joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14004fc10
Capabilities:
Set file attributes

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x70
mov rax, qword [0x1400cd548]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov ebp, r9d
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
mov edx, 0x80
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
xor r14d, r14d
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rdi], rax
cmp rax, 0xffffffffffffffff
jne 0x14004fcb8
call fcn.1400588c0
mov rcx, rax
mov qword [rsp + 0x30], rsi
lea rax, str.Failed_to_open_file__s_for_writing
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x1e9
lea r9, str.D:uworkspace_nViewBranchBuilder_sw_nview_v200_nViewAPIProfileFile.cpp
lea r8, str.ProfileFileWrite::openNewFile
lea edx, [r14 + 1]
call fcn.140058e40
xor al, al
jmp 0x14004fd6a
mov r8b, 1
movzx edx, byte [rsp + 0xc0]
mov rcx, rdi
call fcn.1400504d0
xor edx, edx
mov rcx, rdi
call fcn.140050710
mov edx, ebp
mov rcx, rdi
call fcn.140050310
mov edx, 4
mov rcx, rdi
call fcn.140050710
mov edx, 0x4fa3
mov rcx, rdi
call fcn.140050310
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], r14w
test rbx, rbx
je 0x14004fd38
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rbx + r8*2], 0
jne 0x14004fd20
mov rdx, rbx
lea rcx, [rsp + 0x40]
call fcn.14000d670
lea r8, [rsp + 0x40]
mov edx, 1
mov rcx, rdi
call fcn.1400503c0
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x14004fd68
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
call fcn.140006ee0
mov al, 1
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14006ed70
add rsp, 0x70
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140050130
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
xor ebp, ebp
mov edi, r8d
mov rbx, rcx
mov qword [rcx + 0x20], rbp
mov qword [rcx + 0x28], rbp
mov rsi, rdx
mov qword [rcx + 0x30], rbp
mov dword [rcx + 0x38], ebp
mov qword [rcx + 0x40], rbp
mov dword [rcx + 0x48], ebp
mov qword [rcx + 0x50], rbp
mov rax, qword [rbx + 8]
mov rcx, qword [rcx]
sub rax, rcx
mov edx, r8d
sar rax, 1
shr rdx, 1
cmp rdx, rax
jbe 0x14005018c
mov rcx, rbx
call fcn.140050220
mov rcx, qword [rbx]
mov rdx, rcx
mov dword [rsp + 0x60], ebp
mov rcx, rsi
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x60]
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [rsp + 0x60]
cmp edi, eax
je 0x1400501f3
call fcn.1400588c0
mov rcx, rax
lea r9, str.D:uworkspace_nViewBranchBuilder_sw_nview_v200_nViewAPIProfileFile.cpp
mov eax, dword [rsp + 0x60]
lea r8, str.ReadLineBuffer::readLine
mov dword [rsp + 0x38], eax
mov edx, 1
lea rax, str.read_error:_expected__i_bytes__got__i
mov dword [rsp + 0x30], edi
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x123
call fcn.140058e40
jmp 0x140050205
mov rcx, rax
shr rcx, 1
mov qword [rbx + 0x18], rcx
mov rax, qword [rbx]
mov word [rax + rcx*2 - 2], bp
mov eax, dword [rsp + 0x60]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret

Function at 0x140050290
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov rax, qword [rcx + 0x18]
lea r9, [rsp + 0x40]
mov rdi, rdx
mov dword [rsp + 0x40], 0
add rax, rax
mov qword [rsp + 0x20], 0
mov rbx, rcx
mov qword [rsp + 0x50], rax
mov r8d, 2
lea rdx, [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov r8d, dword [rsp + 0x50]
lea r9, [rsp + 0x40]
mov rdx, qword [rbx]
mov rcx, rdi
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rbx, qword [rsp + 0x48]
cmp eax, 1
sete al
add rsp, 0x30
pop rdi
ret

Function at 0x140050310
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x90
mov rax, qword [0x1400cd548]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rbx, rcx
lea r8, [0x1400b9b40]
mov r9d, edx
lea rcx, [rsp + 0x40]
mov edx, 0x40
call fcn.140007050
mov edx, 0x20
lea rax, [rsp + 0x40]
mov ecx, edx
cmp word [rax], 0
je 0x140050363
add rax, 2
sub rcx, 1
jne 0x140050353
xor eax, eax
test rcx, rcx
je 0x140050379
sub rdx, rcx
add rdx, rdx
test rcx, rcx
cmove rdx, rax
jmp 0x14005037c
mov rdx, rax
mov rcx, qword [rbx]
lea r9, [rsp + 0x30]
mov r8d, edx
mov dword [rsp + 0x30], eax
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14006ed70
add rsp, 0x90
pop rbx
ret
Function at 0x1400503c0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov rbx, r8
mov rdi, rcx
call fcn.140050710
xor eax, eax
mov rdx, rbx
cmp qword [rbx + 0x18], 8
mov dword [rsp + 0x40], eax
jb 0x1400503e8
mov rdx, qword [rbx]
mov r8d, dword [rbx + 0x10]
lea r9, [rsp + 0x40]
mov rcx, qword [rdi]
add r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x1400504d0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x90
mov rax, qword [0x1400cd548]
xor rax, rsp
mov qword [rsp + 0x80], rax
xorps xmm0, xmm0
lea rax, str.NVIEW_PROFILE_LOCK
test dl, dl
lea r9, str.NVIEW_PROFILE_FILE
movzx ebx, r8b
mov rdi, rcx
cmovne r9, rax
lea r8, [0x14009e670]
mov edx, 0x20
lea rcx, [rsp + 0x40]
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
call fcn.140004b70
mov rcx, qword [rdi]
lea r9, [rsp + 0x30]
mov r8d, 0x40
mov qword [rsp + 0x20], 0
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test bl, bl
je 0x14005059c
lea r9, str.ProfileFormat_5
mov edx, 0x20
lea r8, [0x14009e670]
lea rcx, [rsp + 0x40]
call fcn.140004b70
mov rcx, qword [rdi]
lea r9, [rsp + 0x30]
mov r8d, 0x40
mov qword [rsp + 0x20], 0
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14006ed70
mov rbx, qword [rsp + 0xb0]
add rsp, 0x90
pop rdi
ret
Function at 0x1400505c0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rdi
push r14
push r15
sub rsp, 0x30
mov rbp, r8
lea rax, [rsp + 0x60]
mov r14, rdx
mov qword [rsp + 0x28], rax
xor r15d, r15d
lea r9, [rsp + 0x78]
mov rdi, rcx
mov qword [rsp + 0x20], r15
mov rdx, rbp
mov dword [rsp + 0x60], r15d
mov rcx, r14
mov dword [rsp + 0x78], r15d
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rdx, qword [rdi + 0x18]
mov r8, qword [rdi]
mov eax, dword [rsp + 0x78]
lea rbx, [r8 + rdx*2]
cmp eax, 4
jne 0x140050653
mov rdx, rbp
mov rcx, r14
call fcn.140059b20
mov ecx, 4
mov word [rbx], cx
mov ecx, eax
shr ecx, 0x10
mov word [rbx + 4], ax
mov al, 1
mov word [rbx + 2], cx
mov dword [rbx + 6], 0xa
add qword [rdi + 0x18], 4
add rsp, 0x30
pop r15
pop r14
pop rdi
pop rbp
pop rbx
ret
cmp eax, 0xb
jne 0x140050684
mov rdx, rbp
mov word [rbx], ax
mov rcx, r14
call fcn.140059ba0
mov qword [rbx + 2], rax
mov al, 1
mov dword [rbx + 0xa], 0xa
add qword [rdi + 0x18], 6
add rsp, 0x30
pop r15
pop r14
pop rdi
pop rbp
pop rbx
ret
cmp eax, 1
jne 0x1400506fe
mov rcx, qword [rdi + 8]
mov qword [rsp + 0x68], rsi
sub rcx, r8
mov esi, dword [rsp + 0x60]
shr esi, 1
add esi, 2
sar rcx, 1
mov eax, esi
sub rcx, rdx
cmp rcx, rax
jbe 0x1400506eb
mov eax, 1
lea r9, [rsp + 0x78]
mov word [rbx], ax
xor r8d, r8d
lea rax, [rsp + 0x60]
add rbx, 2
mov qword [rsp + 0x28], rax
mov rdx, rbp
mov rcx, r14
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [rsi - 1]
add qword [rdi + 0x18], rcx
lea ecx, [rsi - 2]
mov dword [rbx + rcx*2], 0xa
mov rsi, qword [rsp + 0x68]
mov al, 1
add rsp, 0x30
pop r15
pop r14
pop rdi
pop rbp
pop rbx
ret
xor al, al
add rsp, 0x30
pop r15
pop r14
pop rdi
pop rbp
pop rbx
ret

Function at 0x140050710
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
xor esi, esi
movsxd rbx, edx
mov rdi, rcx
mov dword [rsp + 0x48], esi
mov rcx, qword [rcx]
lea r9, [rsp + 0x48]
lea rdx, [0x1400a3030]
mov qword [rsp + 0x20], rsi
lea r8d, [rsi + 4]
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea r10, str.aProfileFlags
mov r10, qword [r10 + rbx*8]
test r10, r10
je 0x140050786
mov edx, 0x82
mov rax, r10
mov ecx, edx
cmp word [rax], si
je 0x140050772
add rax, 2
sub rcx, 1
jne 0x140050763
test rcx, rcx
je 0x140050786
sub rdx, rcx
add rdx, rdx
test rcx, rcx
cmove rdx, rsi
jmp 0x140050789
mov rdx, rsi
mov rcx, qword [rdi]
lea r9, [rsp + 0x48]
mov r8d, edx
mov qword [rsp + 0x20], rsi
mov rdx, r10
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x1400510c0
Capabilities:
Check if file exists
Get common file path

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x250
mov rax, qword [0x1400cd548]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov ebx, r8d
mov rsi, rdx
mov rdi, rcx
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x30]
mov rbp, r9
call fcn.140070390
lea rax, [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, ebx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x1400511a3
mov rax, rsi
mov r8d, 0x7ffffffe
shr rax, 1
lea rcx, [rax - 1]
cmp rcx, r8
ja 0x140051176
sub r8, rax
lea r9, [rsp + 0x30]
sub r9, rdi
mov rdx, rdi
lea rcx, [r8 + rax]
test rcx, rcx
je 0x140051164
movzx ecx, word [r9 + rdx]
test cx, cx
je 0x140051164
mov word [rdx], cx
add rdx, 2
sub rax, 1
jne 0x140051144
test rax, rax
lea rcx, [rdx - 2]
cmovne rcx, rdx
xor eax, eax
mov word [rcx], ax
jmp 0x140051180
test rax, rax
je 0x140051180
xor eax, eax
mov word [rdi], ax
mov r8, rbp
mov rdx, rsi
mov rcx, rdi
call fcn.140050950
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400511a3
mov eax, 1
jmp 0x1400511a5
xor eax, eax
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.14006ed70
mov rbx, qword [rsp + 0x288]
add rsp, 0x250
pop rdi
pop rsi
pop rbp
ret
lea r9, str.NVIDIA_Corporation_nView
mov r8d, 0x23
jmp 0x1400510c0

Function at 0x1400511d0
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x250
mov rax, qword [0x1400cd548]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov ebx, r8d
mov rsi, rdx
mov rdi, rcx
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x30]
mov rbp, r9
call fcn.140070390
lea rax, [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, ebx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x1400511a3
mov rax, rsi
mov r8d, 0x7ffffffe
shr rax, 1
lea rcx, [rax - 1]
cmp rcx, r8
ja 0x140051176
sub r8, rax
lea r9, [rsp + 0x30]
sub r9, rdi
mov rdx, rdi
lea rcx, [r8 + rax]
test rcx, rcx
je 0x140051164
movzx ecx, word [r9 + rdx]
test cx, cx
je 0x140051164
mov word [rdx], cx
add rdx, 2
sub rax, 1
jne 0x140051144
test rax, rax
lea rcx, [rdx - 2]
cmovne rcx, rdx
xor eax, eax
mov word [rcx], ax
jmp 0x140051180
test rax, rax
je 0x140051180
xor eax, eax
mov word [rdi], ax
mov r8, rbp
mov rdx, rsi
mov rcx, rdi
call fcn.140050950
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400511a3
mov eax, 1
jmp 0x1400511a5
xor eax, eax
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.14006ed70
mov rbx, qword [rsp + 0x288]
add rsp, 0x250
pop rdi
pop rsi
pop rbp
ret
lea r9, str.NVIDIA_Corporation_nView
mov r8d, 0x23
jmp 0x1400510c0
Function at 0x1400534a0
Capabilities:
Change the wallpaper

Disassembly:
mov rax, qword [0x1400d5758]
mov rcx, qword [rax + 0x18]
test rcx, rcx
je 0x1400528dc
add rcx, qword [0x1400d5750]
jmp 0x1400534a0
ret
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x2240]
mov eax, 0x2340
call fcn.14006edd0
sub rsp, rax
mov rax, qword [0x1400cd548]
xor rax, rsp
mov qword [rbp + 0x2230], rax
mov rbx, rcx
xor edi, edi
cmp byte [rcx + 0x3b40], dil
je 0x14005361b
mov word [rbp + 0x170], di
mov qword [rbp + 0x21f0], rdi
mov word [rbp + 0x378], di
mov word [rbp + 0x580], di
mov qword [rbp + 0x21f8], rdi
mov word [rbp + 0x788], di
mov word [rbp + 0x990], di
mov qword [rbp + 0x2200], rdi
mov word [rbp + 0xb98], di
mov word [rbp + 0xda0], di
mov qword [rbp + 0x2208], rdi
mov word [rbp + 0xfa8], di
mov word [rbp + 0x11b0], di
mov qword [rbp + 0x2210], rdi
mov word [rbp + 0x13b8], di
mov word [rbp + 0x15c0], di
mov qword [rbp + 0x2218], rdi
mov word [rbp + 0x17c8], di
mov word [rbp + 0x19d0], di
mov qword [rbp + 0x2220], rdi
mov word [rbp + 0x1bd8], di
mov word [rbp + 0x1de0], di
mov qword [rbp + 0x2228], rdi
mov word [rbp + 0x1fe8], di
lea r8, [rbp + 0x170]
mov edx, dword [rcx]
lea rcx, [rsp + 0x50]
call fcn.140053260
lea rcx, [rsp + 0x50]
call fcn.140054ad0
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x40], 7
mov word [rsp + 0x28], di
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x50]
call fcn.140053d80
test al, al
je 0x1400535f7
lea r8, [rsp + 0x28]
cmp qword [rsp + 0x40], 8
cmovae r8, qword [rsp + 0x28]
lea rcx, [rbx + 0x20]
mov edx, 0x208
call fcn.140004af0
mov dword [rbx + 0x434], 1
mov byte [rbx + 0x3b41], 0
mov rdx, qword [rsp + 0x40]
cmp rdx, 8
jb 0x14005361b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
call fcn.140006ee0
mov qword [rsp + 0x20], rdi
lea r8, [rsp + 0x20]
lea rdx, str.Control_PanelDesktop
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x1400536ef
lea r9d, [rax + 4]
lea rdx, str.TileWallpaper
mov rcx, qword [rsp + 0x20]
cmp dword [rbx + 0x434], 1
jne 0x140053675
lea r8, [0x1400a489c]
call fcn.140059e80
mov r9d, 4
lea r8, [0x1400a48a0]
jmp 0x1400536bb
lea r8, [0x1400a48a0]
call fcn.140059e80
mov r9d, dword [rbx + 0x434]
cmp r9d, 0x64
je 0x1400536cc
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x28], xmm0
mov dword [rsp + 0x38], eax
lea r8, [0x1400b9b40]
lea edx, [rax + 0x14]
lea rcx, [rsp + 0x28]
call fcn.140004b70
mov r9d, 0x14
lea r8, [rsp + 0x28]
lea rdx, str.WallpaperStyle
mov rcx, qword [rsp + 0x20]
call fcn.140059e80
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x1400536dc
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r8, [rbx + 0x20]
xor edx, edx
lea ecx, [rdx + 0x14]
lea r9d, [rdx + 3]
call qword [sym.imp.USER32.dll_SystemParametersInfoW]
mov al, 1
mov rcx, qword [rbp + 0x2230]
xor rcx, rsp
call fcn.14006ed70
lea r11, [rsp + 0x2340]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x140054820
Capabilities:
Create directory
Get common file path

Disassembly:
push rbx
sub rsp, 0x30
xor r9d, r9d
mov qword [rsp + 0x20], rcx
mov rbx, rcx
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 0x1a]
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov edx, 0x104
test eax, eax
je 0x14005485d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
mov eax, 1
add rsp, 0x30
pop rbx
ret
mov rcx, rdx
mov rax, rbx
cmp word [rax], 0
je 0x140054873
add rax, 2
sub rcx, 1
jne 0x140054863
test rcx, rcx
je 0x1400548d0
xor r10d, r10d
mov rax, rdx
sub rax, rcx
test rcx, rcx
cmove rax, r10
lea rcx, [rbx + rax*2]
sub rdx, rax
je 0x1400548c1
lea r9, str._nView_Wallpaper
mov eax, 0x7ffffffe
sub r9, rcx
test rax, rax
je 0x1400548c1
movzx r8d, word [r9 + rcx]
test r8w, r8w
je 0x1400548c1
mov word [rcx], r8w
dec rax
add rcx, 2
sub rdx, 1
jne 0x1400548a0
test rdx, rdx
lea rax, [rcx - 2]
cmovne rax, rcx
mov word [rax], r10w
xor r8d, r8d
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
mov eax, 1
add rsp, 0x30
pop rbx
ret
Function at 0x140055070
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2630]
mov eax, 0x2730
call fcn.14006edd0
sub rsp, rax
mov rax, qword [0x1400cd548]
xor rax, rsp
mov qword [rbp + 0x2620], rax
mov eax, 2
mov r13d, r9d
cmp r9d, eax
mov r14d, r8d
mov r12, rdx
mov r15, rcx
cmova r13d, eax
lea rcx, [rbp + 0x2000]
xor esi, esi
xor edx, edx
mov r8d, 0x208
mov word [rsp + 0x40], si
mov qword [rbp + 0x1fc0], rsi
mov word [rbp + 0x148], si
mov word [rbp + 0x350], si
mov qword [rbp + 0x1fc8], rsi
mov word [rbp + 0x558], si
mov word [rbp + 0x760], si
mov qword [rbp + 0x1fd0], rsi
mov word [rbp + 0x968], si
mov word [rbp + 0xb70], si
mov qword [rbp + 0x1fd8], rsi
mov word [rbp + 0xd78], si
mov word [rbp + 0xf80], si
mov qword [rbp + 0x1fe0], rsi
mov word [rbp + 0x1188], si
mov word [rbp + 0x1390], si
mov qword [rbp + 0x1fe8], rsi
mov word [rbp + 0x1598], si
mov word [rbp + 0x17a0], si
mov qword [rbp + 0x1ff0], rsi
mov word [rbp + 0x19a8], si
mov word [rbp + 0x1bb0], si
mov qword [rbp + 0x1ff8], rsi
mov word [rbp + 0x1db8], si
call fcn.140070390
mov edi, esi
test r14d, r14d
je 0x140055260
lea rbx, [rbp + 0x2228]
lea rax, [rsp + 0x40]
sub rbx, rax
lea rsi, [rsp + 0x40]
nop dword [rax]
mov r9d, edi
lea r8, str.TranscodedImageCache__03d
mov edx, 0x208
lea rcx, [rbp + 0x2000]
call fcn.140007050
xor edx, edx
lea rcx, [rbp + 0x2210]
mov r8d, 0x410
call fcn.140070390
lea rax, [rsp + 0x30]
mov dword [rsp + 0x30], 0x410
mov qword [rsp + 0x28], rax
lea rdx, [rbp + 0x2000]
lea rax, [rbp + 0x2210]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14005531b
mov edx, 0x104
mov rcx, rsi
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x140055235
movzx eax, word [rbx + rcx]
test ax, ax
je 0x140055235
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x140055213
test rdx, rdx
lea rax, [rcx - 2]
cmovne rax, rcx
xor ecx, ecx
inc edi
add rsi, 0x208
sub rbx, 0x208
mov word [rax], cx
cmp edi, r14d
jb 0x1400551a0
xor esi, esi
call fcn.1400050c0
mov r14d, eax
mov ebx, esi
test eax, eax
jle 0x1400552ef
mov edi, 0x2080
mov ecx, ebx
call fcn.140005430
sub eax, 1
js 0x1400552dd
mov rcx, qword [r15]
lea r9, [rsp + 0x40]
add rcx, rsi
cdqe
imul rdx, rax, 0x208
mov r8d, 0x104
sub rdx, rcx
add r9, rdx
lea rax, [r8 + 0x7ffffefa]
test rax, rax
je 0x1400552c6
movzx eax, word [r9 + rcx]
test ax, ax
je 0x1400552c6
mov word [rcx], ax
add rcx, 2
sub r8, 1
jne 0x1400552a3
test r8, r8
lea rax, [rcx - 2]
cmovne rax, rcx
xor ecx, ecx
mov word [rax], cx
mov rax, qword [r15]
mov dword [rdi + rax], r13d
inc ebx
add rdi, 4
add rsi, 0x208
cmp ebx, r14d
jl 0x140055277
mov al, 1
mov rcx, qword [rbp + 0x2620]
xor rcx, rsp
call fcn.14006ed70
mov rbx, qword [rsp + 0x2780]
add rsp, 0x2730
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
xor al, al
jmp 0x1400552f1
Function at 0x140056a00
Capabilities:
Set file attributes
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x80
mov rax, qword [0x1400cd548]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov r15, r8
mov r12, rdx
mov ebx, 0x20
lea r8, [rsp + 0x48]
mov edx, ebx
mov r14, rcx
call qword [sym.imp.GDI32.dll_GetObjectW]
movzx eax, word [rsp + 0x58]
mov edi, 1
movzx ecx, word [rsp + 0x5a]
imul ecx, eax
cmp cx, di
jne 0x140056c12
movzx ebx, di
movzx ebp, bx
mov rdx, rdi
mov ecx, ebp
shl rdx, cl
lea rdx, [rdx*4 + 0x28]
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rsi, rax
mov dword [rax], 0x28
mov eax, dword [rsp + 0x4c]
mov dword [rsi + 4], eax
mov eax, dword [rsp + 0x50]
mov dword [rsi + 8], eax
movzx eax, word [rsp + 0x58]
mov word [rsi + 0xc], ax
movzx eax, word [rsp + 0x5a]
mov word [rsi + 0xe], ax
cmp bx, 0x18
jae 0x140056ab3
mov ecx, ebp
shl edi, cl
mov dword [rsi + 0x20], edi
imul ebp, dword [rsi + 4]
xor r13d, r13d
xor ecx, ecx
mov dword [rsi + 0x10], r13d
mov dword [rsi + 0x24], r13d
lea eax, [rbp + 0x1f]
and eax, 0xffffffe0
cdq
and edx, 7
add edx, eax
sar edx, 3
imul edx, dword [rsi + 8]
mov dword [rsi + 0x14], edx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
movzx r9d, word [rsi + 8]
xor r8d, r8d
mov dword [rsp + 0x30], r13d
mov rdx, r14
mov qword [rsp + 0x28], rsi
mov rcx, r12
mov rdi, rax
mov qword [rsp + 0x20], rax
call qword [sym.imp.GDI32.dll_GetDIBits]
mov edx, 0x80
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov qword [rsp + 0x30], r13
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
xor r8d, r8d
mov edx, 0xc0000000
mov dword [rsp + 0x20], 2
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CreateFileW]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], r13
mov rbx, rax
mov eax, 0x4d42
mov word [rsp + 0x68], ax
mov edx, dword [rsi + 0x20]
lea r8d, [rdx*4 + 0xe]
mov edx, dword [rsi + 0x14]
add r8d, dword [rsi]
add edx, r8d
mov dword [rsp + 0x6e], r13d
mov dword [rsp + 0x6a], edx
lea r8d, [r13 + 0xe]
mov ecx, dword [rsi + 0x20]
lea rdx, [rsp + 0x68]
lea ecx, [rcx*4 + 0xe]
add ecx, dword [rsi]
mov dword [rsp + 0x72], ecx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov r8d, dword [rsi + 0x20]
lea r9, [rsp + 0x40]
mov rdx, rsi
mov qword [rsp + 0x20], r13
mov rcx, rbx
lea r8d, [r8*4 + 0x28]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov r8d, dword [rsi + 0x14]
lea r9, [rsp + 0x40]
mov rdx, rdi
mov qword [rsp + 0x20], r13
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14006ed70
mov rbx, qword [rsp + 0xd8]
add rsp, 0x80
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
cmp cx, 4
ja 0x140056c22
mov ebx, 4
jmp 0x140056a5f
cmp cx, 8
ja 0x140056c32
mov ebx, 8
jmp 0x140056a5f
cmp cx, 0x10
ja 0x140056c42
mov ebx, 0x10
jmp 0x140056a5f
cmp cx, 0x18
ja 0x140056a5f
mov ebp, 0x18
movzx ebx, bp
lea edx, [rbp + 0x10]
jmp 0x140056a72