joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14005be80
Capabilities:
Enumerate process modules

Disassembly:
mov r11, rsp
push rsi
sub rsp, 0x270
mov rax, qword [0x1400cd548]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov qword [r11 + 0x20], rbp
mov rsi, rcx
mov qword [r11 - 0x20], r14
lea rcx, [rsp + 0x30]
mov qword [r11 - 0x28], r15
mov r14d, edx
movzx r15d, r8b
xor edx, edx
mov r8d, 0x208
call fcn.140070390
mov r8d, r14d
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbp, rax
test rax, rax
je 0x14005c0d9
lea rdx, [rsi + 0x234]
mov qword [rsp + 0x260], r12
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
xor r12d, r12d
lea r9, [rsp + 0x20]
lea rdx, [rsp + 0x28]
mov qword [rsp + 0x28], r12
mov rcx, rbp
mov dword [rsp + 0x20], r12d
lea r8d, [r12 + 8]
call sub.KERNEL32.dll_K32EnumProcessModules
mov rdx, qword [rsp + 0x28]
test rdx, rdx
je 0x14005c0c8
mov qword [rsp + 0x268], rdi
lea r8, [rsp + 0x30]
mov edi, 0x104
mov rcx, rbp
mov r9d, edi
call sub.KERNEL32.dll_K32GetModuleFileNameExW
test eax, eax
je 0x14005c0c0
lea r8d, [r12 + 1]
mov qword [rsp + 0x290], rbx
lea rdx, [0x14009f880]
lea rcx, [rsi + 0x210]
call fcn.14000d670
lea rax, [rsp + 0x30]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], r12w
jne 0x14005bf80
lea rdx, [rsp + 0x30]
lea rcx, [rsi + 0x210]
call fcn.14000ed70
mov r8d, 1
lea rdx, [0x14009f880]
lea rcx, [rsi + 0x210]
call fcn.14000ed70
mov rcx, rdi
lea rax, [rsp + 0x30]
lea rbx, [rsi + 4]
cmp word [rax], r12w
je 0x14005bfd0
add rax, 2
sub rcx, 1
jne 0x14005bfc0
mov rdx, rdi
mov rax, r12
sub rdx, rcx
test rcx, rcx
lea rcx, [rsp + 0x30]
cmove rdx, r12
cmovne rax, rdx
lea rcx, [rcx + rax*2]
lea rax, [rsp + 0x30]
cmp rcx, rax
jbe 0x14005c011
cmp word [rcx], 0x5c
je 0x14005c00d
sub rcx, 2
lea rax, [rsp + 0x30]
cmp rcx, rax
ja 0x14005bff7
jmp 0x14005c011
add rcx, 2
mov r8, rdi
mov rdx, rbx
sub rcx, rbx
nop word [rax + rax]
lea rax, [r8 + 0x7ffffefa]
test rax, rax
je 0x14005c042
movzx eax, word [rcx + rdx]
test ax, ax
je 0x14005c042
mov word [rdx], ax
add rdx, 2
sub r8, 1
jne 0x14005c020
test r8, r8
lea rax, [rdx - 2]
cmovne rax, rdx
mov word [rax], r12w
test rbx, rbx
je 0x14005c07c
mov rcx, rdi
mov rax, rbx
nop dword [rax]
cmp word [rax], r12w
je 0x14005c070
add rax, 2
sub rcx, 1
jne 0x14005c060
sub rdi, rcx
test rcx, rcx
cmove rdi, r12
jne 0x14005c07f
mov rdi, r12
lea rax, [rbx + rdi*2]
cmp rax, rbx
jbe 0x14005c09d
cmp word [rax], 0x2e
je 0x14005c099
sub rax, 2
cmp rax, rbx
ja 0x14005c088
jmp 0x14005c09d
mov word [rax], r12w
mov rcx, rbx
call qword [sym.imp.USER32.dll_CharLowerW]
lea rcx, [rsi + 0x20c]
mov rdx, rbx
call fcn.14005b300
mov rbx, qword [rsp + 0x290]
mov dword [rsi], r14d
mov rdi, qword [rsp + 0x268]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r12, qword [rsp + 0x260]
mov r14, qword [rsp + 0x258]
test r15b, r15b
mov r15, qword [rsp + 0x250]
mov rbp, qword [rsp + 0x298]
je 0x14005c108
cmp dword [rsi], 0
je 0x14005c10b
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.14005c130
cmp dword [rsi], 0
seta al
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.14006ed70
add rsp, 0x270
pop rsi
ret
Function at 0x14005c130
Capabilities:
Get file version info

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x30
mov rsi, rdx
mov dword [rsp + 0x60], 0
mov rbp, rcx
lea rdx, [rsp + 0x60]
mov rcx, rsi
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
test eax, eax
je 0x14005c1c6
mov ecx, edi
mov qword [rsp + 0x50], rbx
call fcn.14006f2e8
mov rbx, rax
test rax, rax
je 0x14005c1c1
mov r9, rax
mov qword [rsp + 0x20], 0
mov r8d, edi
mov dword [rsp + 0x68], 0
xor edx, edx
mov rcx, rsi
call sub.VERSION.dll_GetFileVersionInfoW
lea r9, [rsp + 0x68]
mov rcx, rbx
lea r8, [rsp + 0x20]
lea rdx, [0x1400b8b50]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x14005c1b9
mov rax, qword [rsp + 0x20]
mov ecx, dword [rax + 8]
mov dword [rbp + 0x230], ecx
mov rcx, rbx
call fcn.14006ec58
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret

Function at 0x14005c200
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
lea r8, [rcx + 4]
mov rbx, rcx
lea rdx, [0x1400a5540]
mov rcx, rdi
mov r9d, 0x208
call fcn.140059d90
lea r8, [rbx + 0x210]
mov rcx, rdi
lea rdx, str.commandline
call fcn.140059c30
lea r8, [rbx + 0x20c]
mov rcx, rdi
lea rdx, str.apphash
call fcn.140059b60
lea r8, [rbx + 0x230]
mov rcx, rdi
lea rdx, str.version
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.140059b60

Function at 0x14005c280
Capabilities:
Get common file path
Get startup folder

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x250
mov rax, qword [0x1400cd548]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbx, rcx
mov qword [rsp + 0x28], rcx
xor edi, edi
mov dword [rsp + 0x20], edi
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x30]
call fcn.140070390
xor r9d, r9d
lea r8d, [rdi + 0x23]
lea rdx, [rsp + 0x30]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], 7
mov word [rbx], di
lea rax, [rsp + 0x30]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp word [rax + r8*2], di
jne 0x14005c2f0
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.14000d670
mov dword [rsp + 0x20], 1
mov r8d, 0x19
lea rdx, str.NVIDIA_Corporation_nView
mov rcx, rbx
call fcn.14000ed70
mov rax, rbx
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.14006ed70
mov rbx, qword [rsp + 0x268]
add rsp, 0x250
pop rdi
ret
Function at 0x14005c350
Capabilities:
Get common file path
Get installed programs
Get program files directory
Query or enumerate registry value

Disassembly:
push rsi
push rdi
push r14
sub rsp, 0x260
mov rax, qword [0x1400cd548]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov r9d, dword [0x1400cfb44]
xor r14d, r14d
mov rdi, rdx
mov rsi, rcx
test r9d, r9d
jne 0x14005c3cd
mov dword [0x1400cfb44], 0x20019
mov dword [rsp + 0x30], r14d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
je 0x14005c3c6
cmp dword [rsp + 0x30], r14d
je 0x14005c3c6
mov r9d, dword [0x1400cfb44]
bts r9d, 8
mov dword [0x1400cfb44], r9d
jmp 0x14005c3cd
mov r9d, dword [0x1400cfb44]
test rsi, rsi
je 0x14005c5a8
test rdi, rdi
je 0x14005c5a8
lea rax, [rsp + 0x38]
mov qword [rsp + 0x298], rbp
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallB2FE1952_0186_46C3_BAEC_A80AA35AC5B8_Display.NView
mov qword [rsp + 0x38], r14
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x30], edi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14005c48b
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rdx, str.InstallLocation
xor r9d, r9d
mov qword [rsp + 0x20], rsi
xor r8d, r8d
mov qword [rsp + 0x290], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
test eax, eax
mov ebx, eax
sete bpl
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
mov rbx, qword [rsp + 0x290]
jne 0x14005c48b
movzx eax, bpl
mov rbp, qword [rsp + 0x298]
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.14006ed70
add rsp, 0x260
pop r14
pop rdi
pop rsi
ret
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x208
call fcn.140070390
xor r9d, r9d
lea rdx, [rsp + 0x40]
xor ecx, ecx
lea r8d, [r9 + 0x26]
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
shr rdi, 1
mov r9d, 0x7ffffffe
lea rax, [rdi - 1]
cmp rax, r9
ja 0x14005c508
sub r9, rdi
lea r8, [rsp + 0x40]
sub r8, rsi
mov rdx, rdi
mov rcx, rsi
lea rax, [r9 + rdx]
test rax, rax
je 0x14005c4f4
movzx eax, word [r8 + rcx]
test ax, ax
je 0x14005c4f4
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x14005c4d4
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
mov rcx, rdi
mov word [rax], r14w
jmp 0x14005c52a
test rdi, rdi
je 0x14005c5a1
mov word [rsi], r14w
cmp rdi, 0x7fffffff
ja 0x14005c5a1
mov rcx, rdi
test rdi, rdi
je 0x14005c540
mov rax, rsi
nop dword [rax]
cmp word [rax], r14w
je 0x14005c540
add rax, 2
sub rcx, 1
jne 0x14005c530
mov rax, rdi
sub rax, rcx
test rcx, rcx
cmove rax, r14
je 0x14005c5a1
mov rdx, rdi
lea rcx, [rsi + rax*2]
sub rdx, rax
je 0x14005c592
sub rax, rdi
lea r9, str.NVIDIA_Corporation_nView
add rax, 0x7ffffffe
add rax, rdx
sub r9, rcx
test rax, rax
je 0x14005c592
movzx r8d, word [r9 + rcx]
test r8w, r8w
je 0x14005c592
mov word [rcx], r8w
dec rax
add rcx, 2
sub rdx, 1
jne 0x14005c571
test rdx, rdx
lea rax, [rcx - 2]
cmovne rax, rcx
mov word [rax], r14w
mov al, 1
jmp 0x14005c467
xor al, al
jmp 0x14005c46f
Function at 0x140066a30
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0xc0
mov rax, qword [0x1400cd548]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov r14, rcx
xor r15d, r15d
mov rax, rdx
mov dword [rsp + 0x50], r15d
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x40], rcx
lea rdx, str.DisplayConfig
lea rcx, [rsp + 0x60]
xor r9d, r9d
mov qword [rsp + 0x38], rcx
xor r8d, r8d
mov qword [rsp + 0x30], r15
mov rcx, rax
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], r15d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov r9d, 0x123
lea r8, str.D:uworkspace_nViewBranchBuilder_sw_nview_v200_nViewDisplayControlDisplayConfig.cpp
mov ecx, eax
lea rdx, str.DisplayConfig::saveToRegistry
call fcn.140058d30
test eax, eax
jne 0x140066be3
mov rcx, qword [rsp + 0x60]
lea rbp, [r14 + 8]
mov dword [rsp + 0x28], 4
lea r9d, [r15 + 4]
xor r8d, r8d
mov qword [rsp + 0x20], rbp
lea rdx, str.pathInfoCount
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, r15d
cmp dword [rbp], r15d
jbe 0x140066bdf
nop
mov r8d, esi
mov qword [rsp + 0x58], r15
lea rdx, str.pathInfo_d
lea rcx, [rsp + 0x70]
call fcn.1400652e0
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0x70]
lea rax, [rsp + 0x58]
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], r15d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov r9d, 0x12f
lea r8, str.D:uworkspace_nViewBranchBuilder_sw_nview_v200_nViewDisplayControlDisplayConfig.cpp
mov ecx, eax
lea rdx, str.DisplayConfig::saveToRegistry
call fcn.140058d30
test eax, eax
jne 0x140066be3
mov rdx, qword [rsp + 0x58]
mov eax, esi
imul rdi, rax, 0x38
mov rcx, qword [rdi + r14 + 0x28]
call fcn.1400689e0
mov rcx, qword [rsp + 0x58]
lea rbx, [r14 + 0x18]
add rbx, rdi
mov dword [rsp + 0x28], 4
mov r9d, 4
mov qword [rsp + 0x20], rbx
xor r8d, r8d
lea rdx, str.targetInfoCount
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov r8, qword [rsp + 0x58]
mov edx, dword [rbx]
mov rcx, qword [rdi + r14 + 0x20]
call fcn.140067860
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc esi
cmp esi, dword [rbp]
jb 0x140066b00
mov al, 1
jmp 0x140066be5
xor al, al
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.14006ed70
mov rbx, qword [rsp + 0x100]
add rsp, 0xc0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140069da0
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x2f0]
sub rsp, 0x3f0
mov rax, qword [0x1400cd548]
xor rax, rsp
mov qword [rbp + 0x2e0], rax
mov rdi, rdx
mov rsi, rcx
call fcn.140069780
xor r15d, r15d
mov dword [rsp + 0x40], 0x50
mov r14, rax
lea r9, [rsp + 0x40]
lea rax, [rsp + 0x50]
xor edx, edx
mov qword [rsp + 0x38], rax
lea r8, [rbp + 0x240]
mov qword [rsp + 0x30], r15
mov rcx, rdi
mov qword [rsp + 0x28], r15
mov ebx, r15d
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x140069f25
mov r9d, 0xf003f
lea r8, [rsp + 0x48]
lea rdx, [rbp + 0x240]
mov rcx, rdi
call fcn.140059a60
test eax, eax
jne 0x140069ee3
xor edx, edx
mov dword [rsp + 0x68], r15d
mov r8d, 0xa0
mov qword [rsp + 0x70], r15
lea rcx, [rbp + 0x1a0]
mov qword [rbp + 0x188], r15
mov qword [rbp + 0x190], r15
mov dword [rsp + 0x78], r15d
mov word [rsp + 0x7c], r15w
mov dword [rbp + 0x184], r15d
call fcn.140070390
mov rcx, qword [rsp + 0x48]
lea r8, [rbp + 0x1a0]
mov r9d, 0xa0
lea rdx, str.Action
call fcn.140059d90
lea rdx, [rbp + 0x1a0]
mov rcx, r14
call fcn.140069660
mov qword [rsp + 0x70], rax
cmp rax, 0xffffffffffffffff
je 0x140069ed8
mov rdx, qword [rsp + 0x48]
lea rcx, [rsp + 0x60]
call fcn.140069f50
test al, al
je 0x140069ed8
lea rdx, [rsp + 0x60]
mov rcx, rsi
call fcn.140069a10
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x50]
mov dword [rsp + 0x40], 0x50
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x40]
mov qword [rsp + 0x30], r15
lea r8, [rbp + 0x240]
inc ebx
mov qword [rsp + 0x28], r15
mov edx, ebx
mov qword [rsp + 0x20], r15
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x140069e20
mov al, 1
mov rcx, qword [rbp + 0x2e0]
xor rcx, rsp
call fcn.14006ed70
mov rbx, qword [rsp + 0x430]
add rsp, 0x3f0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x14006a7c0
Capabilities:
Enumerate gui resources

Disassembly:
mov dword [rcx + 0x10], edx
mov rdx, rcx
mov qword [rcx + 0x18], r8
mov qword [rcx + 0x20], r9
lea rcx, [0x14006a850]
jmp qword [sym.imp.USER32.dll_EnumWindows]

Function at 0x14006c270
Capabilities:
Enumerate gui resources

Disassembly:
test rcx, rcx
je 0x14006c3e9
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x50
mov rbx, r8
mov ebp, edx
mov rdi, rcx
test edx, edx
jne 0x14006c2cb
call fcn.14006c530
cmp rax, rdi
je 0x14006c2b9
test rax, rax
je 0x14006c3d5
mov rdi, rax
mov qword [rsp + 0x60], rax
mov rcx, rdi
call fcn.14006c750
mov ecx, 1
test al, al
cmove ebp, ecx
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
xor esi, esi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x20], rdi
lea rdx, [rsp + 0x28]
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov rcx, qword [rsp + 0x20]
call fcn.14006a8b0
mov dword [rsp + 0x2c], eax
mov rdx, qword [rsp + 0x38]
cmp rdx, qword [rsp + 0x40]
je 0x14006c313
mov qword [rdx], rdi
add qword [rsp + 0x38], 8
jmp 0x14006c322
lea r8, [rsp + 0x60]
lea rcx, [rsp + 0x30]
call fcn.14002c2f0
test ebp, ebp
jne 0x14006c32f
lea rcx, [0x14006bdd0]
jmp 0x14006c349
cmp ebp, 1
jne 0x14006c33d
lea rcx, [0x14006bd30]
jmp 0x14006c349
cmp ebp, 2
jne 0x14006c354
lea rcx, [0x14006bcb0]
lea rdx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_EnumWindows]
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
sub rax, rcx
sar rax, 3
test eax, eax
jle 0x14006c3bf
mov rdi, rsi
nop dword [rax]
mov rcx, qword [rdi + rcx]
call fcn.14006c720
test al, al
jne 0x14006c3a4
mov r8, qword [rsp + 0x30]
add r8, rdi
mov rdx, qword [rbx + 8]
cmp rdx, qword [rbx + 0x10]
je 0x14006c39c
mov rax, qword [r8]
mov qword [rdx], rax
add qword [rbx + 8], 8
jmp 0x14006c3a4
mov rcx, rbx
call fcn.14002c2f0
inc esi
add rdi, 8
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
sub rax, rcx
sar rax, 3
cmp esi, eax
jl 0x14006c370
test rcx, rcx
je 0x14006c3d5
mov rdx, qword [rsp + 0x40]
sub rdx, rcx
and rdx, 0xfffffffffffffff8
call fcn.140006ee0
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x14006c3f0
Capabilities:
Enumerate gui resources

Disassembly:
push rbx
push rbp
push r12
push r13
push r14
sub rsp, 0x20
mov r14, rcx
mov rdx, rcx
lea rcx, [0x14006be50]
call qword [sym.imp.USER32.dll_EnumWindows]
mov rax, qword [r14 + 8]
xor r13d, r13d
mov rbx, qword [r14]
xor r12b, r12b
sub rax, rbx
mov ebp, r13d
sar rax, 3
test eax, eax
jle 0x14006c51f
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x60], r15
mov r15d, r13d
mov qword [rsp + 0x58], rdi
mov rcx, qword [r15 + rbx]
mov edx, 4
call qword [sym.imp.USER32.dll_GetWindow]
test rax, rax
je 0x14006c483
mov rdi, qword [r14]
mov rbx, qword [r14 + 8]
mov rcx, rdi
cmp rdi, rbx
je 0x14006c472
cmp qword [rcx], rax
je 0x14006c472
add rcx, 8
cmp rcx, rbx
jne 0x14006c464
call fcn.140006c10
cmp rax, rbx
je 0x14006c483
mov qword [r15 + rdi], r13
mov r12b, 1
mov rsi, qword [r14 + 8]
inc ebp
mov rbx, qword [r14]
mov rax, rsi
sub rax, rbx
add r15, 8
sar rax, 3
cmp ebp, eax
jl 0x14006c441
mov r15, qword [rsp + 0x60]
test r12b, r12b
je 0x14006c515
cmp rbx, rsi
je 0x14006c4f2
nop dword [rax]
mov rcx, qword [rbx]
call fcn.14006c8e0
test al, al
jne 0x14006c4c5
add rbx, 8
cmp rbx, rsi
jne 0x14006c4b0
cmp rbx, rsi
je 0x14006c4f2
lea rdi, [rbx + 8]
cmp rdi, rsi
je 0x14006c4f2
mov rbp, qword [rdi]
mov rcx, rbp
call fcn.14006c8e0
test al, al
jne 0x14006c4e9
mov qword [rbx], rbp
add rbx, 8
add rdi, 8
cmp rdi, rsi
jne 0x14006c4d3
mov rdi, qword [r14 + 8]
mov rcx, rbx
call fcn.140006c10
cmp rax, rdi
je 0x14006c515
mov r8, rax
mov rdx, rdi
mov rcx, rdi
call fcn.140037230
mov qword [r14 + 8], rax
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop r13
pop r12
pop rbp
pop rbx
ret

Function at 0x14008782c
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140087658
Function at 0x14008d780
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
jne 0x14008d4a6
call fcn.14007b7d0
mov dword [rax], 0x16
call fcn.14007574c
jmp 0x14008d5f1
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x14008d5f1
mov eax, dword [rcx + 0x14]
shr eax, 0xc
test al, 1
jne 0x14008d5f1
mov eax, dword [rcx + 0x14]
shr eax, 1
test al, 1
je 0x14008d4d5
lock or dword [rcx + 0x14], 0x10
jmp 0x14008d5f1
lock or dword [rcx + 0x14], 1
mov eax, dword [rcx + 0x14]
test eax, 0x4c0
jne 0x14008d4e9
call fcn.14008db44
mov esi, dword [rbx + 0x10]
cmp esi, 1
jne 0x14008d4f9
mov rax, qword [rbx]
mov bpl, byte [rax]
jmp 0x14008d4fc
xor bpl, bpl
mov rdi, qword [rbx + 8]
mov rcx, rbx
mov qword [rbx], rdi
call fcn.14008c350
mov r8d, dword [rbx + 0x20]
mov ecx, eax
mov rdx, rdi
call fcn.140096e2c
mov dword [rbx + 0x10], eax
lea ecx, [rax + 1]
cmp ecx, 2
jbe 0x14008d5df
mov eax, dword [rbx + 0x14]
test al, 6
jne 0x14008d58d
mov rcx, rbx
call fcn.14008c350
cmp eax, 0xffffffff
je 0x14008d578
mov rcx, rbx
call fcn.14008c350
cmp eax, 0xfffffffe
je 0x14008d578
mov rcx, rbx
call fcn.14008c350
movsxd rdi, eax
lea r14, [0x1400d0fb0]
mov rcx, rbx
sar rdi, 6
call fcn.14008c350
and eax, 0x3f
lea rcx, [rax + rax*8]
mov rax, qword [r14 + rdi*8]
lea rdx, [rax + rcx*8]
jmp 0x14008d57f
lea rdx, [0x1400cd910]
mov al, byte [rdx + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x14008d58d
lock or dword [rbx + 0x14], 0x20
cmp dword [rbx + 0x20], 0x200
jne 0x14008d5b1
mov eax, dword [rbx + 0x14]
shr eax, 6
test al, 1
je 0x14008d5b1
mov eax, dword [rbx + 0x14]
shr eax, 8
test al, 1
jne 0x14008d5b1
mov dword [rbx + 0x20], 0x1000
mov rax, qword [rbx]
cmp esi, 1
jne 0x14008d5cf
movzx ecx, byte [rax]
dec dword [rbx + 0x10]
shl cx, 8
movzx eax, bpl
or cx, ax
inc qword [rbx]
jmp 0x14008d5da
movzx ecx, word [rax]
add dword [rbx + 0x10], 0xfffffffe
add qword [rbx], 2
movzx eax, cx
jmp 0x14008d5f6
neg eax
sbb eax, eax
and eax, 8
add eax, 8
lock or dword [rbx + 0x14], eax
and dword [rbx + 0x10], 0
mov eax, 0xffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
jmp 0x14008d470
Function at 0x180001000
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov rdi, rdx
mov rcx, rdx
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
cmp dword [section..data], 0
mov rbx, rax
je 0x18000105a
cmp byte [0x1800150a2], 0
jne 0x18000105a
test rax, rax
je 0x18000105a
mov r8, rax
lea rcx, str.NOTE:_Picked_up__s:__s
mov rdx, rdi
call sym.jli.dll_JLI_ReportMessage
mov r8, rdi
mov rdx, rbx
mov rcx, rsi
call fcn.18000126c
jmp 0x18000105c
xor al, al
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x18000126c
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov qword [rax + 8], rcx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rbp, rcx
mov rdi, r8
mov rcx, rdx
mov rbx, rdx
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
lea rcx, [rax + 1]
call sym.jli.dll_JLI_MemAlloc
mov r14, rax
mov al, byte [rbx]
test al, al
je 0x18000143b
movsx ecx, al
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isspace]
test eax, eax
je 0x1800012c9
inc rbx
mov al, byte [rbx]
test al, al
jne 0x1800012b3
mov al, byte [rbx]
test al, al
je 0x18000143b
mov rsi, r14
movsx ecx, al
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isspace]
test eax, eax
jne 0x180001346
test rdi, rdi
je 0x180001335
mov cl, byte [rbx]
cmp cl, 0x22
je 0x1800012f4
cmp cl, 0x27
jne 0x180001335
inc rbx
mov al, byte [rbx]
cmp al, cl
je 0x180001316
mov dl, al
mov al, dl
test dl, dl
je 0x180001316
mov byte [r14], dl
inc rbx
inc r14
mov al, byte [rbx]
mov dl, al
cmp al, cl
jne 0x1800012ff
test al, al
jne 0x18000133d
mov rdx, rdi
lea rcx, str.Error:_Unmatched_quote_in_environment_variable__s
call sym.jli.dll_JLI_ReportMessage
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov al, byte [rbx]
mov byte [r14], al
inc r14
inc rbx
mov al, byte [rbx]
test al, al
jne 0x1800012d6
mov byte [r14], 0
xor edx, edx
mov rcx, rsi
inc r14
call sym.jli.dll_JLI_PreprocessArg
mov r15, rax
test rax, rax
jne 0x180001378
mov rcx, rsi
call fcn.18000151c
mov rdx, rsi
test eax, eax
jne 0x1800013e2
mov rcx, rbp
call sym.jli.dll_JLI_List_add
jmp 0x1800013bf
mov r13, qword [rax + 8]
xor r12d, r12d
test r13, r13
je 0x1800013af
mov rax, qword [r15]
mov rbp, qword [rax + r12*8]
mov rcx, rbp
call fcn.18000151c
mov rdx, rbp
test eax, eax
jne 0x1800013fc
mov rbp, qword [rsp + 0x50]
mov rcx, rbp
call sym.jli.dll_JLI_List_add
inc r12
cmp r12, r13
jb 0x180001384
mov rcx, qword [r15]
call sym.jli.dll_JLI_MemFree
mov rcx, r15
call sym.jli.dll_JLI_MemFree
cmp dword [section..data], 0xffffffff
je 0x1800012a9
test rdi, rdi
je 0x180001423
mov rdx, rdi
lea rcx, str.Error:_Cannot_specify_main_class_in_environment_variable__s
call sym.jli.dll_JLI_ReportMessage
jmp 0x18000142f
test rdi, rdi
je 0x1800013f3
mov r8, rdi
lea rcx, str.Error:_Option__s_is_not_allowed_in_environment_variable__s
jmp 0x18000141c
lea rcx, str.Error:_Option__s_is_not_allowed_in_this_context
jmp 0x1800013db
mov r8, rsi
test rdi, rdi
je 0x180001415
mov r9, rdi
lea rcx, str.Error:_Option__s_in__s_is_not_allowed_in_environment_variable__s
call sym.jli.dll_JLI_ReportMessage
jmp 0x18000142f
lea rcx, str.Error:_Option__s_in__s_is_not_allowed_in_this_context
call sym.jli.dll_JLI_ReportMessage
jmp 0x18000142f
lea rcx, str.Error:_Cannot_specify_main_class_in_this_context
call sym.jli.dll_JLI_ReportMessage
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rbx, qword [rsp + 0x58]
mov al, 1
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret