joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400969e0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rdi
push r12
push r13
mov eax, 0x2040
call fcn.1400d8110
sub rsp, rax
mov rax, qword [0x1401006f0]
xor rax, rsp
mov qword [rsp + 0x2030], rax
xor ebx, ebx
mov r8, rcx
cmp dword [rcx + 0x4c], ebx
je 0x140096c09
cmp byte [rcx + 0x48], bl
je 0x140096c09
cmp dword [rdx + 0x10], 6
jb 0x140096c09
mov rax, qword [rdx]
mov ecx, 0x400c
cmp word [rax + 0x78], cx
jne 0x140096c09
mov rax, qword [rax + 8]
or ecx, 0xffffffff
lea edi, [rbx + 5]
mov word [rax], cx
cmp dword [r8 + 0x4c], 2
mov rax, qword [rdx]
mov rcx, qword [rax + 0x80]
mov rbp, qword [rcx + 8]
jne 0x140096a6a
call fcn.140095f50
mov edi, eax
mov edx, edi
lea r13, str.open
lea r12, [0x1400e04f4]
cmp edi, ebx
je 0x140096bb6
sub edx, 1
je 0x140096b84
sub edx, 1
je 0x140096b5f
cmp edx, 2
jne 0x140096bdb
lea r9, [rsp + 0x30]
lea rdx, str.http_shellopencommand
mov r8, r12
mov rcx, 0xffffffff80000000
mov dword [rsp + 0x28], 0x800
mov qword [rsp + 0x20], r12
call fcn.14006cdc0
mov edx, 0x22
cmp word [rsp + 0x30], dx
jne 0x140096beb
lea rcx, [rsp + 0x32]
call fcn.1400c7b54
mov rdi, rax
cmp rax, rbx
je 0x140096beb
lea rcx, [rsp + 0x30]
call fcn.1400615e8
lea rdx, str.opera.exe
mov r8d, 9
mov rcx, rax
call fcn.1400883f8
cmp eax, ebx
jne 0x140096beb
lea r8, str._newwindow__s
lea rcx, [rsp + 0x1030]
mov r9, rbp
mov edx, 0x800
mov word [rdi + 2], bx
call fcn.140022b7c
lea r8, [rsp + 0x30]
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x1030]
mov rdx, r13
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rbx, rax
jmp 0x140096be5
lea r8, str.__new_window__s
lea rcx, [rsp + 0x1030]
mov r9, rbp
mov edx, 0x800
call fcn.140022b7c
lea r8, str.chrome.exe
jmp 0x140096b37
lea r8, str._new_window__s
lea rcx, [rsp + 0x1030]
mov r9, rbp
mov edx, 0x800
call fcn.140022b7c
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r12
lea r8, str.firefox.exe
jmp 0x140096b44
lea r8, str.iexplore.exe
mov r9, rbp
mov rdx, r13
xor ecx, ecx
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r12
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rbx, rax
cmp edi, 5
je 0x140096beb
cmp edi, 3
je 0x140096beb
cmp rbx, 0x20
ja 0x140096c09
xor r9d, r9d
mov r8, rbp
mov rdx, r13
xor ecx, ecx
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r12
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rcx, qword [rsp + 0x2030]
xor rcx, rsp
call fcn.1400c6350
lea r11, [rsp + 0x2040]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
Function at 0x140098060
Capabilities:
Write file on windows

Disassembly:
test rcx, rcx
je 0x1400980ef
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
lea rdx, [0x14015e3de]
lea rcx, str.Rar_CM
mov r8d, 0x800
call fcn.1400a279c
mov rsi, rax
test rax, rax
je 0x1400980e0
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasw ax, word [rdi]
lea edx, [rax + 2]
mov r9, rsi
not rcx
lea r8, [rcx - 1]
lea rdi, [rcx - 1]
mov rcx, rbx
call fcn.1400c8f54
mov rcx, rsi
call fcn.1400c8d40
mov edx, dword [0x14015f3e0]
mov eax, 3
test rdi, rdi
cmovne edx, eax
mov dword [0x14015f3e0], edx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140098404
Capabilities:
Get disk information
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
mov eax, 0x5460
call fcn.1400d8110
sub rsp, rax
mov rax, qword [0x1401006f0]
xor rax, rsp
mov qword [rsp + 0x5450], rax
mov rsi, rcx
mov rcx, rdx
mov rdi, rdx
call fcn.1400615e8
mov edx, 0x3a
mov rcx, rax
call fcn.1400c7b54
xor ebp, ebp
cmp rax, rbp
je 0x14009848d
cmp byte [0x140182720], bpl
jne 0x14009848d
lea ecx, [rbp + 0x65]
call fcn.140076080
mov ecx, 0x528
mov rbx, rax
call fcn.140076080
lea r9d, [rbp + 0x31]
mov r8, rbx
mov rcx, rsi
mov rdx, rax
call qword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 1
jne 0x140098628
mov byte [0x140182720], al
lea rdx, [rsp + 0x1050]
mov rcx, rdi
sub rdx, rdi
movzx eax, word [rcx]
mov word [rdx + rcx], ax
add rcx, 2
cmp ax, bp
jne 0x14009849b
lea rcx, [rsp + 0x1050]
call fcn.1400618f4
mov ebx, 0x800
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x1050]
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea rcx, [rsp + 0x50]
mov word [rsp + 0x104e], bp
call fcn.1400615e8
cmp word [rax], bp
je 0x140098561
jmp 0x140098552
mov ecx, 0x14d
call fcn.140076080
lea r9, [rsp + 0x50]
lea r8, str.__s__n_s
lea rcx, [rsp + 0x4050]
mov edx, 0xa00
mov qword [rsp + 0x20], rax
call fcn.140022b7c
mov ecx, 0x65
call fcn.140076080
lea rdx, [rsp + 0x4050]
mov r9d, 0x34
mov r8, rax
mov rcx, rsi
call qword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x140098628
lea rcx, [rsp + 0x50]
xor edx, edx
call fcn.14003cae4
lea rcx, [rsp + 0x50]
call fcn.14003c3d4
cmp al, bpl
je 0x1400984ec
call fcn.14004b0ac
cmp eax, 0x501
jb 0x14009862c
lea r8, [rsp + 0x2050]
lea rcx, [0x140155380]
mov r9, rbx
mov rdx, rdi
call fcn.14004bca8
lea rdx, [rsp + 0x3050]
lea rcx, [rsp + 0x2050]
mov r8, rbx
call fcn.140061f68
mov dword [rsp + 0x38], ebp
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x3050]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
cmp eax, ebp
je 0x14009862c
bt dword [rsp + 0x40], 0x13
jae 0x14009862c
mov ecx, 0x65e
call fcn.140076080
lea r9, [rsp + 0x3050]
lea rcx, [rsp + 0x4050]
mov r8, rax
mov edx, 0xa00
call fcn.140022b7c
mov ecx, 0x65
call fcn.140076080
lea rdx, [rsp + 0x4050]
mov r9d, 0x30
mov r8, rax
mov rcx, rsi
call qword [sym.imp.USER32.dll_MessageBoxW]
xor al, al
jmp 0x14009862e
mov al, 1
mov rcx, qword [rsp + 0x5450]
xor rcx, rsp
call fcn.1400c6350
mov rbx, qword [rsp + 0x5490]
add rsp, 0x5460
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400a1a98
Capabilities:
Capture screenshot

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x80
mov rbx, rcx
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, rax
mov r14, rax
call qword [sym.imp.USER32.dll_GetDC]
mov rcx, rax
mov r13, rax
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov rcx, r13
mov r12, rax
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
lea r8, [rsp + 0x60]
mov edx, 0x20
mov rcx, rbx
mov rbp, rax
call qword [sym.imp.GDI32.dll_GetObjectW]
mov r8d, dword [rsp + 0x68]
mov edx, dword [rsp + 0x64]
mov rcx, r13
call qword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov rdx, rbx
mov rcx, r12
mov rsi, rax
call qword [sym.imp.GDI32.dll_SelectObject]
mov rdx, rsi
mov rcx, rbp
mov rdi, rax
call qword [sym.imp.GDI32.dll_SelectObject]
mov edx, dword [rsp + 0x68]
mov r9d, dword [rsp + 0x64]
mov dword [rsp + 0x50], 0xcc0020
mov dword [rsp + 0x48], edx
mov ecx, r9d
lea r8d, [r9 - 1]
neg ecx
mov rbx, rax
mov dword [rsp + 0x40], ecx
and dword [rsp + 0x38], 0
mov dword [rsp + 0x30], r8d
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], edx
xor r8d, r8d
xor edx, edx
mov rcx, rbp
call qword [sym.imp.GDI32.dll_StretchBlt]
mov eax, dword [rsp + 0x68]
mov r9d, dword [rsp + 0x64]
mov dword [rsp + 0x40], 0xcc0020
and dword [rsp + 0x38], 0
and dword [rsp + 0x30], 0
xor r8d, r8d
xor edx, edx
mov rcx, r12
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], eax
call qword [sym.imp.GDI32.dll_BitBlt]
mov rdx, rdi
mov rcx, r12
call qword [sym.imp.GDI32.dll_SelectObject]
mov rdx, rbx
mov rcx, rbp
call qword [sym.imp.GDI32.dll_SelectObject]
mov rcx, rsi
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, r12
call qword [sym.imp.GDI32.dll_DeleteDC]
mov rcx, rbp
call qword [sym.imp.GDI32.dll_DeleteDC]
mov rdx, r13
mov rcx, r14
call qword [sym.imp.USER32.dll_ReleaseDC]
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop r12
ret
Function at 0x1400a1d3c
Capabilities:
Check if file exists
Get common file path
Get file attributes
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
mov eax, 0x1040
call fcn.1400d8110
sub rsp, rax
mov rax, qword [0x1401006f0]
xor rax, rsp
mov qword [rsp + 0x1030], rax
xor ebp, ebp
mov sil, r8b
mov rdi, rdx
mov rbx, rcx
cmp word [0x140167bb8], bp
je 0x1400a1d8b
mov r8, rdx
lea rdx, [0x140167bb8]
call fcn.1400805a0
jmp 0x1400a1e32
mov dword [rsp + 0x20], edx
mov r8, rcx
lea r9, [0x1400e04f4]
lea rdx, str.TempFolder
lea rcx, [0x1400e0a90]
call fcn.14006d398
movzx eax, word [rbx]
mov word [rsp + 0x30], bp
cmp ax, bp
je 0x1400a1de9
lea rdx, [rsp + 0x30]
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp eax, ebp
je 0x1400a1de1
lea rdx, [rsp + 0x30]
mov r8, rdi
mov rcx, rbx
call fcn.1400805a0
mov ax, word [rbx]
cmp ax, bp
jne 0x1400a1df3
cmp sil, bpl
je 0x1400a1e01
cmp ax, bp
je 0x1400a1e32
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1400a1e32
mov rdx, rbx
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp eax, ebp
je 0x1400a1e15
cmp word [rbx], bp
jne 0x1400a1e32
lea rcx, str._rartemp
mov rdx, rbx
sub rdx, rcx
movzx eax, word [rcx]
mov word [rdx + rcx], ax
add rcx, 2
cmp ax, bp
jne 0x1400a1e22
mov rdx, rdi
mov rcx, rbx
call fcn.14006119c
mov rcx, qword [rsp + 0x1030]
xor rcx, rsp
call fcn.1400c6350
mov rbx, qword [rsp + 0x1070]
add rsp, 0x1040
pop rdi
pop rsi
pop rbp
ret

Function at 0x1400a1e60
Capabilities:
Get disk information

Disassembly:
push rbx
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
lea rdx, str.NoDrives
lea rcx, str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
xor r8d, r8d
mov ebx, eax
call fcn.14006d3c4
not eax
and eax, ebx
add rsp, 0x20
pop rbx
ret

Function at 0x1400a23ac
Capabilities:
Enumerate gui resources

Disassembly:
sub rsp, 0x28
lea rcx, str.Shutdown
mov edx, 1
call fcn.140025fd4
test eax, eax
je 0x1400a23e8
lea rdx, [rsp + 0x30]
lea rcx, [0x1400a22e4]
mov byte [rsp + 0x30], 1
call qword [sym.imp.USER32.dll_EnumWindows]
cmp byte [rsp + 0x30], 0
je 0x1400a23e8
call fcn.14008124c
add rsp, 0x28
ret
Function at 0x1400a287c
Capabilities:
Create directory

Disassembly:
push rbx
push rsi
push rdi
mov eax, 0x2030
call fcn.1400d8110
sub rsp, rax
mov rax, qword [0x1401006f0]
xor rax, rsp
mov qword [rsp + 0x2020], rax
mov rbx, rdx
mov rdx, rcx
mov rsi, r8
lea rcx, [rsp + 0x1020]
mov r8d, 0x7ff
mov dil, r9b
call fcn.1400805a0
test dil, dil
je 0x1400a2916
cmp dword [0x140157c40], 0
jne 0x1400a28d9
cmp byte [0x140157c4a], 0
jne 0x1400a28d9
xor eax, eax
jmp 0x1400a28de
mov eax, 1
xor r9d, r9d
test al, al
lea rdi, [rsp + 0x1020]
setne r9b
or rcx, 0xffffffffffffffff
xor eax, eax
repne scasw ax, word [rdi]
lea r8, [0x1400e9a40]
lea edx, [rax + 2]
not rcx
add r9d, 0x61
lea rcx, [rsp + rcx*2 + 0x101e]
call fcn.140022b7c
mov edi, 0x800
lea rcx, [rsp + 0x20]
xor r8d, r8d
mov rdx, rdi
call fcn.1400a1d3c
lea rcx, [rsp + 0x20]
mov rdx, rdi
call fcn.14006119c
lea rdx, [rsp + 0x1020]
lea rcx, [rsp + 0x20]
mov r8, rdi
call fcn.1400805dc
lea rcx, [rsp + 0x20]
mov rdx, rdi
call fcn.14003c4c4
test rax, rax
je 0x1400a2984
lea rcx, [rsp + 0x20]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x1400a2984
lea rdx, [rsp + 0x20]
mov r8, rsi
mov rcx, rbx
call fcn.1400805a0
mov al, 1
jmp 0x1400a29a9
mov ecx, 0x1f7
call fcn.140076080
lea rdx, [rsp + 0x20]
mov rcx, rax
call fcn.1400b189c
lea rcx, [0x140134b90]
call fcn.1400330fc
xor al, al
mov rcx, qword [rsp + 0x2020]
xor rcx, rsp
call fcn.1400c6350
add rsp, 0x2030
pop rdi
pop rsi
pop rbx
ret

Function at 0x1400a32e4
Capabilities:
Set current directory

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
xor ecx, ecx
cmp eax, ecx
setne al
add rsp, 0x28
ret

Function at 0x1400a32fc
Capabilities:
Set current directory

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
setne bl
test bl, bl
jne 0x1400a3339
mov ecx, 0x627
call fcn.140076080
mov rdx, rdi
mov rcx, rax
call fcn.1400b189c
lea rcx, [0x140134b90]
call fcn.1400330fc
mov al, bl
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1400a3348
Capabilities:
Get common file path

Disassembly:
sub rsp, 0x28
mov rax, rdx
mov rdx, rcx
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
xor ecx, ecx
cmp eax, ecx
setne al
add rsp, 0x28
ret
Function at 0x1400a3a38
Capabilities:
Get graphical window text

Disassembly:
push rbx
push rsi
push rdi
mov eax, 0x2830
call fcn.1400d8110
sub rsp, rax
mov rax, qword [0x1401006f0]
xor rax, rsp
mov qword [rsp + 0x2820], rax
mov rbx, rdx
mov edx, ecx
mov rcx, qword [0x140148968]
mov rdi, r8
call qword [sym.imp.USER32.dll_GetDlgItem]
lea rdx, [rsp + 0x1420]
mov rcx, rax
mov r8d, 0xa00
mov rsi, rax
call qword [sym.imp.USER32.dll_GetWindowTextW]
lea r8, [rsp + 0x20]
mov r9d, 0xa00
mov rdx, rdi
mov rcx, rbx
call fcn.140061580
lea r11, [rsp + 0x20]
lea rdx, [rsp + 0x1420]
sub rdx, r11
movzx eax, word [r11]
movzx ecx, word [r11 + rdx]
sub eax, ecx
jne 0x1400a3ac5
add r11, 2
test ecx, ecx
jne 0x1400a3ab0
test eax, eax
je 0x1400a3ad7
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov rcx, qword [rsp + 0x2820]
xor rcx, rsp
call fcn.1400c6350
add rsp, 0x2830
pop rdi
pop rsi
pop rbx
ret

Function at 0x1400a3d64
Capabilities:
Get graphical window text

Disassembly:
push rbx
sub rsp, 0x440
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rax, qword [0x1401006f0]
xor rax, rsp
mov qword [rsp + 0x430], rax
mov rcx, qword [0x140148968]
test rcx, rcx
je 0x1400a3e82
mov r8d, 0x200
lea rdx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov eax, dword [0x140183adc]
cmp eax, 8
je 0x1400a3df5
lea rcx, [rsp + 0x30]
lea rdx, [0x140184070]
mov r9, rdx
sub r9, rcx
movzx r8d, word [rcx]
movzx r10d, word [rcx + r9]
sub r8d, r10d
jne 0x1400a3ddd
add rcx, 2
test r10d, r10d
jne 0x1400a3dc6
test r8d, r8d
je 0x1400a3df5
mov rcx, qword [0x140148968]
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov eax, dword [0x140183adc]
test eax, eax
je 0x1400a3e08
cmp eax, 1
je 0x1400a3e08
cmp eax, 2
je 0x1400a3e08
cmp eax, 8
jne 0x1400a3e46
lea r8, [0x140183f70]
xor edx, edx
mov ecx, 0x9c
call fcn.1400a3a38
lea rcx, [0x140185170]
call fcn.1400615e8
mov rbx, rax
lea rcx, [0x140186170]
call fcn.1400a2e54
mov rdx, rax
mov r8, rbx
mov ecx, 0x9b
call fcn.1400a3a38
mov eax, dword [0x140186974]
test al, 1
jne 0x1400a3e60
or eax, 1
mov dword [0x140186974], eax
and dword [0x140186970], 0
mov edx, reloc.SHELL32.dll_SHRestricted
lea rcx, [0x140186970]
call fcn.1400532d4
test al, al
je 0x1400a3e82
mov rcx, qword [0x140148968]
call qword [sym.imp.USER32.dll_UpdateWindow]
mov rcx, qword [rsp + 0x430]
xor rcx, rsp
call fcn.1400c6350
add rsp, 0x440
pop rbx
ret
Function at 0x1400a4258
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
sub rsp, 0x440
mov rax, qword [0x1401006f0]
xor rax, rsp
mov qword [rsp + 0x430], rax
mov rbx, rcx
mov dword [rcx], 0x3c8
mov rcx, qword [rcx + 8]
mov ebp, edx
mov esi, 0x200
lea rdx, [rsp + 0x30]
mov r8d, esi
call qword [sym.imp.USER32.dll_GetWindowTextW]
lea rcx, [rsp + 0x30]
mov edx, 0x40
call fcn.14005360c
or r12, 0xffffffffffffffff
cmp word [0x140183a70], 0
je 0x1400a4323
xor eax, eax
lea rdi, [rsp + 0x30]
mov rcx, r12
repne scasw ax, word [rdi]
mov eax, dword [0x1400e197c]
mov rcx, r12
mov dword [rdi - 2], eax
movzx eax, word [0x1400e1980]
mov word [rdi + 2], ax
xor eax, eax
lea rdi, [rsp + 0x30]
repne scasw ax, word [rdi]
not rcx
lea rdi, [rcx - 1]
mov ecx, 0x5aa
call fcn.140076080
mov rdx, rsi
lea rcx, [rsp + rdi*2 + 0x30]
mov r9, rax
lea rax, [0x140183a70]
lea r8, str._s:__s
sub rdx, rdi
mov qword [rsp + 0x20], rax
call fcn.140022b7c
cmp byte [0x140183ad7], 0
je 0x1400a4381
xor eax, eax
lea rdi, [rsp + 0x30]
mov rcx, r12
repne scasw ax, word [rdi]
mov eax, dword [0x1400e197c]
mov rcx, r12
mov dword [rdi - 2], eax
movzx eax, word [0x1400e1980]
mov word [rdi + 2], ax
xor eax, eax
lea rdi, [rsp + 0x30]
repne scasw ax, word [rdi]
not rcx
lea rdi, [rcx - 1]
mov ecx, 0x2fd
call fcn.140076080
sub rsi, rdi
lea rcx, [rsp + rdi*2 + 0x30]
mov r9d, ebp
mov rdx, rsi
mov r8, rax
call fcn.140022b7c
lea rcx, [rbx + 0x28]
lea rdx, [rsp + 0x30]
mov r8d, 0x80
call fcn.1400805a0
mov rcx, qword [rsp + 0x430]
xor rcx, rsp
call fcn.1400c6350
lea r11, [rsp + 0x440]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
Function at 0x1400a6910
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov r8d, dword [0x1401614f8]
lea rdi, str.ExtractionProfile
lea rdx, str.Overwrite
mov rcx, rdi
call fcn.14006d35c
movzx r8d, byte [0x14016151c]
lea rdx, [0x1400e72c0]
mov rcx, rdi
call fcn.14006d35c
movzx r8d, byte [0x14016151b]
lea rdx, str.Fresh
mov rcx, rdi
call fcn.14006d35c
mov r8d, dword [0x1401614f8]
lea rdx, str.Overwrite
mov rcx, rdi
call fcn.14006d35c
movzx r8d, byte [0x140162778]
lea rdx, str.UnpToSubfolders
mov rcx, rdi
call fcn.14006d35c
movzx r8d, byte [0x14016156c]
lea rdx, str.KeepBroken
mov rcx, rdi
call fcn.14006d35c
movzx r8d, byte [0x140187c48]
lea rdx, str.ShowExplorer
mov rcx, rdi
call fcn.14006d35c
mov r8d, dword [0x14016277c]
lea rdx, str.mtime
mov rcx, rdi
call fcn.14006d35c
mov r8d, dword [0x140162780]
lea rdx, str.ctime
mov rcx, rdi
call fcn.14006d35c
mov r8d, dword [0x140162784]
lea rdx, str.atime
mov rcx, rdi
call fcn.14006d35c
xor ebx, ebx
cmp dword [0x140161520], 2
mov r8d, ebx
lea rdx, str.PathsRel
mov rcx, rdi
sete r8b
call fcn.14006d35c
cmp dword [0x140161520], ebx
mov r8d, ebx
lea rdx, str.PathsFull
mov rcx, rdi
sete r8b
call fcn.14006d35c
cmp dword [0x140161520], 1
mov r8d, ebx
lea rdx, str.PathsNone
mov rcx, rdi
sete r8b
call fcn.14006d35c
cmp dword [0x140161520], 4
lea rdx, str.PathsAbsDrive
sete bl
mov rcx, rdi
mov r8d, ebx
call fcn.14006d35c
movzx r8d, byte [0x140161518]
lea rdx, str.ClearArc
mov rcx, rdi
call fcn.14006d35c
movzx r8d, byte [0x140161560]
lea rdx, str.ProcessOwners
mov rcx, rdi
call fcn.14006d35c
movzx r8d, byte [0x14016168d]
lea rdx, str.SetCompressedAttr
mov rcx, rdi
call fcn.14006d35c
mov r8d, dword [0x1401657bc]
lea rdx, str.ExtrDelArc
mov rcx, rdi
call fcn.14006d35c
movzx r8d, byte [0x1401657a3]
lea rdx, [0x1400e9240]
mov rcx, rdi
call fcn.14006d35c
movzx r8d, byte [0x1401657a4]
lea rdx, str.WaitForOther
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.14006d35c
Function at 0x1400a7574
Capabilities:
Query environment variable

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
mov eax, 0x1048
call fcn.1400d8110
sub rsp, rax
mov rax, qword [0x1401006f0]
xor rax, rsp
mov qword [rsp + 0x1030], rax
xor r12d, r12d
mov rsi, r9
mov rbx, r8
mov rbp, rdx
mov rdi, rcx
mov r13d, 0x800
cmp byte [rsp + 0x10b0], r12b
je 0x1400a761f
mov r8, rcx
lea rdx, str.DefFolder
lea rcx, str.Extraction
mov r9, rbx
mov dword [rsp + 0x20], r13d
call fcn.14006d398
mov rcx, rdi
cmp word [rdi], r12w
jne 0x1400a75f8
sub rcx, rbx
movzx eax, word [rbx]
mov word [rcx + rbx], ax
add rbx, 2
cmp ax, r12w
jne 0x1400a75e5
jmp 0x1400a761f
lea rdx, [rsp + 0x30]
mov r8d, r13d
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea rdx, [rsp + 0x30]
mov r8, rbp
mov rcx, rdi
mov word [rsp + 0x102e], r12w
call fcn.1400805a0
cmp word [rdi], r12w
setne bl
cmp word [rdi], r12w
jne 0x1400a763e
lea rcx, [0x140155380]
mov r8, rbp
mov rdx, rdi
call fcn.14004bc74
mov rdx, rbp
mov rcx, rdi
call fcn.14006119c
cmp byte [rsp + 0x10a0], r12b
jne 0x1400a765c
cmp bl, r12b
je 0x1400a7779
lea rdx, str.AppendName
lea rcx, str.Extraction
mov r8d, 1
call fcn.14006d3c4
cmp eax, r12d
je 0x1400a7779
lea rcx, [rsp + 0x30]
mov r8, r13
mov rdx, rsi
call fcn.1400805a0
mov rsi, r12
cmp word [rsp + 0x30], r12w
je 0x1400a76d9
mov rax, r12
lea rbx, [rsp + 0x30]
mov r13d, 0x25
cmp word [rbx], r13w
jne 0x1400a76c7
lea rcx, [rsp + rax + 0x32]
mov edx, r13d
call fcn.1400c7b54
cmp rax, r12
je 0x1400a76c7
mov eax, 0x5f
mov word [rbx], ax
inc rsi
lea rax, [rsi + rsi]
lea rbx, [rsp + rax + 0x30]
cmp word [rbx], r12w
jne 0x1400a76a7
lea rcx, [rsp + 0x30]
call fcn.1400615e8
mov r8, rbp
mov rcx, rdi
mov rdx, rax
call fcn.1400805dc
mov rcx, rdi
call fcn.140061804
mov rbx, rax
cmp rax, r12
je 0x1400a7779
cmp rax, rdi
jbe 0x1400a7779
mov rcx, rdi
mov word [rax], r12w
call fcn.140061804
mov rsi, rax
cmp rax, r12
je 0x1400a7770
cmp rax, rdi
jbe 0x1400a7770
cmp byte [rsp + 0x10a8], r12b
je 0x1400a774c
cmp word [rbx + 2], r12w
je 0x1400a774c
movzx ecx, word [rbx + 4]
call fcn.1400802a0
cmp al, r12b
jne 0x1400a774c
movzx ecx, word [rbx - 2]
call fcn.1400802a0
cmp al, r12b
jne 0x1400a7760
lea rdx, str..tar
mov rcx, rsi
call fcn.1400883c8
cmp eax, r12d
jne 0x1400a7770
mov word [rsi], r12w
jmp 0x1400a7770
cmp word [rbx], 0x2e
jne 0x1400a7779
mov word [rbx], r12w
sub rbx, 2
cmp rbx, rdi
ja 0x1400a7766
xor edx, edx
mov rcx, rdi
call fcn.1400612fc
mov rcx, qword [rsp + 0x1030]
xor rcx, rsp
call fcn.1400c6350
add rsp, 0x1048
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400a77a4
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x1058
call fcn.1400d8110
sub rsp, rax
mov rax, qword [0x1401006f0]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov rdx, rcx
lea r8, [rsp + 0x30]
lea rcx, [0x140155380]
mov r9d, 0x800
call fcn.14004bca8
lea rcx, [rsp + 0x30]
mov edx, 0x802
call fcn.14006119c
lea rdx, [0x1400e1dd8]
lea rcx, [rsp + 0x30]
mov r8d, 0x802
call fcn.1400805dc
lea rax, [0x1400e04f4]
lea r8, [rsp + 0x30]
lea rdx, str.open
xor r9d, r9d
xor ecx, ecx
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.1400c6350
add rsp, 0x1058
ret

Function at 0x1400a95f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x20
xor ebx, ebx
mov rsi, rdx
mov rbp, rcx
mov byte [rdx], bl
call fcn.1400615e8
lea r12d, [rbx + 3]
lea rdx, [0x1400e9ff8]
mov r8, r12
mov rcx, rax
mov rdi, rax
call fcn.1400883f8
cmp eax, ebx
je 0x1400a964b
lea rdx, [0x1400e9ff0]
mov r8, r12
mov rcx, rdi
call fcn.1400883f8
cmp eax, ebx
jne 0x1400a966d
movzx ecx, word [rdi + 6]
call fcn.1400c9644
cmp eax, ebx
je 0x1400a966d
cmp word [rdi + 8], 0x2e
je 0x1400a96f3
cmp word [rdi + 8], bx
je 0x1400a96f3
lea rdx, [0x1400e9fe8]
mov r8, r12
mov rcx, rdi
call fcn.1400883f8
cmp eax, ebx
je 0x1400a96c5
lea rdx, [0x1400e9fe0]
mov r8, r12
mov rcx, rdi
call fcn.1400883f8
cmp eax, ebx
je 0x1400a96c5
lea rdx, [0x1400e9fd8]
mov r8, r12
mov rcx, rdi
call fcn.1400883f8
cmp eax, ebx
je 0x1400a96c5
lea rdx, [0x1400e1a00]
mov r8, r12
mov rcx, rdi
call fcn.1400883f8
cmp eax, ebx
jne 0x1400a96d2
cmp word [rdi + 6], 0x2e
je 0x1400a96f3
cmp word [rdi + 6], bx
je 0x1400a96f3
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1400a96fa
mov rcx, rbp
call fcn.14003c3d4
cmp al, bl
je 0x1400a96fa
mov ebx, 1
jmp 0x1400a96fa
mov ebx, 1
mov byte [rsi], bl
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov al, bl
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop r12
ret