joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140027cb4
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.14001babc
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.14001babc
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x140027e04
cmp rax, 0xffffffffffffffff
je 0x140027e04
xor edi, edi
test rbp, rbp
jle 0x140027daf
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.14001e0e0
mov rbx, rax
test rax, rax
jne 0x140027d3c
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x140027da5
mov edx, 0x8000
mov ecx, r14d
call fcn.140015690
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14001c7bc
cmp eax, 0xffffffff
je 0x140027d85
cdqe
sub rbp, rax
test rbp, rbp
jg 0x140027d4c
mov edx, r15d
mov ecx, r14d
call fcn.140015690
jmp 0x140027da5
cmp byte [rsi + 0x38], dil
je 0x140027d9c
cmp dword [rsi + 0x34], 5
jne 0x140027d9c
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x140027da5
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.14001a168
jmp 0x140027e18
jns 0x140027e18
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.14001babc
cmp rax, 0xffffffffffffffff
jne 0x140027dd0
cmp byte [rsi + 0x30], dil
je 0x140027e18
mov edi, dword [rsi + 0x2c]
jmp 0x140027e18
mov ecx, r14d
call fcn.140016c88
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x140027e18
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x140027e18
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x140027e11
mov eax, dword [rsi + 0x2c]
jmp 0x140027e16
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.14001babc
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x13b8524
Capabilities:
Encode data using xor

Disassembly:
jmp 0x13b852e
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x13b8557
pop rbp
sub rbp, 0x33
sub rbp, 0xfb8524
sub rsp, 0x20
jmp 0x13b8576
mov rax, 0xfb8524
add rax, rbp
add rax, 0x84
mov rcx, 0x60b
mov rdx, 0x5f31aec5
xor byte [rax], dl
inc rax
dec rcx
jne 0x13b8595
jmp 0x13b85ac
lea ecx, [rsp + rbp + 0x4e]
stc
invalid
Function at 0x140017e30
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x80
mov rbx, r8
mov edi, edx
test r8, r8
je 0x140018000
mov rax, qword [rcx]
call qword [rax]
mov rbp, rax
test edi, edi
je 0x140017ea0
cmp edi, 3
je 0x140017ea0
sub edi, 1
je 0x140017e8f
cmp edi, 1
jne 0x140018000
movzx edx, bx
mov rcx, rax
call qword [sym.imp.USER32.dll_LoadIconW]
jmp 0x140018002
movzx edx, bx
mov rcx, rbp
call qword [sym.imp.USER32.dll_LoadCursorW]
jmp 0x140018002
movzx edx, bx
mov r8d, 0xa
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov r15, rax
test rax, rax
je 0x140018000
xor ebx, ebx
mov esi, ebx
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r14, rax
test rax, rax
je 0x140018000
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r12, rax
test rax, rax
je 0x140017f66
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
mov qword [rsp + 0x70], rbx
mov rdx, r15
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r8d, eax
mov rdx, r12
lea rcx, [rsp + 0x50]
call fcn.140015af0
test rax, rax
je 0x140017f3f
mov rsi, qword [rsp + 0x50]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
mov qword [rsp + 0x70], rbx
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140017f66
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
mov qword [rsp + 0x70], rbx
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FreeResource]
test rsi, rsi
je 0x140018000
cmp edi, 3
jne 0x140017ffb
lea r8, [rsp + 0x30]
lea edx, [rdi + 0x1d]
mov rcx, rsi
call qword [sym.imp.GDI32.dll_GetObjectW]
test eax, eax
je 0x140017fed
mov edx, dword [rsp + 0x38]
test edx, edx
je 0x140017fed
lea ecx, [rdx + 1]
and ecx, 0xfffffffe
mov dword [rsp + 0x20], 1
xor r9d, r9d
lea r8d, [rdi + 0x1e]
call qword [sym.imp.COMCTL32.dll_ImageList_Create]
mov rdi, rax
test rax, rax
je 0x140017fed
mov r8d, 0xff00ff
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.COMCTL32.dll_ImageList_AddMasked]
test eax, eax
jns 0x140017fea
mov rcx, rdi
call qword [sym.imp.COMCTL32.dll_ImageList_Destroy]
mov rcx, rsi
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rax, rbx
jmp 0x140018002
mov rbx, rdi
mov rcx, rsi
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rax, rbx
jmp 0x140018002
mov rax, rsi
jmp 0x140018002
xor eax, eax
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
Function at 0x1400180c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push r14
sub rsp, 0x20
xor esi, esi
mov r14, r9
mov qword [r8 + 0x28], rsi
mov rbx, r8
mov rbp, rdx
test rdx, rdx
jne 0x1400180f2
lea eax, [rdx + 1]
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rsi
pop rbp
ret
mov rax, qword [rcx]
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], r15
call qword [rax]
movzx edx, bp
mov r8, r14
mov rcx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov r15, rax
test rax, rax
je 0x1400181e7
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbp, rax
test rax, rax
je 0x1400181e7
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r14, rax
test rax, rax
je 0x1400181de
mov rdx, r15
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov qword [rbx + 0x28], rsi
cmp qword [rbx + 0x20], rdi
jl 0x1400181bc
cmp rdi, 1
jne 0x14001817a
movzx ecx, byte [r14]
mov rax, qword [rbx + 0x18]
mov byte [rax], cl
inc qword [rbx + 0x28]
jmp 0x1400181d9
cmp rdi, 2
jne 0x140018191
movzx ecx, word [r14]
mov rax, qword [rbx + 0x18]
mov word [rax], cx
add qword [rbx + 0x28], rdi
jmp 0x1400181d9
cmp rdi, 4
jne 0x1400181a6
mov ecx, dword [r14]
mov rax, qword [rbx + 0x18]
mov dword [rax], ecx
add qword [rbx + 0x28], rdi
jmp 0x1400181d9
cmp rdi, 8
jne 0x1400181bc
mov rcx, qword [r14]
mov rax, qword [rbx + 0x18]
mov qword [rax], rcx
add qword [rbx + 0x28], rdi
jmp 0x1400181d9
test eax, eax
je 0x1400181d9
mov rdx, rdi
mov rcx, rbx
call fcn.140019e90
mov r8, rdi
mov rdx, r14
mov rcx, rax
call fcn.140026d80
mov esi, 1
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov r15, qword [rsp + 0x48]
mov rax, rsi
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rsi
pop rbp
ret
Function at 0x140018d10
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x80
test rcx, rcx
je 0x140018e4f
cmp word [rcx], 0
je 0x140018e4f
lea rdx, vtable.CVolCommonBaseWithMemManager.0
mov qword [rbp - 0x60], rdx
lea rsi, vtable.CVolObject.0
mov qword [rbp - 0x60], rsi
xor edi, edi
mov qword [rbp - 0x58], rdi
mov qword [rbp - 0x50], rdi
lea rax, vtable.CWString.0
mov qword [rbp - 0x60], rax
lea rax, [rbp - 0x40]
mov qword [rbp + 0x20], rax
mov qword [rbp - 0x40], rdx
mov qword [rbp - 0x40], rsi
mov qword [rbp - 0x38], rdi
mov qword [rbp - 0x30], rdi
lea r14, vtable.CVolMem.0
mov qword [rbp - 0x40], r14
mov qword [rbp - 0x28], rdi
mov qword [rbp - 0x18], rdi
mov qword [rbp - 0x20], rdi
mov qword [rbp - 0x10], 0x40
mov qword [rbp - 0x48], rdi
mov qword [rbp - 0x10], 0xfe
cmp word [rcx], di
je 0x140018e06
cmp word [rcx + 2], di
je 0x140018e06
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp word [rcx + r8*2], 0
jne 0x140018dc0
cmp word [rcx + r8*2 - 2], 0x5c
jne 0x140018e06
cmp word [rcx + r8*2 - 4], 0x3a
je 0x140018e06
dec r8
mov rdx, rcx
lea rcx, [rbp - 0x60]
call fcn.14001bb90
mov rcx, qword [rbp - 0x48]
test rcx, rcx
jne 0x140018e06
lea rcx, [0x140045c30]
cmp qword [rbp - 0x18], 0
cmovne rcx, qword [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov rbx, rdi
cmp eax, 0xffffffff
setne bl
lea rax, [rbp - 0x40]
mov qword [rbp + 0x20], rax
mov qword [rbp - 0x40], r14
mov rdx, qword [rbp - 0x28]
test rdx, rdx
je 0x140018e36
lea rcx, [rbp - 0x40]
mov r8, qword [rbp - 0x40]
call qword [r8 + 0x18]
mov qword [rbp - 0x28], rdi
mov qword [rbp - 0x18], rdi
mov qword [rbp - 0x20], rdi
mov qword [rbp - 0x40], rsi
mov qword [rbp - 0x60], rsi
mov rax, rbx
jmp 0x140018e51
xor eax, eax
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret

Function at 0x140019650
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
movzx edi, cl
lea rax, [rdi - 0x60]
cmp rax, 9
ja 0x1400196d5
sub rdi, 0x30
mov rbx, rdi
test rdi, rdi
je 0x1400196c7
cmp rdi, 0x11
je 0x140019691
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x140019691
mov rbx, rdi
bts rbx, 0xd
cmp rbx, 0x10
je 0x1400196ac
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x1400196ac
bts rbx, 0xf
cmp rbx, 0x12
je 0x1400196c7
mov ecx, 0x12
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x1400196c7
bts rbx, 0xe
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
cmp rdi, 0x6d
jne 0x1400196e4
mov edi, 0xbd
mov ebx, edi
jmp 0x140019679
cmp rdi, 0x6e
jne 0x1400196f3
mov edi, 0xbe
mov ebx, edi
jmp 0x140019679
cmp rdi, 0x6f
jne 0x140019705
mov edi, 0xbf
mov ebx, edi
jmp 0x140019679
lea rax, [0x1400471b0]
mov rax, qword [rax + rdi*8]
cmp word [rax], 0
jne 0x14001966b
mov rbx, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rdi
ret
Function at 0x14001c4a0
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rdi, qword [rcx + 0x10]
mov rsi, rdx
mov rbx, rcx
test rdi, rdi
je 0x14001c555
cmp qword [rdi], 0
mov rbx, qword [rcx]
je 0x14001c521
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14001c540
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14001c540
mov rdx, qword [rdi]
xor r9d, r9d
mov qword [rsp + 0x28], 0
xor r8d, r8d
mov qword [rsp + 0x20], rdx
mov rcx, rbx
mov rdx, rsi
call rax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp dword [rdi + 8], 0
je 0x14001c540
mov rcx, rbx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov eax, 1
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp byte [0x14005a460], 0
jne 0x14001c5a0
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14001c590
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14005a458], rax
mov byte [0x14005a460], 1
jmp 0x14001c5a7
mov rax, qword [0x14005a458]
mov byte [0x14005a460], 1
jmp 0x14001c5a7
mov rax, qword [0x14005a458]
mov rcx, qword [rbx]
mov rdx, rsi
test rax, rax
je 0x14001c52a
mov r8d, dword [rbx + 8]
xor r9d, r9d
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp rax
Function at 0x14001cd80
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x480
mov rax, qword [0x140057010]
xor rax, rsp
mov qword [rsp + 0x470], rax
mov r15, r9
mov rsi, r8
mov rbx, rdx
xor r14d, r14d
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x60], r14
xor edx, edx
lea r8d, [r14 + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x14001ce05
xor edx, edx
lea r8d, [r14 + 2]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x14001ce05
call fcn.14001c2c0
mov ebx, eax
jmp 0x14001cf27
mov r8, r15
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
jne 0x14001ce26
call fcn.14001c2c0
jmp 0x14001cf16
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
mov qword [rsp + 0x40], rax
test rax, rax
jne 0x14001ce49
call fcn.14001c2c0
jmp 0x14001cf16
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
mov dword [rsp + 0x30], eax
inc eax
cmp eax, ebx
jae 0x14001ce6b
mov ebx, 0x8007000e
jmp 0x14001cf18
mov ecx, eax
test eax, eax
je 0x14001cea0
xor edx, edx
mov rax, 0xffffffffffffffff
div rcx
cmp rax, 2
jb 0x14001cf5f
lea rdx, [rcx + rcx]
cmp rdx, 0x400
jbe 0x14001cea0
lea rcx, [rsp + 0x60]
call fcn.14001ffa0
jmp 0x14001ceaa
lea rax, [rsp + 0x68]
mov qword [rsp + 0x60], rax
jmp 0x14001cebd
mov rax, qword [rsp + 0x60]
test rax, rax
jne 0x14001cece
mov ebx, 0x8007000e
jmp 0x14001cf18
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
mov r9d, ebx
mov r8, rsi
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x14001cef3
call fcn.14001c2c0
jmp 0x14001cf16
mov ecx, eax
mov rax, qword [rsp + 0x60]
mov word [rax + rcx*2], r14w
mov r8d, dword [rsp + 0x4d0]
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x48]
call fcn.14001dc50
mov ebx, eax
test rdi, rdi
je 0x14001cf27
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rax, [rsp + 0x68]
cmp qword [rsp + 0x60], rax
je 0x14001cf3e
lea rcx, [rsp + 0x60]
call fcn.14001ff90
nop
mov eax, ebx
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.140024b80
add rsp, 0x480
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
mov ecx, 0x80070216
call fcn.140011e30
int3
Function at 0x140023110
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rbp, rcx
mov rcx, qword [rcx + 8]
test rcx, rcx
je 0x140023291
xor edi, edi
cmp qword [rbp + 0xe0], rdi
je 0x140023247
cmp qword [rbp + 0xe8], rdi
je 0x140023154
mov edi, 0xc80000
jmp 0x14002323f
call fcn.140001320
mov rcx, rax
test rax, rax
je 0x1400232a4
mov rax, qword [rax]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x40], rbx
mov rcx, qword [rbp + 8]
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea r14d, [rax + 1]
test r14d, r14d
js 0x1400232af
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, r14d
or eax, ecx
jge 0x1400231af
mov edx, r14d
lea rcx, [rsp + 0x40]
call fcn.140023650
mov rbx, qword [rsp + 0x40]
mov r8d, r14d
mov rdx, rbx
mov rcx, qword [rbp + 8]
call qword [sym.imp.USER32.dll_GetWindowTextW]
cmp eax, 0xffffffff
jne 0x1400231d0
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.14002f6d4
test eax, eax
js 0x1400232af
cmp eax, dword [rbx - 0xc]
jg 0x1400232af
mov dword [rbx - 0x10], eax
cdqe
mov word [rbx + rax*2], di
cmp dword [rbx - 0x10], 0
je 0x140023223
mov rax, rdi
lea r8, [0x14004ab40]
nop word [rax + rax]
movzx ecx, word [rbx + rax*2]
inc rax
cmp cx, word [r8 + rax*2 - 2]
jne 0x14002321b
cmp rax, 7
jne 0x140023200
cmp cx, word [r8 + rax*2 - 2]
mov eax, 0xc00000
cmovne edi, eax
lea rdx, [rbx - 0x18]
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14002323f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
bts edi, 0x16
mov rcx, qword [rbp + 8]
mov eax, edi
bts eax, 0x10
cmp qword [rbp + 0xf0], 0
cmove eax, edi
mov ebx, eax
bts ebx, 0x11
cmp qword [rbp + 0xf8], 0
cmove ebx, eax
mov edx, 0xfffffff0
call qword [sym.imp.USER32.dll_GetWindowLongW]
and eax, 0xcb0000
cmp eax, ebx
je 0x140023291
mov r9d, 0x37
mov r8d, ebx
mov edx, eax
lea rcx, [rbp + 8]
call fcn.140014a80
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
mov ecx, 0x80004005
call fcn.140011e30
nop
mov ecx, 0x80070057
call fcn.140011e30
int3
Function at 0x14002b480
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14002b307
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14002b307
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14002b307
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14002b307
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14002b307
cmp dword [rcx + 0x84], 0xe
jbe 0x14002b307
cmp dword [rcx + 0xf8], 0
je 0x14002b307
mov ecx, ebx
call fcn.14002b3ac
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.14002b1a0
nop
cmp dword [rbp + 0x20], 0
jne 0x14002b368
call fcn.140030bc4
cmp eax, 1
jne 0x14002b358
xor dl, dl
jmp 0x14002b362
call fcn.140030b90
test al, al
sete dl
cmp dword [rbp + 0x20], 0
je 0x14002b373
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14002b37c
int3
xor r8d, r8d
xor edx, edx
jmp 0x14002b298
Function at 0x140035928
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x1400359af
mov rsi, rbx
cmp word [rax], bp
je 0x14003596e
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x140035958
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x140035954
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.140032d60
mov rdi, rax
test rax, rax
je 0x14003599c
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.140026d80
mov rbp, rdi
xor ecx, ecx
call fcn.140030a80
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x40f180
Capabilities:
Identify system language via api

Disassembly:
push rbp
sub rsp, 0x70
mov rbp, rsp
mov qword [rbp + 0x28], rcx
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x60], 0
mov qword [rbp + 0x88], rdx
mov qword [rbp + 0x90], r8
mov rcx, qword [rbp + 0x88]
call fcn.0040aeb0
mov rcx, qword [rbp + 0x90]
call fcn.0040aeb0
nop
mov rcx, qword [rbp + 0x28]
call fcn.0040ad20
lea rcx, [rbp + 0x60]
mov rdx, qword [rbp + 0x90]
call fcn.0040b3f0
xor rax, rax
cmp qword [rbp + 0x90], 0
je 0x40f223
mov rax, qword [rbp + 0x90]
mov eax, dword [rax - 4]
cmp eax, 1
jl 0x40f25d
mov rcx, qword [rbp + 0x90]
movsxd rdx, eax
cmp word [rcx + rdx*2 - 2], 0x2e
jne 0x40f256
lea rcx, [rbp + 0x60]
mov rdx, qword [rbp + 0x90]
mov r8d, 1
mov r9d, eax
call fcn.0040c860
jmp 0x40f25d
sub eax, 1
test eax, eax
jne 0x40f228
nop
lea rcx, [rbp + 0x68]
mov rdx, qword [rbp + 0x88]
call fcn.0040ed90
cmp qword [rbp + 0x68], 0
je 0x40f29b
mov rcx, rbp
lea rdx, [rbp + 0x58]
mov r8, qword [rbp + 0x60]
mov r9, qword [rbp + 0x68]
call fcn.0040ef20
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x58]
call fcn.0040b370
jmp 0x40f337
call sub.kernel32.dll_GetUserDefaultUILanguage
lea rcx, [rbp + 0x48]
mov edx, eax
call fcn.0040e500
mov rcx, rbp
lea rdx, [rbp + 0x50]
mov r8, qword [rbp + 0x60]
mov r9, qword [rbp + 0x48]
call fcn.0040ef20
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x50]
call fcn.0040b370
mov rax, qword [rbp + 0x28]
cmp qword [rax], 0
jne 0x40f310
cmp byte [0x00492c88], 0
jne 0x40f310
call sub.kernel32.dll_GetSystemDefaultUILanguage
lea rcx, [rbp + 0x38]
mov edx, eax
call fcn.0040e500
mov rcx, rbp
lea rdx, [rbp + 0x40]
mov r8, qword [rbp + 0x60]
mov r9, qword [rbp + 0x38]
call fcn.0040ef20
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x40]
call fcn.0040b370
mov rax, qword [rbp + 0x28]
cmp qword [rax], 0
jne 0x40f337
mov rcx, rbp
lea rdx, [rbp + 0x30]
mov r8, qword [rbp + 0x60]
call fcn.0040f050
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x30]
call fcn.0040b370
nop
lea rcx, [rbp + 0x30]
mov edx, 8
call fcn.0040ae00
lea rcx, [rbp + 0x88]
mov edx, 2
call fcn.0040ae00
mov rax, qword [rbp + 0x28]
lea rsp, [rbp + 0x70]
pop rbp
ret

Function at 0x410060
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x58
lea rcx, [rsp + 0x20]
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [rsp + 0x40]
add rsp, 0x58
ret

Function at 0x410080
Capabilities:
Check os version

Disassembly:
sub rsp, 0x28
call sub.kernel32.dll_GetVersion
mov ecx, eax
and ecx, 0xff
and eax, 0xff00
shr eax, 8
cmp ecx, 5
jne 0x4100a4
cmp eax, 1
jae 0x4100a9
cmp ecx, 5
jbe 0x4100b5
mov dword [0x0048e9b0], 0x7f
jmp 0x4100bf
mov dword [0x0048e9b0], 0x409
add rsp, 0x28
ret