joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400ae890
Capabilities:
Decode data using base64 via dword translation table

Disassembly:
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbp
push rbx
mov qword [rsp + 0x60], r9
mov r10, qword [rcx]
mov ecx, dword [rcx + 8]
mov r11, qword [rdx]
mov esi, ecx
and esi, 0xfffffffc
mov edi, dword [rdx + 8]
xor ebx, ebx
xor ebp, ebp
test ecx, ecx
je 0x1400aeab5
lea r14, [0x140270b08]
mov eax, esi
sar eax, 2
lea eax, [rax + rax*2]
cmp edi, eax
jl 0x1400ae8d7
lea r15d, [rsi - 4]
jmp 0x1400ae8ee
mov edx, 0x55555556
mov eax, edx
imul edi
mov r15d, edx
shr r15d, 0x1f
add r15d, edx
shl r15d, 2
test r15d, r15d
jle 0x1400ae996
movsxd rax, ebx
lea rax, [r10 + rax*2]
movzx edx, word [rax]
movzx r12d, word [rax + 2]
movzx r13d, word [rax + 4]
movzx eax, word [rax + 6]
mov r9d, edx
or r9d, r12d
or r9d, r13d
or r9d, eax
test r9d, 0xffffff00
je 0x1400ae92c
mov r9d, 0xffffffff
jmp 0x1400ae963
movsxd rdx, edx
movsx rdx, byte [r14 + rdx]
movsxd r9, r12d
movsx r12, byte [r14 + r9]
movsxd r9, r13d
movsx r13, byte [r14 + r9]
cdqe
movsx rax, byte [r14 + rax]
shl edx, 0x12
shl r12d, 0xc
shl r13d, 6
or eax, edx
mov edx, eax
or r12d, r13d
or edx, r12d
mov r9d, edx
test r9d, r9d
jl 0x1400aead2
movsxd rax, ebp
add rax, r11
mov edx, r9d
sar edx, 0x10
mov byte [rax], dl
mov edx, r9d
sar edx, 8
mov byte [rax + 1], dl
mov byte [rax + 2], r9b
add ebp, 3
add ebx, 4
cmp ebx, r15d
jl 0x1400ae8f7
lea eax, [rsi - 4]
cmp r15d, eax
jne 0x1400aead2
cmp ebx, esi
je 0x1400aead2
lea eax, [rsi - 4]
cdqe
movzx eax, word [r10 + rax*2]
lea edx, [rsi - 3]
movsxd rdx, edx
movzx edx, word [r10 + rdx*2]
lea r9d, [rsi - 2]
movsxd r9, r9d
movzx r9d, word [r10 + r9*2]
lea r15d, [rsi - 1]
movsxd r15, r15d
movzx r10d, word [r10 + r15*2]
mov r15d, eax
or r15d, edx
or r15d, r9d
or r15d, r10d
test r15d, 0xffffff00
jne 0x1400aead2
cdqe
movsx rax, byte [r14 + rax]
movsxd rdx, edx
movsx rdx, byte [r14 + rdx]
shl eax, 0x12
shl edx, 0xc
or eax, edx
cmp r10d, 0x3d
je 0x1400aea5b
movsxd r9, r9d
movsx r9, byte [r14 + r9]
movsxd r10, r10d
movsx r10, byte [r14 + r10]
shl r9d, 6
or r10d, eax
mov eax, r10d
or eax, r9d
jl 0x1400aead2
add edi, 0xfffffffd
cmp ebp, edi
jg 0x1400aead2
movsxd r9, ebp
add r11, r9
mov edx, eax
sar edx, 0x10
mov byte [r11], dl
mov edx, eax
sar edx, 8
mov byte [r11 + 1], dl
mov byte [r11 + 2], al
add ebp, 3
jmp 0x1400aeaae
cmp r9d, 0x3d
je 0x1400aea97
movsxd r9, r9d
movsx r9, byte [r14 + r9]
shl r9d, 6
or eax, r9d
jl 0x1400aead2
lea edx, [rdi - 2]
cmp ebp, edx
jg 0x1400aead2
mov edx, eax
sar edx, 0x10
movsxd r9, ebp
mov byte [r11 + r9], dl
sar eax, 8
lea edx, [rbp + 1]
movsxd rdx, edx
mov byte [r11 + rdx], al
add ebp, 2
jmp 0x1400aeaae
test eax, eax
jl 0x1400aead2
lea edx, [rdi - 1]
cmp ebp, edx
jg 0x1400aead2
sar eax, 0x10
movsxd rdx, ebp
mov byte [r11 + rdx], al
inc ebp
add ebx, 4
cmp esi, ecx
jne 0x1400aead2
mov dword [r8], ebx
mov r9, qword [rsp + 0x60]
mov dword [r9], ebp
mov eax, 1
pop rbx
pop rbp
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
ret
mov dword [r8], ebx
mov r9, qword [rsp + 0x60]
mov dword [r9], ebp
xor eax, eax
pop rbx
pop rbp
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1400dc010
Capabilities:
Hash data using sha1

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
cmp qword [rsi], 0
jne 0x1400dc03a
lea rcx, [0x1402cfec8]
mov edx, 0x55
call fcn.140004670
mov rdx, rax
mov rcx, rsi
call fcn.140004890
xor eax, eax
mov qword [rsi + 8], rax
mov dword [rsi + 0x10], eax
mov rax, qword [rsi]
cmp dword [rax + 8], 0x50
jbe 0x1400dc0a8
mov dword [rax + 0x150], 0x67452301
mov rax, qword [rsi]
cmp dword [rax + 8], 0x51
jbe 0x1400dc0a8
mov dword [rax + 0x154], 0xefcdab89
mov rax, qword [rsi]
cmp dword [rax + 8], 0x52
jbe 0x1400dc0a8
mov dword [rax + 0x158], 0x98badcfe
mov rax, qword [rsi]
cmp dword [rax + 8], 0x53
jbe 0x1400dc0a8
mov dword [rax + 0x15c], 0x10325476
mov rax, qword [rsi]
cmp dword [rax + 8], 0x54
jbe 0x1400dc0a8
mov dword [rax + 0x160], 0xc3d2e1f0
add rsp, 0x20
pop rsi
ret
call fcn.14015a500
int3

Function at 0x1400e5800
Capabilities:
Get geographical location

Disassembly:
push rdi
push rsi
sub rsp, 0x28
mov rsi, rcx
mov edi, edx
call fcn.14000148a
cmp byte [rax], 0
je 0x1400e581e
xor eax, eax
add rsp, 0x28
pop rsi
pop rdi
ret
call fcn.140001242
cmp byte [rax], 0
jne 0x1400e5838
mov rcx, rsi
mov edx, edi
add rsp, 0x28
pop rsi
pop rdi
jmp fcn.1400e5f20
mov edx, edi
cmp byte [rsi + 0x1b8], 0
jne 0x1400e5849
or edx, 0x80000000
mov rcx, qword [rsi + 8]
add rsp, 0x28
pop rsi
pop rdi
jmp fcn.1400e6550

Function at 0x1400e5860
Capabilities:
Get geographical location

Disassembly:
push rdi
push rsi
sub rsp, 0x28
mov rsi, rcx
mov edi, edx
call fcn.14000148a
cmp byte [rax], 0
je 0x1400e587e
xor eax, eax
add rsp, 0x28
pop rsi
pop rdi
ret
call fcn.140001242
cmp byte [rax], 0
jne 0x1400e58a3
movzx ecx, byte [rsi + 0x1b8]
test ecx, ecx
jne 0x1400e58a3
mov rcx, rsi
mov edx, edi
add rsp, 0x28
pop rsi
pop rdi
jmp fcn.1400e5f20
mov edx, edi
cmp byte [rsi + 0x1b8], 0
jne 0x1400e58b4
or edx, 0x80000000
mov rcx, qword [rsi + 8]
add rsp, 0x28
pop rsi
pop rdi
jmp fcn.1400e6550

Function at 0x1400e6480
Capabilities:
Get geographical location

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0x20]
xor eax, eax
mov qword [rbp + 0x50], rax
mov rax, qword [0x140378098]
mov qword [rbp + 0x48], rax
test dword [rsp], esp
sub rsp, 0x430
lea rsi, [rsp + 0x20]
test rcx, rcx
je 0x1400e64c0
add rcx, 0xc
jmp 0x1400e64c2
xor ecx, ecx
mov qword [rbp + 0x50], rcx
mov qword [rbp + 0x38], rcx
mov dword [rbp + 0x44], edx
mov r8, rsi
mov qword [rbp + 0x30], r8
mov r9d, 0x212
mov dword [rbp + 0x40], r9d
lea rcx, [rbp + 8]
call fcn.1400049c0
mov rcx, qword [rbp + 0x38]
mov edx, dword [rbp + 0x44]
mov r8, qword [rbp + 0x30]
mov r9d, dword [rbp + 0x40]
call sub.KERNEL32.DLL_GetLocaleInfoEx
mov edi, eax
lea rcx, [rbp + 8]
call fcn.140004a10
xor ecx, ecx
mov qword [rbp + 0x50], rcx
mov qword [rbp + 0x50], rcx
test edi, edi
jle 0x1400e651e
mov rcx, rsi
call fcn.1400a1a80
jmp 0x1400e6520
xor eax, eax
lea rcx, [0x140378098]
mov rcx, qword [rcx]
cmp qword [rbp + 0x48], rcx
je 0x1400e6535
call fcn.140004d90
nop
lea rsp, [rbp + 0x58]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x1400e6550
Capabilities:
Get geographical location

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0xb0]
xor eax, eax
mov qword [rbp - 0x48], rax
or edx, 0x20000000
xor r8d, r8d
mov dword [rbp - 0x40], r8d
test rcx, rcx
je 0x1400e6586
add rcx, 0xc
jmp 0x1400e6588
xor ecx, ecx
mov qword [rbp - 0x48], rcx
mov qword [rbp - 0x58], rcx
lea r8, [rbp - 0x40]
mov qword [rbp - 0x60], r8
mov dword [rbp - 0x4c], edx
mov r9d, 4
mov dword [rbp - 0x50], r9d
lea rcx, [rbp - 0x88]
call fcn.1400049c0
mov rcx, qword [rbp - 0x58]
mov r8, qword [rbp - 0x60]
mov edx, dword [rbp - 0x4c]
mov r9d, dword [rbp - 0x50]
call sub.KERNEL32.DLL_GetLocaleInfoEx
lea rcx, [rbp - 0x88]
call fcn.140004a10
xor eax, eax
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x48], rax
mov eax, dword [rbp - 0x40]
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x14015b6c0
Capabilities:
Write file on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0xb0]
xor eax, eax
mov qword [rbp - 0x40], rax
mov rsi, rcx
mov rdi, rdx
mov ebx, r8d
mov qword [rbp - 0x40], r9
mov r14, r9
xor ecx, ecx
call sub.KERNEL32.DLL_SetLastError
mov r15, qword [rbp + 0x30]
mov qword [rsp + 0x20], r15
mov rcx, rsi
mov qword [rbp - 0x4c], rcx
mov rdx, rdi
mov qword [rbp - 0x54], rdx
mov r8d, ebx
mov dword [rbp - 0x44], r8d
mov r9, r14
mov qword [rbp - 0x5c], r9
lea rcx, [rbp - 0x88]
call fcn.1400049c0
mov rcx, qword [rbp - 0x4c]
mov rdx, qword [rbp - 0x54]
mov r8d, dword [rbp - 0x44]
mov r9, qword [rbp - 0x5c]
call sub.KERNEL32.DLL_WriteFile
mov esi, eax
lea rcx, [rbp - 0x88]
call fcn.140004a10
call sub.KERNEL32.DLL_GetLastError
mov edi, eax
xor eax, eax
mov qword [rbp - 0x40], rax
call fcn.14000313b
mov dword [rax + 8], edi
mov eax, esi
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret

Function at 0x140194470
Capabilities:
Create process on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0xb8
lea rbp, [rsp + 0xf0]
xor eax, eax
mov qword [rbp - 0x58], rax
xorps xmm4, xmm4
movaps xmmword [rbp - 0x50], xmm4
mov qword [rbp - 0x40], rax
mov r10, qword [rbp + 0x48]
mov rax, qword [rbp + 0x58]
test rcx, rcx
jne 0x1401944ad
xor ecx, ecx
jmp 0x1401944b9
add rcx, 0xc
mov qword [rbp - 0x40], rcx
mov rcx, qword [rbp - 0x40]
test rdx, rdx
jne 0x1401944c2
xor edx, edx
jmp 0x1401944ce
add rdx, 0xc
mov qword [rbp - 0x48], rdx
mov rdx, qword [rbp - 0x48]
xor r11d, r11d
cmp byte [rbp + 0x30], 0
setne r11b
test r10, r10
jne 0x1401944e2
xor esi, esi
jmp 0x1401944ee
add r10, 0xc
mov qword [rbp - 0x50], r10
mov rsi, qword [rbp - 0x50]
mov qword [rbp - 0x58], rax
mov r10d, dword [rbp + 0x38]
mov rdi, qword [rbp + 0x40]
mov rbx, qword [rbp + 0x50]
mov qword [rbp - 0x60], rcx
mov qword [rbp - 0x68], rdx
mov qword [rbp - 0x70], r8
mov qword [rbp - 0x78], r9
mov dword [rsp + 0x20], r11d
mov dword [rsp + 0x28], r10d
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rax
lea rcx, [rbp - 0xa0]
call fcn.1400049c0
mov rcx, qword [rbp - 0x60]
mov rdx, qword [rbp - 0x68]
mov r8, qword [rbp - 0x70]
mov r9, qword [rbp - 0x78]
call sub.KERNEL32.DLL_CreateProcessW
mov esi, eax
lea rcx, [rbp - 0xa0]
call fcn.140004a10
xor eax, eax
test esi, esi
setne al
movzx eax, al
add rsp, 0xb8
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x1400012ec
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x120
mov rbx, rcx
mov rcx, qword [rcx + 0x20]
call qword [sym.imp.USER32.DLL_GetDlgItem]
mov rcx, qword [rbx + 0x20]
mov edx, 9
mov rbp, rax
call qword [sym.imp.USER32.DLL_GetDlgItem]
xor edi, edi
lea rdx, [rsp + 0x50]
lea r8d, [rdi + 0x64]
mov rcx, rbp
mov rsi, rax
mov word [rsp + 0x50], di
call qword [sym.imp.USER32.DLL_GetWindowTextW]
lea rdx, [rsp + 0x50]
mov rcx, rsi
call qword [sym.imp.USER32.DLL_SetWindowTextW]
mov rcx, qword [rbx + 0x20]
lea rdx, [rsp + 0x130]
mov dword [rsp + 0x130], edi
mov dword [rsp + 0x134], edi
call qword [sym.imp.USER32.DLL_ClientToScreen]
lea r8d, [rdi + 0x10]
lea rcx, [rsp + 0x40]
xor edx, edx
call fcn.1400f3900
lea rdx, [rsp + 0x40]
mov rcx, rbp
call qword [sym.imp.USER32.DLL_GetWindowRect]
mov r8d, dword [rsp + 0x40]
mov r9d, dword [rsp + 0x44]
mov edi, dword [rsp + 0x48]
mov ebx, dword [rsp + 0x4c]
mov dword [rsp + 0x30], 4
sub edi, r8d
sub r8d, dword [rsp + 0x130]
sub ebx, r9d
sub r9d, dword [rsp + 0x134]
xor edx, edx
mov rcx, rsi
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x40], r8d
mov dword [rsp + 0x20], edi
mov dword [rsp + 0x44], r9d
call qword [sym.imp.USER32.DLL_SetWindowPos]
mov r8d, dword [rsp + 0x44]
mov edx, dword [rsp + 0x40]
mov r9d, edi
mov rcx, rsi
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], ebx
call qword [sym.imp.USER32.DLL_MoveWindow]
xor edx, edx
mov rcx, rbp
call qword [sym.imp.USER32.DLL_ShowWindow]
lea r11, [rsp + 0x120]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14000480c
Capabilities:
Get common file path
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
xor esi, esi
mov rdi, rcx
mov rcx, qword [rcx]
mov ebx, esi
cmp rcx, rsi
je 0x140004832
call qword [sym.imp.KERNEL32.DLL_lstrlenW]
mov ebx, eax
lea edx, [rbx + 0x2d0]
mov rcx, rdi
movsxd rdx, edx
call fcn.14005fb18
cmp ebx, esi
jg 0x1400048e1
mov rax, qword [rdi]
lea rcx, [0x14010d8c0]
mov r8d, 0x208
mov word [rax], si
mov rdx, qword [rdi]
call qword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableW]
cmp eax, esi
mov ebx, eax
jg 0x1400048c6
mov rdx, qword [rdi]
lea rcx, [0x14010d8b0]
mov r8d, 0x208
call qword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableW]
cmp eax, esi
mov ebx, eax
jg 0x1400048c6
mov rdx, qword [rdi]
xor r9d, r9d
xor ecx, ecx
lea r8d, [r9 + 0x24]
call qword [sym.imp.SHELL32.DLL_SHGetSpecialFolderPathW]
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.DLL_lstrlenW]
movsxd rbx, eax
cmp ebx, esi
jle 0x1400048e1
mov rax, qword [rdi]
lea rdx, [0x14010d8a0]
lea rcx, [rax + rbx*2]
call qword [sym.imp.KERNEL32.DLL_lstrcpyW]
add ebx, 5
cmp ebx, esi
jle 0x1400048e1
mov rax, qword [rdi]
movsxd rcx, ebx
mov edx, 0x5c
mov word [rax + rcx*2], dx
mov rax, qword [rdi]
inc ebx
movsxd rcx, ebx
mov word [rax + rcx*2], si
mov rdx, qword [rdi]
lea rcx, [0x14012d0c0]
call fcn.140026924
cmp ebx, esi
jle 0x140004900
mov rcx, qword [rdi]
call fcn.1400f2c08
cmp eax, esi
jne 0x14000493c
mov rdx, qword [rdi]
xor r9d, r9d
xor ecx, ecx
lea r8d, [r9 + 0x24]
call qword [sym.imp.SHELL32.DLL_SHGetSpecialFolderPathW]
mov rcx, qword [rdi]
lea rdx, [0x14010d890]
call qword [sym.imp.KERNEL32.DLL_lstrcatW]
mov rdx, qword [rdi]
lea rcx, [0x14012d0c0]
call fcn.140026924
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.DLL_lstrlenW]
mov ebx, eax
mov rsi, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140004f54
Capabilities:
Get geographical location
Query environment variable

Disassembly:
push rbx
sub rsp, 0x70
xor ebx, ebx
lea rdx, [rsp + 0x20]
lea rcx, [0x14010daa0]
lea r8d, [rbx + 0x20]
mov word [rsp + 0x20], bx
call qword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableW]
movzx r11d, word [rsp + 0x20]
cmp r11w, bx
jne 0x140004fa0
lea r9d, [rbx + 0x20]
lea r8, [rsp + 0x20]
lea edx, [rbx + 0xb]
mov ecx, 0x800
call qword [sym.imp.KERNEL32.DLL_GetLocaleInfoW]
mov r11w, word [rsp + 0x20]
lea rax, [rsp + 0x20]
cmp r11w, bx
lea rdx, [0x14010da98]
lea rcx, [0x14012ca60]
cmovne rdx, rax
call fcn.14006adb0
mov rcx, qword [0x14012ca60]
call fcn.140060d9c
movzx ecx, word [0x14012c96c]
cmp eax, 1
cmovg cx, ax
mov word [0x14012c96c], cx
add rsp, 0x70
pop rbx
ret

Function at 0x1400050fc
Capabilities:
Allocate thread local storage

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
lea rcx, [0x14010dad0]
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov rbx, rax
test rax, rax
je 0x1400050f0
lea rdx, [0x14010dab0]
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov rdi, rax
test rax, rax
je 0x1400050e7
mov edx, 1
mov ecx, 0x233
call rdi
mov edx, 1
lea ecx, [rdx + 0x49]
call rdi
mov edx, 1
lea ecx, [rdx + 0x48]
call rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_FreeLibrary]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_SetErrorMode]
or eax, 0x8001
mov ecx, eax
call qword [sym.imp.KERNEL32.DLL_SetErrorMode]
mov ecx, 0xfffffff6
call qword [sym.imp.KERNEL32.DLL_GetStdHandle]
mov ecx, 0xfffffff4
mov qword [0x14012a340], rax
call qword [sym.imp.KERNEL32.DLL_GetStdHandle]
mov ecx, 0xfffffff5
mov qword [0x14012a350], rax
call qword [sym.imp.KERNEL32.DLL_GetStdHandle]
cmp qword [0x14012d2d8], 0
mov qword [0x14012a348], rax
jne 0x140005162
call qword [sym.imp.KERNEL32.DLL_GetProcessHeap]
mov qword [0x14012d2d8], rax
and qword [0x14012cae0], 0
lea rax, [0x14012cae0]
mov qword [0x14012d110], rax
call qword [sym.imp.KERNEL32.DLL_TlsAlloc]
xor ecx, ecx
mov dword [0x14012c934], eax
call fcn.140017930
add rsp, 0x28
jmp 0x140005090
Function at 0x140005194
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rdi
sub rsp, 0x20
mov edi, ecx
lea rcx, [rax + 0x10]
xor ebx, ebx
mov dword [rax + 0x10], 8
mov dword [rax + 0x14], ebx
call qword [sym.imp.USER32.DLL_GetLastInputInfo]
mov edx, dword [0x14012c9f4]
mov eax, dword [rsp + 0x3c]
sub eax, edx
cmp eax, ebx
cmovg edx, dword [rsp + 0x3c]
mov dword [0x14012c9f4], edx
call qword [sym.imp.KERNEL32.DLL_GetTickCount]
mov dword [0x14012c9f4], eax
mov al, byte [0x14012a25f]
cmp al, bl
jle 0x14000522d
lea rcx, [rsp + 0x38]
mov dword [rsp + 0x3c], ebx
call qword [sym.imp.USER32.DLL_GetLastInputInfo]
call qword [sym.imp.KERNEL32.DLL_GetTickCount]
mov r8d, dword [rsp + 0x3c]
mov ecx, eax
sub ecx, r8d
cmp ecx, edi
jb 0x140005216
mov edx, dword [0x14012c9f4]
sub eax, edx
cmp eax, edi
jae 0x140005238
mov ecx, 0xa
call qword [sym.imp.KERNEL32.DLL_Sleep]
mov r11b, byte [0x14012a25f]
cmp r11b, bl
jg 0x1400051e7
mov r8d, dword [rsp + 0x3c]
mov edx, dword [0x14012c9f4]
mov ecx, r8d
sub ecx, edx
cmp ecx, ebx
mov cl, byte [0x14012a25f]
cmovg edx, r8d
cmp cl, bl
setg bl
mov dword [0x14012c9f4], edx
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14000528c
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x98
lea rdx, [rsp + 0x20]
lea rcx, [0x14010dae0]
mov r8d, 0x63
mov byte [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableA]
movzx r11d, byte [0x14012c9f0]
cmp byte [rsp + 0x20], 0x31
mov eax, 1
cmove r11d, eax
mov byte [0x14012c9f0], r11b
add rsp, 0x98
ret

Function at 0x140005534
Capabilities:
Read file via mapping

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
push rdi
sub rsp, 0x30
mov qword [rax - 0x10], rcx
mov rsi, rdx
xor r9d, r9d
xor edx, edx
or rcx, 0xffffffffffffffff
mov r8d, 0x8000004
mov dword [rax - 0x18], 0x64
call qword [sym.imp.KERNEL32.DLL_CreateFileMappingW]
mov rdi, rax
test rax, rax
je 0x1400055c3
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 6]
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_MapViewOfFile]
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
test rbx, rbx
je 0x1400055c3
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 0x64]
call fcn.1400052d8
mov dword [rbx], 0xffffffff
mov qword [rbx + 0x10], rsi
lea rcx, [rbx + 8]
mov qword [0x14012a050], rcx
mov qword [0x14012ca10], rbx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x140005680
Capabilities:
Read file via mapping

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rsi, rcx
xor ecx, ecx
mov rbp, rdx
call qword [sym.imp.KERNEL32.DLL_SetLastError]
xor r9d, r9d
xor edx, edx
mov r8d, 0x8000004
or rcx, 0xffffffffffffffff
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], 0x64
call qword [sym.imp.KERNEL32.DLL_CreateFileMappingA]
mov bl, 1
mov rdi, rax
test rax, rax
je 0x1400056df
call qword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0xb7
jne 0x1400056f7
xor bl, bl
jmp 0x1400056f7
mov r8, rbp
xor edx, edx
mov ecx, 0x8000004
call qword [sym.imp.KERNEL32.DLL_OpenFileMappingA]
mov rdi, rax
test rax, rax
je 0x140005748
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 6]
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_MapViewOfFile]
mov rcx, rdi
mov qword [0x14012ca20], rax
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov r11, qword [0x14012ca20]
test r11, r11
je 0x140005748
test bl, bl
je 0x140005745
xor edx, edx
mov rcx, r11
lea r8d, [rdx + 0x64]
call fcn.1400f3900
mov r11, qword [0x14012ca20]
mov qword [r11], rsi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x140007ba0
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x130
lea rdx, [0x14010e050]
xor ecx, ecx
call fcn.140005680
call fcn.140004f54
mov byte [0x14012c96f], 1
call fcn.1400f0318
call fcn.140059ba4
lea rcx, [0x14010e020]
call qword [sym.imp.USER32.DLL_RegisterWindowMessageW]
xor r9d, r9d
lea rdx, [rsp + 0x20]
lea r8d, [r9 + 0x24]
xor ecx, ecx
mov byte [rsp + 0x20], 0
mov dword [0x14012c9d4], eax
call qword [sym.imp.SHELL32.DLL_SHGetSpecialFolderPathA]
lea rdx, [0x14010e008]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.DLL_lstrcatA]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
lea rcx, [0x14010dffc]
mov rbx, rax
mov qword [0x14012cf88], rax
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
lea rcx, [0x14010dff4]
mov qword [0x14012cf80], rax
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
lea rdx, [0x14010dfe0]
mov rcx, rbx
mov qword [0x14012cf90], rax
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
movsx edx, byte [0x14012a009]
lea rbx, [0x14012d0c0]
lea r8, [0x14010dfd0]
mov qword [0x14012c970], rax
mov rcx, rbx
call fcn.140062c80
lea r8, [0x14010dfc0]
mov edx, 8
mov rcx, rbx
call fcn.140062c80
mov edx, dword [0x14012c9d4]
lea r8, [0x14010df88]
mov rcx, rbx
call fcn.140062c80
add rsp, 0x130
pop rbx
ret
Function at 0x140007cb0
Capabilities:
Terminate process

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x38
mov qword [rsp + 0x70], rcx
movzx edi, word [rcx]
add rcx, 8
mov ebp, 0x20
mov qword [rsp + 0x70], rcx
lea r12d, [rbp - 0x17]
cmp r12w, word [rcx]
ja 0x140007ce3
cmp word [rcx], 0xd
jbe 0x140007cf1
cmp bp, word [rcx]
je 0x140007cf1
add rcx, 2
mov qword [rsp + 0x70], rcx
call fcn.14000528c
call qword [sym.imp.KERNEL32.DLL_GetTickCount]
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x88]
xor esi, esi
mov dword [0x14012c9f4], eax
mov qword [rsp + 0x80], rsi
call fcn.14006ac98
lea rcx, [rsp + 0x78]
call fcn.14005fa18
mov rdx, qword [rsp + 0x88]
lea r8, [rsp + 0x78]
lea rcx, [0x14012d0c0]
xor r9d, r9d
mov byte [rsp + 0x20], 1
call fcn.1400742a0
mov rdx, qword [rsp + 0x78]
lea rcx, [rsp + 0x80]
call fcn.14006adb0
mov r11, qword [rsp + 0x80]
lea rcx, [rsp + 0x78]
mov qword [rsp + 0x70], r11
call fcn.140057768
lea rcx, [rsp + 0x88]
call fcn.140057768
mov rcx, qword [rsp + 0x70]
call fcn.140005264
lea r8d, [rsi + 0xf]
lea rcx, [0x14010e0a8]
mov rdx, rax
mov rbx, rax
mov qword [rsp + 0x70], rax
call qword [sym.imp.SHLWAPI.DLL_StrCmpNIW]
cmp eax, esi
jne 0x140007df4
movzx eax, word [rbx + 0x1e]
cmp r12w, ax
ja 0x140007db9
cmp ax, 0xd
jbe 0x140007dc3
cmp bp, ax
je 0x140007dc3
cmp ax, si
jne 0x140007df4
mov rcx, qword [rsp + 0x70]
lea rdx, [0x14010e088]
mov r8d, 0x1e
mov bl, 0x49
call fcn.14001c8fc
mov rcx, qword [rsp + 0x70]
add rcx, 0x1e
call fcn.140005264
mov rdx, rax
mov qword [rsp + 0x70], rax
jmp 0x140007e1b
lea rdx, [rsp + 0x70]
lea rcx, [0x14010e078]
mov r8d, 8
call fcn.1400623c0
cmp al, sil
je 0x140007ea4
mov rdx, qword [rsp + 0x70]
mov bl, 0x53
mov r13d, 0x22
cmp r13w, di
jne 0x140007e6c
mov rcx, rdx
call qword [sym.imp.KERNEL32.DLL_lstrlenW]
mov rdx, qword [rsp + 0x70]
movsxd rcx, eax
lea rax, [rdx + rcx*2 - 2]
cmp rax, rdx
jbe 0x140007e6c
cmp r12w, word [rax]
ja 0x140007e4e
cmp word [rax], 0xd
jbe 0x140007e53
cmp bp, word [rax]
jne 0x140007e59
sub rax, 2
jmp 0x140007e3d
cmp rax, rdx
jbe 0x140007e6c
cmp r13w, word [rax]
jne 0x140007e6c
mov word [rax], si
mov rdx, qword [rsp + 0x70]
sub rdx, 2
movsx eax, bl
mov ecx, 0x7e
mov qword [rsp + 0x70], rdx
mov word [rdx], ax
mov rax, qword [rsp + 0x70]
sub rax, 2
mov qword [rsp + 0x70], rax
mov word [rax], cx
mov rcx, qword [rsp + 0x70]
call fcn.1400164b4
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_ExitProcess]
lea rdx, [rsp + 0x70]
lea rcx, [0x14010e068]
mov r8d, 0xe
call fcn.1400623c0
cmp al, sil
je 0x140007ed3
mov rcx, qword [rsp + 0x70]
call fcn.14000830c
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_ExitProcess]
lea rcx, [rsp + 0x80]
call fcn.140057768
xor eax, eax
add rsp, 0x38
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret