joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140019cf0
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0x90
mov r12, rdx
mov rsi, rcx
xor r13d, r13d
mov dword [rbp - 0x49], r13d
lea rcx, vtable.CVolCommonBaseWithMemManager.0
mov qword [rbp - 0x39], rcx
lea rdi, vtable.CVolObject.0
mov qword [rbp - 0x39], rdi
mov qword [rbp - 0x31], r13
mov qword [rbp - 0x29], r13
lea rax, vtable.CWString.0
mov qword [rbp - 0x39], rax
lea rax, [rbp - 0x19]
mov qword [rbp + 0x6f], rax
mov qword [rbp - 0x19], rcx
mov qword [rbp - 0x19], rdi
mov qword [rbp - 0x11], r13
mov qword [rbp - 9], r13
lea rbx, vtable.CVolMem.0
mov qword [rbp - 0x19], rbx
mov qword [rbp - 1], r13
mov qword [rbp + 0xf], r13
mov qword [rbp + 7], r13
mov qword [rbp + 0x17], 0x40
mov qword [rbp - 0x21], r13
mov qword [rbp + 0x17], 0xfe
mov rcx, rdx
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov r14d, eax
test eax, eax
jne 0x140019dfa
mov rax, qword [rbp - 0x21]
test rax, rax
jne 0x140019db3
lea rax, [0x14027a600]
cmp qword [rbp + 0xf], r13
cmovne rax, qword [rbp - 1]
mov rdx, rax
mov rcx, rsi
call fcn.140003270
mov dword [rbp - 0x49], 1
lea rax, [rbp - 0x19]
mov qword [rbp + 0x6f], rax
mov qword [rbp - 0x19], rbx
mov rdx, qword [rbp - 1]
test rdx, rdx
je 0x140019de5
lea rcx, [rbp - 0x19]
mov rax, qword [rbp - 0x19]
call qword [rax + 0x18]
mov qword [rbp - 1], r13
mov qword [rbp + 0xf], r13
mov qword [rbp + 7], r13
mov qword [rbp - 0x19], rdi
jmp 0x140019eec
inc r14d
movsxd r15, r14d
mov eax, 2
mul r15
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.140054410
mov rbx, rax
test r14d, r14d
je 0x140019e37
movzx eax, r13w
mov rdi, rbx
mov rcx, r15
rep stosw word [rdi], ax
lea rdi, vtable.CVolObject.0
mov r8d, r14d
mov rdx, rbx
mov rcx, r12
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov qword [rbp - 0x21], r13
mov rdx, qword [rbp - 1]
test rdx, rdx
je 0x140019e5e
lea rcx, [rbp - 0x19]
mov rax, qword [rbp - 0x19]
call qword [rax + 0x18]
mov qword [rbp - 1], r13
mov qword [rbp + 0xf], r13
mov qword [rbp + 7], r13
test rbx, rbx
je 0x140019e81
cmp word [rbx], 0
je 0x140019e81
mov rdx, rbx
lea rcx, [rbp - 0x19]
call fcn.14002e750
mov rcx, rbx
call fcn.140054408
mov rax, qword [rbp - 0x21]
test rax, rax
jne 0x140019ea3
lea rax, [0x14027a600]
cmp qword [rbp + 0xf], 0
cmovne rax, qword [rbp - 1]
mov rdx, rax
mov rcx, rsi
call fcn.140003270
mov dword [rbp - 0x49], 1
lea rax, [rbp - 0x19]
mov qword [rbp + 0x6f], rax
lea rax, vtable.CVolMem.0
mov qword [rbp - 0x19], rax
mov rdx, qword [rbp - 1]
test rdx, rdx
je 0x140019edc
lea rcx, [rbp - 0x19]
mov rax, qword [rbp - 0x19]
call qword [rax + 0x18]
mov qword [rbp - 1], r13
mov qword [rbp + 0xf], r13
mov qword [rbp + 7], r13
mov qword [rbp - 0x19], rdi
mov qword [rbp - 0x39], rdi
mov rax, rsi
mov rbx, qword [rsp + 0xe0]
add rsp, 0x90
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14001d0c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
call fcn.14001cb20
mov r8, qword [rdi]
mov rcx, rdi
mov rbx, rax
call qword [r8 + 0x28]
cmp rbx, rax
je 0x14001cd33
mov r8d, dword [rbx + 0x18]
cmp dword [rax + 0x18], r8d
jne 0x14001cd21
mov r8, qword [rbx + 0x10]
cmp qword [rax + 0x10], r8
jne 0x14001cd21
mov rdx, qword [rbx + 8]
mov rcx, qword [rax + 8]
call fcn.1401f90b0
test eax, eax
je 0x14001cd33
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rdx, rdi
mov rcx, rsi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x14001d0c0
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
movzx eax, byte [rdx + 8]
mov rbx, rdx
xor al, byte [rcx + 8]
mov rdi, rcx
test al, 1
jne 0x14001d240
mov rax, qword [rdx + 0x10]
cmp qword [rcx + 0x10], rax
jne 0x14001d240
movzx eax, byte [rdx + 0x20]
xor al, byte [rcx + 0x20]
test al, 1
jne 0x14001d240
mov rax, qword [rdx + 0x28]
cmp qword [rcx + 0x28], rax
jne 0x14001d240
mov r8, qword [rcx + 0x40]
cmp r8, qword [rdx + 0x40]
jne 0x14001d240
mov rdx, qword [rdx + 0x30]
mov rcx, qword [rcx + 0x30]
call fcn.1401f5820
test eax, eax
jne 0x14001d240
mov r8, qword [rbx + 0x68]
test r8, r8
jne 0x14001d14d
cmp qword [rbx + 0x98], r8
lea r8, [0x14027a600]
je 0x14001d14d
mov r8, qword [rbx + 0x88]
mov rax, qword [rdi + 0x68]
test rax, rax
jne 0x14001d16d
cmp qword [rdi + 0x98], rax
lea rax, [0x14027a600]
je 0x14001d16d
mov rax, qword [rdi + 0x88]
sub r8, rax
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x14001d184
add rax, 2
test ecx, ecx
jne 0x14001d170
test edx, edx
jne 0x14001d240
mov r8, qword [rbx + 0xc0]
test r8, r8
jne 0x14001d1af
cmp qword [rbx + 0xf0], r8
lea r8, [0x14027a600]
je 0x14001d1af
mov r8, qword [rbx + 0xe0]
mov rax, qword [rdi + 0xc0]
test rax, rax
jne 0x14001d1d2
cmp qword [rdi + 0xf0], rax
lea rax, [0x14027a600]
je 0x14001d1d2
mov rax, qword [rdi + 0xe0]
sub r8, rax
nop word [rax + rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x14001d1f4
add rax, 2
test ecx, ecx
jne 0x14001d1e0
test edx, edx
jne 0x14001d240
cmp rdi, rbx
jne 0x14001d240
mov eax, dword [rbx + 0x158]
cmp dword [rdi + 0x158], eax
jne 0x14001d240
mov eax, dword [rbx + 0x15c]
cmp dword [rdi + 0x15c], eax
jne 0x14001d240
lea rdx, [rbx + 0x160]
lea rcx, [rdi + 0x160]
call fcn.140017fd0
test eax, eax
jne 0x14001d240
mov eax, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rdi
ret
Function at 0x14001d400
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rdx
mov rdi, rcx
call fcn.14001d250
mov r8, qword [rbx]
mov rcx, rbx
mov rsi, rax
call qword [r8 + 0x28]
cmp rsi, rax
je 0x14001d45b
mov ecx, dword [rsi + 0x18]
cmp dword [rax + 0x18], ecx
jne 0x14001d54c
mov r8, qword [rsi + 0x10]
cmp qword [rax + 0x10], r8
jne 0x14001d54c
mov rdx, qword [rsi + 8]
mov rcx, qword [rax + 8]
call fcn.1401f90b0
test eax, eax
jne 0x14001d54c
movzx eax, byte [rbx + 8]
xor al, byte [rdi + 8]
test al, 1
jne 0x14001d54c
mov rax, qword [rbx + 0x10]
cmp qword [rdi + 0x10], rax
jne 0x14001d54c
mov eax, dword [rbx + 0x18]
cmp dword [rdi + 0x18], eax
jne 0x14001d54c
mov r8, qword [rbx + 0x38]
test r8, r8
jne 0x14001d49e
cmp qword [rbx + 0x68], r8
lea r8, [0x14027a600]
je 0x14001d49e
mov r8, qword [rbx + 0x58]
mov rax, qword [rdi + 0x38]
test rax, rax
jne 0x14001d4b8
cmp qword [rdi + 0x68], rax
lea rax, [0x14027a600]
je 0x14001d4b8
mov rax, qword [rdi + 0x58]
sub r8, rax
nop dword [rax + rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x14001d4d4
add rax, 2
test ecx, ecx
jne 0x14001d4c0
test edx, edx
jne 0x14001d54c
mov r8, qword [rbx + 0x90]
test r8, r8
jne 0x14001d4fb
cmp qword [rbx + 0xc0], r8
lea r8, [0x14027a600]
je 0x14001d4fb
mov r8, qword [rbx + 0xb0]
mov rax, qword [rdi + 0x90]
test rax, rax
jne 0x14001d51e
cmp qword [rdi + 0xc0], rax
lea rax, [0x14027a600]
je 0x14001d51e
mov rax, qword [rdi + 0xb0]
sub r8, rax
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x14001d535
add rax, 2
test ecx, ecx
jne 0x14001d521
test edx, edx
jne 0x14001d54c
lea eax, [rdx + 1]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
xor eax, eax
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140021d60
Capabilities:
Initialize winhttp library

Disassembly:
push rbx
sub rsp, 0x30
cmp qword [rcx + 0x130], 0
mov rbx, rcx
jne 0x140021ebf
mov edx, dword [rcx + 0x70]
cmp edx, 3
jne 0x140021dc9
mov r9, qword [rcx + 0xe8]
test r9, r9
jne 0x140021da2
cmp qword [rcx + 0x118], r9
lea r9, [0x14027a600]
je 0x140021da2
mov r9, qword [rcx + 0x108]
mov r8, qword [rcx + 0x90]
test r8, r8
jne 0x140021dcf
cmp qword [rcx + 0xc0], r8
jne 0x140021dc0
lea r8, [0x14027a600]
jmp 0x140021dcf
mov r8, qword [rcx + 0xb0]
jmp 0x140021dcf
xor r9d, r9d
xor r8d, r8d
test byte [rcx + 0x20], 1
je 0x140021dd9
xor ecx, ecx
jmp 0x140021e33
mov rcx, qword [rcx + 0x30]
xor eax, eax
test rcx, rcx
je 0x140021dec
cmp word [rcx], ax
sete al
jmp 0x140021df4
cmp qword [rbx + 0x60], 2
setle al
test eax, eax
je 0x140021e1d
mov rcx, qword [0x1402cb6a8]
test rcx, rcx
jne 0x140021e33
cmp qword [0x1402cb6d8], 0
lea rcx, [0x14027a600]
cmovne rcx, qword [0x1402cb6c8]
jmp 0x140021e33
test rcx, rcx
jne 0x140021e33
cmp qword [rbx + 0x60], rcx
lea rcx, [0x14027a600]
je 0x140021e33
mov rcx, qword [rbx + 0x50]
mov dword [rsp + 0x20], 0
call qword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov qword [rbx + 0x130], rax
test rax, rax
jne 0x140021e53
add rsp, 0x30
pop rbx
ret
mov r9d, 4
mov dword [rsp + 0x40], 1
lea r8, [rsp + 0x40]
mov edx, 0x8c
mov rcx, rax
call qword [sym.imp.WINHTTP.dll_WinHttpSetOption]
mov rcx, qword [rbx + 0x130]
lea r8, [rsp + 0x40]
mov r9d, 4
mov dword [rsp + 0x40], 1
mov edx, 0x99
call qword [sym.imp.WINHTTP.dll_WinHttpSetOption]
mov rcx, qword [rbx + 0x130]
mov edx, 0x1388
mov r9d, 0x7530
mov dword [rsp + 0x20], 0x7530
mov r8d, 0x7d0
call qword [sym.imp.WINHTTP.dll_WinHttpSetTimeouts]
mov eax, 1
add rsp, 0x30
pop rbx
ret
Function at 0x140022350
Capabilities:
Prepare http request

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rdi, qword [rsp + 0x98]
xor ebx, ebx
mov rbp, r9
mov r15, r8
mov r13, rdx
lea r9, [0x14027a600]
mov r12, rcx
mov r14d, ebx
mov rsi, qword [rdi + 0x48]
test rsi, rsi
je 0x1400223e5
shr rsi, 3
lea ecx, [rsi + 1]
shl rcx, 3
call fcn.1401f9a98
mov edx, esi
mov r14, rax
lea r9, [0x14027a600]
mov qword [rax + rdx*8], rbx
test esi, esi
je 0x1400223e5
mov r8, qword [rdi + 0x48]
mov ecx, ebx
nop
mov rax, rbx
test r8, r8
je 0x1400223cc
mov rax, qword [rdi + 0x38]
mov rax, qword [rcx + rax]
test rax, rax
cmove rax, r9
mov qword [rcx + r14], rax
add rcx, 8
sub rdx, 1
jne 0x1400223c0
mov rax, qword [rsp + 0x90]
mov edx, ebx
mov rcx, qword [rax + 0x18]
test rcx, rcx
je 0x140022400
cmp word [rcx], dx
sete dl
jmp 0x140022408
cmp qword [rax + 0x48], 2
setle dl
test edx, edx
je 0x140022411
mov rcx, rbx
jmp 0x140022423
test rcx, rcx
jne 0x140022423
mov rcx, r9
cmp qword [rax + 0x48], rbx
je 0x140022423
mov rcx, qword [rax + 0x38]
mov rax, qword [rbp + 0x18]
mov edx, ebx
test rax, rax
je 0x140022436
cmp word [rax], dx
sete dl
jmp 0x14002243e
cmp qword [rbp + 0x48], 2
setle dl
test edx, edx
jne 0x140022459
test rax, rax
je 0x14002244c
mov rbx, rax
jmp 0x140022459
cmp qword [rbp + 0x48], rbx
mov rbx, r9
je 0x140022459
mov rbx, qword [rbp + 0x38]
mov r8, qword [r15 + 0x18]
test r8, r8
jne 0x14002246f
cmp qword [r15 + 0x48], r8
mov r8, r9
je 0x14002246f
mov r8, qword [r15 + 0x38]
mov rdx, qword [r13 + 0x18]
test rdx, rdx
jne 0x140022485
cmp qword [r13 + 0x48], rdx
mov rdx, r9
je 0x140022485
mov rdx, qword [r13 + 0x38]
mov eax, dword [rsp + 0xa0]
mov r9, rbx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rcx
mov rcx, r12
call qword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov rbx, rax
test r14, r14
je 0x1400224b9
mov rcx, r14
call fcn.1401f9088
mov rax, rbx
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret

Function at 0x1400224e0
Capabilities:
Set http header

Disassembly:
mov r8, rdx
mov rdx, qword [rdx + 0x18]
test rdx, rdx
je 0x14002250d
mov rax, 0xffffffffffffffff
inc rax
cmp word [rdx + rax*2], 0
jne 0x1400224f3
mov r9d, 0xa0000000
mov r8d, eax
jmp qword [sym.imp.WINHTTP.dll_WinHttpAddRequestHeaders]
mov rax, qword [r8 + 0x48]
test rax, rax
jne 0x14002252d
lea rdx, [0x14027a600]
mov r9d, 0xa0000000
mov r8d, eax
jmp qword [sym.imp.WINHTTP.dll_WinHttpAddRequestHeaders]
mov rdx, qword [r8 + 0x38]
mov r9d, 0xa0000000
shr rax, 1
dec rax
mov r8d, eax
jmp qword [sym.imp.WINHTTP.dll_WinHttpAddRequestHeaders]
Function at 0x140022a50
Capabilities:
Read http header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], r9
push rbp
push rdi
push r12
push r14
push r15
sub rsp, 0x30
xor r12d, r12d
mov rdi, rdx
mov qword [rdx + 0x18], r12
mov r14d, r8d
mov rdx, qword [rdx + 0x38]
mov r15, rcx
test rdx, rdx
je 0x140022a8a
mov rax, qword [rdi + 0x20]
lea rcx, [rdi + 0x20]
call qword [rax + 0x18]
mov rbp, qword [rsp + 0x80]
xor r9d, r9d
mov qword [rdi + 0x38], r12
xor r8d, r8d
mov qword [rdi + 0x48], r12
mov edx, r14d
mov qword [rdi + 0x40], r12
mov rcx, r15
mov eax, dword [rbp + 0x18]
mov dword [rsp + 0x70], eax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x78], r12d
call qword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
mov eax, dword [rsp + 0x78]
test eax, eax
jne 0x140022b07
cmp dword [rsp + 0x70], r12d
jbe 0x140022af3
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x2f76
jne 0x140022af3
mov dword [rbp + 0x18], 0xffffffff
xor eax, eax
mov rbx, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
mov rcx, rax
mov qword [rsp + 0x60], rsi
call fcn.1401f9a98
mov rsi, rax
xor r8d, r8d
lea rax, [rsp + 0x70]
mov r9, rsi
mov qword [rsp + 0x28], rax
mov edx, r14d
lea rax, [rsp + 0x78]
mov rcx, r15
mov qword [rsp + 0x20], rax
call qword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
mov r14d, eax
test eax, eax
je 0x140022ba5
mov ecx, dword [rsp + 0x70]
mov dword [rbp + 0x18], ecx
mov rcx, qword [rdi + 0x18]
test rcx, rcx
jne 0x140022b65
lea rcx, [0x14027a600]
cmp qword [rdi + 0x48], r12
je 0x140022b65
mov rcx, qword [rdi + 0x38]
cmp rsi, rcx
je 0x140022ba5
mov qword [rdi + 0x18], r12
mov rdx, qword [rdi + 0x38]
test rdx, rdx
je 0x140022b82
mov rax, qword [rdi + 0x20]
lea rcx, [rdi + 0x20]
call qword [rax + 0x18]
mov qword [rdi + 0x38], r12
mov qword [rdi + 0x48], r12
mov qword [rdi + 0x40], r12
test rsi, rsi
je 0x140022ba5
cmp word [rsi], r12w
je 0x140022ba5
mov rdx, rsi
lea rcx, [rdi + 0x20]
call fcn.14002e750
mov rcx, rsi
call fcn.1401f9088
mov rsi, qword [rsp + 0x60]
mov eax, r14d
mov rbx, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret

Function at 0x140022bd0
Capabilities:
Read http header

Disassembly:
mov qword [rsp + 0x18], r8
push rbx
sub rsp, 0x30
mov eax, dword [r9 + 0x18]
mov rbx, r9
mov dword [rsp + 0x48], eax
lea r9, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov dword [rsp + 0x50], 0
mov qword [rsp + 0x28], rax
bts edx, 0x1d
lea rax, [rsp + 0x58]
mov dword [rsp + 0x58], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
je 0x140022c30
mov eax, dword [rsp + 0x48]
mov dword [rbx + 0x18], eax
mov eax, dword [rsp + 0x50]
add rsp, 0x30
pop rbx
ret
cmp dword [rsp + 0x48], 0
jbe 0x140022c4b
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x2f76
jne 0x140022c4b
mov dword [rbx + 0x18], 0xffffffff
xor eax, eax
add rsp, 0x30
pop rbx
ret
Function at 0x14002bc70
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x80
mov rbx, r8
mov edi, edx
test r8, r8
je 0x14002be40
mov rax, qword [rcx]
call qword [rax]
mov rbp, rax
test edi, edi
je 0x14002bce0
cmp edi, 3
je 0x14002bce0
sub edi, 1
je 0x14002bccf
cmp edi, 1
jne 0x14002be40
movzx edx, bx
mov rcx, rax
call qword [sym.imp.USER32.dll_LoadIconW]
jmp 0x14002be42
movzx edx, bx
mov rcx, rbp
call qword [sym.imp.USER32.dll_LoadCursorW]
jmp 0x14002be42
movzx edx, bx
mov r8d, 0xa
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov r15, rax
test rax, rax
je 0x14002be40
xor ebx, ebx
mov esi, ebx
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r14, rax
test rax, rax
je 0x14002be40
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r12, rax
test rax, rax
je 0x14002bda6
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
mov qword [rsp + 0x70], rbx
mov rdx, r15
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r8d, eax
mov rdx, r12
lea rcx, [rsp + 0x50]
call fcn.140029830
test rax, rax
je 0x14002bd7f
mov rsi, qword [rsp + 0x50]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
mov qword [rsp + 0x70], rbx
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x14002bda6
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
mov qword [rsp + 0x70], rbx
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FreeResource]
test rsi, rsi
je 0x14002be40
cmp edi, 3
jne 0x14002be3b
lea r8, [rsp + 0x30]
lea edx, [rdi + 0x1d]
mov rcx, rsi
call qword [sym.imp.GDI32.dll_GetObjectW]
test eax, eax
je 0x14002be2d
mov edx, dword [rsp + 0x38]
test edx, edx
je 0x14002be2d
lea ecx, [rdx + 1]
and ecx, 0xfffffffe
mov dword [rsp + 0x20], 1
xor r9d, r9d
lea r8d, [rdi + 0x1e]
call qword [sym.imp.COMCTL32.dll_ImageList_Create]
mov rdi, rax
test rax, rax
je 0x14002be2d
mov r8d, 0xff00ff
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.COMCTL32.dll_ImageList_AddMasked]
test eax, eax
jns 0x14002be2a
mov rcx, rdi
call qword [sym.imp.COMCTL32.dll_ImageList_Destroy]
mov rcx, rsi
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rax, rbx
jmp 0x14002be42
mov rbx, rdi
mov rcx, rsi
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rax, rbx
jmp 0x14002be42
mov rax, rsi
jmp 0x14002be42
xor eax, eax
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
Function at 0x14002bf00
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push r14
sub rsp, 0x20
xor esi, esi
mov r14, r9
mov qword [r8 + 0x28], rsi
mov rbx, r8
mov rbp, rdx
test rdx, rdx
jne 0x14002bf32
lea eax, [rdx + 1]
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rsi
pop rbp
ret
mov rax, qword [rcx]
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], r15
call qword [rax]
movzx edx, bp
mov r8, r14
mov rcx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov r15, rax
test rax, rax
je 0x14002c027
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbp, rax
test rax, rax
je 0x14002c027
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r14, rax
test rax, rax
je 0x14002c01e
mov rdx, r15
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov qword [rbx + 0x28], rsi
cmp qword [rbx + 0x20], rdi
jl 0x14002bffc
cmp rdi, 1
jne 0x14002bfba
movzx ecx, byte [r14]
mov rax, qword [rbx + 0x18]
mov byte [rax], cl
inc qword [rbx + 0x28]
jmp 0x14002c019
cmp rdi, 2
jne 0x14002bfd1
movzx ecx, word [r14]
mov rax, qword [rbx + 0x18]
mov word [rax], cx
add qword [rbx + 0x28], rdi
jmp 0x14002c019
cmp rdi, 4
jne 0x14002bfe6
mov ecx, dword [r14]
mov rax, qword [rbx + 0x18]
mov dword [rax], ecx
add qword [rbx + 0x28], rdi
jmp 0x14002c019
cmp rdi, 8
jne 0x14002bffc
mov rcx, qword [r14]
mov rax, qword [rbx + 0x18]
mov qword [rax], rcx
add qword [rbx + 0x28], rdi
jmp 0x14002c019
test eax, eax
je 0x14002c019
mov rdx, rdi
mov rcx, rbx
call fcn.14002e670
mov r8, rdi
mov rdx, r14
mov rcx, rax
call fcn.1401f4dc0
mov esi, 1
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov r15, qword [rsp + 0x48]
mov rax, rsi
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rsi
pop rbp
ret
Function at 0x14002d340
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x80
test rcx, rcx
je 0x14002d47f
cmp word [rcx], 0
je 0x14002d47f
lea rdx, vtable.CVolCommonBaseWithMemManager.0
mov qword [rbp - 0x60], rdx
lea rsi, vtable.CVolObject.0
mov qword [rbp - 0x60], rsi
xor edi, edi
mov qword [rbp - 0x58], rdi
mov qword [rbp - 0x50], rdi
lea rax, vtable.CWString.0
mov qword [rbp - 0x60], rax
lea rax, [rbp - 0x40]
mov qword [rbp + 0x20], rax
mov qword [rbp - 0x40], rdx
mov qword [rbp - 0x40], rsi
mov qword [rbp - 0x38], rdi
mov qword [rbp - 0x30], rdi
lea r14, vtable.CVolMem.0
mov qword [rbp - 0x40], r14
mov qword [rbp - 0x28], rdi
mov qword [rbp - 0x18], rdi
mov qword [rbp - 0x20], rdi
mov qword [rbp - 0x10], 0x40
mov qword [rbp - 0x48], rdi
mov qword [rbp - 0x10], 0xfe
cmp word [rcx], di
je 0x14002d436
cmp word [rcx + 2], di
je 0x14002d436
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp word [rcx + r8*2], 0
jne 0x14002d3f0
cmp word [rcx + r8*2 - 2], 0x5c
jne 0x14002d436
cmp word [rcx + r8*2 - 4], 0x3a
je 0x14002d436
dec r8
mov rdx, rcx
lea rcx, [rbp - 0x60]
call fcn.140030360
mov rcx, qword [rbp - 0x48]
test rcx, rcx
jne 0x14002d436
lea rcx, [0x14027a600]
cmp qword [rbp - 0x18], 0
cmovne rcx, qword [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov rbx, rdi
cmp eax, 0xffffffff
setne bl
lea rax, [rbp - 0x40]
mov qword [rbp + 0x20], rax
mov qword [rbp - 0x40], r14
mov rdx, qword [rbp - 0x28]
test rdx, rdx
je 0x14002d466
lea rcx, [rbp - 0x40]
mov r8, qword [rbp - 0x40]
call qword [r8 + 0x18]
mov qword [rbp - 0x28], rdi
mov qword [rbp - 0x18], rdi
mov qword [rbp - 0x20], rdi
mov qword [rbp - 0x40], rsi
mov qword [rbp - 0x60], rsi
mov rax, rbx
jmp 0x14002d481
xor eax, eax
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x14002d4a0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
lea rbp, [rsp - 0x10]
sub rsp, 0x110
test rcx, rcx
je 0x14002d609
cmp word [rcx], 0
je 0x14002d609
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
movaps xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
mov qword [rbp], rax
mov dword [rbp - 0x60], 0x68
psrldq xmm0, 0xc
movd eax, xmm0
or eax, 1
mov dword [rbp - 0x24], eax
xor edi, edi
mov word [rbp - 0x20], di
lea rax, vtable.CVolCommonBaseWithMemManager.0
mov qword [rsp + 0x50], rax
lea rsi, vtable.CVolObject.0
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], rdi
lea r14, vtable.CVolMem.0
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x70], rdi
mov qword [rbp - 0x80], 0x40
mov rdx, rcx
lea rcx, [rsp + 0x50]
call fcn.14002e750
mov rdx, qword [rsp + 0x68]
cmp qword [rsp + 0x78], rdi
cmove rdx, rdi
lea rax, [rbp - 0x78]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x14002d5ab
mov ebx, edi
jmp 0x14002d5d3
mov edx, 0x1f4
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.USER32.dll_WaitForInputIdle]
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, 1
mov qword [rsp + 0x50], r14
mov rdx, qword [rsp + 0x68]
test rdx, rdx
je 0x14002d5f0
lea rcx, [rsp + 0x50]
mov r8, qword [rsp + 0x50]
call qword [r8 + 0x18]
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x50], rsi
mov rax, rbx
jmp 0x14002d60b
xor eax, eax
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret