joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000d7f0
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x6a0
mov rax, qword [0x14003f2f0]
xor rax, rsp
mov qword [rsp + 0x690], rax
mov rdi, rcx
mov r8, rcx
lea rdx, str._s.
lea rcx, [rsp + 0x480]
call fcn.140018028
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x480]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14000d8cc
nop dword [rax]
lea rdx, [0x14002f3b8]
lea rcx, [rsp + 0x4c]
call fcn.140017124
test eax, eax
je 0x14000d8b1
lea rdx, [0x14002f3bc]
lea rcx, [rsp + 0x4c]
call fcn.140017124
test eax, eax
je 0x14000d8b1
lea r9, [rsp + 0x4c]
lea rdx, [0x14002d6c8]
lea rcx, [rsp + 0x270]
mov r8, rdi
call fcn.140018028
test byte [rsp + 0x20], 0x10
lea rcx, [rsp + 0x270]
je 0x14000d8ac
call fcn.14000d7f0
jmp 0x14000d8b1
call fcn.14000d780
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x14000d850
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, qword [rsp + 0x690]
xor rcx, rsp
call fcn.1400161c0
mov rbx, qword [rsp + 0x6b8]
add rsp, 0x6a0
pop rdi
ret
Function at 0x14000db60
Capabilities:
Query environment variable
Read .ini file

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x448
mov rax, qword [0x14003f2f0]
xor rax, rsp
mov qword [rsp + 0x430], rax
mov ebx, dword [rsp + 0x4a0]
mov rdi, qword [rsp + 0x4a8]
mov r14, r8
mov rbp, rdx
mov rsi, rcx
mov r8d, ebx
add r8, r8
xor edx, edx
mov rcx, r9
mov r15, r9
call fcn.1400166f0
lea r9, [rsp + 0x230]
mov r8, r14
mov rdx, rbp
mov rcx, rsi
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x14000dc52
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x230]
mov r8d, pe_nt_image_headers64
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea rcx, [rsp + 0x30]
mov edx, 0x3a
call fcn.140016c54
test rax, rax
jne 0x14000dc28
cmp dword [rsp + 0x4b0], eax
je 0x14000dc28
lea r9, [rsp + 0x30]
lea r8, [0x140041f00]
lea rdx, str._s_s
mov rcx, r15
call fcn.140018028
jmp 0x14000dc52
lea rcx, [rsp + 0x30]
lea rax, [rsp + 0x30]
sub r15, rcx
nop word [rax + rax]
movzx ecx, word [rax]
lea rax, [rax + 2]
mov word [r15 + rax - 2], cx
test cx, cx
jne 0x14000dc40
mov rcx, qword [rsp + 0x430]
xor rcx, rsp
call fcn.1400161c0
add rsp, 0x448
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14000f570
Capabilities:
Get geographical location
Identify system language via api

Disassembly:
push rbx
push rbp
push r14
push r15
sub rsp, 0x448
mov rax, qword [0x14003f2f0]
xor rax, rsp
mov qword [rsp + 0x430], rax
mov r14, rcx
mov ecx, 0x200
mov r15, rdx
call fcn.140015468
xor ebp, ebp
lea ecx, [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_GetUserGeoID]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
lea r8, [rsp + 0x30]
lea edx, [rbp + 8]
mov r9d, pe_nt_image_headers64
mov ecx, ebx
mov word [rsp + 0x20], ax
call qword [sym.imp.KERNEL32.dll_GetGeoInfoW]
lea edx, [rbp + 0x18]
lea ecx, [rbp + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
test rax, rax
jne 0x14000f5e9
xor eax, eax
jmp 0x14000f6e6
mov r8, rax
mov edx, 0x10004
xor ecx, ecx
mov dword [rax], 0x18
call sub.TAPI32.dll_lineGetCountryW
test eax, eax
jne 0x14000f5e2
mov qword [rsp + 0x440], rdi
mov edi, dword [rbx + 4]
cmp edi, dword [rbx]
jbe 0x14000f64b
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov edx, edi
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
test rax, rax
je 0x14000f644
mov r8, rax
mov edx, 0x10004
xor ecx, ecx
mov dword [rax], edi
call sub.TAPI32.dll_lineGetCountryW
test eax, eax
je 0x14000f64b
xor eax, eax
jmp 0x14000f6de
mov qword [rsp + 0x480], rsi
mov esi, dword [rbx + 0x14]
mov edi, ebp
add rsi, rbx
cmp dword [rbx + 0xc], ebp
jbe 0x14000f6cb
mov eax, edi
lea rdx, [rsp + 0x230]
imul rax, rax, 0x2c
mov eax, dword [rax + rsi + 0x10]
add rax, rbx
nop word [rax + rax]
movzx ecx, word [rax]
lea rdx, [rdx + 2]
lea rax, [rax + 2]
mov word [rdx - 2], cx
test cx, cx
jne 0x14000f680
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x230]
call fcn.140017124
test eax, eax
je 0x14000f6b3
inc edi
cmp edi, dword [rbx + 0xc]
jb 0x14000f660
jmp 0x14000f6cb
mov ecx, edi
mov ebp, 1
imul rcx, rcx, 0x2c
mov eax, dword [rcx + rsi]
mov dword [r14], eax
mov eax, dword [rcx + rsi + 4]
mov dword [r15], eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rsi, qword [rsp + 0x480]
mov eax, ebp
mov rdi, qword [rsp + 0x440]
mov rcx, qword [rsp + 0x430]
xor rcx, rsp
call fcn.1400161c0
add rsp, 0x448
pop r15
pop r14
pop rbp
pop rbx
ret
Function at 0x140010580
Capabilities:
Check if file exists
Get file attributes
Read .ini file
Set environment variable

Disassembly:
push rbx
sub rsp, 0xc0
mov rax, qword [0x14003f2f0]
xor rax, rsp
mov qword [rsp + 0xb0], rax
xor edx, edx
lea rcx, [rsp + 0x34]
mov dword [rsp + 0x30], 0
lea r8d, [rdx + 0x7c]
call fcn.1400166f0
lea rbx, str.C:Info.bom
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1400105f2
lea rbx, str.C:System.savInfo.bom
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1400105f2
lea rbx, str.C:System.savUtilInfo.bom
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14001061f
lea r9, [rsp + 0x30]
lea r8, str.1234567_001_Rev_1
lea rdx, str.SkuNumber
lea rcx, str.Info
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0x40
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea rcx, [rsp + 0x30]
mov edx, 0x2d
call qword [sym.imp.SHLWAPI.dll_StrChrW]
lea rcx, [0x140041960]
test rax, rax
je 0x14001064d
lea rdx, [rax + 2]
mov r8d, 3
call qword [sym.imp.SHLWAPI.dll_StrCpyNW]
jmp 0x14001065a
lea rdx, [0x14002db18]
call qword [sym.imp.SHLWAPI.dll_StrCpyW]
lea rdx, [0x140041960]
lea rcx, str.BuildType
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.1400161c0
add rsp, 0xc0
pop rbx
ret
Function at 0x1400109a0
Capabilities:
Query environment variable
Query or enumerate registry value
Set environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x2160]
mov eax, 0x2260
call fcn.140018cb0
sub rsp, rax
mov rax, qword [0x14003f2f0]
xor rax, rsp
mov qword [rbp + 0x2150], rax
mov rdi, rcx
xor esi, esi
lea rcx, [rsp + 0x54]
xor edx, edx
mov r8d, 0x1fc
mov ebx, esi
mov dword [rsp + 0x50], esi
call fcn.1400166f0
lea rcx, [rbp + 0x154]
xor edx, edx
mov r8d, 0xffc
mov dword [rbp + 0x150], esi
call fcn.1400166f0
lea rcx, [rbp + 0x1154]
xor edx, edx
mov r8d, 0xffc
mov dword [rbp + 0x1150], esi
call fcn.1400166f0
lea rax, [rsp + 0x40]
lea r9, [rsp + 0x44]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x150]
lea r8, [rsp + 0x50]
mov qword [rsp + 0x30], rax
xor edx, edx
mov rcx, rdi
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x44], pe_nt_image_headers64
mov dword [rsp + 0x40], 0x800
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x140010b5f
nop word [rax + rax]
lea rdx, [rbp + 0x1150]
lea rcx, [rbp + 0x150]
mov r8d, 0x800
inc ebx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea rdx, str.Path
lea rcx, [rsp + 0x50]
call fcn.140017124
test eax, eax
je 0x140010ad8
lea rdx, str.UserName
lea rcx, [rsp + 0x50]
call fcn.140017124
test eax, eax
je 0x140010ad8
lea rdx, [rbp + 0x1150]
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea rcx, [rsp + 0x50]
xor edx, edx
mov r8d, 0x200
mov dword [rsp + 0x44], pe_nt_image_headers64
mov dword [rsp + 0x40], 0x800
call fcn.1400166f0
lea rcx, [rbp + 0x150]
xor edx, edx
mov r8d, 0x1000
call fcn.1400166f0
lea rcx, [rbp + 0x1150]
xor edx, edx
mov r8d, 0x1000
call fcn.1400166f0
lea rax, [rsp + 0x40]
lea r9, [rsp + 0x44]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x150]
lea r8, [rsp + 0x50]
mov qword [rsp + 0x30], rax
mov edx, ebx
mov rcx, rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
je 0x140010a80
mov rcx, qword [rbp + 0x2150]
xor rcx, rsp
call fcn.1400161c0
lea r11, [rsp + 0x2260]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x140011030
Capabilities:
Query environment variable
Read .ini file
Set environment variable

Disassembly:
push rbp
lea rbp, [rsp - 0x1090]
mov eax, 0x1190
call fcn.140018cb0
sub rsp, rax
mov rax, qword [0x14003f2f0]
xor rax, rsp
mov qword [rbp + 0x1080], rax
mov qword [rsp + 0x11a8], rdi
lea rcx, [rbp + 0x884]
xor edi, edi
xor edx, edx
mov r8d, 0x3fc
mov dword [rbp + 0x880], edi
call fcn.1400166f0
lea rcx, [rbp + 0xc84]
xor edx, edx
mov r8d, 0x3fc
mov dword [rbp + 0xc80], edi
call fcn.1400166f0
lea rcx, [rbp + 0x484]
xor edx, edx
mov r8d, 0x3fc
mov dword [rbp + 0x480], edi
call fcn.1400166f0
lea rcx, [rbp + 0x284]
xor edx, edx
mov r8d, 0x1fc
mov dword [rbp + 0x280], edi
call fcn.1400166f0
lea rdx, [rbp + 0x880]
lea rcx, str.windir
mov r8d, 0x200
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov eax, edi
lea rdx, str.c:hp_supporthpsysdrv.dat
nop dword [rax]
movzx ecx, word [rax + rdx]
lea rax, [rax + 2]
mov word [rbp + rax + 0x47e], cx
test cx, cx
jne 0x1400110f0
lea r8, [rbp + 0x880]
lea rdx, str._s_system32drivers103C_HP
lea rcx, [rbp + 0xc80]
call fcn.140018028
lea rax, [rbp + 0x480]
lea r9, [rbp + 0x280]
mov qword [rsp + 0x28], rax
lea r8, [0x14002ce18]
lea rdx, str.BFirst
lea rcx, str.HPSYSDRV
mov dword [rsp + 0x20], pe_nt_image_headers64
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
jne 0x140011308
lea rcx, [rbp + 0x14]
xor edx, edx
mov r8d, 0x24c
call fcn.1400166f0
lea rdx, [rbp + 0x10]
lea rcx, [rbp + 0xc80]
mov dword [rbp + 0x10], 7

Function at 0x140011360
Capabilities:
Set environment variable

Disassembly:
push rbx
sub rsp, 0x450
mov rax, qword [0x14003f2f0]
xor rax, rsp
mov qword [rsp + 0x440], rax
mov rbx, rcx
lea rcx, [rsp + 0x240]
xor edx, edx
mov r8d, 0x200
call fcn.1400166f0
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0x200
call fcn.1400166f0
mov rcx, rbx
call fcn.140005b10
test eax, eax
je 0x14001145b
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x468], rsi
lea rsi, [0x140042700]
lea r9, [rsp + 0x240]
lea r8, [0x14002ce18]
lea rdx, [0x140032508]
mov rcx, rbx
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], pe_nt_image_headers64
call fcn.14000db60
mov dword [rsp + 0x30], 0
lea r9, [rsp + 0x40]
lea r8, [0x14002ce18]
lea rdx, str.Value
mov rcx, rbx
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], pe_nt_image_headers64
call fcn.14000db60
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x240]
lea rcx, str._nSetting_Environment_Variable__s_s
call fcn.14000adf0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x240]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rsi, qword [rsp + 0x468]
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.1400161c0
add rsp, 0x450
pop rbx
ret
Function at 0x140011480
Capabilities:
Get geographical location
Query environment variable
Set environment variable

Disassembly:
push rdi
sub rsp, 0xa80
mov rax, qword [0x14003f2f0]
xor rax, rsp
mov qword [rsp + 0xa70], rax
lea rcx, [rsp + 0x274]
xor edi, edi
xor edx, edx
mov r8d, 0x7fc
mov dword [rsp + 0x270], edi
call fcn.1400166f0
lea rdx, [rsp + 0x270]
lea rcx, str.CtryListEnv
mov r8d, 0x400
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea edx, [rdi + 0x2c]
lea rcx, [rsp + 0x270]
call fcn.1400149d0
test rax, rax
je 0x140011561
mov qword [rsp + 0xa90], rbx
mov rcx, rax
call fcn.140017774
mov ebx, eax
test eax, eax
je 0x140011548
mov r9d, 0x20
lea r8, [rsp + 0x30]
mov ecx, eax
lea edx, [r9 - 0x1b]
mov word [rsp + 0x20], di
call qword [sym.imp.KERNEL32.dll_GetGeoInfoW]
lea r8, [rsp + 0x70]
mov r9d, pe_nt_image_headers64
mov edx, 8
mov ecx, ebx
mov word [rsp + 0x20], di
call qword [sym.imp.KERNEL32.dll_GetGeoInfoW]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov edx, 0x2c
xor ecx, ecx
call fcn.1400149d0
test rax, rax
jne 0x1400114f1
mov rbx, qword [rsp + 0xa90]
mov rcx, qword [rsp + 0xa70]
xor rcx, rsp
call fcn.1400161c0
add rsp, 0xa80
pop rdi
ret
Function at 0x140011580
Capabilities:
Query environment variable
Read .ini file
Set environment variable

Disassembly:
push rbx
push rdi
push r14
push r15
sub rsp, 0x648
mov rax, qword [0x14003f2f0]
xor rax, rsp
mov qword [rsp + 0x630], rax
mov rbx, rcx
mov ecx, 0x200000
mov r14d, r8d
mov rdi, rdx
call fcn.140015468
mov r9, rbx
mov r8d, 0x100000
mov rcx, rdi
mov rdx, rax
mov r15, rax
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionW]
test eax, eax
jne 0x1400115de
mov rcx, r15
call fcn.1400159b8
xor eax, eax
jmp 0x140011745
cmp word [r15], 0
mov rdi, r15
je 0x140011738
mov qword [rsp + 0x688], rsi
mov qword [rsp + 0x640], r12
xor r12d, r12d
mov qword [rsp + 0x680], rbp
nop word [rax + rax]
or rbx, 0xffffffffffffffff
inc rbx
cmp word [rdi + rbx*2], r12w
jne 0x140011614
mov edx, 0x3d
mov rcx, rdi
inc ebx
call fcn.140016c54
test rax, rax
je 0x14001170f
lea rcx, [rsp + 0x24]
xor edx, edx
mov r8d, 0x204
mov dword [rsp + 0x20], r12d
call fcn.1400166f0
lea rdx, [rsp + 0x20]
sub rdx, rdi
mov rax, rdi
nop dword [rax + rax]
movzx ecx, word [rax]
lea rax, [rax + 2]
mov word [rdx + rax - 2], cx
test cx, cx
jne 0x140011660
lea rdx, [0x14002ddf8]
lea rcx, [rsp + 0x20]
call fcn.140016fd4
or rcx, 0xffffffffffffffff
mov rsi, rax
nop dword [rax]
cmp word [rax + rcx*2 + 2], r12w
lea rcx, [rcx + 1]
jne 0x140011690
lea rbp, [rsp + 0x22]
lea rdx, str.ISO_COUNTRY
lea rbp, [rbp + rcx*2]
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x14001170f
test rbp, rbp
je 0x14001170f
cmp r14d, 1
jne 0x1400116ca
mov rdx, rbp
jmp 0x140011706
lea rdx, [rsp + 0x230]
mov r8d, 0x200
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea rcx, [rsp + 0x230]
mov edx, 0x2525
call fcn.140016c54
test rax, rax
je 0x1400116fe
cmp r14d, 5
jne 0x14001170f
lea rdx, [rsp + 0x230]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
movsxd rax, ebx
lea rdi, [rdi + rax*2]
cmp word [rdi], r12w
jne 0x140011610
mov r12, qword [rsp + 0x640]
mov rsi, qword [rsp + 0x688]
mov rbp, qword [rsp + 0x680]
mov rcx, r15
call fcn.1400159b8
mov eax, 1
mov rcx, qword [rsp + 0x630]
xor rcx, rsp
call fcn.1400161c0
add rsp, 0x648
pop r15
pop r14
pop rdi
pop rbx
ret
Function at 0x140013410
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub rsp, 0x248
mov rax, qword [0x14003f2f0]
xor rax, rsp
mov qword [rsp + 0x230], rax
lea rdx, [rsp + 0x20]
mov r8d, 0x208
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, str.C:Program_FilesOnline_Services
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140013473
lea rdx, [rsp + 0x20]
lea rcx, str.C:Program_FilesOnline_Services
mov r8d, 0x69
call qword [sym.imp.SHELL32.dll_SHSetLocalizedName]
lea rcx, str.C:Program_FilesOnline_Services
call qword [sym.imp.SHLWAPI.dll_PathMakeSystemFolderW]
lea rcx, str.C:Program_Files__x86_Online_Services
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400134aa
lea rdx, [rsp + 0x20]
lea rcx, str.C:Program_Files__x86_Online_Services
mov r8d, 0x69
call qword [sym.imp.SHELL32.dll_SHSetLocalizedName]
lea rcx, str.C:Program_Files__x86_Online_Services
call qword [sym.imp.SHLWAPI.dll_PathMakeSystemFolderW]
lea rcx, str.C:ProgramDataMicrosoftWindowsStart_MenuProgramsOnline_Services
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400134e1
lea rdx, [rsp + 0x20]
lea rcx, str.C:ProgramDataMicrosoftWindowsStart_MenuProgramsOnline_Services
mov r8d, 0x69
call qword [sym.imp.SHELL32.dll_SHSetLocalizedName]
lea rcx, str.C:ProgramDataMicrosoftWindowsStart_MenuProgramsOnline_Services
call qword [sym.imp.SHLWAPI.dll_PathMakeSystemFolderW]
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1400161c0
add rsp, 0x248
ret
Function at 0x1418b2058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1418b21df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1418b2089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1418b206f
add dl, dl
jne 0x1418b2096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1418b20f6
xor eax, eax
add dl, dl
jne 0x1418b20a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1418b21ad
add dl, dl
jne 0x1418b20b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1418b20c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1418b20d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1418b20dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1418b20ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1418b207e
mov eax, 1
add dl, dl
jne 0x1418b2106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1418b2113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1418b20fb
sub eax, ebx
mov ebx, 1
jne 0x1418b214c
mov ecx, 1
add dl, dl
jne 0x1418b212e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1418b213b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1418b2123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1418b207e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1418b2168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1418b2175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1418b215d
cmp eax, 0x7d00
jae 0x1418b219b
cmp eax, 0x500
jb 0x1418b2196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1418b207e
cmp eax, 0x7f
ja 0x1418b219e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1418b207e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1418b21d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1418b207e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140003ee8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140003f32
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140003f32
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140003f32
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140003f32
cmp dword [rcx + 0x84], 0xe
jbe 0x140003f32
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140003f34
xor al, al
add rsp, 0x28
ret
Function at 0x140009513
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [rsp + 0x20], r9d
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x68
mov rax, qword [rsp + 0x78]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x78]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0x70]
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx + rax*8 + 0x88]
mov rcx, qword [rsp + 0x78]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0x20]
mov rcx, qword [rsp + 0x78]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0x1c]
mov rcx, qword [rsp + 0x78]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0x24]
mov rcx, qword [rsp + 0x78]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x20], 0
jmp 0x1400095bf
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0x18]
cmp dword [rsp + 0x20], eax
jae 0x140009627
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x38]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rsp + 0x78]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x40]
mov ecx, dword [rsp + 0x88]
call fcn.14000949f
cmp eax, dword [rsp + 0x80]
jne 0x140009625
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x48]
movzx eax, word [rcx + rax*2]
mov rcx, qword [rsp + 0x50]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rsp + 0x78]
add rcx, rax
mov rax, rcx
jmp 0x140009629
jmp 0x1400095b5
xor eax, eax
add rsp, 0x68
ret

Function at 0x14000962f
Capabilities:
Access peb ldr_data

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x58
mov rax, qword gs:[0x60]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
add rax, 0x10
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x28]
cmp qword [rsp + 0x20], rax
je 0x1400096bc
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 0x60]
call fcn.140008ddf
cmp dword [rsp + 0x60], eax
jne 0x1400096ad
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + 0x30]
jmp 0x1400096be
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
jmp 0x140009678
xor eax, eax
add rsp, 0x58
ret
Function at 0x140013e40
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x68
mov rax, qword [0x1402840b0]
mov edi, r8d
mov dword [rsp + 0xb8], edx
mov dword [rsp + 0x3c], r8d
mov rsi, rcx
mov ecx, 0xfffffff5
mov rdx, qword [rax]
mov qword [rsp + 0x58], rdx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdx, [rsp + 0x40]
mov rcx, rax
mov qword [rsp + 0x28], rdx
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
mov eax, 0x50
cmovne ax, word [rsp + 0x40]
cwde
sub eax, dword [rsp + 0xb8]
test dil, dil
mov dword [rsp + 0x38], eax
jne 0x140014040
cmp byte [rsi], 0
je 0x140014094
mov rcx, qword [sym.imp.msvcrt.dll___iob_func]
mov r14, rsi
mov r13d, 1
xor ebx, ebx
xor r12d, r12d
xor ebp, ebp
mov qword [rsp + 0x30], rcx
jmp 0x140013f28
test r13b, r13b
je 0x140014030
mov rsi, qword [rsp + 0x30]
add ebx, 1
call rsi
lea r9, [rax + 0x30]
mov rcx, r14
movsxd r8, ebp
mov edx, 1
mov r14, rdi
call sub.msvcrt.dll_fwrite
cmp dword [rsp + 0x38], ebx
jbe 0x140014020
xor r13d, r13d
xor r12d, r12d
xor ebp, ebp
cmp byte [rdi], 0
je 0x140013fd0
mov rsi, rdi
mov rdx, qword [rsp + 0x28]
mov rcx, rsi
call sym.libvlccore.dll_vlc_towc
cmp rax, 0xffffffffffffffff
mov r15, rax
je 0x140013fd0
movzx ecx, word [rsp + 0x40]
mov edx, 8
lea rdi, [rsi + rax]
call sub.msvcrt.dll_iswctype
test eax, eax
jne 0x140013ee0
add ebp, r15d
add r12d, 1
add ebx, 1
cmp dword [rsp + 0x38], ebx
ja 0x140013f1c
test r13b, r13b
mov ebx, r12d
je 0x140013f9f
call qword [sym.imp.msvcrt.dll___iob_func]
movsxd r8, ebp
lea r9, [rax + 0x30]
mov rcx, r14
sub r8, r15
mov edx, 1
mov ebp, r15d
mov r14, rsi
mov ebx, 1
mov r12d, 1
call sub.msvcrt.dll_fwrite
mov edx, dword [rsp + 0xb8]
lea r8, [0x14017d394]
lea rcx, [0x14017d395]
mov r13d, 1
call fcn.140013d50
cmp byte [rdi], 0
jne 0x140013f25
nop dword [rax + rax]
test r13b, r13b
je 0x140014080
cmp byte [rsp + 0x3c], 0
lea r8, str._s_ne_0m
lea rcx, [0x14017d388]
cmovne rcx, r8
mov rdx, r14
call fcn.140013d50
mov r9, qword [0x1402840b0]
mov rbx, qword [rsp + 0x58]
xor rbx, qword [r9]
jne 0x14001408f
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
xor ebx, ebx
xor r12d, r12d
xor ebp, ebp
jmp 0x140013f9f
mov ecx, 0x20
call sub.msvcrt.dll_putchar
jmp 0x140013ee9
call qword [sym.imp.msvcrt.dll___iob_func]
lea rcx, str.e_34_1m
lea r9, [rax + 0x30]
mov r8d, 7
mov edx, 1
call sub.msvcrt.dll_fwrite
cmp byte [rsi], 0
jne 0x140013ebc
mov r14, rsi
lea rcx, str._s_ne_0m
jmp 0x140013ff0
mov ecx, 0x20
call sub.msvcrt.dll_putchar
jmp 0x140013fd9
call fcn.1400c4db0
mov r14, rsi
lea rcx, [0x14017d388]
jmp 0x140013ff0