joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4652c0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46538a
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rax
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call fcn.00402820
xorps xmm15, xmm15
mov r14, qword [0x005512a0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x46536f
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x00473640]
xor ebx, ebx
mov rcx, rdx
call fcn.00442a80
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call fcn.00465620
inc rbx
cmp rcx, rbx
jae 0x46535e
mov edi, 1
lea rsi, [0x00473640]
call fcn.00442b60
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x0049e688]
lea rsi, [0x0049e280]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00457640
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004652c0

Function at 0x1408daa38
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1408daa42
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x1408daa6b
pop rbp
sub rbp, 0x33
sub rbp, 0x8daa38
sub rsp, 0x20
jmp 0x1408daa8a
mov rax, 0x8daa38
add rax, rbp
add rax, 0x84
mov rcx, 0x647
mov rdx, 0xffffffffd1aa5e92
invalid
xor byte [rax], dl
inc rax
inc eax
dec rcx
leave
jne 0x1408daaa9
jmp 0x1408daac0
ficomp dword ss:[rbx]
ficomp dword [rbx]
jnp 0x1408daadd
sbb ebp, dword [rsi - 0x256d6d6e]
adc edx, dword [rbx - 0x66]
xchg ebx, eax
xchg edx, eax
xchg edx, eax
ficom dword [rbx + 0x5255da7b]
pushfq
xchg edx, eax
xchg edx, eax
xchg edx, eax
ficom dword [rbp + 0x50]
mov edx, 0xda929292
jo 0x1408daabf
xchg ebx, eax
push rbx
sbb dword [rbx], edx
sahf
xchg edx, eax
xchg edx, eax
xchg edx, eax
ficom dword [rbx - 0x253d3d86]
sub dl, byte [rdx]
fild word [rdx + rdx*4 - 0x6d6d6d6e]
fisubr dword [rbx]
and al, 0xce
in eax, 0x92
xchg edx, eax
xchg edx, eax
xchg edx, eax
xchg edx, eax
ficom dword [rbx + 0x2328da7b]
push rbp
mov edx, 0x929292ff
xchg edx, eax
jp 0x1408daaac
xchg edx, eax
xchg edx, eax
xchg edx, eax
jnp 0x1408daa9e
xchg edx, eax
xchg edx, eax
xchg edx, eax
push rbx
jp 0x1408daab0
movabs dword [0x929292965313da83], eax
fisubr dword [rbp + 0x5a]
popfq
invalid
Function at 0x14000dd98
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x14000de0f
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x14000de0f
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
add rcx, rbx
and edi, 0xf
jbe 0x14000ddfc
cmp rbx, rcx
jae 0x14000de0f
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
add edi, 0xffffffff
jne 0x14000dde7
cmp rbx, rcx
jae 0x14000de0f
movzx eax, word [rbx]
neg ax
sbb rax, rax
and rax, rbx
jmp 0x14000de11
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140022530
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rsi, rdx
mov ecx, dword [rdx + 8]
lea eax, [rcx - 0x100]
cmp eax, 9
ja 0x140022577
mov rdx, qword [rdi + 0x2a0]
test rdx, rdx
je 0x14002258b
mov rcx, qword [rdi + 0x40]
mov r8, rsi
call qword [sym.imp.USER32.dll_TranslateAcceleratorW]
test eax, eax
je 0x14002258b
mov eax, 1
jmp 0x140022596
cmp ecx, 0x203
jne 0x1400225a6
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rdi + 0x260], eax
mov rdx, rsi
mov rcx, rdi
call fcn.1401c92b0
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
cmp ecx, 0x201
jne 0x14002258b
call qword [sym.imp.USER32.dll_GetDoubleClickTime]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, ebx
cmp eax, dword [rdi + 0x260]
jae 0x14002258b
and dword [rdi + 0x260], 0
mov rcx, rdi
movsx eax, word [rsi + 0x18]
mov edx, dword [rsi + 0x10]
mov dword [rsp + 0x38], eax
movsx eax, word [rsi + 0x1a]
mov dword [rsp + 0x3c], eax
mov r8, qword [rsp + 0x38]
call fcn.14002b678
jmp 0x140022570
Function at 0x14002b940
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x20
mov r12b, r9b
mov ebx, r8d
mov r15, rdx
mov rdi, rcx
test rdx, rdx
je 0x14002ba72
test ebx, ebx
je 0x14002ba72
call fcn.1401bf5e4
mov rcx, qword [rax + 8]
call fcn.1401c1034
nop
xor bpl, bpl
mov rcx, qword [rdi + 0x40]
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x14002ba63
call qword [sym.imp.USER32.dll_EmptyClipboard]
lea eax, [rbx + 1]
movsxd rbx, eax
add rbx, rbx
mov rdx, rbx
mov ecx, 0x2002
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rsi, rax
test rax, rax
je 0x14002ba5c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalSize]
mov rdi, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov r14, rax
test rax, rax
je 0x14002ba5c
mov r8, rbx
mov rdx, r15
mov rcx, rax
call fcn.1402bec40
cmp rdi, rbx
jbe 0x14002ba01
mov r8, rdi
sub r8, rbx
lea rcx, [r14 + rbx]
xor edx, edx
call fcn.1402bf2e0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rdx, rsi
mov ecx, InitCommonControls
call qword [sym.imp.USER32.dll_SetClipboardData]
test rax, rax
setne bpl
test rax, rax
je 0x14002ba5c
test r12b, r12b
je 0x14002ba40
lea rcx, str.MSDEVColumnSelect
call qword [sym.imp.USER32.dll_RegisterClipboardFormatW]
mov ecx, eax
xor edx, edx
call qword [sym.imp.USER32.dll_SetClipboardData]
cmp rdi, rbx
jne 0x14002ba5c
lea rcx, str.WinMergeClipboard
call qword [sym.imp.USER32.dll_RegisterClipboardFormatW]
mov ecx, eax
xor edx, edx
call qword [sym.imp.USER32.dll_SetClipboardData]
call qword [sym.imp.USER32.dll_CloseClipboard]
nop
lea rcx, [rsp + 0x58]
call fcn.14000daec
mov al, bpl
jmp 0x14002ba74
xor al, al
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x14002ba90
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
xor r12d, r12d
mov r15, r8
mov byte [r8], r12b
mov rbx, rdx
mov rcx, qword [rcx + 0x40]
mov sil, r12b
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x14002bbc8
lea ecx, [r12 + 0xd]
call qword [sym.imp.USER32.dll_GetClipboardData]
mov rbp, rax
test rax, rax
je 0x14002bbc2
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov r14, rax
test rax, rax
je 0x14002bbc2
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GlobalSize]
mov r13d, eax
lea esi, [r12 + 1]
lea rdi, [r13 + 1]
shr rdi, 1
sub edi, esi
js 0x14002bb55
mov rax, qword [rbx]
mov edx, esi
mov ecx, dword [rax - 0xc]
sub edx, dword [rax - 8]
sub ecx, edi
or edx, ecx
jge 0x14002bb30
mov edx, edi
mov rcx, rbx
call fcn.14000e2ac
mov rcx, qword [rbx]
cmp edi, dword [rcx - 0xc]
jg 0x14002bbe8
mov dword [rcx - 0x10], edi
mov r8, r13
mov rax, qword [rbx]
movsxd rdx, edi
mov word [rax + rdx*2], r12w
mov rdx, r14
call fcn.1402bec40
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea rcx, str.MSDEVColumnSelect
call qword [sym.imp.USER32.dll_RegisterClipboardFormatW]
mov ecx, eax
call qword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x14002bb7a
mov byte [r15], sil
lea rcx, str.WinMergeClipboard
call qword [sym.imp.USER32.dll_RegisterClipboardFormatW]
mov ecx, eax
call qword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
jne 0x14002bbc2
mov rcx, qword [rbx]
test rcx, rcx
jne 0x14002bba0
mov eax, r12d
jmp 0x14002bbad
movsxd rdx, dword [rcx - 0xc]
call fcn.140286a2c
test eax, eax
js 0x14002bbe8
mov rcx, qword [rbx]
cmp eax, dword [rcx - 0xc]
jg 0x14002bbe8
mov dword [rcx - 0x10], eax
mov ecx, eax
mov rax, qword [rbx]
mov word [rax + rcx*2], r12w
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rbx, qword [rsp + 0x50]
mov al, sil
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov ecx, 0x80070057
call fcn.14000e344
int3

Function at 0x140030500
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
lea r8, [rcx + 0x140]
mov rbx, rcx
mov edx, 0x3ed
mov rcx, rdi
call fcn.1401bc5b8
lea r8, [rbx + 0x228]
mov edx, 0x3ed
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1401e2a24
Function at 0x140039e14
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
sub rsp, 0x20
and qword [rcx], 0
mov rbx, rcx
lea rcx, str.icu.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [rbx], rax
test rax, rax
je 0x140039f4e
lea rdx, str.u_getVersion
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx]
lea rdx, str.ubrk_open
mov qword [0x140446c30], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx]
lea rdx, str.ubrk_openRules
mov qword [0x140446c18], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx]
lea rdx, str.ubrk_openBinaryRules
mov qword [0x140446c20], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx]
lea rdx, str.ubrk_setText
mov qword [0x140446c28], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx]
lea rdx, str.ubrk_close
mov qword [0x140446c00], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx]
lea rdx, str.ubrk_first
mov qword [0x140446c08], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx]
lea rdx, str.ubrk_previous
mov qword [0x140446c10], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx]
lea rdx, str.ubrk_next
mov qword [0x140446c40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx]
lea rdx, str.ubrk_preceding
mov qword [0x140446c38], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx]
lea rdx, str.ubrk_following
mov qword [0x140446bf8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx]
lea rdx, str.ubrk_next
mov qword [0x140446bf0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140446c38], rax
mov rax, rbx
add rsp, 0x20
pop rbx
ret
Function at 0x14003e97c
Capabilities:
Hash data using djb2

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov qword [rax + 8], rcx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rbx, qword [rcx]
mov ebp, r8d
mov r13, rdx
mov edi, 0x1505
cmp rbx, rdx
jae 0x14003eb30
mov r14b, 0xa
cmp byte [rbx], r14b
je 0x14003eaf9
cmp byte [rbx], 0xd
jne 0x14003ea26
lea rax, [r13 - 1]
cmp rbx, rax
je 0x14003eaf9
cmp byte [rbx + 1], r14b
jne 0x14003eaf9
test bpl, 0x10
jne 0x14003ea19
test bpl, 0x40
je 0x14003e9ef
mov al, byte [rbx]
sub al, 0x30
cmp al, 9
jbe 0x14003ea19
movsx eax, byte [rbx]
imul edi, edi, 0x21
movzx esi, al
test bpl, 0x20
je 0x14003ea17
test sil, sil
js 0x14003ea17
mov ecx, esi
call fcn.14028ffd0
test eax, eax
je 0x14003ea17
mov ecx, esi
call fcn.140290438
mov esi, eax
xor edi, esi
inc rbx
cmp rbx, r13
jb 0x14003e9b6
jmp 0x14003eb30
movzx ecx, byte [rbx]
call fcn.14028ff20
test eax, eax
je 0x14003e9e1
mov r12, rbx
lea rsi, [rbx + 1]
jmp 0x14003ea57
movzx ecx, byte [rsi]
call fcn.14028ff20
test eax, eax
je 0x14003ea5c
cmp byte [rsi], 0xd
je 0x14003ea5c
cmp byte [rsi], r14b
je 0x14003ea5c
inc rbx
inc rsi
cmp rsi, r13
jb 0x14003ea3b
lea rax, [rbx + 1]
cmp r13, rax
jbe 0x14003ea73
cmp byte [rax], 0xd
je 0x14003ea73
cmp byte [rax], r14b
je 0x14003ea73
xor eax, eax
jmp 0x14003ea78
mov eax, 1
test bpl, 2
jne 0x14003ea19
test bpl, 4
je 0x14003ea98
test eax, eax
jne 0x14003ea98
imul edi, edi, 0x21
lea esi, [rax + 0x20]
test sil, bpl
je 0x14003ea17
jmp 0x14003ea03
test bpl, 8
je 0x14003ea19
test eax, eax
jne 0x14003ea19
lea r15, [rbx + 1]
cmp r12, r15
je 0x14003ea19
mov r14d, ebp
and r14d, 0x20
movsx eax, byte [r12]
imul edi, edi, 0x21
movzx esi, al
test r14d, r14d
je 0x14003eae7
test sil, sil
js 0x14003eae7
mov ecx, esi
call fcn.14028ffd0
test eax, eax
je 0x14003eae7
mov ecx, esi
call fcn.140290438
mov esi, eax
xor edi, esi
inc r12
cmp r12, r15
jne 0x14003eabe
mov r14b, 0xa
jmp 0x14003ea19
imul edi, edi, 0x21
test bpl, 0x10
jne 0x14003eb05
mov r14b, byte [rbx]
movsx eax, r14b
movzx esi, al
test bpl, 0x20
je 0x14003eb2b
test sil, sil
js 0x14003eb2b
mov ecx, esi
call fcn.14028ffd0
test eax, eax
je 0x14003eb2b
mov ecx, esi
call fcn.140290438
mov esi, eax
xor edi, esi
inc rbx
mov rax, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov qword [rax], rbx
mov eax, edi
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14003eb58
Capabilities:
Hash data using djb2

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rbx, qword [rcx]
mov r14d, r8d
mov rsi, rdx
mov r15, rcx
mov edi, 0x1505
test r8b, 0x7e
je 0x14003ebd4
call fcn.14003e97c
jmp 0x14003ec0d
cmp byte [rbx], 0xa
je 0x14003ebdb
cmp byte [rbx], 0xd
jne 0x14003eba7
lea rax, [rsi - 1]
cmp rbx, rax
je 0x14003ebdb
cmp byte [rbx + 1], 0xa
jne 0x14003ebdb
movsx eax, byte [rbx]
imul edi, edi, 0x21
movzx ebp, al
test r14b, 0x20
je 0x14003ebcf
test bpl, bpl
js 0x14003ebcf
mov ecx, ebp
call fcn.14028ffd0
test eax, eax
je 0x14003ebcf
mov ecx, ebp
call fcn.140290438
mov ebp, eax
xor edi, ebp
inc rbx
cmp rbx, rsi
jb 0x14003eb8e
jmp 0x14003ec08
movsx eax, byte [rbx]
imul edi, edi, 0x21
movzx esi, al
test r14b, 0x20
je 0x14003ec03
test sil, sil
js 0x14003ec03
mov ecx, esi
call fcn.14028ffd0
test eax, eax
je 0x14003ec03
mov ecx, esi
call fcn.140290438
mov esi, eax
xor edi, esi
inc rbx
mov qword [r15], rbx
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x140069dc4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
movzx eax, word [rcx]
mov r14, rdx
mov rsi, rcx
xor edi, edi
jmp 0x140069f6a
movzx ebp, word [r14]
mov r15, rsi
add rsi, 2
cmp ax, 0x1a
je 0x140069fe1
cmp ax, 0x21
je 0x140069fcd
cmp ax, 0x2a
je 0x140069f9a
cmp ax, 0x3f
je 0x140069f5a
cmp ax, 0x5b
je 0x140069e81
cmp ax, 0x60
je 0x140069e50
movzx ecx, ax
call fcn.140287650
movzx ecx, bp
movzx ebx, ax
call fcn.140287650
cmp ax, bx
jne 0x14006a01c
jmp 0x140069f63
movzx esi, word [rsi]
movzx ecx, si
call fcn.140287650
movzx ecx, bp
movzx ebx, ax
call fcn.140287650
cmp ax, bx
jne 0x14006a01c
test si, si
je 0x14006a01c
lea rsi, [r15 + 4]
jmp 0x140069f63
movzx eax, word [rsi]
cmp ax, 0x21
jne 0x140069e91
lea rsi, [r15 + 4]
movzx eax, word [rsi]
setne r13b
mov r12b, r13b
xor r12b, 1
jmp 0x140069f38
test ax, ax
je 0x140069f42
cmp ax, 0x60
jne 0x140069ec0
add rsi, 2
movzx eax, word [rsi]
test ax, ax
je 0x140069f42
add rsi, 2
movzx r15d, ax
movzx ecx, word [rsi]
cmp cx, 0x2d
jne 0x140069ef5
add rsi, 2
movzx r15d, word [rsi]
cmp r15w, 0x60
jne 0x140069ee8
add rsi, 2
movzx r15d, word [rsi]
test r15w, r15w
je 0x140069f42
add rsi, 2
movzx ecx, word [rsi]
test cx, cx
je 0x140069f42
movzx ecx, ax
call fcn.140287650
movzx ecx, bp
movzx ebx, ax
call fcn.140287650
cmp ax, bx
jb 0x140069f35
movzx ecx, r15w
call fcn.140287650
movzx ecx, bp
movzx ebx, ax
call fcn.140287650
cmp ax, bx
movzx r12d, r12b
movzx eax, r13b
cmovbe r12d, eax
movzx eax, word [rsi]
cmp ax, 0x5d
jne 0x140069ea1
test r12b, r12b
je 0x14006a01c
cmp word [rsi], di
je 0x14006a01c
add rsi, 2
jmp 0x140069f63
test bp, bp
je 0x14006a01c
movzx eax, word [rsi]
add r14, 2
test ax, ax
jne 0x140069df0
cmp word [r14], di
sete dil
mov eax, edi
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov ebx, edi
test bp, bp
je 0x140069fb3
mov rax, r14
inc ebx
lea rax, [rax + 2]
cmp word [rax], di
jne 0x140069fa4
test ebx, ebx
js 0x14006a01c
movsxd rax, ebx
mov rcx, rsi
lea rdx, [r14 + rax*2]
call 0x140069dc4
test eax, eax
jne 0x14006a023
sub ebx, 1
jns 0x140069fb3
jmp 0x14006a01c
cmp word [rsi], di
je 0x14006a01c
mov rdx, r14
mov rcx, rsi
call 0x140069dc4
test eax, eax
jmp 0x140069f77
mov ebx, edi
test bp, bp
je 0x14006a004
mov rax, rdi
cmp bp, 0x2e
je 0x14006a000
inc rax
inc ebx
movzx ebp, word [r14 + rax*2]
test bp, bp
jne 0x140069feb
test ebx, ebx
js 0x14006a01c
movsxd rax, ebx
mov rcx, rsi
lea rdx, [r14 + rax*2]
call 0x140069dc4
test eax, eax
jne 0x14006a023
sub ebx, 1
jns 0x14006a004
xor eax, eax
jmp 0x140069f7d
mov eax, 1
jmp 0x140069f7d
test rdx, rdx
je 0x14006a03e
test rcx, rcx
jne 0x140069dc4
xor eax, eax
ret
Function at 0x14006a23c
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x10c0
call fcn.14021a050
sub rsp, rax
mov rax, qword [0x140412700]
xor rax, rsp
mov qword [rsp + 0x10b0], rax
mov rbx, rcx
call fcn.1401416c4
lea rdx, [0x14044b0d0]
mov rcx, rax
call fcn.140172b98
xor esi, esi
test al, al
je 0x14006a48a
mov rcx, rbx
call fcn.14017b4fc
test al, al
jne 0x14006a48a
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
mov rdx, rbx
cmp qword [rbx + 0x18], 7
jbe 0x14006a2b5
mov rdx, qword [rbx]
mov r8, qword [rbx + 0x10]
lea rcx, [rsp + 0x40]
call fcn.140038e84
nop
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.14017a540
nop
mov rax, qword [0x140447858]
test rax, rax
jne 0x14006a32e
mov qword [rsp + 0x28], rsi
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x20], rax
mov r9d, 0x800
xor r8d, r8d
lea rdx, str.ExternalArchiveFormat.ini
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SearchPathW]
dec eax
cmp eax, 0x7fe
ja 0x14006a320
lea rcx, [rsp + 0xb0]
call fcn.1402a4fa0
jmp 0x14006a327
lea rax, [0x140447850]
mov qword [0x140447858], rax
cmp word [rax], si
je 0x14006a3c3
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 7
cmova rdx, qword [rsp + 0x60]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], reloc.OLEAUT32.dll_SafeArrayLock
lea r9, [rsp + 0x80]
lea r8, [0x140447850]
lea rcx, str.extensions
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x14006a3c3
cmp word [rsp + 0x80], 0x2e
jne 0x14006a3c3
mov edx, 0x3b
lea rcx, [rsp + 0x80]
call qword [sym.imp.SHLWAPI.dll_StrChrW]
test rax, rax
je 0x14006a3b0
mov word [rax], si
lea rdx, [0x140397e14]
lea rcx, [rsp + 0x80]
call qword [sym.imp.SHLWAPI.dll_StrTrimW]
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x40]
call fcn.140011ae8
nop
lea rcx, [rsp + 0x40]
call fcn.14017bdc8
test al, al
jne 0x14006a413
mov ecx, 0x3b8
mov rax, qword gs:[0x58]
add rcx, qword [rax]
call fcn.14006a7ac
mov r8, rax
mov rcx, qword [rax]
mov rax, qword [rcx + 8]
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 7
cmova rdx, qword [rsp + 0x40]
mov rcx, r8
call qword [case.0x14001d845.0]
mov rdi, rax
test rax, rax
jne 0x14006a454
mov rbx, rsi
mov qword [rsp + 0x38], rbx
mov rax, qword [0x140446d18]
mov rdx, qword [0x140446d10]
sub rax, rdx
sar rax, 3
cmp rbx, rax
jae 0x14006a451
lea rcx, [rsp + 0x40]
mov rax, qword [rdx + rbx*8]
call qword [case.0x14001d845.0]
mov rdi, rax
test rax, rax
jne 0x14006a454
inc rbx
jmp 0x14006a416
mov rdi, rsi
lea rcx, [rsp + 0x60]
call fcn.14000dd24
nop
lea rcx, [rsp + 0x40]
call fcn.14000dd24
mov rax, rdi
jmp 0x14006a48c
xor eax, eax
mov rcx, qword [rsp + 0x10b0]
xor rcx, rsp
call fcn.1402194b0
lea r11, [rsp + 0x10c0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140078704
Capabilities:
Create process on windows

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [rsp + 0x28], 1
lea rdx, str.open
and qword [rsp + 0x20], 0
mov rcx, rax
xor r9d, r9d
mov r8, rbx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
add rsp, 0x30
pop rbx
ret

Function at 0x140078740
Capabilities:
Create process on windows

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [rsp + 0x28], 1
lea rdx, str.edit
and qword [rsp + 0x20], 0
mov rcx, rax
xor r9d, r9d
mov r8, rbx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp rax, 0x1f
jne 0x1400787b1
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [rsp + 0x28], 1
lea rdx, str.open
and qword [rsp + 0x20], 0
mov rcx, rax
xor r9d, r9d
mov r8, rbx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp rax, 0x1f
jne 0x1400787b1
mov rcx, rbx
call fcn.1400787b8
add rsp, 0x30
pop rbx
ret

Function at 0x1400787b8
Capabilities:
Create process on windows
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
lea rbp, [rsp - 0x190]
sub rsp, 0x290
mov rax, qword [0x140412700]
xor rax, rsp
mov qword [rbp + 0x180], rax
mov rbx, rcx
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x70]
call fcn.1402bf2e0
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x14007889a
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
mov r8d, CreateStdDispatch
lea rdx, str.shell32.dll_OpenAs_RunDLL
lea rcx, [rsp + 0x30]
call fcn.140013184
nop
mov r8, rbx
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x50]
call fcn.14006e244
nop
lea rcx, [rsp + 0x30]
call fcn.14000dd24
lea rbx, [rsp + 0x50]
cmp qword [rsp + 0x68], 7
cmova rbx, qword [rsp + 0x50]
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [rsp + 0x28], 1
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x20], rcx
mov r9, rbx
lea r8, str.RUNDLL32.EXE
xor edx, edx
mov rcx, rax
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
lea rcx, [rsp + 0x50]
call fcn.14000dd24
mov rcx, qword [rbp + 0x180]
xor rcx, rsp
call fcn.1402194b0
mov rbx, qword [rsp + 0x2a8]
add rsp, 0x290
pop rbp
ret

Function at 0x1400788bc
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
push rdi
sub rsp, 0x50
mov rdi, rcx
xorps xmm0, xmm0
movups xmmword [rax - 0x28], xmm0
xorps xmm1, xmm1
movdqu xmmword [rax - 0x18], xmm1
or r8, 0xffffffffffffffff
xor esi, esi
inc r8
cmp word [rcx + r8*2], si
jne 0x1400788e4
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.140013184
nop
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.14017a350
mov ebx, eax
lea rcx, [rsp + 0x30]
call fcn.14000dd24
cmp ebx, 1
jne 0x14007893d
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rsi
mov r9, rdi
lea r8, str.notepad.exe
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x140078949
lea rcx, str.http:__www.gnu.org_licenses_gpl_2.0.html
call fcn.140078704
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret