joyce8/EMBER2024-capa huggingface dataset:
Function at 0x66205e10
Capabilities:
Get file attributes

Disassembly:
mov byte [rsp + 0x18], r8b
mov byte [rsp + 0x10], dl
push rbp
push rsi
push rdi
sub rsp, 0x160
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rsp + 0x198], rbx
mov rbp, r9
mov rdi, rcx
add rcx, 0x1c0
call fcn.662082e0
xor esi, esi
cmp qword [rdi + 0x1a0], rsi
jne 0x66205f77
cmp qword [rdi + 8], rsi
je 0x66205f29
lea rcx, [rsp + 0x90]
call fcn.662035e0
nop
lea rdx, [rsp + 0x90]
mov rcx, qword [rdi]
call fcn.6620c420
lea rcx, [rsp + 0x90]
call fcn.662048a0
mov dword [rsp + 0x50], 0x30
mov qword [rsp + 0x58], rsi
mov dword [rsp + 0x68], 0x40
mov qword [rsp + 0x60], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x70], xmm0
mov eax, 0x20
cmp byte [rdi + 0x1e4], sil
mov ecx, esi
cmovne eax, ecx
or eax, 0x40
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 1
lea r9, [rsp + 0x80]
lea r8, [rsp + 0x50]
mov edx, dword [rdi + 0x1e0]
lea rcx, [rdi + 0x1b0]
call qword [sym.imp.ntdll.dll_NtOpenFile]
mov dword [rsp + 0x180], eax
test eax, eax
jns 0x66205f1a
xor eax, eax
mov qword [rdi + 0x1b0], rax
lea rcx, [rsp + 0x90]
call fcn.66203630
mov eax, dword [rsp + 0x180]
jmp 0x66206038
lea rcx, [rsp + 0x90]
call fcn.66203630
xor esi, esi
mov dword [rsp + 0x30], esi
xor eax, eax
mov qword [rsp + 0x34], rax
mov qword [rsp + 0x3c], rax
mov dword [rsp + 0x44], eax
mov dword [rsp + 0x20], 5
lea r9d, [rax + 0x18]
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x80]
mov rcx, qword [rdi + 0x1b0]
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
test eax, eax
js 0x66206038
mov rax, qword [rsp + 0x38]
mov qword [rdi + 0x1a8], rax
mov rcx, rdi
call fcn.66206280
mov esi, eax
test eax, eax
jns 0x66205fa0
lea rcx, [rdi + 0x1c0]
call fcn.662082e0
mov rcx, rdi
call fcn.66205160
mov eax, esi
jmp 0x66206038
cmp byte [rsp + 0x188], 0
je 0x66205fb1
xor eax, eax
jmp 0x66206038
mov rbx, qword [rdi + 0x1c0]
mov rcx, rbx
call fcn.66205000
test al, al
je 0x66205faa
cmp byte [rsp + 0x190], 0
je 0x66205faa
mov rax, qword [rdi + 0x1b0]
mov qword [rdi + 0x1b8], rax
xor esi, esi
mov qword [rdi + 0x1b0], rsi
test rbp, rbp
je 0x66205ffb
or r8, 0xffffffffffffffff
mov rdx, rbp
mov rcx, rdi
call fcn.662046d0
jmp 0x66206028
mov rcx, rbx
call fcn.66204fe0
mov rbx, rax
mov rcx, rdi
call fcn.662045a0
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
or r9, 0xffffffffffffffff
mov r8, rbx
mov dl, 1
mov rcx, rax
call fcn.66203710
xor r9d, r9d
xor r8d, r8d
mov dl, 1
mov rcx, rdi
call fcn.66205e10
mov rbx, qword [rsp + 0x198]
add rsp, 0x160
pop rdi
pop rsi
pop rbp
ret
Function at 0x662060d0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push r14
sub rsp, 0x60
mov r14d, r9d
mov rbp, r8
mov rbx, rcx
lea rax, [r14 + rdx]
cmp qword [rcx + 0x1a8], rax
jge 0x6620610e
mov eax, 0xc000007b
mov rbx, qword [rsp + 0x98]
add rsp, 0x60
pop r14
pop rsi
pop rbp
ret
mov rax, qword [rcx + 0x1a0]
test rax, rax
je 0x6620613b
add rdx, rax
mov r8, r14
mov rcx, rbp
call fcn.6620ec20
xor eax, eax
mov rbx, qword [rsp + 0x98]
add rsp, 0x60
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x1b0], 0
jne 0x6620615b
mov eax, 0xc0000008
mov rbx, qword [rsp + 0x98]
add rsp, 0x60
pop r14
pop rsi
pop rbp
ret
cmp byte [rcx + 0x1e4], 0
mov qword [rsp + 0x90], rdi
mov qword [rsp + 0x80], 0
je 0x662061bf
mov rdi, qword [rsp + 0xa0]
test rdi, rdi
jne 0x662061ad
lea rcx, [rsp + 0x80]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x100002
mov byte [rsp + 0x20], dil
call qword [sym.imp.ntdll.dll_NtCreateEvent]
mov rdi, qword [rsp + 0x80]
jmp 0x662061b6
mov rcx, rdi
call qword [sym.imp.ntdll.dll_NtClearEvent]
test eax, eax
jns 0x662061c1
jmp 0x6620625d
xor edi, edi
mov rcx, qword [rbx + 0x1b0]
xor eax, eax
xor r9d, r9d
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x88]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x50]
mov dword [rsp + 0x30], r14d
xor r8d, r8d
mov rdx, rdi
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x50], 0
call qword [sym.imp.ntdll.dll_NtReadFile]
mov ebx, eax
cmp eax, 0x103
jne 0x66206237
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntdll.dll_NtWaitForSingleObject]
mov ebx, eax
test eax, eax
je 0x66206233
js 0x66206248
mov ebx, 0xc0000001
jmp 0x66206248
mov ebx, dword [rsp + 0x50]
test ebx, ebx
js 0x66206248
cmp qword [rsp + 0x58], r14
mov eax, 0xc000007b
cmovne ebx, eax
mov rcx, qword [rsp + 0x80]
test rcx, rcx
je 0x6620625b
call qword [sym.imp.ntdll.dll_NtClose]
mov eax, ebx
mov rdi, qword [rsp + 0x90]
mov rbx, qword [rsp + 0x98]
add rsp, 0x60
pop r14
pop rsi
pop rbp
ret
Function at 0x66207440
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
xor eax, eax
cmp byte [rcx + 2], al
setne al
ret
Function at 0x662080b0
Capabilities:
Get windows directory from kuser_shared_data

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, rdx
mov rdi, rcx
test rcx, rcx
je 0x6620811a
test rdx, rdx
je 0x6620811a
xor edx, edx
mov rcx, rbx
call fcn.662041f0
xor eax, eax
or r9, 0xffffffffffffffff
mov qword [rsp + 0x28], rax
mov r8d, 0x7ffe0030
mov dl, 1
mov rcx, rbx
mov dword [rsp + 0x20], eax
call fcn.66203710
lea rdx, str.System32
mov rcx, rbx
call fcn.6620c350
mov rdx, rdi
mov rcx, rbx
call fcn.6620c350
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov eax, 0xc000000d
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x6620d0d0
Capabilities:
Encode data using xor

Disassembly:
movzx eax, byte [rcx]
mov r10, r8
movsxd r8, r9d
add al, 0x29
cmp al, 1
ja 0x6620cad7
mov rdx, r10
jmp 0x6620d0d0
lea rdx, [rcx + 1]
mov rcx, r10
jmp fcn.6620ec20
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
movzx esi, byte [rcx]
inc rcx
mov rbx, r8
lea eax, [rsi + 0x29]
mov rdi, rdx
cmp al, 1
jbe 0x6620d120
test rbx, rbx
je 0x6620d19c
sub rcx, rdx
nop
movzx eax, byte [rcx + rdi]
lea rdi, [rdi + 1]
mov byte [rdi - 1], al
dec rbx
jne 0x6620d100
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
call fcn.6620d380
cmp sil, 0xd8
jne 0x6620d19c
xor ecx, ecx
test rbx, rbx
je 0x6620d19c
cmp rbx, 0x20
jb 0x6620d179
movdqa xmm2, xmmword [0x66220070]
mov rax, rbx
mov rdx, rbx
and eax, 0x1f
sub rdx, rax
lea rax, [rdi + 0x10]
movdqu xmm0, xmmword [rax - 0x10]
add rcx, 0x20
lea rax, [rax + 0x20]
pxor xmm0, xmm2
movdqu xmmword [rax - 0x30], xmm0
movdqu xmm1, xmmword [rax - 0x20]
pxor xmm1, xmm2
movdqu xmmword [rax - 0x20], xmm1
cmp rcx, rdx
jb 0x6620d150
cmp rcx, rbx
jae 0x6620d19c
lea rax, [rcx + rdi]
sub rbx, rcx
nop word [rax + rax]
xor byte [rax], 0xf0
lea rax, [rax + 1]
dec rbx
jne 0x6620d190
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140001430
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x20
mov r8d, pe_nt_image_headers64
lea rdx, [0x1400856a0]
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov ebx, eax
cmp eax, 0x100
jb 0x140001493
lea ecx, [rax + 1]
mov qword [rsp + 0x30], rdi
add rcx, rcx
call fcn.14002e6fc
mov rdi, rax
test rax, rax
je 0x1400014b6
mov r8d, ebx
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov rax, rdi
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret
test ebx, ebx
jne 0x1400014a4
xor eax, eax
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret
mov rbx, qword [rsp + 0x38]
lea rax, [0x1400856a0]
add rsp, 0x20
pop rsi
ret
lea rdx, str.Could_not_allocate_environment_buffer
mov ecx, 0x68
call fcn.140001360
int3
Function at 0x140002090
Capabilities:
Query environment variable
Read .ini file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x30
lea r14, str.pythonX
mov edx, 0x400
lea r9, str.py__ls
mov qword [rsp + 0x20], r14
mov r8, 0xffffffffffffffff
lea rcx, [0x140085ab0]
lea rsi, str.environment
call fcn.140001210
lea rbx, [0x1400856a0]
mov r8d, pe_nt_image_headers64
mov rdx, rbx
lea rcx, [0x140085ab0]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edi, eax
cmp eax, 0x100
jb 0x140002155
lea ecx, [rax + 1]
add rcx, rcx
call fcn.14002e6fc
mov rbx, rax
test rax, rax
je 0x1400021ee
mov r8d, edi
lea rcx, [0x140085ab0]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov r9, rsi
lea rcx, str.found_configured_value__ls_ls_in__ls_n
mov r8, rbx
mov rdx, r14
call fcn.1400012c0
mov rsi, qword [rsp + 0x48]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r14
ret
test edi, edi
jne 0x140002127
xor ebx, ebx
cmp word [0x1400858a0], bx
je 0x14000219f
lea rsi, [0x1400858a0]
xor r8d, r8d
mov qword [rsp + 0x28], rsi
lea r9, [0x140085ab0]
mov rdx, r14
mov dword [rsp + 0x20], 0x400
lea rcx, str.defaults
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x14000219f
lea rbx, [0x140085ab0]
jmp 0x140002127
cmp word [0x14006b680], bx
je 0x1400021da
lea rsi, [0x14006b680]
xor r8d, r8d
mov qword [rsp + 0x28], rsi
lea r9, [0x140085ab0]
mov rdx, r14
mov dword [rsp + 0x20], 0x400
lea rcx, str.defaults
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
jne 0x140002196
mov rdx, r14
lea rcx, str.found_no_configured_value_for__ls_n
call fcn.1400012c0
jmp 0x14000213c
lea rdx, str.Could_not_allocate_environment_buffer
mov ecx, 0x68
call fcn.140001360
int3
Function at 0x140013c5c
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x140013a4b
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140013a4b
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140013a4b
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140013a4b
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140013a4b
cmp dword [rcx + 0x84], 0xe
jbe 0x140013a4b
cmp dword [rcx + 0xf8], 0
je 0x140013a4b
mov ecx, ebx
call fcn.140013b7c
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.1400137bc
cmp dword [rbp + 0x20], 0
je 0x140013a98
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140013aa0
int3
xor r8d, r8d
xor edx, edx
jmp 0x1400139e4
Function at 0x141766058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1417661df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x141766089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14176606f
add dl, dl
jne 0x141766096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1417660f6
xor eax, eax
add dl, dl
jne 0x1417660a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1417661ad
add dl, dl
jne 0x1417660b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1417660c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1417660d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1417660dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1417660ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14176607e
mov eax, 1
add dl, dl
jne 0x141766106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141766113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1417660fb
sub eax, ebx
mov ebx, 1
jne 0x14176614c
mov ecx, 1
add dl, dl
jne 0x14176612e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14176613b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141766123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14176607e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x141766168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x141766175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14176615d
cmp eax, 0x7d00
jae 0x14176619b
cmp eax, 0x500
jb 0x141766196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14176607e
cmp eax, 0x7f
ja 0x14176619e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14176607e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1417661d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14176607e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140046f00
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x140046f0d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x140046f1d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x140046f05
lea eax, [rcx + 1]
call r11
adc eax, eax
add ebx, ebx
jne 0x140046f35
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x140046f22
