joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100002b10
Capabilities:
Get file version info

Disassembly:
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov rax, rsp
sub rsp, 0x88
mov qword [rax - 8], rbx
mov qword [rax - 0x10], rbp
mov qword [rax - 0x18], rsi
mov qword [rax - 0x20], rdi
mov qword [rax - 0x28], r12
xor ebp, ebp
cmp dword [rcx + 0x7c], ebp
mov qword [rax - 0x30], r13
mov qword [rax - 0x38], r14
mov qword [rax - 0x40], r15
mov r14d, ebp
mov r9d, r8d
mov rdi, rdx
mov r12, rcx
mov r13, rbp
jle 0x100002d2e
mov r15, rbp
nop
nop
nop
mov ebx, dword [r12 + 0x80]
mov edx, r9d
mov rcx, rdi
add rbx, r15
mov eax, dword [rbx + r12 + 0xbc]
lea r8, [rax + r12 + 0x84]
call fcn.100002900
test eax, eax
je 0x100002d33
lea rdx, [rsp + 0x90]
mov rcx, rdi
call sub.VERSION.dll_GetFileVersionInfoSizeA
test eax, eax
mov edi, eax
je 0x100002cf8
mov rdx, rdi
mov ecx, 0x42
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
test rax, rax
mov r13, rax
je 0x100002d33
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
test rax, rax
mov rsi, rax
je 0x100002d33
mov edx, dword [rsp + 0x90]
mov r8d, edi
mov rdi, qword [rsp + 0x98]
mov rcx, rdi
mov r9, rax
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x100002ced
lea r9, [rsp + 0x20]
lea r8, [rsp + 0x38]
lea rdx, [0x1000015d4]
mov rcx, rsi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x100002ced
cmp dword [rsp + 0x20], ebp
je 0x100002ced
mov rax, qword [rsp + 0x38]
lea r8, [rbx + r12 + 0x90]
mov rdx, rbp
mov r10d, dword [rax + 8]
mov r9d, dword [rax + 0xc]
nop
mov eax, dword [r8 - 0xc]
mov ecx, dword [r8 - 8]
cmp r10d, eax
jae 0x100002c64
mov eax, 0xffffffff
jmp 0x100002c84
cmp r10d, eax
jbe 0x100002c70
mov eax, 1
jmp 0x100002c84
cmp r9d, ecx
jae 0x100002c7c
mov eax, 0xffffffff
jmp 0x100002c84
cmp r9d, ecx
mov eax, ebp
seta al
mov ecx, dword [r8 + 4]
mov dword [rsp + rdx + 0x28], eax
mov eax, dword [r8]
cmp r10d, eax
jae 0x100002c9b
mov eax, 0xffffffff
jmp 0x100002cbb
cmp r10d, eax
jbe 0x100002ca7
mov eax, 1
jmp 0x100002cbb
cmp r9d, ecx
jae 0x100002cb3
mov eax, 0xffffffff
jmp 0x100002cbb
cmp r9d, ecx
mov eax, ebp
seta al
mov dword [rsp + rdx + 0x30], eax
add rdx, 4
add r8, 0x18
cmp rdx, 8
jl 0x100002c50
cmp dword [rsp + 0x28], ebp
jl 0x100002cd9
cmp dword [rsp + 0x30], ebp
jle 0x100002ced
cmp dword [rsp + 0x2c], ebp
jl 0x100002d81
cmp dword [rsp + 0x34], ebp
jg 0x100002d81
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
jmp 0x100002d14
cmp dword [rbx + r12 + 0x84], ebp
jne 0x100002d33
cmp dword [rbx + r12 + 0x88], ebp
jne 0x100002d33
mov rdi, qword [rsp + 0x98]
mov r9d, dword [rsp + 0xa0]
inc r14d
add r15, 0x3c
cmp r14d, dword [r12 + 0x7c]
jl 0x100002b70
mov ebp, 1
test r13, r13
mov rax, qword [rsp + 0xa8]
mov r15, qword [rsp + 0x48]
mov r12, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x80]
mov dword [rax], r14d
mov r14, qword [rsp + 0x50]
je 0x100002d6d
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov r13, qword [rsp + 0x58]
mov eax, ebp
mov rbp, qword [rsp + 0x78]
add rsp, 0x88
ret
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
jmp 0x100002d33
Function at 0x100004270
Capabilities:
Delete file
Set current directory
Set file attributes

Disassembly:
mov r11, rsp
sub rsp, 0x148
mov rax, qword [0x100011410]
mov qword [rsp + 0x130], rax
mov qword [r11 + 0x18], rbx
mov rbx, qword [0x100012348]
mov qword [r11 + 0x20], rdi
test rbx, rbx
mov rdi, rbx
je 0x1000042e7
cmp dword [0x1000130e4], 0
jne 0x1000042c9
cmp dword [0x100012ba0], 0
jne 0x1000042c9
mov rcx, qword [rbx]
mov edx, 0x80
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov rcx, qword [rdi]
mov rbx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
test rbx, rbx
mov rdi, rbx
jne 0x1000042a0
mov eax, dword [0x1000130e0]
mov rdi, qword [rsp + 0x168]
mov rbx, qword [rsp + 0x160]
test eax, eax
je 0x100004355
cmp dword [0x1000130e4], 0
jne 0x100004355
cmp dword [0x100012ba0], 0
jne 0x100004355
lea rdx, [0x100012350]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
test byte [0x100012ba4], 0x20
je 0x100004338
lea rcx, [rsp + 0x20]
call fcn.100009990
lea rcx, [0x100001634]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea rcx, [rsp + 0x20]
call fcn.1000037b0
mov eax, dword [0x1000130e0]
cmp word [0x100012178], 1
je 0x100004368
test eax, eax
je 0x100004368
call fcn.100001eb0
mov dword [0x1000130e0], 0
mov rcx, qword [rsp + 0x130]
call fcn.10000ea20
add rsp, 0x148
ret

Function at 0x100004390
Capabilities:
Check if file exists
Create directory
Delete directory
Delete file
Get common file path
Get file attributes

Disassembly:
mov r11, rsp
sub rsp, 0x168
mov rax, qword [0x100011410]
mov qword [rsp + 0x130], rax
mov qword [r11 + 0x20], rbx
mov qword [r11 - 8], rbp
mov qword [r11 - 0x10], rsi
mov qword [r11 - 0x18], rdi
xor esi, esi
mov qword [r11 - 0x20], r12
mov r12d, r8d
mov rbx, rdx
mov rbp, rcx
mov edi, esi
nop
nop
lea rdx, [0x100001660]
lea rcx, [rsp + 0x20]
mov r8d, edi
call qword [sym.imp.USER32.dll_wsprintfA]
mov rdx, rbp
mov rcx, rbx
inc edi
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea r8, [rsp + 0x20]
mov edx, r12d
mov rcx, rbx
call fcn.100009a40
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x100004457
cmp edi, 0x190
jl 0x1000043d0
lea rdx, [0x100001658]
mov r9, rbx
xor r8d, r8d
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
je 0x100004477
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov eax, 1
jmp 0x100004479
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x100004422
mov dword [0x1000130e0], 1
mov eax, 1
jmp 0x100004479
mov eax, esi
mov r12, qword [rsp + 0x148]
mov rdi, qword [rsp + 0x150]
mov rsi, qword [rsp + 0x158]
mov rbp, qword [rsp + 0x160]
mov rbx, qword [rsp + 0x188]
mov rcx, qword [rsp + 0x130]
call fcn.10000ea20
add rsp, 0x168
ret
Function at 0x100004c10
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub rsp, 0x58
mov rax, qword [0x100011410]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x40], r13
mov r13, rcx
lea rcx, [rsp + 0x20]
lea rdx, [0x100001640]
xor r8d, r8d
xor r12d, r12d
call qword [sym.imp.USER32.dll_wsprintfA]
lea r8d, [r12 + 0xa]
lea rdx, [rsp + 0x20]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
test rax, rax
je 0x100004d40
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rbp
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x50], rdi
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
mov rbp, rax
je 0x100004d25
mov esi, dword [rax]
mov edi, dword [rax + 4]
lea rcx, [rax + 8]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
lea r8, [rbp + 8]
mov edx, edi
movsxd r9, eax
mov ecx, esi
lea r9, [r9 + rbp + 9]
call r13
test eax, eax
je 0x100004d33
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FreeResource]
inc r12d
lea rdx, [0x100001640]
lea rcx, [rsp + 0x20]
mov r8d, r12d
call qword [sym.imp.USER32.dll_wsprintfA]
lea rdx, [rsp + 0x20]
mov r8d, 0xa
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
test rax, rax
jne 0x100004c74
mov eax, 1
mov rsi, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x50]
mov r13, qword [rsp + 0x40]
mov r12, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x38]
call fcn.10000ea20
add rsp, 0x58
ret
mov dword [0x100012170], 0x80070714
xor eax, eax
jmp 0x100004cf8
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FreeResource]
xor eax, eax
jmp 0x100004cf8
mov eax, 1
jmp 0x100004d0c

Function at 0x100004fc0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x140
mov rax, qword [0x100011410]
mov qword [rsp + 0x130], rax
mov rbx, rcx
lea rdx, [0x100012350]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea rcx, [rsp + 0x20]
mov r8, rbx
mov edx, 0x104
call fcn.100009a40
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x10000503a
test al, 0x10
jne 0x10000503a
xor edx, edx
lea rcx, [rsp + 0x20]
lea r8d, [rdx + 8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rcx, qword [rsp + 0x130]
call fcn.10000ea20
add rsp, 0x140
pop rbx
ret
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, qword [rsp + 0x130]
call fcn.10000ea20
add rsp, 0x140
pop rbx
ret
Function at 0x1000059e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub rsp, 0x38
lea rdx, [0x1000016c8]
mov r8d, 0xa
xor ecx, ecx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rdi
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
cmp eax, 0x24
mov ebx, eax
ja 0x100005a65
test eax, eax
je 0x100005a6a
lea rdx, [0x1000016c8]
mov r8d, 0xa
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
mov rdi, rax
je 0x100005a6a
lea rcx, [0x100013420]
mov r8, rbx
mov rdx, rax
call sub.msvcrt.dll_memcpy
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeResource]
cmp ebx, 0x24
je 0x100005a87
mov dword [rsp + 0x28], 0
xor r9d, r9d
mov edx, 0x4b1
mov dword [rsp + 0x20], 0x10
xor r8d, r8d
jmp 0x100005aae
mov eax, dword [0x100013440]
test eax, eax
mov dword [0x100012564], eax
jne 0x100005ad0
mov dword [rsp + 0x28], eax
xor r9d, r9d
mov edx, 0x4c6
mov dword [rsp + 0x20], 0x10
xor r8d, r8d
xor ecx, ecx
call fcn.100005260
mov dword [0x100012170], 0x80070714
xor eax, eax
mov rdi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
add rsp, 0x38
ret
lea rdx, [0x1000016b8]
mov r8d, 0xa
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
cmp eax, 4
mov ebx, eax
ja 0x100005b47
test eax, eax
je 0x100005b47
lea rdx, [0x1000016b8]
mov r8d, 0xa
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
mov rdi, rax
je 0x100005b47
lea rcx, [0x100012ba8]
mov r8, rbx
mov rdx, rax
call sub.msvcrt.dll_memcpy
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeResource]
lea rcx, [0x100004d50]
call fcn.100004c10
test eax, eax
jne 0x100005b86
mov dword [rsp + 0x28], eax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x4c6
xor ecx, ecx
mov dword [rsp + 0x20], 0x10
call fcn.100005260
xor eax, eax
mov rdi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
add rsp, 0x38
ret
mov rdi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov eax, 1
add rsp, 0x38
ret
Function at 0x100005ba0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub rsp, 0x38
lea rdx, [0x1000016e0]
mov r8d, 0xa
xor ecx, ecx
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rdi
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, 0x40
lea edx, [rax + 1]
mov esi, eax
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
test rax, rax
mov rdi, rax
jne 0x100005c51
mov dword [rsp + 0x28], eax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x4b5
xor ecx, ecx
mov dword [rsp + 0x20], 0x10
call fcn.100005260
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jg 0x100005c2b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x100012170], eax
xor eax, eax
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x50]
add rsp, 0x38
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
xor eax, eax
mov dword [0x100012170], ecx
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x50]
add rsp, 0x38
ret
lea rdx, [0x1000016e0]
mov r8d, 0xa
xor ecx, ecx
mov qword [rsp + 0x48], rbx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
cmp eax, esi
mov ebx, eax
ja 0x100005cc8
test eax, eax
je 0x100005ccc
lea rdx, [0x1000016e0]
mov r8d, 0xa
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
mov rsi, rax
je 0x100005ccc
mov r8, rbx
mov rdx, rax
mov rcx, rdi
call sub.msvcrt.dll_memcpy
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeResource]
test ebx, ebx
jne 0x100005d06
xor r9d, r9d
xor r8d, r8d
mov edx, 0x4b1
xor ecx, ecx
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x10
call fcn.100005260
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [0x100012170], 0x80070714
jmp 0x100005d99
lea rdx, [0x1000016d4]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x100005d3c
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rbx, qword [rsp + 0x48]
mov eax, 1
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x50]
add rsp, 0x38
ret
xor r9d, r9d
mov r8, rdi
mov edx, 0x3e9
xor ecx, ecx
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0x20
call fcn.100005260
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_LocalFree]
cmp ebx, 6
jne 0x100005d8f
lea eax, [rbx - 5]
mov rbx, qword [rsp + 0x48]
mov dword [0x100012170], 0
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x50]
add rsp, 0x38
ret
mov dword [0x100012170], 0x800704c7
mov rbx, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x50]
xor eax, eax
add rsp, 0x38
ret
Function at 0x100005dc0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], rdi
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, 0x40
lea ebx, [rax + 0x14]
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
test rax, rax
mov rsi, rax
jne 0x100005e6b
xor ebx, ebx
xor r9d, r9d
xor r8d, r8d
mov edx, 0x4b5
xor ecx, ecx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 0x10
call fcn.100005260
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jg 0x100005e40
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x100012170], eax
xor eax, eax
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x50]
add rsp, 0x48
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
xor eax, eax
mov dword [0x100012170], ecx
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x50]
add rsp, 0x48
ret
mov rdx, rdi
mov rcx, rax
mov qword [rsp + 0x58], rbp
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea r8, [0x1000016e8]
mov edx, ebx
mov rcx, rsi
call fcn.100009a40
xor ebx, ebx
xor r9d, r9d
mov qword [rsp + 0x30], rbx
xor r8d, r8d
mov edx, 0x40000000
mov rcx, rsi
mov dword [rsp + 0x28], 0x4000080
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rcx, rsi
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_LocalFree]
cmp rbp, 0xffffffffffffffff
jne 0x100005ee2
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jg 0x100005f0a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x100012170], eax
jmp 0x100005f1f
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x100005eca
test al, 0x10
je 0x100005eca
mov dword [0x100012170], ebx
mov eax, 1
jmp 0x100005f21
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
mov dword [0x100012170], ecx
xor eax, eax
mov rbp, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x50]
add rsp, 0x48
ret
Function at 0x1000062d0
Capabilities:
Get common file path

Disassembly:
sub rsp, 0x158
mov rax, qword [0x100011410]
mov qword [rsp + 0x140], rax
lea rcx, [rsp + 0x30]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jne 0x100006371
mov dword [rsp + 0x28], eax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x4f0
xor ecx, ecx
mov dword [rsp + 0x20], 0x10
call fcn.100005260
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jg 0x100006345
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x100012170], eax
xor eax, eax
mov rcx, qword [rsp + 0x140]
call fcn.10000ea20
add rsp, 0x158
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
xor eax, eax
mov dword [0x100012170], ecx
mov rcx, qword [rsp + 0x140]
call fcn.10000ea20
add rsp, 0x158
ret
mov edx, 2
lea rcx, [rsp + 0x30]
mov r8d, edx
call fcn.100005f40
mov rcx, qword [rsp + 0x140]
call fcn.10000ea20
add rsp, 0x158
ret

Function at 0x1000063a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], rbp
mov rbp, r8
mov qword [rsp + 0x40], rsi
mov r8d, 5
mov rbx, rcx
mov qword [rsp + 0x38], rdi
mov rsi, r9
call qword [sym.imp.KERNEL32.dll_FindResourceA]
test rax, rax
je 0x100006438
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
mov rdi, rax
je 0x100006438
mov rax, qword [rsp + 0x80]
test rax, rax
jne 0x10000640f
mov r9, rsi
mov r8, rbp
mov rdx, rdi
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.USER32.dll_DialogBoxIndirectParamA]
mov rbx, rax
jmp 0x100006429
mov r9, rsi
mov r8, rbp
mov rdx, rdi
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.USER32.dll_DialogBoxIndirectParamA]
mov rbx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeResource]
cmp rbx, 0xffffffffffffffff
jne 0x100006464
xor r9d, r9d
xor r8d, r8d
mov edx, 0x4fb
xor ecx, ecx
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x10
call fcn.100005260
mov rax, qword [rsp + 0x88]
jmp 0x100006467
mov rax, rbx
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
add rsp, 0x58
ret
Function at 0x100006ae0
Capabilities:
Create process on windows

Disassembly:
mov r11, rsp
sub rsp, 0x288
mov rax, qword [0x100011410]
mov qword [rsp + 0x270], rax
test rcx, rcx
mov qword [r11 + 0x18], rbx
mov qword [r11 - 8], rdi
mov edi, 1
mov rbx, rcx
jne 0x100006b15
xor eax, eax
jmp 0x100006cc3
xor eax, eax
mov qword [rsp + 0x2a8], rsi
xor esi, esi
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x58]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], rsi
mov rdx, rcx
mov qword [rsp + 0x30], rsi
xor ecx, ecx
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x100006c3a
mov rcx, qword [rsp + 0x58]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x58]
lea rdx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [0x1000130e8], esi
mov ebx, dword [rsp + 0x50]
jne 0x100006bbf
mov ecx, dword [0x100012b9c]
test dil, cl
je 0x100006bbf
test cl, 2
jne 0x100006bbf
mov eax, ebx
and eax, 0xff000000
cmp eax, 0xaa000000
cmove ecx, ebx
mov dword [0x100012b9c], ecx
bt dword [0x100012ba4], 0xb
jae 0x100006bd1
mov dword [0x100012170], ebx
jmp 0x100006c0a
call fcn.100002810
cmp eax, 2
je 0x100006c00
mov eax, ebx
and eax, 0xff000000
cmp eax, 0xaa000000
jne 0x100006bee
test dil, bl
jne 0x100006c00
bt dword [0x100012ba4], 9
jae 0x100006c0a
mov dword [0x100012170], ebx
jmp 0x100006c0a
mov dword [0x100012170], 0xbc2
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
bt dword [0x100012ba4], 0xa
jae 0x100006cb9
cmp dword [rsp + 0x50], esi
jge 0x100006cb9
jmp 0x100006cb7
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jg 0x100006c52
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x100012170], eax
jmp 0x100006c67
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
mov dword [0x100012170], ecx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov qword [rsp + 0x30], rsi
xor r9d, r9d
mov r8d, eax
lea rax, [rsp + 0x70]
xor edx, edx
mov ecx, 0x1000
mov dword [rsp + 0x28], 0x200
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
lea r9, [rsp + 0x70]
mov r8, rbx
mov edx, 0x4c4
xor ecx, ecx
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], 0x10
call fcn.100005260
mov edi, esi
mov rsi, qword [rsp + 0x2a8]
mov eax, edi
mov rdi, qword [rsp + 0x280]
mov rbx, qword [rsp + 0x2a0]
mov rcx, qword [rsp + 0x270]
call fcn.10000ea20
add rsp, 0x288
ret
Function at 0x100006cf0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub rsp, 0x38
lea rdx, [0x100001700]
mov r8d, 0xa
xor ecx, ecx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rsi
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, 0x40
lea edx, [rax + 1]
mov esi, eax
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
test rax, rax
mov rbx, rax
jne 0x100006d63
mov dword [rsp + 0x28], eax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x4b5
xor ecx, ecx
mov dword [rsp + 0x20], 0x10
call fcn.100005260
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x48]
add rsp, 0x38
ret
lea rdx, [0x100001700]
mov r8d, 0xa
xor ecx, ecx
mov qword [rsp + 0x58], rdi
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
cmp eax, esi
mov edi, eax
ja 0x100006dda
test eax, eax
je 0x100006dde
lea rdx, [0x100001700]
mov r8d, 0xa
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
mov rsi, rax
je 0x100006dde
mov r8, rdi
mov rdx, rax
mov rcx, rbx
call sub.msvcrt.dll_memcpy
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeResource]
test edi, edi
jne 0x100006df8
mov dword [rsp + 0x28], 0
xor r8d, r8d
mov edx, 0x4b1
mov dword [rsp + 0x20], 0x10
jmp 0x100006e24
lea rdx, [0x1000016d4]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x100006e2e
mov dword [rsp + 0x28], 0
mov r8, rbx
mov edx, 0x3e9
mov dword [rsp + 0x20], 0x40
xor r9d, r9d
xor ecx, ecx
call fcn.100005260
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x48]
add rsp, 0x38
ret