joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140041230
Capabilities:
Create thread
Terminate thread

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x60
mov rdx, qword [0x1401128c8]
lea rax, [0x140154ce8]
mov qword [rsp + 0x38], rax
xor esi, esi
mov dword [rsp + 0x30], ecx
lea rax, str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
mov qword [rsp + 0x40], rax
lea rax, str.NoDriveTypeAutorun
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0xa0]
mov dword [rsp + 0x50], eax
mov dword [rsp + 0xa0], esi
test rdx, rdx
je 0x1400412b5
lea r8d, [rsi + 1]
mov edi, esi
lea rcx, str.DisableLGP
call fcn.140020e30
mov rbx, rax
test rax, rax
je 0x1400412b1
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.1400a3cac
mov rcx, rbx
mov edi, eax
call fcn.14009b5a0
test edi, edi
jmp 0x1400412d7
lea r9, [rsp + 0x80]
mov rcx, 0xffffffff80000001
lea rdx, str.DisableLGP
call fcn.14003e990
cmp dword [rsp + 0x80], esi
mov ecx, esi
mov qword [rsp + 0x88], rbp
setne cl
mov qword [rsp + 0x90], r14
test ecx, ecx
je 0x140041362
mov rax, qword [0x140142a80]
lea rsi, [0x140158be0]
mov r14d, 0xffc
lea r9, str.LPG_handling_disabled__per_settings
sub r14, rax
mov rbx, 0xffffffffffffffff
mov r8, rbx
mov rdx, r14
lea rdi, [rax + rsi]
mov rcx, rdi
call fcn.1400034e0
mov byte [rdi + r14 - 1], 0
nop dword [rax]
inc rbx
cmp byte [rsi + rbx], 0
jne 0x140041330
mov word [rbx + rsi], 0xa0d
add rbx, 2
mov qword [0x140142a80], rbx
cmp rbx, 0x1000
jae 0x14004149c
mov byte [rbx + rsi], 0
xor eax, eax
jmp 0x140041484
mov qword [rsp + 0x28], rsi
lea r9, [rsp + 0x30]
lea r8, [0x140040bb0]
mov dword [rsp + 0x20], esi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbp, rax
test rax, rax
jne 0x1400413d3
mov rax, qword [0x140142a80]
lea rsi, [0x140158be0]
mov r14d, 0xffc
lea r9, str.SetLGP:_Unable_to_start_thread
sub r14, rax
mov rbx, 0xffffffffffffffff
mov r8, rbx
mov rdx, r14
lea rdi, [rax + rsi]
mov rcx, rdi
call fcn.1400034e0
mov byte [rdi + r14 - 1], bpl
inc rbx
cmp byte [rsi + rbx], 0
jne 0x1400413c5
jmp 0x140041339
mov edx, 0x1388
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x140041465
mov rax, qword [0x140142a80]
lea rsi, [0x140158be0]
mov r14d, 0xffc
lea r9, str.SetLGP:_Killing_stuck_thread_
sub r14, rax
mov rbx, 0xffffffffffffffff
mov r8, rbx
mov rdx, r14
lea rdi, [rax + rsi]
mov rcx, rdi
call fcn.1400034e0
mov byte [rdi + r14 - 1], 0
inc rbx
cmp byte [rsi + rbx], 0
jne 0x140041426
mov word [rbx + rsi], 0xa0d
add rbx, 2
mov qword [0x140142a80], rbx
cmp rbx, 0x1000
jae 0x14004149c
xor edx, edx
mov byte [rbx + rsi], 0
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x140041484
lea rdx, [rsp + 0xa0]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov ecx, dword [rsp + 0xa0]
test eax, eax
cmove ecx, esi
mov eax, ecx
mov r14, qword [rsp + 0x90]
mov rbp, qword [rsp + 0x88]
add rsp, 0x60
pop rdi
pop rsi
pop rbx
ret
call fcn.140092188
int3
Function at 0x140041aa0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov rbx, rcx
lea rdi, [rsp + 0x78]
call fcn.140001000
mov qword [rsp + 0x30], rdi
lea rbp, [0x140155430]
xor esi, esi
mov r14, 0xffffffffffffffff
mov qword [rsp + 0x28], rsi
mov r9, r14
mov rcx, qword [rax]
mov rdx, rbp
mov qword [rsp + 0x20], rbx
mov ebx, 0xffd
mov r8d, ebx
call fcn.14009b444
test eax, eax
cmovs eax, r14d
test eax, eax
js 0x140041b0d
movsxd rbx, eax
add rbx, rbp
cmp rbx, rbp
jbe 0x140041b3c
nop word [rax + rax]
movzx ecx, byte [rbx - 1]
lea rdi, [rbx - 1]
call fcn.1400a1d30
test eax, eax
je 0x140041b3c
mov byte [rdi], sil
mov rbx, rdi
cmp rdi, rbp
ja 0x140041b20
mov word [rbx], 0xa0d
mov byte [rbx + 2], sil
cmp byte [0x140155430], sil
jne 0x140041b60
mov edx, 2
lea ecx, [rdx - 1]
call fcn.1400966e0
mov rsi, rax
jmp 0x140041bc6
mov dword [rsp + 0x28], esi
mov r9d, r14d
mov r8, rbp
mov qword [rsp + 0x20], rsi
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rdi, eax
cmp edi, 1
jle 0x140041bc6
mov rcx, rdi
mov edx, 2
call fcn.1400966e0
mov rbx, rax
test rax, rax
je 0x140041bc6
mov dword [rsp + 0x28], edi
mov r9d, r14d
mov r8, rbp
mov qword [rsp + 0x20], rax
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, edi
je 0x140041bc3
mov rcx, rbx
call fcn.14009b5a0
jmp 0x140041bc6
mov rsi, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [0x140111ab0]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140041c3c
mov r9d, 0x7ffffffe
mov edx, 0xb1
mov r8d, r9d
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [0x140111ab0]
mov r9, rsi
xor r8d, r8d
mov edx, 0xc2
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [0x140111ab0]
xor r9d, r9d
xor r8d, r8d
mov edx, 0xba
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [0x140111ab0]
xor r8d, r8d
movsxd r9, eax
mov edx, 0xb6
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, rsi
call fcn.14009b5a0
add rsp, 0x40
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140041c50
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov r14, rdx
mov qword [rsp + 0x50], 0
mov rbp, rcx
call fcn.140003550
lea rcx, [0x1400e30d4]
mov rdi, rax
call fcn.140003550
mov r8, rax
lea rcx, [rsp + 0x50]
mov rdx, rdi
mov rbx, rax
call fcn.14009b840
test rdi, rdi
je 0x140041ca5
mov rcx, rdi
call fcn.14009b5a0
test rbx, rbx
je 0x140041cb2
mov rcx, rbx
call fcn.14009b5a0
mov rsi, qword [rsp + 0x50]
test rsi, rsi
jne 0x140041cd2
mov rdx, rbp
lea rcx, str.Error:_Cant_open_file__s
call fcn.140041aa0
xor eax, eax
jmp 0x140041d71
xor edx, edx
mov rcx, rsi
lea r8d, [rdx + 2]
call fcn.1400a5ff0
mov rcx, rsi
call fcn.1400a4a38
xor r8d, r8d
mov edi, eax
xor edx, edx
mov rcx, rsi
call fcn.1400a5ff0
lea ecx, [rdi + 1]
call fcn.14009b5b4
mov qword [r14], rax
test rax, rax
jne 0x140041d24
mov r8, rbp
lea rcx, str.Error:_Cant_allocate__d_bytes_buffer_for_file__s
mov edx, edi
call fcn.140041aa0
mov rcx, rsi
xor edi, edi
call fcn.14009b928
jmp 0x140041d60
mov r9, rsi
mov r8, rdi
mov edx, 1
mov rcx, rax
call fcn.1400a6f3c
cmp rax, rdi
je 0x140041d4d
mov rdx, rbp
lea rcx, str.Error:_Cant_read__s
call fcn.140041aa0
xor edi, edi
mov rdx, qword [r14]
mov byte [rdi + rdx], 0
mov rcx, rsi
call fcn.14009b928
test edi, edi
jne 0x140041d6f
mov rcx, qword [r14]
call fcn.14009b5a0
mov qword [r14], 0
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret

Function at 0x140042a20
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x60
call fcn.140003550
mov rdi, rax
mov qword [rsp + 0x30], rax
xor eax, eax
mov dword [rsp + 0x38], 0x80000000
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
lea r8, [0x1400429b0]
mov dword [rsp + 0x20], eax
xor edx, edx
mov dword [rsp + 0x3c], 3
xor ecx, ecx
mov dword [rsp + 0x40], 3
mov dword [rsp + 0x44], 0x80
mov qword [rsp + 0x48], 0xffffffffffffffff
mov dword [rsp + 0x50], 0x3e5
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
test rax, rax
je 0x140042ad0
mov edx, 0xbb8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x140042ac5
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CancelSynchronousIo]
mov edx, 0xffffffff
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x50], 0x102
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140042ada
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x50], eax
test rdi, rdi
je 0x140042ae7
mov rcx, rdi
call fcn.14009b5a0
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
Function at 0x140042b10
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
xor r12d, r12d
lea r14, [rax + 0x28]
test r9, r9
mov qword [rsp + 0x88], r12
mov esi, r8d
mov r15, rdx
cmovne r14, r9
lea r8, [rax - 0x38]
lea r9d, [r12 + 1]
mov edx, r12d
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
movsxd rdi, eax
test eax, eax
jne 0x140042b73
call fcn.140041e50
mov rdx, rax
lea rcx, str.Warning:_Could_not_read_file_pointer__s
call fcn.140041aa0
mov ebx, 1
cmp ebx, 1
jbe 0x140042b99
mov rdx, qword [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x140042c6d
mov r9, r14
mov qword [rsp + 0x20], r12
mov r8d, esi
mov rdx, r15
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140042be8
mov edx, dword [r14]
mov dword [0x140111624], r12d
cmp esi, edx
je 0x140042c87
cmp dword [0x1401128ec], r12d
je 0x140042bd7
test edx, edx
je 0x140042c7b
mov r8d, esi
lea rcx, str.Wrote__d_bytes_but_requested__d
call fcn.140041aa0
jmp 0x140042c0d
call fcn.140041e50
mov rdx, rax
lea rcx, str.Write_error__s
call fcn.140041aa0
call qword [sym.imp.KERNEL32.dll_GetLastError]
or eax, 0xc0030000
mov dword [0x140111624], eax
test rdi, rdi
je 0x140042c3e
cmp ebx, 4
jae 0x140042c33
mov edx, 5
lea rcx, str.Retrying_in__d_seconds...
call fcn.140041aa0
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
cmp ebx, 4
jbe 0x140042b78
call qword [sym.imp.KERNEL32.dll_GetLastError]
test ax, ax
jne 0x140042c54
mov ecx, 0xc003001d
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
lea rcx, str.Could_not_set_file_pointer___Aborting
call fcn.140041aa0
jmp 0x140042c3e
lea rcx, str.Warning:_Possible_short_write
call fcn.140041aa0
mov eax, 1
jmp 0x140042c56
Function at 0x140043330
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x40
xor ebx, ebx
mov rdi, rdx
mov r14, rcx
lea ebp, [rbx + 0x57]
test rdx, rdx
je 0x1400433e5
mov byte [rdx], bl
lea ecx, [rbp + 0x29]
lea edx, [rbx + 2]
mov qword [rsp + 0x50], rsi
call fcn.1400966e0
lea r8d, [rbp + 0x29]
mov rdx, rax
mov rcx, r14
mov rsi, rax
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
test ebx, ebx
je 0x1400433cf
mov qword [rsp + 0x38], 0
mov r9d, 0xffffffff
mov qword [rsp + 0x30], 0
mov r8, rsi
mov dword [rsp + 0x28], 0x80
xor edx, edx
mov ecx, 0xfde9
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ebx, eax
test eax, eax
jne 0x1400433cf
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
test rsi, rsi
je 0x1400433dc
mov rcx, rsi
call fcn.14009b5a0
mov rsi, qword [rsp + 0x50]
mov byte [rdi + 0x7f], 0
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rbp, qword [rsp + 0x60]
mov eax, ebx
mov rbx, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x140047780
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
lea r9, [rsp + 0x40]
mov dword [rsp + 0x20], 4
mov r8d, 4
lea rdx, str.SoftwareMicrosoftPowerShell1Install
mov rcx, 0xffffffff80000002
call fcn.140027c60
cmp dword [rsp + 0x40], 0
jg 0x140047860
lea r9, [rsp + 0x40]
mov dword [rsp + 0x20], 4
mov r8d, 4
lea rdx, str.SoftwareMicrosoftPowerShell3Install
mov rcx, 0xffffffff80000002
call fcn.140027c60
cmp dword [rsp + 0x40], 0
jg 0x140047860
mov rax, qword [0x140142a80]
lea rsi, [0x140158be0]
mov ebp, 0xffc
lea r9, str.Notice:_The_ISO_download_feature_has_been_deactivated_because_a_compatible_PowerShell_version_was_not_detected_on_this_system.
sub rbp, rax
mov rbx, 0xffffffffffffffff
mov r8, rbx
mov rdx, rbp
lea rdi, [rax + rsi]
mov rcx, rdi
call fcn.1400034e0
mov byte [rdi + rbp - 1], 0
nop dword [rax]
inc rbx
cmp byte [rsi + rbx], 0
jne 0x140047830
mov word [rbx + rsi], 0xa0d
add rbx, 2
mov qword [0x140142a80], rbx
cmp rbx, 0x1000
jae 0x1400478f2
mov byte [rbx + rsi], 0
jmp 0x1400478dd
cmp dword [0x1401128c0], 0
jne 0x1400478be
call fcn.140043410
test eax, eax
jg 0x1400478be
mov rax, qword [0x140142a80]
lea rsi, [0x140158be0]
mov ebp, 0xffc
lea r9, str.Notice:_The_ISO_download_feature_has_been_deactivated_because_Check_for_updates_is_disabled_in_your_settings.
sub rbp, rax
mov rbx, 0xffffffffffffffff
mov r8, rbx
mov rdx, rbp
lea rdi, [rax + rsi]
mov rcx, rdi
call fcn.1400034e0
mov byte [rdi + rbp - 1], 0
nop dword [rax]
inc rbx
cmp byte [rsi + rbx], 0
jne 0x1400478b0
jmp 0x140047839
xor eax, eax
lea r8, [0x140047620]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
call fcn.140092188
int3
Function at 0x140048690
Capabilities:
Get graphical window text

Disassembly:
push rbp
push rdi
sub rsp, 0x28
mov qword [rsp + 0x40], rbx
mov rbp, rcx
mov qword [rsp + 0x48], rsi
xor ebx, ebx
mov qword [rsp + 0x50], rbx
mov rsi, rdx
mov qword [rsp + 0x20], r14
call qword [sym.imp.USER32.dll_GetDC]
mov rdi, rax
test rax, rax
je 0x14004876c
xor r9d, r9d
lea edx, [rbx + 0x31]
xor r8d, r8d
mov rcx, rbp
call qword [sym.imp.USER32.dll_SendMessageA]
test rax, rax
je 0x14004876c
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.GDI32.dll_SelectObject]
test rsi, rsi
jne 0x140048732
mov rcx, rbp
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov esi, eax
test eax, eax
jle 0x14004876c
lea r14d, [rax + 1]
movsxd rcx, r14d
lea edx, [rbx + 2]
call fcn.1400966e0
mov rbx, rax
test rax, rax
je 0x14004876c
mov r8d, r14d
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
jle 0x14004876c
mov r8d, esi
mov rdx, rbx
jmp 0x14004875e
mov rcx, rsi
call fcn.140003550
mov rbx, rax
test rax, rax
je 0x14004876c
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140048750
mov rdx, rax
lea r9, [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.GDI32.dll_GetTextExtentPoint32W]
mov rcx, rbx
call fcn.14009b5a0
mov r14, qword [rsp + 0x20]
lea rax, [rdi - 1]
mov rsi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
cmp rax, 0xfffffffffffffffd
ja 0x140048799
mov rdx, rdi
mov rcx, rbp
call qword [sym.imp.USER32.dll_ReleaseDC]
mov rax, qword [rsp + 0x50]
add rsp, 0x28
pop rdi
pop rbp
ret
Function at 0x140048e30
Capabilities:
Identify system language via api

Disassembly:
push rbx
push rdi
push r12
sub rsp, 0x160
mov rax, qword [0x140106438]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov qword [rsp + 0x180], rbp
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx ecx, ax
call fcn.140041790
mov qword [rsp + 0x28], rax
lea r9, str._s_s_shell32.dll.mui
lea rax, [0x14015a0e0]
mov edx, 0x104
mov r8, 0xffffffffffffffff
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x40]
call fcn.1400034e0
lea rcx, [rsp + 0x40]
mov byte [rsp + 0x143], 0
call fcn.140003550
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test rbx, rbx
je 0x140048ec8
mov rcx, rbx
call fcn.14009b5a0
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor ebx, ebx
lea r12, [0x140156530]
mov edi, 0x80
test rbp, rbp
je 0x14004903a
mov qword [rsp + 0x188], rsi
mov r8, r12
mov qword [rsp + 0x190], r14
mov edx, 0x101d
mov rcx, rbp
mov qword [rsp + 0x198], r15
call fcn.140043260
test eax, eax
jg 0x140048f4e
movups xmm0, xmmword [str.Microsoft_Windows]
movzx eax, word [0x1400f0400]
mov word [0x140156540], ax
movaps xmmword [0x140156530], xmm0
mov byte [0x140156541], bl
call fcn.140041e50
mov r8, rax
lea rdx, [rsp + 0x40]
lea rcx, str.Warning:_Could_not_locate_localized_format_prompt_title_string_in__s:__s
call fcn.140041aa0
mov edx, 2
mov rcx, rdi
call fcn.1400966e0
mov r9d, edi
mov r8, rax
mov edx, 0x101e
mov rcx, rbp
mov rsi, rax
call qword [sym.imp.USER32.dll_LoadStringW]
mov r14d, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r15d, eax
test r14d, r14d
jle 0x140048fc3
mov qword [rsp + 0x38], rbx
lea rax, [0x140156470]
mov qword [rsp + 0x30], rbx
mov r9d, 0xffffffff
mov dword [rsp + 0x28], edi
mov r8, rsi
xor edx, edx
mov qword [rsp + 0x20], rax
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov r14d, eax
test eax, eax
jne 0x140048fc3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r15d, eax
test rsi, rsi
je 0x140048fd0
mov rcx, rsi
call fcn.14009b5a0
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r15, qword [rsp + 0x198]
test r14d, r14d
mov r14, qword [rsp + 0x190]
mov rsi, qword [rsp + 0x188]
jg 0x140049031
movsd xmm0, qword [str.Format_disk]
mov eax, dword [0x1400f0468]
mov dword [0x140156478], eax
movsd qword [0x140156470], xmm0
mov byte [0x14015647b], bl
call fcn.140041e50
mov r8, rax
lea rdx, [rsp + 0x40]
lea rcx, str.Warning:_Could_not_locate_localized_format_prompt_button_string_in__s:__s
call fcn.140041aa0
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, 0xc4d
call fcn.14001b320
mov rbp, qword [rsp + 0x180]
test rax, rax
je 0x14004906b
mov ecx, 0xc4d
call fcn.14001b320
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], 0
jne 0x140049062
mov ecx, 0xc4d
inc rbx
call fcn.14001b320
cmp rbx, rdi
lea rcx, [0x1401565b0]
mov rdx, rax
cmovb rdi, rbx
mov r8, rdi
call fcn.140093550
mov byte [rdi + r12 + 0x7f], 0
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.140092060
add rsp, 0x160
pop r12
pop rdi
pop rbx
ret
Function at 0x140053540
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
xor ebp, ebp
mov rdi, rcx
mov ebx, ebp
mov r15d, ebp
mov byte [0x14015b42c], bl
test rcx, rcx
je 0x1400535b1
mov rax, 0xffffffffffffffff
mov rcx, rax
nop dword [rax + rax]
inc rcx
cmp byte [rdi + rcx], bl
jne 0x140053580
cmp rcx, 4
jbe 0x1400535b1
nop
inc rax
cmp byte [rdi + rax], bl
jne 0x140053590
lea rbx, [rdi - 1]
add rbx, rax
cmp byte [rbx], 0x2e
je 0x1400535b1
cmp rbx, rdi
je 0x1400535b1
dec rbx
cmp byte [rbx], 0x2e
jne 0x1400535a4
test rbx, rbx
lea r12, str._NULL_
lea r13, str..zip
mov esi, ebp
cmove rbx, r12
mov r14, r13
nop dword [rax + rax]
mov rax, qword [r14]
mov rdx, r12
test rax, rax
mov rcx, rbx
cmovne rdx, rax
call fcn.1400a5b5c
test eax, eax
je 0x1400535fb
inc esi
add r14, 0x10
cmp esi, 0xa
jb 0x1400535d0
xor al, al
jmp 0x1400537c7
movsxd r14, esi
mov ecx, 0x200
add r14, r14
movzx eax, byte [r13 + r14*8 + 8]
mov byte [0x14015b42c], al
call fcn.14009b5b4
mov rbx, rax
test rax, rax
je 0x140053795
cmp byte [0x14015b42c], 9
mov esi, 1
mov dword [0x140111620], ebp
jae 0x140053685
lea rax, [0x140111620]
xor r9d, r9d
mov qword [rsp + 0x30], rax
lea rdx, [fcn.140041aa0]
mov qword [rsp + 0x28], rbp
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], rbp
call fcn.14006db00
movzx r9d, byte [r13 + r14*8 + 8]
mov r8d, 0x200
mov rdx, rbx
mov rcx, rdi
call fcn.14006dcd0
mov r15, rax
call fcn.14006dab0
jmp 0x140053784
jne 0x14005373a
cmp dword [0x140112904], ebp
je 0x14005371f
mov rcx, rdi
call fcn.1400534d0
mov r14, rax
test rax, rax
je 0x1400536f9
mov r9, rax
mov byte [0x14015b40e], sil
mov r8d, 0x200
mov rdx, rsi
mov rcx, rbx
call fcn.1400a6f3c
mov rcx, r14
mov r15, rax
call fcn.14009b928
lea rcx, [rbx + 4]
mov r8d, 0xc
lea rdx, str.SignedImage
call fcn.1400a1ff0
test eax, eax
jne 0x140053784
mov word [rbx + 0x1fe], 0xaa55
jmp 0x140053784
call fcn.1400a7b18
mov rdx, rdi
lea rcx, str.Could_not_open__s:__d
mov r8d, dword [rax]
call fcn.140041aa0
mov rcx, rbx
call fcn.14009b5a0
xor al, al
jmp 0x1400537c7
lea rcx, str.__An_FFU_image_was_selected__but_this_system_does_not_have_FFU_support_
call fcn.140041aa0
