joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140004e62
Capabilities:
Query environment variable

Disassembly:
jmp 0x1403b0d60
sub rsp, 0x148
mov rax, qword [0x14056a550]
xor rax, rsp
mov qword [rsp + 0x140], rax
cmp dword [0x1406f9ec8], 0
jne 0x1403b0f65
cmp dword [0x1406f9ecc], 0
jne 0x1403b0f65
cmp dword [0x1406f9ec0], 0
jne 0x1403b0f65
cmp dword [0x1406f9ec4], 0
jne 0x1403b0f65
lea rcx, str.FORT_BLOCKSIZE
lea rdx, [rsp + 0x30]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x1403b0e1c
cmp eax, 0x104
jb 0x1403b0dd7
mov byte [rsp + 0x30], 0
dec eax
lea rcx, [rsp + 0x30]
lea r9, [rsp + 0x2c]
mov edx, eax
mov r8d, 2
call fcn.140003b75
mov edx, dword [rsp + 0x2c]
lea ecx, [rdx + 0x1ff]
and ecx, 0xfffffe00
cmp edx, 0x7fffc001
mov r8d, 0xfffffffe
cmovae ecx, r8d
test edx, edx
cmovs ecx, r8d
test eax, eax
cmovne ecx, r8d
jmp 0x1403b0e26
mov byte [rsp + 0x30], 0
mov ecx, 0xffffffff
mov dword [0x1406f9ec8], ecx
lea rcx, str.FORT_BUFFERCOUNT
lea rdx, [rsp + 0x30]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x1403b0e8e
cmp eax, 0x104
jb 0x1403b0e56
mov byte [rsp + 0x30], 0
dec eax
lea rcx, [rsp + 0x30]
lea r9, [rsp + 0x2c]
mov edx, eax
mov r8d, 2
call fcn.140003b75
mov edx, dword [rsp + 0x2c]
cmp edx, 0x7f
mov r8d, 0xfffffffe
mov ecx, edx
cmovg ecx, r8d
test edx, edx
cmovs ecx, r8d
test eax, eax
cmovne ecx, r8d
jmp 0x1403b0e98
mov byte [rsp + 0x30], 0
mov ecx, 0xffffffff
mov dword [0x1406f9ecc], ecx
lea rcx, str.FORT_FMT_RECL
lea rdx, [rsp + 0x30]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x1403b0ef4
cmp eax, 0x104
jb 0x1403b0ec8
mov byte [rsp + 0x30], 0
dec eax
lea rcx, [rsp + 0x30]
lea r9, [rsp + 0x2c]
mov edx, eax
mov r8d, 2
call fcn.140003b75
mov ecx, dword [rsp + 0x2c]
test ecx, ecx
mov edx, 0xfffffffe
cmovs ecx, edx
test eax, eax
cmovne ecx, edx
jmp 0x1403b0efe
mov byte [rsp + 0x30], 0
mov ecx, 0xffffffff
mov dword [0x1406f9ec0], ecx
lea rcx, str.FORT_UFMT_RECL
lea rdx, [rsp + 0x30]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x1403b0f5a
cmp eax, 0x104
jb 0x1403b0f2e
mov byte [rsp + 0x30], 0
dec eax
lea rcx, [rsp + 0x30]
lea r9, [rsp + 0x2c]
mov edx, eax
mov r8d, 2
call fcn.140003b75
mov ecx, dword [rsp + 0x2c]
test ecx, ecx
mov edx, 0xfffffffe
cmovs ecx, edx
test eax, eax
cmovne ecx, edx
jmp 0x1403b0f5f
mov ecx, 0xffffffff
mov dword [0x1406f9ec4], ecx
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.140003706
nop
add rsp, 0x148
ret
Function at 0x140004f70
Capabilities:
Terminate process

Disassembly:
jmp 0x140471810
sub rsp, 0x28
mov ecx, 0x17
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x14047182a
mov ecx, 5
int 0x29
mov r8d, 1
mov edx, 0xc0000417
lea ecx, [r8 + 1]
call fcn.140005b32
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000417
add rsp, 0x28
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
Function at 0x140005114
Capabilities:
Write file on windows

