joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002ff90
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov ecx, dword [0x1400eb338]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x14002ffce
mov rcx, qword [rsi]
shl rcx, 4
mov qword [rax + rcx], rdi
mov ecx, dword [rsi + 8]
mov rdx, qword [rsi]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
add rsp, 0x28
pop rdi
pop rsi
ret
test rdi, rdi
je 0x14002ffc7
call fcn.14002fd70
jmp 0x14002ffae

Function at 0x140034330
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov eax, dword [0x1400f0c00]
mov ecx, dword [0x1400ee910]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 0x10]
jg 0x140034365
lea rcx, [0x1400f0bf0]
add rsp, 0x28
jmp fcn.14002ff50
lea rcx, [0x1400f0c00]
call fcn.140093ea4
cmp dword [0x1400f0c00], 0xffffffff
jne 0x140034355
xorps xmm0, xmm0
movups xmmword [0x1400f0bf0], xmm0
lea rcx, [0x1400f0bf0]
xor edx, edx
call fcn.14002ffe0
lea rcx, [0x1400f0c00]
call fcn.140093e38
jmp 0x140034355

Function at 0x140037a18
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
sub rsp, 0x28
mov edx, 4
call sub.ADVAPI32.dll_SystemFunction036
test al, al
setne al
add rsp, 0x28
ret

Function at 0x14003b1d0
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x14003b1e5
mov dword [rsi], eax
cmp eax, 0xffffffff
setne al
add rsp, 0x20
pop rsi
ret

Function at 0x14003e570
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov eax, dword [0x1400f0ca0]
mov ecx, dword [0x1400ee910]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 0x10]
jg 0x14003e5a5
lea rcx, [0x1400f0c90]
add rsp, 0x28
jmp fcn.14002ff50
lea rcx, [0x1400f0ca0]
call fcn.140093ea4
cmp dword [0x1400f0ca0], 0xffffffff
jne 0x14003e595
xorps xmm0, xmm0
movups xmmword [0x1400f0c90], xmm0
lea rcx, [0x1400f0c90]
xor edx, edx
call fcn.14002ffe0
lea rcx, [0x1400f0ca0]
call fcn.140093e38
jmp 0x14003e595

Function at 0x14004036a
Capabilities:
Create thread

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rax, r8
mov r8, rdx
mov rdi, rcx
mov rsi, qword [rsp + 0x90]
mov edx, dword [rsp + 0x80]
mov r10, qword [rsp + 0x88]
mov qword [rsi], 0
mov rcx, qword [rcx]
mov qword [rsp + 0x30], r10
mov dword [rsp + 0x28], edx
mov qword [rsp + 0x20], r9
xor r14d, r14d
xor edx, edx
mov r9, rax
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
test rax, rax
je 0x140040402
mov rbx, rax
mov rdi, qword [rdi]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
mov dword [rsp + 0x30], 3
mov rcx, rax
mov rdx, rbx
mov r8, rdi
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
xor ecx, ecx
test eax, eax
sete cl
lea eax, [rcx + rcx*4]
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
ret
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
jmp qword [sym.imp.KERNEL32.dll_GetLastError]
Function at 0x140043190
Capabilities:
Get common file path

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x2e8
mov rsi, rcx
mov rax, qword [0x1400eb280]
xor rax, rsp
mov qword [rsp + 0x2e0], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x2d0], rax
movaps xmm0, xmmword [0x1400cb8d0]
movaps xmmword [rsp + 0x2c0], xmm0
movaps xmmword [rsp + 0x2b0], xmm0
movaps xmmword [rsp + 0x2a0], xmm0
movaps xmmword [rsp + 0x290], xmm0
movaps xmmword [rsp + 0x280], xmm0
lea rdx, [0x1400ce762]
lea r8, str....._base_files_file_util_win.cc
lea rdi, [rsp + 0x70]
mov rcx, rdi
mov r9d, 0x3af
call fcn.140004b70
lea rcx, [rsp + 0x280]
mov rdx, rdi
xor r8d, r8d
call fcn.1400190d0
lea rbx, [rsp + 0x70]
mov r8d, 0x208
mov rcx, rbx
mov dl, 0xaa
call fcn.1400bf140
mov word [rsp + 0x70], 0
mov ecx, 0x104
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov edi, eax
add edi, 0xfffffefb
cmp edi, 0xfffffefc
jb 0x1400432af
mov qword [rsp + 0x20], rbx
mov rcx, rbx
call fcn.14009b320
mov qword [rsp + 0x28], rax
lea rbx, [rsp + 0x30]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.1400259e0
lea r14, [rsp + 0x50]
mov rcx, rbx
mov rdx, r14
call fcn.140026a00
mov rcx, rsi
mov rdx, r14
call fcn.140025b30
mov rcx, r14
call fcn.140025ac0
mov rcx, rbx
call fcn.140025ac0
cmp edi, 0xfffffefc
setae bl
lea rcx, [rsp + 0x280]
call fcn.1400190e0
mov rcx, qword [rsp + 0x2e0]
xor rcx, rsp
call fcn.140093e10
mov eax, ebx
add rsp, 0x2e8
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x1400432f0
Capabilities:
Set current directory

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xa0
mov rsi, rcx
mov rax, qword [0x1400eb280]
xor rax, rsp
mov qword [rsp + 0x98], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x90], rax
movaps xmm0, xmmword [0x1400cb8d0]
movaps xmmword [rsp + 0x80], xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
lea rdx, [0x1400ce777]
lea r8, str....._base_files_file_util_win.cc
lea rbx, [rsp + 0x20]
mov rcx, rbx
mov r9d, 0x3bf
call fcn.140004b70
lea rdi, [rsp + 0x40]
mov rcx, rdi
mov rdx, rbx
xor r8d, r8d
call fcn.1400190d0
cmp qword [rsi + 0x18], 8
jb 0x140043382
mov rsi, qword [rsi]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
setne bl
mov rcx, rdi
call fcn.1400190e0
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.140093e10
mov eax, ebx
add rsp, 0xa0
pop rbx
pop rdi
pop rsi
ret
Function at 0x140045630
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x50
mov r14, rcx
mov rax, qword [0x1400eb280]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rsi, qword [rdx]
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], 0xf
mov byte [rsp + 0x28], 0
mov rcx, rsi
call fcn.1400a10c0
mov rdi, rax
cmp rax, 0xf
jbe 0x140045697
lea rcx, [rsp + 0x28]
mov rdx, rdi
mov r9, rsi
call fcn.140004ba0
jmp 0x1400456b1
mov qword [rsp + 0x38], rdi
lea rcx, [rsp + 0x28]
mov rdx, rsi
mov r8, rdi
call fcn.1400beaa0
mov byte [rsp + rdi + 0x28], 0
movabs rdx, 0xcbf29ce484222325
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x38]
mov r15, qword [rsp + 0x40]
cmp r15, 0x10
lea rbx, [rsp + 0x28]
cmovae rbx, rsi
test rdi, rdi
je 0x1400456f6
movabs rax, 0x100000001b3
mov ecx, edi
and ecx, 3
cmp rdi, 4
jae 0x1400456fb
xor r8d, r8d
jmp 0x14004574c
mov r9, rdx
jmp 0x140045777
mov r9, rdi
and r9, 0xfffffffffffffffc
xor r8d, r8d
nop word cs:[rax + rax]
movzx r10d, byte [rbx + r8]
xor r10, rdx
imul r10, rax
movzx edx, byte [rbx + r8 + 1]
xor rdx, r10
imul rdx, rax
movzx r10d, byte [rbx + r8 + 2]
xor r10, rdx
imul r10, rax
movzx edx, byte [rbx + r8 + 3]
xor rdx, r10
imul rdx, rax
add r8, 4
cmp r9, r8
jne 0x140045710
mov r9, rdx
test rcx, rcx
je 0x140045777
add r8, rbx
xor r10d, r10d
nop word [rax + rax]
movzx r9d, byte [r8 + r10]
xor r9, rdx
imul r9, rax
inc r10
mov rdx, r9
cmp rcx, r10
jne 0x140045760
and r9, qword [r14 + 0x30]
mov r12, qword [r14 + 8]
mov rax, qword [r14 + 0x18]
mov rcx, r9
shl rcx, 4
mov r14, qword [rax + rcx + 8]
cmp r14, r12
je 0x1400457f1
add r9, r9
mov r13, qword [rax + r9*8]
cmp rdi, qword [r14 + 0x20]
jne 0x1400457d3
nop word cs:[rax + rax]
cmp qword [r14 + 0x28], 0x10
jb 0x1400457c0
mov rdx, qword [r14 + 0x10]
jmp 0x1400457c4
lea rdx, [r14 + 0x10]
mov rcx, rbx
mov r8, rdi
call fcn.1400bf4e0
test eax, eax
je 0x1400457e4
cmp r14, r13
je 0x1400457f1
mov r14, qword [r14 + 8]
cmp rdi, qword [r14 + 0x20]
je 0x1400457b0
jmp 0x1400457d3
test r14, r14
je 0x1400457f1
cmp r15, 0x10
jae 0x1400457fa
jmp 0x14004582a
mov r14, r12
cmp r15, 0x10
jb 0x14004582a
lea rdx, [r15 + 1]
cmp rdx, 0x1000
jb 0x140045822
mov rax, qword [rsi - 8]
add rsi, 0xfffffffffffffff8
sub rsi, rax
cmp rsi, 0x20
jae 0x14004584f
add r15, 0x28
mov rdx, r15
mov rsi, rax
mov rcx, rsi
call fcn.140093b30
cmp r14, r12
setne bl
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140093e10
mov eax, ebx
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call fcn.14009afa0
int3
Function at 0x14004d400
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rsi
mov eax, ecx
test r8, r8
je 0x14004d47c
cmp r8, 1
jne 0x14004d412
xor ecx, ecx
jmp 0x14004d45e
mov r9, r8
and r9, 0xfffffffffffffffe
xor ecx, ecx
lea r10, [0x1400cfbb0]
nop word cs:[rax + rax]
movzx r11d, al
movzx esi, byte [rdx + rcx]
xor esi, r11d
shr eax, 8
xor eax, dword [r10 + rsi*4]
movzx r11d, al
movzx esi, byte [rdx + rcx + 1]
xor esi, r11d
shr eax, 8
xor eax, dword [r10 + rsi*4]
add rcx, 2
cmp r9, rcx
jne 0x14004d430
test r8b, 1
je 0x14004d47c
movzx r8d, al
movzx ecx, byte [rdx + rcx]
xor ecx, r8d
lea rdx, [0x1400cfbb0]
shr eax, 8
xor eax, dword [rdx + rcx*4]
pop rsi
ret

Function at 0x14004d518
Capabilities:
Execute anti-debugging instructions

Disassembly:
push rsi
rdtsc
mov r11, qword [0x1400eb380]
mov rcx, qword [0x1400eb390]
mov r9, qword [0x1400eb398]
mov r8, qword [0x1400eb3a0]
mov r10, qword [0x1400eb3a8]
mov rsi, qword [0x1400eb380]
test r11b, 1
jne 0x14004d56f
cmp r11, rsi
jne 0x14004d56f
shl rdx, 0x20
or rdx, rax
sub rdx, r9
cmp rdx, r10
jae 0x14004d56f
imul rdx, r8
shr rdx, 0x1e
add rdx, rcx
mov rax, rdx
pop rsi
ret
pop rsi
jmp 0x1400bfeea
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov rax, qword [0x1400eb280]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov eax, dword [0x1400eb3ec]
test al, 1
jne 0x1400c0055
mov ecx, eax
or ecx, 1
lock cmpxchg dword [0x1400eb3ec], ecx
test al, 1
jne 0x1400c0055
mov rbx, qword [0x1400eb3d8]
xor ebp, ebp
mov rdi, qword [0x1400eb3e0]
rdtsc
mov rsi, rdx
shl rsi, 0x20
or rsi, rax
call fcn.1400706d8
mov rcx, rax
rdtsc
shl rdx, 0x20
or rdx, rax
mov rax, rdx
sub rax, rsi
cmp rax, rdi
jb 0x1400bff7c
inc ebp
cmp ebp, 0x14
jne 0x1400bff7c
cmp rdi, 0xf4240
lea r8, [rdi + rdi + 2]
cmovb rdi, r8
mov qword [0x1400eb3e0], rdi
xor ebp, ebp
mov r8, rbx
sub r8, rdx
cmp r8, 0x10000
jb 0x1400bff34
cmp rax, rdi
jae 0x1400bff34
mov r8, rdi
shr r8, 1
cmp r8, rax
jb 0x1400bffbe
mov eax, 1
lock xadd dword [0x1400eb3e8], eax
cmp eax, 3
jb 0x1400bffc8
mov rax, rdi
shr rax, 3
sub rdi, rax
mov qword [0x1400eb3e0], rdi
mov dword [0x1400eb3e8], 0
mov qword [0x1400eb3d8], rdx
mov rax, qword [0x1400eb390]
mov qword [rsp + 0x30], rax
mov r9, qword [0x1400eb398]
mov qword [rsp + 0x38], r9
mov rsi, qword [0x1400eb3a0]
mov qword [rsp + 0x40], rsi
mov r10, qword [0x1400eb3a8]
mov qword [rsp + 0x48], r10
mov r8, qword [0x1400eb388]
mov qword [rsp + 0x28], r8
mov r8, rdx
sub r8, r9
cmp r8, r10
jae 0x1400c0066
imul rsi, r8
shr rsi, 0x1e
add rsi, rax
inc qword [0x1400eb3d0]
mov edx, dword [0x1400eb3ec]
and edx, 2
xchg dword [0x1400eb3ec], edx
cmp edx, 8
jae 0x1400c007f
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140093e10
mov rax, rsi
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
ret
lea rcx, [0x1400eb3ec]
call fcn.1400c027c
jmp 0x1400bff24
imul rax, rcx, 0x64
lea r9, [rsp + 0x28]
mov rcx, rdx
mov rdx, rax
call fcn.1400c008d
mov rsi, rax
jmp 0x1400c0028
lea rcx, [0x1400eb3ec]
call fcn.1400c0356
jmp 0x1400c003c
Function at 0x14004d858
Capabilities:
Get system information on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov edi, edx
mov rsi, rcx
mov rax, qword [0x1400eb280]
xor rax, rsp
mov qword [rsp + 0x58], rax
xor ebx, ebx
xor edx, edx
call fcn.14004e298
mov dword [rsi + 0x120], ebx
mov dword [rsi + 0x124], edi
movaps xmm0, xmmword [0x1400cb8d0]
lea rdi, [rsp + 0x20]
movaps xmmword [rdi + 0x20], xmm0
movaps xmmword [rdi + 0x10], xmm0
movaps xmmword [rdi], xmm0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rdi + 4]
mov ecx, dword [rdi + 0x28]
cmp eax, ecx
cmova ecx, eax
mov qword [rsi + 0x128], rcx
mov qword [rsi + 0x130], 0x20
mov qword [rsi + 0x138], 0x40
mov dword [rsi + 0x140], ebx
lea rax, [rsi + 8]
mov qword [rsi + 8], 0
xor rax, 0xffffffffb37cc16a
mov qword [rsi + 0x10], rax
mov qword [rsi + 0x18], rsi
mov dword [rsi + 0x28], ebx
lea rcx, [rsi + 0x30]
mov r8d, 0xf0
xor edx, edx
call fcn.1400bf140
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140093e10
mov rax, rsi
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret

Function at 0x140050cc8
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rdx, 0xcbf29ce484222325
xor r8d, r8d
movzx eax, byte [r8 + rcx]
movabs r9, 0x100000001b3
xor rdx, rax
inc r8
imul rdx, r9
cmp r8, 4
jb 0x140050cd5
mov rax, rdx
ret

Function at 0x1400514f0
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
mov rax, qword [0x1400eb280]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov edi, edx
mov rbx, rcx
cmp byte [0x1400ee000], 0
je 0x14005151c
or eax, 0xffffffff
jmp 0x140051583
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
mov dword [rsp + 0x20], eax
test eax, eax
jns 0x140051547
cmp eax, 0x80010106
jne 0x14005157f
lea rcx, str.Mscoree.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
jne 0x14005154b
jmp 0x14005157f
mov byte [rbx + 0x62], 1
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea r8, [rsp + 0x20]
mov rdx, rax
mov rcx, rbx
call fcn.14005d468
cmp al, 1
jne 0x140051573
mov edx, edi
mov rcx, rbx
call fcn.14005df90
mov dword [rsp + 0x20], eax
cmp byte [rbx + 0x62], 0
je 0x14005157f
call qword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140093e10
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x140052f70
Capabilities:
Hide thread from debugger
Terminate process

Disassembly:
push rbx
sub rsp, 0x30
lea rcx, [0x1400c63c8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [0x1400c6570]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x140052fb7
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
mov rax, rbx
lea edx, [r9 + 0x11]
call qword [0x1400c48f0]
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x140052fd2
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x30
pop rbx
ret
Function at 0x1400538a0
Capabilities:
Print debug messages
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rdi, r8
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rbx + 0x20], eax
je 0x1400539ad
mov r8d, 0xb
lea rdx, str.C:windows_
mov rcx, rdi
call fcn.14009b870
test eax, eax
je 0x1400539ad
call fcn.1400534b0
mov rcx, rax
test rax, rax
je 0x1400539b8
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [0x1400c48f0]
add rax, 0x18
mov qword [rsp + 0x30], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov r9, rdi
lea rdx, str._Guard__tid:_d_dllpath:_s
lea rcx, [rsp + 0x30]
call fcn.1400532d0
mov rbx, qword [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov rcx, rax
lea rdx, str.payload.dll
call fcn.14009b6d4
test eax, eax
jne 0x14005398c
lea rcx, str._GUARD__illegal_dll_inject_terminate
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, rax
mov r9d, 0x10030
lea r8, [0x1400c6640]
lea rdx, [0x1400c6650]
call qword [sym.imp.USER32.dll_MessageBoxW]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400539ad
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x1400c48f0]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov ecx, 0x80004005
call fcn.140051450
int3
Function at 0x140053e10
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x1400eb280]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rdi, rcx
call fcn.1400534b0
mov rcx, rax
test rax, rax
je 0x140053f2b
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [0x1400c48f0]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x20], rbx
mov rcx, qword [rdi + 0x10]
test rcx, rcx
je 0x140053ef2
cmp qword [rdi + 8], 0
je 0x140053ef2
and dword [rsp + 0x28], 0
and dword [rsp + 0x2c], 0
mov ebx, dword [rdi]
shl rbx, 3
lea r9, [rsp + 0x28]
mov r8d, 4
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140053ebd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.VirtualProtect:error_code:_d
lea rcx, [rsp + 0x20]
call fcn.1400532d0
mov rbx, qword [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x140053ef2
mov r8d, dword [rdi]
mov rcx, qword [rdi + 0x10]
mov rax, qword [rdi + 8]
xchg qword [rcx + r8*8], rax
lea r9, [rsp + 0x2c]
mov r8d, dword [rsp + 0x28]
mov rdx, rbx
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
and qword [rdi + 0x10], 0
and qword [rdi + 8], 0
mov rbx, qword [rsp + 0x20]
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140053f13
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x1400c48f0]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140093e10
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov ecx, 0x80004005
call fcn.140051450
int3

Function at 0x140053f88
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x140053fff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x140053fff
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
add rcx, rbx
and edi, 0xf
jbe 0x140053fec
cmp rbx, rcx
jae 0x140053fff
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
add edi, 0xffffffff
jne 0x140053fd7
cmp rbx, rcx
jae 0x140053fff
movzx eax, word [rbx]
neg ax
sbb rax, rax
and rax, rbx
jmp 0x140054001
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140054df0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0x90
mov rax, qword [0x1400eb280]
xor rax, rsp
mov qword [rbp + 0x3f], rax
or edi, 0xffffffff
mov esi, edx
mov rbx, rcx
cmp edx, edi
jne 0x140054e2b
xor eax, eax
jmp 0x140054f50
mov rax, qword [rcx + 0x40]
cmp qword [rax], 0
je 0x140054e65
mov rdx, qword [rcx + 0x58]
movsxd r8, dword [rdx]
mov rcx, r8
add rcx, qword [rax]
cmp qword [rax], rcx
jae 0x140054e65
lea ecx, [r8 - 1]
mov eax, esi
mov dword [rdx], ecx
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], sil
jmp 0x140054f50
cmp qword [rbx + 0x80], 0
je 0x140054f4e
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x140054ea0
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140054ec0
movsx ecx, sil
mov rdx, qword [rbx + 0x80]
call fcn.14009f5e0
cmp eax, edi
jmp 0x140054f4b
lea r8, [rbp + 7]
mov byte [rbp + 0x17], sil
mov rax, qword [rcx]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x38], r8
lea r9, [rbp + 0x18]
lea r8, [rbp + 0x3f]
mov qword [rsp + 0x30], r8
lea r8, [rbp + 0x1f]
mov rax, qword [rax + 0x38]
mov qword [rsp + 0x28], r8
lea r8, [rbp + 0xf]
mov qword [rsp + 0x20], r8
lea r8, [rbp + 0x17]
call qword [0x1400c48f0]
test eax, eax
je 0x140054f15
sub eax, 1
je 0x140054f15
cmp eax, 2
jne 0x140054f4e
movsx ecx, byte [rbp + 0x17]
jmp 0x140054ead
mov r14, qword [rbp + 7]
lea rax, [rbp + 0x1f]
sub r14, rax
je 0x140054f3f
mov r9, qword [rbx + 0x80]
lea rcx, [rbp + 0x1f]
mov r8, r14
mov edx, 1
call fcn.14009ff08
cmp r14, rax
jne 0x140054f4e
lea rax, [rbp + 0x17]
mov byte [rbx + 0x71], 1
cmp qword [rbp + 0xf], rax
cmovne edi, esi
mov eax, edi
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.140093e10
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x1400556f0
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x140055710
xor eax, eax
jmp 0x1400557f6
cmp qword [rcx + 0x68], 0
je 0x140055721
call fcn.140055810
jmp 0x1400557f6
mov rax, qword [rcx + 0x38]
mov rdi, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x140055738
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14005573a
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x14005576c
cmp rax, rbp
mov rbx, rbp
mov rcx, r14
cmovb rbx, rax
mov r8, rbx
call fcn.1400beaa0
mov rax, qword [rsi + 0x50]
add r14, rbx
sub rdi, rbx
sub dword [rax], ebx
mov rcx, qword [rsi + 0x38]
movsxd rax, ebx
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x1400557f0
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x1400557a3
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
mov ebx, 0xfff
jmp 0x1400557cc
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call fcn.14009f9a0
add r14, rax
sub rdi, rax
cmp rax, rbx
jne 0x1400557f0
cmp rdi, rbx
ja 0x1400557aa
test rdi, rdi
je 0x1400557f0
mov r9, qword [rsi + 0x80]
mov r8, rdi
mov edx, 1
mov rcx, r14
call fcn.14009f9a0
sub rdi, rax
sub rbp, rdi
mov rax, rbp
add rsp, 0x20
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x1400558e0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x14005590f
call fcn.1400559a0
jmp 0x140055986
mov rax, qword [rcx + 0x40]
mov rsi, rbx
mov r9, qword [rax]
test r9, r9
je 0x140055926
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x140055928
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x140055980
test ecx, ecx
jle 0x140055961
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call fcn.1400beaa0
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x140055980
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140055980
mov r8, rbx
mov edx, 1
mov rcx, r15
call fcn.14009ff08
sub rbx, rax
sub rsi, rbx
mov rax, rsi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret

Function at 0x1400588d0
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x20], r9
mov r9, r8
mov r8, rdx
mov rdx, rcx
lea rcx, [rsp + 0x30]
call fcn.1400584c8
cmp qword [rax + 0x18], 0xf
jbe 0x1400588f6
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x140058938
mov rcx, qword [rsp + 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140058933
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005893d
call fcn.140093b30
add rsp, 0x58
ret
call fcn.14009afa0
int3