joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400c0b00
Capabilities:
Enumerate files on windows

Disassembly:
push rbx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xee8
mov rax, qword [0x1401f7280]
xor rax, rsp
mov qword [rsp + 0xec0], rax
mov r12, qword [rsp + 0xf40]
mov rbx, r9
mov r9, r8
mov r8, rdx
mov r14, rdx
mov r15, rcx
lea rdx, str._s_s
lea rcx, [rsp + 0x8a0]
call fcn.1400f98c8
xor r13d, r13d
lea r8, [rsp + 0x30]
lea rcx, [rsp + 0x8a0]
lea edx, [r13 + 1]
xor r9d, r9d
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x1400c0bd1
lea r8, [rsp + 0x30]
lea edx, [rax + 2]
lea rcx, [rsp + 0x8a0]
xor r9d, r9d
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x1400c0bd1
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x8a0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1400c0cab
mov rcx, r12
mov qword [rsp + 0xee0], rbp
mov qword [rsp + 0xed8], rsi
call fcn.1400f9670
mov ebp, dword [rsp + 0xf50]
mov esi, dword [rsp + 0xf48]
mov eax, dword [rsp + 0x30]
test al, 0x10
jne 0x1400c0c7c
test al, 2
je 0x1400c0c07
test esi, esi
je 0x1400c0c7c
lea rdx, [rsp + 0x5c]
lea rcx, [rsp + 0x490]
mov r8d, 0x207
call fcn.1400fb86c
lea rdx, [rsp + 0x280]
lea rcx, [rsp + 0x490]
mov r8d, 0x104
mov word [rsp + 0x89e], r13w
call fcn.1400eb6b0
lea rcx, [rsp + 0x280]
call fcn.1400f9670
lea rdx, [rsp + 0x280]
mov rcx, r12
call fcn.1400c1770
test eax, eax
je 0x1400c0c7c
inc dword [rbx]
test ebp, ebp
jne 0x1400c0c7c
mov edx, dword [rbx]
lea r8, [rsp + 0x30]
mov r9, r14
mov rcx, r15
call fcn.1400c0930
lea rdx, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1400c0bf7
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rsi, qword [rsp + 0xed8]
mov rbp, qword [rsp + 0xee0]
mov rcx, qword [rsp + 0xec0]
xor rcx, rsp
call fcn.1400f9a80
add rsp, 0xee8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rbx
ret
Function at 0x1400c0cd0
Capabilities:
Move file

Disassembly:
push rbx
push rsi
push rdi
push r14
sub rsp, 0x468
mov rax, qword [0x1401f7280]
xor rax, rsp
mov qword [rsp + 0x450], rax
mov rdi, r8
mov r14, rdx
mov rsi, rcx
lea rdx, [rsp + 0x240]
mov r8d, 7
mov rcx, rdi
mov rbx, r9
call fcn.1400ed200
mov rcx, rbx
call fcn.1400fa1a4
lea r8, [rsp + 0x240]
lea rdx, str._s._s
lea rcx, [rsp + 0x30]
mov r9, rbx
call fcn.1400f98c8
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.1400fa7c0
xor r8d, r8d
test eax, eax
je 0x1400c0d6f
mov rcx, qword [0x1401fbba0]
xor eax, eax
lea r9, [rsp + 0x30]
mov dword [rsp + 0x28], eax
mov edx, 0x4d8
mov qword [rsp + 0x20], rax
call fcn.1400f11b0
jmp 0x1400c0df1
xor r9d, r9d
mov edx, 0x1004
mov rcx, rsi
call qword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
jle 0x1400c0dd0
lea r8, [rsp + 0x30]
mov rdx, rdi
mov rcx, rsi
call fcn.1400c25f0
lea rax, [rsp + 0x30]
mov r8, rdi
sub r8, rax
lea rdx, [rsp + 0x30]
nop dword [rax]
nop dword [rax + rax]
movzx eax, word [rdx]
lea rdx, [rdx + 2]
mov word [r8 + rdx - 2], ax
test ax, ax
jne 0x1400c0db0
mov rdx, rdi
mov rcx, rsi
call fcn.1400c1630
mov dword [r14], eax
lea rcx, [rsp + 0x30]
lea rax, [rsp + 0x30]
sub rdi, rcx
nop dword [rax]
movzx ecx, word [rax]
lea rax, [rax + 2]
mov word [rdi + rax - 2], cx
test cx, cx
jne 0x1400c0de0
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.1400f9a80
add rsp, 0x468
pop r14
pop rdi
pop rsi
pop rbx
ret

Function at 0x1400c0fa0
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rsi, r8
mov edi, edx
mov rbx, rcx
call fcn.140091c60
lea rbp, [0x140208860]
lea rdx, str.UseAssociatedOnly
lea rcx, [0x14018ade0]
mov r9, rbp
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov qword [rsp + 0x28], rbp
mov r9, rbx
lea rcx, [0x14018ade0]
mov dword [rsp + 0x20], edi
cmp eax, 1
jne 0x1400c1010
lea r8, [0x140181e34]
lea rdx, str.AllExtensions
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
jmp 0x1400c1028
lea rdx, str.CustomExtensions
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov rcx, rbx
call fcn.1400f9670
lea rdx, str.ShowHiddenFiles
lea rcx, str.Viewing
mov r9, rbp
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov dword [rsi], eax
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x1400c1210
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x870
mov rax, qword [0x1401f7280]
xor rax, rsp
mov qword [rsp + 0x860], rax
mov rbx, rcx
lea rcx, [rsp + 0x240]
mov edx, 0x30c
call fcn.140091c60
lea rdi, [0x140208860]
lea rdx, str.UseAssociatedOnly
lea rcx, [0x14018ade0]
mov r9, rdi
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov qword [rsp + 0x28], rdi
lea r9, [rsp + 0x240]
lea rcx, [0x14018ade0]
mov dword [rsp + 0x20], 0x30c
cmp eax, 1
jne 0x1400c129c
lea r8, [0x140181e34]
lea rdx, str.AllExtensions
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
jmp 0x1400c12be
lea r8, [rsp + 0x240]
lea rdx, str.CustomExtensions
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea rcx, [rsp + 0x240]
call fcn.1400f9670
lea rdx, str.ShowHiddenFiles
lea rcx, str.Viewing
mov r9, rdi
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
lea rdx, [rsp + 0x30]
mov r8d, 0x104
mov rcx, rbx
call fcn.1400eb6b0
lea rcx, [rsp + 0x240]
call fcn.1400f9670
lea rcx, [rsp + 0x30]
call fcn.1400f9670
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x240]
call fcn.1400c1770
mov rcx, qword [rsp + 0x860]
xor rcx, rsp
call fcn.1400f9a80
mov rbx, qword [rsp + 0x888]
add rsp, 0x870
pop rdi
ret

Function at 0x1400c1340
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x30
lea rax, [rsp + 0x58]
mov rbx, rcx
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerAdvanced
mov r9d, 1
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400c13ba
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x48]
lea r9, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rdx, str.HideFileExt
xor r8d, r8d
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x48], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1400c13af
mov dword [rbx], 0
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x30
pop rbx
ret
Function at 0x1400c2400
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0xb18
mov rax, qword [0x1401f7280]
xor rax, rsp
mov qword [rsp + 0xb00], rax
mov rax, qword [rsp + 0xb60]
mov rbp, rcx
mov rcx, rdx
mov qword [rsp + 0x48], r9
mov rdi, r8
mov qword [rsp + 0x50], r8
mov qword [rsp + 0x40], rax
mov rsi, rdx
call fcn.1400e47e0
test dword [0x1401f7180], 0x1000
je 0x1400c24bb
lea rcx, [rsp + 0x2b0]
xor r9d, r9d
mov edx, 0x104
mov r8d, 0x1000
call fcn.14001eac0
lea rcx, [rsp + 0x2b0]
mov edx, 0x3b
call fcn.1400f9cdc
mov ebx, dword [rsp + 0xb68]
mov rdx, rsi
test rax, rax
mov rax, qword [rsp + 0x40]
mov rcx, rbp
je 0x1400c24b1
lea r9, [rsp + 0x2b0]
mov r8, rdi
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
call fcn.1400c06c0
jmp 0x1400c24eb
lea r8, [rsp + 0x2b0]
jmp 0x1400c24d2
mov ebx, dword [rsp + 0xb68]
mov rax, qword [rsp + 0x40]
mov r8, qword [rsp + 0x48]
mov rdx, rsi
mov rcx, rbp
mov dword [rsp + 0x30], 0
mov r9, rdi
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
call fcn.1400c0b00
lea rdx, [0x140186bd0]
lea rcx, [rsp + 0x4c0]
mov r8, rsi
call fcn.1400f98c8
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x4c0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1400c25c9
test byte [rsp + 0x60], 0x10
je 0x1400c25aa
cmp word [rsp + 0x8c], 0x2e
jne 0x1400c2563
lea rcx, [rsp + 0x8c]
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400c2544
cmp eax, 1
je 0x1400c25aa
cmp eax, 2
jne 0x1400c2563
cmp word [rsp + 0x8e], 0x2e
je 0x1400c25aa
lea r9, [rsp + 0x8c]
lea rdx, str._s_s_
lea rcx, [rsp + 0x6f0]
mov r8, rsi
call fcn.1400f98c8
mov rax, qword [rsp + 0x40]
mov r9, qword [rsp + 0x48]
mov r8, qword [rsp + 0x50]
lea rdx, [rsp + 0x6f0]
mov rcx, rbp
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
call fcn.1400c2400
lea rdx, [rsp + 0x60]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1400c2522
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, qword [rsp + 0xb00]
xor rcx, rsp
call fcn.1400f9a80
add rsp, 0xb18
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400c2710
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push r12
push r13
push r15
sub rsp, 0x20
mov rsi, rcx
mov rcx, qword [rsp + 0x60]
mov r12, rdx
mov r15, r8
xor ebp, ebp
xor r8d, r8d
lea edx, [rbp + 0x74]
mov ebx, r9d
call qword [sym.imp.USER32.dll_GetMenuState]
mov r9d, ebp
mov r13d, 1
cmp eax, 8
cmove r9d, r13d
cmp ebx, 0x74
jg 0x1400c27f2
je 0x1400c27d8
add ebx, 0xffffffee
cmp ebx, 0x3b
ja case.0x1400c278b.19
lea rdx, [0x140000000]
movsxd rax, ebx
movzx eax, byte [rdx + rax + 0xc2978]
mov ecx, dword [rdx + rax*4 + 0xc295c]
add rcx, rdx
jmp rcx
mov eax, 9
lea ecx, [rax + 0x32]
jmp 0x1400c284f
mov eax, 4
lea ecx, [rax + 0x32]
jmp 0x1400c284f
mov eax, 5
lea ecx, [rax + 0x32]
jmp 0x1400c284f
mov eax, 6
lea ecx, [rax + 0x32]
jmp 0x1400c284f
mov eax, 7
lea ecx, [rax + 0x32]
jmp 0x1400c284f
mov eax, 8
lea ecx, [rax + 0x32]
jmp 0x1400c284f
mov eax, dword [0x1401f714c]
cmp eax, 0x1e
je 0x1400c285b
test r9d, r9d
je 0x1400c27ed
add eax, 0x32
jmp 0x1400c2855
sub eax, 0x32
jmp 0x1400c2855
sub ebx, 0xa3
je 0x1400c2845
sub ebx, 0x3e1
je 0x1400c283b
sub ebx, 2
je 0x1400c2831
sub ebx, 4
je 0x1400c2827
cmp ebx, 2
je 0x1400c281b
neg r9d
sbb eax, eax
and eax, 0x32
jmp 0x1400c2855
mov dword [0x1401f714c], 0x1e
jmp 0x1400c285b
mov eax, 2
lea ecx, [rax + 0x32]
jmp 0x1400c284f
mov eax, 3
lea ecx, [rax + 0x32]
jmp 0x1400c284f
mov eax, r13d
mov ecx, 0x33
jmp 0x1400c284f
mov eax, 0xa
mov ecx, 0x3c
test r9d, r9d
cmovne eax, ecx
mov dword [0x1401f714c], eax
mov edx, 0x7f02
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorW]
mov rcx, rax
call qword [sym.imp.USER32.dll_SetCursor]
mov ebx, dword [0x1401f714c]
cmp ebx, 0x1e
je 0x1400c290f
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x1400c28b4
lea r9, [0x140208860]
lea rdx, str.FullSort
lea rcx, [0x140185d88]
mov r8d, r13d
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
jne 0x1400c28b4
add ebx, 0x64
mov eax, dword [0x1401f714c]
cmp eax, 4
je 0x1400c28c4
cmp eax, 0x36
jne 0x1400c28de
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.USER32.dll_IsWindowVisible]
mov edx, ebp
mov rcx, rsi
test eax, eax
sete dl
call fcn.1400c2290
lea r9, [fcn.1400c1970]
movsxd r8, ebx
mov edx, 0x1030
mov rcx, rsi
call qword [sym.imp.USER32.dll_SendMessageW]
cmp dword [0x1401f714c], 0x32
mov rcx, rsi
setg bpl
or edx, 0xffffffff
mov r8d, ebp
call fcn.1400c6200
mov rdx, r15
mov rcx, rsi
call fcn.1400c1630
mov edx, 0x7f00
xor ecx, ecx
mov dword [r12], eax
call qword [sym.imp.USER32.dll_LoadCursorW]
mov rcx, rax
call qword [sym.imp.USER32.dll_SetCursor]
mov rcx, qword [rsp + 0x60]
mov edx, r13d
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r13
pop r12
jmp fcn.140072400
Function at 0x1400c2fc0
Capabilities:
Create thread

Disassembly:
push rdi
sub rsp, 0x460
mov rax, qword [0x1401f7280]
xor rax, rsp
mov qword [rsp + 0x450], rax
mov rdi, rcx
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400c2fe2
test rax, rax
je 0x1400c3170
mov rcx, qword [0x1401fbb60]
mov qword [rsp + 0x478], rbx
xor r9d, r9d
xor r8d, r8d
mov edx, 0x146
mov qword [rsp + 0x480], rbp
mov qword [rsp + 0x488], rsi
call qword [sym.imp.USER32.dll_SendMessageW]
xor ebx, ebx
mov rbp, rax
test eax, eax
jle 0x1400c309e
nop
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0x410
call fcn.1400f9ab0
mov rcx, qword [0x1401fbb60]
movsxd rsi, ebx
mov r8, rsi
xor r9d, r9d
mov edx, 0x149
call qword [sym.imp.USER32.dll_SendMessageW]
movsxd rcx, eax
cmp rcx, 0x208
jae 0x1400c3083
mov rcx, qword [0x1401fbb60]
lea r9, [rsp + 0x40]
mov r8, rsi
mov edx, 0x148
call qword [sym.imp.USER32.dll_SendMessageW]
lea rcx, [rsp + 0x40]
mov rdx, rdi
call fcn.1400f92fc
test eax, eax
je 0x1400c3189
inc ebx
cmp ebx, ebp
jl 0x1400c3030
mov rcx, qword [0x1401fbb60]
mov r9, rdi
xor r8d, r8d
mov edx, 0x14a
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [0x1401fbab8]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1004
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [0x1401fbb60]
xor r8d, r8d
movsxd r9, eax
mov edx, 0x151
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [0x1401fbb60]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x14e
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [0x1401fbab8]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1004
call qword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
jle 0x1400c3140
lea rax, [rsp + 0x30]
lea r8, [0x1400c7910]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor r8d, r8d
mov rcx, qword [0x1401fbb60]
xor r9d, r9d
mov edx, 0x14e
call qword [sym.imp.USER32.dll_SendMessageW]
mov rbp, qword [rsp + 0x480]
mov rbx, qword [rsp + 0x478]
mov rsi, qword [rsp + 0x488]
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.1400f9a80
add rsp, 0x460
pop rdi
ret
mov rcx, qword [0x1401fbb60]
movsxd rbx, ebx
xor r9d, r9d
mov r8, rbx
mov edx, 0x150
call qword [sym.imp.USER32.dll_SendMessageW]
test rax, rax
jne 0x1400c321b
mov rcx, qword [0x1401fbab8]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1004
call qword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
jle 0x1400c321b
mov rcx, qword [0x1401fbab8]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1004
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [0x1401fbb60]
mov r8, rbx
movsxd r9, eax
mov edx, 0x151
call qword [sym.imp.USER32.dll_SendMessageW]
lea rax, [rsp + 0x30]
lea r8, [0x1400c7910]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov r8, rbx
jmp 0x1400c3143
Function at 0x1400c5080
Capabilities:
Delete file
Set current directory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0xdb0]
sub rsp, 0xeb0
mov rax, qword [0x1401f7280]
xor rax, rsp
mov qword [rbp + 0xda0], rax
mov rsi, rcx
mov rdi, r8
mov rbx, rdx
lea rcx, [rsp + 0x60]
xor edx, edx
mov r8d, 0x410
call fcn.1400f9ab0
xor r14d, r14d
cmp dword [rdi], 1
lea rcx, [rsp + 0x60]
jne 0x1400c50f6
sub rcx, rbx
nop dword [rax]
movzx eax, word [rbx]
lea rbx, [rbx + 2]
mov word [rcx + rbx - 2], ax
test ax, ax
jne 0x1400c50e0
mov dword [rdi], r14d
jmp 0x1400c5103
xor r8d, r8d
mov edx, 0x104
call fcn.1400d0ab0
lea rax, [rsp + 0x60]
or rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp word [rax + rbx*2], r14w
jne 0x1400c5110
test ebx, ebx
jle 0x1400c52f4
cmp ebx, 2
jl 0x1400c516f
lea rcx, [rbp + 0x370]
mov edx, 0x104
mov r8d, 1
call fcn.1400d0ab0
movsxd rax, ebx
cmp word [rsp + rax*2 + 0x5c], 0x3a
jne 0x1400c5155
cmp word [rsp + rax*2 + 0x5e], 0x5c
je 0x1400c52f4
lea rcx, [rbp + 0x370]
mov edx, 0x3c
call fcn.1400f9cdc
test rax, rax
jne 0x1400c52f4
lea rbx, [0x140208ca0]
lea rdx, [rsp + 0x60]
mov rcx, rbx
call fcn.1400f92fc
test eax, eax
jne 0x1400c51ab
lea rdx, [rbp + 0x580]
lea rcx, [rsp + 0x60]
mov r8d, 0x208
call fcn.1400d0930
lea rcx, [rbp + 0x580]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
xor eax, eax
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
call fcn.1400ed890
lea rax, [rsp + 0x60]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x30], rax
mov eax, 0x40
mov qword [rsp + 0x38], r14
mov word [rsp + 0x40], ax
mov dword [rsp + 0x44], r14d
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
jne 0x1400c52eb
cmp dword [rsp + 0x44], 1
je 0x1400c52eb
lea rcx, [rsp + 0x60]
call fcn.1400e47e0
lea rdx, [rbp + 0x990]
lea rcx, [rsp + 0x60]
mov r8d, 0x208
call fcn.1400d0b20
lea rdx, [rsp + 0x60]
mov rcx, rbx
call fcn.1400f92fc
test eax, eax
jne 0x1400c52da
mov rcx, qword [0x1401fbae0]
test rcx, rcx
je 0x1400c527f
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, qword [0x1401fbae0]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov qword [0x1401fbae0], r14
mov rcx, r14
movzx eax, word [rbp + rcx + 0x990]
lea rcx, [rcx + 2]
mov word [rcx + rbx - 2], ax
test ax, ax
jne 0x1400c5282
mov edx, 1
xor ecx, ecx
mov word [0x140209940], r14w
mov dword [0x1401fbc74], r14d
call fcn.14005b3c0
mov rcx, qword [0x1401fbab8]
call fcn.1400c0ed0
mov rcx, qword [0x1401fbb00]
xor r9d, r9d
mov edx, 0x111
mov r8d, 0x46e
call qword [sym.imp.USER32.dll_SendMessageW]
mov ecx, 4
call fcn.1400d8990
mov eax, 1
jmp 0x1400c52f6
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
xor eax, eax
mov rcx, qword [rbp + 0xda0]
xor rcx, rsp
call fcn.1400f9a80
lea r11, [rsp + 0xeb0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x1400c65f0
Capabilities:
Read .ini file

Disassembly:
sub rsp, 0x88
mov rax, qword [0x1401f7280]
xor rax, rsp
mov qword [rsp + 0x70], rax
lea rax, [0x140208860]
cmp ecx, 1
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea r8, str.12632256
lea rcx, [0x140185d88]
mov dword [rsp + 0x20], 0x20
lea rdx, str.BackColor
je 0x1400c6640
lea rdx, str.BackgroundColor
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea rcx, [rsp + 0x30]
call fcn.1400fa308
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1400f9a80
add rsp, 0x88
ret

Function at 0x1400c6670
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x670
mov rax, qword [0x1401f7280]
xor rax, rsp
mov qword [rsp + 0x660], rax
mov rcx, qword [0x1401fbb60]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x14b
call qword [sym.imp.USER32.dll_SendMessageW]
lea r14, [0x140208860]
lea rdx, str.MRUDs
lea rcx, [0x140185d88]
mov r9, r14
mov r8d, 0x1e
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
xor esi, esi
mov ebp, eax
test eax, eax
js 0x1400c67f6
mov qword [rsp + 0x680], rbx
mov qword [rsp + 0x688], rdi
nop dword [rax]
inc esi
lea rdx, str.MRUD_d
lea rcx, [rsp + 0x240]
mov r8d, esi
call fcn.1400f98c8
lea r9, [rsp + 0x30]
lea r8, [0x140181e34]
lea rdx, [rsp + 0x240]
lea rcx, [0x140185d88]
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], 0x104
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [rsp + 0x30], 0
je 0x1400c67de
mov rcx, qword [0x1401fbb60]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x146
call qword [sym.imp.USER32.dll_SendMessageW]
xor ebx, ebx
mov rdi, rax
test eax, eax
jle 0x1400c67a9
nop dword [rax]
nop dword [rax + rax]
mov rcx, qword [0x1401fbb60]
lea r9, [rsp + 0x450]
movsxd r8, ebx
mov edx, 0x148
call qword [sym.imp.USER32.dll_SendMessageW]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x450]
call fcn.1400f92fc
test eax, eax
je 0x1400c67de
inc ebx
cmp ebx, edi
jl 0x1400c6770
mov rcx, qword [0x1401fbb60]
lea r9, [rsp + 0x30]
xor r8d, r8d
mov edx, 0x14a
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [0x1401fbb60]
mov r9d, 0xa
xor r8d, r8d
mov edx, 0x151
call qword [sym.imp.USER32.dll_SendMessageW]
cmp esi, ebp
jle 0x1400c66f0
mov rdi, qword [rsp + 0x688]
mov rbx, qword [rsp + 0x680]
mov rcx, qword [rsp + 0x660]
xor rcx, rsp
call fcn.1400f9a80
lea r11, [rsp + 0x670]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x1400c6820
Capabilities:
Read .ini file

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x88
mov rax, qword [0x1401f7280]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rbx, qword [rsp + 0xf0]
mov rsi, qword [rsp + 0xf8]
mov r15, qword [rsp + 0x100]
mov rbp, qword [rsp + 0x108]
mov r12, qword [rsp + 0x110]
mov rdi, r9
mov r14, r8
call fcn.1400c69a0
lea r13, [0x140208860]
lea rdx, str.ResampleFilter
lea rcx, str.Resize
mov r8d, 5
mov r9, r13
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
lea rdx, str.UseResample
lea rcx, [0x140185d88]
mov r9, r13
mov r8d, 1
mov dword [rbx], eax
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
lea rdx, str.Enlarge
lea rcx, [0x140185d88]
mov r9, r13
xor r8d, r8d
mov dword [rdi], eax
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
lea rdx, str.PaintBorders
lea rcx, [0x140185d88]
mov r9, r13
xor r8d, r8d
mov dword [r14], eax
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
lea rdx, str.Scroll
lea rcx, [0x140185d88]
mov r9, r13
xor r8d, r8d
mov dword [rsi], eax
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
lea r9, [rsp + 0x30]
lea r8, str.12632256
lea rdx, str.BackColor
lea rcx, [0x140185d88]
mov qword [rsp + 0x28], r13
mov dword [r15], eax
mov dword [rsp + 0x20], 0x20
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea rcx, [rsp + 0x30]
call fcn.1400fa308
mov dword [rbp], eax
test r12, r12
je 0x1400c6971
lea rdx, str.ExifThumb
lea rcx, [0x140185d88]
mov r9, r13
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [r12], eax
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1400f9a80
add rsp, 0x88
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x1400c69a0
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0xc0
mov rax, qword [0x1401f7280]
xor rax, rsp
mov qword [rsp + 0xb0], rax
lea rax, [0x140208860]
mov rdi, rdx
mov rbx, rcx
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
lea r8, str.100_100
lea rdx, str.ThumbW
lea rcx, [0x140185d88]
mov dword [rsp + 0x20], 0x40
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea rdx, [0x14018ea20]
lea rcx, [rsp + 0x30]
mov r9, rdi
mov r8, rbx
call fcn.1400fb8b4
lea rcx, [rsp + 0x30]
mov edx, 0x2c
call fcn.1400f9cdc
test rax, rax
jne 0x1400c6a28
mov eax, dword [rbx]
mov dword [rdi], eax
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.1400f9a80
mov rbx, qword [rsp + 0xe0]
add rsp, 0xc0
pop rdi
ret