mov rcx, rbx
call fcn.14009b5a0
xor al, al
jmp 0x1400537c7
xor edx, edx
mov rcx, rdi
call fcn.140055fb0
test rax, rax
je 0x14005377f
mov rcx, rax
mov byte [0x14015b40e], sil
call fcn.1400534d0
mov rdi, rax
test rax, rax
je 0x14005377f
mov r9, rax
mov r8d, 0x200
mov rdx, rsi
mov rcx, rbx
call fcn.1400a6f3c
mov rcx, rdi
mov r15, rax
call fcn.14009b928
call fcn.140056400
cmp r15, 0x200
je 0x140053799
mov rcx, rbx
call fcn.14009b5a0
xor al, al
jmp 0x1400537c7
cmp byte [rbx + 0x1fe], 0x55
jne 0x1400537ab
cmp byte [rbx + 0x1ff], 0xaa
je 0x1400537bb
cmp dword [0x140111a98], ebp
mov eax, 2
cmovne ebp, eax
mov esi, ebp
mov rcx, rbx
call fcn.14009b5a0
movzx eax, sil
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1400537f0
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov rdi, qword [0x1401128d8]
lea rcx, str.Disk_image_analysis:
xor ebx, ebx
mov qword [rsp + 0x88], rbx
call fcn.140041aa0
mov rcx, rdi
call fcn.140003550
mov qword [rsp + 0x30], rbx
lea r8d, [rbx + 1]
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
mov rcx, rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r14d, eax
test rsi, rsi
je 0x14005386a
mov rcx, rsi
call fcn.14009b5a0
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_SetLastError]
cmp rbp, 0xffffffffffffffff
jne 0x140053897
mov rdx, rdi
lea rcx, str.__Could_not_open_image__s
call fcn.140041aa0
movzx eax, bpl
add rsp, 0x50
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov rcx, rdi
call fcn.140053540
test al, al
setne dil
cmp byte [0x14015b42c], bl
jne 0x140053964
mov ecx, dword [0x14015b550]
mov edx, 0x200
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], rbp
lea eax, [rcx - 0x200]
cmp eax, 0xfe00
cmova ecx, edx
mov dword [0x140109f38], ecx
lea rcx, [rsp + 0x40]
call fcn.140064040
test eax, eax
jne 0x14005390c
lea rdx, str.__Image
lea rcx, str._s_does_not_have_a_Boot_Marker
call fcn.140041aa0
mov eax, dword [0x140111a98]
neg eax
sbb dil, dil
and dil, 2
jmp 0x140053964
lea r14, [0x1400d1550]
mov edi, ebx
mov rsi, r14
lea rcx, [rsp + 0x40]
call qword [rsi]
test eax, eax
jne 0x140053943
inc edi
add rsi, 0x10
cmp edi, 0xd
jb 0x140053918
lea rdx, str.__Image
lea rcx, str._s_has_an_unknown_Master_Boot_Record
call fcn.140041aa0
jmp 0x140053961
movsxd r8, edi
lea rdx, str.__Image
add r8, r8
lea rcx, str._s_has_a__s_Master_Boot_Record
mov r8, qword [r14 + r8*8 + 8]
call fcn.140041aa0
mov dil, 1
lea rdx, [rsp + 0x90]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x140053992
call fcn.140041e50
mov rdx, rax
lea rcx, str.__Could_not_get_image_size:__s
call fcn.140041aa0
mov dil, 0xfe
jmp 0x140053a09
mov rax, qword [rsp + 0x90]
xor r9d, r9d
xor r8d, r8d
mov qword [0x14015b3f0], rax
mov rdx, rbx
mov dword [rsp + 0x80], 8
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov r8d, dword [rsp + 0x80]
lea r9, [rsp + 0x80]
lea rdx, [rsp + 0x88]
mov qword [rsp + 0x20], rbx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140053a03
movabs rax, 0x4d4957534d
mov byte [0x14015b40f], 1
cmp qword [rsp + 0x88], rax
je 0x140053a09
mov byte [0x14015b40f], bl
test rbp, rbp
je 0x140053a17
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, dil
add rsp, 0x50
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret