joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140024578
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x68
mov rax, qword [0x14005b018]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov r8d, 0xb
lea rdx, [rsp + 0x40]
lea rcx, str.MSVCETW_PARENT_CONTEXT_THREAD_ID
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
xor ecx, ecx
test eax, eax
je 0x140024613
movdqa xmm0, xmmword [0x140042370]
lea rax, [rsp + 0x40]
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x20], rcx
or r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], cx
jne 0x1400245c5
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.14000e828
test byte [0x140061480], 0x80
je 0x140024607
lea rcx, [rsp + 0x20]
call fcn.140027024
mov rcx, qword [0x140060910]
lea rdx, [0x140053c30]
mov r8d, eax
call fcn.140027518
lea rcx, [rsp + 0x20]
call fcn.14000ed54
jmp 0x140024632
test byte [0x140061480], 0x80
je 0x140024632
mov rcx, qword [0x140060910]
lea rdx, [0x140053c30]
xor r8d, r8d
call fcn.140027518
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140011450
add rsp, 0x68
ret
Function at 0x140025124
Capabilities:
Set environment variable

Disassembly:
sub rsp, 0x58
mov rax, qword [0x14005b018]
xor rax, rsp
mov qword [rsp + 0x40], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, eax
lea rcx, [rsp + 0x20]
call fcn.14000e790
cmp qword [rsp + 0x38], 8
lea rdx, [rsp + 0x20]
lea rcx, str.MSVCETW_PARENT_CONTEXT_THREAD_ID
cmovae rdx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea rcx, [rsp + 0x20]
call fcn.14000ed54
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140011450
add rsp, 0x58
ret

Function at 0x1400252a0
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
push r12
push r14
sub rsp, 0x20
mov rsi, rdx
lea r8, str._CL_
xor r14d, r14d
lea rcx, [rax + 0x10]
xor edx, edx
mov qword [rax + 0x10], r14
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll__wdupenv_s]
mov rax, qword [rsi]
mov rbx, rsi
test rax, rax
je 0x1400253ce
lea r12d, [r14 + 0x5c]
movzx edx, word [rax]
mov rcx, r14
test dx, dx
je 0x1400253be
cmp dx, 0x22
jne 0x14002531a
inc rcx
mov rdx, rax
cmp rax, qword [rbx]
je 0x14002531a
sub rdx, 2
cmp word [rdx], r12w
jne 0x14002531a
inc rcx
cmp rdx, qword [rbx]
jne 0x140025308
add rax, 2
movzx edx, word [rax]
test dx, dx
jne 0x1400252f7
test rcx, rcx
je 0x1400253be
sub rax, qword [rbx]
lea rbp, [rcx + 1]
sar rax, 1
mov rcx, 0xffffffffffffffff
add rbp, rax
mov eax, 2
mul rbp
cmovo rax, rcx
mov rcx, rax
call fcn.140011964
mov rdi, rax
test rax, rax
jne 0x140025369
mov ecx, 0x1f6a
call fcn.14000c824
mov rdx, qword [rbx]
lea r8, [rdi + rbp*2]
mov rcx, rdi
cmp rdi, r8
jae 0x1400253bb
movzx eax, word [rdx]
cmp ax, 0x22
jne 0x1400253ab
mov rax, rdx
cmp rdx, qword [rbx]
je 0x1400253a0
sub rax, 2
cmp word [rax], r12w
jne 0x1400253a0
mov word [rcx], r12w
add rcx, 2
cmp rax, qword [rbx]
jne 0x140025389
mov word [rcx], r12w
add rcx, 2
movzx eax, word [rdx]
mov word [rcx], ax
add rdx, 2
add rcx, 2
cmp rcx, r8
jb 0x140025378
mov qword [rbx], rdi
add rbx, 8
mov rax, qword [rbx]
test rax, rax
jne 0x1400252e8
cmp dword [0x14005f2fc], r14d
jne 0x1400253eb
mov r8, qword [rsp + 0x48]
lea r9, str._hybrid:x86native__noover__c__Gy__GL___Oy___Ob0__d2globaldataref__d2nodllexport
mov rdx, rsi
call fcn.140025440
mov r8, qword [rsp + 0x48]
lea r9, str._hybrid:x86arm64__nologo__Oy_
mov rdx, rsi
call fcn.140025440
mov rdx, qword [rsp + 0x48]
test rdx, rdx
je 0x140025421
lea rcx, str._CL_
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll__wputenv_s]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
test byte [0x140061480], 0x80
je 0x140025436
lea rdx, [0x140030a08]
call fcn.140027504
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x140025440
Capabilities:
Resolve path using msvcrt
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
or rbx, 0xffffffffffffffff
mov rbp, r9
xor r15d, r15d
mov rdi, r8
mov r14, rdx
inc rbx
cmp word [r9 + rbx*2], r15w
jne 0x140025468
add rbx, 2
test rdi, rdi
je 0x14002548c
or rax, 0xffffffffffffffff
inc rax
cmp word [r8 + rax*2], r15w
jne 0x14002547f
add rbx, rax
lea rcx, [rbx + rbx]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
jne 0x1400254a8
mov ecx, 0x1f6a
call fcn.14000c824
mov rdx, rbx
mov rcx, rsi
test rdi, rdi
je 0x1400254e0
mov r8, rdi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, [0x14002ff20]
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
mov r8, rbp
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
jmp 0x1400254e9
mov r8, rbp
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
mov rdx, rsi
lea rcx, str._CL_
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll__wputenv_s]
lea rax, str.cl.exe
mov qword [r14], rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___p__wpgmptr]
mov r8, r14
xor ecx, ecx
mov rdx, qword [rax]
call qword [sym.imp.api_ms_win_crt_process_l1_1_0.dll__wspawnv]
test rax, rax
je 0x140025550
test rdi, rdi
je 0x140025531
mov rdx, rdi
lea rcx, str._CL_
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll__wputenv_s]
test byte [0x140061480], 0x80
je 0x140025546
lea rdx, [0x140030a08]
call fcn.140027504
or ecx, 0xffffffff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x1400262cc
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x450
mov rax, qword [0x14005b018]
xor rax, rsp
mov qword [rsp + 0x440], rax
mov ebx, 0x800
mov r14d, 0x100
mov ecx, ebx
call fcn.140011964
xor r15d, r15d
mov rdi, rax
mov dword [rsp + 0x20], r15d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r9, [rsp + 0x20]
mov r8d, ebx
mov rcx, rax
mov rdx, rdi
call qword [sym.imp.PSAPI.DLL_EnumProcessModules]
test eax, eax
je 0x1400263a3
mov esi, r14d
mov ebx, dword [rsp + 0x20]
lea rcx, [rsi*8]
cmp rbx, rcx
jbe 0x1400263e9
mov rcx, rdi
call fcn.140011470
add r14d, r14d
mov rcx, 0xffffffffffffffff
mov esi, r14d
mov eax, 8
mul rsi
cmovo rax, rcx
mov rcx, rax
call fcn.140011964
mov rdi, rax
mov dword [rsp + 0x20], r15d
lea ebx, [r14*8]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r9, [rsp + 0x20]
mov r8d, ebx
mov rcx, rax
mov rdx, rdi
call qword [sym.imp.PSAPI.DLL_EnumProcessModules]
test eax, eax
jne 0x140026337
lea rdx, str.Failed_to_get_module_info_n
mov ecx, 2
call fcn.140007ecc
mov rcx, rdi
call fcn.140011470
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.140011450
lea r11, [rsp + 0x450]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
shr ebx, 3
lea rdx, str._d_modules:_n
mov r8d, ebx
mov ecx, 2
call fcn.140007ecc
mov ebp, r15d
test ebx, ebx
je 0x1400263b4
mov r14, rdi
test ebp, ebp
je 0x140026413
mov rsi, qword [r14]
jmp 0x14002641e
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rsi, rax
mov r8d, 0x105
lea rdx, [rsp + 0x30]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov ecx, eax
add rcx, rcx
cmp rcx, 0x20a
jae 0x14002648f
mov word [rsp + rcx + 0x30], r15w
lea r8, str.__p_
lea rcx, [rsp + 0x240]
mov r9, rsi
mov edx, 0x100
call fcn.140002e0c
lea r9, [rsp + 0x30]
mov ecx, 2
lea r8, [rsp + 0x240]
lea rdx, str.Module__s:__s_n
call fcn.140007ecc
inc ebp
add r14, 8
cmp ebp, ebx
jb 0x14002640a
jmp 0x1400263b4
call fcn.140011580
int3
Function at 0x14002869c
Capabilities:
Execute command

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x3f0]
sub rsp, 0x4f0
mov rax, qword [0x14005b018]
xor rax, rsp
mov qword [rbp + 0x3e0], rax
mov rbx, qword [rbp + 0x450]
mov r15, rdx
movsxd rsi, r8d
lea rdx, str.mkdir__s___nul_2_1
mov r8, qword [0x1400613d0]
mov r14, rcx
lea rcx, [rsp + 0x70]
mov rdi, r9
call fcn.140028378
xor r12d, r12d
test eax, eax
jns 0x140028715
lea rdx, str.fatal_error_C1511:_too_long_or_ill_formed_repro_capture_directory_path_n
lea ecx, [r12 + 1]
call fcn.140007ecc
lea ecx, [r12 + 4]
call fcn.14000c8c0
int3
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wsystem]
mov rcx, qword [0x1400613d0]
lea rdx, [rsp + 0x38]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wstat64i32]
test eax, eax
jne 0x140028895
movzx eax, word [rsp + 0x3e]
test ax, ax
je 0x140028895
bt ax, 0xe
jae 0x140028895
mov rax, qword [rbx + 0x38]
lea r8, [0x14002fa4c]
mov r9, rbx
mov qword [rsp + 0x20], rax
mov edx, 0x104
lea rcx, [rbp + 0x1d0]
call fcn.1400079d0
mov r8, qword [0x1400613d0]
lea rax, str..rsp
lea r9, [rbp + 0x1d0]
mov qword [rsp + 0x20], rax
lea rdx, str._s_s_s
lea rcx, [rsp + 0x70]
call fcn.140028378
lea r8, [0x14004c6b4]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfopen_s]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
jne 0x1400287df
lea rdx, str.fatal_error_C1511:_unable_to_create_c1xx.rsp_in_repro_capture_directory_n
mov ecx, 1
call fcn.140007ecc
mov ecx, 4
call fcn.14000c8c0
int3
mov rax, qword [rdi]
mov rbx, rdi
test rax, rax
je 0x140028807
mov r8, rax
lea rdx, [0x14002ff18]
call fcn.140029834
mov rcx, qword [rsp + 0x30]
lea rbx, [rbx + 8]
mov rax, qword [rbx]
jmp 0x1400287e5
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov r8, qword [0x1400613d0]
lea rax, [0x140053ec4]
lea r9, [rbp + 0x1d0]
mov qword [rsp + 0x20], rax
lea rdx, str._s_s_s
lea rcx, [rsp + 0x70]
call fcn.140028378
lea rcx, [0x140053ecc]
mov qword [rdi + rsi*8 + 0x18], r12
mov qword [rdi + rsi*8], rcx
mov r8, r15
lea rcx, [0x140053ed8]
mov qword [rsp + 0x20], rdi
mov qword [rdi + rsi*8 + 8], rcx
mov rdx, r14
lea rcx, [rsp + 0x70]
mov qword [rdi + rsi*8 + 0x10], rcx
xor ecx, ecx
mov r9, qword [r14 + 8]
call fcn.1400068c0
mov rcx, qword [rbp + 0x3e0]
xor rcx, rsp
call fcn.140011450
add rsp, 0x4f0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
lea rdx, str.fatal_error_C1511:_repro_capture_directory_could_not_be_created_n
mov ecx, 1
call fcn.140007ecc
mov ecx, 4
call fcn.14000c8c0
int3
Function at 0x1400299dc
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xe0
mov rdi, rdx
mov rbx, r8
xor edx, edx
mov rsi, rcx
lea rcx, [rbp - 0x15]
lea r8d, [rdx + 0x64]
call sub.VCRUNTIME140.dll_memset
mov rdx, rbx
mov dword [rbp - 0x19], 0x68
lea rcx, [rbp + 0x7f]
call fcn.140029878
mov rbx, qword [rbp + 0x7f]
lea rax, [rbp - 0x31]
mov qword [rsp + 0x48], rax
xor r9d, r9d
lea rax, [rbp - 0x19]
xor r8d, r8d
mov qword [rsp + 0x40], rax
mov rdx, rbx
and qword [rsp + 0x38], 0
mov rcx, rdi
and qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x400
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x140029a72
or dword [rsi + 4], 0xffffffff
mov byte [rsi], al
jmp 0x140029aba
mov rcx, qword [rbp - 0x31]
or edx, 0xffffffff
or dword [rbp - 0x35], 0xffffffff
mov byte [rbp - 0x39], 1
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x140029a9f
mov rcx, qword [rbp - 0x31]
lea rdx, [rbp + 0x7f]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov eax, dword [rbp + 0x7f]
mov dword [rbp - 0x35], eax
mov rcx, qword [rbp - 0x31]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x29]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rbp - 0x39]
mov qword [rsi], rax
test rbx, rbx
je 0x140029ac7
mov rcx, rbx
call fcn.140011470
lea r11, [rsp + 0xe0]
mov rax, rsi
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x140029ae4
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x250
mov rax, qword [0x14005b018]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov r15, r8
mov r12, rdx
mov rdi, rcx
xor r8d, r8d
xor edx, edx
lea rcx, str.PATH
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
xor r13d, r13d
mov esi, eax
test eax, eax
jne 0x140029b41
or r14, 0xffffffffffffffff
mov byte [rdi], r13b
mov dword [rdi + 4], r14d
jmp 0x140029c0b
mov eax, 2
mov r14, 0xffffffffffffffff
mul rsi
cmovo rax, r14
mov rcx, rax
call fcn.140011964
mov r8d, esi
lea rcx, str.PATH
mov rdx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [rsi - 1]
cmp eax, ecx
je 0x140029b8b
mov byte [rdi], r13b
mov dword [rdi + 4], r14d
test rbx, rbx
je 0x140029c0b
jmp 0x140029c03
movzx ebp, word [rbx]
mov rcx, rbx
mov rsi, rbx
jmp 0x140029ba3
cmp bp, 0x3b
je 0x140029ba8
add rsi, 2
movzx ebp, word [rsi]
test bp, bp
jne 0x140029b96
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], r13
mov r9d, 0x104
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov word [rsi], r13w
mov rdx, r12
call qword [sym.imp.KERNEL32.dll_SearchPathW]
dec eax
cmp eax, 0x102
jbe 0x140029bf3
add rsi, 2
mov rcx, rsi
test bp, bp
je 0x140029bea
movzx ebp, word [rsi]
test bp, bp
jne 0x140029b96
mov byte [rdi], r13b
mov dword [rdi + 4], r14d
jmp 0x140029c03
mov r8, r15
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.1400299dc
mov rcx, rbx
call fcn.140011470
mov rax, rdi
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.140011450
mov rbx, qword [rsp + 0x2a8]
add rsp, 0x250
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140029e84
Capabilities:
Query environment variable
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
xor edi, edi
cmp dword [0x140061490], edi
mov r14d, edi
jne 0x14002a0d5
xor r8d, r8d
lea rcx, str.VS_UNICODE_OUTPUT
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea r12d, [rdi + 1]
test eax, eax
je 0x140029ed0
mov r13d, edi
jmp 0x140029ef6
mov ecx, r12d
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__get_osfhandle]
mov rcx, rax
call fcn.140007e90
test eax, eax
je 0x140029eed
call qword [sym.imp.KERNEL32.dll_GetConsoleOutputCP]
jmp 0x140029ef3
call qword [sym.imp.KERNEL32.dll_GetACP]
mov r13d, eax
mov r15d, edi
mov esi, r12d
mov ebx, r12d
lea eax, [rsi + 0xa]
lea ecx, [rax + rax*4]
lea eax, [r15 + rcx*4]
imul ecx, eax, 0x32
add ecx, ebx
call fcn.14000c774
mov rbp, rax
cmp word [rax], di
je 0x14002a033
or rax, 0xffffffffffffffff
mov rcx, rax
inc rcx
cmp word [rbp + rcx*2], di
jne 0x140029f26
movzx r12d, word [rbp + rcx*2 - 2]
test r13d, r13d
jne 0x140029f4c
mov rdi, rax
xor eax, eax
inc rdi
cmp word [rbp + rdi*2], ax
jne 0x140029f40
jmp 0x140029f73
mov qword [rsp + 0x38], rdi
mov r9d, eax
mov qword [rsp + 0x30], rdi
mov r8, rbp
mov dword [rsp + 0x28], edi
xor edx, edx
mov ecx, r13d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea edi, [rax - 1]
cmp edi, 0x28
jg 0x140029fdc
cmp r12w, 0xa
je 0x140029fdc
mov r12d, 1
mov rdx, rbp
mov ecx, r12d
call fcn.140007ecc
test r14d, r14d
jne 0x140029fb9
cmp edi, 0x28
jge 0x140029fcd
lea eax, [r12 + 0x27]
sub eax, edi
mov edi, eax
lea rdx, [0x14002ff20]
mov ecx, r12d
call fcn.140007ecc
sub rdi, r12
jne 0x140029fa3
jmp 0x140029fcd
lea rdx, [0x14002ff84]
mov ecx, r12d
call fcn.140007ecc
call fcn.14002a0f4
xor edi, edi
test r14d, r14d
mov eax, edi
sete al
mov r14d, eax
jmp 0x14002a01d
xor edi, edi
lea r12d, [rdi + 1]
test r14d, r14d
je 0x140029ffe
lea rdx, [0x14002ff84]
mov ecx, r12d
mov r14d, edi
call fcn.140007ecc
call fcn.14002a0f4
mov rdx, rbp
mov ecx, r12d
call fcn.140007ecc
lea rdx, [0x14002ff84]
mov ecx, r12d
call fcn.140007ecc
call fcn.14002a0f4
cmp ebx, r12d
jne 0x14002a033
cmp esi, r12d
jne 0x14002a033
call fcn.14002a0f4
inc ebx
jmp 0x140029eff
add ebx, r12d
cmp ebx, 0x32
jne 0x140029eff
cmp esi, r12d
jne 0x14002a04c
lea esi, [rbx - 0x30]
jmp 0x140029efc
cmp esi, 2
jne 0x14002a05b
mov esi, 5
jmp 0x140029efc
lea rdx, [0x14002ff84]
mov ecx, r12d
mov esi, r12d
call fcn.140007ecc
call fcn.14002a0f4
test r14d, r14d
je 0x14002a08e
lea rdx, [0x14002ff84]
mov ecx, r12d
mov r14d, edi
call fcn.140007ecc
call fcn.14002a0f4
add r15d, r12d
cmp r15d, 9
jl 0x140029efc
jne 0x14002a0b7
call fcn.14000f5d8
test al, al
jne 0x140029efc
call fcn.14000f714
test al, al
jne 0x140029efc
test byte [0x140061480], 0x80
je 0x14002a0cc
lea rdx, [0x140030a08]
call fcn.140027504
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14002e034
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0x70
and qword [r11 - 0x38], 0
lea rax, [r11 + 8]
and qword [r11 + 8], 0
lea rdx, str.SoftwareMicrosoftVSCommon15.0SQM_vctip14.29.30148.0
mov qword [r11 - 0x40], rax
xor r9d, r9d
and qword [r11 - 0x48], 0
xor r8d, r8d
mov dword [rsp + 0x28], 0x20206
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x20], 1
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x14002e0a7
mov r8d, eax
lea rdx, str.RegCreateKeyEx
lea rcx, [rsp + 0x50]
call fcn.14002e130
lea rdx, [0x140057f28]
lea rcx, [rsp + 0x50]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
mov rbx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov rcx, qword [rsp + 0x80]
lea rdx, str.LastCrash
mov qword [rsp + 0x88], rax
mov r9d, 0xb
lea rax, [rsp + 0x88]
mov dword [rsp + 0x28], 8
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x14002e11a
mov r8d, eax
lea rdx, str.RegSetValueEx
lea rcx, [rsp + 0x50]
call fcn.14002e130
lea rdx, [0x140057f28]
lea rcx, [rsp + 0x50]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
test rbx, rbx
je 0x14002e128
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x70
pop rbx
ret
Function at 0x140006a48
Capabilities:
Get file version info

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 8], rcx
push rdi
sub rsp, 0x40
mov rbx, rdx
mov rdi, rcx
and dword [rax - 0x18], 0
mov rcx, rdx
cmp qword [rdx + 0x18], 8
jb 0x140006a73
mov rcx, qword [rdx]
xor edx, edx
call qword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
nop dword [rax + rax]
mov esi, eax
test eax, eax
sete dl
mov rcx, qword [rsp + 0x48]
lea rax, str.Could_not_read_file_version_info
mov qword [rsp + 0x20], rax
movzx r9d, dl
lea r8, str.amcorewcd_sourcecommon_src_versioninfo.cpp
mov edx, 0x82
call fcn.140006b20
mov ecx, esi
call fcn.140010d10
mov qword [rdi], rax
mov dword [rsp + 0x30], 1
cmp qword [rbx + 0x18], 8
jb 0x140006aca
mov rbx, qword [rbx]
mov r9, rax
mov r8d, esi
xor edx, edx
mov rcx, rbx
call qword [sym.imp.VERSION.dll_GetFileVersionInfoW]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x48]
lea rdx, str.Could_not_retrieve_file_version_info
mov qword [rsp + 0x20], rdx
mov r9d, eax
lea r8, str.amcorewcd_sourcecommon_src_versioninfo.cpp
mov edx, 0x8b
call fcn.140006b58
mov rax, rdi
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x1400084ec
Capabilities:
Hash data using fnv

Disassembly:
xor r9d, r9d
movabs rcx, 0xcbf29ce484222325
test r8, r8
je 0x14000851c
movzx eax, byte [r9 + rdx]
movabs r10, 0x100000001b3
xor rcx, rax
inc r9
imul rcx, r10
cmp r9, r8
jb 0x1400084fe
mov rax, rcx
ret
Function at 0x14000a224
Capabilities:
Parse credit card information

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
xor al, al
mov ecx, dword [rbx + 0x7c]
mov dil, 1
cmp ecx, 0xffffffff
je 0x14000a40f
cmp ecx, 0x7c
je 0x14000a40f
cmp ecx, 0x29
jne 0x14000a26a
cmp dword [rbx + 0x1c], 0
jne 0x14000a40f
test dword [rbx + 0x80], 0x10000000
je 0x14000a3c7
cmp ecx, 0x2e
jne 0x14000a28a
lea rcx, [rbx + 0x40]
mov edx, 5
call fcn.14000aef0
mov rcx, rbx
call fcn.14000a65c
jmp 0x14000a3b8
cmp ecx, 0x5c
jne 0x14000a2ee
mov rcx, rbx
call fcn.14000a65c
test byte [rbx + 0x80], 0x80
je 0x14000a2e1
cmp word [rbx + 0x78], 0x62
jne 0x14000a2c2
mov edx, 4
lea rcx, [rbx + 0x40]
call fcn.14000aef0
mov rcx, rbx
call fcn.14000a65c
jmp 0x14000a3c0
cmp word [rbx + 0x78], 0x42
jne 0x14000a2e1
lea rcx, [rbx + 0x40]
mov edx, 4
call fcn.14000aef0
mov rax, qword [rbx + 0x48]
xor dword [rax + 0xc], 1
jmp 0x14000a2b5
mov rcx, rbx
call fcn.14000a530
jmp 0x14000a3b8
cmp ecx, 0x5b
jne 0x14000a319
mov rcx, rbx
call fcn.14000a65c
mov rcx, rbx
call fcn.14000ecb4
mov edx, 0x5d
mov rcx, rbx
lea r8d, [rdx - 0x59]
call fcn.14000f390
jmp 0x14000a3b8
cmp ecx, 0x28
jne 0x14000a344
mov rcx, rbx
call fcn.14000a65c
mov rcx, rbx
call fcn.14001be58
mov edx, 0x29
mov rcx, rbx
mov dil, al
lea r8d, [rdx - 0x24]
call fcn.14000f390
jmp 0x14000a3b3
cmp ecx, 0x5e
jne 0x14000a351
lea edx, [rcx - 0x5c]
jmp 0x14000a2ac
cmp ecx, 0x24
jne 0x14000a35e
lea edx, [rcx - 0x21]
jmp 0x14000a2ac
cmp ecx, 0x3f
je 0x14000a3fd
lea eax, [rcx - 0x2a]
cmp eax, 1
jbe 0x14000a3fd
cmp ecx, 0x7b
je 0x14000a3fd
cmp ecx, 0x7d
jne 0x14000a38d
test dword [rbx + 0x80], 0x10000000
je 0x14000a3d9
cmp ecx, 0x5d
jne 0x14000a39e
test dword [rbx + 0x80], 0x10000000
je 0x14000a3eb
movzx edx, word [rbx + 0x78]
lea rcx, [rbx + 0x40]
call fcn.14000ad48
mov rcx, rbx
call fcn.14000a65c
test dil, dil
je 0x14000a3c0
mov rcx, rbx
call fcn.14000a424
mov al, 1
jmp 0x14000a233
mov ecx, 5
call qword [sym.imp.msvcp_win.dll_void___cdecl_std::_Xregex_error_enum_std::regex_constants::error_type_]
nop dword [rax + rax]
int3
mov ecx, 6
call qword [sym.imp.msvcp_win.dll_void___cdecl_std::_Xregex_error_enum_std::regex_constants::error_type_]
nop dword [rax + rax]
int3
mov ecx, 4
call qword [sym.imp.msvcp_win.dll_void___cdecl_std::_Xregex_error_enum_std::regex_constants::error_type_]
nop dword [rax + rax]
int3
mov ecx, 0xa
call qword [sym.imp.msvcp_win.dll_void___cdecl_std::_Xregex_error_enum_std::regex_constants::error_type_]
nop dword [rax + rax]
int3
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14000cc28
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x20
and qword [rsp + 0x38], 0
mov rbx, r8
mov r8, qword [rdx]
test r8, r8
je 0x14000cc42
mov r8, qword [r8]
lea r9, [rsp + 0x38]
xor edx, edx
call qword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
nop dword [rax + rax]
test eax, eax
js 0x14000cc79
mov rdx, qword [rsp + 0x38]
mov rcx, rbx
call fcn.140007de0
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
nop dword [rax + rax]
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x14000cc88
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rcx, 0xcbf29ce484222325
xor r8d, r8d
movzx eax, byte [r8 + rdx]
movabs r9, 0x100000001b3
xor rcx, rax
inc r8
imul rcx, r9
cmp r8, 2
jb 0x14000cc95
mov rax, rcx
ret