joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400b03e0
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x690
mov rax, qword [0x1401f7280]
xor rax, rsp
mov qword [rsp + 0x680], rax
mov rax, rdx
mov rbx, rcx
lea rdx, [rsp + 0x20]
mov rcx, rax
mov rsi, r8
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1400b04cd
cmp word [rsp + 0x4c], 0x2e
je 0x1400b04ae
test byte [rsp + 0x20], 0x10
jne 0x1400b04ae
lea rdx, [rsp + 0x270]
mov rcx, rbx
sub rdx, rbx
nop word [rax + rax]
movzx eax, word [rcx]
lea rcx, [rcx + 2]
mov word [rdx + rcx - 2], ax
test ax, ax
jne 0x1400b0450
lea rax, [rsp + 0x270]
sub rax, 2
nop dword [rax]
cmp word [rax + 2], 0
lea rax, [rax + 2]
jne 0x1400b0470
lea r8, [rsp + 0x4c]
xor edx, edx
movzx ecx, word [r8 + rdx*2]
lea rdx, [rdx + 1]
mov word [rax + rdx*2 - 2], cx
test cx, cx
jne 0x1400b0482
lea r9, [rsp + 0x270]
xor r8d, r8d
mov edx, 0x180
mov rcx, rsi
call qword [sym.imp.USER32.dll_SendMessageW]
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1400b0428
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, qword [rsp + 0x680]
xor rcx, rsp
call fcn.1400f9a80
lea r11, [rsp + 0x690]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x1400b0500
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x260
mov rax, qword [0x1401f7280]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rdi, rcx
lea r8, [0x140209500]
lea rdx, str.Slideshow.lst
lea rcx, [rsp + 0x40]
mov esi, 0xfeff
mov word [rsp + 0x30], si
call fcn.1400ec0a0
lea rdx, [0x140183d70]
lea rcx, [rsp + 0x40]
call fcn.1400fafe4
mov rbx, rax
test rax, rax
jne 0x1400b058a
mov rcx, qword [0x1401fbba0]
lea r9, [rsp + 0x40]
xor r8d, r8d
mov edx, 0x4e71
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x20], rax
call fcn.1400f11b0
jmp 0x1400b0601
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.1400fad50
mov edx, 2
lea rcx, [rsp + 0x34]
lea r8d, [rdx - 1]
mov r9, rbx
call fcn.1400fabdc
cmp word [rsp + 0x34], si
je 0x1400b05d9
mov edx, 2
lea rcx, [rsp + 0x30]
mov r9, rbx
lea r8d, [rdx - 1]
call fcn.1400faf54
lea rcx, str.__UNICODE_FILE___edit_with_care_____r_n_r_n
mov rdx, rbx
call fcn.1400ff480
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call fcn.1400fad50
lea rdx, str._s_r_n
mov r8, rdi
mov rcx, rbx
call fcn.1400fbc58
mov rcx, rbx
call fcn.1400fa904
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1400f9a80
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1400b12e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x480
mov rax, qword [0x1401f7280]
xor rax, rsp
mov qword [rsp + 0x430], rax
mov qword [r11 - 0x18], rbp
mov qword [r11 - 0x20], rsi
mov qword [r11 - 0x28], r12
mov rbp, rdx
mov qword [r11 - 0x30], r13
mov rdi, r8
mov r13, r9
mov r12, rcx
lea r8, [rsp + 0x20]
or edx, 0xffffffff
mov r9d, 0x104
mov rcx, rbp
mov qword [r11 - 0x38], r14
call qword [sym.imp.SHELL32.dll_DragQueryFileW]
xor esi, esi
mov r14d, eax
test eax, eax
jle 0x1400b1448
mov qword [rsp + 0x448], r15
mov r15d, dword [rsp + 0x4c0]
mov qword [rsp + 0x478], rbx
nop dword [rax]
lea r8, [rsp + 0x20]
mov r9d, 0x104
mov edx, esi
mov rcx, rbp
call qword [sym.imp.SHELL32.dll_DragQueryFileW]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400b13c7
test al, 0x10
je 0x1400b13c7
lea rcx, [rsp + 0x20]
mov rdx, r13
lea rax, [rsp + 0x20]
sub rdx, rcx
nop word [rax + rax]
movzx ecx, word [rax]
lea rax, [rax + 2]
mov word [rdx + rax - 2], cx
test cx, cx
jne 0x1400b13a0
mov edx, 0x111
mov r9d, 0x65
mov r8d, 0x772
mov rcx, r12
jmp 0x1400b1427
test r15d, r15d
je 0x1400b1417
mov rcx, rdi
call fcn.1400dfb40
cmp eax, 0xffffffff
je 0x1400b1417
movsxd rbx, eax
lea r9, [rsp + 0x20]
mov edx, 0x181
mov r8, rbx
mov rcx, rdi
call qword [sym.imp.USER32.dll_SendMessageW]
or r9, 0xffffffffffffffff
xor r8d, r8d
mov edx, 0x185
mov rcx, rdi
call qword [sym.imp.USER32.dll_SendMessageW]
mov r9, rbx
mov edx, 0x185
mov r8d, 1
jmp 0x1400b1424
lea r9, [rsp + 0x20]
xor r8d, r8d
mov edx, 0x180
mov rcx, rdi
call qword [sym.imp.USER32.dll_SendMessageW]
inc esi
cmp esi, r14d
jl 0x1400b1360
mov r15, qword [rsp + 0x448]
mov rbx, qword [rsp + 0x478]
mov rcx, rbp
call qword [sym.imp.SHELL32.dll_DragFinish]
cmp dword [rsp + 0x4b0], 0
mov r14, qword [rsp + 0x450]
mov r13, qword [rsp + 0x458]
mov rsi, qword [rsp + 0x468]
mov rbp, qword [rsp + 0x470]
je 0x1400b148a
mov edx, dword [rsp + 0x4b8]
mov rcx, rdi
call fcn.1400b5f80
xor r9d, r9d
xor r8d, r8d
mov edx, 0x18b
mov rcx, rdi
call qword [sym.imp.USER32.dll_SendMessageW]
lea rdx, str.___d__
lea rcx, [rsp + 0x230]
mov r8, rax
call fcn.1400f98c8
lea r8, [rsp + 0x230]
mov edx, 0xbf8
mov rcx, r12
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x18b
mov rcx, rdi
call qword [sym.imp.USER32.dll_SendMessageW]
mov r12, qword [rsp + 0x460]
test eax, eax
jle 0x1400b1502
xor r9d, r9d
mov edx, 0x194
mov r8d, 0x3e7
mov rcx, rdi
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rsp + 0x430]
xor rcx, rsp
call fcn.1400f9a80
add rsp, 0x480
pop rdi
ret
Function at 0x1400b2d00
Capabilities:
Read .ini file

Disassembly:
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x660
mov rax, qword [0x1401f7280]
xor rax, rsp
mov qword [rsp + 0x640], rax
mov r13d, r9d
mov r15, rdx
mov ebp, ecx
mov r12, r8
lea r9, [0x140208860]
lea rdx, str.ShowHiddenFiles
lea rcx, str.Viewing
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
lea rcx, [rsp + 0x240]
xor edx, edx
mov r8d, 0x200
mov dword [rsp + 0x30], eax
call fcn.1400f9ab0
mov edx, 2
mov ecx, 0x1000
call fcn.1400f97a4
mov r14, rax
test rax, rax
je 0x1400b2f50
xor ecx, ecx
mov qword [rsp + 0x690], rbx
mov qword [rsp + 0x658], rsi
lea edx, [rcx + 1]
mov esi, ecx
mov ebx, ecx
mov qword [rsp + 0x650], rdi
mov edi, ecx
mov rcx, rax
call fcn.14002c5a0
movsxd rcx, eax
test eax, eax
jle 0x1400b2dd8
lea eax, [rbp*2 + 1]
nop dword [rax]
cmp word [r14 + rbx*2], 0
jne 0x1400b2dca
inc edi
inc esi
cmp edi, eax
je 0x1400b2dd8
inc rbx
cmp rbx, rcx
jl 0x1400b2dc0
movsxd rax, esi
lea rdx, [rsp + 0x240]
lea rcx, [r14 + rax*2]
sub rdx, rcx
nop word [rax + rax]
movzx eax, word [rcx]
lea rcx, [rcx + 2]
mov word [rdx + rcx - 2], ax
test ax, ax
jne 0x1400b2df0
lea rcx, [rsp + 0x240]
sub rcx, 2
nop dword [rax]
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x1400b2e10
mov eax, dword [0x14018675c]
mov dword [rcx], eax
mov rcx, r14
call fcn.1400f97e8
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0x200
call fcn.1400f9ab0
lea rcx, [rsp + 0x440]
xor edx, edx
mov r8d, 0x200
call fcn.1400f9ab0
xor ecx, ecx
lea rax, [rsp + 0x240]
mov ebp, ecx
or rdi, 0xffffffffffffffff
inc rdi
cmp word [rax + rdi*2], cx
jne 0x1400b2e62
test edi, edi
jle 0x1400b2f38
mov r14d, dword [rsp + 0x6b0]
mov rbx, rcx
lea rsi, [rsp + 0x240]
nop word [rax + rax]
movzx eax, word [rsi]
cmp ax, 0x3b
jne 0x1400b2f71
add rbx, rbx
cmp rbx, 0x200
jae 0x1400b2f7b
cmp word [rsp + 0x440], 0
mov word [rsp + rbx + 0x40], cx
mov rbx, rcx
je 0x1400b2ed7
lea rdx, [rsp + 0x440]
lea rcx, [rsp + 0x40]
call fcn.1400f9d68
test rax, rax
jne 0x1400b2f28
mov eax, dword [rsp + 0x30]
lea rcx, [rsp + 0x40]
mov r9d, r13d
mov r8, r12
mov rdx, r15
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], eax
call fcn.1400afe50
xor ecx, ecx
mov eax, ecx
nop dword [rax + rax]
movzx ecx, word [rsp + rax + 0x40]
add rax, 2
mov word [rsp + rax + 0x43e], cx
test cx, cx
jne 0x1400b2f00
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0x200
call fcn.1400f9ab0
xor ecx, ecx
inc ebp
add rsi, 2
cmp ebp, edi
jl 0x1400b2e90
mov rsi, qword [rsp + 0x658]
mov rbx, qword [rsp + 0x690]
mov rdi, qword [rsp + 0x650]
mov rcx, qword [rsp + 0x640]
xor rcx, rsp
call fcn.1400f9a80
add rsp, 0x660
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov word [rsp + rbx*2 + 0x40], ax
inc rbx
jmp 0x1400b2f2a
call fcn.1400f8f44
int3
Function at 0x1400b4830
Capabilities:
Set current directory
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x2a0
mov rax, qword [0x1401f7280]
xor rax, rsp
mov qword [rsp + 0x290], rax
mov rdi, rcx
mov rbp, rdx
mov eax, 0xfeff
lea rcx, [rsp + 0x40]
xor edx, edx
mov r14d, r8d
mov word [rsp + 0x30], ax
call fcn.1400ebbc0
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea rdx, [0x140183390]
mov rcx, rdi
call fcn.1400fafe4
mov rsi, rax
test rax, rax
jne 0x1400b48c5
mov rcx, qword [0x1401fbba0]
xor ebx, ebx
mov r9, rdi
xor r8d, r8d
mov edx, 0x4e71
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x20], rbx
call fcn.1400f11b0
xor eax, eax
jmp 0x1400b499d
mov edx, 2
lea rcx, [rsp + 0x30]
mov r9, rax
lea r8d, [rdx - 1]
call fcn.1400faf54
lea rcx, str.__UNICODE_FILE___edit_with_care_____r_n_r_n
mov rdx, rsi
call fcn.1400ff480
xor r9d, r9d
xor r8d, r8d
mov edx, 0x18b
mov rcx, rbp
call qword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 1
jl 0x1400b4990
xor ebx, ebx
mov edi, eax
nop dword [rax + rax]
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0x248
call fcn.1400f9ab0
xor r9d, r9d
mov r8, rbx
mov edx, 0x18a
mov rcx, rbp
call qword [sym.imp.USER32.dll_SendMessageW]
cmp rax, 0x104
jg 0x1400b4954
lea r9, [rsp + 0x40]
mov r8, rbx
mov edx, 0x189
mov rcx, rbp
call qword [sym.imp.USER32.dll_SendMessageW]
lea rcx, [rsp + 0x40]
or rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400b4960
test rax, rax
je 0x1400b4988
test r14d, r14d
jne 0x1400b4988
lea r8, [rsp + 0x40]
lea rdx, str._s_r_n
mov rcx, rsi
call fcn.1400fbc58
inc rbx
dec rdi
jne 0x1400b4910
mov rcx, rsi
call fcn.1400fa904
mov eax, 1
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.1400f9a80
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x1400b49d0
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x2480]
mov eax, 0x2580
call fcn.1400f9a20
sub rsp, rax
mov rax, qword [0x1401f7280]
xor rax, rsp
mov qword [rbp + 0x2470], rax
mov rbx, rdx
lea rcx, [rbp + 0x470]
mov edx, 1
call fcn.14002c5a0
xor r14d, r14d
lea rsi, [0x140208860]
lea rdx, str.OpenIndex
lea rcx, str.Slideshow
lea r8d, [r14 + 1]
mov r9, rsi
mov word [rbp + 0x260], r14w
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
lea r8d, [r14 + 1]
lea rdx, str.SaveSlideDir
lea rcx, str.Others
mov r9, rsi
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
je 0x1400b4a6f
lea rcx, str.Slideshow
jmp 0x1400b4abb
lea rdx, [0x140208ca0]
or rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rdx + rax*2], r14w
jne 0x1400b4a80
test rax, rax
je 0x1400b4ab4
mov rax, r14
nop dword [rax]
nop word [rax + rax]
movzx ecx, word [rax + rdx]
lea rax, [rax + 2]
mov word [rbp + rax + 0x4e], cx
test cx, cx
jne 0x1400b4aa0
jmp 0x1400b4ae0
lea rcx, [0x140182e78]
lea r9, [rbp + 0x50]
lea r8, [0x140182e70]
lea rdx, str.OpenDir
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], 0x104
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, 0x98
call fcn.1400f9ab0
mov rax, qword [0x1401fbb00]
mov rcx, qword [0x1401fbba0]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x470]
lea r8, [rbp - 0x30]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x260]
mov r9d, 0x40
mov qword [rsp + 0x60], rax
lea rax, [rbp + 0x50]
mov edx, 0x483
mov dword [rsp + 0x30], 0x98
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x50], r14
mov qword [rbp - 0x80], rax
mov dword [rsp + 0x58], r14d
mov dword [rsp + 0x5c], edi
mov dword [rsp + 0x68], 0x104
mov qword [rsp + 0x70], r14
mov dword [rsp + 0x78], r14d
call qword [sym.imp.USER32.dll_LoadStringW]
mov ecx, dword [0x1402094d0]
lea rax, [rbp - 0x30]
mov edx, 0x64
mov qword [rbp - 0x78], rax
lea rax, [0x1400b4c60]
lea r8d, [rdx - 4]
mov qword [rbp - 0x70], 0x88026c
mov qword [rbp - 0x68], r14
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x50], 0x40e
call qword [sym.imp.KERNEL32.dll_MulDiv]
mov r8d, 0x64
mov ecx, 0x2d8
mov edx, eax
call qword [sym.imp.KERNEL32.dll_MulDiv]
xor ecx, ecx
mov ebx, eax
call fcn.1400ebf50
cmp eax, 0x320
jg 0x1400b4bcf
cmp dword [0x1402094d0], 0x60
jg 0x1400b4bdf
xor ecx, ecx
call fcn.1400ebf50
mov ecx, eax
lea eax, [rbx - 0xa]
cmp eax, ecx
jle 0x1400b4be6
mov dword [rbp - 0x3c], 1
lea rcx, [rsp + 0x30]
call qword [sym.imp.COMDLG32.dll_GetOpenFileNameW]
test eax, eax
je 0x1400b4c2c
mov r8d, dword [rsp + 0x5c]
lea rdx, [0x140182ce0]
lea rcx, [rbp + 0x50]
call fcn.1400f98c8
lea r8, [rbp + 0x50]
lea rdx, str.OpenIndex
lea rcx, str.Slideshow
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov eax, 1
jmp 0x1400b4c2e
xor eax, eax
mov rcx, qword [rbp + 0x2470]
xor rcx, rsp
call fcn.1400f9a80
lea r11, [rsp + 0x2580]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x1400b5e10
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov ebx, r8d
mov esi, edx
mov rdi, rcx
call fcn.1400b2870
lea r9, [0x140208860]
lea rdx, str.SortOrder
lea rcx, str.Slideshow
mov r8d, 0x1e
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov rdx, qword [0x1401fbb70]
mov r9d, 1
mov rcx, rdi
mov r8d, eax
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 1
call fcn.1400b3300
test esi, esi
jne 0x1400b5e7f
lea ecx, [rsi + 1]
xor edx, edx
call fcn.1400b28f0
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x1400b8b80
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push r15
sub rsp, 0x20
mov r15, r8
mov rsi, rdx
xor r8d, r8d
xor edx, edx
mov r14, r9
mov rbx, rcx
call fcn.1400fe870
mov edx, 1
lea rcx, [rsi + 0xc]
lea r8d, [rdx + 0x11]
mov r9, rbx
call fcn.1400fabdc
movzx eax, byte [rsi + 0xe]
dec eax
cmp eax, 0xa
ja case.0x1400b8be3.4
lea rdx, [0x140000000]
cdqe
mov ecx, dword [rdx + rax*4 + 0xb8cec]
add rcx, rdx
jmp rcx
mov r8, qword [rsp + 0x50]
mov rcx, qword [0x1401fbba0]
mov r9d, 0x20
mov edx, 0x4e74
call qword [sym.imp.USER32.dll_LoadStringW]
jmp case.0x1400b8be3.3
mov r8, qword [rsp + 0x50]
mov rcx, qword [0x1401fbba0]
mov r9d, 0x20
mov edx, 0x4e74
call qword [sym.imp.USER32.dll_LoadStringW]
cmp byte [rsi + 0x1c], 8
je case.0x1400b8be3.3
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
mov r8, qword [rsp + 0x50]
mov rcx, qword [0x1401fbba0]
mov r9d, 0x20
mov edx, 0x4e74
call qword [sym.imp.USER32.dll_LoadStringW]
movzx eax, byte [rsi + 0x1c]
cmp al, 0x20
ja case.0x1400b8be3.4
movabs rcx, 0x101018000
bt rcx, rax
jae case.0x1400b8be3.4
movzx eax, byte [rsi + 0x18]
movzx edx, byte [rsi + 0x19]
shl edx, 8
add edx, eax
mov dword [rsi], edx
movzx r8d, byte [rsi + 0x1b]
movzx eax, byte [rsi + 0x1a]
shl r8d, 8
add r8d, eax
mov dword [rsi + 4], r8d
test edx, edx
jle case.0x1400b8be3.4
test r8d, r8d
jle case.0x1400b8be3.4
mov ecx, 8
mov edx, 0x18
cmp byte [rsi + 0x1c], cl
mov eax, edx
cmove eax, ecx
mov dword [rsi + 8], eax
cmp byte [rsi + 0x1c], 0xf
cmove eax, edx
mov dword [rsi + 8], eax
test r15, r15
je 0x1400b8cd0
movzx ecx, byte [rsi + 0x1c]
mov dword [r15], ecx
test r14, r14
je 0x1400b8ce2
cmp byte [rsi + 0x1c], 0x20
jne 0x1400b8ce2
mov dword [r14], 1
mov eax, 1
jmp 0x1400b8c29
Function at 0x1400b8d20
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rbp, r8
movzx r8d, byte [rdx + 0xe]
mov r15, rdx
mov r13, rcx
dec r8d
je 0x1400b8d95
sub r8d, 2
je 0x1400b8d65
sub r8d, 6
je 0x1400b8d95
cmp r8d, 2
jne 0x1400b8ea1
xor eax, eax
mov r14d, 0x100
nop dword [rax]
mov ecx, dword [rbp + 0x20]
cmp ecx, r14d
cmova ecx, r14d
cmp eax, ecx
jge 0x1400b8ea1
movsxd rcx, eax
mov byte [rbp + rcx*4 + 0x28], al
mov byte [rbp + rcx*4 + 0x29], al
mov byte [rbp + rcx*4 + 0x2a], al
inc eax
jmp 0x1400b8d70
movzx eax, byte [rdx + 0xc]
xor r8d, r8d
add eax, 0x12
movsxd rdx, eax
call fcn.1400fe870
movzx eax, byte [r15 + 0xf]
movzx esi, byte [r15 + 0x10]
movzx ecx, byte [r15 + 0x12]
shl esi, 8
add esi, eax
movzx eax, byte [r15 + 0x11]
shl ecx, 8
add ecx, eax
cmp esi, 0xff
jle 0x1400b8dd4
xor eax, eax
jmp 0x1400b8ea6
test esi, esi
js 0x1400b8dcd
lea rdi, [rbp + 0x29]
movsxd rax, esi
lea r12d, [rcx + rsi]
lea rdi, [rdi + rax*4]
mov r14d, 0x100
cmp dword [rbp + 0x20], r12d
mov ecx, r12d
mov r8d, 2
cmovl ecx, dword [rbp + 0x20]
lea edx, [r8 + 2]
cmp esi, ecx
jge 0x1400b8ea1
cmp byte [r15 + 0x13], 0x20
mov ebx, 3
lea rcx, [rsp + 0x58]
cmove ebx, edx
cmp byte [r15 + 0x13], 0x10
mov r9, r13
cmove ebx, r8d
mov edx, 1
mov r8d, ebx
call fcn.1400fabdc
cmp rax, rbx
jne 0x1400b8dcd
cmp byte [r15 + 0x13], 0x10
jne 0x1400b8e7e
movzx eax, byte [rsp + 0x58]
movzx ecx, byte [rsp + 0x59]
inc esi
imul cx, r14w
add cx, ax
movzx eax, cl
shr cx, 5
shl al, 3
mov byte [rdi - 1], al
movzx eax, cl
shr cx, 5
shl cl, 3
shl al, 3
add rdi, 4
mov byte [rdi - 3], cl
mov byte [rdi - 4], al
jmp 0x1400b8ded
movzx eax, byte [rsp + 0x58]
inc esi
add rdi, 4
mov byte [rdi - 5], al
movzx eax, byte [rsp + 0x59]
mov byte [rdi - 4], al
movzx eax, byte [rsp + 0x5a]
mov byte [rdi - 3], al
jmp 0x1400b8ded
mov eax, 1
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret

Function at 0x1400b90c0
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx + 0x4008]
mov rbx, rcx
cmp qword [rcx + 0x4000], rax
jb 0x1400b9120
mov r9, qword [rcx + 0x4010]
mov edx, 1
mov r8d, 0x4000
call fcn.1400fabdc
mov qword [rbx + 0x4008], rax
test rax, rax
jne 0x1400b9115
mov rcx, qword [rbx + 0x4010]
call fcn.1400fa96c
test eax, eax
je 0x1400b9115
or eax, 0xffffffff
add rsp, 0x20
pop rbx
ret
mov qword [rbx + 0x4000], 0
mov rcx, qword [rbx + 0x4000]
inc rcx
movzx eax, byte [rcx + rbx - 1]
mov qword [rbx + 0x4000], rcx
add rsp, 0x20
pop rbx
ret
Function at 0x1400bc510
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
lea r9, [0x140208860]
lea rdx, str.HTMLTextAlign
lea rcx, [0x140185d88]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
lea rdx, str.center
mov rcx, rbx
mov edi, eax
call fcn.1400f98c8
cmp edi, 1
jne 0x1400bc56a
lea rdx, str.left
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1400f98c8
cmp edi, 2
jne 0x1400bc57e
lea rdx, str.right
mov rcx, rbx
call fcn.1400f98c8
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1400bd690
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, rdx
lea rdx, [0x140183378]
mov esi, r8d
call fcn.1400fafe4
mov rdi, rax
test rax, rax
jne 0x1400bd6c9
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
xor edx, edx
mov rcx, rax
mov qword [rsp + 0x30], rbx
lea r8d, [rdx + 2]
call fcn.1400fad50
mov rcx, rdi
call fcn.1400fe108
xor r8d, r8d
xor edx, edx
mov rcx, rdi
mov ebx, eax
call fcn.1400fad50
lea ecx, [rsi - 1]
mov r9, rdi
cmp ebx, ecx
mov edx, 2
cmovl ecx, ebx
movsxd r8, ecx
mov rcx, rbp
call fcn.1400fabdc
mov rcx, rdi
call fcn.1400fa904
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov eax, 1
add rsp, 0x20
pop rdi
ret
Function at 0x1400c06c0
Capabilities:
Enumerate files on windows

Disassembly:
push rbp
push rbx
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1000]
mov eax, 0x1100
call fcn.1400f9a20
sub rsp, rax
mov rax, qword [0x1401f7280]
xor rax, rsp
mov qword [rbp + 0xfe0], rax
mov r13, qword [rbp + 0x1060]
mov qword [rsp + 0x38], r9
mov rdi, r8
mov r14, rdx
mov r12, rcx
lea r10, [r9 - 2]
nop dword [rax + rax]
cmp word [r10 + 2], 0
lea r10, [r10 + 2]
jne 0x1400c0710
mov eax, dword [0x14018675c]
xor ebx, ebx
mov rcx, r9
lea edx, [rbx + 0x3b]
mov dword [r10], eax
mov r15d, ebx
mov dword [rsp + 0x30], ebx
call fcn.1400e8af0
test eax, eax
jle 0x1400c0909
mov qword [rsp + 0x10f8], rsi
mov esi, dword [rbp + 0x1068]
nop
mov rcx, qword [rsp + 0x38]
lea r8, [rbp + 0x3a0]
mov r9d, 0x3b
mov edx, r15d
mov dword [rsp + 0x20], 0x104
call fcn.1400ec2b0
lea rcx, [rbp + 0x3a0]
or rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400c0780
test rax, rax
je 0x1400c08e1
lea r9, [rbp + 0x3a0]
lea rdx, str._s_s
lea rcx, [rbp + 0x9c0]
mov r8, r14
call fcn.1400f98c8
xor r9d, r9d
lea r8, [rsp + 0x40]
lea rcx, [rbp + 0x9c0]
lea edx, [r9 + 1]
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x1400c0830
lea r8, [rsp + 0x40]
lea edx, [rax + 2]
lea rcx, [rbp + 0x9c0]
xor r9d, r9d
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x1400c0830
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x9c0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400c08df
mov rcx, r13
call fcn.1400f9670
xor r15d, r15d
nop dword [rax + rax]
mov eax, dword [rsp + 0x40]
test al, 0x10
jne 0x1400c08bb
test al, 2
je 0x1400c0850
test esi, esi
je 0x1400c08bb
lea rdx, [rsp + 0x6c]
lea rcx, [rbp + 0x5b0]
mov r8d, 0x207
call fcn.1400fb86c
lea rdx, [rbp + 0x190]
lea rcx, [rbp + 0x5b0]
mov r8d, 0x104
mov word [rbp + 0x9be], r15w
call fcn.1400eb6b0
lea rcx, [rbp + 0x190]
call fcn.1400f9670
lea rdx, [rbp + 0x190]
mov rcx, r13
call fcn.1400c1770
test eax, eax
je 0x1400c08bb
inc dword [rdi]
mov edx, dword [rdi]
lea r8, [rsp + 0x40]
mov r9, r14
mov rcx, r12
call fcn.1400c0930
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1400c0840
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
mov r15d, dword [rsp + 0x30]
xor ebx, ebx
mov rcx, qword [rsp + 0x38]
inc r15d
mov edx, 0x3b
mov dword [rsp + 0x30], r15d
call fcn.1400e8af0
cmp r15d, eax
jl 0x1400c0750
mov rsi, qword [rsp + 0x10f8]
mov rcx, qword [rbp + 0xfe0]
xor rcx, rsp
call fcn.1400f9a80
add rsp, 0x1100
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rbx
pop rbp
ret