joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1406f99f8
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1406f9b7f
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1406f9a29
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406f9a0f
add dl, dl
jne 0x1406f9a36
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406f9a96
xor eax, eax
add dl, dl
jne 0x1406f9a45
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406f9b4d
add dl, dl
jne 0x1406f9a56
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406f9a63
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406f9a70
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406f9a7d
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1406f9a8a
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1406f9a1e
mov eax, 1
add dl, dl
jne 0x1406f9aa6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406f9ab3
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406f9a9b
sub eax, ebx
mov ebx, 1
jne 0x1406f9aec
mov ecx, 1
add dl, dl
jne 0x1406f9ace
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1406f9adb
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406f9ac3
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1406f9a1e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1406f9b08
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1406f9b15
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406f9afd
cmp eax, 0x7d00
jae 0x1406f9b3b
cmp eax, 0x500
jb 0x1406f9b36
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1406f9a1e
cmp eax, 0x7f
ja 0x1406f9b3e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1406f9a1e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1406f9b72
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1406f9a1e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140011a70
Capabilities:
Check for software breakpoints

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [rcx + 0x24], 0xca
mov rbx, rcx
jne 0x140011ad5
mov rax, qword [rcx + 8]
mov edx, 1
lea r8d, [rdx + 0x2f]
call qword [rax]
lea rcx, [0x140017f00]
mov qword [rbx + 0x218], rax
mov qword [rax], rcx
lea rcx, [0x140018060]
mov qword [rax + 8], rcx
mov rcx, rbx
mov byte [rax + 0x10], 0
call fcn.140017d10
cmp byte [rbx + 0x58], 0
je 0x140011ace
mov dword [rbx + 0x24], 0xcf
mov al, 1
add rsp, 0x20
pop rbx
ret
mov dword [rbx + 0x24], 0xcb
mov eax, dword [rbx + 0x24]
cmp eax, 0xcb
jne 0x140011b61
mov rax, qword [rbx + 0x238]
cmp byte [rax + 0x20], 0
je 0x140011b48
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x140011afe
mov rcx, rbx
call qword [rax]
mov rax, qword [rbx + 0x238]
mov rcx, rbx
call qword [rax]
test eax, eax
je 0x140011b40
cmp eax, 2
je 0x140011b48
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x140011af0
cmp eax, 3
je 0x140011b26
cmp eax, 1
jne 0x140011af0
inc dword [rcx + 8]
mov eax, dword [rcx + 8]
mov rcx, qword [rbx + 0x10]
cmp eax, dword [rcx + 0xc]
jl 0x140011af0
mov eax, dword [rbx + 0x188]
add dword [rcx + 0xc], eax
jmp 0x140011af0
xor al, al
add rsp, 0x20
pop rbx
ret
mov eax, dword [rbx + 0x9c]
mov rcx, rbx
mov dword [rbx + 0xa4], eax
add rsp, 0x20
pop rbx
jmp 0x140011b90
cmp eax, 0xcc
je 0x140011b83
mov rax, qword [rbx]
mov dword [rax + 0x28], shutdown
mov rcx, qword [rbx]
mov eax, dword [rbx + 0x24]
mov dword [rcx + 0x2c], eax
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp 0x140011b90
mov qword [rsp + 0x18], rbp
push rdi
sub rsp, 0x20
xor ebp, ebp
cmp dword [rcx + 0x24], 0xcc
mov rdi, rcx
je 0x140011bbe
mov rax, qword [rcx + 0x218]
call qword [rax]
mov dword [rdi + 0x98], ebp
mov dword [rdi + 0x24], 0xcc
mov rax, qword [rdi + 0x218]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rsi
cmp byte [rax + 0x10], bpl
je 0x140011c6e
nop dword [rax]
mov ecx, dword [rdi + 0x98]
cmp ecx, dword [rdi + 0x78]
jae 0x140011c3d
nop dword [rax + rax]
mov rax, qword [rdi + 0x10]
test rax, rax
je 0x140011c0f
mov dword [rax + 8], ecx
mov rcx, qword [rdi + 0x10]
mov eax, dword [rdi + 0x78]
mov dword [rcx + 0xc], eax
mov rax, qword [rdi + 0x10]
mov rcx, rdi
call qword [rax]
mov rax, qword [rdi + 0x220]
mov ebx, dword [rdi + 0x98]
lea r8, [rdi + 0x98]
xor r9d, r9d
xor edx, edx
mov rcx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov ecx, dword [rdi + 0x98]
cmp ecx, ebx
je 0x140011c96
cmp ecx, dword [rdi + 0x78]
jb 0x140011bf0
mov rax, qword [rdi + 0x218]
mov rcx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r11, qword [rdi + 0x218]
mov rcx, rdi
call qword [r11]
mov dword [rdi + 0x98], ebp
mov rax, qword [rdi + 0x218]
cmp byte [rax + 0x10], bpl
jne 0x140011be0
cmp byte [rdi + 0x59], bpl
mov al, 1
setne bpl
add ebp, 0xcd
mov dword [rdi + 0x24], ebp
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
xor al, al
jmp 0x140011c81
Function at 0x140011b90
Capabilities:
Check for software breakpoints

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [rcx + 0x24], 0xca
mov rbx, rcx
jne 0x140011ad5
mov rax, qword [rcx + 8]
mov edx, 1
lea r8d, [rdx + 0x2f]
call qword [rax]
lea rcx, [0x140017f00]
mov qword [rbx + 0x218], rax
mov qword [rax], rcx
lea rcx, [0x140018060]
mov qword [rax + 8], rcx
mov rcx, rbx
mov byte [rax + 0x10], 0
call fcn.140017d10
cmp byte [rbx + 0x58], 0
je 0x140011ace
mov dword [rbx + 0x24], 0xcf
mov al, 1
add rsp, 0x20
pop rbx
ret
mov dword [rbx + 0x24], 0xcb
mov eax, dword [rbx + 0x24]
cmp eax, 0xcb
jne 0x140011b61
mov rax, qword [rbx + 0x238]
cmp byte [rax + 0x20], 0
je 0x140011b48
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x140011afe
mov rcx, rbx
call qword [rax]
mov rax, qword [rbx + 0x238]
mov rcx, rbx
call qword [rax]
test eax, eax
je 0x140011b40
cmp eax, 2
je 0x140011b48
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x140011af0
cmp eax, 3
je 0x140011b26
cmp eax, 1
jne 0x140011af0
inc dword [rcx + 8]
mov eax, dword [rcx + 8]
mov rcx, qword [rbx + 0x10]
cmp eax, dword [rcx + 0xc]
jl 0x140011af0
mov eax, dword [rbx + 0x188]
add dword [rcx + 0xc], eax
jmp 0x140011af0
xor al, al
add rsp, 0x20
pop rbx
ret
mov eax, dword [rbx + 0x9c]
mov rcx, rbx
mov dword [rbx + 0xa4], eax
add rsp, 0x20
pop rbx
jmp 0x140011b90
cmp eax, 0xcc
je 0x140011b83
mov rax, qword [rbx]
mov dword [rax + 0x28], shutdown
mov rcx, qword [rbx]
mov eax, dword [rbx + 0x24]
mov dword [rcx + 0x2c], eax
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp 0x140011b90
mov qword [rsp + 0x18], rbp
push rdi
sub rsp, 0x20
xor ebp, ebp
cmp dword [rcx + 0x24], 0xcc
mov rdi, rcx
je 0x140011bbe
mov rax, qword [rcx + 0x218]
call qword [rax]
mov dword [rdi + 0x98], ebp
mov dword [rdi + 0x24], 0xcc
mov rax, qword [rdi + 0x218]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rsi
cmp byte [rax + 0x10], bpl
je 0x140011c6e
nop dword [rax]
mov ecx, dword [rdi + 0x98]
cmp ecx, dword [rdi + 0x78]
jae 0x140011c3d
nop dword [rax + rax]
mov rax, qword [rdi + 0x10]
test rax, rax
je 0x140011c0f
mov dword [rax + 8], ecx
mov rcx, qword [rdi + 0x10]
mov eax, dword [rdi + 0x78]
mov dword [rcx + 0xc], eax
mov rax, qword [rdi + 0x10]
mov rcx, rdi
call qword [rax]
mov rax, qword [rdi + 0x220]
mov ebx, dword [rdi + 0x98]
lea r8, [rdi + 0x98]
xor r9d, r9d
xor edx, edx
mov rcx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov ecx, dword [rdi + 0x98]
cmp ecx, ebx
je 0x140011c96
cmp ecx, dword [rdi + 0x78]
jb 0x140011bf0
mov rax, qword [rdi + 0x218]
mov rcx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r11, qword [rdi + 0x218]
mov rcx, rdi
call qword [r11]
mov dword [rdi + 0x98], ebp
mov rax, qword [rdi + 0x218]
cmp byte [rax + 0x10], bpl
jne 0x140011be0
cmp byte [rdi + 0x59], bpl
mov al, 1
setne bpl
add ebp, 0xcd
mov dword [rdi + 0x24], ebp
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
xor al, al
jmp 0x140011c81
Function at 0x1400147b0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
xor esi, esi
mov rbx, rcx
mov qword [rcx + 8], rsi
mov ecx, 0x98
mov dword [rsp + 0x38], esi
call qword [sym.imp.MSVCR100.dll_malloc]
mov rdi, rax
test rax, rax
jne 0x1400147f7
mov rdx, qword [rbx]
mov dword [rdx + 0x28], 0x38
mov rcx, qword [rbx]
mov dword [rcx + 0x2c], esi
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx]
mov dword [rdi + 0x5c], 0x3b9aca00
lea rax, [fcn.140013890]
lea rcx, str.JPEGMEM
mov qword [rdi], rax
lea rax, [fcn.140013a20]
mov qword [rdi + 8], rax
lea rax, [fcn.140013b10]
mov qword [rdi + 0x10], rax
lea rax, [fcn.140013c00]
mov qword [rdi + 0x18], rax
lea rax, [0x140013d10]
mov qword [rdi + 0x20], rax
lea rax, [0x140013dc0]
mov qword [rdi + 0x28], rax
lea rax, [0x140013e70]
mov qword [rdi + 0x30], rax
lea rax, [0x140014020]
mov qword [rdi + 0x38], rax
lea rax, [0x140014280]
mov qword [rdi + 0x40], rax
lea rax, [0x1400144f0]
mov qword [rdi + 0x48], rax
lea rax, [0x140014630]
mov qword [rdi + 0x50], rax
mov eax, dword [rsp + 0x38]
mov dword [rdi + 0x58], eax
mov qword [rdi + 0x68], rsi
mov qword [rdi + 0x78], rsi
mov qword [rdi + 0x60], rsi
mov qword [rdi + 0x70], rsi
mov qword [rdi + 0x80], rsi
mov qword [rdi + 0x88], rsi
mov dword [rdi + 0x90], 0x98
mov qword [rbx + 8], rdi
call qword [sym.imp.MSVCR100.dll_getenv]
test rax, rax
je 0x140014904
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x38]
lea rdx, str._ld_c
mov rcx, rax
mov byte [rsp + 0x30], 0x78
call qword [sym.imp.MSVCR100.dll_sscanf]
test eax, eax
jle 0x140014904
movzx eax, byte [rsp + 0x30]
cmp al, 0x6d
je 0x1400148f1
cmp al, 0x4d
je 0x1400148f1
mov eax, dword [rsp + 0x38]
jmp 0x1400148fb
mov eax, dword [rsp + 0x38]
imul eax, eax, 0x3e8
imul eax, eax, 0x3e8
mov dword [rdi + 0x58], eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x140022550
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rdi
push r12
push r13
push r15
sub rsp, 0x30
cmp dword [rcx + 0x64], 1
mov r15, qword [rcx + 0x268]
mov rdi, rcx
jne 0x14002257d
mov ebx, 0x1fe
mov byte [r15 + 0x38], 1
jmp 0x140022583
xor ebx, ebx
mov byte [r15 + 0x38], bl
mov rax, qword [rcx + 8]
mov r9d, dword [rcx + 0x7c]
lea r8d, [rbx + 0x100]
mov edx, 1
call qword [rax + 0x10]
mov r13d, dword [r15 + 0x28]
xor r12d, r12d
movsxd rcx, ebx
mov qword [r15 + 0x30], rax
mov qword [rsp + 0x68], rcx
cmp dword [rdi + 0x7c], r12d
jle 0x1400226d4
mov qword [rsp + 0x70], rbp
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], r14
lea r14, [r15 + 0x3c]
xor ebp, ebp
nop dword [rax]
mov esi, dword [r14]
mov eax, r13d
cdq
idiv esi
mov r13d, eax
test rcx, rcx
je 0x1400225ed
mov rax, qword [r15 + 0x30]
add qword [rax + rbp], 0xff
mov rax, qword [r15 + 0x30]
xor r8d, r8d
xor r10d, r10d
mov r11, qword [rax + rbp]
lea eax, [rsi - 1]
lea ebx, [rax + rax]
add eax, 0xff
cdq
idiv ebx
xor edi, edi
mov r9d, eax
nop
cmp r10d, r9d
jle 0x140022646
mov eax, r8d
imul eax, eax, 0x1fe
lea ecx, [rax + rsi + 0xfe]
nop word [rax + rax]
add ecx, 0x1fe
inc r8d
mov eax, ecx
cdq
idiv ebx
mov r9d, eax
cmp r10d, eax
jg 0x140022630
movzx eax, r8b
inc rdi
inc r10d
imul r13b
mov byte [rdi + r11 - 1], al
cmp rdi, 0xff
jle 0x140022610
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1400226ab
mov ecx, 1
lea rdx, [r11 - 1]
nop word [rax + rax]
movzx eax, byte [r11]
inc rcx
dec rdx
mov byte [rdx + 1], al
movzx eax, byte [r11 + 0xff]
mov byte [r11 + rcx + 0xfe], al
cmp rcx, 0xff
jle 0x140022680
mov rcx, qword [rsp + 0x68]
mov rax, qword [rsp + 0x60]
inc r12d
add r14, 4
add rbp, 8
cmp r12d, dword [rax + 0x7c]
jl 0x1400225d0
mov r14, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r13
pop r12
pop rdi
pop rbx
ret
Function at 0x140029d00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov ebx, dword [rcx + 0x44]
mov rdi, rcx
mov qword [rsp + 0x30], rbp
nop word [rax + rax]
mov edx, dword [rdi + 0x94]
mov esi, dword [rdi + 0x58]
mov eax, dword [rdi + 0x44]
sub esi, dword [rdi + 0x9c]
lea ecx, [rbx + rax - reloc.mfc100.dll_Ordinal_262]
sub esi, edx
cmp edx, ecx
jb 0x140029daf
mov rcx, qword [rdi + 0x50]
mov r8, rbx
lea rdx, [rcx + rbx]
call sub.MSVCR100.dll_memcpy
mov r8d, dword [rdi + 0x74]
mov rax, qword [rdi + 0x68]
sub dword [rdi + 0x98], ebx
sub dword [rdi + 0x94], ebx
sub dword [rdi + 0x84], ebx
lea rdx, [rax + r8*2]
nop dword [rax]
movzx eax, word [rdx - 2]
sub rdx, 2
cmp eax, ebx
jb 0x140029d80
sub eax, ebx
jmp 0x140029d82
xor eax, eax
dec r8d
mov word [rdx], ax
jne 0x140029d70
mov rax, qword [rdi + 0x60]
mov edx, ebx
lea rcx, [rax + rbx*2]
movzx eax, word [rcx - 2]
sub rcx, 2
cmp eax, ebx
jb 0x140029da4
sub eax, ebx
jmp 0x140029da6
xor eax, eax
dec edx
mov word [rcx], ax
jne 0x140029d94
add esi, ebx
mov rcx, qword [rdi]
cmp dword [rcx + 8], 0
je 0x140029e9f
mov edx, dword [rdi + 0x9c]
mov eax, dword [rdi + 0x94]
mov r8d, esi
add rdx, rax
add rdx, qword [rdi + 0x50]
call fcn.140029ab0
add dword [rdi + 0x9c], eax
mov r9d, dword [rdi + 0x9c]
cmp r9d, 3
jb 0x140029e17
mov eax, dword [rdi + 0x94]
mov rdx, qword [rdi + 0x50]
mov ecx, dword [rdi + 0x80]
movzx r8d, byte [rax + rdx]
mov dword [rdi + 0x70], r8d
shl r8d, cl
inc eax
movzx eax, byte [rax + rdx]
xor r8d, eax
and r8d, dword [rdi + 0x7c]
mov dword [rdi + 0x70], r8d
cmp r9d, reloc.mfc100.dll_Ordinal_262
jae 0x140029e2d
mov rax, qword [rdi]
cmp dword [rax + 8], 0
jne 0x140029d20
mov ecx, dword [rdi + 0x1718]
mov esi, dword [rdi + 0x58]
cmp ecx, esi
jae 0x140029e9f
mov eax, dword [rdi + 0x94]
lea ebx, [r9 + rax]
cmp ecx, ebx
jae 0x140029e71
sub esi, ebx
mov eax, Ordinal_262
mov ecx, ebx
cmp esi, eax
cmova esi, eax
add rcx, qword [rdi + 0x50]
xor edx, edx
mov r8d, esi
call sub.MSVCR100.dll_memset
lea r11d, [rsi + rbx]
mov dword [rdi + 0x1718], r11d
jmp 0x140029e9f
lea eax, [rbx + 0x102]
cmp ecx, eax
jae 0x140029e9f
sub ebx, ecx
sub esi, ecx
mov eax, Ordinal_262
add ebx, eax
cmp ebx, esi
cmova ebx, esi
add rcx, qword [rdi + 0x50]
xor edx, edx
mov r8d, ebx
call sub.MSVCR100.dll_memset
add dword [rdi + 0x1718], ebx
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400407d0
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rdx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rbx], rax
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x140040880
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x38
lea r9, [rsp + 0x58]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
or ecx, 0xffffffff
test eax, eax
cmovne ecx, dword [rsp + 0x58]
mov eax, ecx
add rsp, 0x38
ret
sub rsp, 0x28
mov rax, r8
test rdx, rdx
jne 0x1400408e5
test rax, rax
jne 0x1400408d4
call qword [sym.imp.MSVCR100.dll__errno]
mov dword [rax], reloc.WSOCK32.dll_shutdown
xor eax, eax
add rsp, 0x28
ret
movsxd r8, dword [r8 + 4]
mov rdx, qword [rax + 8]
add rsp, 0x28
jmp 0x140040880
movsxd r8, dword [rdx + 4]
mov rdx, qword [rdx + 8]
add rsp, 0x28
jmp 0x140040880

Function at 0x1400408b0
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x38
lea r9, [rsp + 0x58]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
or ecx, 0xffffffff
test eax, eax
cmovne ecx, dword [rsp + 0x58]
mov eax, ecx
add rsp, 0x38
ret
sub rsp, 0x28
mov rax, r8
test rdx, rdx
jne 0x1400408e5
test rax, rax
jne 0x1400408d4
call qword [sym.imp.MSVCR100.dll__errno]
mov dword [rax], reloc.WSOCK32.dll_shutdown
xor eax, eax
add rsp, 0x28
ret
movsxd r8, dword [r8 + 4]
mov rdx, qword [rax + 8]
add rsp, 0x28
jmp 0x140040880
movsxd r8, dword [rdx + 4]
mov rdx, qword [rdx + 8]
add rsp, 0x28
jmp 0x140040880

Function at 0x1400414b0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
sub rsp, 0x40
mov rax, qword [rsp + 0x80]
test r9, r9
mov rbp, rcx
lea rdi, [rsp + 0x78]
lea rbx, [rsp + 0x30]
mov ecx, 0x10
cmovne rdi, r9
test rax, rax
mov r12d, r8d
cmovne rbx, rax
mov rsi, rdx
call sub.mfc100.dll_Ordinal_1272
test rax, rax
je 0x140041567
mov r8, rsi
mov rdx, rbp
mov rcx, rax
call fcn.1400409a0
test rax, rax
je 0x140041567
mov edx, dword [rsp + 0x98]
lea r8, [0x140041400]
mov r9, rax
xor ecx, ecx
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], r12d
call qword [sym.imp.MSVCR100.dll__beginthreadex]
mov qword [rbx], rax
lea rax, [rsp + 0x30]
cmp rbx, rax
jne 0x140041548
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rbx], 0
je 0x140041552
xor eax, eax
jmp 0x140041576
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call qword [sym.imp.MSVCR100.dll__errno]
mov dword [rax], ebx
cmp ebx, 8
jne 0x140041573
call qword [sym.imp.MSVCR100.dll__errno]
mov dword [rax], reloc.OLEAUT32.dll_VariantTimeToDosDateTime
or eax, 0xffffffff
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
add rsp, 0x40
pop r12
pop rdi
pop rsi
ret

Function at 0x140041590
Capabilities:
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, ecx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
call fcn.140041360
mov rcx, rax
mov edx, ebx
call fcn.140040df0
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x1400415c0
Capabilities:
Allocate thread local storage

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rsi, r8
mov rbp, rdx
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov edi, eax
mov dword [rbx], eax
cmp eax, 0xffffffff
je 0x140041603
call fcn.140041360
mov r9, rsi
mov r8, rbp
mov rcx, rax
mov edx, edi
call fcn.140040f50
jmp 0x140041627
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call qword [sym.imp.MSVCR100.dll__errno]
mov dword [rax], ebx
cmp ebx, 8
jne 0x140041624
call qword [sym.imp.MSVCR100.dll__errno]
mov dword [rax], reloc.OLEAUT32.dll_VariantTimeToDosDateTime
or eax, 0xffffffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140042a00
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x28
lea rcx, str.IS_ApplicationBarcodeBuffer___called
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rax, qword [0x1403c3c18]
add rsp, 0x28
ret

Function at 0x140048a70
Capabilities:
Copy file

Disassembly:
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xd0
mov qword [rbp - 0x59], 0xfffffffffffffffe
mov qword [rsp + 0xe0], rbx
mov rax, qword [0x1403c2c80]
xor rax, rsp
mov qword [rbp + 0x4f], rax
mov qword [rbp - 0x39], shutdown
xor ebx, ebx
mov qword [rbp - 0x41], rbx
mov byte [rbp - 0x51], bl
lea r8d, [rbx + 0x14]
lea rdx, str.SystemProperties.ini
lea rcx, [rbp - 0x51]
call fcn.140008ba0
nop
call fcn.14006c390
lea rdx, [rax + 0x10]
lea r8, str..Config_
lea rcx, [rbp + 0x27]
call fcn.14000d180
nop
lea r8, [rbp - 0x51]
mov rdx, rax
lea rcx, [rbp - 1]
call fcn.14000d2a0
nop
cmp qword [rbp + 0x3f], 0x10
jb 0x140048afd
mov rcx, qword [rbp + 0x27]
call fcn.140290ed8
mov qword [rbp + 0x3f], shutdown
mov qword [rbp + 0x37], rbx
mov byte [rbp + 0x27], 0
cmp qword [rbp - 0x39], 0x10
jb 0x140048b1d
mov rcx, qword [rbp - 0x51]
call fcn.140290ed8
mov qword [rbp - 0x39], shutdown
mov qword [rbp - 0x41], rbx
mov byte [rbp - 0x51], 0
lea r8, str..bak
lea rdx, [rbp - 1]
lea rcx, [rbp - 0x29]
call fcn.14000d180
lea rdx, [rbp - 0x29]
cmp qword [rbp - 0x11], 0x10
cmovae rdx, qword [rbp - 0x29]
lea rcx, [rbp - 1]
cmp qword [rbp + 0x17], 0x10
cmovae rcx, qword [rbp - 1]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileA]
cmp qword [rbp - 0x11], 0x10
jb 0x140048b76
mov rcx, qword [rbp - 0x29]
call fcn.140290ed8
mov qword [rbp - 0x11], shutdown
mov qword [rbp - 0x19], rbx
mov byte [rbp - 0x29], 0
cmp qword [rbp + 0x17], 0x10
jb 0x140048b96
mov rcx, qword [rbp - 1]
call fcn.140290ed8
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.1402912a0
mov rbx, qword [rsp + 0xe0]
add rsp, 0xd0
pop rbp
ret
Function at 0x140082600
Capabilities:
Get disk size

Disassembly:
sub rsp, 0x28
cmp qword [rcx + 0x18], 0x10
jb 0x14008260e
mov rcx, qword [rcx]
lea r9, [rsp + 0x38]
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
test eax, eax
je 0x140082641
movabs rax, 0x431bde82d7b634db
mul qword [rsp + 0x30]
shr rdx, 0x12
mov eax, edx
add rsp, 0x28
ret
or eax, 0xffffffff
add rsp, 0x28
ret

Function at 0x140082820
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
mov rdi, rcx
mov edx, 1
mov rcx, rbx
call fcn.14019c930
mov rcx, rbx
test rdi, rdi
jne 0x14008288a
xor edx, edx
call fcn.14019c890
xor edx, edx
mov rcx, rax
call fcn.14019c890
mov rcx, rax
movsd xmm1, qword [0x1402ca4b0]
call fcn.14019c980
mov rcx, rax
movsd xmm1, qword [0x1402ca4b0]
call fcn.14019c980
xor edx, edx
mov rcx, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.14019c890
mov edx, dword [rdi]
call fcn.14019c890
mov edx, dword [rdi + 4]
mov rcx, rax
call fcn.14019c890
mov rcx, rax
movsd xmm1, qword [rdi + 8]
call fcn.14019c980
mov rcx, rax
movsd xmm1, qword [rdi + 0x10]
call fcn.14019c980
mov edx, dword [rdi + 0x20]
mov rcx, rax
call fcn.14019c890
mov r8d, dword [rdi + 0x20]
mov rdx, qword [rdi + 0x18]
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.14019c720
Function at 0x1400a7430
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x28
lea rcx, [0x1402d79c8]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, [0x1403c3ed0]
add rsp, 0x28
jmp qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]

Function at 0x1400a7460
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x28
lea rcx, str._____IS_BarcodeImageReaderTasmanBars::deinitialize__
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, [0x1403c3ed0]
add rsp, 0x28
jmp qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
Function at 0x1400b83f0
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rdi, rcx
mov rdx, rcx
lea rcx, [rsp + 0x20]
mov r8d, 1
call fcn.14003fc30
mov rax, qword [rdi + 0x28]
mov rbx, qword [rax]
cmp rbx, rax
je 0x1400b8435
nop dword [rax]
mov rcx, qword [rbx + 0x10]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rbx, qword [rbx]
cmp rbx, qword [rdi + 0x28]
jne 0x1400b8420
mov rax, qword [rdi + 0x28]
mov rcx, qword [rax]
mov qword [rax], rax
mov rax, qword [rdi + 0x28]
mov qword [rax + 8], rax
mov qword [rdi + 0x30], 0
cmp rcx, qword [rdi + 0x28]
je 0x1400b8466
mov rbx, qword [rcx]
call fcn.140290ed8
mov rcx, rbx
cmp rbx, qword [rdi + 0x28]
jne 0x1400b8455
lea rcx, [rsp + 0x20]
call fcn.14003fc70
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret