joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100004e24
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x180]
sub rsp, 0x280
mov rax, qword [0x10000f100]
xor rax, rsp
mov qword [rbp + 0x170], rax
xor eax, eax
mov rbx, rcx
xor r9d, r9d
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x58]
xor r8d, r8d
mov esi, 1
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rdx
and qword [rsp + 0x38], 0
and qword [rsp + 0x30], 0
mov rdx, rcx
xor ecx, ecx
mov dword [rsp + 0x28], 0x20
and dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x100004f7f
mov rcx, qword [rsp + 0x58]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x58]
lea rdx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [0x100011408], 0
mov edi, dword [rsp + 0x50]
jne 0x100004ef6
mov ecx, dword [0x100010ebc]
test sil, cl
je 0x100004ef6
test cl, 2
jne 0x100004ef6
mov eax, edi
and eax, 0xff000000
cmp eax, 0xaa000000
cmove ecx, edi
mov dword [0x100010ebc], ecx
test dword [0x100010ec4], 0x800
je 0x100004f0a
mov dword [0x100010488], edi
jmp 0x100004f54
cmp dword [0x10001048c], 0
jne 0x100004f4a
movzx ecx, word [0x100010490]
mov ebx, dword [0x1000105a4]
call fcn.100002b98
cmp ebx, eax
jne 0x100004f4a
mov eax, edi
and eax, 0xff000000
cmp eax, 0xaa000000
jne 0x100004f3c
test sil, dil
jne 0x100004f4a
test dword [0x100010ec4], 0x200
je 0x100004f54
jmp 0x100004f02
mov dword [0x100010488], 0xbc2
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test dword [0x100010ec4], 0x400
je 0x100004fde
cmp dword [rsp + 0x50], 0
jge 0x100004fde
jmp 0x100004fdc
call fcn.100007924
mov dword [0x100010488], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
and qword [rsp + 0x30], 0
mov r8d, eax
lea rax, [rsp + 0x70]
xor r9d, r9d
xor edx, edx
mov ecx, 0x1000
mov dword [rsp + 0x28], 0x200
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
and dword [rsp + 0x28], 0
lea r9, [rsp + 0x70]
mov r8, rbx
mov edx, 0x4c4
xor ecx, ecx
mov dword [rsp + 0x20], InitCommonControls
call fcn.100005420
xor esi, esi
mov eax, esi
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.10000c380
mov rbx, qword [rsp + 0x2b0]
add rsp, 0x280
pop rdi
pop rsi
pop rbp
ret
Function at 0x100005100
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
mov r12, rcx
lea rcx, [0x10000f460]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor ebx, ebx
mov rdi, rax
test rax, rax
je 0x1000052a3
lea rdx, [0x10000f490]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
je 0x100005293
mov edx, 0xc3
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r15, rax
test rax, rax
je 0x100005293
lea rdx, [0x10000f4a8]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r13, rax
test rax, rax
je 0x100005293
cmp byte [0x1000104a0], bl
lea rsi, [0x1000104a0]
mov ebp, 0x104
jne 0x1000051eb
mov rdx, rsi
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov rcx, rsi
movsxd rdx, eax
add rdx, rsi
call qword [sym.imp.USER32.dll_CharPrevA]
mov qword [rsp + 0xa8], rax
cmp byte [rax], 0x5c
jne 0x1000051eb
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.USER32.dll_CharPrevA]
cmp byte [rax], 0x3a
je 0x1000051eb
mov rax, qword [rsp + 0xa8]
mov byte [rax], bl
lea rax, [0x10000ffe0]
lea rcx, [rsp + 0x30]
mov byte [0x10000fcd0], bl
mov qword [rsp + 0x48], rax
lea rax, [0x1000050d8]
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rbx
mov dword [rsp + 0x50], 1
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rsi
call r14
mov r12, rax
test rax, rax
je 0x10000527d
mov rdx, rsi
mov rcx, rax
call r13
cmp byte [0x1000104a0], bl
je 0x100005277
lea rcx, [0x10000fcd0]
sub rsi, rcx
lea rax, [rbp + 0x7ffffefa]
test rax, rax
je 0x10000526d
mov al, byte [rsi + rcx]
test al, al
je 0x10000526d
mov byte [rcx], al
inc rcx
dec rbp
jne 0x100005250
test rbp, rbp
jne 0x100005275
dec rcx
mov byte [rcx], bl
mov rcx, r12
call r15
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp byte [0x10000fcd0], bl
setne bl
mov eax, ebx
jmp 0x1000052c4
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edx, 0x4c1
jmp 0x1000052a8
mov edx, 0x4c2
xor r9d, r9d
xor r8d, r8d
mov rcx, r12
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], InitCommonControls
call fcn.100005420
xor eax, eax
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x100005680
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rdi, rdx
mov ebp, r8d
mov rsi, rcx
mov rdx, rcx
mov r8d, 0xa
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
cmp eax, ebp
ja 0x100005713
test rdi, rdi
je 0x100005713
test eax, eax
jne 0x1000056cc
xor eax, eax
jmp 0x100005715
mov r8d, 0xa
mov rdx, rsi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rsi, rax
test rax, rax
je 0x1000056c8
mov r9, rbx
mov rdx, rbp
mov r8, rax
mov rcx, rdi
call fcn.10000c530
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1000058fc
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x40
lea rdi, [0x100010f00]
mov ebx, edx
mov rsi, rcx
mov rax, rdi
xor r12d, r12d
cmp dword [rax], 1
je 0x10000593e
lea rcx, [0x100011400]
add rax, 0x20
inc r12d
cmp rax, rcx
jl 0x100005926
cmp r12d, 0x28
jne 0x100005971
and dword [rsp + 0x28], 0
mov rcx, qword [0x100010448]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x4bb
mov dword [rsp + 0x20], InitCommonControls
call fcn.100005420
or rax, 0xffffffffffffffff
jmp 0x100005b1f
lea rdx, [0x10000f428]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x1000059cf
bt ebx, 8
jb 0x100005968
test bl, 8
jne 0x100005968
test bl, 1
jne 0x100005968
test bl, 2
jne 0x100005968
movsxd rdx, r12d
mov rcx, rdx
shl rcx, 5
and dword [rcx + rdi], eax
mov rax, qword [0x1000105c0]
and dword [rcx + rdi + 0x10], 0
mov qword [rcx + rdi + 8], rax
mov eax, dword [0x1000105c8]
mov dword [rcx + rdi + 4], 1
mov dword [rcx + rdi + 0x14], eax
jmp 0x100005b1c
test bl, 8
je 0x1000059dd
or rcx, 0xffffffffffffffff
jmp 0x100005af8
test bl, 2
jne 0x1000059ed
mov r13d, 0x80000000
test bl, 1
je 0x1000059f3
mov r13d, 0x40000000
bt ebx, 8
jae 0x100005a18
bt ebx, 0xa
jae 0x100005a06
mov ebx, 1
jmp 0x100005a28
and ebx, 0x200
neg ebx
sbb ebx, ebx
and ebx, 0xfffffffe
add ebx, 4
jmp 0x100005a28
and ebx, 0x200
neg ebx
sbb ebx, ebx
and ebx, 2
add ebx, 3
and qword [rsp + 0x30], 0
xor r9d, r9d
xor r8d, r8d
mov edx, r13d
mov rcx, rsi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rcx, rax
cmp rax, 0xffffffffffffffff
jne 0x100005af8
cmp ebx, 3
je 0x100005af8
mov al, byte [rsi]
test al, al
je 0x100005ad1
lea rdi, [rsi + 1]
xor ebp, ebp
cmp byte [rdi], 0x3a
jne 0x100005a7f
cmp byte [rsi + 2], 0x5c
jne 0x100005a7f
lea rdi, [rsi + 3]
jmp 0x100005a90
cmp al, 0x5c
jne 0x100005a90
cmp byte [rdi], al
jne 0x100005a90
lea rdi, [rsi + 2]
mov ebp, 2
cmp byte [rdi], 0
je 0x100005aca
cmp byte [rdi], 0x5c
jne 0x100005ab9
cmp byte [rdi - 1], 0x3a
je 0x100005ab9
test ebp, ebp
je 0x100005aa8
dec ebp
jmp 0x100005ab9
xor edx, edx
mov rcx, rsi
mov byte [rdi], 0
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov byte [rdi], 0x5c
mov rcx, rdi
call qword [sym.imp.USER32.dll_CharNextA]
mov rdi, rax
cmp byte [rax], 0
jne 0x100005a95
lea rdi, [0x100010f00]
and qword [rsp + 0x30], 0
xor r9d, r9d
xor r8d, r8d
mov edx, r13d
mov rcx, rsi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rcx, rax
movsxd rdx, r12d
mov rax, rdx
shl rax, 5
mov qword [rax + rdi + 0x18], rcx
cmp rcx, 0xffffffffffffffff
je 0x100005b18
and dword [rax + rdi], 0
and dword [rax + rdi + 4], 0
jmp 0x100005b1c
or rdx, 0xffffffffffffffff
mov rax, rdx
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r13
pop r12
pop rdi
ret
Function at 0x100006254
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
lea rcx, [0x100001848]
xor r8d, r8d
xor edx, edx
call fcn.100005680
lea rdx, [0x100001848]
mov r8d, 0xa
xor ecx, ecx
mov dword [0x1000105c8], eax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [0x1000105c0], rax
test rax, rax
je 0x1000063d2
mov rcx, qword [0x100010448]
test rcx, rcx
je 0x1000062f0
mov edx, 0x842
call qword [sym.imp.USER32.dll_GetDlgItem]
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x100010448]
mov edx, 0x841
call qword [sym.imp.USER32.dll_GetDlgItem]
mov edx, 5
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
call fcn.100006184
test eax, eax
jne 0x100006300
mov edx, 0x4ba
jmp 0x100006341
lea rcx, [0x1000105cc]
call fcn.10000820c
mov rdi, rax
test rax, rax
je 0x100006335
lea rcx, [0x1000105c0]
mov rdx, rax
call fcn.100008458
mov ebx, eax
test eax, eax
je 0x100006362
mov rcx, rdi
call fcn.1000082f8
test eax, eax
jne 0x100006362
mov edx, dword [0x1000105cc]
add edx, 0x514
mov rcx, qword [0x100010448]
and dword [rsp + 0x28], 0
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], InitCommonControls
call fcn.100005420
xor ebx, ebx
mov rcx, qword [0x1000105c0]
test rcx, rcx
je 0x10000637c
call qword [sym.imp.KERNEL32.dll_FreeResource]
and qword [0x1000105c0], 0
test ebx, ebx
jne 0x1000063a6
cmp dword [0x10001065c], ebx
jne 0x1000063a6
and dword [rsp + 0x28], ebx
xor r9d, r9d
xor r8d, r8d
mov edx, 0x4f8
xor ecx, ecx
mov dword [rsp + 0x20], InitCommonControls
call fcn.100005420
test byte [0x100011418], 1
jne 0x1000063d0
test byte [0x100010ec4], 1
jne 0x1000063d0
mov rcx, qword [0x100010448]
movsxd r8, ebx
xor r9d, r9d
mov edx, 0xfa1
call qword [sym.imp.USER32.dll_SendMessageA]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x1000065cc
Capabilities:
Check if file exists
Create directory
Delete directory
Delete file
Get common file path
Get file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
sub rsp, 0x140
mov rax, qword [0x10000f100]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov rbp, rcx
xor esi, esi
xor ebx, ebx
mov rdi, rdx
mov r12, rcx
sub rbp, rdx
lea r8, [0x100001878]
lea rcx, [rsp + 0x20]
mov r9d, esi
mov edx, 0x104
call fcn.100001b10
inc esi
mov edx, 0x104
mov rcx, rdi
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x100006643
mov al, byte [rcx + rbp]
test al, al
je 0x100006643
mov byte [rcx], al
inc rcx
dec rdx
jne 0x100006626
test rdx, rdx
jne 0x10000664b
dec rcx
mov byte [rcx], bl
lea r8, [rsp + 0x20]
mov edx, 0x104
mov rcx, rdi
call fcn.100007ddc
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1000066db
cmp esi, 0x190
jl 0x100006603
lea rdx, [0x100001884]
mov r9, rdi
xor r8d, r8d
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
je 0x1000066b1
mov rcx, rdi
mov ebx, 1
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov eax, ebx
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.10000c380
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x10000667e
mov dword [0x100011400], 1
mov ebx, 1
jmp 0x1000066b1
Function at 0x100006704
Capabilities:
Create directory
Delete directory
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x170
mov rax, qword [0x10000f100]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov esi, r8d
mov r9, rcx
test edx, edx
je 0x1000067f7
lea rdx, [rsp + 0x50]
call fcn.1000065cc
test eax, eax
je 0x100006883
lea rbx, [0x100010670]
lea r8, [rsp + 0x50]
mov edi, 0x104
mov rcx, rbx
sub r8, rbx
mov edx, edi
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x10000677f
mov al, byte [r8 + rcx]
test al, al
je 0x10000677f
mov byte [rcx], al
inc rcx
dec rdx
jne 0x100006761
test rdx, rdx
jne 0x100006787
dec rcx
mov byte [rcx], 0
test byte [0x100010ec4], 0x20
je 0x1000067e4
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx r11d, word [rsp + 0x20]
test r11d, r11d
je 0x1000067d3
dec r11d
je 0x1000067ca
dec r11d
je 0x1000067c1
dec r11d
jne 0x1000067e4
lea r8, [0x1000018a0]
jmp 0x1000067da
lea r8, [0x100001898]
jmp 0x1000067da
lea r8, [0x100001890]
jmp 0x1000067da
lea r8, [0x100001888]
mov edx, edi
mov rcx, rbx
call fcn.100007ddc
lea r8, [0x100001609]
mov edx, edi
mov rcx, rbx
call fcn.100007ddc
jmp 0x100006832
lea rbx, [0x100010670]
mov edi, 0x104
mov rcx, rbx
sub r9, rbx
lea rax, [rdi + 0x7ffffefa]
test rax, rax
je 0x100006827
mov al, byte [r9 + rcx]
test al, al
je 0x100006827
mov byte [rcx], al
inc rcx
dec rdi
jne 0x100006809
test rdi, rdi
jne 0x10000682f
dec rcx
mov byte [rcx], 0
mov rcx, rbx
call fcn.100006da4
test eax, eax
jne 0x100006857
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x100006887
mov dword [0x100011400], 1
test esi, esi
je 0x100006894
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call fcn.100006eec
test eax, eax
jne 0x100006894
cmp dword [0x100011400], eax
je 0x100006883
and dword [0x100011400], eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
xor eax, eax
jmp 0x1000068a0
call fcn.100007924
mov dword [0x100010488], eax
jmp 0x100006883
and dword [0x100010488], 0
mov eax, 1
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.10000c380
lea r11, [rsp + 0x170]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x100006da4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, 0x40
lea ebp, [rax + 0x14]
mov edx, ebp
mov ebx, ebp
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, rax
test rax, rax
jne 0x100006e1b
and dword [rsp + 0x28], eax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x4b5
xor ecx, ecx
mov dword [rsp + 0x20], InitCommonControls
call fcn.100005420
call fcn.100007924
mov dword [0x100010488], eax
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
test ebp, ebp
je 0x100006e60
cmp rbx, 0x7fffffff
ja 0x100006e60
mov r8d, 0x7ffffffe
mov r9, rsi
mov rcx, rax
sub r8, rbx
sub r9, rax
lea rax, [r8 + rbx]
test rax, rax
je 0x100006e55
mov al, byte [r9 + rcx]
test al, al
je 0x100006e55
mov byte [rcx], al
inc rcx
dec rbx
jne 0x100006e3a
test rbx, rbx
jne 0x100006e5d
dec rcx
mov byte [rcx], 0
lea r8, [0x1000018b8]
mov edx, ebp
mov rcx, rdi
call fcn.100007ddc
and qword [rsp + 0x30], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, rdi
mov dword [rsp + 0x28], 0x4000080
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_LocalFree]
cmp rbx, 0xffffffffffffffff
je 0x100006df9
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x100006df9
test al, 0x10
je 0x100006df9
and dword [0x100010488], 0
mov eax, 1
jmp 0x100006e06
Function at 0x10000794c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov rax, qword [0x10000f100]
xor rax, rsp
mov qword [rsp + 0x38], rax
xor r13d, r13d
mov r14, rcx
mov ebp, 1
xor r9d, r9d
jmp 0x1000079d3
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r12, rax
test rax, rax
je 0x100007a0d
mov esi, dword [rax]
mov edi, dword [rax + 4]
lea rcx, [rax + 8]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
lea r8, [r12 + 8]
mov edx, edi
movsxd r9, eax
mov ecx, esi
lea r9, [r9 + r12 + 9]
call r14
mov rcx, r12
test eax, eax
je 0x100007a03
call qword [sym.imp.KERNEL32.dll_FreeResource]
add r13d, ebp
mov r9d, r13d
lea r8, [0x1000019f0]
lea rcx, [rsp + 0x20]
mov edx, 0x14
call fcn.100001b10
lea rdx, [rsp + 0x20]
mov r8d, 0xa
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
test rax, rax
jne 0x100007981
jmp 0x100007a19
xor ebp, ebp
call qword [sym.imp.KERNEL32.dll_FreeResource]
jmp 0x100007a19
mov dword [0x100010488], 0x80070714
xor ebp, ebp
mov eax, ebp
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.10000c380
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret

Function at 0x100007bbc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub rsp, 0x148
mov rax, qword [0x10000f100]
xor rax, rsp
mov qword [rsp + 0x130], rax
lea r9, [0x100010670]
lea rax, [rsp + 0x20]
mov edx, 0x104
sub r9, rax
mov r8d, edx
lea rcx, [rsp + 0x20]
lea rax, [r8 + 0x7ffffefa]
test rax, rax
je 0x100007c0f
mov al, byte [r9 + rcx]
test al, al
je 0x100007c0f
mov byte [rcx], al
inc rcx
dec r8
jne 0x100007bf1
test r8, r8
jne 0x100007c17
dec rcx
mov byte [rcx], 0
lea r8, [0x1000016b0]
lea rcx, [rsp + 0x20]
call fcn.100007ddc
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x100007c52
test al, 0x10
jne 0x100007c52
xor edx, edx
lea rcx, [rsp + 0x20]
lea r8d, [rdx + 8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
jmp 0x100007c5f
lea rcx, [0x1000016b0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.10000c380
add rsp, 0x148
ret
Function at 0x100007c80
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x30
mov rbx, qword [0x100010ee0]
mov r12, rdx
mov rbp, r8
mov rdx, rcx
mov r8d, 5
mov rcx, rbx
mov rsi, r9
call qword [sym.imp.KERNEL32.dll_FindResourceA]
test rax, rax
je 0x100007d09
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rdi, rax
test rax, rax
je 0x100007d09
mov r9, rbp
mov r8, r12
mov rdx, rax
mov rcx, rbx
test rsi, rsi
jne 0x100007cec
and qword [rsp + 0x20], rsi
jmp 0x100007cf1
mov qword [rsp + 0x20], rsi
call qword [sym.imp.USER32.dll_DialogBoxIndirectParamA]
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_FreeResource]
cmp rbx, 0xffffffffffffffff
jne 0x100007d2d
and dword [rsp + 0x28], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 0x4fb
xor ecx, ecx
mov dword [rsp + 0x20], InitCommonControls
call fcn.100005420
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop r12
ret
Function at 0x10000806c
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
lea rbp, [rax - 0x18]
sub rsp, 0x110
mov rax, qword [0x10000f100]
xor rax, rsp
mov qword [rbp], rax
mov esi, dword [0x10000f414]
mov dword [rsp + 0x30], InitCommonControls
cmp esi, 0xfffffffe
jne 0x1000081dd
lea rcx, [rsp + 0x50]
xor edi, edi
mov dword [rsp + 0x50], 0x94
mov dword [0x10000f414], edi
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x1000081d7
lea esi, [rdi + 1]
cmp dword [rsp + 0x60], esi
jne 0x1000081d7
cmp dword [rsp + 0x54], 4
jne 0x1000081d7
cmp dword [rsp + 0x58], 0xa
jae 0x1000081d7
lea ecx, [rdi + 0x4a]
call qword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x1000081d7
lea rax, [rsp + 0x38]
lea rdx, [0x100001a00]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1000081d7
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x10]
lea rdx, [0x100001609]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x38]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x100008178
mov eax, dword [0x10000f414]
jmp 0x1000081df
lea rcx, [rbp - 0x10]
mov al, byte [rcx]
cmp al, 0x30
jl 0x100008193
cmp al, 0x39
jg 0x100008193
add edi, 0xfffffffd
movsx eax, al
shl edi, 4
add edi, eax
jmp 0x1000081ac
cmp al, 0x61
jl 0x100008199
add al, 0xe0
movsx edx, al
sub edx, 0x37
lea eax, [rdx - 0xa]
cmp eax, 5
ja 0x1000081b7
shl edi, 4
add edi, edx
call qword [sym.imp.USER32.dll_CharNextA]
mov rcx, rax
jmp 0x10000817c
lea rax, [rbp - 0x10]
cmp rcx, rax
je 0x1000081d7
and edi, 0x3ff
cmp edi, esi
je 0x1000081cf
cmp edi, 0xd
jne 0x1000081d7
mov dword [0x10000f414], esi
jmp 0x1000081dd
mov esi, dword [0x10000f414]
mov eax, esi
mov rcx, qword [rbp]
xor rcx, rsp
call fcn.10000c380
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret