joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140019490
Capabilities:
Check if file exists
Delete directory
Delete file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x2a0
mov rax, qword [0x1402a76c0]
xor rax, rsp
mov qword [rsp + 0x290], rax
mov rbp, r8
mov edi, edx
lea rdx, str.UninstUnInstaller::DeleteShortCut
lea rcx, [rsp + 0x30]
call fcn.14001abe0
nop
lea r14, [0x1402a8360]
lea rbx, [0x1402bbdb0]
mov rcx, qword [0x1402a8360]
cmp rcx, r14
je 0x140019516
test byte [rcx + 0x1c], 1
je 0x140019516
mov r9, rbx
cmp qword [0x1402bbdc8], 8
cmovae r9, qword [0x1402bbdb0]
mov edx, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
lea r8, [0x1402526c0]
mov rcx, qword [rcx + 0x10]
call fcn.140001ad0
mov esi, 1
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x80]
call fcn.1401e7e40
mov edx, edi
call fcn.140019da0
mov rdi, rax
lea r9, str.Canon_Printer_Uninstaller
mov r8, rax
lea rdx, [0x140252608]
mov rcx, rax
call qword [sym.imp.USER32.dll_wsprintfW]
mov r9, rbp
mov r8, rdi
lea rdx, [0x140252608]
lea rcx, [rsp + 0x80]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rsp + 0x80]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1400195a0
lea rcx, [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x14001959e
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x1400195a0
xor esi, esi
mov rcx, rdi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov cl, 1
mov byte [rsp + 0x38], cl
mov rax, qword [0x1402a8360]
cmp rax, r14
je 0x1400195f4
test byte [rax + 0x1c], cl
je 0x1400195f4
mov r9, rbx
cmp qword [0x1402bbdc8], 8
cmovae r9, qword [0x1402bbdb0]
mov edx, recv
lea r8, [0x1402526c0]
mov rcx, qword [rax + 0x10]
call fcn.140001ad0
movzx ecx, byte [rsp + 0x38]
mov rax, qword [0x1402a8360]
lea rdx, vtable.WppTrace.0
mov qword [rsp + 0x30], rdx
test cl, cl
jne 0x14001964d
cmp rax, r14
je 0x14001964d
test byte [rax + 0x1c], 1
je 0x14001964d
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rcx, qword [rsp + 0x40]
cmp qword [0x1402bbdc8], 8
cmovae rbx, qword [0x1402bbdb0]
mov edx, 0xa
mov qword [rsp + 0x20], rcx
mov r9, rbx
lea r8, [0x140252818]
mov rcx, qword [rax + 0x10]
call fcn.140006c90
lea rcx, [rsp + 0x60]
call fcn.1400048a0
lea rcx, [rsp + 0x40]
call fcn.1400048a0
mov eax, esi
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.1401e2900
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x140019a00
Capabilities:
Check if file exists
Delete file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x2a0
mov rax, qword [0x1402a76c0]
xor rax, rsp
mov qword [rsp + 0x290], rax
mov rsi, rdx
lea rcx, [rsp + 0x30]
lea rdx, str.UninstUnInstaller::DeleteUninstallExe
call fcn.14001abe0
mov rcx, qword [0x1402a8360]
lea rbp, [0x1402a8360]
lea rdi, [0x1402bbdb0]
cmp rcx, rbp
je 0x140019a85
test byte [rcx + 0x1c], 1
je 0x140019a85
cmp qword [0x1402bbdc8], 8
lea r8, [0x1402526c0]
mov rcx, qword [rcx + 0x10]
mov r9, rdi
cmovae r9, qword [0x1402bbdb0]
mov edx, reloc.WSOCK32.dll_recv
call fcn.140001ad0
xor edx, edx
lea rcx, [rsp + 0x80]
mov r8d, 0x208
mov ebx, 1
call fcn.1401e7e40
lea r9, str.UNINSTAL.exe
mov r8, rsi
lea rdx, [0x140252608]
lea rcx, [rsp + 0x80]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rsp + 0x80]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x140019ae0
lea rcx, [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ebx, eax
mov dl, 1
mov byte [rsp + 0x38], dl
mov rcx, qword [0x1402a8360]
cmp rcx, rbp
je 0x140019b2f
test byte [rcx + 0x1c], dl
je 0x140019b2f
cmp qword [0x1402bbdc8], 8
lea r8, [0x1402526c0]
mov rcx, qword [rcx + 0x10]
mov r9, rdi
cmovae r9, qword [0x1402bbdb0]
mov edx, reloc.COMCTL32.dll_InitCommonControls
mov dword [rsp + 0x20], ebx
call fcn.140001b40
movzx edx, byte [rsp + 0x38]
mov rcx, qword [0x1402a8360]
lea rax, vtable.WppTrace.0
mov qword [rsp + 0x30], rax
test dl, dl
jne 0x140019b88
cmp rcx, rbp
je 0x140019b88
test byte [rcx + 0x1c], 1
je 0x140019b88
cmp qword [rsp + 0x58], 8
lea rax, [rsp + 0x40]
mov rcx, qword [rcx + 0x10]
lea r8, [0x140252818]
cmovae rax, qword [rsp + 0x40]
mov edx, 0xa
cmp qword [0x1402bbdc8], 8
mov qword [rsp + 0x20], rax
cmovae rdi, qword [0x1402bbdb0]
mov r9, rdi
call fcn.140006c90
lea rcx, [rsp + 0x60]
call fcn.1400048a0
lea rcx, [rsp + 0x40]
call fcn.1400048a0
mov eax, ebx
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.1401e2900
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140019bd0
Capabilities:
Check if file exists
Delete file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x2a0
mov rax, qword [0x1402a76c0]
xor rax, rsp
mov qword [rsp + 0x290], rax
mov rsi, rdx
lea rcx, [rsp + 0x30]
lea rdx, str.UninstUnInstaller::DeleteIni
call fcn.14001abe0
mov rcx, qword [0x1402a8360]
lea rbp, [0x1402a8360]
lea rdi, [0x1402bbdb0]
cmp rcx, rbp
je 0x140019c55
test byte [rcx + 0x1c], 1
je 0x140019c55
cmp qword [0x1402bbdc8], 8
lea r8, [0x1402526c0]
mov rcx, qword [rcx + 0x10]
mov r9, rdi
cmovae r9, qword [0x1402bbdb0]
mov edx, send
call fcn.140001ad0
xor edx, edx
lea rcx, [rsp + 0x80]
mov r8d, 0x208
mov ebx, 1
call fcn.1401e7e40
lea r9, str.Uninst.ini
mov r8, rsi
lea rdx, [0x140252608]
lea rcx, [rsp + 0x80]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rsp + 0x80]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x140019cb0
lea rcx, [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ebx, eax
mov dl, 1
mov byte [rsp + 0x38], dl
mov rcx, qword [0x1402a8360]
cmp rcx, rbp
je 0x140019cff
test byte [rcx + 0x1c], dl
je 0x140019cff
cmp qword [0x1402bbdc8], 8
lea r8, [0x1402526c0]
mov rcx, qword [rcx + 0x10]
mov r9, rdi
cmovae r9, qword [0x1402bbdb0]
mov edx, reloc.WSOCK32.dll_send
mov dword [rsp + 0x20], ebx
call fcn.140001b40
movzx edx, byte [rsp + 0x38]
mov rcx, qword [0x1402a8360]
lea rax, vtable.WppTrace.0
mov qword [rsp + 0x30], rax
test dl, dl
jne 0x140019d58
cmp rcx, rbp
je 0x140019d58
test byte [rcx + 0x1c], 1
je 0x140019d58
cmp qword [rsp + 0x58], 8
lea rax, [rsp + 0x40]
mov rcx, qword [rcx + 0x10]
lea r8, [0x140252818]
cmovae rax, qword [rsp + 0x40]
mov edx, 0xa
cmp qword [0x1402bbdc8], 8
mov qword [rsp + 0x20], rax
cmovae rdi, qword [0x1402bbdb0]
mov r9, rdi
call fcn.140006c90
lea rcx, [rsp + 0x60]
call fcn.1400048a0
lea rcx, [rsp + 0x40]
call fcn.1400048a0
mov eax, ebx
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.1401e2900
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14001ce30
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x38
mov r15, rcx
mov rax, qword [rcx]
mov rcx, qword [rax - 0x18]
test rcx, rcx
je 0x14001ce6e
mov rax, qword [rcx]
mov rax, qword [rax + 0x20]
call qword [case.0x1400136d6.0]
mov rcx, rax
test rax, rax
jne 0x14001ce92
call fcn.1401bb0c4
mov rdx, rax
mov rcx, qword [rax]
mov rax, qword [rcx + 0x20]
mov rcx, rdx
call qword [case.0x1400136d6.0]
mov rcx, rax
test rax, rax
je 0x14001d01e
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
call qword [case.0x1400136d6.0]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x20], rbx
mov esi, dword [rsp + 0x78]
mov ecx, esi
call fcn.1401bb5fc
mov rbp, rax
test rax, rax
je 0x14001d013
mov ecx, esi
shr ecx, 4
inc cx
movzx edx, cx
mov r8d, 6
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov r14, rax
test rax, rax
je 0x14001cfb4
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x14001cfb4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
test rax, rax
je 0x14001cfb4
mov rdx, r14
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
add rcx, rdi
and esi, 0xf
jbe 0x14001cf3e
cmp rdi, rcx
jae 0x14001cfb4
movzx eax, word [rdi]
lea rdi, [rdi + rax*2]
add rdi, 2
add esi, 0xffffffff
jne 0x14001cf25
cmp rdi, rcx
jae 0x14001cfb4
cmp word [rdi], 0
je 0x14001cfb4
movzx esi, word [rdi]
lfence
mov rbx, qword [rsp + 0x20]
mov ebp, 1
mov ecx, ebp
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, esi
or eax, ecx
jge 0x14001cf7b
lfence
mov edx, esi
lea rcx, [rsp + 0x20]
call fcn.140004e00
mov rbx, qword [rsp + 0x20]
lea r8, [rdi + 2]
movzx r9d, word [rdi]
mov rdx, rsi
mov rcx, rbx
call fcn.1401ebe84
xor ecx, ecx
test eax, eax
je 0x14001cfa6
cmp eax, 0xc
je 0x14001d02f
cmp eax, 0x50
jne 0x14001d029
cmp esi, dword [rbx - 0xc]
jg 0x14001d008
mov dword [rbx - 0x10], esi
mov word [rbx + rsi*2], cx
jmp 0x14001cfb8
xor ecx, ecx
mov ebp, ecx
test ebp, ebp
je 0x14001d013
lea r8, [rsp + 0x80]
mov qword [rsp + 0x28], r8
mov rdx, rbx
mov rcx, r15
call fcn.140018e50
nop
lea rdx, [rbx - 0x18]
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14001cffb
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400136d6.0]
add rsp, 0x38
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov ecx, 0x80070057
call fcn.140001470
int3
mov ecx, 0x80004005
call fcn.140001470
nop
mov ecx, 0x80004005
call fcn.140001470
nop
call fcn.1401bb848
int3
call fcn.1401bb86c
int3
Function at 0x140022a50
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x1402a76c0]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rbx, rcx
lea rdx, str.CSilentPropertyParametersFromSilentIni::GetVDCDIASInstallFlagWithUsingVDC
lea rcx, [rsp + 0x30]
call fcn.14001abe0
mov rcx, qword [0x1402a8360]
lea rsi, [0x1402a8360]
lea rdi, [0x1402bbdb0]
cmp rcx, rsi
je 0x140022ad0
test byte [rcx + 0x1c], 1
je 0x140022ad0
cmp qword [0x1402bbdc8], 8
lea r8, [0x140253020]
mov rcx, qword [rcx + 0x10]
mov r9, rdi
cmovae r9, qword [0x1402bbdb0]
mov edx, socket
call fcn.140001ad0
mov rcx, qword [rbx + 0x10]
lea rdx, [0x140252f48]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov r9, qword [rbx + 8]
lea rcx, str.SelectMenu
xor r8d, r8d
lea rdx, str.DrvInf
test eax, eax
je 0x140022b01
lea rdx, str.NetSpot
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ebx, eax
mov al, 1
mov byte [rsp + 0x38], al
mov rcx, qword [0x1402a8360]
cmp rcx, rsi
je 0x140022b58
test byte [rcx + 0x1c], al
je 0x140022b58
cmp qword [0x1402bbdc8], 8
lea r8, [0x140253020]
mov rcx, qword [rcx + 0x10]
mov r9, rdi
cmovae r9, qword [0x1402bbdb0]
mov edx, socket
mov dword [rsp + 0x20], ebx
call fcn.140001b40
movzx eax, byte [rsp + 0x38]
mov rcx, qword [0x1402a8360]
lea rdx, vtable.WppTrace.0
mov qword [rsp + 0x30], rdx
test al, al
jne 0x140022bb1
cmp rcx, rsi
je 0x140022bb1
test byte [rcx + 0x1c], 1
je 0x140022bb1
cmp qword [rsp + 0x58], 8
lea rax, [rsp + 0x40]
mov rcx, qword [rcx + 0x10]
lea r8, [0x140252818]
cmovae rax, qword [rsp + 0x40]
mov edx, 0xa
cmp qword [0x1402bbdc8], 8
mov qword [rsp + 0x20], rax
cmovae rdi, qword [0x1402bbdb0]
mov r9, rdi
call fcn.140006c90
lea rcx, [rsp + 0x60]
call fcn.1400048a0
lea rcx, [rsp + 0x40]
call fcn.1400048a0
mov eax, ebx
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1401e2900
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140022bf0
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x1402a76c0]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rdi, rcx
lea rdx, str.CSilentPropertyParametersFromSilentIni::GetSelectJobValue
lea rcx, [rsp + 0x30]
call fcn.14001abe0
mov rcx, qword [0x1402a8360]
lea rsi, [0x1402a8360]
lea rbx, [0x1402bbdb0]
cmp rcx, rsi
je 0x140022c70
test byte [rcx + 0x1c], 1
je 0x140022c70
cmp qword [0x1402bbdc8], 8
lea r8, [0x140253020]
mov rcx, qword [rcx + 0x10]
mov r9, rbx
cmovae r9, qword [0x1402bbdb0]
mov edx, socket
call fcn.140001ad0
mov r9, qword [rdi + 8]
lea rdx, str.SelectJob
mov r8d, 2
lea rcx, str.SelectJob
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dl, 1
mov edi, eax
mov byte [rsp + 0x38], dl
mov rcx, qword [0x1402a8360]
cmp rcx, rsi
je 0x140022cdf
test byte [rcx + 0x1c], dl
je 0x140022cdf
cmp qword [0x1402bbdc8], 8
lea r8, [0x140253020]
mov rcx, qword [rcx + 0x10]
mov r9, rbx
cmovae r9, qword [0x1402bbdb0]
mov edx, reloc.WSOCK32.dll_socket
mov dword [rsp + 0x20], eax
call fcn.140001b40
movzx edx, byte [rsp + 0x38]
mov rcx, qword [0x1402a8360]
lea rax, vtable.WppTrace.0
mov qword [rsp + 0x30], rax
test dl, dl
jne 0x140022d38
cmp rcx, rsi
je 0x140022d38
test byte [rcx + 0x1c], 1
je 0x140022d38
cmp qword [rsp + 0x58], 8
lea rax, [rsp + 0x40]
mov rcx, qword [rcx + 0x10]
lea r8, [0x140252818]
cmovae rax, qword [rsp + 0x40]
mov edx, 0xa
cmp qword [0x1402bbdc8], 8
mov qword [rsp + 0x20], rax
cmovae rbx, qword [0x1402bbdb0]
mov r9, rbx
call fcn.140006c90
lea rcx, [rsp + 0x60]
call fcn.1400048a0
lea rcx, [rsp + 0x40]
call fcn.1400048a0
mov eax, edi
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1401e2900
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x14002edc0
Capabilities:
Inspect load icon resource

Disassembly:
test rdx, rdx
je 0x14002efd0
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x70
mov rbx, rdx
mov r15, rcx
mov rdi, qword [rdx + 0x38]
test rdi, rdi
je 0x14002efb2
cmp qword [rdx + 0x20], 0
je 0x14002efb2
cmp qword [rdx + 0x18], 0
je 0x14002efb2
lea rcx, [rsp + 0x50]
call fcn.1401c9574
nop
mov rdx, qword [rbx + 0x20]
lea rcx, [rsp + 0x50]
call fcn.1401c97ac
mov ecx, 0x18
call fcn.1401baa78
mov r14, rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [r14], xmm0
mov qword [r14 + 0x10], rax
mov rcx, qword [r15]
mov rax, qword [rcx + 0x300]
mov r8, r14
mov rdx, rbx
mov rcx, r15
call qword [case.0x1400136d6.0]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.GDI32.dll_GetTextColor]
mov r12d, eax
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.GDI32.dll_GetBkColor]
mov ebp, eax
test byte [rbx + 0x10], 1
je 0x14002eeb6
mov ecx, recv
call qword [sym.imp.USER32.dll_GetSysColor]
mov edx, eax
lea rcx, [rsp + 0x50]
call fcn.1401c9ff0
mov ecx, recv
call qword [sym.imp.USER32.dll_GetSysColor]
mov edx, eax
lea rcx, [rsp + 0x50]
call fcn.1401c9ee0
mov ecx, recv
call qword [sym.imp.USER32.dll_GetSysColor]
lea rsi, [rbx + 0x28]
mov r8d, eax
mov rdx, rsi
lea rcx, [rsp + 0x50]
call fcn.1401ca334
mov rax, 0xffffffffffffffff
inc rax
cmp word [rdi + rax*2], 0
jne 0x14002eed1
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rsi
mov r9d, 6
mov r8d, dword [r14 + 0x14]
mov edx, dword [r14 + 0x10]
mov rcx, qword [rbx + 0x20]
call qword [sym.imp.GDI32.dll_ExtTextOutW]
mov ecx, dword [rbx + 8]
mov rax, qword [r15 + 0xe8]
mov rcx, qword [rax + rcx*8]
movzx edx, word [rcx + 4]
mov rcx, qword [0x1402bbf88]
call qword [sym.imp.USER32.dll_LoadIconW]
mov r9, rax
mov dword [rsp + 0x40], 3
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov eax, dword [r14 + 4]
mov dword [rsp + 0x28], eax
mov eax, dword [r14]
mov dword [rsp + 0x20], eax
mov r8d, dword [r14 + 0xc]
xor edx, edx
mov rcx, qword [rbx + 0x20]
call qword [sym.imp.USER32.dll_DrawIconEx]
test byte [rbx + 0x10], 0x10
je 0x14002ef77
mov rdx, rsi
mov rcx, qword [rbx + 0x20]
call qword [sym.imp.USER32.dll_DrawFocusRect]
mov edx, r12d
lea rcx, [rsp + 0x50]
call fcn.1401c9ff0
mov edx, ebp
lea rcx, [rsp + 0x50]
call fcn.1401c9ee0
lea rcx, [rsp + 0x50]
call fcn.1401c9914
mov edx, 0x18
mov rcx, r14
call fcn.1400079c0
nop
lea rcx, [rsp + 0x50]
call fcn.1401c961c
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
Function at 0x14003e030
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x38
mov r15, rcx
mov rax, qword [rcx]
mov rcx, qword [rax - 0x18]
test rcx, rcx
je 0x14003e06e
mov rax, qword [rcx]
mov rax, qword [rax + 0x20]
call qword [case.0x1400136d6.0]
mov rcx, rax
test rax, rax
jne 0x14003e092
call fcn.1401bb0c4
mov rdx, rax
mov rcx, qword [rax]
mov rax, qword [rcx + 0x20]
mov rcx, rdx
call qword [case.0x1400136d6.0]
mov rcx, rax
test rax, rax
je 0x14003e22d
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
call qword [case.0x1400136d6.0]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x20], rbx
mov esi, dword [rsp + 0x78]
mov ecx, esi
call fcn.1401bb5fc
mov rbp, rax
test rax, rax
je 0x14003e222
mov ecx, esi
shr ecx, 4
inc cx
movzx edx, cx
mov r8d, 6
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov r14, rax
test rax, rax
je 0x14003e1b4
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x14003e1b4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
test rax, rax
je 0x14003e1b4
mov rdx, r14
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
add rcx, rdi
and esi, 0xf
jbe 0x14003e13e
cmp rdi, rcx
jae 0x14003e1b4
movzx eax, word [rdi]
lea rdi, [rdi + rax*2]
add rdi, 2
add esi, 0xffffffff
jne 0x14003e125
cmp rdi, rcx
jae 0x14003e1b4
cmp word [rdi], 0
je 0x14003e1b4
movzx esi, word [rdi]
lfence
mov rbx, qword [rsp + 0x20]
mov ebp, 1
mov ecx, ebp
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, esi
or eax, ecx
jge 0x14003e17b
lfence
mov edx, esi
lea rcx, [rsp + 0x20]
call fcn.140004e00
mov rbx, qword [rsp + 0x20]
lea r8, [rdi + 2]
movzx r9d, word [rdi]
mov rdx, rsi
mov rcx, rbx
call fcn.1401ebe84
xor edi, edi
test eax, eax
je 0x14003e1a6
cmp eax, 0xc
je 0x14003e23e
cmp eax, 0x50
jne 0x14003e238
cmp esi, dword [rbx - 0xc]
jg 0x14003e217
mov dword [rbx - 0x10], esi
mov word [rbx + rsi*2], di
jmp 0x14003e1b8
xor edi, edi
mov ebp, edi
test ebp, ebp
je 0x14003e222
cmp dword [rbx - 0x10], 0
je 0x14003e217
lea rax, [rsp + 0x80]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x28]
mov rdx, rbx
mov rcx, r15
call fcn.14003e250
mov qword [rsp + 0x28], rdi
lea rdx, [rbx - 0x18]
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14003e20a
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400136d6.0]
add rsp, 0x38
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov ecx, 0x80070057
call fcn.140001470
int3
mov ecx, 0x80004005
call fcn.140001470
nop
mov ecx, 0x80004005
call fcn.140001470
nop
call fcn.1401bb848
int3
call fcn.1401bb86c
int3
Function at 0x140040d10
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
sub rsp, 0x30
mov ecx, 0x40000
movaps xmmword [rsp + 0x20], xmm6
mov rbp, r8
mov rbx, rdx
xor esi, esi
call fcn.140064a50
movdqa xmm6, xmmword [0x14026f460]
lea r8, [0x140254818]
mov rdx, rbx
mov qword [rsp + 0x50], rsi
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x68], rsi
mov rdi, rax
call fcn.1401fc080
test eax, eax
jne 0x140040ec6
lea r8, [0x140254794]
mov rdx, rbp
lea rcx, [rsp + 0x68]
call fcn.1401fc080
test eax, eax
jne 0x140040ec6
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140040ea6
cmp qword [rsp + 0x68], rsi
je 0x140040e9c
xor edx, edx
mov r8d, 0x40000
mov rcx, rdi
call fcn.1401e7e40
mov r9, qword [rsp + 0x50]
lea edx, [rsi + 1]
mov r8d, 0x40000
mov rcx, rdi
call fcn.1401fd0cc
mov rbx, rax
test rax, rax
je 0x140040e92
lfence
mov rcx, rsi
cmp rbx, 0x40
jb 0x140040e3a
mov rdx, rbx
lea rax, [rdi + 0x20]
and rdx, 0xffffffffffffffc0
nop word [rax + rax]
movdqu xmm0, xmmword [rax - 0x20]
add rcx, 0x40
lea rax, [rax + 0x40]
pxor xmm0, xmm6
movdqu xmmword [rax - 0x60], xmm0
movdqu xmm0, xmmword [rax - 0x50]
pxor xmm0, xmm6
movdqu xmmword [rax - 0x50], xmm0
movdqu xmm1, xmmword [rax - 0x40]
pxor xmm1, xmm6
movdqu xmmword [rax - 0x40], xmm1
movdqu xmm0, xmmword [rax - 0x30]
pxor xmm0, xmm6
movdqu xmmword [rax - 0x30], xmm0
cmp rcx, rdx
jb 0x140040df0
cmp rcx, rbx
jae 0x140040e50
mov rdx, rbx
lea rax, [rcx + rdi]
sub rdx, rcx
not byte [rax]
lea rax, [rax + 1]
sub rdx, 1
jne 0x140040e44
mov r9, qword [rsp + 0x68]
mov r8, rbx
mov edx, 1
mov rcx, rdi
call fcn.1401fc96c
cmp rbx, 0x40000
jb 0x140040e92
mov r9, qword [rsp + 0x50]
mov edx, 1
mov r8d, 0x40000
mov rcx, rdi
call fcn.1401fd0cc
mov rbx, rax
test rax, rax
jne 0x140040dd3
mov rcx, qword [rsp + 0x50]
mov esi, 1
test rcx, rcx
je 0x140040ea6
call fcn.1401fc204
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x140040eb5
call fcn.1401fc204
test rdi, rdi
je 0x140040ec2
mov rcx, rdi
call fcn.1400079c0
mov eax, esi
jmp 0x140040ec8
xor eax, eax
mov rbx, qword [rsp + 0x58]
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400416f0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
jg 0x140041721
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rdi
je 0x1400417a5
lfence
mov rdi, r14
mov rcx, rbx
call fcn.14000e0e0
test rax, rax
jle 0x140041776
mov rdx, qword [rbx + 0x38]
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov r8, rbp
mov rdx, qword [rdx]
call fcn.1401e7770
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x140041795
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax + 0x38]
call qword [case.0x1400136d6.0]
cmp eax, 0xffffffff
je 0x14004179d
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x140041738
sub r14, rdi
jmp 0x140041886
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x1400417bc
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x1400417be
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x1400417f0
cmp rax, r14
mov rdi, r14
mov rcx, rsi
cmovb rdi, rax
mov r8, rdi
call fcn.1401e7770
mov rax, qword [rbx + 0x50]
add rsi, rdi
sub rbp, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x140041880
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14004182b
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rbp, 0xfff
jbe 0x140041861
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call fcn.1401fd0cc
add rsi, rax
sub rbp, rax
cmp rax, 0xfff
jne 0x140041880
cmp rbp, rax
ja 0x140041834
test rbp, rbp
je 0x140041880
mov r9, qword [rbx + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call fcn.1401fd0cc
sub rbp, rax
sub r14, rbp
lfence
mov rbp, qword [rsp + 0x30]
mov rax, r14
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret