joyce8/EMBER2024-capa huggingface dataset:
Function at 0x520a60
Capabilities:
Parse credit card information

Disassembly:
lea ecx, [rax - 0x61]
cmp cl, 0x19
jbe 0x520a78
lea ecx, [rax - 0x41]
cmp cl, 0x19
jbe 0x520a78
lea ecx, [rax - 0x30]
cmp cl, 9
ja 0x520a80
xor eax, eax
ret
cmp rbx, 3
je 0x520a8c
cmp rbx, 4
jne 0x520ab9
cmp al, 0x2c
ja 0x520aa6
lea ecx, [rax - 0x21]
cmp cl, 1
jbe 0x520ab6
cmp al, 0x24
je 0x520ab6
nop dword [rax]
cmp al, 0x26
jae 0x520ab6
jmp 0x520ab9
lea ecx, [rax - 0x3a]
cmp cl, 4
jbe 0x520ab6
cmp al, 0x5b
je 0x520ab6
cmp al, 0x5d
jne 0x520ab9
xor eax, eax
ret
cmp al, 0x2f
ja 0x520af2
nop dword [rax]
cmp al, 0x26
ja 0x520ad1
cmp al, 0x24
je 0x520b11
cmp al, 0x26
je 0x520b11
jmp 0x520b8b
lea ecx, [rax - 0x2b]
cmp cl, 1
jbe 0x520b11
lea ecx, [rax - 0x2d]
nop dword [rax]
cmp cl, 1
jbe 0x520b88
cmp al, 0x2f
je 0x520b11
jmp 0x520b8b
cmp al, 0x3d
ja 0x520b09
lea ecx, [rax - 0x3a]
cmp cl, 1
jbe 0x520b11
nop
cmp al, 0x3d
je 0x520b11
jmp 0x520b8b
lea ecx, [rax - 0x3f]
cmp cl, 1
ja 0x520b80
cmp rbx, 2
jg 0x520b47
cmp rbx, 1
je 0x520b41
nop dword [rax]
cmp rbx, 2
jne 0x520b8b
cmp al, 0x2f
je 0x520b32
cmp al, 0x3b
je 0x520b32
cmp al, 0x2c
jne 0x520b39
mov ecx, 1
jmp 0x520b3e
cmp al, 0x3f
sete cl
mov eax, ecx
ret
cmp al, 0x3f
sete al
ret
cmp rbx, 5
jne 0x520b6a
cmp al, 0x40
je 0x520b59
cmp al, 0x2f
je 0x520b59
cmp al, 0x3f
jne 0x520b62
mov ecx, 1
nop
jmp 0x520b67
cmp al, 0x3a
sete cl
mov eax, ecx
ret
cmp rbx, 6
je 0x520b79
cmp rbx, 7
jne 0x520b8b
xor eax, eax
ret
mov eax, 1
ret
cmp al, 0x5f
je 0x520b88
cmp al, 0x7e
jne 0x520b8b
xor eax, eax
ret
cmp rbx, 7
jne 0x520ba1
cmp al, 0x21
je 0x520b9d
lea ecx, [rax - 0x28]
cmp cl, 2
ja 0x520ba1
xor eax, eax
nop
ret
mov eax, 1
ret
Function at 0x140004600
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, rsp
and rsp, 0xfffffffffffffff0
xor r8, r8
push r8
push rax
pushfq
push r8
push rdx
sub rsp, 0xa8
push r8
push r15
push r14
push r13
push r12
push rbx
push r8
push rsi
push rdi
push rbp
push rax
push rdx
sub rsp, 0x280
movdqa xmmword [rsp + 0x2e0], xmm6
movdqa xmmword [rsp + 0x2f0], xmm7
movdqa xmmword [rsp + 0x300], xmm8
movdqa xmmword [rsp + 0x310], xmm9
movdqa xmmword [rsp + 0x320], xmm10
movdqa xmmword [rsp + 0x330], xmm11
movdqa xmmword [rsp + 0x340], xmm12
movdqa xmmword [rsp + 0x350], xmm13
movdqa xmmword [rsp + 0x360], xmm14
movdqa xmmword [rsp + 0x370], xmm15
mov eax, dword [0x1404ff608]
mov rbx, qword gs:[0x58]
mov rbx, qword [rbx + rax*8]
mov eax, 0x10
add rax, rbx
lea rdx, [rsp + 0x20]
xor r8, r8
mov qword [rdx + 0x10], r8
mov byte [rdx + 0x19], 1
mov dword [rdx + 0x1c], 0xffffffff
mov byte [rdx + 0x18], 2
mov r8, qword [rax + 0x80]
mov qword [rdx], r8
mov qword [rax + 0x80], rdx
lea r8, [rsp + 0x280]
mov qword [rdx + 8], r8
call fcn.14012bec0
int3
push r15
push r14
push r13
push r12
push rbx
push rsi
push rdi
push rbp
sub rsp, 0xd8
movdqa xmmword [rsp + 0x20], xmm6
movdqa xmmword [rsp + 0x30], xmm7
movdqa xmmword [rsp + 0x40], xmm8
movdqa xmmword [rsp + 0x50], xmm9
movdqa xmmword [rsp + 0x60], xmm10
movdqa xmmword [rsp + 0x70], xmm11
movdqa xmmword [rsp + 0x80], xmm12
movdqa xmmword [rsp + 0x90], xmm13
movdqa xmmword [rsp + 0xa0], xmm14
movdqa xmmword [rsp + 0xb0], xmm15
mov qword [rsp + 0x120], rcx
mov qword [rsp + 0x128], rdx
mov qword [rsp + 0x130], r8
mov qword [rsp + 0x138], r9
mov eax, dword [0x1404ff608]
mov rbx, qword gs:[0x58]
mov rbx, qword [rbx + rax*8]
mov eax, 0x10
add rax, rbx
mov qword [rsp + 0xc0], rax
cmp rcx, qword [rax + 0x88]
sete byte [rsp + 0xd0]
lock and dword [rax + 0x38], 0xffffffef
mov rax, qword [r8 + 0x18]
mov rbx, qword [rax]
mov rax, qword [r8 + 0x20]
mov rbp, qword [rax]
mov rax, qword [r8 + 0x28]
mov rsi, qword [rax]
mov rax, qword [r8 + 0x30]
mov rdi, qword [rax]
mov rax, qword [r8 + 0x58]
mov r12, qword [rax]
mov rax, qword [r8 + 0x60]
mov r13, qword [rax]
mov rax, qword [r8 + 0x68]
mov r14, qword [rax]
mov rax, qword [r8 + 0x70]
mov r15, qword [rax]
movdqa xmm6, xmmword [r8 + 0x90]
movdqa xmm7, xmmword [r8 + 0xa0]
movdqa xmm8, xmmword [r8 + 0xb0]
movdqa xmm9, xmmword [r8 + 0xc0]
movdqa xmm10, xmmword [r8 + 0xd0]
movdqa xmm11, xmmword [r8 + 0xe0]
movdqa xmm12, xmmword [r8 + 0xf0]
movdqa xmm13, xmmword [r8 + 0x100]
movdqa xmm14, xmmword [r8 + 0x110]
movdqa xmm15, xmmword [r8 + 0x120]
mov rcx, qword [r8 + 0x78]
mov rdx, qword [rsp + 0x120]
call qword [rsp + 0x128]
mov r8, qword [rsp + 0x130]
mov rdx, qword [rsp + 0xc0]
mov rcx, qword [rdx + 0x70]
cmp rcx, 0
je 0x140004790
mov r9, qword [rdx + 0x68]
mov qword [r9], rcx
mov qword [rdx + 0x68], 0
mov qword [rdx + 0x70], 0
mov rcx, qword [rsp + 0x138]
mov r8, qword [r8 + 0x78]
xor r9d, r9d
mov rcx, qword [rcx]
cmp rcx, r9
je 0x1400047ac
cmp rcx, r8
jl 0x14000479f
mov qword [rdx + 0x80], rcx
test dword [0x1404f87b0], 1
je 0x1400047db
cmp byte [rsp + 0xd0], 0
je 0x1400047db
mov rcx, 0x43
mov rdx, rax
mov rsp, r8
jmp 0x140004300
mov rsp, r8
jmp rax
Function at 0x1400047e0
Capabilities:
Access peb ldr_data

Disassembly:
push r15
push r14
push r13
push r12
push rbx
push rsi
push rdi
push rbp
sub rsp, 0xc8
movdqa xmmword [rsp + 0x20], xmm6
movdqa xmmword [rsp + 0x30], xmm7
movdqa xmmword [rsp + 0x40], xmm8
movdqa xmmword [rsp + 0x50], xmm9
movdqa xmmword [rsp + 0x60], xmm10
movdqa xmmword [rsp + 0x70], xmm11
movdqa xmmword [rsp + 0x80], xmm12
movdqa xmmword [rsp + 0x90], xmm13
movdqa xmmword [rsp + 0xa0], xmm14
movdqa xmmword [rsp + 0xb0], xmm15
mov qword [rsp + 0x110], rcx
mov qword [rsp + 0x118], rdx
mov eax, dword [0x1404ff608]
mov rbx, qword gs:[0x58]
mov rbx, qword [rbx + rax*8]
mov eax, 0x10
add rax, rbx
mov qword [rsp + 0xc0], rax
lock and dword [rax + 0x38], 0xffffffef
mov rax, qword [rdx + 0x18]
mov rbx, qword [rax]
mov rax, qword [rdx + 0x20]
mov rbp, qword [rax]
mov rax, qword [rdx + 0x28]
mov rsi, qword [rax]
mov rax, qword [rdx + 0x30]
mov rdi, qword [rax]
mov rax, qword [rdx + 0x58]
mov r12, qword [rax]
mov rax, qword [rdx + 0x60]
mov r13, qword [rax]
mov rax, qword [rdx + 0x68]
mov r14, qword [rax]
mov rax, qword [rdx + 0x70]
mov r15, qword [rax]
movdqa xmm6, xmmword [rdx + 0x90]
movdqa xmm7, xmmword [rdx + 0xa0]
movdqa xmm8, xmmword [rdx + 0xb0]
movdqa xmm9, xmmword [rdx + 0xc0]
movdqa xmm10, xmmword [rdx + 0xd0]
movdqa xmm11, xmmword [rdx + 0xe0]
movdqa xmm12, xmmword [rdx + 0xf0]
movdqa xmm13, xmmword [rdx + 0x100]
movdqa xmm14, xmmword [rdx + 0x110]
movdqa xmm15, xmmword [rdx + 0x120]
mov rcx, qword [rdx + 0x78]
call qword [rsp + 0x110]
mov rdx, qword [rsp + 0x118]
mov rax, qword [rdx + 0x18]
mov qword [rax], rbx
mov rax, qword [rdx + 0x20]
mov qword [rax], rbp
mov rax, qword [rdx + 0x28]
mov qword [rax], rsi
mov rax, qword [rdx + 0x30]
mov qword [rax], rdi
mov rax, qword [rdx + 0x58]
mov qword [rax], r12
mov rax, qword [rdx + 0x60]
mov qword [rax], r13
mov rax, qword [rdx + 0x68]
mov qword [rax], r14
mov rax, qword [rdx + 0x70]
mov qword [rax], r15
movdqa xmmword [rdx + 0x90], xmm6
movdqa xmmword [rdx + 0xa0], xmm7
movdqa xmmword [rdx + 0xb0], xmm8
movdqa xmmword [rdx + 0xc0], xmm9
movdqa xmmword [rdx + 0xd0], xmm10
movdqa xmmword [rdx + 0xe0], xmm11
movdqa xmmword [rdx + 0xf0], xmm12
movdqa xmmword [rdx + 0x100], xmm13
movdqa xmmword [rdx + 0x110], xmm14
movdqa xmmword [rdx + 0x120], xmm15
mov rax, qword [rsp + 0xc0]
lock or dword [rax + 0x38], 0x10
movdqa xmm6, xmmword [rsp + 0x20]
movdqa xmm7, xmmword [rsp + 0x30]
movdqa xmm8, xmmword [rsp + 0x40]
movdqa xmm9, xmmword [rsp + 0x50]
movdqa xmm10, xmmword [rsp + 0x60]
movdqa xmm11, xmmword [rsp + 0x70]
movdqa xmm12, xmmword [rsp + 0x80]
movdqa xmm13, xmmword [rsp + 0x90]
movdqa xmm14, xmmword [rsp + 0xa0]
movdqa xmm15, xmmword [rsp + 0xb0]
add rsp, 0xc8
pop rbp
pop rdi
pop rsi
pop rbx
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1400c4140
Capabilities:
Decode data using base64 via dword translation table

Disassembly:
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbp
push rbx
mov qword [rsp + 0x60], r9
mov r10, qword [rcx]
mov ecx, dword [rcx + 8]
mov r11, qword [rdx]
mov esi, ecx
and esi, 0xfffffffc
mov edi, dword [rdx + 8]
xor ebx, ebx
xor ebp, ebp
test ecx, ecx
je 0x1400c4365
lea r14, [0x140411ba0]
mov eax, esi
sar eax, 2
lea eax, [rax + rax*2]
cmp edi, eax
jl 0x1400c4187
lea r15d, [rsi - 4]
jmp 0x1400c419e
mov edx, 0x55555556
mov eax, edx
imul edi
mov r15d, edx
shr r15d, 0x1f
add r15d, edx
shl r15d, 2
test r15d, r15d
jle 0x1400c4246
movsxd rax, ebx
lea rax, [r10 + rax*2]
movzx edx, word [rax]
movzx r12d, word [rax + 2]
movzx r13d, word [rax + 4]
movzx eax, word [rax + 6]
mov r9d, edx
or r9d, r12d
or r9d, r13d
or r9d, eax
test r9d, 0xffffff00
je 0x1400c41dc
mov r9d, 0xffffffff
jmp 0x1400c4213
movsxd rdx, edx
movsx rdx, byte [r14 + rdx]
movsxd r9, r12d
movsx r12, byte [r14 + r9]
movsxd r9, r13d
movsx r13, byte [r14 + r9]
cdqe
movsx rax, byte [r14 + rax]
shl edx, 0x12
shl r12d, 0xc
shl r13d, 6
or eax, edx
mov edx, eax
or r12d, r13d
or edx, r12d
mov r9d, edx
test r9d, r9d
jl 0x1400c4382
movsxd rax, ebp
add rax, r11
mov edx, r9d
sar edx, 0x10
mov byte [rax], dl
mov edx, r9d
sar edx, 8
mov byte [rax + 1], dl
mov byte [rax + 2], r9b
add ebp, 3
add ebx, 4
cmp ebx, r15d
jl 0x1400c41a7
lea eax, [rsi - 4]
cmp r15d, eax
jne 0x1400c4382
cmp ebx, esi
je 0x1400c4382
lea eax, [rsi - 4]
cdqe
movzx eax, word [r10 + rax*2]
lea edx, [rsi - 3]
movsxd rdx, edx
movzx edx, word [r10 + rdx*2]
lea r9d, [rsi - 2]
movsxd r9, r9d
movzx r9d, word [r10 + r9*2]
lea r15d, [rsi - 1]
movsxd r15, r15d
movzx r10d, word [r10 + r15*2]
mov r15d, eax
or r15d, edx
or r15d, r9d
or r15d, r10d
test r15d, 0xffffff00
jne 0x1400c4382
cdqe
movsx rax, byte [r14 + rax]
movsxd rdx, edx
movsx rdx, byte [r14 + rdx]
shl eax, 0x12
shl edx, 0xc
or eax, edx
cmp r10d, 0x3d
je 0x1400c430b
movsxd r9, r9d
movsx r9, byte [r14 + r9]
movsxd r10, r10d
movsx r10, byte [r14 + r10]
shl r9d, 6
or r10d, eax
mov eax, r10d
or eax, r9d
jl 0x1400c4382
add edi, 0xfffffffd
cmp ebp, edi
jg 0x1400c4382
movsxd r9, ebp
add r11, r9
mov edx, eax
sar edx, 0x10
mov byte [r11], dl
mov edx, eax
sar edx, 8
mov byte [r11 + 1], dl
mov byte [r11 + 2], al
add ebp, 3
jmp 0x1400c435e
cmp r9d, 0x3d
je 0x1400c4347
movsxd r9, r9d
movsx r9, byte [r14 + r9]
shl r9d, 6
or eax, r9d
jl 0x1400c4382
lea edx, [rdi - 2]
cmp ebp, edx
jg 0x1400c4382
mov edx, eax
sar edx, 0x10
movsxd r9, ebp
mov byte [r11 + r9], dl
sar eax, 8
lea edx, [rbp + 1]
movsxd rdx, edx
mov byte [r11 + rdx], al
add ebp, 2
jmp 0x1400c435e
test eax, eax
jl 0x1400c4382
lea edx, [rdi - 1]
cmp ebp, edx
jg 0x1400c4382
sar eax, 0x10
movsxd rdx, ebp
mov byte [r11 + rdx], al
inc ebp
add ebx, 4
cmp esi, ecx
jne 0x1400c4382
mov dword [r8], ebx
mov r9, qword [rsp + 0x60]
mov dword [r9], ebp
mov eax, 1
pop rbx
pop rbp
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
ret
mov dword [r8], ebx
mov r9, qword [rsp + 0x60]
mov dword [r9], ebp
xor eax, eax
pop rbx
pop rbp
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1400ee980
Capabilities:
Hash data using sha1

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
cmp qword [rsi], 0
jne 0x1400ee9aa
lea rcx, [0x140463500]
mov edx, 0x55
call fcn.140003fb0
mov rdx, rax
mov rcx, rsi
call fcn.1400041d0
xor eax, eax
mov qword [rsi + 8], rax
mov dword [rsi + 0x10], eax
mov rax, qword [rsi]
cmp dword [rax + 8], 0x50
jbe 0x1400eea18
mov dword [rax + 0x150], 0x67452301
mov rax, qword [rsi]
cmp dword [rax + 8], 0x51
jbe 0x1400eea18
mov dword [rax + 0x154], 0xefcdab89
mov rax, qword [rsi]
cmp dword [rax + 8], 0x52
jbe 0x1400eea18
mov dword [rax + 0x158], 0x98badcfe
mov rax, qword [rsi]
cmp dword [rax + 8], 0x53
jbe 0x1400eea18
mov dword [rax + 0x15c], 0x10325476
mov rax, qword [rsi]
cmp dword [rax + 8], 0x54
jbe 0x1400eea18
mov dword [rax + 0x160], 0xc3d2e1f0
add rsp, 0x20
pop rsi
ret
call fcn.1401556f0
int3
Function at 0x1400012d0
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x120
mov rbx, rcx
mov rcx, qword [rcx + 0x20]
call qword [sym.imp.USER32.DLL_GetDlgItem]
mov rcx, qword [rbx + 0x20]
mov edx, 9
mov rbp, rax
call qword [sym.imp.USER32.DLL_GetDlgItem]
xor edi, edi
lea rdx, [rsp + 0x50]
lea r8d, [rdi + 0x64]
mov rcx, rbp
mov rsi, rax
mov word [rsp + 0x50], di
call qword [sym.imp.USER32.DLL_GetWindowTextW]
lea rdx, [rsp + 0x50]
mov rcx, rsi
call qword [sym.imp.USER32.DLL_SetWindowTextW]
mov rcx, qword [rbx + 0x20]
lea rdx, [rsp + 0x130]
mov dword [rsp + 0x130], edi
mov dword [rsp + 0x134], edi
call qword [sym.imp.USER32.DLL_ClientToScreen]
lea r8d, [rdi + 0x10]
lea rcx, [rsp + 0x40]
xor edx, edx
call fcn.1400dd9e0
lea rdx, [rsp + 0x40]
mov rcx, rbp
call qword [sym.imp.USER32.DLL_GetWindowRect]
mov r8d, dword [rsp + 0x40]
mov r9d, dword [rsp + 0x44]
mov edi, dword [rsp + 0x48]
mov ebx, dword [rsp + 0x4c]
mov dword [rsp + 0x30], 4
sub edi, r8d
sub r8d, dword [rsp + 0x130]
sub ebx, r9d
sub r9d, dword [rsp + 0x134]
xor edx, edx
mov rcx, rsi
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x40], r8d
mov dword [rsp + 0x20], edi
mov dword [rsp + 0x44], r9d
call qword [sym.imp.USER32.DLL_SetWindowPos]
mov r8d, dword [rsp + 0x44]
mov edx, dword [rsp + 0x40]
mov r9d, edi
mov rcx, rsi
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], ebx
call qword [sym.imp.USER32.DLL_MoveWindow]
xor edx, edx
mov rcx, rbp
call qword [sym.imp.USER32.DLL_ShowWindow]
lea r11, [rsp + 0x120]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1400047b4
Capabilities:
Get common file path
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
xor esi, esi
mov rdi, rcx
mov rcx, qword [rcx]
mov ebx, esi
cmp rcx, rsi
je 0x1400047da
call qword [sym.imp.KERNEL32.DLL_lstrlenW]
mov ebx, eax
lea edx, [rbx + 0x2d0]
mov rcx, rdi
movsxd rdx, edx
call fcn.14005a250
cmp ebx, esi
jg 0x140004889
mov rax, qword [rdi]
lea rcx, [0x1400f9870]
mov r8d, 0x208
mov word [rax], si
mov rdx, qword [rdi]
call qword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableW]
cmp eax, esi
mov ebx, eax
jg 0x14000486e
mov rdx, qword [rdi]
lea rcx, [0x1400f9860]
mov r8d, 0x208
call qword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableW]
cmp eax, esi
mov ebx, eax
jg 0x14000486e
mov rdx, qword [rdi]
xor r9d, r9d
xor ecx, ecx
lea r8d, [r9 + 0x24]
call qword [sym.imp.SHELL32.DLL_SHGetSpecialFolderPathW]
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.DLL_lstrlenW]
movsxd rbx, eax
cmp ebx, esi
jle 0x140004889
mov rax, qword [rdi]
lea rdx, [0x1400f9850]
lea rcx, [rax + rbx*2]
call qword [sym.imp.KERNEL32.DLL_lstrcpyW]
add ebx, 5
cmp ebx, esi
jle 0x140004889
mov rax, qword [rdi]
movsxd rcx, ebx
mov edx, 0x5c
mov word [rax + rcx*2], dx
mov rax, qword [rdi]
inc ebx
movsxd rcx, ebx
mov word [rax + rcx*2], si
mov rdx, qword [rdi]
lea rcx, [0x140117fa0]
call fcn.1400297c0
cmp ebx, esi
jle 0x1400048a8
mov rcx, qword [rdi]
call fcn.1400dce2c
cmp eax, esi
jne 0x1400048e4
mov rdx, qword [rdi]
xor r9d, r9d
xor ecx, ecx
lea r8d, [r9 + 0x24]
call qword [sym.imp.SHELL32.DLL_SHGetSpecialFolderPathW]
mov rcx, qword [rdi]
lea rdx, [0x1400f9840]
call qword [sym.imp.KERNEL32.DLL_lstrcatW]
mov rdx, qword [rdi]
lea rcx, [0x140117fa0]
call fcn.1400297c0
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.DLL_lstrlenW]
mov ebx, eax
mov rsi, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140004efc
Capabilities:
Get geographical location
Query environment variable

Disassembly:
push rbx
sub rsp, 0x70
xor ebx, ebx
lea rdx, [rsp + 0x20]
lea rcx, [0x1400f9a50]
lea r8d, [rbx + 0x20]
mov word [rsp + 0x20], bx
call qword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableW]
movzx r11d, word [rsp + 0x20]
cmp r11w, bx
jne 0x140004f48
lea r9d, [rbx + 0x20]
lea r8, [rsp + 0x20]
lea edx, [rbx + 0xb]
mov ecx, 0x800
call qword [sym.imp.KERNEL32.DLL_GetLocaleInfoW]
mov r11w, word [rsp + 0x20]
lea rax, [rsp + 0x20]
cmp r11w, bx
lea rdx, [0x1400f9a48]
lea rcx, [0x1401179a8]
cmovne rdx, rax
call fcn.140064e2c
mov rcx, qword [0x1401179a8]
call fcn.14005b3b8
movzx ecx, word [0x140122004]
cmp eax, 1
cmovg cx, ax
mov word [0x140122004], cx
add rsp, 0x70
pop rbx
ret

Function at 0x1400050a8
Capabilities:
Allocate thread local storage

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
lea rcx, [0x1400f9a80]
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov rbx, rax
test rax, rax
je 0x14000509c
lea rdx, [0x1400f9a60]
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov rdi, rax
test rax, rax
je 0x140005093
mov edx, 1
mov ecx, 0x233
call rdi
mov edx, 1
lea ecx, [rdx + 0x49]
call rdi
mov edx, 1
lea ecx, [rdx + 0x48]
call rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_FreeLibrary]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_SetErrorMode]
or eax, 0x8001
mov ecx, eax
call qword [sym.imp.KERNEL32.DLL_SetErrorMode]
mov ecx, 0xfffffff6
call qword [sym.imp.KERNEL32.DLL_GetStdHandle]
mov ecx, 0xfffffff4
mov qword [0x1401152d0], rax
call qword [sym.imp.KERNEL32.DLL_GetStdHandle]
mov ecx, 0xfffffff5
mov qword [0x1401152e0], rax
call qword [sym.imp.KERNEL32.DLL_GetStdHandle]
cmp qword [0x140118190], 0
mov qword [0x1401152d8], rax
jne 0x14000510e
call qword [sym.imp.KERNEL32.DLL_GetProcessHeap]
mov qword [0x140118190], rax
and qword [0x140117a28], 0
lea rax, [0x140117a28]
mov qword [0x140117ff0], rax
call qword [sym.imp.KERNEL32.DLL_TlsAlloc]
xor ecx, ecx
mov dword [0x1401178b4], eax
call fcn.140016b40
add rsp, 0x28
jmp 0x14000503c
Function at 0x140005140
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rdi
sub rsp, 0x20
mov edi, ecx
lea rcx, [rax + 0x10]
xor ebx, ebx
mov dword [rax + 0x10], 8
mov dword [rax + 0x14], ebx
call qword [sym.imp.USER32.DLL_GetLastInputInfo]
mov edx, dword [0x140117958]
mov eax, dword [rsp + 0x3c]
sub eax, edx
cmp eax, ebx
cmovg edx, dword [rsp + 0x3c]
mov dword [0x140117958], edx
call qword [sym.imp.KERNEL32.DLL_GetTickCount]
mov dword [0x140117958], eax
mov al, byte [0x14011521f]
cmp al, bl
jle 0x1400051d9
lea rcx, [rsp + 0x38]
mov dword [rsp + 0x3c], ebx
call qword [sym.imp.USER32.DLL_GetLastInputInfo]
call qword [sym.imp.KERNEL32.DLL_GetTickCount]
mov r8d, dword [rsp + 0x3c]
mov ecx, eax
sub ecx, r8d
cmp ecx, edi
jb 0x1400051c2
mov edx, dword [0x140117958]
sub eax, edx
cmp eax, edi
jae 0x1400051e4
mov ecx, 0xa
call qword [sym.imp.KERNEL32.DLL_Sleep]
mov r11b, byte [0x14011521f]
cmp r11b, bl
jg 0x140005193
mov r8d, dword [rsp + 0x3c]
mov edx, dword [0x140117958]
mov ecx, r8d
sub ecx, edx
cmp ecx, ebx
mov cl, byte [0x14011521f]
cmovg edx, r8d
cmp cl, bl
setg bl
mov dword [0x140117958], edx
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140005238
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x98
lea rdx, [rsp + 0x20]
lea rcx, [0x1400f9a90]
mov r8d, 0x63
mov byte [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableA]
movzx r11d, byte [0x1401178e3]
cmp byte [rsp + 0x20], 0x31
mov eax, 1
cmove r11d, eax
mov byte [0x1401178e3], r11b
add rsp, 0x98
ret

Function at 0x1400054e0
Capabilities:
Read file via mapping

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
push rdi
sub rsp, 0x30
mov qword [rax - 0x10], rcx
mov rsi, rdx
xor r9d, r9d
xor edx, edx
or rcx, 0xffffffffffffffff
mov r8d, 0x8000004
mov dword [rax - 0x18], 0x64
call qword [sym.imp.KERNEL32.DLL_CreateFileMappingW]
mov rdi, rax
test rax, rax
je 0x14000556f
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 6]
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_MapViewOfFile]
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
test rbx, rbx
je 0x14000556f
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 0x64]
call fcn.140005284
mov dword [rbx], 0xffffffff
mov qword [rbx + 0x10], rsi
lea rcx, [rbx + 8]
mov qword [0x140115010], rcx
mov qword [0x140117978], rbx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x14000562c
Capabilities:
Read file via mapping

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rsi, rcx
xor ecx, ecx
mov rbp, rdx
call qword [sym.imp.KERNEL32.DLL_SetLastError]
xor r9d, r9d
xor edx, edx
mov r8d, 0x8000004
or rcx, 0xffffffffffffffff
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], 0x64
call qword [sym.imp.KERNEL32.DLL_CreateFileMappingA]
mov bl, 1
mov rdi, rax
test rax, rax
je 0x14000568b
call qword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0xb7
jne 0x1400056a3
xor bl, bl
jmp 0x1400056a3
mov r8, rbp
xor edx, edx
mov ecx, 0x8000004
call qword [sym.imp.KERNEL32.DLL_OpenFileMappingA]
mov rdi, rax
test rax, rax
je 0x1400056f4
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 6]
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_MapViewOfFile]
mov rcx, rdi
mov qword [0x140117988], rax
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov r11, qword [0x140117988]
test r11, r11
je 0x1400056f4
test bl, bl
je 0x1400056f1
xor edx, edx
mov rcx, r11
lea r8d, [rdx + 0x64]
call fcn.1400dd9e0
mov r11, qword [0x140117988]
mov qword [r11], rsi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x140005a50
Capabilities:
Get file version info

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rbx, rcx
mov rsi, rdx
lea rcx, [rsp + 0x30]
mov edx, 0x169
mov r12, r8
call fcn.14005a1c4
mov r15, qword [rsp + 0x30]
mov r8d, 0x104
add r15, 0xc8
mov rdx, rbx
mov rcx, r15
call qword [sym.imp.KERNEL32.DLL_lstrcpynW]
xor edi, edi
cmp rsi, rdi
je 0x140005aaa
lea ebp, [rdi + 1]
cmp rsi, 0xffffffffffffffff
jne 0x140005aac
mov ebp, edi
mov ebx, 0x64
cmp r12, rdi
je 0x140005ac9
mov rdx, rbx
mov rcx, r12
call fcn.14005a250
mov r11, qword [r12]
mov word [r11], di
cmp ebp, edi
je 0x140005adf
mov rdx, rbx
mov rcx, rsi
call fcn.14005a250
mov r11, qword [rsi]
mov word [r11], di
lea rdx, [rsp + 0x88]
mov rcx, r15
mov dword [rsp + 0x88], edi
call sub.VERSION.DLL_GetFileVersionInfoSizeW
mov r14d, eax
cmp eax, edi
je 0x140005c12
mov rdx, r14
mov ecx, 2
mov dword [rsp + 0x90], edi
mov qword [rsp + 0x98], rdi
call qword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov rcx, rax
mov r13, rax
call qword [sym.imp.KERNEL32.DLL_GlobalLock]
mov edx, dword [rsp + 0x88]
mov r8d, r14d
mov r9, rax
mov rcx, r15
mov rbx, rax
call sub.VERSION.DLL_GetFileVersionInfoW
lea r9, [rsp + 0x90]
lea r8, [rsp + 0x98]
lea rdx, [0x1400f9ae8]
mov rcx, rbx
call sub.VERSION.DLL_VerQueryValueW
cmp r12, rdi
je 0x140005b99
mov rcx, qword [rsp + 0x98]
lea rdx, [0x1400f9ad0]
movzx eax, word [rcx + 0x14]
movzx r8d, word [rcx + 0x12]
movzx r9d, word [rcx + 0x10]
movzx ecx, word [rcx + 0x16]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
mov rcx, qword [r12]
call qword [sym.imp.USER32.DLL_wsprintfW]
cmp ebp, edi
je 0x140005bcf
mov rcx, qword [rsp + 0x98]
lea rdx, [0x1400f9ad0]
movzx eax, word [rcx + 0xc]
movzx r8d, word [rcx + 0xa]
movzx r9d, word [rcx + 8]
movzx ecx, word [rcx + 0xe]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
mov rcx, qword [rsi]
call qword [sym.imp.USER32.DLL_wsprintfW]
cmp rsi, rdi
jne 0x140005beb
mov rax, qword [rsp + 0x98]
mov edi, dword [rax + 0x10]
mov eax, dword [rax + 0x14]
shl rdi, 0x20
or rdi, rax
jmp 0x140005c00
mov rcx, qword [rsp + 0x98]
mov edi, dword [rcx + 8]
mov ecx, dword [rcx + 0xc]
shl rdi, 0x20
or rdi, rcx
mov rcx, r13
call qword [sym.imp.KERNEL32.DLL_GlobalUnlock]
mov rcx, r13
call qword [sym.imp.KERNEL32.DLL_GlobalFree]
lea rcx, [rsp + 0x30]
call fcn.140052160
mov rbx, qword [rsp + 0x80]
mov rax, rdi
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret