joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140972188
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.14097230f
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1409721b9
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14097219f
add dl, dl
jne 0x1409721c6
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140972226
xor eax, eax
add dl, dl
jne 0x1409721d5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1409722dd
add dl, dl
jne 0x1409721e6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1409721f3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140972200
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14097220d
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x14097221a
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1409721ae
mov eax, 1
add dl, dl
jne 0x140972236
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140972243
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14097222b
sub eax, ebx
mov ebx, 1
jne 0x14097227c
mov ecx, 1
add dl, dl
jne 0x14097225e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14097226b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140972253
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1409721ae
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140972298
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1409722a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14097228d
cmp eax, 0x7d00
jae 0x1409722cb
cmp eax, 0x500
jb 0x1409722c6
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1409721ae
cmp eax, 0x7f
ja 0x1409722ce
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1409721ae
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140972302
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1409721ae
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140033910
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
mov eax, 0x10090
call fcn.14005fa80
sub rsp, rax
mov rax, qword [0x140077010]
xor rax, rsp
mov qword [rsp + 0x10080], rax
xor eax, eax
lea rsi, str.NUITKA_PYTHONPATH
mov word [rsp + 0x80], ax
lea rbx, [rsp + 0x30]
mov word [rsp + 0x30], ax
mov edi, 0x28
mov dl, 0x4e
nop dword [rax]
cmp word [rbx], 0
mov rcx, rdi
mov rax, rbx
je 0x14003397d
nop dword [rax]
add rax, 2
dec rcx
cmp word [rax], 0
jne 0x140033970
cmp rcx, 1
jb 0x140033a2a
mov byte [rsp + 0x20], dl
mov rcx, 0xffffffffffffffff
mov byte [rsp + 0x21], 0
nop word [rax + rax]
cmp word [rax + rcx*2 + 2], 0
lea rcx, [rcx + 1]
jne 0x1400339a0
lea rcx, [rax + rcx*2]
mov r8d, 2
lea rdx, [rsp + 0x20]
call fcn.140053160
movzx edx, byte [rsi + 1]
inc rsi
add rbx, 2
dec rdi
test dl, dl
jne 0x140033960
mov r8d, 0x10000
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
dec eax
cmp eax, 0xffff
ja 0x140033a26
lea rcx, [rsp + 0x80]
call fcn.140054928
mov rcx, qword [rsp + 0x10080]
xor rcx, rsp
call fcn.1400447a0
lea r11, [rsp + 0x10090]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
xor eax, eax
jmp 0x140033a01
call fcn.1400485e0
int3

Function at 0x140033a30
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x140077010]
xor rax, rsp
mov qword [rsp + 0x80], rax
xor eax, eax
lea rsi, str.NUITKA_PYTHONPATH
mov word [rsp + 0x30], ax
lea rbx, [rsp + 0x30]
mov edi, 0x28
mov dl, 0x4e
nop
cmp word [rbx], 0
mov rcx, rdi
mov rax, rbx
je 0x140033a8d
nop dword [rax]
add rax, 2
dec rcx
cmp word [rax], 0
jne 0x140033a80
cmp rcx, 1
jb 0x140033b07
mov byte [rsp + 0x20], dl
mov rcx, 0xffffffffffffffff
mov byte [rsp + 0x21], 0
cmp word [rax + rcx*2 + 2], 0
lea rcx, [rcx + 1]
jne 0x140033aa3
lea rcx, [rax + rcx*2]
mov r8d, 2
lea rdx, [rsp + 0x20]
call fcn.140053160
movzx edx, byte [rsi + 1]
inc rsi
add rbx, 2
dec rdi
test dl, dl
jne 0x140033a70
xor edx, edx
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1400447a0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
call fcn.1400485e0
int3
Function at 0x14004894c
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x1400487ab
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400487ab
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400487ab
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400487ab
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400487ab
cmp dword [rcx + 0x84], 0xe
jbe 0x1400487ab
cmp dword [rcx + 0xf8], 0
je 0x1400487ab
mov ecx, ebx
call fcn.140048868
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.140048638
nop
cmp dword [rbp + 0x20], 0
je 0x1400487f9
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140048804
int3
xor r8d, r8d
xor edx, edx
jmp 0x14004873c
Function at 0x140059834
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x1400598bb
mov rsi, rbx
cmp word [rax], bp
je 0x14005987a
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x140059864
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x140059860
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.140056eb4
mov rdi, rax
test rax, rax
je 0x1400598a8
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.1400466e0
mov rbp, rdi
xor ecx, ecx
call fcn.140055288
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x180002410
Capabilities:
Get file size

Disassembly:
xor edx, edx
lea r8d, [rdx + 0x3e]
jmp 0x1800add60
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rbx, qword [rsp + 0x98]
lea r12d, [r8 + 0x5f8]
mov ebp, r8d
mov r13, rcx
cmp r8d, r12d
jae 0x1800ade9e
mov rsi, qword [rsp + 0x98]
mov r14d, dword [rsp + 0x90]
mov rdi, qword [rsp + 0x98]
mov r15, qword [rsp + 0x98]
cmp ebp, 0x17b
ja 0x1800ade85
je 0x1800ade4b
mov eax, ebp
sub eax, 0x3e
je 0x1800ade2c
sub eax, 0x7e
je 0x1800adf25
sub eax, 0x41
je 0x1800addee
cmp eax, 0x14
jne 0x1800adf25
lea rbx, str._sError_in_calling_of_API_for_suppress_Registration_Serial_Nag
jmp 0x1800adf25
mov r9d, 0x54
mov qword [rsp + 0x30], r15
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call fcn.1800bf800
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r15
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1800adf25
mov rdx, r13
mov ecx, 0xf
call fcn.1800d0d90
mov r15, rax
test rax, rax
jne 0x1800adf25
lea rax, [r15 - 1]
jmp 0x1800adea1
mov r9d, 0xf8
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.18007f710
mov r9, rax
mov dword [rsp + 0x90], 0xffffffff
mov r8, r13
lea rdx, [rsp + 0x90]
mov ecx, 0xa5
call fcn.1800d3130
jmp 0x1800adf25
mov eax, ebp
sub eax, 0x1bc
je 0x1800adeb9
sub eax, 0x14
je 0x1800ade9e
cmp eax, 0xab
jne 0x1800adf25
mov rax, rbx
mov rbx, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
test rsi, rsi
je 0x1800adf1b
mov ebx, 0xfa
mov eax, ebx
sub eax, 0xfa
je 0x1800adefb
sub eax, 1
je 0x1800adef2
sub eax, 1
je 0x1800adee6
cmp eax, 1
jne 0x1800adf0f
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1800adf0f
shl rdi, 0x20
mov eax, r14d
add rdi, rax
jmp 0x1800adf0f
mov edi, dword [rsp + 0x98]
jmp 0x1800adf0f
lea rdx, [rsp + 0x98]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov r14d, eax
inc ebx
cmp ebx, 0xfe
jb 0x1800adec3
jmp 0x1800adf22
mov rdi, 0xffffffffffffffff
mov rbx, rdi
add ebp, 0xbf
cmp ebp, r12d
jb 0x1800addb2
jmp 0x1800ade9e
Function at 0x180024790
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
imul esi, ecx, 0x3aa
mov rbp, rdx
mov edi, ecx
mov ebx, ecx
cmp ecx, esi
ja 0x180024850
nop dword [rax]
cmp ebx, 0x4126
ja 0x1800247f2
je 0x1800247e9
cmp ebx, 0x3e
je 0x1800247e0
cmp ebx, 0x20b2
jne 0x180024840
lea rcx, str._s:_first_non_whitespace_character_is_not___
jmp 0x18002483a
lea rcx, str.________________________.___0_1_2_3_4_5_6_7_8_9_:____________A_B_C_D_E_F_G_H_I_J_K_L_M_N_O_P_Q_R_S_T_U_V_W_X_Y_Z___________a_b_c_d_e_f_g_h_i_j_k_l_m_n_o_p_q_r_s_Qt5Widgets.dll
jmp 0x18002483a
lea rcx, str.C___DEFGHIJKLMNOGGGGP_QGRGSGTUVW6XYZ
jmp 0x18002483a
cmp ebx, 0x619a
je 0x180024826
cmp ebx, 0x820e
je 0x180024865
cmp ebx, 0x8c46
jne 0x180024840
mov r8, rbp
mov dword [rsp + 0x30], pe_nt_image_headers64
mov edx, 0x75
lea rcx, [rsp + 0x30]
call fcn.1800d2280
jmp 0x180024840
lea rcx, str.r_das_Lesen_der_Eigenschaft
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_puts]
lea rcx, str.wxPropertyGridManager::SelectPage
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_puts]
imul eax, edi, 0x86
add ebx, eax
cmp ebx, esi
jbe 0x1800247c0
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x18002ea90
Capabilities:
Check for software breakpoints

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x20
imul r15d, ecx, 0x5f8
mov rdi, r8
mov r14, rdx
mov ebp, ecx
mov esi, ecx
cmp ecx, r15d
ja 0x18002eb53
mov rbx, qword [rsp + 0x68]
xor r12d, r12d
nop dword [rax + rax]
cmp esi, 0x77b0
ja 0x18002eba4
je 0x18002eb97
mov eax, esi
sub eax, 0x50
je 0x18002eb84
sub eax, 4
je 0x18002eb1e
sub eax, 0x61
je 0x18002eb16
cmp eax, 0x3b4b
jne 0x18002ec21
test rbx, rbx
je 0x18002ec40
mov rax, qword [r14]
mov qword [rbx], rax
jmp 0x18002ec21
mov r14, r12
jmp 0x18002ec21
mov eax, dword [r14]
lea r8, [rsp + 0x50]
mov rdx, rdi
mov dword [rsp + 0x50], eax
mov ecx, 0x9b
call fcn.1800b9f00
test rax, rax
jne 0x18002ec50
mov ecx, 0xbb
mov eax, ecx
sub eax, 0xbb
je 0x18002eb6f
cmp eax, 0x70
jne 0x18002eb74
mov rax, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
mov qword [rsp + 0x68], r12
add ecx, 0x70
cmp ecx, 0x19b
jb 0x18002eb45
jmp 0x18002ec21
mov ecx, 0x18
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
jmp 0x18002ec21
mov qword [rbx + 8], r12
mov rax, qword [rdi]
mov qword [rbx + 0x10], rax
jmp 0x18002ec21
cmp esi, 0x87c0
je 0x18002ec07
cmp esi, 0xb360
je 0x18002ebbe
cmp esi, 0xef10
je 0x18002eb53
jmp 0x18002ec21
cmp qword [rdi], r12
jne 0x18002ebd4
mov qword [rdi], rbx
mov qword [rdi + 8], rbx
mov dword [rsp + 0x68], 1
jmp 0x18002ec21
mov ecx, 0xc6
nop dword [rax]
cmp ecx, 0xc6
jne 0x18002ebf2
mov rax, qword [rdi]
mov qword [rax + 8], rbx
mov qword [rdi], rbx
add ecx, 6
cmp ecx, 0xcc
jb 0x18002ebe0
mov dword [rsp + 0x68], 1
jmp 0x18002ec21
mov r8, rdi
mov dword [rsp + 0x50], 8
mov edx, 0x75
lea rcx, [rsp + 0x50]
call fcn.1800d2280
imul eax, ebp, 0xbf
add esi, eax
cmp esi, r15d
jbe 0x18002ead0
jmp 0x18002eb53
mov dword [rsp + 0x68], r12d
jmp 0x18002eb53
mov rax, qword [rax]
jmp 0x18002eb58
Function at 0x18003add0
Capabilities:
Delete directory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x20
mov ebx, dword [rsp + 0x58]
lea r12d, [rdx + 0x467]
mov ebp, edx
mov rsi, rcx
cmp edx, r12d
jae 0x18003af56
mov r15, qword [rsp + 0x68]
mov r14d, dword [rsp + 0x58]
nop dword [rax]
cmp ebp, 0x12e
ja 0x18003aef1
je 0x18003aece
mov eax, ebp
sub eax, 0x8d
je 0x18003af47
sub eax, 0x5e
je 0x18003ae94
cmp eax, 0x3c
jne 0x18003af47
test rsi, rsi
je 0x18003af47
mov edi, 0xf3
nop dword [rax + rax]
mov eax, edi
sub eax, 0xf3
je 0x18003ae74
sub eax, 1
je 0x18003ae6e
cmp eax, 1
jne 0x18003ae85
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x18003ae85
mov rcx, qword [rsi + 0x28]
jmp 0x18003ae78
mov rcx, qword [rsi + 0x20]
xor r8d, r8d
mov edx, 0x127
call fcn.18003add0
inc edi
cmp edi, 0xf6
jb 0x18003ae50
jmp 0x18003af47
mov rdx, rsi
mov ecx, 0xf
call fcn.1800d0d90
mov r15, rax
test rax, rax
jne 0x18003af47
mov edx, 0x30
mov ecx, edx
sub ecx, 0x2f
je 0x18003af56
cmp ecx, 1
jne 0x18003aec5
lea ebx, [rcx - 2]
dec edx
cmp edx, 0x2e
ja 0x18003aeb2
jmp 0x18003af47
lea r9, str.PATCHABLE_RET
mov dword [rsp + 0x58], 0xffffffff
mov r8, rsi
lea rdx, [rsp + 0x58]
mov ecx, 0xa5
call fcn.1800d3130
jmp 0x18003af47
cmp ebp, 0x18c
je 0x18003af3b
cmp ebp, 0x22d
je 0x18003af6f
cmp ebp, 0x2ce
jne 0x18003af47
mov ecx, 0x101
nop
cmp ecx, 0x101
je 0x18003af22
cmp ecx, 0x9a9a
je 0x18003af56
jmp 0x18003af2d
mov eax, r14d
neg eax
sbb ebx, ebx
neg ebx
dec ebx
add ecx, 0x9999
cmp ecx, 0x13332
jbe 0x18003af10
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov r14d, eax
add ebp, 0xa1
cmp ebp, r12d
jb 0x18003ae10
mov rbp, qword [rsp + 0x60]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r15
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x18003af47
Function at 0x18003cfd0
Capabilities:
Move file

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
lea ebp, [rdx - 0xe]
mov r13, r8
mov ebx, edx
mov r14, rcx
cmp edx, ebp
jbe case.0x18003d034.7
mov r12, qword [rsp + 0x88]
lea esi, [rdx - 0x78]
mov r15, qword [rsp + 0x88]
lea r8, [0x180000000]
mov rdi, qword [rsp + 0x88]
xor edx, edx
cmp esi, 0x2c
ja case.0x18003d034.14
movzx eax, byte [r8 + rsi + 0x3d280]
mov ecx, dword [r8 + rax*4 + 0x3d244]
add rcx, r8
jmp rcx
mov dword [rsp + 0x78], edx
jmp case.0x18003d034.14
mov rdx, r14
mov ecx, 0xf
call fcn.1800d0d90
mov r12, rax
test rax, rax
jne 0x18003d220
mov eax, reloc.SHLWAPI.dll_IsCharSpaceW
nop dword [rax]
cmp eax, 0x1d
je 0x18003d084
cmp eax, 0x3a
jne 0x18003d08c
mov rax, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov dword [rsp + 0x20], 0xffffffff
add eax, 0x1d
cmp eax, 0x3a
jbe 0x18003d060
jmp 0x18003d220
mov r8, r14
mov dword [rsp + 0x88], pe_nt_image_headers64
mov edx, 0x75
lea rcx, [rsp + 0x88]
call fcn.1800d2280
xor edx, edx
mov r13d, edx
jmp 0x18003d222
test r15, r15
je case.0x18003d034.14
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r15
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x18003d220
mov eax, dword [r14]
lea r8, [rsp + 0x88]
add eax, 4
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x88], eax
mov ecx, 0xb7
call fcn.180063050
mov rdi, rax
jmp 0x18003d220
mov rdx, r13
mov ecx, 0xf
call fcn.1800d0d90
mov r15, rax
jmp 0x18003d220
mov eax, dword [rsp + 0x78]
neg eax
sbb ecx, ecx
neg ecx
dec ecx
mov dword [rsp + 0x20], ecx
jmp case.0x18003d034.14
test r15, r15
je 0x18003d150
mov rdx, r15
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_MoveFileW]
mov dword [rsp + 0x78], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r12
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x18003d220
mov eax, 0xca
nop
cmp eax, 0xca
je 0x18003d23a
add eax, 0x4248
cmp eax, 0x4248
jbe 0x18003d170
mov ecx, 0x2e
nop dword [rax]
mov eax, ecx
sub eax, 0x2d
je case.0x18003d034.7
cmp eax, 1
jne 0x18003d1a9
lea rax, [rdi + 4]
mov qword [rsp + 0x20], rax
dec ecx
cmp ecx, 0x2c
ja 0x18003d190
test rdi, rdi
jne 0x18003d1e3
mov eax, 0x25
nop word [rax + rax]
cmp eax, 0x25
je 0x18003d1d2
cmp eax, 0x378
je case.0x18003d034.7
jmp 0x18003d1d7
mov qword [rsp + 0x20], rdx
add eax, 0x353
cmp eax, 0x6a6
jbe 0x18003d1c0
mov eax, dword [r14]
mov dword [rdi], eax
jmp case.0x18003d034.14
cmp qword [rsp + 0x28], 0
je case.0x18003d034.14
lea rcx, [r14 + 0x10]
mov r9d, 0x59
lea r8, [rsp + 0x28]
xor edx, edx
call fcn.1800a62d0
jmp 0x18003d220
mov r9, qword [r14 + 0x60]
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 0x41]
call fcn.1800c1ba0
mov qword [rsp + 0x28], rax
xor edx, edx
lea r8, [0x180000000]
dec ebx
dec esi
cmp ebx, ebp
ja 0x18003d017
jmp case.0x18003d034.7
mov rax, qword [rsp + 0x28]
jmp 0x18003d06f
Function at 0x180071b50
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], r9
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rbx, qword [rsp + 0x38]
mov r12, rdx
lea edx, [r8 - 8]
mov r10, r9
mov dword [rsp + 0x90], edx
mov ebp, r8d
mov r13, rcx
cmp r8d, edx
jbe case.0x180071bb3.0
mov rsi, qword [rsp + 0x38]
lea r14d, [r8 - 0x120]
mov r15, qword [rsp + 0x38]
lea r8, [0x180000000]
cmp r14d, 0xc
ja case.0x180071bb3.5
mov ecx, dword [r8 + r14*4 + 0x71d4c]
add rcx, r8
jmp rcx
mov r9d, pe_nt_image_headers64
mov r8, r10
xor edx, edx
xor ecx, ecx
call fcn.18006e2a0
mov dword [rsp + 0x30], eax
mov r10, qword [rsp + 0x98]
mov edx, dword [rsp + 0x90]
dec ebp
dec r14d
cmp ebp, edx
ja 0x180071b9b
mov rax, rbx
mov rbx, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov rsi, r10
jmp case.0x180071bb3.5
mov edi, 0xce
nop dword [rax + rax]
mov eax, edi
sub eax, 0xce
je 0x180071c2b
sub eax, 1
je 0x180071c25
cmp eax, 1
je case.0x180071bb3.0
jmp 0x180071c74
mov ebx, dword [rsp + 0x34]
jmp 0x180071c74
mov r8d, dword [r12]
lea r9, [rsp + 0x34]
mov rcx, qword [r15 + 0x10]
mov rdx, r13
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x180071c74
mov ecx, 0xe1
mov eax, ecx
sub eax, 0xe1
je 0x180071c63
cmp eax, 1
je case.0x180071bb3.0
jmp 0x180071c6a
mov rbx, 0xffffffffffffffff
inc ecx
cmp ecx, 0xe3
jb 0x180071c53
inc edi
cmp edi, 0xd1
jb 0x180071c10
jmp 0x180071bcb
test r15, r15
je 0x180071c93
cmp dword [r15 + 8], 1
je case.0x180071bb3.5
mov rax, 0xffffffffffffffff
jmp 0x180071be6
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x180071ced
mov rdx, qword [rsp + 0x38]
mov r8d, eax
nop
mov ecx, 0x63
cmp ecx, 0x63
je 0x180071cc8
cmp ecx, 0x122
jne 0x180071cce
mov rsi, qword [rsi + 8]
jmp 0x180071cce
mov rax, qword [rsi]
mov qword [rdx], rax
add ecx, 0xbf
cmp ecx, 0x1e1
jb 0x180071cb5
add rdx, 8
sub r8, 1
jne 0x180071cb0
mov edx, dword [rsp + 0x90]
mov rbx, qword [rsp + 0x38]
jmp case.0x180071bb3.5
mov ecx, dword [rsp + 0x30]
shl rcx, 3
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [rsp + 0x38], rax
cmp rax, 0
jne 0x180071bcb
mov edx, 0xdd
nop dword [rax]
mov ecx, edx
sub ecx, 0xdc
je case.0x180071bb3.0
cmp ecx, 1
jne 0x180071d35
xor ebx, ebx
dec edx
cmp edx, 0xdb
ja 0x180071d20
jmp 0x180071bcb
mov r15, r10
jmp case.0x180071bb3.5
Function at 0x1800add60
Capabilities:
Get file size

Disassembly:
xor edx, edx
lea r8d, [rdx + 0x3e]
jmp 0x1800add60
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rbx, qword [rsp + 0x98]
lea r12d, [r8 + 0x5f8]
mov ebp, r8d
mov r13, rcx
cmp r8d, r12d
jae 0x1800ade9e
mov rsi, qword [rsp + 0x98]
mov r14d, dword [rsp + 0x90]
mov rdi, qword [rsp + 0x98]
mov r15, qword [rsp + 0x98]
cmp ebp, 0x17b
ja 0x1800ade85
je 0x1800ade4b
mov eax, ebp
sub eax, 0x3e
je 0x1800ade2c
sub eax, 0x7e
je 0x1800adf25
sub eax, 0x41
je 0x1800addee
cmp eax, 0x14
jne 0x1800adf25
lea rbx, str._sError_in_calling_of_API_for_suppress_Registration_Serial_Nag
jmp 0x1800adf25
mov r9d, 0x54
mov qword [rsp + 0x30], r15
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call fcn.1800bf800
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r15
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1800adf25
mov rdx, r13
mov ecx, 0xf
call fcn.1800d0d90
mov r15, rax
test rax, rax
jne 0x1800adf25
lea rax, [r15 - 1]
jmp 0x1800adea1
mov r9d, 0xf8
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.18007f710
mov r9, rax
mov dword [rsp + 0x90], 0xffffffff
mov r8, r13
lea rdx, [rsp + 0x90]
mov ecx, 0xa5
call fcn.1800d3130
jmp 0x1800adf25
mov eax, ebp
sub eax, 0x1bc
je 0x1800adeb9
sub eax, 0x14
je 0x1800ade9e
cmp eax, 0xab
jne 0x1800adf25
mov rax, rbx
mov rbx, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
test rsi, rsi
je 0x1800adf1b
mov ebx, 0xfa
mov eax, ebx
sub eax, 0xfa
je 0x1800adefb
sub eax, 1
je 0x1800adef2
sub eax, 1
je 0x1800adee6
cmp eax, 1
jne 0x1800adf0f
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1800adf0f
shl rdi, 0x20
mov eax, r14d
add rdi, rax
jmp 0x1800adf0f
mov edi, dword [rsp + 0x98]
jmp 0x1800adf0f
lea rdx, [rsp + 0x98]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov r14d, eax
inc ebx
cmp ebx, 0xfe
jb 0x1800adec3
jmp 0x1800adf22
mov rdi, 0xffffffffffffffff
mov rbx, rdi
add ebp, 0xbf
cmp ebp, r12d
jb 0x1800addb2
jmp 0x1800ade9e
Function at 0x1800ae5b0
Capabilities:
Get file attributes

Disassembly:
mov qword [rsp + 8], rbp
mov qword [rsp + 0x10], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
lea ebp, [r8 + 6]
mov edi, r8d
mov r12, rdx
mov r13, rcx
cmp r8d, ebp
jae case.0x1800ae613.4
mov r15d, dword [rsp + 0x90]
lea esi, [r8 - 0x101]
mov r14, qword [rsp + 0x98]
lea rdx, [0x180000000]
nop dword [rax + rax]
cmp esi, 6
ja case.0x1800ae613.5
mov ecx, dword [rdx + rsi*4 + 0xae710]
add rcx, rdx
jmp rcx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov r15d, eax
jmp 0x1800ae6c2
mov eax, r15d
and al, 0xa0
neg al
sbb ecx, ecx
neg ecx
dec ecx
mov dword [rsp + 0x98], ecx
jmp case.0x1800ae613.5
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r14
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp r15d, 0xffffffff
jmp 0x1800ae6c0
mov rax, qword [r13]
lea r8, [rsp + 0x40]
mov dword [rsp + 0x30], 0x92
xor r9d, r9d
mov qword [rsp + 0x28], 0
xor edx, edx
mov rcx, r12
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x20], 0
call fcn.1800b1250
test rax, rax
je 0x1800ae6e0
mov ecx, 0x55
cmp ecx, 0x55
je 0x1800ae6d7
add ecx, 0x2486
cmp ecx, 0x2486
jbe 0x1800ae698
jmp 0x1800ae6c2
mov rdx, r12
mov ecx, 0xf
call fcn.1800d0d90
mov r14, rax
test rax, rax
je 0x1800ae6e2
lea rdx, [0x180000000]
inc edi
inc esi
cmp edi, ebp
jb 0x1800ae600
jmp case.0x1800ae613.4
mov rax, qword [rax + 0x10]
jmp 0x1800ae6f5
jmp 0x1800ae6f5
mov dword [rsp + 0x98], 0xffffffff
mov rax, qword [rsp + 0x98]
lea r11, [rsp + 0x50]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret