joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140098410
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], rbp
push rsi
push rdi
push r12
push r13
push r15
sub rsp, 0xe0
mov dword [rsp + 0x70], 0x68
mov rbp, rcx
xor ecx, ecx
xorps xmm0, xmm0
mov qword [rsp + 0x78], rcx
movzx r13d, r9b
movdqa xmmword [rax - 0x88], xmm0
mov r15, rdx
mov dword [rax - 0x5c], ecx
test r8b, r8b
je 0x140098466
mov dword [rax - 0x5c], 1
mov eax, 7
mov word [rsp + 0xb0], ax
mov word [rsp + 0xb2], cx
mov r8, 0xffffffffffffffff
mov qword [rsp + 0xb8], rcx
test rbp, rbp
je 0x140098491
mov rdi, r8
inc rdi
cmp word [rbp + rdi*2], cx
jne 0x140098485
jmp 0x140098493
mov edi, ecx
test r15, r15
je 0x1400984ab
mov rsi, r8
nop dword [rax + rax]
inc rsi
cmp word [rdx + rsi*2], cx
jne 0x1400984a0
jmp 0x1400984ad
mov esi, ecx
lea eax, [rsi + rdi]
movsxd rcx, eax
mov eax, 2
add rcx, 4
mul rcx
cmovo rax, r8
mov rcx, rax
call fcn.1400b609c
mov r12, rax
test rax, rax
je 0x140098654
mov qword [rsp + 0x110], rbx
mov qword [rsp + 0x118], r14
mov r14, rax
test edi, edi
je 0x14009852c
mov eax, 0x22
cmp word [rbp], ax
je 0x140098501
mov word [r14], ax
lea r14, [r14 + 2]
movsxd rbx, edi
mov rdx, rbp
add rbx, rbx
mov rcx, r14
mov r8, rbx
call fcn.1400b9e30
add r14, rbx
cmp word [rbp], 0x22
je 0x14009852c
mov eax, 0x22
mov word [r14], ax
add r14, 2
test esi, esi
je 0x140098558
test edi, edi
je 0x140098541
mov eax, 0x20
mov word [r14], ax
add r14, 2
movsxd rbx, esi
mov rdx, r15
add rbx, rbx
mov rcx, r14
mov r8, rbx
call fcn.1400b9e30
add r14, rbx
xor ecx, ecx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], rax
xor r9d, r9d
lea rax, [rsp + 0x70]
mov word [r14], cx
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov rax, qword [rsp + 0x130]
mov rdx, r12
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov rcx, r12
mov ebx, eax
call fcn.1400b60a4
mov r14, qword [rsp + 0x118]
test ebx, ebx
mov rbx, qword [rsp + 0x110]
je 0x140098654
test r13b, r13b
je 0x14009863a
mov rcx, qword [rsp + 0x50]
mov edx, 0xc8
call qword [sym.imp.USER32.dll_WaitForInputIdle]
mov rcx, qword [rsp + 0x50]
lea rdx, [rsp + 0x120]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x14009862f
nop dword [rax]
cmp dword [rsp + 0x120], 0x103
jne 0x14009863a
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rsp + 0x50]
mov edx, 0xc8
call qword [sym.imp.USER32.dll_WaitForInputIdle]
mov rcx, qword [rsp + 0x50]
lea rdx, [rsp + 0x120]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x1400985f0
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x140098656
xor al, al
mov rbp, qword [rsp + 0x128]
add rsp, 0xe0
pop r15
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x140098670
Capabilities:
Create process on windows

Disassembly:
sub rsp, 0x38
mov r8, rcx
mov dword [rsp + 0x28], 1
xor ecx, ecx
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea rdx, str.open
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
setg al
add rsp, 0x38
ret
Function at 0x14009bd20
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, rdx
mov rdi, rcx
call fcn.14009bcf0
test al, al
jne 0x14009bdad
mov rcx, rdi
call fcn.14009bc80
test rbx, rbx
je 0x14009bdad
cmp word [rbx], 0
je 0x14009bdad
mov rcx, qword [rdi + 0x210]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rdi
sub rcx, rbx
nop dword [rax]
nop dword [rax + rax]
movzx eax, word [rbx]
mov word [rcx + rbx], ax
lea rbx, [rbx + 2]
test ax, ax
jne 0x14009bd70
lea rax, [rsp + 0x50]
mov r9, rdi
mov qword [rsp + 0x28], rax
lea r8, [0x14009c020]
xor edx, edx
mov dword [rsp + 0x20], 0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rdi + 0x208], rax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x14009c0e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
lea rbp, [rax - 0x328]
sub rsp, 0x420
mov rbx, rdx
movaps xmmword [rax - 0x18], xmm6
mov rsi, rcx
xor edx, edx
lea rcx, [rbp + 0x100]
mov r8d, 0x208
call fcn.1400ba240
test rbx, rbx
lea rdi, [rbp + 0x100]
lea rcx, [rbp + 0xc0]
cmovne rdi, rbx
mov rdx, rdi
call fcn.14009c050
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
movaps xmm2, xmmword [rsp + 0x60]
lea rcx, [rbp + 0xc0]
movaps xmm1, xmmword [rsp + 0x70]
xor edx, edx
movsd xmm0, qword [rbp - 0x80]
mov qword [rsp + 0x50], rcx
lea rcx, [0x14009c660]
movaps xmm3, xmmword [rsp + 0x50]
mov qword [rsp + 0x48], rcx
lea rcx, [0x14009cd60]
movaps xmm4, xmmword [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov qword [rbp + 0x70], rax
lea rax, [0x14012c34c]
movups xmmword [rbp - 0x58], xmm4
mov qword [rbp - 0x50], rcx
lea rcx, [0x14009c4f0]
mov qword [rsp + 0x30], 0x10e
movaps xmm5, xmmword [rsp + 0x30]
mov qword [rsp + 0x20], 0x68
movaps xmm6, xmmword [rsp + 0x20]
movaps xmmword [rbp + 0x10], xmm4
mov qword [rbp + 0x80], rax
lea rax, [rsp + 0x20]
mov qword [rbp + 0x18], rcx
lea rcx, [rbp + 0x60]
movups xmmword [rbp - 0x68], xmm5
mov qword [rbp - 0x68], 0x10f
movaps xmmword [rbp], xmm5
movups xmmword [rbp - 0x78], xmm6
mov qword [rbp], 0x110
movups xmmword [rbp - 0x48], xmm3
mov dword [rbp + 0x60], 0x60
movups xmmword [rbp - 0x38], xmm2
mov dword [rbp + 0x64], 0x28
movups xmmword [rbp - 0x28], xmm1
mov qword [rbp + 0x68], rsi
movsd qword [rbp - 0x18], xmm0
movaps xmmword [rbp - 0x10], xmm6
movaps xmmword [rbp + 0x20], xmm3
movaps xmmword [rbp + 0x30], xmm2
movaps xmmword [rbp + 0x40], xmm1
movsd qword [rbp + 0x50], xmm0
mov dword [rbp + 0x90], edx
mov qword [rbp + 0x98], rax
mov dword [rbp + 0x88], 3
call qword [sym.imp.COMCTL32.dll_PropertySheetW]
test rax, rax
jns 0x14009c261
xor r9d, r9d
lea r8, str.Audio_Recording_Wizard
lea rdx, str.Couldnt_create_dialog
mov rcx, rsi
call fcn.140091170
xor bl, bl
jmp 0x14009c270
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne bl
lea rcx, [rbp + 0xc0]
call fcn.14009c070
lea r11, [rsp + 0x420]
movzx eax, bl
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop rbp
ret
Function at 0x14009ecb0
Capabilities:
Accept command line arguments

Disassembly:
sub rsp, 0x238
mov edx, 6
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
call qword [sym.imp.COMCTL32.dll_InitCommonControls]
mov r8d, 0x104
lea rdx, [rsp + 0x20]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x14009ed00
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea rdx, [rsp + 0x20]
sub rdx, rax
nop
movzx ecx, word [rax]
mov word [rdx + rax], cx
lea rax, [rax + 2]
test cx, cx
jne 0x14009ecf0
lea rdx, [rsp + 0x20]
lea rcx, [0x1401a94c0]
call fcn.140097960
lea rcx, [0x1401a94c0]
call fcn.140028ef0
lea rcx, [0x1401aa200]
mov qword [0x1401a96c8], rax
call fcn.1400b0b60
mov ecx, 0xfff8f0
call qword [sym.imp.GDI32.dll_CreateSolidBrush]
mov qword [0x1401a91e8], rax
add rsp, 0x238
ret
Function at 0x1400a5ef0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
cmp rcx, qword [0x14018d230]
mov rsi, rcx
jne 0x1400a5ff3
cmp qword [0x140194b98], 0
jne 0x1400a5ff3
mov ecx, 0x208
call fcn.1400b609c
mov rbx, rax
test rax, rax
je 0x1400a5ff3
mov rdx, rax
mov ecx, 1
call fcn.1400979b0
test al, al
je 0x1400a5feb
mov rcx, 0xffffffffffffffff
mov rdx, rcx
cmp word [rbx + rdx*2 + 2], 0
lea rdx, [rdx + 1]
jne 0x1400a5f52
lea rax, [rbx + rdx*2]
mov edx, 0x5c
mov word [rax], dx
lea rax, [rax + 2]
movups xmm0, xmmword [0x1401509b8]
movups xmmword [rax], xmm0
movsd xmm1, qword [0x1401509c8]
movsd qword [rax + 0x10], xmm1
nop word [rax + rax]
cmp word [rax + rcx*2 + 2], 0
lea rcx, [rcx + 1]
jne 0x1400a5f90
lea rdi, [rax + rcx*2]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1400a5fb9
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
movups xmm0, xmmword [str.Ignored_VST_plug_ins.txt]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [0x1401521e0]
movups xmmword [rdi + 0x10], xmm1
movups xmm0, xmmword [0x1401521f0]
movups xmmword [rdi + 0x20], xmm0
mov eax, dword [reloc.WSOCK32.dll_WSACleanup]
mov dword [rdi + 0x30], eax
mov qword [0x140194b98], rbx
jmp 0x1400a5ff3
mov rcx, rbx
call fcn.1400b60a4
mov rax, qword [rsi]
lea r8, [rsp + 0x30]
lea rdx, [0x1400abe00]
mov qword [rsp + 0x30], 0
mov rcx, rsi
call qword [rax + htons]
mov rbx, qword [rsp + 0x30]
mov edi, eax
test rbx, rbx
je 0x1400a603c
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400a602d
xor edx, edx
call qword [sym.imp.USER32.dll_EndDialog]
mov edx, 8
mov rcx, rbx
call fcn.1400b6094
mov eax, edi
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400a9a00
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x490
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
test rdx, rdx
jne 0x1400a9a8b
test rbx, rbx
jne 0x1400a9a2c
lea rbx, [rcx + 0x9e38]
mov r8, qword [rcx + 0x1e08]
lea r9, [0x1400a0550]
mov rcx, qword [0x1401a94b0]
mov edx, 0x132
mov rsi, rbx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.USER32.dll_DialogBoxParamW]
test rax, rax
je 0x1400a9baf
mov rax, 0xffffffffffffffff
inc rax
cmp word [rbx + rax*2], 0
jne 0x1400a9a64
dec eax
cdqe
lea rcx, [rbx + rax*2]
movzx eax, word [rbx + rax*2]
cmp ax, 0x5c
je 0x1400a9a86
cmp ax, 0x2f
jne 0x1400a9a8b
xor eax, eax
mov word [rcx], ax
mov qword [rsp + 0x4a0], rbp
mov edx, 0x7f02
xor ecx, ecx
mov qword [rsp + 0x4a8], r14
call qword [sym.imp.USER32.dll_LoadCursorW]
mov rcx, rax
call qword [sym.imp.USER32.dll_SetCursor]
mov r8, rsi
lea rdx, str._s.
lea rcx, [rsp + 0x280]
mov r14, rax
call fcn.140010090
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x280]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x1400a9b9f
nop dword [rax + rax]
lea r9, [rsp + 0x5c]
mov r8, rsi
lea rdx, str._s_s
lea rcx, [rsp + 0x280]
call fcn.140010090
test byte [rsp + 0x30], 0x10
je 0x1400a9b3e
cmp word [rsp + 0x5c], 0x2e
je 0x1400a9b77
test rbx, rbx
je 0x1400a9b77
cmp byte [rbx + 0x309], 0
je 0x1400a9b77
mov r8, rbx
lea rdx, [rsp + 0x280]
mov rcx, rdi
call fcn.1400a9a00
jmp 0x1400a9b77
test rbx, rbx
je 0x1400a9b64
cmp byte [rbx + 0x308], 0
je 0x1400a9b64
lea rdx, [rbx + 0x208]
mov rcx, rdi
lea r8, [rsp + 0x5c]
call fcn.1400a98a0
test al, al
je 0x1400a9b77
xor r8d, r8d
lea rdx, [rsp + 0x280]
mov rcx, rdi
call fcn.1400a0860
lea rdx, [rsp + 0x30]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1400a9af0
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, r14
call qword [sym.imp.USER32.dll_SetCursor]
mov rbp, qword [rsp + 0x4a0]
mov r14, qword [rsp + 0x4a8]
lea r11, [rsp + 0x490]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1400a9f60
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
xor ecx, ecx
call fcn.140097490
mov rbx, rax
movzx eax, word [rax]
test ax, ax
je 0x1400aa08f
mov qword [rsp + 0x30], rbp
xor ebp, ebp
mov qword [rsp + 0x38], rsi
mov esi, 0xfffd
nop dword [rax]
nop dword [rax + rax]
sub ax, 0x2d
test si, ax
je 0x1400aa05e
lea rdx, str..exe
mov rcx, rbx
call fcn.1400ba6a4
test rax, rax
jne 0x1400aa05e
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400aa05e
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
shr ecx, 4
and ecx, 1
cmp eax, 0xffffffff
cmove ecx, ebp
test cl, cl
je 0x1400aa002
xor r8d, r8d
mov rdx, rbx
mov rcx, rdi
call fcn.1400a9a00
jmp 0x1400aa05e
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rbx + rax*2], bp
jne 0x1400aa010
cmp eax, 4
jle 0x1400aa050
cdqe
lea rdx, str..aap
add rax, 0xfffffffffffffffc
lea rcx, [rbx + rax*2]
call fcn.1400f579c
test eax, eax
jne 0x1400aa050
lea rcx, [rdi + 0x1bc0]
mov rdx, rbx
mov rax, qword [rcx]
call qword [rax]
mov byte [rdi + 0xbdf], bpl
jmp 0x1400aa05e
xor r8d, r8d
mov rdx, rbx
mov rcx, rdi
call fcn.1400a0860
mov rax, 0xffffffffffffffff
cmp word [rbx + rax*2 + 2], bp
lea rax, [rax + 1]
jne 0x1400aa065
lea rbx, [rbx + rax*2]
movzx eax, word [rbx + 2]
add rbx, 2
test ax, ax
jne 0x1400a9fa0
mov rsi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400ad9b0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
cmp byte [rcx + 0xd], 0
mov rbx, rcx
jne 0x1400adaf2
lea rdi, [rcx + 0x9ca]
cmp word [rdi], 0
jne 0x1400ad9ef
lea rdx, str.You_must_select_an_output_directory_first_
xor ecx, ecx
call fcn.14009ebd0
xor al, al
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 0x30], rbp
mov rax, 0xffffffffffffffff
mov qword [rsp + 0x38], rsi
cmp word [rdi + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x1400ada00
lea rsi, [rcx + 0x9ca]
xor ebp, ebp
lea rsi, [rsi + rax*2]
cmp rsi, rdi
jbe 0x1400ada38
movzx eax, word [rsi - 2]
lea rcx, [rsi - 2]
cmp ax, 0x5c
je 0x1400ada32
cmp ax, 0x2f
jne 0x1400ada38
mov rsi, rcx
mov word [rcx], bp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov rbp, qword [rsp + 0x30]
mov dword [rsi], 0x5c
mov rsi, qword [rsp + 0x38]
cmp eax, 0xffffffff
jne 0x1400adaf2
cmp word [rbx + 0x9cc], 0x3a
jne 0x1400ada94
cmp word [rbx + 0x9d0], 0
jne 0x1400ada94
mov rcx, qword [rbx + 0x1e00]
lea rdx, str.The_output_drive_does_not_exist_
xor r9d, r9d
mov r8, rdi
call fcn.140091170
xor al, al
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rcx, qword [rbx + 0x1e00]
lea rdx, str.The_output_directory_does_not_exist__n_nCreate_it_
mov r9d, 4
mov r8, rdi
call fcn.140091170
cmp eax, 7
je 0x1400ad9e2
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1400adaf2
mov rcx, qword [rbx + 0x1e00]
lea r8, str.Error___Awave_Audio
xor r9d, r9d
lea rdx, str.Couldnt_create_output_directory_
call fcn.140091170
xor al, al
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
cmp byte [rbx + 0xe], 0
je 0x1400adb21
mov rcx, qword [rbx + 0x1e00]
lea r8, str.Please_confirm_Delete_source_files_option_
mov r9d, 4
lea rdx, str.Are_you_sure_that_you_want_that_a_source_file_should_be_deleted_after_it_has_been_converted_
call fcn.140091170
cmp eax, 7
je 0x1400ad9e2
mov rbx, qword [rsp + 0x40]
mov al, 1
add rsp, 0x20
pop rdi
ret
Function at 0x1400adb30
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
movss xmm0, dword [rcx + 0xa554]
mov rdi, rcx
mulss xmm0, dword [0x1401545fc]
mov ecx, gethostbyname
addss xmm0, dword [0x14012bc68]
cvttss2si rdx, xmm0
call fcn.140090410
mov ebp, reloc.WSOCK32.dll_recv
cmp ax, 0x12
ja 0x1400adb81
movzx esi, bp
lea ebx, [rbp + 0x24]
jmp 0x1400adbb9
cmp ax, 0x16
ja 0x1400adb91
mov esi, socket
lea ebx, [rsi + 0x21]
jmp 0x1400adbb9
cmp ax, 0x1c
ja 0x1400adba1
mov esi, 0x18
lea ebx, [rsi + 0x1e]
jmp 0x1400adbb9
cmp ax, 0x28
ja 0x1400adbb1
mov esi, 0x20
lea ebx, [rsi + 0x17]
jmp 0x1400adbb9
mov esi, gethostbyname
lea ebx, [rsi + 8]
mov rcx, qword [rdi + 0x1e08]
call fcn.14009ebf0
cmp qword [rdi + 0x1e10], 0
je 0x1400adbf5
mov rcx, qword [rdi + 0x1df8]
xor r9d, r9d
mov edx, 0x1003
lea r8d, [r9 + 1]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rdi + 0x1e10]
call qword [sym.imp.COMCTL32.dll_ImageList_Destroy]
mov rcx, qword [0x1401a94b0]
xor eax, eax
mov dword [rsp + 0x30], eax
xor r9d, r9d
mov dword [rsp + 0x28], eax
mov rdx, rbx
movzx r8d, si
mov dword [rsp + 0x20], eax
call qword [sym.imp.COMCTL32.dll_ImageList_LoadImageW]
mov qword [rdi + 0x1e10], rax
test rax, rax
jne 0x1400adc45
lea rdx, str.Couldnt_load_image_list_bitmap
lea rcx, str.ERROR_
call fcn.14009ebd0
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov r8d, 1
mov edx, ebp
mov rcx, rax
call qword [sym.imp.COMCTL32.dll_ImageList_SetOverlayImage]
mov rcx, qword [rdi + 0x1e10]
mov edx, reloc.COMCTL32.dll_InitCommonControls
lea r8d, [rdx - 0xf]
call qword [sym.imp.COMCTL32.dll_ImageList_SetOverlayImage]
mov rcx, qword [rdi + 0x1e10]
mov edx, send
lea r8d, [rdx - 0xf]
call qword [sym.imp.COMCTL32.dll_ImageList_SetOverlayImage]
mov r9, qword [rdi + 0x1e10]
mov edx, 0x1003
mov rcx, qword [rdi + 0x1df8]
mov r8d, 1
call qword [sym.imp.USER32.dll_SendMessageW]
lea rbx, [0x140152c10]
lea rbp, str.Couldnt_load_image_list_bitmap
nop
movzx edx, word [rbx + 2]
lea rcx, [0x1401a96d0]
movzx r8d, si
call fcn.14008f910
movzx edx, word [rbx]
mov r9d, 1
mov rcx, qword [rdi + 0x1e00]
mov r8d, 0xf7
mov qword [rsp + 0x20], rax
call qword [sym.imp.USER32.dll_SendDlgItemMessageW]
add rbx, 4
cmp rbx, rbp
jne 0x1400adcb0
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x1400b21d0
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
test r8, r8
lea rdi, [0x14012c34c]
mov rsi, rdx
mov rbp, rcx
cmovne rdi, r8
mov r8, 0xffffffffffffffff
mov rax, r8
inc rax
cmp word [rdx + rax*2], 0
jne 0x1400b2202
mov rcx, r8
nop
inc rcx
cmp word [rdi + rcx*2], 0
jne 0x1400b2210
add eax, 5
add ecx, eax
mov eax, 2
movsxd rdx, ecx
mul rdx
cmovo rax, r8
mov rcx, rax
call fcn.1400b609c
mov r9, rdi
mov dword [rsp + 0x28], 0xa
mov r8, rsi
mov dword [rsp + 0x20], recv
lea rdx, str._s:_t_s_c_c
mov rcx, rax
mov rbx, rax
call fcn.140010090
mov r9, rbx
xor r8d, r8d
mov edx, 0xc2
mov rcx, rbp
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, rbx
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
jmp fcn.1400b60a4
Function at 0x1401030e8
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140102e70
Function at 0x140012200
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x40], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x1400e9088]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rdi, rcx
cmp qword [rcx + 0x68], 0
je 0x1400123c5
cmp byte [rcx + 0x72], 0
je 0x1400123c5
mov rax, qword [rcx]
mov ebx, 0xffff
mov edx, ebx
call qword [rax + SafeArrayPutElement]
cmp bx, ax
jne 0x14001225d
xor al, al
jmp 0x1400123c7
xor r14d, r14d
mov qword [rbp - 0x20], r14
mov qword [rbp - 0x18], r14
mov qword [rbp - 0x18], SafeArrayGetLBound
mov qword [rbp - 0x20], r14
mov byte [rbp - 0x30], r14b
xor r8d, r8d
lea edx, [r14 + 8]
lea rcx, [rbp - 0x30]
call fcn.140011c90
nop
mov r10, qword [rbp - 0x30]
mov r9, qword [rbp - 0x18]
nop dword [rax]
nop word [rax + rax]
lea rdx, [rbp - 0x30]
cmp r9, 0x10
cmovae rdx, r10
lea r8, [rbp - 0x30]
cmovae r8, r10
mov rcx, qword [rdi + 0x68]
mov r10, qword [rcx]
mov r9, qword [rbp - 0x20]
add r9, rdx
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
lea rdx, [rdi + 0x74]
call qword [r10 + 0x40]
test eax, eax
je 0x1400122de
sub eax, 1
jne 0x14001234f
jmp 0x1400122e2
mov byte [rdi + 0x72], 0
lea rax, [rbp - 0x30]
mov r10, qword [rbp - 0x30]
mov r9, qword [rbp - 0x18]
cmp r9, 0x10
cmovae rax, r10
mov rbx, qword [rbp - 0x38]
sub rbx, rax
je 0x14001232c
lea rcx, [rbp - 0x30]
cmp r9, 0x10
cmovae rcx, r10
mov r9, qword [rdi + 0x80]
mov r8, rbx
mov edx, 1
call fcn.1400810f8
cmp rbx, rax
jne 0x140012354
mov r9, qword [rbp - 0x18]
mov r10, qword [rbp - 0x30]
cmp byte [rdi + 0x72], 0
je 0x140012358
test rbx, rbx
jne 0x1400122a0
xor r8d, r8d
lea edx, [rbx + 8]
lea rcx, [rbp - 0x30]
call fcn.140011d80
jmp 0x140012289
cmp eax, 2
je 0x140012358
xor bl, bl
jmp 0x14001235a
mov bl, 1
mov rax, qword [rbp - 0x18]
cmp rax, 0x10
jb 0x1400123b0
inc rax
mov rcx, qword [rbp - 0x30]
cmp rax, 0x1000
jb 0x1400123ab
test cl, 0x1f
je 0x14001237e
call fcn.14007c118
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x14001238d
call fcn.14007c118
int3
sub rcx, rax
cmp rcx, 8
jae 0x14001239c
call fcn.14007c118
int3
cmp rcx, 0x27
jbe 0x1400123a8
call fcn.14007c118
int3
mov rcx, rax
call fcn.1400562e0
mov qword [rbp - 0x18], SafeArrayGetLBound
mov qword [rbp - 0x20], r14
mov byte [rbp - 0x30], 0
movzx eax, bl
jmp 0x1400123c7
mov al, 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140056280
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x14001cde0
Capabilities:
Create directory

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xe0
mov qword [rbp - 0x29], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rdi
mov rax, qword [0x1400e9088]
xor rax, rsp
mov qword [rbp + 0x4f], rax
mov rdi, rcx
mov qword [rbp + 0x1f], rcx
mov rdx, rcx
lea rcx, [rbp + 0x2f]
call fcn.14001ec00
nop
lea rcx, [rbp + 0x2f]
cmp qword [rbp + 0x47], 8
cmovae rcx, qword [rbp + 0x2f]
call qword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
xor ebx, ebx
test eax, eax
jne 0x14001cf3c
lea rdx, [rbp + 0x2f]
cmp qword [rbp + 0x47], 8
cmovae rdx, qword [rbp + 0x2f]
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
mov dword [rbp + 0x27], ebx
mov word [rbp + 0x2b], 0x100
mov qword [rbp - 0x19], rbx
lea rax, [rbp - 0x19]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], ebx
mov dword [rsp + 0x40], ebx
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor r8d, r8d
mov dl, 1
lea rcx, [rbp + 0x27]
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x14001cf3c
xor eax, eax
mov qword [rbp - 0x11], rax
mov qword [rbp - 9], rax
mov qword [rbp + 0xf], rax
mov dword [rbp - 0xd], 2
mov dword [rbp - 0x11], 0x1fffff
mov dword [rbp - 9], 1
mov qword [rbp + 7], rbx
mov qword [rbp - 1], rbx
mov rax, qword [rbp - 0x19]
mov qword [rbp + 0x17], rax
mov dword [rbp + 0xf], 5
mov qword [rbp - 0x21], rbx
lea r9, [rbp - 0x21]
xor r8d, r8d
lea rdx, [rbp - 0x11]
lea ecx, [rbx + 1]
call qword [sym.imp.ADVAPI32.dll_SetEntriesInAclW]
test eax, eax
jne 0x14001cf31
lea rcx, [rbp + 0x2f]
cmp qword [rbp + 0x47], 8
cmovae rcx, qword [rbp + 0x2f]
mov qword [rsp + 0x30], rbx
mov rax, qword [rbp - 0x21]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
xor r9d, r9d
lea edx, [rbx + 1]
lea r8d, [rbx + 4]
call qword [sym.imp.ADVAPI32.dll_SetNamedSecurityInfoW]
mov rcx, qword [rbp - 0x21]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rbp - 0x19]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
nop
mov r8, qword [rbp + 0x47]
cmp r8, 8
jb 0x14001cf56
inc r8
mov rdx, qword [rbp + 0x2f]
lea rcx, [rbp + 0x2f]
call fcn.1400129b0
mov qword [rbp + 0x47], 7
mov qword [rbp + 0x3f], rbx
mov word [rbp + 0x2f], bx
mov r8, qword [rdi + 0x18]
cmp r8, 8
jb 0x14001cf7e
inc r8
mov rdx, qword [rdi]
mov rcx, rdi
call fcn.1400129b0
mov qword [rdi + 0x18], 7
mov qword [rdi + 0x10], rbx
cmp qword [rdi + 0x18], 8
jb 0x14001cf99
mov rax, qword [rdi]
mov word [rax], bx
jmp 0x14001cf9c
mov word [rdi], bx
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.140056280
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret