joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001da90
Capabilities:
Get common file path

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
lea rcx, [0x100082100]
mov rax, qword [0x100082100]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x50], rbx
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
mov edi, 0x105
sub eax, edi
or eax, ecx
jge 0x10001dae2
mov edx, edi
lea rcx, [rsp + 0x50]
call fcn.10001fc6c
mov rbx, qword [rsp + 0x50]
cmp dword [rbx - 0xc], edi
jge 0x10001daf2
mov ecx, 0x80070057
call fcn.10001fd10
int3
mov dword [rbx - 0x10], edi
mov word [rbx + 0x20a], 0
mov edx, edi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov rsi, 0xffffffffffffffff
test eax, eax
je 0x10001dc3a
xor eax, eax
mov rcx, rsi
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
test ecx, ecx
js 0x10001dc2f
cmp ecx, dword [rbx - 0xc]
jg 0x10001dc2f
mov dword [rbx - 0x10], ecx
movsxd rax, ecx
mov word [rbx + rax*2], 0
lea rcx, [0x100082100]
mov rax, qword [0x100082100]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x58], rax
lea rdx, [0x100001f30]
lea rcx, [rsp + 0x60]
call fcn.10001ff98
nop
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x50]
call fcn.1000327cc
mov dil, al
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
mov ecx, esi
lock xadd dword [rdx + 0x10], ecx
add ecx, esi
test ecx, ecx
jg 0x10001dba9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test dil, dil
je 0x10001dc02
mov rdi, qword [rsp + 0x58]
mov rdx, rdi
lea rcx, [0x1000827c0]
call fcn.100030720
mov ebx, eax
lea rdx, [rdi - 0x18]
mov ecx, esi
lock xadd dword [rdx + 0x10], ecx
add ecx, esi
test ecx, ecx
jg 0x10001dbdf
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, esi
test eax, eax
jg 0x10001dbfe
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, ebx
jmp 0x10001dc56
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, esi
test eax, eax
jg 0x10001dc28
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x50]
jmp 0x10001dc3a
mov rbx, qword [rsp + 0x50]
jmp 0x10001dc3a
mov ecx, 0x80070057
call fcn.10001fd10
nop
lea rdx, [rbx - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, esi
test eax, eax
jg 0x10001dc54
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
Function at 0x10001f7b4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x28
mov r13, rcx
mov r12d, edx
lea rcx, [0x100082910]
xor edx, edx
xor ebx, ebx
call fcn.10006acc8
lea ebp, [rbx + 1]
jmp 0x10001f886
test rbx, rbx
jne 0x10001f892
mov eax, r12d
lea edx, [rbx + 6]
xor r9d, r9d
shr eax, 4
mov rcx, rsi
add ax, 1
movzx r8d, ax
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
test rax, rax
mov rbx, rax
je 0x10001f875
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x10001f822
xor ebx, ebx
jmp 0x10001f870
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
mov rdi, rax
je 0x10001f81e
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, r12d
mov r11d, eax
add r11, rdi
and ecx, 0xf
jbe 0x10001f85f
cmp rdi, r11
jae 0x10001f81e
add ecx, 0xffffffff
movzx eax, word [rdi]
lea rdi, [rdi + rax*2 + 2]
jne 0x10001f84d
cmp rdi, r11
jae 0x10001f81e
movzx eax, word [rdi]
neg ax
sbb rbx, rbx
and rbx, rdi
test rbx, rbx
jne 0x10001f894
lea rcx, [0x100082910]
mov edx, ebp
call fcn.10006acc8
add ebp, 1
test rax, rax
mov rsi, rax
jne 0x10001f7df
xor esi, esi
test rsi, rsi
jne 0x10001f89d
xor eax, eax
jmp 0x10001f8ab
mov r8d, r12d
mov rdx, rsi
mov rcx, r13
call fcn.10001f8c0
add rsp, 0x28
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x10001f8c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x20
mov eax, r8d
mov rbp, rdx
mov ebx, r8d
shr eax, 4
mov rsi, rcx
mov r8d, 6
add ax, 1
mov rcx, rbp
movzx edx, ax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
mov r12, rax
je 0x10001fa1c
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x10001fa1c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
mov rdi, rax
je 0x10001fa1c
mov rdx, r12
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r11d, eax
add r11, rdi
and ebx, 0xf
jbe 0x10001f953
cmp rdi, r11
jae 0x10001fa1c
add ebx, 0xffffffff
movzx eax, word [rdi]
lea rdi, [rdi + rax*2 + 2]
jne 0x10001f93d
cmp rdi, r11
jae 0x10001fa1c
cmp word [rdi], 0
je 0x10001fa1c
mov rax, qword [rsi]
movzx ebx, word [rdi]
mov ecx, 1
sub ecx, dword [rax - 8]
mov eax, dword [rax - 0xc]
sub eax, ebx
or ecx, eax
jge 0x10001f987
mov edx, ebx
mov rcx, rsi
call fcn.10001fc6c
movzx ecx, word [rdi]
lea r8, [rdi + 2]
cmp ecx, 0xffffffff
jne 0x10001f9a4
xor eax, eax
mov rdi, r8
lea rcx, [rax - 1]
repne scasw ax, word [rdi]
not rcx
and ecx, ecx
movsxd r9, ecx
mov rcx, qword [rsi]
lea rdi, [rbx + rbx]
mov rdx, rdi
add r9, r9
call fcn.10006b664
test eax, eax
je 0x10001f9f2
cmp eax, 0xc
je 0x10001f9e7
cmp eax, 0x16
je 0x10001f9dc
cmp eax, 0x22
je 0x10001f9dc
cmp eax, 0x50
je 0x10001f9f2
mov ecx, 0x80004005
call fcn.10001fd10
int3
mov ecx, 0x80070057
call fcn.10001fd10
int3
mov ecx, 0x8007000e
call fcn.10001fd10
int3
test ebx, ebx
js 0x10001fa11
mov rcx, qword [rsi]
cmp ebx, dword [rcx - 0xc]
jg 0x10001fa11
mov dword [rcx - 0x10], ebx
mov rcx, qword [rsi]
mov eax, 1
mov word [rdi + rcx], 0
jmp 0x10001fa1e
mov ecx, 0x80070057
call fcn.10001fd10
int3
xor eax, eax
add rsp, 0x20
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x10002d0f8
Capabilities:
Set file attributes

Disassembly:
mov qword [rsp + 0x10], rdx
push rbx
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x38
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov r15, r8
mov rbp, rdx
mov rbx, rcx
mov rcx, r8
call fcn.10001fe6c
lea rdx, [0x10000a174]
mov rcx, qword [rbx]
call qword [sym.imp.msvcrt.dll__wfopen]
mov r13, rax
test rax, rax
jne 0x10002d190
mov edx, 0x80
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rdx, [0x10000a174]
mov rcx, qword [rbx]
call qword [sym.imp.msvcrt.dll__wfopen]
mov r13, rax
test rax, rax
jne 0x10002d190
mov rcx, qword [rbp]
test rcx, rcx
je 0x10002d189
lock add dword [rcx + 8], 0xffffffff
jne 0x10002d181
test rcx, rcx
je 0x10002d181
mov rax, qword [rcx]
lea edx, [r13 + 1]
call qword [rax]
mov qword [rbp], 0
xor eax, eax
jmp 0x10002d288
mov rax, qword [rbp]
mov r12, qword [rax + 0x10]
test r12, r12
je 0x10002d252
xor eax, eax
test r12, r12
setne al
test eax, eax
je 0x10002d247
mov rbx, qword [r12 + 0x10]
mov r12, qword [r12]
test rbx, rbx
je 0x10002d1c4
lock add dword [rbx + 8], 1
mov qword [rsp + 0x70], rbx
mov rax, qword [rbx + 0x18]
cmp dword [rax - 0x10], 0
jne 0x10002d1e9
mov r8, qword [rbx + 0x20]
lea rdx, [0x10000a180]
mov rcx, r13
call qword [sym.imp.msvcrt.dll_fwprintf]
jmp 0x10002d228
mov r8, qword [rbx + 0x20]
lea rdx, [0x10000a180]
mov rcx, r13
call qword [sym.imp.msvcrt.dll_fwprintf]
mov r8, qword [rbx + 0x18]
lea rdx, [0x10000a190]
mov rcx, r13
call qword [sym.imp.msvcrt.dll_fwprintf]
mov r11, qword [r15]
cmp dword [r11 - 0x10], 0
jne 0x10002d228
lea rdx, [rbx + 0x18]
mov rcx, r15
call fcn.10001ecdc
nop
lock add dword [rbx + 8], 0xffffffff
jne 0x10002d23c
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [rax]
test r12, r12
jne 0x10002d1a1
jmp 0x10002d252
mov ecx, 0x80004005
call fcn.10001fd10
int3
mov rcx, r13
call qword [sym.imp.msvcrt.dll_fclose]
nop
mov rcx, qword [rbp]
test rcx, rcx
je 0x10002d283
lock add dword [rcx + 8], 0xffffffff
jne 0x10002d27b
test rcx, rcx
je 0x10002d27b
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
mov qword [rbp], 0
mov eax, 1
add rsp, 0x38
pop r15
pop r14
pop r13
pop r12
pop rbp
pop rbx
ret
Function at 0x100030720
Capabilities:
Check mutex on windows
Get file size
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
mov rax, rsp
sub rsp, 0x88
mov rsi, rdx
xor edi, edi
mov dword [rax - 0x48], edi
mov dword [rax + 0x18], edi
cmp qword [0x1000827c0], 0xffffffffffffffff
je 0x10003074e
lea eax, [rdi + 1]
jmp 0x100030870
lea rcx, [rsp + 0x48]
call fcn.100068598
test eax, eax
je 0x100030763
xor eax, eax
jmp 0x100030870
lea r8, [0x100009980]
xor edx, edx
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [0x1000827c8], rax
test rax, rax
jne 0x100030794
lea rcx, [rsp + 0x48]
call fcn.1000309dc
xor eax, eax
jmp 0x100030870
lea rcx, [rsp + 0x48]
call fcn.1000309dc
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov edx, 0xc0000000
lea r8d, [r9 + 3]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x1000827c0], rax
cmp rax, 0xffffffffffffffff
jne 0x1000307e8
lea rcx, [0x1000827c0]
call fcn.1000308a8
xor eax, eax
jmp 0x100030870
xor esi, esi
mov dword [rsp + 0x40], esi
xor edx, edx
mov rcx, qword [0x1000827c8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x100030814
cmp eax, 0x80
je 0x100030814
cmp eax, 0x102
jne 0x10003085d
lea edi, [rsi + 1]
jmp 0x10003085d
mov edi, 1
mov esi, edi
mov dword [rsp + 0x40], edi
xor edx, edx
mov rcx, qword [0x1000827c0]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
test eax, eax
jne 0x10003085d
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0xa0]
lea r8d, [rdi + 1]
lea rdx, [0x1000062d4]
mov rcx, qword [0x1000827c0]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, eax
test esi, esi
je 0x10003086e
mov rcx, qword [0x1000827c8]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, edi
add rsp, 0x88
pop rdi
pop rsi
ret

Function at 0x1000308f4
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
push r12
sub rsp, 0x48
mov esi, r8d
mov r12, rdx
xor edi, edi
mov dword [rsp + 0x70], edi
mov dword [rsp + 0x30], edi
cmp qword [0x1000827c0], 0xffffffffffffffff
jne 0x100030923
xor eax, eax
jmp 0x1000309a7
xor ebx, ebx
mov dword [rsp + 0x30], ebx
mov edx, 0x3e8
mov rcx, qword [0x1000827c8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x10003094f
cmp eax, 0x80
je 0x10003094f
cmp eax, 0x102
je 0x100030958
jmp 0x100030994
mov ebx, 1
mov dword [rsp + 0x30], ebx
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov rcx, qword [0x1000827c0]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
lea r8d, [rsi + rsi]
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x70]
mov rdx, r12
mov rcx, qword [0x1000827c0]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, eax
test ebx, ebx
je 0x1000309a5
mov rcx, qword [0x1000827c8]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, edi
add rsp, 0x48
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x100030a6c
Capabilities:
Manipulate console buffer

Disassembly:
push rbx
push rsi
push rdi
mov rax, rsp
sub rsp, 0x50
xor ebx, ebx
mov dword [rax + 0x30], ebx
mov word [rax + 0x20], bx
mov word [rax + 0x22], bx
call fcn.100033a80
cmp eax, 2
je 0x100030c36
lea rcx, [0x10000a788]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
cmp rax, rbx
mov rdi, rax
je 0x100030c36
lea rdx, [0x10000a7a8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp rax, rbx
je 0x100030c2d
mov ecx, 0xffffffff
call rax
cmp eax, ebx
je 0x100030c2d
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
cmp rax, 0xffffffffffffffff
mov qword [0x1000834f8], rax
je 0x100030c27
lea rdx, [0x100083094]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleMode]
cmp eax, ebx
je 0x100030c27
mov edx, dword [0x100083094]
mov rcx, qword [0x1000834f8]
or edx, 3
call qword [sym.imp.KERNEL32.dll_SetConsoleMode]
cmp eax, ebx
je 0x100030c27
mov rcx, qword [0x1000834f8]
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
cmp eax, ebx
je 0x100030c27
movsx rsi, word [rsp + 0x34]
mov word [0x100083092], 1
mov rcx, rsi
mov word [0x100083090], si
shl rcx, 2
cmp rcx, rsi
jb 0x100030c27
call qword [sym.imp.msvcrt.dll_malloc]
cmp rax, rbx
mov qword [0x100083500], rax
je 0x100030bd3
movzx ecx, word [rsp + 0x36]
mov r8d, dword [0x100083090]
mov word [rsp + 0x78], bx
mov word [rsp + 0x8a], cx
add cx, 1
mov word [rsp + 0x7a], bx
mov r9d, dword [rsp + 0x78]
mov word [rsp + 0x8e], cx
lea rcx, [rsp + 0x88]
mov qword [rsp + 0x20], rcx
mov rcx, qword [0x1000834f8]
mov rdx, rax
mov word [rsp + 0x88], bx
mov word [rsp + 0x8c], si
call qword [sym.imp.KERNEL32.dll_ReadConsoleOutputW]
movzx eax, word [rsp + 0x36]
movsx r8d, word [rsp + 0x34]
mov rcx, qword [0x1000834f8]
mov word [rsp + 0x72], ax
lea rax, [rsp + 0x80]
mov word [rsp + 0x70], bx
mov r9d, dword [rsp + 0x70]
mov dx, 0x20
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_FillConsoleOutputCharacterW]
cmp eax, ebx
je 0x100030c27
mov edx, dword [rsp + 0x70]
mov rcx, qword [0x1000834f8]
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
mov ebx, 1
jmp 0x100030c2d
call qword [sym.imp.KERNEL32.dll_FreeConsole]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, ebx
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x100030df8
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x20
mov rsi, qword [rcx + 8]
mov rbx, rcx
mov rcx, qword [rcx]
xor r12d, r12d
xor ebp, ebp
xor edi, edi
call qword [sym.imp.msvcrt.dll_feof]
test eax, eax
jne 0x100030ef3
mov r9, qword [rbx]
lea edx, [rax + 1]
lea rcx, [rsp + 0x50]
mov r8, rdx
call qword [sym.imp.msvcrt.dll_fread]
cmp rax, 1
jne 0x100030ee1
mov al, byte [rsp + 0x50]
cmp al, 0x2c
je 0x100030ef3
cmp al, 0xa
je 0x100030ef3
mov rdx, qword [rbx + 0x10]
add r12, 1
cmp r12, rdx
jbe 0x100030ea6
mov rcx, qword [rbx + 8]
test rcx, rcx
jne 0x100030e7f
mov ecx, 0x106
mov qword [rbx + 0x10], 0x104
call qword [sym.imp.msvcrt.dll_malloc]
jmp 0x100030e94
add rdx, 0x104
mov qword [rbx + 0x10], rdx
add rdx, 2
call qword [sym.imp.msvcrt.dll_realloc]
test rax, rax
je 0x100030ec6
mov qword [rbx + 8], rax
lea rsi, [rax + r12 - 1]
mov al, byte [rsp + 0x50]
mov byte [rsi], al
cmp byte [rsp + 0x50], 0x20
je 0x100030eba
test rbp, rbp
mov rdi, rsi
jne 0x100030eba
mov rbp, rsi
mov rcx, qword [rbx]
add rsi, 1
jmp 0x100030e14
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x100030edd
call qword [sym.imp.msvcrt.dll_free]
mov qword [rbx + 8], 0
xor eax, eax
jmp 0x100030f04
mov rcx, qword [rbx]
call qword [sym.imp.msvcrt.dll_fclose]
mov qword [rbx], 0
jmp 0x100030edd
cmp qword [rbx], 0
je 0x100030edd
mov byte [rdi + 1], 0
mov rax, rbp
mov byte [rdi + 2], 0
add rsp, 0x20
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x10003149c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
sub rsp, 0x20
movzx ebx, cx
mov rcx, qword [0x100083508]
test rcx, rcx
je 0x1000314da
movzx edx, bx
mov r8d, 5
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x1000314da
mov rcx, qword [0x100083508]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x10003150f
mov rcx, qword [0x100083510]
test rcx, rcx
je 0x10003151a
movzx edx, bx
mov r8d, 5
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x10003151a
mov rcx, qword [0x100083510]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x10003151a
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
jmp 0x10003151c
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x100031748
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x28
test rcx, rcx
mov rdi, rdx
mov rbx, rcx
je 0x10003185a
test rdx, rdx
je 0x10003185a
xor r9d, r9d
lea rdx, [0x10000a8a8]
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
test rax, rax
mov r12, rax
je 0x10003185a
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
mov rbp, rax
je 0x10003185a
xor r9d, r9d
lea rdx, [0x10000a8a8]
mov rcx, rdi
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
test rax, rax
mov r13, rax
je 0x10003185a
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
mov rsi, rax
je 0x10003185a
mov rdx, r12
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rdx, r13
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, 0x84
cmp ebx, ecx
jb 0x10003185a
cmp eax, ecx
jb 0x10003185a
mov eax, 0xfecdfecd
cmp dword [rbp], eax
jne 0x10003185a
cmp dword [rsi], eax
jne 0x10003185a
mov rdx, qword [rbp + 0x1c]
cmp rdx, qword [rsi + 0x1c]
jne 0x100031829
mov rdx, qword [rbp + 0x24]
cmp rdx, qword [rsi + 0x24]
jne 0x100031829
xor eax, eax
jmp 0x10003182e
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x100031853
mov rdx, qword [rbp + 0x2c]
cmp rdx, qword [rsi + 0x2c]
jne 0x10003184a
mov rdx, qword [rbp + 0x34]
cmp rdx, qword [rsi + 0x34]
jne 0x10003184a
xor eax, eax
jmp 0x10003184f
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x10003185a
mov eax, 1
jmp 0x10003185c
xor eax, eax
add rsp, 0x28
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x100032190
Capabilities:
Check os version

Disassembly:
sub rsp, 0x158
mov rax, qword [0x100082138]
xor rax, rsp
mov qword [rsp + 0x140], rax
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x11c
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x1000321e5
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov edx, dword [rsp + 0x30]
mov ecx, dword [rsp + 0x24]
xor eax, eax
lea r8d, [rax + 1]
sub edx, r8d
je 0x100032251
cmp edx, r8d
jne 0x10003226b
cmp ecx, 5
jne 0x100032247
mov ecx, dword [rsp + 0x28]
test ecx, ecx
je 0x100032240
sub ecx, r8d
je 0x100032230
cmp ecx, r8d
je 0x10003221a
lea eax, [r8 + 0x13]
jmp 0x10003226b
cmp word [rsp + 0x134], r8w
mov ecx, 0x10
cmovae eax, ecx
or eax, 4
jmp 0x10003226b
cmp word [rsp + 0x134], 2
mov ecx, 8
jmp 0x100032228
mov eax, 4
jmp 0x10003226b
cmp ecx, 4
ja 0x100032283
mov eax, 2
cmp ecx, 4
jne 0x10003226b
mov ecx, dword [rsp + 0x28]
test ecx, ecx
je 0x100032268
cmp ecx, 0xa
je 0x100032268
cmp ecx, 0x5a
jne 0x10003226b
mov eax, r8d
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.10006b1f0
add rsp, 0x158
ret
cmp ecx, 6
jne 0x10003229d
cmp dword [rsp + 0x28], eax
jne 0x10003229d
cmp dword [rsp + 0x2c], 0x1554
jae 0x10003229d
lea eax, [rcx + 0x3a]
jmp 0x10003226b
mov eax, 0x20
jmp 0x10003226b

Function at 0x1000323a0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x100082138]
xor rax, rsp
mov qword [rsp + 0x48], rax
cmp word [0x100083a08], 0
jne 0x100032476
lea rax, [rsp + 0x38]
lea rdx, [0x1000098b0]
mov r9d, 1
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x30], 6
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100032476
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea rdx, [0x100009968]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x100032476
lea rsi, [0x1000096f0]
mov rdi, rsi
mov rdx, qword [rdi]
lea rcx, [rsp + 0x40]
mov r8d, 3
call sub.msvcrt.dll__wcsnicmp
test eax, eax
je 0x100032464
add ebx, 1
add rdi, 0x10
cmp ebx, 0x1c
jb 0x10003243f
jmp 0x100032476
movsxd rax, ebx
add rax, rax
movzx eax, word [rsi + rax*8 + 8]
mov word [0x100083a08], ax
mov ax, word [0x100083a08]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.10006b1f0
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x100032ac0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x100032ad6
xor al, al
jmp 0x100032add
shr eax, 4
not al
and al, 1
add rsp, 0x28
ret
Function at 0x10003356c
Capabilities:
Delete file
Get common file path
Move file
Set file attributes

Disassembly:
push rbx
push rdi
sub rsp, 0x248
mov rax, qword [0x100082138]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rdi, rcx
mov rcx, qword [rcx]
mov ebx, 1
lea edx, [rbx + 0x7f]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1000335f2
mov rcx, qword [rdi]
lea r9, [rsp + 0x20]
lea rdx, [0x10000ba00]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x1000335df
mov rcx, qword [rdi]
lea rdx, [rsp + 0x20]
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
lea rcx, [rsp + 0x20]
test eax, eax
jne 0x1000335e2
mov rcx, qword [rdi]
mov r8d, 4
xor edx, edx
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
xor bl, bl
mov al, bl
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.10006b1f0
add rsp, 0x248
pop rdi
pop rbx
ret

Function at 0x100033614
Capabilities:
Get token membership

Disassembly:
sub rsp, 0x88
mov rax, qword [0x100082138]
xor rax, rsp
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0x68]
lea rcx, [rsp + 0x70]
mov r9d, 0x220
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], 0
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov r8d, 0x20
mov dl, 2
mov dword [rsp + 0x28], 0
mov byte [rsp + 0x70], 0
mov dword [rsp + 0x20], 0
mov byte [rsp + 0x71], 0
mov byte [rsp + 0x72], 0
mov byte [rsp + 0x73], 0
mov byte [rsp + 0x74], 0
mov byte [rsp + 0x75], 5
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
mov dword [rsp + 0x60], eax
je 0x1000336d0
mov rdx, qword [rsp + 0x68]
lea r8, [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
neg eax
sbb ecx, ecx
and ecx, dword [rsp + 0x60]
mov dword [rsp + 0x60], ecx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [rsp + 0x60]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.10006b1f0
add rsp, 0x88
ret
Function at 0x100033a80
Capabilities:
Check os version

Disassembly:
push rbx
sub rsp, 0x150
mov rax, qword [0x100082138]
xor rax, rsp
mov qword [rsp + 0x140], rax
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x114
mov ebx, 6
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x100033b3a
cmp dword [rsp + 0x30], 2
jne 0x100033b18
mov eax, dword [rsp + 0x24]
cmp eax, 4
ja 0x100033ae0
mov ebx, 1
jmp 0x100033b3a
cmp eax, 5
jne 0x100033b06
mov eax, dword [rsp + 0x28]
test eax, eax
jne 0x100033af2
lea ebx, [rax + 2]
jmp 0x100033b3a
cmp eax, 1
jne 0x100033afc
lea ebx, [rax + 2]
jmp 0x100033b3a
cmp eax, 2
jne 0x100033b3a
lea ebx, [rax + 2]
jmp 0x100033b3a
cmp eax, ebx
jne 0x100033b3a
cmp dword [rsp + 0x28], 0
jne 0x100033b3a
mov ebx, 5
jmp 0x100033b3a
cmp dword [rsp + 0x30], 1
jne 0x100033b3a
cmp dword [rsp + 0x24], 4
jne 0x100033b3a
mov eax, dword [rsp + 0x28]
test eax, eax
je 0x100033b38
cmp eax, 0xa
je 0x100033b38
cmp eax, 0x5a
jne 0x100033b3a
xor ebx, ebx
mov eax, ebx
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.10006b1f0
add rsp, 0x150
pop rbx
ret