joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180047c48
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
xor r15d, r15d
lea r12, [0x180000000]
movzx eax, byte [r15 + r12 + 0x5ed10]
mov edi, eax
mov r8d, eax
shr edi, 5
mov r11d, eax
shr r8d, 6
mov ebp, edi
lea edx, [rax + rax]
shr r11d, 7
xor edx, eax
and ebp, 4
mov r10d, edi
mov r9d, r8d
and edi, 1
and r10d, 2
imul ecx, edi, 0x1b000000
and r8d, 1
lea ebx, [rdx + rdx]
and r9d, 2
lea edx, [rdx*4]
xor ebx, eax
xor edx, eax
shl ebx, 0x19
shl edx, 8
mov esi, eax
xor rbx, rcx
mov r14d, eax
imul ecx, r10d, 0x1b000000
xor rbx, rcx
imul ecx, r8d, 0x1b000000
xor rbx, rcx
imul ecx, r9d, 0x1b000000
xor rbx, rcx
imul ecx, ebp, 0x1b000000
xor rbx, rcx
imul ecx, r11d, 0x1b000000
xor rbx, rcx
imul ecx, edi, 0x11b00
xor rdx, rcx
imul ecx, r10d, 0x11b00
xor rdx, rcx
imul ecx, r8d, 0x11b00
xor rdx, rcx
imul ecx, r9d, 0x11b00
xor rdx, rcx
imul ecx, ebp, 0x11b00
xor rdx, rcx
imul ecx, edi, 0x11b0000
or rbx, rdx
lea edx, [rax*8]
xor edx, eax
lea eax, [rax*4]
shl edx, 0x10
xor eax, r14d
xor rdx, rcx
imul ecx, r10d, 0x11b0000
xor rdx, rcx
imul ecx, ebp, 0x11b0000
xor rdx, rcx
imul ecx, edi, 0x11b
or rbx, rdx
lea edx, [rax + rax]
xor rdx, rcx
imul ecx, r10d, 0x11b
xor rdx, rcx
imul ecx, ebp, 0x11b
xor rdx, rcx
imul ecx, r11d, 0x11b
xor rdx, rcx
xor rdx, rsi
or rdx, rbx
shl rdx, 0x20
or rdx, rbx
or rdx, rsi
mov qword [r12 + r15*8 + 0x786b0], rdx
inc r15
cmp r15, 0x100
jl 0x180047c6b
mov rbx, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov byte [0x180078eb1], 1
pop r15
pop r14
pop r12
ret

Function at 0x180047dd4
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xor r11d, r11d
lea rbx, [0x180000000]
movzx r9d, byte [r11 + rbx + 0x5ec10]
mov edx, r9d
shr edx, 7
imul r10d, edx, 0x1b000000
lea r8d, [r9 + r9]
imul ecx, edx, 0x11b
mov eax, r8d
shl eax, 0x18
xor r10, rax
mov eax, r9d
shl eax, 8
or eax, r9d
shl eax, 8
or r10, rax
mov eax, r8d
xor rcx, rax
xor rcx, r9
or rcx, r10
shl rcx, 0x20
or rcx, r10
mov qword [rbx + r11*8 + 0x77ea0], rcx
inc r11
cmp r11, 0x100
jl 0x180047de3
and qword [0x1800786a8], 0
and qword [0x1800786a0], 0
mov rbx, qword [rsp + 8]
mov byte [0x180078eb0], 1
ret
Function at 0x180049898
Capabilities:
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x90
mov rax, qword [0x180072180]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rbx, r8
mov rdi, rdx
mov ecx, dword [0x180078fb0]
mov rax, qword gs:[0x58]
mov edx, 4
mov rax, qword [rax + rcx*8]
mov ecx, dword [rdx + rax]
cmp dword [0x180078ec0], ecx
jg 0x18004997a
mov eax, ebx
cmp rbx, rax
jne 0x18004993c
xor ecx, ecx
test rbx, rbx
setne cl
xor eax, eax
test ebx, ebx
setne al
cmp ecx, eax
jne 0x18004993c
xor r9d, r9d
mov r8d, ebx
mov rdx, rdi
mov rcx, qword [0x180078eb8]
call sub.bcrypt.dll_BCryptGenRandom
test eax, eax
js 0x1800499bd
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.180051610
mov rbx, qword [rsp + 0xa0]
add rsp, 0x90
pop rdi
ret
mov ecx, 0x5b6
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rdx, str.GenerateBlock_size
lea rcx, [rsp + 0x20]
call fcn.180002260
nop
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x40]
call fcn.1800495c8
lea rdx, [0x18006ec90]
lea rcx, [rsp + 0x40]
call sub.VCRUNTIME140.dll__CxxThrowException
nop
lea rcx, [0x180078ec0]
call fcn.180051ee4
cmp dword [0x180078ec0], 0xffffffff
jne 0x1800498e4
lea rcx, [0x180078eb8]
call fcn.1800494dc
lea rcx, [0x18005512c]
call fcn.1800519f8
nop
lea rcx, [0x180078ec0]
call fcn.180051e78
jmp 0x1800498e4
mov ecx, eax
call fcn.180049a00
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rdx, [0x18005d788]
lea rcx, [rsp + 0x20]
call fcn.180002260
nop
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x40]
call fcn.1800495c8
lea rdx, [0x18006ec90]
lea rcx, [rsp + 0x40]
call sub.VCRUNTIME140.dll__CxxThrowException
int3

Function at 0x18004ae04
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
xor r14d, r14d
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
cmp r8, 8
jb 0x18004ae77
mov rbp, r8
shr rbp, 3
imul rax, rbp, 0xfffffffffffffff8
add rdi, rax
mov r8d, 8
lea rcx, [rsp + 0x58]
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov r8d, 8
lea rcx, [rsp + 0x50]
mov rdx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsp + 0x50]
add rsi, 8
xor rax, qword [rsp + 0x58]
add rbx, 8
or r14, rax
sub rbp, 1
jne 0x18004ae36
mov rcx, r14
shr rcx, 0x20
or ecx, r14d
mov edx, ecx
mov eax, ecx
shr edx, 8
or edx, ecx
shr eax, 0x10
and edx, 0xff00
or edx, eax
movzx eax, cl
shr edx, 8
or edx, eax
test rdi, rdi
je 0x18004aeb9
sub rsi, rbx
movzx ecx, byte [rsi + rbx]
movzx eax, byte [rbx]
inc rbx
xor ecx, eax
or edx, ecx
sub rdi, 1
jne 0x18004aea5
mov rbx, qword [rsp + 0x40]
test edx, edx
mov rbp, qword [rsp + 0x48]
sete al
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x18004aed4
Capabilities:
Encode data using xor

Disassembly:
test r9, r9
je 0x18004af9a
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov rbx, r9
mov r15d, 4
mov rdi, r8
mov rsi, rdx
mov r14, rcx
cmp rbx, r15
jb 0x18004af65
mov rbp, rbx
shr rbp, 2
imul rax, rbp, 0xfffffffffffffffc
add rbx, rax
mov r8, r15
lea rcx, [rsp + 0x20]
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov r8, r15
lea rcx, [rsp + 0x68]
mov rdx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [rsp + 0x68]
lea rdx, [rsp + 0x24]
xor eax, dword [rsp + 0x20]
mov r8, r15
mov rcx, r14
mov dword [rsp + 0x24], eax
call sub.VCRUNTIME140.dll_memcpy
add r14, r15
add rsi, r15
add rdi, r15
sub rbp, 1
jne 0x18004af1a
test rbx, rbx
je 0x18004af82
sub rsi, rdi
sub r14, rdi
mov al, byte [rsi + rdi]
xor al, byte [rdi]
mov byte [r14 + rdi], al
inc rdi
sub rbx, 1
jne 0x18004af70
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret

Function at 0x18004af9c
Capabilities:
Encode data using xor

Disassembly:
test r8, r8
je 0x18004b049
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov rbx, r8
mov r14d, 4
mov rsi, rdx
mov rdi, rcx
cmp rbx, r14
jb 0x18004b021
mov rbp, rbx
shr rbp, 2
imul rax, rbp, 0xfffffffffffffffc
add rbx, rax
mov r8, r14
lea rcx, [rsp + 0x68]
mov rdx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov r8, r14
lea rcx, [rsp + 0x60]
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [rsp + 0x60]
lea rdx, [rsp + 0x20]
xor eax, dword [rsp + 0x68]
mov r8, r14
mov rcx, rdi
mov dword [rsp + 0x20], eax
call sub.VCRUNTIME140.dll_memcpy
add rdi, r14
add rsi, r14
sub rbp, 1
jne 0x18004afd9
test rbx, rbx
je 0x18004b037
sub rsi, rdi
mov al, byte [rsi + rdi]
xor byte [rdi], al
inc rdi
sub rbx, 1
jne 0x18004b029
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x180050f64
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movdqu xmm1, xmmword [rcx]
mov r9d, 4
shl edx, 2
mov r8, rcx
movdqu xmm0, xmmword [rcx + rdx*4]
movdqu xmmword [rcx], xmm0
movdqu xmmword [rcx + rdx*4], xmm1
add edx, 0xfffffffc
cmp edx, r9d
jbe 0x180050fb3
aesimc xmm0, xmmword [r8 + rdx*4]
mov ecx, r9d
add r9d, 4
aesimc xmm1, xmmword [r8 + rcx*4]
movdqu xmmword [r8 + rcx*4], xmm0
movdqu xmmword [r8 + rdx*4], xmm1
add edx, 0xfffffffc
cmp r9d, edx
jb 0x180050f8a
mov eax, r9d
aesimc xmm0, xmmword [r8 + rax*4]
movdqu xmmword [r8 + rax*4], xmm0
ret
Function at 0x100043d08
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rdi
sub rsp, 0x60
mov rdi, rcx
call fcn.10005691c
mov rcx, rax
call qword [sym.imp.USER32.dll_GetMenu]
mov ebp, 1
mov edx, 0x800b
mov rcx, rax
mov r8d, ebp
mov rbx, rax
call qword [sym.imp.USER32.dll_EnableMenuItem]
mov r8d, ebp
mov edx, 0x8007
mov rcx, rbx
call qword [sym.imp.USER32.dll_EnableMenuItem]
mov r8d, ebp
mov edx, 0x8003
mov rcx, rbx
call qword [sym.imp.USER32.dll_EnableMenuItem]
mov r8d, ebp
mov edx, 0x8004
mov rcx, rbx
call qword [sym.imp.USER32.dll_EnableMenuItem]
mov r8d, ebp
mov edx, 0x8009
mov rcx, rbx
call qword [sym.imp.USER32.dll_EnableMenuItem]
mov r8d, ebp
mov edx, 0x8008
mov rcx, rbx
call qword [sym.imp.USER32.dll_EnableMenuItem]
mov r8d, ebp
mov edx, 0x800a
mov rcx, rbx
call qword [sym.imp.USER32.dll_EnableMenuItem]
and qword [rsp + 0x28], 0
mov r9, qword [0x1001a72b0]
and dword [rsp + 0x20], 0
lea r8, [0x10016f7a8]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.msvcrt.dll__beginthreadex]
jmp 0x100043e19
lea rcx, [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x100043e9e
lea rcx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_DispatchMessageW]
and dword [rsp + 0x20], 0
lea rcx, [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
jne 0x100043dcc
mov rcx, qword [0x1001a72b0]
mov edx, 0x64
mov rcx, qword [rcx + 0x2810]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x100043dfd
xor r8d, r8d
mov edx, 0x8003
mov rcx, rbx
call qword [sym.imp.USER32.dll_EnableMenuItem]
xor r8d, r8d
mov edx, 0x8004
mov rcx, rbx
call qword [sym.imp.USER32.dll_EnableMenuItem]
xor r8d, r8d
mov edx, 0x8009
mov rcx, rbx
call qword [sym.imp.USER32.dll_EnableMenuItem]
xor r8d, r8d
mov edx, 0x8008
mov rcx, rbx
call qword [sym.imp.USER32.dll_EnableMenuItem]
xor r8d, r8d
mov edx, 0x800a
mov rcx, rbx
call qword [sym.imp.USER32.dll_EnableMenuItem]
mov al, bpl
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
mov rbx, qword [0x1001a72b0]
mov rcx, qword [rbx + 0x2818]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [rbx + 0x2810]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rbx, qword [0x10019f520]
test rbx, rbx
je 0x100043ede
mov rcx, rbx
call fcn.10006275c
mov rcx, rbx
call sub.msvcrt.dll_free
mov rbx, qword [0x10019f588]
and qword [0x10019f520], 0
mov rcx, qword [rbx + 0x18]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, rbx
call fcn.100177328
mov rcx, qword [0x10019f588]
test rcx, rcx
je 0x100043f12
mov rax, qword [rcx]
mov edx, ebp
call qword [rax]
and qword [0x10019f588], 0
call qword [sym.imp.ole32.dll_CoUninitialize]
mov rcx, rdi
call sub.gdiplus.dll_GdiplusShutdown
call fcn.100056cbc
mov cl, al
call fcn.100170acc
xor al, al
jmp 0x100043e8e
Function at 0x100044a18
Capabilities:
Delete file

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x60
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov edi, 1
mov sil, dil
mov rcx, qword [0x10019f520]
xor ebp, ebp
cmp rcx, rbp
je 0x100044b0c
cmp byte [rcx + 0x18], bpl
je 0x100044b0c
cmp dword [rcx + 0x49ca0], ebp
jle 0x100044b0c
cmp byte [rcx + 0x19], bpl
je 0x100044b0c
call fcn.10004e4d8
mov rbx, rax
mov cl, byte [0x10019018a]
cmp cl, bpl
je 0x100044a95
lea rcx, [0x10019a4f8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov cl, byte [0x10019018a]
mov bl, byte [rbx + 0x279]
cmp cl, bpl
je 0x100044aad
lea rcx, [0x10019a4f8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp bl, bpl
je 0x100044ac3
mov ebx, 2
mov sil, bpl
mov rcx, qword [0x10019f520]
jmp 0x100044b14
cmp byte [0x100199d17], bpl
je 0x100044ad7
mov ebx, edi
mov rcx, qword [0x10019f520]
jmp 0x100044b14
mov dl, dil
mov cl, dil
call fcn.100053168
call fcn.100056cbc
mov bl, al
call fcn.10005691c
mov rcx, rax
mov dl, bl
call fcn.1001763f0
mov ebx, eax
xor edx, edx
xor ecx, ecx
call fcn.100053168
mov rcx, qword [0x10019f520]
jmp 0x100044b14
mov ebx, 2
mov sil, bpl
sub ebx, edi
je 0x100044b76
cmp ebx, edi
je 0x100044b24
mov dil, bpl
jmp 0x100044bf3
cmp rcx, rbp
je 0x100044bf3
cmp sil, bpl
je 0x100044b3e
call fcn.1000635a0
mov rcx, qword [0x10019f520]
xor r8d, r8d
lea rdx, [rsp + 0x28]
call fcn.100064a14
mov r11, qword [0x10019f520]
cmp byte [r11 + 0x19], bpl
je 0x100044b6a
cmp qword [rsp + 0x28], rbp
jbe 0x100044b6a
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, qword [rsp + 0x38]
call sub.msvcrt.dll_free
jmp 0x100044bf3
mov r8b, dil
lea rdx, [rsp + 0x40]
call fcn.100064a14
nop
cmp qword [rsp + 0x40], rbp
jbe 0x100044be9
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x2c], ebp
mov dword [rsp + 0x30], 0x10
mov qword [rsp + 0x38], rbp
lea r9, [0x100026888]
lea r8, [rsp + 0x28]
mov edx, 0xc0
lea ecx, [rdx + 0x40]
call fcn.100043f44
lea r8, [rsp + 0x28]
cmp dword [rsp + 0x28], ebp
cmovbe r8, rbp
lea rdx, [rsp + 0x40]
mov rcx, qword [0x10019f520]
call fcn.10006461c
nop
mov rcx, qword [rsp + 0x38]
cmp rcx, rbp
je 0x100044be9
call qword [sym.imp.msvcrt.dll_free]
nop
mov rcx, qword [rsp + 0x50]
call sub.msvcrt.dll_free
mov al, dil
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x100053168
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
sub rsp, 0x20
mov sil, dl
mov dil, cl
call fcn.10004e4d8
mov r8b, byte [0x10019018a]
xor ebp, ebp
lea r12, [0x10019a4f8]
mov rbx, rax
cmp r8b, bpl
je 0x1000531ad
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r8b, byte [0x10019018a]
mov ebx, dword [rbx + 0x240]
cmp r8b, bpl
je 0x1000531c1
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
neg dil
sbb edi, edi
and edi, 2
dec edi
add edi, ebx
cmovs edi, ebp
call fcn.10004e4d8
mov cl, byte [0x10019018a]
mov rbx, rax
cmp cl, bpl
je 0x1000531f2
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov cl, byte [0x10019018a]
mov dword [rbx + 0x240], edi
cmp cl, bpl
je 0x100053206
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.10004e4d8
mov cl, byte [0x10019018a]
mov rbx, rax
cmp cl, bpl
je 0x100053228
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov cl, byte [0x10019018a]
mov ebx, dword [rbx + 0x23c]
cmp cl, bpl
je 0x10005323c
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
neg sil
sbb esi, esi
and esi, 2
dec esi
add esi, ebx
cmovs esi, ebp
call fcn.10004e4d8
mov cl, byte [0x10019018a]
mov rbx, rax
cmp cl, bpl
je 0x10005326d
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov cl, byte [0x10019018a]
mov dword [rbx + 0x23c], esi
cmp cl, bpl
je 0x100053281
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.10005fcc4
cmp edi, ebp
mov rbx, rax
jle 0x1000532bb
cmp byte [rax], bpl
je 0x1000532ed
cmp byte [rax + 1], bpl
jne 0x1000532ed
mov rcx, qword [rax + 0x10]
cmp rcx, rbp
jne 0x1000532b1
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rcx, qword [rsp + 0x50]
mov qword [rbx + 0x10], rcx
mov byte [rbx + 1], 1
jmp 0x1000532e9
cmp byte [rax], bpl
je 0x1000532ed
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rcx, qword [rsp + 0x50]
cmp byte [rbx + 1], bpl
je 0x1000532e1
mov rdx, rcx
sub rdx, qword [rbx + 0x10]
add qword [rbx + 0x20], rdx
mov qword [rbx + 0x10], rbp
mov byte [rbx + 1], bpl
mov qword [rbx + 0x18], rcx
call fcn.10004e4d8
mov dl, byte [0x10019018a]
mov rbx, rax
cmp dl, bpl
je 0x10005330f
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dl, byte [0x10019018a]
cmp esi, ebp
setg cl
mov byte [rbx + 0x23a], cl
cmp dl, bpl
je 0x100053328
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.10004e4d8
mov r8b, byte [0x10019018a]
mov rbx, rax
cmp r8b, bpl
je 0x10005334c
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r8b, byte [0x10019018a]
cmp edi, ebp
setg dl
mov byte [rbx + 0x237], dl
cmp r8b, bpl
je 0x100053365
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r12
pop rdi
pop rsi
ret
Function at 0x10005eca0
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push r12
sub rsp, 0x40
mov rax, qword [0x100190170]
xor rax, rsp
mov qword [rsp + 0x38], rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
mov ebx, 4
mov r12d, 0x3ff
mov r11, rax
mov qword [0x10019aa88], rax
cmp qword [0x1001a7318], rax
je 0x10005edf5
movzx r8d, ax
mov qword [0x1001a7318], rax
mov edx, r8d
and edx, r12d
sub edx, ebx
je 0x10005ed4f
sub edx, 0xd
je 0x10005ed35
cmp edx, 1
je 0x10005ed1b
lea rax, [0x100199510]
mov qword [0x100199530], rax
jmp 0x10005edae
lea rax, [0x100199522]
mov byte [0x10019aa81], 0
mov qword [0x100199530], rax
jmp 0x10005edf5
lea rax, [0x100199528]
mov byte [0x10019aa81], 1
mov qword [0x100199530], rax
jmp 0x10005edf5
shr r8d, 0xa
mov byte [0x10019aa81], 1
sub r8d, 1
je 0x10005ed94
cmp r8d, 1
jne 0x10005ed08
lea rax, [0x100199516]
xor ecx, ecx
mov qword [0x100199530], rax
call fcn.10005e9bc
mov r11, qword [0x10019aa88]
mov rcx, qword [0x100199530]
test eax, eax
sete byte [0x10019aa81]
jmp 0x10005eda2
lea rcx, [0x10019951c]
mov qword [0x100199530], rcx
lea rax, [0x100199510]
cmp rcx, rax
jne 0x10005edf5
mov r9d, 5
lea r8, [rsp + 0x28]
movzx ecx, r11w
lea edx, [r9 - 2]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov rax, qword [0x100199530]
movzx r11d, word [rsp + 0x28]
mov word [rax], r11w
movzx ecx, word [rsp + 0x2a]
call qword [sym.imp.msvcrt.dll_towlower]
mov rcx, qword [0x100199530]
mov r11, qword [0x10019aa88]
mov word [rcx + 2], ax
mov rcx, r11
call qword [fcn.1000df40c]
test eax, eax
movzx eax, word [0x10019aa88]
setne dil
and ax, r12w
cmp ax, bx
jne 0x10005ee20
mov byte [0x10019a4f4], 1
test dil, dil
jne 0x10005ee27
mov byte [0x10019a4f4], 0
call fcn.10005691c
mov rcx, rax
call qword [fcn.1000df40c]
mov rbx, rax
test rax, rax
je 0x10005eeaa
cmp byte [0x10019a4f4], 0
je 0x10005ee72
lea r8, [rsp + 0x24]
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [fcn.1000df40c]
mov r11d, dword [rsp + 0x20]
and r11b, 1
neg r11b
sbb eax, eax
add eax, 2
mov dword [0x10019f5b0], eax
jmp 0x10005ee97
test dil, dil
je 0x10005ee90
mov rcx, rax
call qword [fcn.1000df40c]
test eax, eax
je 0x10005ee90
mov dword [0x10019f5b0], 1
jmp 0x10005ee97
and dword [0x10019f5b0], 0
call fcn.10005691c
mov rdx, rbx
mov rcx, rax
call qword [fcn.1000df40c]
jmp 0x10005eeb1
and dword [0x10019f5b0], 0
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.10017a260
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x40
pop r12
ret
Function at 0x10005f34c
Capabilities:
Get common file path
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x240
mov rax, qword [0x100190170]
xor rax, rsp
mov qword [rsp + 0x230], rax
xor edi, edi
cmp qword [0x10019f5a8], rdi
jne 0x10005f50a
lea rcx, [rsp + 0x20]
mov edx, 0x105
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, edi
je 0x10005f50a
lea rcx, [rsp + 0x20]
mov word [rsp + 0x228], di
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rcx, [0x100028320]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov edx, 0x104
add eax, ebx
cmp eax, edx
jg 0x10005f50a
lea r8, [0x100028320]
lea rcx, [rsp + 0x20]
call sub.msvcrt.dll_wcscat_s
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x10019f5a8], rax
cmp rax, rdi
je 0x10005f50a
lea rdx, [0x100028338]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x100199410]
lea rdx, [0x100028358]
cmp rax, rdi
cmovne rcx, rax
mov qword [0x100199410], rcx
mov rcx, qword [0x10019f5a8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x100199418]
lea rdx, [0x100028370]
cmp rax, rdi
cmovne rcx, rax
mov qword [0x100199418], rcx
mov rcx, qword [0x10019f5a8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x100199420]
lea rdx, [0x100028388]
cmp rax, rdi
cmovne rcx, rax
mov qword [0x100199420], rcx
mov rcx, qword [0x10019f5a8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x100199428]
lea rdx, [0x1000283a0]
cmp rax, rdi
cmovne rcx, rax
mov qword [0x100199428], rcx
mov rcx, qword [0x10019f5a8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x100199430]
lea rdx, [0x1000283b8]
cmp rax, rdi
cmovne rcx, rax
mov qword [0x100199430], rcx
mov rcx, qword [0x10019f5a8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [fcn.1000df40c]
lea rdx, [0x1000283d0]
cmp rax, rdi
cmovne rcx, rax
mov qword [fcn.1000df40c], rcx
mov rcx, qword [0x10019f5a8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [fcn.1000df40c]
cmp rax, rdi
cmovne rcx, rax
mov qword [fcn.1000df40c], rcx
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.10017a260
mov rbx, qword [rsp + 0x250]
add rsp, 0x240
pop rdi
ret
Function at 0x100060234
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
cmp qword [0x10019f5b8], 0
jne 0x100060337
lea rcx, [0x100028eb8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x10019f5b8], rax
test rax, rax
je 0x100060339
lea rdx, [0x100028ed0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x10019f5b8]
lea rdx, [0x100028ee0]
mov qword [0x10019f5c0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x10019f5b8]
lea rdx, [0x100028ef8]
mov qword [0x10019f5c8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x10019f5b8]
lea rdx, [0x100028f10]
mov qword [0x10019f5d0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x10019f5b8]
lea rdx, [0x100028f28]
mov qword [0x10019f5d8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x10019f5b8]
lea rdx, [0x100028f40]
mov qword [0x10019f5e0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x10019f5b8]
lea rdx, [0x100028f60]
mov qword [0x10019f5e8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x10019f5b8]
lea rdx, [0x100028f78]
mov qword [0x10019f5f0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x10019f5f8], rax
mov al, 1
add rsp, 0x28
ret