joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140087dc8
Capabilities:
Get graphical window text

Disassembly:
push rbx
sub rsp, 0x440
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rax, qword [0x1400e0920]
xor rax, rsp
mov qword [rsp + 0x430], rax
mov rcx, qword [0x1400fec08]
test rcx, rcx
je 0x140087ee6
mov r8d, 0x200
lea rdx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov eax, dword [0x14012489c]
cmp eax, 8
je 0x140087e59
lea rcx, [rsp + 0x30]
lea rdx, [0x140124e30]
mov r9, rdx
sub r9, rcx
movzx r8d, word [rcx]
movzx r10d, word [rcx + r9]
sub r8d, r10d
jne 0x140087e41
add rcx, 2
test r10d, r10d
jne 0x140087e2a
test r8d, r8d
je 0x140087e59
mov rcx, qword [0x1400fec08]
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov eax, dword [0x14012489c]
test eax, eax
je 0x140087e6c
cmp eax, 1
je 0x140087e6c
cmp eax, 2
je 0x140087e6c
cmp eax, 8
jne 0x140087eaa
lea r8, [0x140124d30]
xor edx, edx
mov ecx, 0x9c
call fcn.140087aa4
lea rcx, [0x140125730]
call fcn.140052abc
mov rbx, rax
lea rcx, [0x140125f30]
call fcn.140052a24
mov rdx, rax
mov r8, rbx
mov ecx, 0x9b
call fcn.140087aa4
mov eax, dword [0x140126334]
test al, 1
jne 0x140087ec4
or eax, 1
mov dword [0x140126334], eax
and dword [0x140126330], 0
mov edx, 0x64
lea rcx, [0x140126330]
call fcn.140046aec
test al, al
je 0x140087ee6
mov rcx, qword [0x1400fec08]
call qword [sym.imp.USER32.dll_UpdateWindow]
mov rcx, qword [rsp + 0x430]
xor rcx, rsp
call fcn.1400a8530
add rsp, 0x440
pop rbx
ret

Function at 0x14008827c
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
sub rsp, 0x440
mov rax, qword [0x1400e0920]
xor rax, rsp
mov qword [rsp + 0x430], rax
mov rbx, rcx
mov dword [rcx], 0x3b8
mov rcx, qword [rcx + 8]
mov ebp, edx
mov esi, 0x200
lea rdx, [rsp + 0x30]
mov r8d, esi
call qword [sym.imp.USER32.dll_GetWindowTextW]
lea rcx, [rsp + 0x30]
mov edx, 0x40
call fcn.140046fa0
or r12, 0xffffffffffffffff
cmp word [0x140124830], 0
je 0x140088347
xor eax, eax
lea rdi, [rsp + 0x30]
mov rcx, r12
repne scasw ax, word [rdi]
mov eax, dword [0x1400c8754]
mov rcx, r12
mov dword [rdi - 2], eax
movzx eax, word [0x1400c8758]
mov word [rdi + 2], ax
xor eax, eax
lea rdi, [rsp + 0x30]
repne scasw ax, word [rdi]
not rcx
lea rdi, [rcx - 1]
mov ecx, 0x5aa
call fcn.140061d2c
mov rdx, rsi
lea rcx, [rsp + rdi*2 + 0x30]
mov r9, rax
lea rax, [0x140124830]
lea r8, str._s:__s
sub rdx, rdi
mov qword [rsp + 0x20], rax
call fcn.14005b860
cmp byte [0x140124896], 0
je 0x1400883a5
xor eax, eax
lea rdi, [rsp + 0x30]
mov rcx, r12
repne scasw ax, word [rdi]
mov eax, dword [0x1400c8754]
mov rcx, r12
mov dword [rdi - 2], eax
movzx eax, word [0x1400c8758]
mov word [rdi + 2], ax
xor eax, eax
lea rdi, [rsp + 0x30]
repne scasw ax, word [rdi]
not rcx
lea rdi, [rcx - 1]
mov ecx, 0x2fd
call fcn.140061d2c
sub rsi, rdi
lea rcx, [rsp + rdi*2 + 0x30]
mov r9d, ebp
mov rdx, rsi
mov r8, rax
call fcn.14005b860
lea rcx, [rbx + 0x28]
lea rdx, [rsp + 0x30]
mov r8d, 0x80
call fcn.14006b580
mov rcx, qword [rsp + 0x430]
xor rcx, rsp
call fcn.1400a8530
lea r11, [rsp + 0x440]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
Function at 0x14008aa08
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov r8d, dword [0x14010bc54]
lea rdi, str.ExtractionProfile
lea rdx, str.Overwrite
mov rcx, rdi
call fcn.14005c3b8
movzx r8d, byte [0x14010bc75]
lea rdx, [0x1400c8de0]
mov rcx, rdi
call fcn.14005c3b8
movzx r8d, byte [0x14010bc74]
lea rdx, str.Fresh
mov rcx, rdi
call fcn.14005c3b8
mov r8d, dword [0x14010bc54]
lea rdx, str.Overwrite
mov rcx, rdi
call fcn.14005c3b8
movzx r8d, byte [0x14010c239]
lea rdx, str.UnpToSubfolders
mov rcx, rdi
call fcn.14005c3b8
movzx r8d, byte [0x14010bcbc]
lea rdx, str.KeepBroken
mov rcx, rdi
call fcn.14005c3b8
movzx r8d, byte [0x140126e08]
lea rdx, str.ShowExplorer
mov rcx, rdi
call fcn.14005c3b8
mov r8d, dword [0x14010c23c]
lea rdx, str.mtime
mov rcx, rdi
call fcn.14005c3b8
mov r8d, dword [0x14010c240]
lea rdx, str.ctime
mov rcx, rdi
call fcn.14005c3b8
mov r8d, dword [0x14010c244]
lea rdx, str.atime
mov rcx, rdi
call fcn.14005c3b8
xor ebx, ebx
cmp dword [0x14010bc78], 2
mov r8d, ebx
lea rdx, str.PathsRel
mov rcx, rdi
sete r8b
call fcn.14005c3b8
cmp dword [0x14010bc78], ebx
mov r8d, ebx
lea rdx, str.PathsFull
mov rcx, rdi
sete r8b
call fcn.14005c3b8
cmp dword [0x14010bc78], 1
mov r8d, ebx
lea rdx, str.PathsNone
mov rcx, rdi
sete r8b
call fcn.14005c3b8
cmp dword [0x14010bc78], 4
mov r8d, ebx
lea rdx, str.PathsAbsDrive
mov rcx, rdi
sete r8b
call fcn.14005c3b8
movzx r8d, byte [0x14010bc70]
lea rdx, str.ClearArc
mov rcx, rdi
call fcn.14005c3b8
movzx r8d, byte [0x14010bcb0]
lea rdx, str.ProcessOwners
mov rcx, rdi
call fcn.14005c3b8
movzx r8d, byte [0x14010bd16]
lea rdx, str.SetCompressedAttr
mov rcx, rdi
call fcn.14005c3b8
mov r8d, dword [0x14010d66c]
lea rdx, str.ExtrDelArc
mov rcx, rdi
call fcn.14005c3b8
cmp byte [0x14010bca5], bl
lea rdx, str.CheckAV
sete bl
mov rcx, rdi
mov r8d, ebx
call fcn.14005c3b8
movzx r8d, byte [0x14010d65b]
lea rdx, [0x1400ca4d8]
mov rcx, rdi
call fcn.14005c3b8
movzx r8d, byte [0x14010d65c]
lea rdx, str.WaitForOther
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.14005c3b8
Function at 0x14008b6a0
Capabilities:
Get common file path
Query environment variable

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x840
mov rax, qword [0x1400e0920]
xor rax, rsp
mov qword [rsp + 0x830], rax
xor r12d, r12d
mov sil, r9b
mov rbp, r8
mov rdi, rdx
mov rbx, rcx
cmp byte [rsp + 0x898], r12b
je 0x14008b756
mov r9, rdx
mov r8, rcx
lea rdx, str.DefFolder
lea rcx, str.Extraction
mov dword [rsp + 0x20], 0x400
call fcn.14005c3f4
mov rcx, rbx
cmp word [rbx], r12w
jne 0x14008b719
sub rcx, rdi
movzx eax, word [rdi]
mov word [rcx + rdi], ax
add rdi, 2
cmp ax, r12w
jne 0x14008b706
jmp 0x14008b75a
lea rdx, [rsp + 0x30]
mov r8d, 0x400
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea rax, [rsp + 0x30]
mov rdx, rbx
mov word [rsp + 0x82e], r12w
lea rcx, [rsp + 0x30]
sub rdx, rax
movzx eax, word [rcx]
mov word [rdx + rcx], ax
add rcx, 2
cmp ax, r12w
jne 0x14008b743
jmp 0x14008b75a
mov word [rcx], r12w
cmp word [rbx], r12w
setne dil
cmp word [rbx], r12w
jne 0x14008b776
mov rdx, rbx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov rcx, rbx
call fcn.14005254c
cmp sil, r12b
jne 0x14008b78c
cmp dil, r12b
je 0x14008b8bf
lea rdx, str.AppendName
lea rcx, str.Extraction
mov r8d, 1
call fcn.14005c420
cmp eax, r12d
je 0x14008b8bf
lea rcx, [rsp + 0x30]
mov r8d, 0x400
mov rdx, rbp
call fcn.14006b580
mov rsi, r12
cmp word [rsp + 0x30], r12w
je 0x14008b809
mov rax, r12
lea rdi, [rsp + 0x30]
mov ebp, 0x25
cmp word [rdi], bp
jne 0x14008b7f7
lea rcx, [rsp + rax + 0x32]
mov edx, ebp
call fcn.1400a95dc
cmp rax, r12
je 0x14008b7f7
mov eax, 0x5f
mov word [rdi], ax
inc rsi
lea rax, [rsi + rsi]
lea rdi, [rsp + rax + 0x30]
cmp word [rdi], r12w
jne 0x14008b7d9
lea rcx, [rsp + 0x30]
call fcn.140052abc
or rcx, 0xffffffffffffffff
mov rdi, rbx
mov r11, rax
xor eax, eax
repne scasw ax, word [rdi]
xor edx, edx
movzx ecx, word [r11 + rdx]
add rdx, 2
mov word [rdi + rdx - 4], cx
test cx, cx
jne 0x14008b824
mov rcx, rbx
call fcn.140052e80
mov rdi, rax
cmp rax, r12
je 0x14008b8bf
cmp rax, rbx
jbe 0x14008b8bf
mov rcx, rbx
mov word [rax], r12w
call fcn.140052e80
mov rsi, rax
cmp rax, r12
je 0x14008b8b6
cmp rax, rbx
jbe 0x14008b8b6
cmp byte [rsp + 0x890], r12b
je 0x14008b892
cmp word [rdi + 2], r12w
je 0x14008b892
movzx ecx, word [rdi + 4]
call fcn.14006b3b8
cmp al, r12b
jne 0x14008b892
movzx ecx, word [rdi - 2]
call fcn.14006b3b8
cmp al, r12b
jne 0x14008b8a6
lea rdx, str..tar
mov rcx, rsi
call fcn.140073da4
cmp eax, r12d
jne 0x14008b8b6
mov word [rsi], r12w
jmp 0x14008b8b6
cmp word [rdi], 0x2e
jne 0x14008b8bf
mov word [rdi], r12w
sub rdi, 2
cmp rdi, rbx
ja 0x14008b8ac
xor edx, edx
mov rcx, rbx
call fcn.14005258c
mov rcx, qword [rsp + 0x830]
xor rcx, rsp
call fcn.1400a8530
add rsp, 0x840
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14008b8e8
Capabilities:
Create process on windows

Disassembly:
push rdi
sub rsp, 0x850
mov rax, qword [0x1400e0920]
xor rax, rsp
mov qword [rsp + 0x840], rax
lea rdx, [rsp + 0x30]
call fcn.140052780
lea rcx, [rsp + 0x30]
call fcn.14005254c
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x30]
lea r8, [rsp + 0x30]
lea rdx, str.open
repne scasw ax, word [rdi]
mov eax, dword [0x1400c4d00]
xor r9d, r9d
mov dword [rdi - 2], eax
lea rax, [0x1400c3f4c]
xor ecx, ecx
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rcx, qword [rsp + 0x840]
xor rcx, rsp
call fcn.1400a8530
add rsp, 0x850
pop rdi
ret
Function at 0x14008f494
Capabilities:
Query environment variable

Disassembly:
push rbx
mov eax, 0x1100
call fcn.1400ba8b0
sub rsp, rax
mov rax, qword [0x1400e0920]
xor rax, rsp
mov qword [rsp + 0x10f0], rax
mov rbx, rcx
mov ecx, 0x6c
call fcn.140061d2c
lea rcx, [rsp + 0x820]
mov r9, rbx
mov r8, rax
mov edx, 0x464
call fcn.14005b860
jmp 0x14008f554
lea rdx, [rsp + 0x20]
mov r8d, 0x400
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x14008f527
lea rdx, [rsp + 0x20]
mov rax, rbx
sub rdx, rbx
movzx ecx, word [rax]
movzx r8d, word [rax + rdx]
sub ecx, r8d
jne 0x14008f515
add rax, 2
test r8d, r8d
jne 0x14008f4ff
test ecx, ecx
je 0x14008f527
lea rcx, [rsp + 0x20]
call fcn.1400861c4
test al, al
jne 0x14008f564
mov ecx, 0x66
call fcn.140061d2c
mov rcx, qword [0x1400ffd80]
lea rdx, [rsp + 0x820]
mov r8, rax
mov r9d, 0x15
call qword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 2
je 0x14008f582
mov rcx, rbx
call fcn.1400861c4
test al, al
je 0x14008f4dc
lea rcx, [0x140105570]
call fcn.140042c50
test al, al
je 0x14008f582
lea rcx, [0x140105570]
xor edx, edx
call fcn.140043330
mov rcx, qword [rsp + 0x10f0]
xor rcx, rsp
call fcn.1400a8530
add rsp, 0x1100
pop rbx
ret
Function at 0x14008f59c
Capabilities:
Get file system object information

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push rdi
push r12
push r13
sub rsp, 0x340
mov rax, qword [0x1400e0920]
xor rax, rsp
mov qword [rsp + 0x338], rax
mov r9, qword [rcx + 0x38]
mov rbp, rcx
lea r8, [0x1400c3260]
lea rcx, [r11 - 0x38]
mov edx, 0xa
add r9, 0x41
call fcn.14005b860
lea r8, [rsp + 0x60]
lea rcx, [rsp + 0x320]
mov r9d, 0x2b8
xor edx, edx
mov dword [rsp + 0x20], 0x301
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test byte [rbp + 0x10], 1
je 0x14008f648
mov ecx, 0xd
call qword [sym.imp.USER32.dll_GetSysColor]
mov rcx, qword [rbp + 0x20]
mov edx, eax
call qword [sym.imp.GDI32.dll_SetBkColor]
mov ecx, 0xe
mov r12d, eax
call qword [sym.imp.USER32.dll_GetSysColor]
mov rcx, qword [rbp + 0x20]
mov edx, eax
call qword [sym.imp.GDI32.dll_SetTextColor]
mov r13d, eax
jmp 0x14008f652
mov r12d, dword [rsp + 0x50]
mov r13d, dword [rsp + 0x50]
mov r8d, dword [rbp + 0x2c]
mov rcx, qword [rbp + 0x20]
xor edi, edi
mov qword [rsp + 0x38], rdi
lea rsi, [rbp + 0x28]
lea rax, [0x1400c3f4c]
mov edx, dword [rsi]
mov dword [rsp + 0x30], edi
mov qword [rsp + 0x28], rax
lea r9d, [rdi + 2]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.GDI32.dll_ExtTextOutW]
lea ecx, [rdi + 0x31]
call qword [sym.imp.USER32.dll_GetSystemMetrics]
lea ecx, [rdi + 0x32]
mov ebx, eax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov r9, qword [rsp + 0x60]
mov r8d, dword [rbp + 0x2c]
mov edx, dword [rsi]
mov rcx, qword [rbp + 0x20]
mov dword [rsp + 0x40], 3
mov qword [rsp + 0x38], rdi
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ebx
call qword [sym.imp.USER32.dll_DrawIconEx]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.USER32.dll_DestroyIcon]
mov r8d, dword [rbp + 0x2c]
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x70]
lea r9, [rsp + 0x70]
repne scasw ax, word [rdi]
mov eax, dword [rsi]
add r8d, 2
not rcx
lea edx, [rbx + rax + 7]
dec rcx
mov dword [rsp + 0x20], ecx
mov rcx, qword [rbp + 0x20]
call qword [sym.imp.GDI32.dll_TextOutW]
test byte [rbp + 0x10], 1
je 0x14008f728
mov rcx, qword [rbp + 0x20]
mov edx, r12d
call qword [sym.imp.GDI32.dll_SetBkColor]
mov rcx, qword [rbp + 0x20]
mov edx, r13d
call qword [sym.imp.GDI32.dll_SetTextColor]
mov rcx, qword [rsp + 0x338]
xor rcx, rsp
call fcn.1400a8530
lea r11, [rsp + 0x340]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
Function at 0x140095c54
Capabilities:
Delete directory
Enumerate files on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
mov eax, 0x1a90
call fcn.1400ba8b0
sub rsp, rax
mov rax, qword [0x1400e0920]
xor rax, rsp
mov qword [rsp + 0x1a80], rax
xor r12d, r12d
mov bl, cl
mov dword [0x1400fec14], 1
cmp dl, r12b
je 0x140095e04
lea rcx, [rsp + 0xa80]
mov edx, 0x400
call fcn.140086084
lea rcx, [rsp + 0xa80]
call fcn.14005254c
lea r9, [rsp + 0xa80]
lea r8, str._sRar_
lea rcx, [rsp + 0x1280]
mov edx, 0x400
call fcn.14005b860
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x1280]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x140095dfb
cmp dword [0x1400fec14], 1
jne 0x140095dfb
mov ecx, dword [rsp + 0x24]
sub ecx, dword [rsp + 0x38]
cmp ecx, 8
mov rcx, r12
setae sil
movzx eax, word [rsp + rcx + 0xa80]
add rcx, 2
mov word [rsp + rcx + 0x27e], ax
cmp ax, r12w
jne 0x140095d2a
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x280]
repne scasw ax, word [rdi]
lea rdx, [rsp + 0x5c]
sub rdi, 2
xor ecx, ecx
movzx eax, word [rdx + rcx]
mov word [rdi + rcx], ax
add rcx, 2
test ax, ax
jne 0x140095d60
test byte [rsp + 0x30], 0x10
je 0x140095dd7
lea rdx, str.Rar_DI
lea rcx, [rsp + 0x5c]
mov r8d, 6
call fcn.1400ab004
cmp eax, r12d
jne 0x140095da3
call fcn.14003ec88
mov dil, 1
cmp eax, 0x400
jne 0x140095da6
mov dil, r12b
lea rcx, [rsp + 0x280]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
cmp eax, r12d
jne 0x140095de4
cmp sil, r12b
je 0x140095dc3
cmp bl, r12b
je 0x140095dc8
cmp dil, r12b
je 0x140095de4
lea rcx, [rsp + 0x280]
call fcn.14008710c
jmp 0x140095de4
lea rcx, [rsp + 0x280]
call fcn.140086e3c
lea rdx, [rsp + 0x30]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
cmp eax, r12d
jne 0x140095d0b
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindClose]
cmp bl, r12b
jne 0x140095e30
cmp byte [0x1400ec040], r12b
je 0x140095e30
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov cl, 1
call fcn.140092ffc
mov byte [0x1400ec040], al
mov dword [0x1400fec14], r12d
mov rcx, qword [rsp + 0x1a80]
xor rcx, rsp
call fcn.1400a8530
lea r11, [rsp + 0x1a90]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret
Function at 0x1400969d0
Capabilities:
Copy file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r12
mov eax, 0x20a0
call fcn.1400ba8b0
sub rsp, rax
mov rax, qword [0x1400e0920]
xor rax, rsp
mov qword [rsp + 0x2090], rax
xor esi, esi
cmp byte [0x1400fec05], sil
je 0x140096be5
lea rdx, [rsp + 0x870]
lea rcx, [0x140105fb0]
mov r8d, 0x401
call fcn.1400129d4
lea r8d, [rsi + 1]
lea rdx, [0x1400c4b40]
lea rcx, [0x1400c40d8]
call fcn.14005c420
cmp eax, esi
setne bl
cmp bl, sil
je 0x140096a71
lea r9, [0x1400c3f4c]
lea r8, [rsp + 0x70]
lea rdx, str.SaveArcFolder
lea rcx, [0x1400c5f38]
mov dword [rsp + 0x20], 0x400
call fcn.14005c3f4
cmp word [rsp + 0x70], si
jne 0x140096a82
lea rcx, [rsp + 0x70]
call fcn.14003cf6c
mov rcx, rsi
movzx eax, word [rsp + rcx + 0x70]
add rcx, 2
mov word [rsp + rcx + 0x107e], ax
cmp ax, si
jne 0x140096a85
lea rcx, [rsp + 0x1080]
call fcn.14005254c
lea rcx, [rsp + 0x870]
call fcn.140052abc
or r12, 0xffffffffffffffff
lea rdi, [rsp + 0x1080]
mov r11, rax
xor eax, eax
mov rcx, r12
repne scasw ax, word [rdi]
xor edx, edx
movzx ecx, word [r11 + rdx]
add rdx, 2
mov word [rdi + rdx - 4], cx
test cx, cx
jne 0x140096ace
mov ecx, 0x5af
call fcn.140061d2c
mov rcx, qword [0x1400ffd80]
lea r8, [rsp + 0x1080]
mov rdx, rax
xor r9d, r9d
mov byte [rsp + 0x20], 1
call fcn.140019140
cmp al, sil
je 0x140096be5
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x1080]
mov r8d, 0x400
call fcn.140053004
cmp bl, sil
je 0x140096b48
lea r8, [rsp + 0x70]
lea rdx, str.SaveArcFolder
lea rcx, [0x1400c5f38]
call fcn.14005c3a0
xor eax, eax
lea rdi, [rsp + 0x870]
mov rcx, r12
repne scasw ax, word [rdi]
lea rdi, [rsp + 0x1080]
lea r8d, [rax + 0x38]
not rcx
xor edx, edx
mov word [rsp + rcx*2 + 0x870], si
mov rcx, r12
repne scasw ax, word [rdi]
not rcx
mov word [rsp + rcx*2 + 0x1080], si
lea rcx, [rsp + 0x30]
call fcn.1400a9164
lea rax, [rsp + 0x870]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x1080]
mov dword [rsp + 0x38], 2
mov qword [rsp + 0x48], rax
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
cmp eax, esi
je 0x140096be5
mov ecx, 0x5b0
call fcn.140061d2c
mov r8, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rcx, rax
call fcn.140095e68
lea rcx, [0x1400ec668]
call fcn.1400286c0
mov rcx, qword [rsp + 0x2090]
xor rcx, rsp
call fcn.1400a8530
lea r11, [rsp + 0x20a0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop r12
ret
Function at 0x140099ed4
Capabilities:
Copy file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
mov eax, 0x1890
call fcn.1400ba8b0
sub rsp, rax
mov rax, qword [0x1400e0920]
xor rax, rsp
mov qword [rsp + 0x1880], rax
lea rdx, str.AppDataCopied
lea rcx, [0x1400c40d8]
xor r8d, r8d
call fcn.14005c420
xor ebx, ebx
cmp eax, ebx
jne 0x14009a063
lea rdx, [rsp + 0x870]
mov r8d, 0x401
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rsp + 0x870]
lea rdi, [0x1400cc968]
call fcn.140052abc
movzx ecx, word [rdi]
add rdi, 2
mov word [rax], cx
add rax, 2
cmp cx, bx
jne 0x140099f48
lea rcx, [rsp + 0x1080]
call fcn.140053308
mov rdx, rbx
movzx eax, word [rsp + rdx + 0x1080]
add rdx, 2
mov word [rsp + rdx + 0x5e], ax
cmp ax, bx
jne 0x140099f6b
lea rcx, [rsp + 0x60]
call fcn.14005254c
xor eax, eax
or rsi, 0xffffffffffffffff
lea rdi, [rsp + 0x60]
mov rcx, rsi
repne scasw ax, word [rdi]
mov rax, qword [0x1400cc968]
lea rcx, [rsp + 0x870]
mov qword [rdi - 2], rax
mov eax, dword [0x1400cc970]
mov dword [rdi + 6], eax
movzx eax, word [0x1400cc974]
mov word [rdi + 0xa], ax
call fcn.140031110
cmp al, bl
je 0x14009a04a
lea rcx, [rsp + 0x60]
call fcn.140031110
cmp al, bl
jne 0x14009a04a
xor eax, eax
lea rdi, [rsp + 0x870]
mov rcx, rsi
repne scasw ax, word [rdi]
lea rdi, [rsp + 0x60]
lea r8d, [rsi + 0x39]
not rcx
xor edx, edx
mov word [rsp + rcx*2 + 0x870], bx
mov rcx, rsi
repne scasw ax, word [rdi]
not rcx
mov word [rsp + rcx*2 + 0x60], bx
lea rcx, [rsp + 0x20]
call fcn.1400a9164
lea rax, [rsp + 0x870]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x60]
mov dword [rsp + 0x28], 2
mov qword [rsp + 0x38], rax
lea eax, [rsi + 0x15]
mov word [rsp + 0x40], ax
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
lea rdx, str.AppDataCopied
lea rcx, [0x1400c40d8]
mov r8d, 1
call fcn.14005c3b8
mov rcx, qword [rsp + 0x1880]
xor rcx, rsp
call fcn.1400a8530
lea r11, [rsp + 0x1890]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x14009a088
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x470
mov rax, qword [0x1400e0920]
xor rax, rsp
mov qword [rsp + 0x460], rax
lea rcx, [rsp + 0x34]
mov dword [rsp + 0x30], 0x40000
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
lea r8, [rsp + 0x40]
lea rdx, str.VerInfo
lea rcx, [0x1400c40d8]
mov ebx, 0xc
xor r9d, r9d
mov dword [rsp + 0x20], ebx
call fcn.14005c438
lea rcx, [rsp + 0x60]
call fcn.140053274
lea rcx, [rsp + 0x60]
call fcn.140052f74
and dword [rsp + 0x50], 0
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x60]
lea esi, [rbx - 0xb]
repne scasb al, byte [rdi]
mov rax, qword [str.version.dat]
lea rdx, [0x1400c378c]
sub rdi, rsi
lea rcx, [rsp + 0x60]
mov qword [rdi], rax
mov eax, dword [0x1400cc9a0]
mov dword [rdi + 8], eax
call fcn.1400abbc4
mov rdi, rax
test rax, rax
je 0x14009a156
lea rcx, [rsp + 0x50]
mov r9, rax
mov r8, rbx
mov rdx, rsi
call fcn.1400a9fd4
mov rcx, rdi
call fcn.1400aa410
mov eax, dword [rsp + 0x30]
cmp dword [rsp + 0x40], eax
je 0x14009a1fd
mov r9, rbx
cmp dword [rsp + 0x50], eax
je 0x14009a1c5
lea r8, [rsp + 0x30]
lea rdx, str.VerInfo
lea rcx, [0x1400c40d8]
call fcn.14005c3d0
lea rdx, [0x1400c40f8]
lea rcx, [rsp + 0x60]
call fcn.1400abbc4
mov rdi, rax
test rax, rax
je 0x14009a1b9
lea rcx, [rsp + 0x30]
mov r9, rax
mov r8, rbx
mov rdx, rsi
call fcn.1400aa698
mov rcx, rdi
call fcn.1400aa410
and dword [0x1400fec1c], 0
jmp 0x14009a2ce
lea rcx, [rsp + 0x50]
lea rdx, [rsp + 0x40]
lea r8, [rsp + 0x50]
mov rax, qword [rcx]
mov qword [rdx], rax
mov eax, dword [rcx + 8]
lea rcx, [0x1400c40d8]
mov dword [rdx + 8], eax
lea rdx, str.VerInfo
call fcn.14005c3d0
mov eax, dword [rsp + 0x30]
cmp dword [rsp + 0x40], eax
jne 0x14009a24d
cmp dword [rsp + 0x50], eax
je 0x14009a24d
lea rcx, [rsp + 0x40]
lea rdx, [rsp + 0x50]
mov rax, qword [rcx]
mov qword [rdx], rax
mov eax, dword [rcx + 8]
lea rcx, [rsp + 0x60]
mov dword [rdx + 8], eax
lea rdx, [0x1400c40f8]
call fcn.1400abbc4
mov rdi, rax
test rax, rax
je 0x14009a24d
lea rcx, [rsp + 0x40]
mov r9, rax
mov r8, rbx
mov rdx, rsi
call fcn.1400aa698
mov rcx, rdi
call fcn.1400aa410
mov eax, dword [rsp + 0x48]
mov ecx, dword [rsp + 0x38]
sub rcx, rax
mov eax, dword [rsp + 0x44]
shl rcx, 0x20
sub rcx, rax
mov eax, dword [rsp + 0x34]
add rcx, rax
movabs rax, 0xd6bf94d5e57a42bd
imul rcx
add rdx, rcx
sar rdx, 0x17
mov rax, rdx
shr rax, 0x3f
add rdx, rax
movabs rax, 0x48d159e26af37c05
imul rdx
sar rdx, 0xa
mov rax, rdx
shr rax, 0x3f
add rdx, rax
movabs rax, 0x2aaaaaaaaaaaaaab
imul rdx
sar rdx, 2
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov eax, 0x168
test edx, edx
cmovs edx, eax
mov dword [0x1400fec1c], edx
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.1400a8530
lea r11, [rsp + 0x470]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret