joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14009fcf4
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov rbx, rcx
lea rdx, [0x140110140]
mov rcx, r8
call fcn.1400b5c3c
xor esi, esi
cmp rax, rsi
mov rdi, rax
sete r8b
mov byte [rbx + 0x3038], r8b
cmp r8b, sil
jne 0x14009ff12
lea r14d, [rsi + 1]
lea edx, [rsi + 0x16]
lea rcx, [rsp + 0x38]
mov r8, r14
mov r9, rax
call fcn.1400ef54c
cmp word [rsp + 0x38], si
jne 0x14009ff0a
cmp word [rsp + 0x3a], r14w
jne 0x14009ff0a
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call fcn.1400ef620
movzx r11d, word [rsp + 0x3c]
sub r11d, r14d
movsxd rcx, r11d
shl rcx, 4
add rcx, 0x16
call fcn.1400ea464
movzx ecx, word [rsp + 0x3c]
sub ecx, r14d
mov r15, rax
movsxd rcx, ecx
imul rcx, rcx, 0xe
add rcx, 0x14
call fcn.1400ea464
movzx ecx, word [rsp + 0x3c]
mov r9, rdi
sub ecx, r14d
mov r8, r14
mov r13, rax
movsxd rdx, ecx
mov rcx, r15
shl rdx, 4
add rdx, 0x16
call fcn.1400ef54c
mov rcx, qword [r15]
mov ebp, esi
mov qword [r13], rcx
mov rax, qword [r15 + 8]
mov qword [r13 + 8], rax
mov eax, dword [r15 + 0x10]
mov dword [r13 + 0x10], eax
cmp si, word [rsp + 0x3c]
jae 0x14009febe
movsxd rcx, ebp
lea r12d, [r14 + rbp]
mov rbx, rcx
add rbx, rbx
imul rcx, rcx, 0xe
mov rax, qword [r15 + rbx*8 + 6]
mov qword [rcx + r13 + 6], rax
mov eax, dword [r15 + rbx*8 + 0xe]
mov word [rcx + r13 + 0x12], r12w
mov dword [rcx + r13 + 0xe], eax
mov eax, dword [r15 + rbx*8 + 0xe]
mov rcx, rax
mov dword [rsp + 0x90], eax
mov qword [rsp + 0x30], rax
call fcn.1400ea464
mov rcx, rdi
mov r14, rax
cmp rax, rsi
je 0x14009ff0d
mov edx, dword [r15 + rbx*8 + 0x12]
xor r8d, r8d
call fcn.1400ef620
mov rdx, qword [rsp + 0x30]
mov r9, rdi
mov r8d, 1
mov rcx, r14
call fcn.1400ef54c
mov eax, dword [rsp + 0x90]
mov rcx, qword [rsp + 0x98]
mov dword [rsp + 0x28], eax
mov r9d, 0x400
movzx r8d, r12w
mov edx, 3
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_UpdateResourceW]
mov rcx, r14
mov ebx, eax
call fcn.1400e9aa4
cmp ebx, esi
je 0x14009ff0a
movzx eax, word [rsp + 0x3c]
mov r14d, 1
add ebp, r14d
cmp ebp, eax
jl 0x14009fdf7
mov rcx, rdi
call fcn.1400eee40
movzx r11d, word [rsp + 0x3c]
movzx r8d, word [rsp + 0xa8]
mov rcx, qword [rsp + 0x98]
sub r11d, r14d
mov r9d, 0x400
mov edx, 0xe
imul r11d, r11d, 0xe
add r11d, 0x14
mov dword [rsp + 0x28], r11d
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_UpdateResourceW]
cmp eax, esi
setne al
jmp 0x14009ff14
mov rcx, rdi
call fcn.1400eee40
xor al, al
mov rbx, qword [rsp + 0xa0]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14009ff2c
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
sub rsp, 0x30
mov r13, rdx
mov rbx, rcx
lea rdx, [0x140110140]
mov rcx, r8
mov r12d, r9d
call fcn.1400b5c3c
xor ebp, ebp
cmp rax, rbp
mov rdi, rax
sete r8b
mov byte [rbx + 0x3038], r8b
cmp r8b, bpl
jne 0x1400a0012
mov rcx, rax
call fcn.1400efacc
cmp eax, 0x42
jne 0x1400a000a
mov rcx, rdi
call fcn.1400efacc
cmp eax, 0x4d
jne 0x1400a000a
lea edx, [rbp + 2]
xor r8d, r8d
mov rcx, rdi
call fcn.1400ef620
lea ebx, [rbp + 1]
lea edx, [rbp + 4]
lea rcx, [rsp + 0x50]
mov r8, rbx
mov r9, rdi
call fcn.1400ef54c
mov r11d, dword [rsp + 0x50]
add r11d, 0xfffffff2
mov ecx, r11d
mov dword [rsp + 0x50], r11d
call fcn.1400ea464
mov rcx, rdi
mov rsi, rax
cmp rax, rbp
je 0x1400a000d
lea edx, [rbp + 0xe]
xor r8d, r8d
call fcn.1400ef620
mov r8d, dword [rsp + 0x50]
mov r9, rdi
mov rdx, rbx
mov rcx, rsi
call fcn.1400ef54c
mov ecx, dword [rsp + 0x50]
cmp rax, rcx
je 0x1400a002d
mov rcx, rsi
call fcn.1400e9aa4
mov rcx, rdi
call fcn.1400eee40
xor al, al
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r13
pop r12
pop rdi
ret
mov rcx, rdi
call fcn.1400eee40
mov ecx, dword [rsp + 0x50]
mov r9d, 0x400
mov dword [rsp + 0x28], ecx
movzx r8d, r12w
mov edx, 2
mov rcx, r13
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_UpdateResourceW]
mov rcx, rsi
mov ebx, eax
call fcn.1400e9aa4
cmp ebx, ebp
setne al
jmp 0x1400a0014

Function at 0x1400a00b0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x430
mov rax, qword [0x140132350]
xor rax, rsp
mov qword [rsp + 0x420], rax
mov rax, rdx
mov rbx, rcx
lea rdx, [0x140110140]
mov rcx, rax
call fcn.1400b5c3c
xor edi, edi
cmp rax, rdi
mov rsi, rax
sete dl
mov byte [rbx + 0x3038], dl
cmp dl, dil
je 0x1400a0103
mov al, 1
jmp 0x1400a0154
lea rcx, [rsp + 0x20]
mov r9, rax
mov edx, 1
mov r8d, 0x400
call fcn.1400ef54c
mov rcx, rsi
mov rbx, rax
call fcn.1400eee40
lea ecx, [rbx - 4]
cmp ecx, edi
jle 0x1400a0152
lea rax, [rsp + 0x21]
cmp byte [rax - 1], 0x55
jne 0x1400a0149
cmp byte [rax], 0x50
jne 0x1400a0149
cmp byte [rax + 1], 0x58
jne 0x1400a0149
cmp byte [rax + 2], 0x30
je 0x1400a00ff
inc edi
inc rax
cmp edi, ecx
jl 0x1400a0132
xor al, al
mov rcx, qword [rsp + 0x420]
xor rcx, rsp
call fcn.1400e9d00
lea r11, [rsp + 0x430]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1400a017c
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push rbx
push rsi
push rdi
mov eax, 0x2030
call fcn.1400fe810
sub rsp, rax
mov rax, qword [0x140132350]
xor rax, rsp
mov qword [rsp + 0x2020], rax
mov rax, rdx
mov rbx, rcx
lea rdx, [0x140110140]
mov rcx, rax
mov rsi, r8
call fcn.1400b5c3c
test rax, rax
mov rdi, rax
sete dl
mov byte [rbx + 0x3038], dl
test dl, dl
je 0x1400a01ce
xor al, al
jmp 0x1400a0210
mov r9, rax
mov ebx, 1
jmp 0x1400a01ee
lea rcx, [rsp + 0x20]
mov r9, rsi
mov r8, rax
mov rdx, rbx
call fcn.1400ef054
mov r9, rdi
lea rcx, [rsp + 0x20]
mov r8d, 0x2000
mov rdx, rbx
call fcn.1400ef54c
test rax, rax
jne 0x1400a01d8
mov rcx, rdi
call fcn.1400eee40
mov al, bl
mov rcx, qword [rsp + 0x2020]
xor rcx, rsp
call fcn.1400e9d00
add rsp, 0x2030
pop rdi
pop rsi
pop rbx
ret

Function at 0x1400a022c
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x2038
call fcn.1400fe810
sub rsp, rax
mov rax, qword [0x140132350]
xor rax, rsp
mov qword [rsp + 0x2020], rax
mov rax, rdx
mov rbx, rcx
lea rdx, [0x140110140]
mov rcx, rax
mov r15, r9
mov r14, r8
call fcn.1400b5c3c
test rax, rax
mov rsi, rax
sete dl
mov byte [rbx + 0x3038], dl
test dl, dl
jne 0x1400a03b1
xor r13d, r13d
mov r9, rax
lea rcx, [rsp + 0x20]
mov r8d, 0x2000
mov edx, 1
call fcn.1400ef54c
mov r12, rax
cmp rax, 0x28
jbe 0x1400a03a9
lea rbp, [rax - 0x28]
xor edi, edi
test rbp, rbp
je 0x1400a035c
lea rbx, [rsp + 0x24]
cmp byte [rsp + rdi + 0x20], 0x2a
jne 0x1400a02f3
cmp byte [rsp + rdi + 0x21], 0x2a
jne 0x1400a02f3
lea rcx, [rsp + rdi + 0x22]
lea rdx, str.messages
mov r8d, 0xc
call fcn.1400ed110
test eax, eax
je 0x1400a0377
cmp word [rbx - 4], 0x2a
jne 0x1400a031a
cmp word [rbx - 2], 0x2a
jne 0x1400a031a
lea rdx, [0x14010df70]
mov r8d, 0xc
mov rcx, rbx
call fcn.1400ee530
test eax, eax
je 0x1400a0377
mov eax, 0xfeff
cmp word [rbx - 4], ax
jne 0x1400a034c
cmp word [rbx - 2], 0x2a
jne 0x1400a034c
cmp word [rbx], 0x2a
jne 0x1400a034c
lea rcx, [rbx + 2]
lea rdx, [0x14010df70]
mov r8d, 0xc
call fcn.1400ee530
test eax, eax
je 0x1400a0377
inc rdi
add rbx, 2
cmp rdi, rbp
jb 0x1400a02c6
lea r13d, [r13 + r12 - 0x28]
xor r8d, r8d
mov rcx, rsi
mov edx, r13d
call fcn.1400ef620
mov r9, rsi
jmp 0x1400a0290
lea edx, [rdi + r13]
xor r8d, r8d
mov rcx, rsi
call fcn.1400ef620
mov r9, rsi
mov r8, r15
mov edx, 1
mov rcx, r14
call fcn.1400ef54c
mov rcx, rsi
mov rbx, rax
call fcn.1400eee40
mov rax, rbx
jmp 0x1400a03b3
mov rcx, rsi
call fcn.1400eee40
xor eax, eax
mov rcx, qword [rsp + 0x2020]
xor rcx, rsp
call fcn.1400e9d00
add rsp, 0x2038
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400a03d8
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r13
push r14
mov eax, 0x2030
call fcn.1400fe810
sub rsp, rax
mov rax, qword [0x140132350]
xor rax, rsp
mov qword [rsp + 0x2020], rax
mov rax, rdx
mov rbx, rcx
lea rdx, [0x140112a08]
mov rcx, rax
call fcn.1400b5c3c
test rax, rax
mov rsi, rax
sete dl
mov byte [rbx + 0x3038], dl
test dl, dl
jne 0x1400a04fc
xor r13d, r13d
mov r9, rax
lea r14d, [r13 + 1]
lea rcx, [rsp + 0x20]
mov r8d, 0x2000
mov rdx, r14
call fcn.1400ef54c
mov r12, rax
cmp rax, 0x20
jbe 0x1400a04f4
lea ebp, [r12 - 0x20]
xor edi, edi
test ebp, ebp
jle 0x1400a04a2
lea rbx, [rsp + 0x21]
cmp byte [rbx - 1], 0x61
jne 0x1400a0498
cmp byte [rbx], 0x73
jne 0x1400a0498
movsxd rax, edi
lea rdx, str.Invoker_
mov r8d, 0x14
lea rcx, [rsp + rax + 0x22]
call fcn.1400ed110
test eax, eax
je 0x1400a04ba
add edi, r14d
add rbx, r14
cmp edi, ebp
jl 0x1400a046f
lea r13d, [r13 + r12 - 0x20]
xor r8d, r8d
mov rcx, rsi
mov edx, r13d
call fcn.1400ef620
mov r9, rsi
jmp 0x1400a043f
lea edx, [rdi + r13]
xor r8d, r8d
mov rcx, rsi
call fcn.1400ef620
lea rcx, str.requireAdministrator_
mov r9, rsi
mov r8d, 0x15
mov rdx, r14
call fcn.1400ef054
mov rcx, rsi
cmp rax, 0x15
sete bl
call fcn.1400eee40
mov al, bl
jmp 0x1400a04fe
mov rcx, rsi
call fcn.1400eee40
xor al, al
mov rcx, qword [rsp + 0x2020]
xor rcx, rsp
call fcn.1400e9d00
lea r11, [rsp + 0x2030]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x1400a17f8
Capabilities:
Set registry value

Disassembly:
sub rsp, 0x28
mov r8, qword [0x1401855b8]
mov rcx, qword [str.SFXDefault]
lea rdx, [0x1401106e8]
call fcn.14009b7f0
mov r11, qword [0x1401855b8]
mov rcx, qword [str.SFXDefault]
mov r8d, dword [r11 + 0x1000]
lea rdx, str.PathType
call fcn.14009b808
mov r11, qword [0x1401855b8]
mov rcx, qword [str.SFXDefault]
movzx r8d, byte [r11 + 0x1004]
lea rdx, str.SavePath
call fcn.14009b808
mov r8, qword [0x1401855b8]
mov rcx, qword [str.SFXDefault]
lea rdx, [0x14010eb80]
add r8, 0x1006
call fcn.14009b7f0
mov r8, qword [0x1401855b8]
mov rcx, qword [str.SFXDefault]
lea rdx, str.Presetup
add r8, 0x11006
call fcn.14009b7f0
mov r11, qword [0x1401855b8]
mov rcx, qword [str.SFXDefault]
movzx r8d, byte [r11 + 0x21006]
lea rdx, str.SetupCode
call fcn.14009b808
mov r11, qword [0x1401855b8]
mov rcx, qword [str.SFXDefault]
movzx r8d, byte [r11 + 0x21007]
lea rdx, str.TempMode
call fcn.14009b808
mov r8, qword [0x1401855b8]
mov rcx, qword [str.SFXDefault]
lea rdx, str.TempModeQuestion
add r8, 0x21008
call fcn.14009b7f0
mov r8, qword [0x1401855b8]
mov rcx, qword [str.SFXDefault]
lea rdx, str.TempModeTitle
add r8, 0x21808
call fcn.14009b7f0
mov r11, qword [0x1401855b8]
mov rcx, qword [str.SFXDefault]
mov r8d, dword [r11 + 0x21a08]
lea rdx, str.Silent
call fcn.14009b808
mov r11, qword [0x1401855b8]
mov rcx, qword [str.SFXDefault]
mov r8d, dword [r11 + 0x21a0c]
lea rdx, str.Overwrite
call fcn.14009b808
mov r11, qword [0x1401855b8]
mov rcx, qword [str.SFXDefault]
movzx r8d, byte [r11 + 0x21a11]
lea rdx, str.UpdateFiles
call fcn.14009b808
mov r11, qword [0x1401855b8]
mov rcx, qword [str.SFXDefault]
movzx r8d, byte [r11 + 0x21a10]
lea rdx, str.FreshFiles
call fcn.14009b808
mov r8, qword [0x1401855b8]
mov rcx, qword [str.SFXDefault]
lea rdx, str.DelFiles
add r8, 0x21a12
call fcn.14009b7f0
mov r8, qword [0x1401855b8]
mov rcx, qword [str.SFXDefault]
lea rdx, str.Title
add r8, 0x23a12
call fcn.14009b7f0
mov r8, qword [0x1401855b8]
mov rcx, qword [str.SFXDefault]
lea rdx, [0x140112c68]
add r8, 0x23c12
call fcn.14009b7f0
mov r8, qword [0x1401855b8]
add r8, 0x43c12
mov rcx, qword [str.SFXDefault]
lea rdx, str.LicenseTitle
call fcn.14009b7f0
mov r8, qword [0x1401855b8]
mov rcx, qword [str.SFXDefault]
lea rdx, str.LicenseText
add r8, 0x43e12
call fcn.14009b7f0
mov r8, qword [0x1401855b8]
mov rcx, qword [str.SFXDefault]
lea rdx, str.ShortcutText
add r8, 0x63e12
call fcn.14009b7f0
mov rcx, qword [str.SFXDefault]
lea r8, [0x140171eda]
lea rdx, str.SFXLogo
call fcn.14009b7f0
mov rcx, qword [str.SFXDefault]
lea r8, [0x140170eda]
lea rdx, str.SFXIcon
call fcn.14009b7f0
movzx r8d, byte [0x140172eda]
mov rcx, qword [str.SFXDefault]
lea rdx, str.SFXElevate
call fcn.14009b808
mov rcx, qword [str.SFXDefault]
lea r8, [0x140169b08]
lea rdx, str.SFXModule
add rsp, 0x28
jmp fcn.14009b7f0
Function at 0x1400a1c40
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x2030
call fcn.1400fe810
sub rsp, rax
mov rax, qword [0x140132350]
xor rax, rsp
mov qword [rsp + 0x2020], rax
lea rdx, [0x140110140]
call fcn.1400423b4
mov rsi, rax
test rax, rax
je 0x1400a1d26
xor r12d, r12d
xor r13d, r13d
lea ebx, [r12 + 1]
lea rcx, [rsp + 0x20]
mov r9, rsi
mov r8d, 0x2000
mov rdx, rbx
call fcn.1400ef54c
cmp eax, 0x20
mov r15, rax
jle 0x1400a1d1a
lea r14d, [rax - 0x20]
xor ebp, ebp
test r14d, r14d
jle 0x1400a1cfb
lea rdi, [rsp + 0x21]
cmp byte [rdi - 1], 0x72
jne 0x1400a1cf1
cmp byte [rdi], 0x65
jne 0x1400a1cf1
movsxd rax, ebp
lea rdx, str.quireAdministrator_
mov r8d, 0x14
lea rcx, [rsp + rax + 0x22]
call fcn.1400ed110
test eax, eax
je 0x1400a1d1c
add ebp, ebx
add rdi, rbx
cmp ebp, r14d
jl 0x1400a1cc8
lea r12d, [r12 + r15 - 0x20]
xor r8d, r8d
mov rcx, rsi
mov edx, r12d
call fcn.1400ef620
add r13d, ebx
cmp r13d, 0x80
jb 0x1400a1c9a
xor bl, bl
mov rcx, rsi
call fcn.1400eee40
mov al, bl
mov rcx, qword [rsp + 0x2020]
xor rcx, rsp
call fcn.1400e9d00
lea r11, [rsp + 0x2030]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1400a3d3c
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x180
mov rax, qword [0x140132350]
xor rax, rsp
mov qword [rsp + 0x170], rax
xor ebp, ebp
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
cmp qword [0x140130550], rbp
jne 0x1400a3db1
lea r9d, [rbp + 0x64]
lea r8, [rsp + 0xa0]
lea edx, [rbp + 0xf]
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
movzx r11d, word [rsp + 0xa0]
lea rax, [0x1401855e0]
mov word [0x1401855e0], r11w
mov word [0x1401855e2], bp
mov qword [0x140130550], rax
lea rdx, [rsp + 0x30]
mov r8d, 0x32
mov rcx, rsi
call fcn.140065df0
lea r9, [0x140130538]
lea r8, [rsp + 0x30]
xor edx, edx
mov ecx, 0x400
mov dword [rsp + 0x28], edi
mov word [rbx], bp
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_GetNumberFormatW]
mov word [rbx + rdi*2 - 2], bp
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1400e9d00
mov rbx, qword [rsp + 0x1b8]
add rsp, 0x180
pop rdi
pop rsi
pop rbp
ret

Function at 0x1400a41fc
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, r8
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
mov rsi, rax
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
test eax, eax
jle 0x1400a427a
lea edi, [rax + 1]
mov eax, 2
movsxd rcx, edi
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.1400e9a64
mov rbx, rax
test rax, rax
je 0x1400a427a
mov r8d, edi
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetWindowTextW]
xor r9d, r9d
xor r8d, r8d
mov rdx, rbp
mov rcx, rbx
call fcn.1400a40a0
mov rcx, rbx
call fcn.1400ea9fc
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400a5c0c
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x80
mov edi, edx
mov rbx, rcx
cmp edx, 0xa9
jne 0x1400a5c37
call fcn.1400a5bb4
mov al, 1
jmp 0x1400a5d5b
cmp edx, 0xaa
jne 0x1400a5c6f
mov ecx, 0x4f9
call fcn.14005fad0
xor r9d, r9d
xor edx, edx
mov r8, rax
lea rax, [0x1401096a0]
xor ecx, ecx
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x1400a5c30
call fcn.1400a4290
mov rsi, rax
cmp edi, 0xab
jne 0x1400a5c8f
or dword [rbx + 0x100], 0xffffffff
lea rax, [0x1401096a0]
jmp 0x1400a5d08
lea eax, [rdi - 0x3e8]
cmp eax, 0x7f
ja 0x1400a5d59
xor edx, edx
lea rcx, [rsp + 0x30]
lea r8d, [rdx + 0x50]
call fcn.1400ea880
lea r9, [rsp + 0x30]
xor r8d, r8d
mov edx, edi
mov rcx, rsi
mov dword [rsp + 0x30], 0x50
mov dword [rsp + 0x34], 0x20
call qword [sym.imp.USER32.dll_GetMenuItemInfoW]
test eax, eax
je 0x1400a5d59
mov rax, qword [rbx + 0xe8]
cmp qword [rsp + 0x60], rax
jae 0x1400a5d59
movsxd rax, dword [rsp + 0x60]
mov rcx, rax
mov dword [rbx + 0x100], eax
imul rcx, rcx, 0x1304
add rcx, qword [rbx + 0xe0]
call fcn.140050ce0
lea rdx, str.ActivePath
lea rcx, str.InterfaceThemes
mov r8, rax
call fcn.14009b7f0
mov edx, dword [rbx + 0x1104]
cmp edx, 0xffffffff
je 0x1400a5d35
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.USER32.dll_CheckMenuItem]
mov r8d, 8
mov edx, edi
mov rcx, rsi
call qword [sym.imp.USER32.dll_CheckMenuItem]
mov rcx, rbx
mov dword [rbx + 0x1104], edi
call fcn.1400a4e94
jmp 0x1400a5c30
xor al, al
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret

Function at 0x1400a5df8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov ecx, r9d
mov dil, r8b
mov ebx, edx
call qword [sym.imp.USER32.dll_GetSysColor]
and dword [rsp + 0x30], 0
lea rcx, [rbx + rbx*4]
add rcx, rcx
mov dword [rsp + 0x34], eax
lea rax, [0x140130580]
test dil, dil
je 0x1400a5e32
mov ebx, dword [rax + rcx*8 + 4]
jmp 0x1400a5e36
mov ebx, dword [rax + rcx*8 + 8]
test dil, dil
jne 0x1400a5e75
mov rcx, qword [0x140149ef8]
movsxd rdx, ebx
mov r8d, 2
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rcx, qword [0x140149ef8]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x1400a5e6d
cmp word [rax + 0xe], 8
je 0x1400a5e75
mov dword [rsp + 0x30], 0x800080
mov rcx, qword [0x140149ef8]
lea r9, [rsp + 0x30]
movsxd rdx, ebx
xor r8d, r8d
mov dword [rsp + 0x20], 1
call qword [sym.imp.COMCTL32.dll_CreateMappedBitmap]
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x1400a7dcc
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r14
sub rsp, 0xf0
mov rdi, rcx
mov rcx, qword [rcx + 8]
test rcx, rcx
je 0x1400a7dfe
call qword [sym.imp.USER32.dll_DestroyWindow]
and qword [rdi + 8], 0
mov r14d, 1
lea rdx, str.ViewSmall
lea rcx, str.GeneralToolbar
mov r8d, r14d
call fcn.14009b870
test eax, eax
je 0x1400a803e
and qword [rsp + 0x58], 0
mov rax, qword [0x140149ef0]
lea rdx, str.ToolbarWindow32
mov qword [rsp + 0x50], rax
mov rax, qword [0x140158330]
mov qword [rsp + 0x48], 0xd
mov qword [rsp + 0x40], rax
and dword [rsp + 0x38], 0
and dword [rsp + 0x30], 0
and dword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
mov r9d, 0x56000944
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.USER32.dll_CreateWindowExW]
lea r8d, [r14 + 0x1f]
xor r9d, r9d
mov rcx, rax
mov edx, 0x41e
mov qword [rdi + 8], rax
call qword [sym.imp.USER32.dll_SendMessageW]
call fcn.1400b6a28
lea esi, [r14 + 0xf]
mov r12b, al
mov ebp, esi
test al, al
je 0x1400a7eb2
mov ecx, esi
call fcn.1400b6950
mov ecx, esi
mov ebp, eax
call fcn.1400b6950
mov esi, eax
movzx edx, si
movzx ecx, bp
xor r8d, r8d
shl edx, 0x10
or edx, ecx
mov rcx, qword [rdi + 8]
movsxd rbx, edx
mov edx, 0x41f
mov r9, rbx
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rdi + 8]
mov r9, rbx
xor r8d, r8d
mov edx, 0x420
call qword [sym.imp.USER32.dll_SendMessageW]
xor r9d, r9d
lea rdx, str.FolderUp.bmp
lea r8d, [r9 + 0xf]
lea rcx, [0x1401679a0]
call fcn.1400a56a8
mov rbx, rax
test rax, rax
jne 0x1400a7f10
mov rbx, qword [rdi + 0x30]
test r12b, r12b
je 0x1400a7f34
mov r8d, esi
mov edx, ebp
mov rcx, rbx
call fcn.1400b6a9c
lea rcx, [0x1401679a0]
mov rdx, rax
mov rbx, rax
call fcn.1400a50dc
mov rcx, qword [rdi + 8]
and qword [rsp + 0x60], 0
lea r9, [rsp + 0x60]
mov r8, r14
mov edx, 0x413
mov qword [rsp + 0x68], rbx
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rdi + 8]
lea r9, [0x140130bc0]
mov r8, r14
mov edx, 0x444
call qword [sym.imp.USER32.dll_SendMessageW]
mov ebx, 2
lea r8, [rsp + 0x80]
mov edx, ebx
mov rcx, rdi
call fcn.1400a6fd0
mov eax, dword [rsp + 0x88]
lea ecx, [rbx + 0x10]
test eax, eax
mov dword [rsp + 0x80], 0x4c
mov dword [rsp + 0x84], 0x173
cmove eax, r14d
and dword [rsp + 0xb0], 0
mov dword [rsp + 0xc8], ebx
or eax, 4
mov dword [rsp + 0x88], eax
mov rax, qword [rdi + 8]
mov qword [rsp + 0xa8], rax
call qword [sym.imp.USER32.dll_GetSysColor]
lea ecx, [rbx + 0xd]
mov dword [rsp + 0x8c], eax
call qword [sym.imp.USER32.dll_GetSysColor]
lea ecx, [rbx + 0x26]
mov dword [rsp + 0x90], eax
mov eax, dword [rsp + 0xb8]
lea rdx, [rsp + 0x70]
test eax, eax
cmove eax, ecx
mov rcx, qword [0x140158338]
mov dword [rsp + 0xb8], eax
call qword [sym.imp.USER32.dll_GetClientRect]
mov r11d, dword [rsp + 0x7c]
mov rcx, qword [rdi + 0x10]
lea r9, [rsp + 0x80]
or r8, 0xffffffffffffffff
mov edx, 0x40a
mov dword [rsp + 0xb4], r11d
call qword [sym.imp.USER32.dll_SendMessageW]
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop r12
pop rdi
ret
Function at 0x1400aa810
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rdi
push r12
push r13
mov eax, 0x2040
call fcn.1400fe810
sub rsp, rax
mov rax, qword [0x140132350]
xor rax, rsp
mov qword [rsp + 0x2030], rax
xor ebx, ebx
mov r8, rcx
cmp dword [rcx + 0x4c], ebx
je 0x1400aaa39
cmp byte [rcx + 0x49], bl
je 0x1400aaa39
cmp dword [rdx + 0x10], 6
jb 0x1400aaa39
mov rax, qword [rdx]
mov ecx, 0x400c
cmp word [rax + 0x78], cx
jne 0x1400aaa39
mov rax, qword [rax + 8]
or ecx, 0xffffffff
lea edi, [rbx + 5]
mov word [rax], cx
cmp dword [r8 + 0x4c], 2
mov rax, qword [rdx]
mov rcx, qword [rax + 0x80]
mov rbp, qword [rcx + 8]
jne 0x1400aa89a
call fcn.1400a9fb0
mov edi, eax
mov edx, edi
lea r13, str.open
lea r12, [0x1401096a0]
cmp edi, ebx
je 0x1400aa9e6
sub edx, 1
je 0x1400aa9b4
sub edx, 1
je 0x1400aa98f
cmp edx, 2
jne 0x1400aaa0b
lea r9, [rsp + 0x30]
lea rdx, str.http_shellopencommand
mov r8, r12
mov rcx, 0xffffffff80000000
mov dword [rsp + 0x28], 0x800
mov qword [rsp + 0x20], r12
call fcn.14009b00c
mov edx, 0x22
cmp word [rsp + 0x30], dx
jne 0x1400aaa1b
lea rcx, [rsp + 0x32]
call fcn.1400ed378
mov rdi, rax
cmp rax, rbx
je 0x1400aaa1b
lea rcx, [rsp + 0x30]
call fcn.140050ce0
lea rdx, str.opera.exe
mov r8d, 9
mov rcx, rax
call fcn.140068cd4
cmp eax, ebx
jne 0x1400aaa1b
lea r8, str._newwindow__s
lea rcx, [rsp + 0x1030]
mov r9, rbp
mov edx, 0x800
mov word [rdi + 2], bx
call fcn.140057264
lea r8, [rsp + 0x30]
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x1030]
mov rdx, r13
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rbx, rax
jmp 0x1400aaa15
lea r8, str.__new_window__s
lea rcx, [rsp + 0x1030]
mov r9, rbp
mov edx, 0x800
call fcn.140057264
lea r8, str.chrome.exe
jmp 0x1400aa967
lea r8, str._new_window__s
lea rcx, [rsp + 0x1030]
mov r9, rbp
mov edx, 0x800
call fcn.140057264
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r12
lea r8, str.firefox.exe
jmp 0x1400aa974
lea r8, str.iexplore.exe
mov r9, rbp
mov rdx, r13
xor ecx, ecx
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r12
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rbx, rax
cmp edi, 5
je 0x1400aaa1b
cmp edi, 3
je 0x1400aaa1b
cmp rbx, 0x20
ja 0x1400aaa39
xor r9d, r9d
mov r8, rbp
mov rdx, r13
xor ecx, ecx
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r12
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rcx, qword [rsp + 0x2030]
xor rcx, rsp
call fcn.1400e9d00
lea r11, [rsp + 0x2040]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r13
pop r12
pop rdi
ret