, [rcx + rdx + 0x18]
cmp eax, dword [rdx + 0x14]
jb 0x14001143a
mov r9w, word [rcx + 6]
xor ecx, ecx
cmp r9w, cx
je 0x140011438
mov r8d, dword [rdx + 0xc]
cmp eax, r8d
jb 0x140011430
mov r10d, dword [rdx + 0x10]
add r10d, r8d
cmp eax, r10d
jae 0x140011430
add eax, dword [rdx + 0x14]
sub eax, r8d
ret
inc ecx
add rdx, 0x28
jmp 0x14001140e
xor eax, eax
ret

Function at 0x14000ae90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r12
xor edx, edx
push rbp
push rdi
push rsi
push rbx
mov rbx, qword [0x140017160]
mov rax, qword [rbx + 0x83a]
test rax, rax
je 0x14000af3e
mov edx, dword [rbx + 0x7f0]
test edx, edx
jne 0x14000af3e
movsxd rcx, dword [rax + 0x3c]
xor r8d, r8d
mov ecx, dword [rax + rcx + 0x88]
add rcx, rax
mov edi, dword [rcx + 0x20]
mov r10d, dword [rcx + 0x1c]
mov esi, dword [rcx + 0x24]
mov ebp, dword [rcx + 0x18]
xor ecx, ecx
add r10, rax
add rdi, rax
add rsi, rax
cmp r8d, ebp
jae 0x14000af38
mov r9d, dword [rdi + r8*4]
cmp word [rax + r9], 0x775a
jne 0x14000af33
test rcx, rcx
movzx r9d, word [rsi + r8*2]
jne 0x14000af0b
mov ecx, dword [r10 + r9*4]
add rcx, rax
jmp 0x14000af33
mov r9d, dword [r10 + r9*4]
mov r11, rcx
add r9, rax
mov r12, r9
sub r11, r9
sub r12, rcx
cmp r9, rcx
mov r9d, r12d
cmovb r9d, r11d
lea r11d, [rdx - 1]
cmp r11d, r9d
cmovae edx, r9d
inc r8
jmp 0x14000aee6
mov dword [rbx + 0x7f0], edx
pop rbx
mov eax, edx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x14000b270
Capabilities:
Hash data using djb2

Disassembly:
xor eax, eax
test rcx, rcx
je 0x14000b2bd
mov r10, rcx
mov eax, 0x1505
mov r9b, byte [r10]
test edx, edx
jne 0x14000b28c
test r9b, r9b
jne 0x14000b29f
ret
mov r11, r10
sub r11, rcx
cmp r11d, edx
jae 0x14000b2bd
cmp r9b, 1
adc r10, 0
cmp r9b, 0x60
jbe 0x14000b2ae
test r8d, r8d
je 0x14000b2ae
sub r9d, 0x20
imul eax, eax, 0x21
movzx r9d, r9b
inc r10
add eax, r9d
jmp 0x14000b27f
ret
Function at 0x14000b2c0
Capabilities:
Hash data using djb2

Disassembly:
mov eax, 0x1505
movsx edx, byte [rcx]
inc rcx
test dl, dl
je 0x14000b2d6
imul eax, eax, 0x21
add eax, edx
jmp 0x14000b2c5
ret

Function at 0x14000cc00
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push rsi
xor eax, eax
push rbx
mov r8b, byte [rdx + rax]
mov byte [rcx + rax], r8b
mov r8b, byte [rdx + rax + 1]
mov byte [rcx + rax + 1], r8b
mov r8b, byte [rdx + rax + 2]
mov byte [rcx + rax + 2], r8b
mov r8b, byte [rdx + rax + 3]
mov byte [rcx + rax + 3], r8b
add rax, 4
cmp rax, 0x20
jne 0x14000cc04
mov r11d, 8
lea r10, str.cw
lea rbx, [0x1400171a0]
mov esi, r11d
movzx r9d, byte [rcx + 0x1c]
movzx r8d, byte [rcx + 0x1d]
movzx edx, byte [rcx + 0x1e]
movzx eax, byte [rcx + 0x1f]
and esi, 7
jne 0x14000cc82
mov sil, byte [r10 + r8]
mov r8b, byte [r10 + rdx]
mov dl, byte [r10 + rax]
mov al, byte [r10 + r9]
mov r9d, r11d
shr r9d, 3
xor sil, byte [rbx + r9]
mov r9d, esi
jmp 0x14000cc97
cmp esi, 4
jne 0x14000cc97
mov r9b, byte [r10 + r9]
mov r8b, byte [r10 + r8]
mov dl, byte [r10 + rdx]
mov al, byte [r10 + rax]
xor r9b, byte [rcx]
xor r8b, byte [rcx + 1]
inc r11d
add rcx, 4
xor dl, byte [rcx - 2]
xor al, byte [rcx - 1]
mov byte [rcx + 0x1c], r9b
mov byte [rcx + 0x1d], r8b
mov byte [rcx + 0x1e], dl
mov byte [rcx + 0x1f], al
cmp r11d, 0x3c
jne 0x14000cc48
pop rbx
pop rsi
ret

Function at 0x1400113f0
Capabilities:
Enumerate pe sections

Disassembly:
push r14
xor r14d, r14d
push r13
push r12
push rbp
push rdi
push rsi
push rbx
mov rbx, rcx
mov rdx, rbx
sub rsp, 0x20
movsxd rax, dword [rcx + 0x3c]
mov ecx, dword [rcx + rax + 0x88]
call 0x1400113f0
mov rdx, rbx
mov esi, eax
add rsi, rbx
mov ecx, dword [rsi + 0x20]
call 0x1400113f0
mov ecx, dword [rsi + 0x24]
mov rdx, rbx
mov r12d, eax
call 0x1400113f0
mov r13d, dword [rsi + 0x18]
add r12, rbx
mov edi, eax
cmp r13, r14
je 0x14000ae2f
mov ecx, dword [r12 + r14*4]
mov rdx, rbx
call 0x1400113f0
mov ebp, eax
add rbp, rbx
mov rcx, rbp
call fcn.14000b2c0
cmp eax, 0xa6caa1c5
jne 0x14000ae14
mov ecx, dword [rsi + 0x1c]
mov rdx, rbx
add rdi, rbx
call 0x1400113f0
movzx edx, word [rdi + r14*2]
mov eax, eax
add rax, rbx
mov ecx, dword [rax + rdx*4]
add rsp, 0x20
mov rdx, rbx
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
jmp 0x1400113f0
mov rcx, rbp
call fcn.14000b2c0
mov edx, eax
lea rax, [r14 + 1]
cmp edx, 0xffe885ef
je 0x14000ade3
mov r14, rax
jmp 0x14000adbe
add rsp, 0x20
xor eax, eax
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov eax, ecx
movsxd rcx, dword [rdx + 0x3c]
add rcx, rdx
movzx edx, word [rcx + 0x14]
lea rdx, [rcx + rdx + 0x18]
cmp eax, dword [rdx + 0x14]
jb 0x14001143a
mov r9w, word [rcx + 6]
xor ecx, ecx
cmp r9w, cx
je 0x140011438
mov r8d, dword [rdx + 0xc]
cmp eax, r8d
jb 0x140011430
mov r10d, dword [rdx + 0x10]
add r10d, r8d
cmp eax, r10d
jae 0x140011430
add eax, dword [rdx + 0x14]
sub eax, r8d
ret
inc ecx
add rdx, 0x28
jmp 0x14001140e
xor eax, eax
ret
Function at 0x140001af0
Capabilities:
Get common file path

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x1d8]
sub rsp, 0x2d8
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov rax, qword [0x14003e010]
xor rax, rsp
mov qword [rbp + 0x1c0], rax
mov r14d, r9d
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp - 0x50]
call fcn.140019dc0
mov edx, 0x104
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xor r15d, r15d
mov qword [rbp - 0x80], r15
mov qword [rbp - 0x78], r15
mov qword [rbp - 0x80], r15
mov qword [rbp - 0x78], 7
mov word [rsp + 0x70], r15w
lea r8d, [r15 + 0xb]
lea rdx, str.apphelp.dll
lea rcx, [rsp + 0x70]
call fcn.140001f30
nop
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], r15
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], 7
mov word [rsp + 0x50], r15w
lea rax, [rbp - 0x50]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140001bb0
lea rdx, [rbp - 0x50]
lea rcx, [rsp + 0x50]
call fcn.140001f30
nop
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x70]
call fcn.140002400
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x140001c20
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001c1b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001d82
call fcn.140018250
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], 7
mov word [rsp + 0x50], r15w
mov rdx, qword [rbp - 0x78]
cmp rdx, 8
jb 0x140001c75
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001c70
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001d88
call fcn.140018250
mov qword [rbp - 0x80], r15
mov qword [rbp - 0x78], 7
mov word [rsp + 0x70], r15w
lea rcx, [rbp - 0x70]
cmp qword [rbp - 0x58], 8
cmovae rcx, qword [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], r15
mov ecx, 0x28
call fcn.140018214
mov qword [rsp + 0x38], rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
nop
mov qword [rsp + 0x40], r15
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.140004640
test rax, rax
je 0x140001d00
lea rdx, str.ImageExplorerMain
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140001d00
mov r9d, r14d
mov r8, rsi
mov rdx, rdi
mov rcx, rbx
call rax
mov ebx, eax
jmp 0x140001d03
mov ebx, r15d
lea rcx, [rsp + 0x20]
call fcn.140003b80
nop
mov rdx, qword [rbp - 0x58]
cmp rdx, 8
jb 0x140001d4a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001d45
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001d7c
call fcn.140018250
mov qword [rbp - 0x60], r15
mov qword [rbp - 0x58], 7
mov word [rbp - 0x70], r15w
mov eax, ebx
mov rcx, qword [rbp + 0x1c0]
xor rcx, rsp
call fcn.1400181f0
add rsp, 0x2d8
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.14001c384
nop
call fcn.14001c384
nop
call fcn.14001c384
int3
jmp 0x140001af0
Function at 0x140001e40
Capabilities:
Get common file path

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x1d8]
sub rsp, 0x2d8
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov rax, qword [0x14003e010]
xor rax, rsp
mov qword [rbp + 0x1c0], rax
mov r14d, r9d
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp - 0x50]
call fcn.140019dc0
mov edx, 0x104
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xor r15d, r15d
mov qword [rbp - 0x80], r15
mov qword [rbp - 0x78], r15
mov qword [rbp - 0x80], r15
mov qword [rbp - 0x78], 7
mov word [rsp + 0x70], r15w
lea r8d, [r15 + 0xb]
lea rdx, str.apphelp.dll
lea rcx, [rsp + 0x70]
call fcn.140001f30
nop
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], r15
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], 7
mov word [rsp + 0x50], r15w
lea rax, [rbp - 0x50]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140001bb0
lea rdx, [rbp - 0x50]
lea rcx, [rsp + 0x50]
call fcn.140001f30
nop
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x70]
call fcn.140002400
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x140001c20
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001c1b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001d82
call fcn.140018250
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], 7
mov word [rsp + 0x50], r15w
mov rdx, qword [rbp - 0x78]
cmp rdx, 8
jb 0x140001c75
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001c70
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001d88
call fcn.140018250
mov qword [rbp - 0x80], r15
mov qword [rbp - 0x78], 7
mov word [rsp + 0x70], r15w
lea rcx, [rbp - 0x70]
cmp qword [rbp - 0x58], 8
cmovae rcx, qword [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], r15
mov ecx, 0x28
call fcn.140018214
mov qword [rsp + 0x38], rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
nop
mov qword [rsp + 0x40], r15
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.140004640
test rax, rax
je 0x140001d00
lea rdx, str.ImageExplorerMain
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140001d00
mov r9d, r14d
mov r8, rsi
mov rdx, rdi
mov rcx, rbx
call rax
mov ebx, eax
jmp 0x140001d03
mov ebx, r15d
lea rcx, [rsp + 0x20]
call fcn.140003b80
nop
mov rdx, qword [rbp - 0x58]
cmp rdx, 8
jb 0x140001d4a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001d45
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001d7c
call fcn.140018250
mov qword [rbp - 0x60], r15
mov qword [rbp - 0x58], 7
mov word [rbp - 0x70], r15w
mov eax, ebx
mov rcx, qword [rbp + 0x1c0]
xor rcx, rsp
call fcn.1400181f0
add rsp, 0x2d8
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.14001c384
nop
call fcn.14001c384
nop
call fcn.14001c384
int3
jmp 0x140001af0
Function at 0x140004c50
Capabilities:
Check os version

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x98]
sub rsp, 0x190
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rdi
mov rax, qword [0x14003e010]
xor rax, rsp
mov qword [rbp + 0x80], rax
mov rbx, rdx
mov qword [rsp + 0x38], rdx
xor edi, edi
mov dword [rsp + 0x20], edi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], di
lea rdx, [rsp + 0x40]
call fcn.14000ba70
test al, al
jne 0x140004d1f
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], 7
mov word [rbx], di
mov dword [rsp + 0x20], 1
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x140004eab
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004d15
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004ee5
call fcn.140018250
jmp 0x140004eab
lea rdx, [rsp + 0x40]
call fcn.140004a90
test al, al
je 0x140004e7f
mov ecx, 1
call fcn.140018214
mov qword [rsp + 0x28], rax
mov byte [rax], 0
xor edx, edx
mov r8d, 0x118
lea rcx, [rsp + 0x64]
call fcn.140019dc0
mov dword [rsp + 0x60], 0x11c
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x140004d7b
cmp dword [rsp + 0x64], 6
setae cl
mov rax, qword [rsp + 0x28]
mov byte [rax], cl
lea rcx, [rsp + 0x28]
call fcn.140008cf0
lea rdx, [rsp + 0x40]
call fcn.14000ba70
test al, al
jne 0x140004dff
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], 7
mov word [rbx], di
mov dword [rsp + 0x20], 1
lea rcx, [rsp + 0x28]
call fcn.140008450
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x140004eab
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004d15
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004eeb
jmp 0x140004d15
lea rdx, [rsp + 0x40]
call fcn.140004a90
test al, al
je 0x140004e75
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], 7
mov word [rbx], di
mov dword [rsp + 0x20], 1
lea rcx, [rsp + 0x28]
call fcn.140008450
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x140004eab
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004d15
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004ef1
jmp 0x140004d15
lea rcx, [rsp + 0x28]
call fcn.140008450
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rsp + 0x50]
movups xmmword [rbx + 0x10], xmm1
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], di
mov dword [rsp + 0x20], 1
mov rax, rbx
mov word [rsp + 0x40], di
mov qword [rsp + 0x58], 7
mov qword [rsp + 0x50], rdi
mov rcx, qword [rbp + 0x80]
xor rcx, rsp
call fcn.1400181f0
lea r11, [rsp + 0x190]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
call fcn.14001c384
int3
call fcn.14001c384
int3
call fcn.14001c384
int3
Function at 0x14000b960
Capabilities:
Check mutex on windows

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov rax, qword [0x14003e010]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rsi, rdx
mov rdi, rcx
mov rcx, qword [rcx]
xor ebp, ebp
test rcx, rcx
je 0x14000b99e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rdi], rbp
mov word [rdi + 8], bp
mov qword [rsp + 0x28], rbp
lea rcx, [rsp + 0x28]
call fcn.1400137c0
nop
mov rbx, qword [rsp + 0x28]
cmp qword [rbx], 0
lea rcx, [rbx + 0x10]
jne 0x14000b9c4
mov rcx, rbp
cmp qword [rsi + 0x10], 0
je 0x14000b9d7
cmp qword [rsi + 0x18], 8
jb 0x14000b9da
mov rsi, qword [rsi]
jmp 0x14000b9da
mov rsi, rbp
mov r8, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rdi], rax
test rax, rax
je 0x14000b9fe
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x14000b9fe
mov byte [rdi + 9], 1
cmp qword [rdi], 0
setne sil
mov rdi, qword [rbx]
test rdi, rdi
je 0x14000ba25
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rbx], rbp
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14000ba38
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rbx + 8], rbp
mov edx, 0x58
mov rcx, rbx
call fcn.140018250
mov qword [rsp + 0x28], rbp
movzx eax, sil
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400181f0
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret

Function at 0x14000ba70
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x450
mov rax, qword [0x14003e010]
xor rax, rsp
mov qword [rsp + 0x440], rax
mov rbx, rdx
mov qword [rsp + 0x28], rdx
xor esi, esi
mov qword [rdx + 0x10], rsi
mov rax, rdx
cmp qword [rdx + 0x18], 8
jb 0x14000baaf
mov rax, qword [rdx]
mov word [rax], si
call fcn.14000bb80
movzx edi, al
mov byte [rsp + 0x20], al
jmp 0x14000bacf
test dil, dil
jne 0x14000bb49
mov qword [rbx + 0x10], rsi
mov rax, rbx
cmp qword [rbx + 0x18], 8
jb 0x14000bae5
mov rax, qword [rbx]
mov word [rax], si
xor edx, edx
mov r8d, 0x410
lea rcx, [rsp + 0x30]
call fcn.140019dc0
mov r8d, 0x207
lea rdx, [rsp + 0x30]
lea rcx, str.APPDATA
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea rax, [rsp + 0x30]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp word [rax + r8*2], 0
jne 0x14000bb20
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.140001f30
movzx edi, dil
mov eax, 1
cmp qword [rbx + 0x10], 0
cmovne edi, eax
movzx eax, dil
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.1400181f0
lea r11, [rsp + 0x450]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret