joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400e62c8
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xd0
mov rax, qword [0x140192630]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov edi, dword [rdx + 0x10]
mov eax, 0x10000
mov esi, dword [rdx + 0x14]
xor r8d, r8d
mov r10, rcx
mov dword [rbp - 0x21], eax
mov ecx, dword [rdx + 0x18]
mov rbx, rdx
mov qword [rbp - 0x19], rax
mov dword [rbp - 9], eax
mov dword [rbp - 5], eax
mov dword [rbp + 3], eax
mov qword [rbp + 7], rax
mov dword [rbp + 0xf], eax
mov dword [rbp + 0x13], eax
mov dword [rbp + 0x17], eax
mov dword [rbp + 0x1f], eax
mov dword [rbp + 0x23], eax
mov dword [rbp + 0x27], eax
lea eax, [rcx + 1]
mov dword [rdx + 0x18], eax
mov qword [rbp - 0x29], r8
mov dword [rbp - 0x1d], 0x38000
mov qword [rbp - 0x11], r8
mov dword [rbp - 1], 0x7c000
mov dword [rbp + 0x1b], 0xfe000
cmp ecx, 6
jb 0x1400e6354
mov dword [rdx], r8d
jmp 0x1400e63be
mov eax, 0xaaaaaaab
mul ecx
shr edx, 2
lea eax, [rdx + rdx*2]
add eax, eax
sub ecx, eax
cmp ecx, 3
jb 0x1400e6373
mov eax, 5
sub eax, ecx
mov ecx, eax
mov byte [rsp + 0x50], r8b
mov r9d, 0xa
mov eax, ecx
lea rcx, [rbp - 0x29]
imul rdx, rax, 0x1c
mov al, byte [rbx + 6]
mov byte [rsp + 0x48], al
add rdx, rcx
mov al, byte [rbx + 5]
mov rcx, r10
mov byte [rsp + 0x40], al
mov al, byte [rbx + 4]
mov byte [rsp + 0x38], al
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 7
call fcn.1400e5a20
mov dword [rbx + 0x10], edi
mov dword [rbx + 0x14], esi
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.140101680
mov rbx, qword [rsp + 0x100]
add rsp, 0xd0
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400e751c
Capabilities:
Get file system object information

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r13
push r14
push r15
lea rbp, [rsp - 0x3560]
mov eax, 0x3660
call fcn.140101610
sub rsp, rax
mov rax, qword [0x140192630]
xor rax, rsp
mov qword [rbp + 0x3550], rax
cmp dword [0x1401923d0], 0xffffffff
mov r14, r9
mov bl, r8b
mov rdi, rdx
mov rsi, rcx
mov r13d, 0x4001
mov r15d, 0x800
jne 0x1400e75ce
mov r9d, 0x2b8
mov dword [rsp + 0x20], r13d
lea r8, [rbp - 0x30]
xor edx, edx
lea rcx, [0x14014303c]
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov eax, dword [rbp - 0x28]
lea rdx, [rbp + 0x2550]
mov r8d, r15d
mov dword [0x140206c9c], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov r9d, 0x2b8
mov dword [rsp + 0x20], r13d
lea r8, [rbp - 0x30]
xor edx, edx
lea rcx, [rbp + 0x2550]
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov eax, dword [rbp - 0x28]
mov dword [0x1401923d0], eax
mov r8, r15
lea rcx, [rbp + 0x550]
mov rdx, rdi
call fcn.140096ef0
mov r8, r15
lea rdx, [rbp + 0x550]
lea rcx, [rbp + 0x550]
call fcn.140081290
movzx edi, word [rsi]
lea rax, [rbp + 0x550]
mov qword [rsp + 0x48], rax
mov r9d, 0x2b8
mov dword [rsp + 0x30], 3
lea r8, [rbp + 0x290]
mov qword [rsp + 0x34], 0x40000000
lea rcx, [rbp + 0x550]
test di, di
je 0x1400e7640
neg bl
mov dword [rsp + 0x20], 0x4011
sbb edx, edx
and edx, 0x10
jmp 0x1400e7647
mov dword [rsp + 0x20], r13d
xor edx, edx
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov eax, dword [rbp + 0x298]
mov r8, r15
mov dword [rsp + 0x54], eax
lea rcx, [rbp + 0x1550]
test di, di
je 0x1400e7670
mov rdx, rsi
call fcn.140096ef0
jmp 0x1400e7699
lea rdx, [rbp + 0x550]
call fcn.140096ef0
lea rcx, [rbp + 0x1550]
call fcn.140081140
lea rcx, [rbp + 0x550]
call fcn.1400810ec
mov qword [rsp + 0x48], rax
mov rcx, qword [0x14019b708]
mov edx, 0x66
call qword [sym.imp.USER32.dll_GetDlgItem]
lea r9, [rsp + 0x30]
xor r8d, r8d
mov rcx, rax
mov edx, 0x104d
mov rsi, rax
call qword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [0x140206c9c]
lea r9, [rsp + 0x30]
mov rbx, rax
mov dword [rsp + 0x30], 3
lea rax, [rbp + 0x1550]
mov dword [rsp + 0x34], ebx
test di, di
mov qword [rsp + 0x48], rax
mov r15d, 1
mov edx, 0x104c
cmovne ecx, dword [0x1401923d0]
xor r8d, r8d
mov dword [rsp + 0x54], ecx
mov rcx, rsi
mov dword [rsp + 0x38], r15d
call qword [sym.imp.USER32.dll_SendMessageW]
lea edi, [r15 + 1]
movsxd r8, ebx
lea r9, [rbp - 0x80]
mov dword [rbp - 0x78], edi
mov edx, 0x1074
mov qword [rbp - 0x68], r14
mov rcx, rsi
call qword [sym.imp.USER32.dll_SendMessageW]
test ebx, ebx
jne 0x1400e7755
lea r9, [rbp - 0x80]
mov dword [rbp - 0x70], r15d
xor r8d, r8d
mov dword [rbp - 0x74], r15d
mov edx, 0x102b
mov rcx, rsi
call qword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [0x140203030]
add eax, r15d
mov dword [0x140203030], eax
cmp eax, r15d
jne 0x1400e7785
mov ecx, 0x4f5
call fcn.140090e20
mov rcx, qword [0x14019b708]
mov r8, rax
mov edx, edi
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
mov rcx, qword [rbp + 0x3550]
xor rcx, rsp
call fcn.140101680
add rsp, 0x3660
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x1400e97d0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
mov eax, 0x2040
call fcn.140101610
sub rsp, rax
mov rax, qword [0x140192630]
xor rax, rsp
mov qword [rsp + 0x2030], rax
xor r9d, r9d
mov dword [rsp + 0x20], 0x1000
lea r8, [rsp + 0x1030]
lea rdx, str.rarreg.key
lea rcx, [0x1401423c8]
call fcn.1400a86e4
movsxd rdi, eax
test eax, eax
je 0x1400e9888
mov r8d, 0x800
lea rdx, [rsp + 0x30]
lea rcx, str.Rar_RK
call fcn.1400d0414
mov rbx, rax
test rax, rax
je 0x1400e9875
mov r8, rdi
lea rcx, [rsp + 0x1030]
mov r9, rax
mov edx, 1
call fcn.140128494
mov rcx, rbx
call fcn.1401280c8
lea rcx, [rsp + 0x30]
call fcn.1400e31c0
lea rcx, [rsp + 0x30]
call fcn.140070160
lea rdx, str.rarreg.key
lea rcx, [0x1401423c8]
call fcn.1400a8118
mov rcx, qword [rsp + 0x2030]
xor rcx, rsp
call fcn.140101680
mov rbx, qword [rsp + 0x2050]
add rsp, 0x2040
pop rdi
ret
Function at 0x1400e9a94
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
lea rbp, [rax - 0xf78]
mov eax, 0x1070
call fcn.140101610
sub rsp, rax
mov rax, qword [0x140192630]
xor rax, rsp
mov qword [rbp + 0xf60], rax
lea rcx, [rsp + 0x54]
mov dword [rsp + 0x50], 0x60200
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov edi, 0xc
lea r8, [rsp + 0x30]
xor r9d, r9d
mov dword [rsp + 0x20], edi
lea rdx, str.VerInfo
lea rcx, [0x140142df0]
call fcn.1400a86e4
lea esi, [rdi - 0xb]
mov ebx, 0x800
mov r8b, sil
lea rcx, [rsp + 0x60]
mov edx, ebx
call fcn.1400805ec
mov edx, ebx
lea rcx, [rsp + 0x60]
call fcn.14007f710
mov r8d, ebx
lea rdx, str.version.dat
lea rcx, [rsp + 0x60]
call fcn.140096ec8
and dword [rsp + 0x40], 0
lea rdx, [0x140147320]
lea rcx, [rsp + 0x60]
call fcn.14007137c
mov rbx, rax
test rax, rax
je 0x1400e9b6f
mov r9, rax
lea rcx, [rsp + 0x40]
mov r8d, edi
mov edx, esi
call fcn.14012b598
mov rcx, rbx
call fcn.1401280c8
mov eax, dword [rsp + 0x50]
cmp dword [rsp + 0x30], eax
je 0x1400e9c20
lea rdx, str.VerInfo
mov r9, rdi
lea rcx, [0x140142df0]
cmp dword [rsp + 0x40], eax
je 0x1400e9bf8
lea r8, [rsp + 0x50]
call fcn.1400a9320
call fcn.1400a9024
test al, al
jne 0x1400e9bdb
lea rdx, [0x140143210]
lea rcx, [rsp + 0x60]
call fcn.14007137c
mov rbx, rax
test rax, rax
je 0x1400e9bdb
mov r9, rax
lea rcx, [rsp + 0x50]
mov r8, rdi
mov rdx, rsi
call fcn.140128494
mov rcx, rbx
call fcn.1401280c8
call fcn.1400a902c
neg al
mov edx, 0x168
sbb ecx, ecx
not ecx
and ecx, edx
mov dword [0x14019c750], ecx
jmp 0x1400e9cb7
movsd xmm0, qword [rsp + 0x40]
lea r8, [rsp + 0x40]
mov eax, dword [rsp + 0x48]
movsd qword [rsp + 0x30], xmm0
mov dword [rsp + 0x38], eax
call fcn.1400a9320
mov eax, dword [rsp + 0x50]
cmp dword [rsp + 0x30], eax
jne 0x1400e9c77
cmp dword [rsp + 0x40], eax
je 0x1400e9c77
movsd xmm0, qword [rsp + 0x30]
mov eax, dword [rsp + 0x38]
movsd qword [rsp + 0x40], xmm0
mov dword [rsp + 0x48], eax
call fcn.1400a9024
test al, al
jne 0x1400e9c77
lea rdx, [0x140143210]
lea rcx, [rsp + 0x60]
call fcn.14007137c
mov rbx, rax
test rax, rax
je 0x1400e9c77
mov r9, rax
lea rcx, [rsp + 0x30]
mov r8, rdi
mov rdx, rsi
call fcn.140128494
mov rcx, rbx
call fcn.1401280c8
mov ecx, dword [rsp + 0x38]
mov eax, dword [rsp + 0x58]
shl rax, 0x20
shl rcx, 0x20
sub rax, rcx
mov ecx, dword [rsp + 0x34]
sub rax, rcx
mov ecx, dword [rsp + 0x54]
add rax, rcx
movabs rcx, 0xc92a69c000
cqo
idiv rcx
mov edx, 0x168
test eax, eax
cmovs eax, edx
mov dword [0x14019c750], eax
mov rcx, qword [rbp + 0xf60]
xor rcx, rsp
call fcn.140101680
lea r11, [rsp + 0x1070]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x1400eb130
Capabilities:
Create thread

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rsi
mov bl, r8b
mov rdi, rdx
mov ecx, dword [0x140238590]
mov rax, qword gs:[0x58]
mov edx, 4
mov rcx, qword [rax + rcx*8]
mov eax, dword [rdx + rcx]
cmp dword [0x14020f510], eax
jle 0x1400eb1ad
lea rcx, [0x14020f510]
call fcn.140101db8
cmp dword [0x14020f510], 0xffffffff
jne 0x1400eb1ad
lea rcx, [0x14020f40e]
call fcn.1400941b8
nop
lea rcx, [0x14013f5f0]
call fcn.140101bc4
nop
lea rcx, [0x14020f510]
call fcn.140101d58
mov r8b, 1
mov rdx, rdi
lea rsi, [0x14020b3e0]
mov rcx, rsi
call fcn.1400eca34
test bl, bl
sete al
and qword [rsp + 0x30], 0
mov qword [rsp + 0x28], rsi
mov byte [rsp + 0x20], al
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
xor ecx, ecx
call fcn.1400edbb8
test al, al
jne 0x1400eb205
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, rsi
call fcn.1400eb5b0
cmp ebx, 0x4c7
sete al
jmp 0x1400eb229
test bl, bl
je 0x1400eb21f
mov r8, rsi
mov edx, 0x10000
lea rcx, [0x1400eb8c0]
call fcn.14012885c
jmp 0x1400eb227
mov rcx, rsi
call fcn.1400eb5b0
mov al, 1
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x1400ec15c
Capabilities:
Create thread
Query environment variable

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2f60]
mov eax, 0x3060
call fcn.140101610
sub rsp, rax
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x30a0], rbx
mov rax, qword [0x140192630]
xor rax, rsp
mov qword [rbp + 0x2f50], rax
mov r15b, r8b
mov r12, rdx
xor r13d, r13d
mov ebx, 0x800
test r9, r9
jne 0x1400ec1fc
mov dword [rsp + 0x20], ebx
lea r9, [0x1401423c8]
lea r8, [rsp + 0x50]
lea rdx, str.ExternalViewer
lea rcx, [0x140143838]
call fcn.1400a8858
mov r8d, ebx
lea rdx, [rbp + 0x1f50]
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
dec eax
cmp eax, 0x7fe
ja 0x1400ec20c
lea rdx, [rbp + 0x1f50]
jmp 0x1400ec1ff
mov rdx, r9
mov r8, rbx
lea rcx, [rsp + 0x50]
call fcn.140096ef0
cmp word [rsp + 0x50], r13w
jne 0x1400ec21b
xor al, al
jmp 0x1400ec40d
mov r8, rbx
mov rdx, r12
lea rcx, [rbp + 0xf50]
call fcn.140096ef0
mov rdx, rbx
lea rcx, [rbp + 0xf50]
call fcn.1400b1850
lea rcx, [rsp + 0x50]
call fcn.140070448
test al, al
jne 0x1400ec331
mov eax, 0x22
cmp word [rsp + 0x50], ax
jne 0x1400ec26b
mov edx, eax
lea rcx, [rsp + 0x52]
call fcn.140120ac0
jmp 0x1400ec310
lea rax, [rsp + 0x50]
jmp 0x1400ec310
lea rdx, [0x14015df88]
mov rcx, rax
call fcn.14012bcec
mov rdi, rax
test rax, rax
je 0x1400ec331
mov rsi, rax
movzx ecx, word [rax]
jmp 0x1400ec29f
add rsi, 2
movzx ecx, word [rsi]
call fcn.140096ad8
test al, al
jne 0x1400ec298
mov r8, rbx
mov rdx, rsi
lea rcx, [rbp + 0x1f50]
call fcn.140096ef0
mov r8, rbx
lea rdx, [0x1401474b4]
lea rcx, [rbp + 0x1f50]
call fcn.140096ec8
mov r8, rbx
lea rdx, [rbp + 0xf50]
lea rcx, [rbp + 0x1f50]
call fcn.140096ec8
movzx r14d, word [rdi]
mov word [rdi], r13w
mov eax, 0x22
cmp word [rsp + 0x50], ax
je 0x1400ec31b
lea rcx, [rsp + 0x50]
call fcn.140070448
test al, al
jne 0x1400ec31b
mov word [rdi], r14w
lea rax, [rsi + 2]
test rax, rax
jne 0x1400ec275
jmp 0x1400ec331
mov r8, rbx
lea rdx, [rbp + 0x1f50]
lea rcx, [rbp + 0xf50]
call fcn.140096ef0
mov ecx, dword [0x140238590]
mov rax, qword gs:[0x58]
mov edx, 4
mov rax, qword [rax + rcx*8]
mov ecx, dword [rdx + rax]
cmp dword [0x14020b3d0], ecx
jle 0x1400ec38f
lea rcx, [0x14020b3d0]
call fcn.140101db8
cmp dword [0x14020b3d0], 0xffffffff
jne 0x1400ec38f
lea rcx, [0x14020b2ce]
call fcn.1400941b8
nop
lea rcx, [0x14013f610]
call fcn.140101bc4
nop
lea rcx, [0x14020b3d0]
call fcn.140101d58
mov r8b, 1
mov rdx, r12
lea rbx, [0x1402072a0]
mov rcx, rbx
call fcn.1400eca34
test r15b, r15b
sete al
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], rbx
mov byte [rsp + 0x20], al
lea r9, [rbp + 0xf50]
xor r8d, r8d
lea rdx, [rsp + 0x50]
xor ecx, ecx
call fcn.1400edbb8
test al, al
jne 0x1400ec3df
mov rcx, rbx
call fcn.1400eb5b0
jmp 0x1400ec214
test r15b, r15b
je 0x1400ec403
cmp qword [0x1402072a0], r13
je 0x1400ec403
mov r8, rbx
mov edx, 0x10000
lea rcx, [0x1400eb8c0]
call fcn.14012885c
jmp 0x1400ec40b
mov rcx, rbx
call fcn.1400eb5b0
mov al, 1
mov rcx, qword [rbp + 0x2f50]
xor rcx, rsp
call fcn.140101680
mov rbx, qword [rsp + 0x30a0]
add rsp, 0x3060
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400ec438
Capabilities:
Create thread

Disassembly:
push rsi
mov eax, 0x1060
call fcn.140101610
sub rsp, rax
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x1070], rbx
mov rax, qword [0x140192630]
xor rax, rsp
mov qword [rsp + 0x1050], rax
mov rbx, rdx
mov rcx, rdx
call fcn.1400ed15c
test al, al
je 0x1400ec4ad
mov ecx, 0x65
call fcn.140090e20
mov rbx, rax
mov ecx, 0x596
call fcn.140090e20
mov rdx, rax
mov r9d, 0x30
mov r8, rbx
mov rcx, qword [0x14019b6f0]
call fcn.1400d19e0
jmp 0x1400ec624
cmp byte [0x14019b720], 0
jne 0x1400ec4f9
and qword [rsp + 0x30], 0
and qword [rsp + 0x28], 0
mov byte [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
xor ecx, ecx
call fcn.1400edbb8
test al, al
jne 0x1400ec624
mov ecx, 0x201
call fcn.140090e20
mov rcx, rax
mov rdx, rbx
call fcn.1400d63e4
jmp 0x1400ec624
mov cl, 1
call fcn.1400cb40c
mov r9b, 1
mov esi, 0x800
mov r8d, esi
lea rdx, [0x1401ab1ce]
lea rcx, str.Rar_EX
call fcn.1400d04f0
test al, al
je 0x1400ec624
mov r8d, esi
lea rdx, [0x1401b6732]
lea rcx, [0x1401c40e0]
call fcn.1400065fc
mov eax, dword [0x1401c40e4]
mov dword [0x1401b16c8], eax
lea rdx, [0x140142bd8]
lea rcx, [0x1401b7738]
call fcn.140096f60
mov dword [0x1401b06b4], 2
mov r9d, esi
lea r8, [rsp + 0x50]
mov rdx, rbx
lea rcx, [0x1401ab1ce]
call fcn.140080b78
xor r8d, r8d
xor edx, edx
lea rcx, [0x1401c40e0]
call fcn.1400060f4
cmp byte [0x14019b723], 0
jne 0x1400ec624
mov ecx, dword [0x140238590]
mov rax, qword gs:[0x58]
mov edx, 4
mov rax, qword [rax + rcx*8]
mov ecx, dword [rdx + rax]
cmp dword [0x140213650], ecx
jle 0x1400ec5f8
lea rcx, [0x140213650]
call fcn.140101db8
cmp dword [0x140213650], 0xffffffff
jne 0x1400ec5f8
lea rcx, [0x14021354e]
call fcn.1400941b8
nop
lea rcx, [0x14013f630]
call fcn.140101bc4
nop
lea rcx, [0x140213650]
call fcn.140101d58
xor r8d, r8d
lea rdx, [rsp + 0x50]
lea rcx, [0x14020f520]
call fcn.1400eca34
lea r8, [0x14020f520]
mov edx, 0x10000
lea rcx, [0x1400eb8c0]
call fcn.14012885c
mov rcx, qword [rsp + 0x1050]
xor rcx, rsp
call fcn.140101680
mov rbx, qword [rsp + 0x1070]
add rsp, 0x1060
pop rsi
ret
Function at 0x1400ec838
Capabilities:
Query environment variable

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x6010]
mov eax, 0x6110
call fcn.140101610
sub rsp, rax
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rax, qword [0x140192630]
xor rax, rsp
mov qword [rbp + 0x6000], rax
mov rdi, rdx
mov rsi, rcx
mov rcx, r8
call fcn.1400810ec
mov r10, rax
or rdx, 0xffffffffffffffff
mov r8, rdx
xor ebx, ebx
inc r8
cmp word [rdi + r8*2], bx
jne 0x1400ec888
inc rdx
cmp word [rax + rdx*2], bx
jne 0x1400ec892
lea rax, [rdx + 1]
add rax, r8
mov r14d, 0x1000
cmp rax, r14
jb 0x1400ec8b4
xor al, al
jmp 0x1400ec9cb
mov r9, r14
lea r8, [rbp + 0x4000]
mov rdx, r10
mov rcx, rdi
call fcn.140080b78
lea rcx, [rsp + 0x40]
call fcn.140096f24
nop
mov dword [rsp + 0x20], r14d
lea r9, [0x1401423c8]
lea r8, [rbp + 0x2000]
lea rdx, str.ViewerIgnoreModifications
lea rcx, [0x140143838]
call fcn.1400a8858
cmp word [rbp + 0x2000], bx
je 0x1400ec91a
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x2000]
call fcn.1400b1a70
mov r14d, 0x800
mov r8, r14
lea rdx, [rbp + 0x1000]
lea rcx, [rsp + 0x40]
call fcn.140097034
test al, al
je 0x1400ec9bf
mov r8d, r14d
lea rdx, [rbp]
lea rcx, [rbp + 0x1000]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
dec eax
cmp eax, 0x7fe
ja 0x1400ec920
lea rdx, [0x14015ddec]
lea rcx, [rbp + 2]
call fcn.140121f44
mov rdi, rax
test rax, rax
je 0x1400ec99c
mov word [rax], bx
add rdi, 4
cmp word [rdi], bx
jne 0x1400ec984
lea rdi, [0x140142bd8]
mov r8d, 5
mov rdx, rsi
lea rcx, [rbp]
call fcn.140074664
test al, al
je 0x1400ec920
jmp 0x1400ec9a0
lea rdi, [rbp]
mov r8d, 5
lea rdx, [rbp + 0x4000]
mov rcx, rdi
call fcn.140074664
test al, al
je 0x1400ec920
mov bl, 1
lea rcx, [rsp + 0x40]
call fcn.140004f48
mov al, bl
mov rcx, qword [rbp + 0x6000]
xor rcx, rsp
call fcn.140101680
add rsp, 0x6110
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x1400edbb8
Capabilities:
Create process on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r15
lea rbp, [rsp - 0x1fa0]
mov eax, 0x20a0
call fcn.140101610
sub rsp, rax
mov rax, qword [0x140192630]
xor rax, rsp
mov qword [rbp + 0x1f90], rax
mov rsi, qword [rbp + 0x2008]
lea rcx, [rsp + 0x20]
mov rbx, qword [rbp + 0x2010]
mov rdi, rdx
xor edx, edx
mov r15, r8
mov r12, r9
lea r8d, [rdx + 0x70]
call fcn.140120b70
mov eax, 0x500
mov dword [rsp + 0x20], 0x70
xor r13d, r13d
mov qword [rsp + 0x38], rdi
cmp byte [rbp + 0x2000], r13b
mov qword [rsp + 0x30], rbx
lea ecx, [rax + 0x40]
cmove eax, ecx
mov rcx, rdi
mov dword [rsp + 0x24], eax
call fcn.140080460
test rax, rax
je 0x1400edc55
cmp word [rax], 0x2e
jne 0x1400edc66
cmp word [rax + 2], r13w
jne 0x1400edc66
or dword [rsp + 0x24], 1
lea rax, [0x14014303c]
mov qword [rsp + 0x68], rax
mov rcx, rdi
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x40], r12
call fcn.1400810ec
cmp rax, rdi
jne 0x1400edcb1
lea rdx, [0x140142c38]
mov rcx, rdi
call fcn.14007f744
test al, al
jne 0x1400edcb1
mov r9, rdi
lea r8, str.._s
mov edx, 0x1000
lea rcx, [rbp - 0x70]
call fcn.140002910
lea rax, [rbp - 0x70]
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x50], 1
mov byte [0x14019b721], 1
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov ebx, eax
test eax, eax
jne 0x1400edd06
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x4c7
jne 0x1400edced
test rsi, rsi
je 0x1400edce6
mov qword [rsi], r13
mov al, 1
jmp 0x1400eddcf
cmp qword [rsp + 0x30], r13
je 0x1400edd06
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x30], r13
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov ebx, eax
mov byte [0x14019b721], r13b
test ebx, ebx
je 0x1400eddcd
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x483
je 0x1400eddcd
cmp byte [rbp + 0x2000], r13b
jne 0x1400edce6
mov r8, qword [rbp - 0x78]
lea rdi, [0x140000000]
test r8, r8
je 0x1400edd74
movsxd rdx, dword [0x140207290]
mov rax, qword [rsp + 0x58]
mov qword [rdi + rdx*8 + 0x207190], r8
mov qword [rdi + rdx*8 + 0x207210], rax
inc edx
and edx, 0x8000000f
jge 0x1400edd6c
dec edx
or edx, 0xfffffff0
inc edx
mov dword [0x140207290], edx
jmp 0x1400eddbc
mov rbx, r13
mov rax, qword [rsp + 0x58]
cmp qword [rbx + rdi + 0x207210], rax
jne 0x1400eddaf
mov rcx, qword [rbx + rdi + 0x207190]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x1400eddab
mov r8, qword [rbx + rdi + 0x207190]
mov qword [rbp - 0x78], r8
jmp 0x1400eddaf
mov r8, qword [rbp - 0x78]
add rbx, 8
cmp rbx, 0x80
jl 0x1400edd77
test rsi, rsi
je 0x1400edce6
mov qword [rsi], r8
jmp 0x1400edce6
xor al, al
mov rcx, qword [rbp + 0x1f90]
xor rcx, rsp
call fcn.140101680
add rsp, 0x20a0
pop r15
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x1400ee2e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
lea rcx, [0x14019b740]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1400ee32f
mov ecx, 0x2bc
call fcn.140090e20
mov ecx, 0x2bd
mov rbx, rax
call fcn.140090e20
mov rcx, qword [0x14019b6f0]
mov rdx, rax
mov r9d, 0x40
mov r8, rbx
add rsp, 0x20
pop rbx
jmp fcn.1400d19e0
xor r8d, r8d
lea rdx, [0x14019b740]
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.1400ecba0
Function at 0x1400f19c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
movsxd r13, dword [rdx + 0x1c]
lea r9, [0x140000000]
mov r14, qword [rdx]
xor ebx, ebx
mov r11, qword [rdx + 8]
or esi, 0xffffffff
mov dword [rsp + 0x70], esi
mov ebp, 0x23d
mov dword [0x14021667c], ebx
mov r12, rcx
mov dword [0x140216f94], ebp
mov r15, rdx
lea r10d, [rsi + 2]
mov edi, ebx
mov r8d, ebx
mov ecx, ebx
test r13d, r13d
jle 0x1400f1a6b
cmp word [r14 + rcx*4], bx
je 0x1400f1a51
add edi, r10d
mov dword [rsp + 0x70], r8d
movsxd rax, edi
mov esi, r8d
mov dword [0x14021667c], edi
mov dword [r9 + rax*4 + 0x2166a0], r8d
cmp rcx, rbp
jae 0x1400f1c41
mov byte [rcx + r9 + 0x216fa0], bl
jmp 0x1400f1a57
mov word [r14 + rcx*4 + 2], bx
add r8d, r10d
add rcx, r10
cmp rcx, r13
jl 0x1400f1a1b
cmp edi, 2
jge 0x1400f1b01
mov r9d, dword [0x140217558]
mov r8d, dword [0x1402175d8]
movsxd rdx, esi
cmp esi, 2
jge 0x1400f1a93
add esi, r10d
add rdx, r10
mov dword [rsp + 0x70], esi
mov rcx, rdx
mov r10d, esi
jmp 0x1400f1a99
mov r10d, ebx
mov rcx, rbx
inc edi
lea rbx, [0x140000000]
movsxd rax, edi
mov dword [0x14021667c], edi
mov dword [rbx + rax*4 + 0x2166a0], r10d
mov r10d, 1
mov word [r14 + rcx*4], r10w
lea ebx, [r10 - 1]
cmp rcx, rbp
jae 0x1400f1c47
dec r9d
lea rax, [0x140000000]
mov byte [rcx + rax + 0x216fa0], bl
mov dword [0x140217558], r9d
test r11, r11
je 0x1400f1af8
movzx eax, word [r11 + rcx*4 + 2]
sub r8d, eax
mov dword [0x1402175d8], r8d
cmp edi, 2
jl 0x1400f1a7c
mov eax, edi
mov dword [r15 + 0x24], esi
cdq
sub eax, edx
sar eax, 1
mov ebx, eax
cmp eax, r10d
jl 0x1400f1b2f
mov r8d, ebx
mov rdx, r14
mov rcx, r12
call fcn.1400f2da8
mov r10d, 1
sub ebx, r10d
cmp ebx, r10d
jge 0x1400f1b13
lea rsi, [0x140000000]
jmp 0x1400f1b3b
mov r10, r15
movsxd rbx, dword [0x1402166a4]
mov r8d, r10d
movsxd rax, edi
mov rdx, r14
sub edi, r10d
mov rcx, r12
mov dword [0x14021667c], edi
mov eax, dword [rsi + rax*4 + 0x2166a0]
mov dword [0x1402166a4], eax
call fcn.1400f2da8
movsxd rcx, dword [0x1402166a4]
mov r15d, 1
mov r9, rcx
movsxd rdx, r13d
sub ebp, r15d
mov r8d, r15d
movsxd rax, ebp
sub ebp, r15d
mov dword [rsi + rax*4 + 0x2166a0], ebx
movsxd rax, ebp
mov dword [rsi + rax*4 + 0x2166a0], ecx
movzx eax, word [r14 + rcx*4]
add ax, word [r14 + rbx*4]
mov word [r14 + rdx*4], ax
mov al, byte [rcx + rsi + 0x216fa0]
cmp byte [rbx + rsi + 0x216fa0], al
cmova ecx, ebx
movsxd rax, ecx
mov cl, byte [rax + rsi + 0x216fa0]
add cl, r15b
mov word [r14 + r9*4 + 2], r13w
mov byte [rdx + rsi + 0x216fa0], cl
mov rdx, r14
mov word [r14 + rbx*4 + 2], r13w
mov rcx, r12
mov dword [0x1402166a4], r13d
add r13d, r15d
call fcn.1400f2da8
cmp edi, 2
jge 0x1400f1b38
mov eax, dword [0x1402166a4]
sub ebp, r15d
mov rdx, qword [rsp + 0x68]
movsxd rcx, ebp
mov dword [0x140216f94], ebp
mov dword [rsi + rcx*4 + 0x2166a0], eax
mov rcx, r12
call fcn.1400f2a40
mov r8d, dword [rsp + 0x70]
mov rdx, r14
mov rcx, r12
mov rbx, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
jmp fcn.1400f2c7c
call fcn.1401013e4
int3
call fcn.1401013e4
int3