joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400a7b0c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
xor ebx, ebx
mov rdi, r8
mov rsi, rdx
mov r15, rcx
test r8, r8
jne 0x1400a7b3d
call fcn.140036380
mov rdi, qword [rax + 0x18]
lea r8, [0x1403db4a8]
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbp, rax
test rax, rax
jne 0x1400a7b5c
xor eax, eax
jmp 0x1400a7ba8
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
test rax, rax
je 0x1400a7b58
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r14, rax
test rax, rax
je 0x1400a7b9d
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rdx, r14
mov rcx, r15
mov r8d, eax
call fcn.1400a7bc4
mov ebx, eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret

Function at 0x1400ab310
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
xor edi, edi
mov dword [rax - 0x18], edi
mov rbx, qword [0x14047a8b8]
and qword [rax + 0x10], rdi
xor esi, esi
mov eax, dword [0x140475fd0]
test eax, eax
je 0x1400ab35b
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x140475fd0]
test eax, eax
jne 0x1400ab364
call fcn.140015924
test eax, eax
je 0x1400ab380
lea rdx, [rsp + 0x48]
mov rcx, qword [0x14046a4b0]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne 0x1400ab388
xor eax, eax
jmp 0x1400ab3ed
test rbx, rbx
jne 0x1400ab3a8
lea rcx, str.ImageList_GetImageCount
call fcn.140020fc0
mov rbx, rax
test rax, rax
je 0x1400ab3bb
mov qword [0x14047a8b8], rax
mov rcx, rbx
call fcn.1402829ec
mov rcx, r14
call rbx
mov edi, eax
mov dword [rsp + 0x20], eax
xor ebx, ebx
test edi, edi
sete bl
test ebx, ebx
je 0x1400ab3d0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x1400ab3d2
xor esi, esi
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x1400ab3eb
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x1401040f0
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
xor edi, edi
mov dword [rax - 0x18], edi
mov rbx, qword [0x14047cb08]
and qword [rax + 0x10], rdi
xor esi, esi
mov eax, dword [0x140475fd0]
test eax, eax
je 0x14010413b
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x140475fd0]
test eax, eax
jne 0x140104144
call fcn.140015924
test eax, eax
je 0x140104160
lea rdx, [rsp + 0x48]
mov rcx, qword [0x14046a4b0]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne 0x140104168
xor eax, eax
jmp 0x1401041cd
test rbx, rbx
jne 0x140104188
lea rcx, str.ChooseFontW
call fcn.140050a34
mov rbx, rax
test rax, rax
je 0x14010419b
mov qword [0x14047cb08], rax
mov rcx, rbx
call fcn.1402829ec
mov rcx, r14
call rbx
mov edi, eax
mov dword [rsp + 0x20], eax
xor ebx, ebx
test edi, edi
sete bl
test ebx, ebx
je 0x1401041b0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x1401041b2
xor esi, esi
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x1401041cb
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret

Function at 0x14014db28
Capabilities:
Delete registry value

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx + 8]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
xor ecx, ecx
test eax, eax
sete cl
mov eax, ecx
add rsp, 0x28
ret

Function at 0x14014dd74
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
sub rsp, 0x38
mov rcx, qword [rcx + 8]
lea rax, [r11 + 8]
mov qword [r11 - 0x10], rax
lea r9, [r11 + 0x20]
mov qword [r11 - 0x18], r8
xor r8d, r8d
mov dword [rsp + 0x40], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor edx, edx
test eax, eax
jne 0x14014ddb6
mov ecx, dword [rsp + 0x58]
sub ecx, 4
neg ecx
sbb eax, eax
and eax, 0xd
test eax, eax
sete dl
mov eax, edx
add rsp, 0x38
ret
Function at 0x14014e240
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x30
mov rdi, r9
mov rbx, r8
mov rsi, rdx
mov rbp, rcx
test rdx, rdx
je 0x14014e312
test rbx, rbx
je 0x14014e318
test r9, r9
je 0x14014e31e
and qword [r8], 0
xor r8d, r8d
and dword [r9], 0
mov rcx, qword [rcx + 8]
mov qword [rax - 0x10], r9
lea r9, [rax + 0x10]
and qword [rax - 0x18], 0
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14014e2fb
cmp dword [rsp + 0x48], 3
jne 0x14014e2fb
test eax, eax
jne 0x14014e2fb
cmp dword [rdi], eax
je 0x14014e2fb
mov ecx, dword [rdi]
call fcn.14000d15c
mov qword [rbx], rax
lea r9, [rsp + 0x48]
mov rcx, qword [rbp + 8]
xor r8d, r8d
mov qword [rsp + 0x28], rdi
mov rdx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14014e2ef
cmp dword [rsp + 0x48], 3
jne 0x14014e2ef
test eax, eax
jne 0x14014e2ef
mov eax, 1
jmp 0x14014e2fd
mov rcx, qword [rbx]
call fcn.14000d164
and qword [rbx], 0
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
call fcn.140010b4c
int3
call fcn.140010b4c
int3
call fcn.140010b4c
int3

Function at 0x14014e6d0
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
cmp dword [rcx + 0x28], ebx
je 0x14014e6e1
xor eax, eax
jmp 0x14014e70f
mov rcx, qword [rcx + 8]
lea rax, [rsp + 0x40]
mov r9d, 4
mov dword [rsp + 0x40], r8d
mov dword [rsp + 0x28], r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
sete bl
mov eax, ebx
add rsp, 0x30
pop rbx
ret

Function at 0x14014e718
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
cmp dword [rcx + 0x28], ebx
je 0x14014e729
xor eax, eax
jmp 0x14014e74d
mov rcx, qword [rcx + 8]
mov dword [rsp + 0x28], r9d
mov r9d, 3
mov qword [rsp + 0x20], r8
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
sete bl
mov eax, ebx
add rsp, 0x30
pop rbx
ret
Function at 0x1401c1860
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
xor edi, edi
mov dword [rax - 0x18], edi
mov rbx, qword [0x14047e5c8]
and qword [rax + 0x10], rdi
xor esi, esi
mov eax, dword [0x140475fd0]
test eax, eax
je 0x1401c18ab
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x140475fd0]
test eax, eax
jne 0x1401c18b4
call fcn.140015924
test eax, eax
je 0x1401c18d0
lea rdx, [rsp + 0x48]
mov rcx, qword [0x14046a4b0]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne 0x1401c18d8
xor eax, eax
jmp 0x1401c193d
test rbx, rbx
jne 0x1401c18f8
lea rcx, str.ChooseColorW
call fcn.140050a34
mov rbx, rax
test rax, rax
je 0x1401c190b
mov qword [0x14047e5c8], rax
mov rcx, rbx
call fcn.1402829ec
mov rcx, r14
call rbx
mov edi, eax
mov dword [rsp + 0x20], eax
xor ebx, ebx
test edi, edi
sete bl
test ebx, ebx
je 0x1401c1920
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x1401c1922
xor esi, esi
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x1401c193b
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret

Function at 0x1401c8268
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
xor edi, edi
mov dword [rax - 0x18], edi
mov rbx, qword [0x14047e728]
and qword [rax + 0x10], rdi
xor esi, esi
mov eax, dword [0x140475fd0]
test eax, eax
je 0x1401c82b3
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x140475fd0]
test eax, eax
jne 0x1401c82bc
call fcn.140015924
test eax, eax
je 0x1401c82d8
lea rdx, [rsp + 0x48]
mov rcx, qword [0x14046a4b0]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne 0x1401c82e0
xor eax, eax
jmp 0x1401c8345
test rbx, rbx
jne 0x1401c8300
lea rcx, str.PageSetupDlgW
call fcn.140050a34
mov rbx, rax
test rax, rax
je 0x1401c8313
mov qword [0x14047e728], rax
mov rcx, rbx
call fcn.1402829ec
mov rcx, r14
call rbx
mov edi, eax
mov dword [rsp + 0x20], eax
xor ebx, ebx
test edi, edi
sete bl
test ebx, ebx
je 0x1401c8328
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x1401c832a
xor esi, esi
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x1401c8343
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x1401c835c
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
xor edi, edi
mov dword [rax - 0x18], edi
mov rbx, qword [0x14047e720]
and qword [rax + 0x10], rdi
xor esi, esi
mov eax, dword [0x140475fd0]
test eax, eax
je 0x1401c83a7
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x140475fd0]
test eax, eax
jne 0x1401c83b0
call fcn.140015924
test eax, eax
je 0x1401c83cc
lea rdx, [rsp + 0x48]
mov rcx, qword [0x14046a4b0]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne 0x1401c83d4
xor eax, eax
jmp 0x1401c8439
test rbx, rbx
jne 0x1401c83f4
lea rcx, str.PrintDlgW
call fcn.140050a34
mov rbx, rax
test rax, rax
je 0x1401c8407
mov qword [0x14047e720], rax
mov rcx, rbx
call fcn.1402829ec
mov rcx, r14
call rbx
mov edi, eax
mov dword [rsp + 0x20], eax
xor ebx, ebx
test edi, edi
sete bl
test ebx, ebx
je 0x1401c841c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x1401c841e
xor esi, esi
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x1401c8437
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret

Function at 0x14025d334
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
test rdx, rdx
jne 0x14025d362
xor eax, eax
jmp 0x14025d3ef
test rbx, rbx
je 0x14025d35b
test r9, r9
jne 0x14025d37a
call fcn.140036380
mov r9, qword [rax + 0x18]
test r9, r9
je 0x14025d35b
mov r8, rbx
mov qword [rsi + 0x10], r9
mov rdx, rdi
mov rcx, r9
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
je 0x14025d35b
mov rcx, qword [rsi + 0x10]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r14d, eax
test eax, eax
je 0x14025d35b
mov rcx, qword [rsi + 0x10]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbp, rax
test rax, rax
je 0x14025d35b
mov rbx, qword [rsi]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rcx, qword [rbx + 8]
mov rdi, rax
call fcn.1402829ec
mov r8d, r14d
mov rdx, rdi
mov rcx, rsi
call qword [rbx + reloc.OLEAUT32.dll_VariantClear]
mov rcx, rbp
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x14027f6c0
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
xor edi, edi
mov qword [rax - 0x18], rdi
mov rbx, qword [0x14047fda8]
and qword [rax + 0x10], rdi
xor esi, esi
mov eax, dword [0x140475fd0]
test eax, eax
je 0x14027f70c
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x140475fd0]
test eax, eax
jne 0x14027f715
call fcn.140015924
test eax, eax
je 0x14027f731
lea rdx, [rsp + 0x48]
mov rcx, qword [0x14046a4b0]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne 0x14027f739
xor eax, eax
jmp 0x14027f7a2
test rbx, rbx
jne 0x14027f759
lea rcx, str.FindTextW
call fcn.140050a34
mov rbx, rax
test rax, rax
je 0x14027f76e
mov qword [0x14047fda8], rax
mov rcx, rbx
call fcn.1402829ec
mov rcx, r14
call rbx
mov rdi, rax
mov qword [rsp + 0x20], rax
xor ebx, ebx
test rdi, rdi
sete bl
test ebx, ebx
je 0x14027f784
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x14027f786
xor esi, esi
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x14027f79f
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rdi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret

Function at 0x14027f7b8
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
xor edi, edi
mov qword [rax - 0x18], rdi
mov rbx, qword [0x14047fdb0]
and qword [rax + 0x10], rdi
xor esi, esi
mov eax, dword [0x140475fd0]
test eax, eax
je 0x14027f804
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x140475fd0]
test eax, eax
jne 0x14027f80d
call fcn.140015924
test eax, eax
je 0x14027f829
lea rdx, [rsp + 0x48]
mov rcx, qword [0x14046a4b0]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne 0x14027f831
xor eax, eax
jmp 0x14027f89a
test rbx, rbx
jne 0x14027f851
lea rcx, str.ReplaceTextW
call fcn.140050a34
mov rbx, rax
test rax, rax
je 0x14027f866
mov qword [0x14047fdb0], rax
mov rcx, rbx
call fcn.1402829ec
mov rcx, r14
call rbx
mov rdi, rax
mov qword [rsp + 0x20], rax
xor ebx, ebx
test rdi, rdi
sete bl
test ebx, ebx
je 0x14027f87c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x14027f87e
xor esi, esi
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x14027f897
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rdi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x1402d1860
Capabilities:
Parse pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov esi, r8d
mov ebx, edx
mov r14d, ecx
test r8d, r8d
jne 0x1402d1598
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1402d1598
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1402d1598
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1402d1598
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1402d1598
cmp dword [rcx + 0x84], 0xe
jbe 0x1402d1598
cmp dword [rcx + 0xf8], esi
je 0x1402d1598
mov ecx, r14d
call fcn.1402d1768
mov ecx, 2
call fcn.1402d4448
nop
cmp byte [0x140481608], 0
jne 0x1402d1662
mov r15d, 1
mov eax, r15d
xchg dword [0x1404815f8], eax
test ebx, ebx
jne 0x1402d160b
mov rdi, qword [0x14046b910]
mov edx, edi
and edx, 0x3f
lea ecx, [rbx + 0x40]
sub ecx, edx
xor eax, eax
ror rax, cl
xor rax, rdi
mov rcx, qword [0x140481600]
cmp rcx, rax
je 0x1402d1602
xor rdi, rcx
mov ecx, edx
ror rdi, cl
mov rcx, rdi
call qword [0x140346ad0]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rdi
lea rcx, [0x140481618]
jmp 0x1402d1617
cmp ebx, r15d
jne 0x1402d161d
lea rcx, [0x140481630]
call fcn.1402d3c28
nop
test ebx, ebx
jne 0x1402d1634
lea rdx, [0x1403470e8]
lea rcx, [0x1403470c0]
call fcn.1402d1398
lea rdx, [0x1403470f8]
lea rcx, [0x1403470f0]
call fcn.1402d1398
movzx eax, byte [0x140481608]
test esi, esi
cmove eax, r15d
mov byte [0x140481608], al
jmp 0x1402d1662
mov ecx, 2
call fcn.1402d449c
test esi, esi
jne 0x1402d1679
mov ecx, r14d
call fcn.1402d1694
int3
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
xor r8d, r8d
xor edx, edx
jmp 0x1402d1528
Function at 0x1402df934
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
mov rbp, rsp
sub rsp, 0x20
test rcx, rcx
jne 0x1402df55c
call fcn.1402ac7f4
mov dword [rax], reloc.OLEAUT32.dll_SafeArrayAccessData
call fcn.1402ac648
or eax, 0xffffffff
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop rbp
ret
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x1402df544
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 0xc
test cl, 1
jne 0x1402df544
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
mov rax, qword [rbp + 0x10]
shr ecx, 1
test cl, 1
je 0x1402df58e
lock or dword [rax + 0x14], 0x10
jmp 0x1402df544
lock or dword [rax + 0x14], 1
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
test ecx, 0x4c0
jne 0x1402df5ab
mov rcx, qword [rbp + 0x10]
call fcn.1402ea810
mov rax, qword [rbp + 0x10]
mov rcx, qword [rax + 8]
mov qword [rax], rcx
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.1402cdb64
mov rdx, qword [rbp + 0x10]
mov ecx, eax
mov r8d, dword [rdx + 0x20]
mov rdx, qword [rdx + 8]
call fcn.1402def94
mov dword [rbx + 0x10], eax
mov rax, qword [rbp + 0x10]
mov edx, dword [rax + 0x10]
lea ecx, [rdx + 1]
cmp ecx, 1
ja 0x1402df602
neg edx
sbb ecx, ecx
and ecx, 8
add ecx, 8
lock or dword [rax + 0x14], ecx
mov rax, qword [rbp + 0x10]
and dword [rax + 0x10], 0
jmp 0x1402df544
mov ecx, dword [rax + 0x14]
test cl, 6
jne 0x1402df66e
mov rcx, qword [rbp + 0x10]
call fcn.1402cdb64
cmp eax, 0xffffffff
je 0x1402df655
mov rcx, qword [rbp + 0x10]
call fcn.1402cdb64
cmp eax, 0xfffffffe
je 0x1402df655
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.1402cdb64
movsxd rdi, eax
lea rsi, [0x140481a10]
mov rcx, rbx
sar rdi, 6
call fcn.1402cdb64
and eax, 0x3f
shl rax, 6
add rax, qword [rsi + rdi*8]
jmp 0x1402df65c
lea rax, [0x14046ba90]
mov al, byte [rax + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x1402df66e
mov rax, qword [rbp + 0x10]
lock or dword [rax + 0x14], 0x20
mov rax, qword [rbp + 0x10]
cmp dword [rax + 0x20], 0x200
jne 0x1402df6a4
mov ecx, dword [rax + 0x14]
shr ecx, 6
test cl, 1
je 0x1402df6a0
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 8
test cl, 1
jne 0x1402df6a0
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x20], 0x1000
mov rax, qword [rbp + 0x10]
dec dword [rax + 0x10]
mov rcx, qword [rax]
movzx edx, byte [rcx]
inc rcx
mov qword [rax], rcx
mov eax, edx
jmp 0x1402df547
jmp 0x1402df514
Function at 0x1402df93c
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x20
test rcx, rcx
jne 0x1402df70e
call fcn.1402ac7f4
mov dword [rax], reloc.OLEAUT32.dll_SafeArrayAccessData
call fcn.1402ac648
mov eax, 0xffff
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rbp
ret
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x1402df6f0
mov rax, qword [rbp + 0x20]
mov ecx, dword [rax + 0x14]
shr ecx, 0xc
test cl, 1
jne 0x1402df6f0
mov rax, qword [rbp + 0x20]
mov ecx, dword [rax + 0x14]
mov rax, qword [rbp + 0x20]
shr ecx, 1
test cl, 1
je 0x1402df740
lock or dword [rax + 0x14], 0x10
jmp 0x1402df6f0
lock or dword [rax + 0x14], 1
mov rax, qword [rbp + 0x20]
mov ecx, dword [rax + 0x14]
test ecx, 0x4c0
jne 0x1402df75d
mov rcx, qword [rbp + 0x20]
call fcn.1402ea810
mov rax, qword [rbp + 0x20]
cmp dword [rax + 0x10], 1
jne 0x1402df772
mov rcx, qword [rax]
mov sil, 1
mov r14b, byte [rcx]
jmp 0x1402df778
xor sil, sil
xor r14b, r14b
mov rcx, qword [rax + 8]
mov qword [rax], rcx
mov rbx, qword [rbp + 0x20]
mov rcx, rbx
call fcn.1402cdb64
mov rdx, qword [rbp + 0x20]
mov ecx, eax
mov r8d, dword [rdx + 0x20]
mov rdx, qword [rdx + 8]
call fcn.1402def94
mov dword [rbx + 0x10], eax
mov rax, qword [rbp + 0x20]
mov edx, dword [rax + 0x10]
lea ecx, [rdx + 1]
cmp ecx, 2
ja 0x1402df7cb
neg edx
sbb ecx, ecx
and ecx, 8
add ecx, 8
lock or dword [rax + 0x14], ecx
mov rax, qword [rbp + 0x20]
and dword [rax + 0x10], 0
jmp 0x1402df6f0
mov ecx, dword [rax + 0x14]
test cl, 6
jne 0x1402df837
mov rcx, qword [rbp + 0x20]
call fcn.1402cdb64
cmp eax, 0xffffffff
je 0x1402df81e
mov rcx, qword [rbp + 0x20]
call fcn.1402cdb64
cmp eax, 0xfffffffe
je 0x1402df81e
mov rbx, qword [rbp + 0x20]
mov rcx, rbx
call fcn.1402cdb64
movsxd rdi, eax
lea r15, [0x140481a10]
mov rcx, rbx
sar rdi, 6
call fcn.1402cdb64
and eax, 0x3f
shl rax, 6
add rax, qword [r15 + rdi*8]
jmp 0x1402df825
lea rax, [0x14046ba90]
mov al, byte [rax + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x1402df837
mov rax, qword [rbp + 0x20]
lock or dword [rax + 0x14], 0x20
mov rax, qword [rbp + 0x20]
cmp dword [rax + 0x20], 0x200
jne 0x1402df86d
mov ecx, dword [rax + 0x14]
shr ecx, 6
test cl, 1
je 0x1402df869
mov rax, qword [rbp + 0x20]
mov ecx, dword [rax + 0x14]
shr ecx, 8
test cl, 1
jne 0x1402df869
mov rax, qword [rbp + 0x20]
mov dword [rax + 0x20], 0x1000
mov rax, qword [rbp + 0x20]
mov rcx, qword [rax]
test sil, sil
je 0x1402df88b
movzx edx, byte [rcx]
dec dword [rax + 0x10]
shl dx, 8
movzx ecx, r14b
or dx, cx
inc qword [rax]
jmp 0x1402df896
movzx edx, word [rcx]
add dword [rax + 0x10], 0xfffffffe
add qword [rax], 2
movzx eax, dx
jmp 0x1402df6f5
jmp 0x1402df6bc