Disassembly:
jmp 0x140144ab0
push rbp
push rsi
sub rsp, 0x48
lea rbp, [rsp + 0x30]
movabs rax, 0x4e41524554495257
mov ecx, dword [rcx]
mov rsi, rdx
mov dword [0x140761844], ecx
mov qword [0x140761848], rax
lea r10d, [rcx - 1]
cmp r10d, 0x31
jbe 0x140144af0
mov dword [0x140898f1c], 1
jmp 0x140144bd3
movsxd rcx, ecx
lea rax, [0x140000000]
imul rcx, rcx, 0x138
mov rax, qword [rax + rcx + 0x75da18]
cmp rax, 0xffffffffffffffff
je 0x140144bda
lea r9, [0x140000000]
mov rdx, r8
lea r8, [0x140646140]
mov qword [rbp + 8], rax
xor eax, eax
mov dword [0x140898f1c], eax
mov r10d, dword [r9 + rcx + 0x75da2c]
lea rcx, [rbp + 0x10]
mov qword [0x140646140], 0
mov dword [0x140646150], eax
mov dword [0x140646154], eax
mov dword [rcx], r10d
call fcn.140004368
cmp dword [0x140761850], 0
je 0x140144b84
lea rdx, [0x140646140]
lea rcx, [rbp + 8]
lea r8, [0x1404db9dc]
lea r9, [rbp + 4]
call fcn.140006447
mov eax, dword [rbp + 4]
jmp 0x140144b9c
xor r8d, r8d
xor r9d, r9d
mov edx, dword [0x140646140]
mov rcx, qword [rbp + 8]
call sub.KERNEL32.dll_SetFilePointer
mov dword [rbp + 4], eax
test eax, eax
jne 0x140144bad
call sub.KERNEL32.dll_GetLastError
mov dword [0x140898f1c], eax
jmp 0x140144bd3
mov rax, rsp
mov rdx, rsi
mov r8d, dword [rbp + 0x10]
lea r9, [rbp]
mov rcx, qword [rbp + 8]
mov qword [rax + 0x20], 0
call sub.KERNEL32.dll_WriteFile
mov dword [rbp + 4], eax
test eax, eax
je 0x140144ba0
lea rsp, [rbp + 0x18]
pop rsi
pop rbp
ret
mov dword [0x140898f1c], 0x72
jmp 0x140144bd3
Function at 0x140005452
Capabilities:
Query environment variable

Disassembly:
jmp 0x14037ffc0
push rsi
sub rsp, 0x140
mov rax, qword [0x14056a550]
xor rax, rsp
mov qword [rsp + 0x138], rax
xor esi, esi
test rcx, rcx
je 0x14038009e
lea rdx, [rsp + 0x30]
mov r8d, 0x105
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x14038009e
xor ecx, ecx
cmp eax, 0x104
ja 0x140380096
movsx ecx, byte [rsp + 0x30]
lea eax, [rcx - 0x54]
cmp eax, 0x25
ja 0x14038002f
movabs rdx, 0x2100000021
bt rdx, rax
jae 0x14038002f
mov ecx, 1
jmp 0x140380096
test ecx, ecx
je 0x140380096
mov dword [rsp + 0x2c], 0
xor eax, eax
test cl, cl
je 0x140380094
movzx ecx, cl
add ecx, 0xffffffd0
cmp ecx, 9
ja 0x140380094
lea rcx, [rsp + 0x31]
nop word cs:[rax + rax]
movzx edx, byte [rcx]
lea r8d, [rdx - 0x30]
inc rcx
cmp r8d, 0xa
jb 0x140380060
test dl, dl
jne 0x140380094
lea rdx, [0x14052c90c]
lea rcx, [rsp + 0x30]
lea r8, [rsp + 0x2c]
call fcn.140004683
xor eax, eax
cmp dword [rsp + 0x2c], 0
setne al
mov ecx, eax
xor esi, esi
test ecx, ecx
setne sil
mov rcx, qword [rsp + 0x138]
xor rcx, rsp
call fcn.140003706
mov eax, esi
add rsp, 0x140
pop rsi
ret
Function at 0x1400056f0
Capabilities:
Set current directory

Disassembly:
jmp 0x140487a74
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
and qword [rbp - 0x30], 0
mov rbx, rcx
and qword [rbp - 0x28], 0
lea rcx, [rbp - 0x50]
and qword [rbp - 0x20], 0
xor edx, edx
and qword [rbp - 0x18], 0
and qword [rbp - 0x10], 0
mov byte [rbp - 8], 0
call fcn.140002ea5
mov rax, qword [rbp - 0x48]
mov r9d, 0xfde9
cmp dword [rax + 0xc], r9d
jne 0x140487acf
cmp byte [rbp - 0x38], 0
je 0x140487b04
mov rax, qword [rbp - 0x50]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x140487b04
call fcn.14000650a
test eax, eax
jne 0x140487af0
cmp byte [rbp - 0x38], al
je 0x140487ae8
mov rax, qword [rbp - 0x50]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x140487b04
cmp byte [rbp - 0x38], 0
je 0x140487b01
mov rax, qword [rbp - 0x50]
and dword [rax + 0x3a8], 0xfffffffd
xor r9d, r9d
lea r8, [rbp + 0x18]
mov rcx, rbx
lea rdx, [rbp - 0x30]
call fcn.140006893
test eax, eax
je 0x140487b1c
xor ebx, ebx
jmp 0x140487b28
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov ebx, eax
cmp byte [rbp - 8], 0
je 0x140487b37
mov rcx, qword [rbp - 0x20]
call fcn.140001276
mov eax, ebx
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
Function at 0x1400058e4
Capabilities:
Check http status code

Disassembly:
jmp 0x140073ab0
push rbp
sub rsp, 0x4b0
lea rbp, [rsp + 0x30]
mov edx, 0x104
lea r8, [0x1408b7560]
lea rcx, [rbp + 0x110]
mov r9d, edx
mov eax, 0x305a
mov word [0x1408bab27], ax
mov byte [0x1408bab29], 0x30
mov dword [rcx - 0xc], 0x64
call fcn.140002c52
mov edx, eax
movsxd rdx, edx
lea rcx, [0x1408bab27]
mov qword [rbp + 0x440], rdx
mov edx, 2
mov qword [rbp + 0x448], rcx
lea rcx, [rbp + 0x438]
lea r8, [0x1405ef0a0]
mov r9d, 0x104
mov qword [rcx + 0x18], 0xc
lea rax, [rbp + 0x110]
mov qword [rcx], rax
call fcn.1400048cc
mov edx, 0x104
lea rcx, [rbp + 0x220]
lea r8, [0x1405ef0a0]
mov r9d, edx
call fcn.140002c52
movsxd rax, eax
lea rcx, [rbp + 0x220]
mov rdx, rax
call fcn.140001929
test al, 1
je 0x140073c5e
mov qword [rbp + 0x218], rbx
lea rcx, [rbp]
mov qword [rbp + 0x108], rsi
mov rbx, rcx
lea rsi, [0x1408bab27]
mov r10d, dword [rbp + 0x104]
lea r8d, [r10 + 1]
mov dword [rbp + 0x104], r8d
cmp r8d, 0xc8
jge 0x140073ccc
lea rdx, [0x1405ef1b0]
lea rcx, [rbp + 0x104]
mov r8d, 7
call fcn.140001a37
movzx eax, word [0x1405ef1b5]
mov word [0x1408bab28], ax
mov edx, 0x104
mov rcx, rbx
lea r8, [0x1408b7560]
mov r9d, edx
call fcn.140002c52
mov edx, 2
lea rcx, [rbp + 0x458]
lea r8, [0x1405ef0a0]
mov r9d, 0x104
movsxd rax, eax
mov qword [rcx], rbx
mov qword [rcx + 8], rax
mov qword [rcx + 0x10], rsi
mov qword [rcx + 0x18], 0xc
call fcn.1400048cc
mov edx, 0x104
lea rcx, [rbp + 0x330]
lea r8, [0x1405ef0a0]
mov r9d, edx
call fcn.140002c52
movsxd rdx, eax
lea rcx, [rbp + 0x330]
call fcn.140001929
test al, 1
jne 0x140073b8d
mov rbx, qword [rbp + 0x218]
mov rsi, qword [rbp + 0x108]
mov rax, rsp
lea rcx, [0x1404b0dbc]
lea rdx, [0x1405ef0a0]
lea r8, [0x1404b0dc4]
mov r9d, 0x104
mov qword [rax + 0x20], 6
call fcn.1400038fa
cmp dword [0x140898f1c], 0
je 0x140073cbc
lea rcx, str.FILE_NAMING_PROBLEM
mov edx, 0x13
call fcn.140004ad9
lea rcx, [0x1408bab27]
lea rdx, [0x1404b0dc0]
mov r8d, 0xc
call fcn.140006316
mov byte [0x1408baf52], 0x2e
lea rsp, [rbp + 0x480]
pop rbp
ret
mov eax, 0x4ec4ec4f
imul r8d
sar r8d, 0x1f
sar edx, 3
sub edx, r8d
imul r9d, edx, 0xffffffe6
lea r8d, [rdx + 0x40]
mov byte [0x1405ef1b5], r8b
lea r10d, [r9 + r10 + 0x42]
mov byte [0x1405ef1b6], r10b
jmp 0x140073bc5
Function at 0x140005cea
Capabilities:
Set thread local storage value

Disassembly:
jmp 0x14040f00c
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
lea r9, [0x140542ac8]
mov edi, ecx
lea rdx, str.FlsSetValue
mov ecx, 3
lea r8, [0x140542ac0]
call fcn.14040ea84
mov rdx, rbx
mov ecx, edi
test rax, rax
je 0x14040f04c
call qword [0x1408e8020]
jmp 0x14040f052
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140005df8
Capabilities:
Set environment variable

Disassembly:
jmp 0x14048786c
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.140002ea5
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x1404878f6
cmp byte [rbp - 0x21], r15b
je 0x1404878f1
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x14048792c
call fcn.14000650a
test eax, eax
jne 0x140487918
cmp byte [rbp - 0x21], r15b
je 0x140487910
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x14048792c
cmp byte [rbp - 0x21], r15b
je 0x140487929
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.140006893
test eax, eax
jne 0x1404879cc
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.140002ea5
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x14048796b
cmp byte [rbp - 0x21], r15b
je 0x1404879a0
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x1404879a0
call fcn.14000650a
test eax, eax
jne 0x14048798c
cmp byte [rbp - 0x21], r15b
je 0x140487985
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x1404879a0
cmp byte [rbp - 0x21], r15b
je 0x14048799d
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.140006893
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x1404879cc
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x1404879cf
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x1404879dd
mov rcx, rdi
call fcn.140001276
cmp byte [rbp + 0x3f], r15b
je 0x1404879ec
mov rcx, qword [rbp + 0x27]
call fcn.140001276
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x140005e7f
Capabilities:
Read file on windows

Disassembly:
jmp 0x140164140
push rbp
push rbx
sub rsp, 0xa8
lea rbp, [rsp + 0x30]
movabs rax, 0x444e415244414552
mov ecx, dword [rcx]
mov rbx, rdx
mov dword [0x140761844], ecx
mov qword [0x140761848], rax
lea r10d, [rcx - 1]
cmp r10d, 0x31
jbe 0x140164183
mov dword [0x140898f1c], 1
jmp 0x1401642a6
movsxd rcx, ecx
lea rax, [0x140000000]
imul rcx, rcx, 0x138
mov rax, qword [rax + rcx + 0x75da18]
cmp rax, 0xffffffffffffffff
je 0x1401642ad
mov qword [rbp + 0x58], rax
lea rax, [0x140000000]
mov rdx, r8
lea r8, [rbp + 0x60]
mov dword [0x140898f1c], 0
mov r9d, dword [rax + rcx + 0x75da2c]
lea rcx, [rbp + 0x54]
mov dword [rcx], r9d
call fcn.140004368
lea r8, [0x1404df3ac]
lea rcx, [rbp + 0x58]
lea rdx, [rbp + 0x60]
lea r9, [rbp + 0x68]
call fcn.140006447
cmp dword [rbp + 0x68], 0
je 0x14016429b
mov rax, rsp
mov rdx, rbx
mov r8d, dword [rbp + 0x54]
lea r9, [rbp + 0x50]
mov rcx, qword [rbp + 0x58]
mov qword [rax + 0x20], 0
call sub.KERNEL32.dll_ReadFile
mov dword [rbp + 0x68], eax
test eax, eax
jne 0x1401642a6
mov rcx, rsp
lea rdx, [rbp + 0x30]
movabs r8, 0x801228384ff00
lea r9, [0x1404df3b0]
lea rax, str.READR_reclen_lbread
mov qword [rbp], 0
mov qword [rcx + 0x20], rdx
lea rcx, [rbp]
mov edx, 0xffffffff
mov qword [rbp + 0x30], 0x13
mov qword [rbp + 0x38], rax
call fcn.140002004
mov eax, dword [rbp + 0x54]
lea rcx, [rbp]
lea rdx, [0x1404df3b8]
lea r8, [rbp + 0x40]
mov dword [r8], eax
call fcn.140002f27
mov eax, dword [rbp + 0x50]
lea rcx, [rbp]
lea rdx, [0x1404df3c0]
lea r8, [rbp + 0x48]
mov dword [r8], eax
call fcn.140002f27
call sub.KERNEL32.dll_GetLastError
mov dword [0x140898f1c], eax
lea rsp, [rbp + 0x78]
pop rbx
pop rbp
ret
mov dword [0x140898f1c], 0x72
jmp 0x1401642a6

Function at 0x140005f88
Capabilities:
Parse pe header

Disassembly:
jmp 0x140441854
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
jmp 0x1404415b0
Function at 0x140006285
Capabilities:
Get file size

Disassembly:
jmp 0x1400276f0
push rbp
sub rsp, 0x60
lea rbp, [rsp + 0x20]
xor eax, eax
mov qword [rbp + 0x28], r13
lea r13, [rbp + 0x1f]
mov ecx, dword [rcx]
and r13, 0xffffffffffffffe0
mov qword [rbp + 0x30], r13
lea edx, [rcx - 1]
cmp edx, 0x31
ja 0x14002775c
movsxd rcx, ecx
lea rdx, [0x140000000]
imul r8, rcx, 0x138
mov rcx, qword [rdx + r8 + 0x75da18]
cmp rcx, 0xffffffffffffffff
je 0x14002775c
mov qword [r13], 0
lea rdx, [r13 + 4]
call sub.KERNEL32.dll_GetFileSize
cmp eax, 0xffffffff
je 0x140027766
mov dword [r13], eax
mov edx, eax
mov eax, dword [r13 + 4]
shl rax, 0x20
or rax, rdx
mov r13, qword [rbp + 0x28]
lea rsp, [rbp + 0x40]
pop rbp
ret
call sub.KERNEL32.dll_GetLastError
test eax, eax
je 0x14002774b
mov dword [r13 + 4], 0
xor eax, eax
jmp 0x14002774b
Function at 0x1400065a0
Capabilities:
Set registry value

Disassembly:
jmp 0x140049b20
push rbp
push rdi
push r12
push r13
sub rsp, 0x2f8
lea rbp, [rsp + 0x50]
mov r13, r8
mov r12, rdx
mov rdi, rcx
mov edx, 2
lea rcx, [rbp + 0x240]
lea r8, [0x1405c3910]
mov r9d, 0x28
lea rax, str.SoftwareWinstepsRecentFiles
lea r10, [rbp + 0x2a0]
mov qword [rcx], rax
mov qword [rcx + 8], 0x1d
mov byte [rcx + 0x60], 0
mov qword [rcx + 0x10], r10
mov qword [rcx + 0x18], 1
call fcn.1400048cc
mov r11, rsp
mov rcx, 0xffffffff80000001
lea rdx, [0x1405c3910]
xor r8d, r8d
lea r9, [0x1405c3938]
xor r10d, r10d
mov qword [rbp + 0x280], r10
lea rax, [rbp + 0x280]
mov dword [0x1405c3938], 0x20202000
mov dword [r11 + 0x20], 0
mov dword [r11 + 0x28], 0x4001f
mov qword [r11 + 0x30], r10
mov qword [r11 + 0x38], rax
mov qword [r11 + 0x40], r10
call sub.ADVAPI32.dll_RegCreateKeyExA
test eax, eax
jne 0x140049cdc
mov edx, 0x12c
lea rcx, [rbp]
mov r8, r12
mov r9, r13
call fcn.1400042eb
mov rax, rsp
lea r12, [0x1405c3820]
mov rcx, r12
mov edx, 0xf0
mov r9d, 0x12c
lea r8, [rbp]
mov qword [rax + 0x20], 0
call fcn.1400025f4
mov edx, 0xc
lea rcx, [rbp + 0x260]
mov r8, rdi
call fcn.140004390
mov edx, 0xc
lea rdi, [rbp + 0x270]
mov rcx, rdi
lea r8, [rbp + 0x260]
mov r9d, edx
call fcn.140002c52
mov edx, 2
lea rcx, [rbp + 0x220]
lea r8, [0x1405c393c]
mov r9d, 4
mov qword [rcx], rdi
lea rdi, [rbp + 0x290]
movsxd rax, eax
mov qword [rcx + 8], rax
mov byte [rcx + 0x70], 0
mov qword [rcx + 0x10], rdi
mov qword [rcx + 0x18], 1
call fcn.1400048cc
mov edx, 0xf0
lea rcx, [rbp + 0x130]
mov r8, r12
mov r9d, edx
call fcn.140002c52
mov rdx, rsp
xor r8d, r8d
mov r9d, 1
mov rcx, qword [rbp + 0x280]
mov qword [rdx + 0x20], r12
mov dword [rdx + 0x28], eax
lea rdx, [0x1405c393c]
call sub.ADVAPI32.dll_RegSetValueExA
test eax, eax
jne 0x140049cdc
mov rcx, qword [rbp + 0x280]
call sub.ADVAPI32.dll_RegCloseKey
lea rsp, [rbp + 0x2a8]
pop r13
pop r12
pop rdi
pop rbp
ret

Function at 0x140006681
Capabilities:
Get graphical window text

Disassembly:
jmp 0x1400562f0
push rbp
sub rsp, 0x30
lea rbp, [rsp + 0x20]
test byte [0x1408bdc20], 1
je 0x14005636f
mov eax, dword [0x140729df0]
test eax, eax
jl 0x14005636f
mov dword [0x1408bdc20], 0
mov qword [rbp], rbx
mov ebx, eax
mov edx, 0x100
mov r8d, 0x2e
mov r9d, 1
mov rcx, qword [0x1407619c8]
call sub.USER32.dll_SendMessageA
call fcn.140002360
dec ebx
jns 0x14005631d
mov edx, 0x102
mov r8d, 0xd
mov r9d, 1
mov rcx, qword [0x1407619c8]
mov rbx, qword [rbp]
call sub.USER32.dll_SendMessageA
nop
lea rsp, [rbp + 0x10]
pop rbp
jmp fcn.140002360
lea rsp, [rbp + 0x10]
pop rbp
ret
Function at 0x140021ee0
Capabilities:
Query or enumerate registry value

Disassembly:
jmp 0x140021ee0
push rbp
push r13
push r14
push r15
sub rsp, 0xb8
lea rbp, [rsp + 0x30]
mov r15, r8
mov r13, rcx
lea rcx, [rbp]
mov edx, 2
lea r8, [0x14056ced0]
mov r9d, 0x28
lea r10, [0x1404a7d68]
mov qword [rcx], r10
lea r11, [rbp + 0x70]
mov qword [rbp + 8], 0x1d
lea r14, [0x140000000]
mov byte [r11], 0
mov qword [rbp + 0x10], r11
mov qword [rbp + 0x18], 1
call fcn.1400048cc
mov r10, rsp
lea rcx, [0x14056cde0]
mov edx, 0xf0
lea r8, [0x1404a7d88]
mov r9d, 1
mov qword [r10 + 0x20], 0
call fcn.1400025f4
mov edx, 0xc
lea rcx, [rbp + 0x40]
mov r8, r15
call fcn.140004390
mov edx, 0xc
lea r15, [rbp + 0x50]
mov rcx, r15
lea r8, [rbp + 0x40]
mov r9d, edx
call fcn.140002c52
mov edx, 2
lea rcx, [rbp + 0x20]
lea r8, [0x14056cef8]
mov r9d, 4
movsxd rax, eax
lea r10, [rbp + 0x80]
mov qword [rcx], r15
mov qword [rbp + 0x28], rax
mov byte [rcx + 0x60], 0
mov qword [rbp + 0x30], r10
mov qword [rbp + 0x38], 1
call fcn.1400048cc
mov r11, rsp
mov rcx, 0xffffffff80000001
lea rdx, [0x14056ced0]
xor r8d, r8d
mov r9d, 0x4001f
lea r10, [rbp + 0x60]
mov qword [r11 + 0x20], r10
call sub.ADVAPI32.dll_RegOpenKeyExA
test eax, eax
jne 0x1400220b3
mov r15, rsp
lea rdx, [0x14056cef8]
xor r8d, r8d
lea r9, [rbp + 0x5c]
mov rcx, qword [rbp + 0x60]
lea r10, [0x14056cde0]
mov dword [rbp + 0x4c], 0xf0
lea r11, [rbp + 0x4c]
mov qword [r15 + 0x20], r10
mov qword [r15 + 0x28], r11
call sub.ADVAPI32.dll_RegQueryValueExA
test eax, eax
jne 0x140022081
movsxd rcx, dword [rbp + 0x4c]
cmp rcx, 2
jle 0x14002206c
lea rdx, [0x14056cde0]
lea r8, [rcx - 1]
neg r8
add r8, 0xf0
lea rcx, [rdx + rcx - 1]
mov edx, 0
cmovg rdx, r8
lea r8, [0x1404a7d8c]
jmp 0x140022094
lea rcx, [0x14056cde0]
mov edx, 0xf0
lea r8, [0x1404a7d90]
jmp 0x140022094
lea rcx, [0x14056cde0]
mov edx, 0xf0
lea r8, [0x1404a7d94]
mov r10, rsp
mov r9d, 1
mov qword [r10 + 0x20], 0
call fcn.1400025f4
mov rcx, qword [rbp + 0x60]
call sub.ADVAPI32.dll_RegCloseKey
mov edx, 0xf0
movups xmm0, xmmword [r14 + rdx + 0x56cdd0]
movups xmmword [r13 + rdx - 0x10], xmm0
movups xmm1, xmmword [r14 + rdx + 0x56cdc0]
movups xmmword [r13 + rdx - 0x20], xmm1
movups xmm2, xmmword [r14 + rdx + 0x56cdb0]
movups xmmword [r13 + rdx - 0x30], xmm2
movups xmm3, xmmword [r14 + rdx + 0x56cda0]
movups xmmword [r13 + rdx - 0x40], xmm3
movups xmm4, xmmword [r14 + rdx + 0x56cd90]
movups xmmword [r13 + rdx - 0x50], xmm4
sub rdx, 0x50
jne 0x1400220b8
mov rax, r13
lea rsp, [rbp + 0x88]
pop r15
pop r14
pop r13
pop rbp
ret
Function at 0x1400276f0
Capabilities:
Get file size

Disassembly:
jmp 0x1400276f0
push rbp
sub rsp, 0x60
lea rbp, [rsp + 0x20]
xor eax, eax
mov qword [rbp + 0x28], r13
lea r13, [rbp + 0x1f]
mov ecx, dword [rcx]
and r13, 0xffffffffffffffe0
mov qword [rbp + 0x30], r13
lea edx, [rcx - 1]
cmp edx, 0x31
ja 0x14002775c
movsxd rcx, ecx
lea rdx, [0x140000000]
imul r8, rcx, 0x138
mov rcx, qword [rdx + r8 + 0x75da18]
cmp rcx, 0xffffffffffffffff
je 0x14002775c
mov qword [r13], 0
lea rdx, [r13 + 4]
call sub.KERNEL32.dll_GetFileSize
cmp eax, 0xffffffff
je 0x140027766
mov dword [r13], eax
mov edx, eax
mov eax, dword [r13 + 4]
shl rax, 0x20
or rax, rdx
mov r13, qword [rbp + 0x28]
lea rsp, [rbp + 0x40]
pop rbp
ret
call sub.KERNEL32.dll_GetLastError
test eax, eax
je 0x14002774b
mov dword [r13 + 4], 0
xor eax, eax
jmp 0x14002774b
Function at 0x140049b20
Capabilities:
Set registry value

Disassembly:
jmp 0x140049b20
push rbp
push rdi
push r12
push r13
sub rsp, 0x2f8
lea rbp, [rsp + 0x50]
mov r13, r8
mov r12, rdx
mov rdi, rcx
mov edx, 2
lea rcx, [rbp + 0x240]
lea r8, [0x1405c3910]
mov r9d, 0x28
lea rax, str.SoftwareWinstepsRecentFiles
lea r10, [rbp + 0x2a0]
mov qword [rcx], rax
mov qword [rcx + 8], 0x1d
mov byte [rcx + 0x60], 0
mov qword [rcx + 0x10], r10
mov qword [rcx + 0x18], 1
call fcn.1400048cc
mov r11, rsp
mov rcx, 0xffffffff80000001
lea rdx, [0x1405c3910]
xor r8d, r8d
lea r9, [0x1405c3938]
xor r10d, r10d
mov qword [rbp + 0x280], r10
lea rax, [rbp + 0x280]
mov dword [0x1405c3938], 0x20202000
mov dword [r11 + 0x20], 0
mov dword [r11 + 0x28], 0x4001f
mov qword [r11 + 0x30], r10
mov qword [r11 + 0x38], rax
mov qword [r11 + 0x40], r10
call sub.ADVAPI32.dll_RegCreateKeyExA
test eax, eax
jne 0x140049cdc
mov edx, 0x12c
lea rcx, [rbp]
mov r8, r12
mov r9, r13
call fcn.1400042eb
mov rax, rsp
lea r12, [0x1405c3820]
mov rcx, r12
mov edx, 0xf0
mov r9d, 0x12c
lea r8, [rbp]
mov qword [rax + 0x20], 0
call fcn.1400025f4
mov edx, 0xc
lea rcx, [rbp + 0x260]
mov r8, rdi
call fcn.140004390
mov edx, 0xc
lea rdi, [rbp + 0x270]
mov rcx, rdi
lea r8, [rbp + 0x260]
mov r9d, edx
call fcn.140002c52
mov edx, 2
lea rcx, [rbp + 0x220]
lea r8, [0x1405c393c]
mov r9d, 4
mov qword [rcx], rdi
lea rdi, [rbp + 0x290]
movsxd rax, eax
mov qword [rcx + 8], rax
mov byte [rcx + 0x70], 0
mov qword [rcx + 0x10], rdi
mov qword [rcx + 0x18], 1
call fcn.1400048cc
mov edx, 0xf0
lea rcx, [rbp + 0x130]
mov r8, r12
mov r9d, edx
call fcn.140002c52
mov rdx, rsp
xor r8d, r8d
mov r9d, 1
mov rcx, qword [rbp + 0x280]
mov qword [rdx + 0x20], r12
mov dword [rdx + 0x28], eax
lea rdx, [0x1405c393c]
call sub.ADVAPI32.dll_RegSetValueExA
test eax, eax
jne 0x140049cdc
mov rcx, qword [rbp + 0x280]
call sub.ADVAPI32.dll_RegCloseKey
lea rsp, [rbp + 0x2a8]
pop r13
pop r12
pop rdi
pop rbp
ret
Function at 0x1400562f0
Capabilities:
Get graphical window text

Disassembly:
jmp 0x1400562f0
push rbp
sub rsp, 0x30
lea rbp, [rsp + 0x20]
test byte [0x1408bdc20], 1
je 0x14005636f
mov eax, dword [0x140729df0]
test eax, eax
jl 0x14005636f
mov dword [0x1408bdc20], 0
mov qword [rbp], rbx
mov ebx, eax
mov edx, 0x100
mov r8d, 0x2e
mov r9d, 1
mov rcx, qword [0x1407619c8]
call sub.USER32.dll_SendMessageA
call fcn.140002360
dec ebx
jns 0x14005631d
mov edx, 0x102
mov r8d, 0xd
mov r9d, 1
mov rcx, qword [0x1407619c8]
mov rbx, qword [rbp]
call sub.USER32.dll_SendMessageA
nop
lea rsp, [rbp + 0x10]
pop rbp
jmp fcn.140002360
lea rsp, [rbp + 0x10]
pop rbp
ret

Function at 0x14005630d
Capabilities:
Get graphical window text

Disassembly:
jmp 0x1400562f0
push rbp
sub rsp, 0x30
lea rbp, [rsp + 0x20]
test byte [0x1408bdc20], 1
je 0x14005636f
mov eax, dword [0x140729df0]
test eax, eax
jl 0x14005636f
mov dword [0x1408bdc20], 0
mov qword [rbp], rbx
mov ebx, eax
mov edx, 0x100
mov r8d, 0x2e
mov r9d, 1
mov rcx, qword [0x1407619c8]
call sub.USER32.dll_SendMessageA
call fcn.140002360
dec ebx
jns 0x14005631d
mov edx, 0x102
mov r8d, 0xd
mov r9d, 1
mov rcx, qword [0x1407619c8]
mov rbx, qword [rbp]
call sub.USER32.dll_SendMessageA
nop
lea rsp, [rbp + 0x10]
pop rbp
jmp fcn.140002360
lea rsp, [rbp + 0x10]
pop rbp
ret