sub eax, 3
jb 0x140046f4f
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x140046f86
movsxd rbp, eax
lea eax, [rcx + 1]
call r11
adc ecx, ecx
call r11
adc ecx, ecx
jne 0x140046f76
mov ecx, eax
add eax, 2
call r11
adc ecx, ecx
add ebx, ebx
jne 0x140046f74
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x140046f63
cmp rbp, 0xfffffffffffff300
adc ecx, eax
call fcn.140046ec2
jmp 0x140046f0d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x1b400
mov dl, 9
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x140046fd2
cmp rsi, rcx
jae 0x140046fda
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x140046fb9
cmp al, 0x8f
ja 0x140046fb9
cmp byte [rsi - 2], 0xf
je 0x140046fbf
sub al, 0xe8
cmp al, 1
ja 0x140046fa3
cmp rsi, rcx
jae 0x140046fda
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x140046fa9
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x140046fda
lodsb al, byte [rsi]
jmp 0x140046fb9
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x44000]
mov eax, dword [rdi]
or eax, eax
je 0x140047043
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x556ac]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x140046fe7
jns 0x14004701c
movzx rdx, word [rdi]
add rdi, 2
jmp 0x140047026
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x14004703d
mov qword [rbx], rax
add rbx, 8
jmp 0x140047007
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x18f]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x14004709b
sub rsp, 0xffffffffffffff80
jmp 0x14001bce0
Function at 0x140002100
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x90]
sub rsp, 0x190
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x1c8], rbx
mov rax, qword [0x140039088]
xor rax, rsp
mov qword [rbp + 0x80], rax
mov r15, r9
mov rbx, r8
mov rdi, rcx
mov qword [rsp + 0x38], rbx
mov edx, 0x6c
lea r8d, [rdx - 0x62]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rsi, rax
test rax, rax
je 0x140002297
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x140002297
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r14, rax
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
test r14, r14
je 0x140002297
test eax, eax
je 0x140002297
xor ecx, ecx
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rcx
mov r8d, eax
add r8, r14
mov rdx, r14
lea rcx, [rsp + 0x40]
call fcn.140005a00
nop
xor eax, eax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov r8, r15
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x58]
call fcn.140002060
nop
xor edx, edx
mov r8d, 0x108
lea rcx, [rsp + 0x70]
call fcn.14000a6c0
mov rdx, rbx
lea rcx, [rsp + 0x70]
call fcn.140002830
nop
cmp qword [rbp - 8], 0
je 0x140002262
mov r8, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x58]
sub r8, rdx
lea rcx, [rsp + 0x70]
call fcn.1400033e0
lea rcx, [rsp + 0x78]
call fcn.1400047c0
test rax, rax
jne 0x140002262
mov rax, qword [rsp + 0x70]
movsxd rcx, dword [rax + 4]
lea r9, [rsp + 0x70]
add rcx, r9
mov eax, dword [rcx + 0x10]
or eax, 2
mov edx, eax
or edx, 4
cmp qword [rcx + 0x48], 0
cmovne edx, eax
xor r8d, r8d
call fcn.140001b70
nop
lea rcx, [rbp + 0x18]
call fcn.1400027b0
nop
lea rax, vtable.std::ios_base.0
mov qword [rbp + 0x18], rax
lea rcx, [rbp + 0x18]
call fcn.140006288
nop
lea rcx, [rsp + 0x58]
call fcn.140002550
nop
lea rcx, [rsp + 0x40]
call fcn.140002550
nop
mov rcx, rbx
call fcn.140002680
mov rcx, qword [rbp + 0x80]
xor rcx, rsp
call fcn.140007230
mov rbx, qword [rsp + 0x1c8]
add rsp, 0x190
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140002310
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x90
mov rax, qword [0x140039088]
xor rax, rsp
mov qword [rbp + 0x4f], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
xor esi, esi
lea r9, [rbp + 7]
xor r8d, r8d
mov qword [rbp + 7], rsi
xor edx, edx
lea rcx, [0x1400233e0]
mov rbx, rax
call qword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
mov rdx, qword [rbp + 7]
mov qword [rbp - 1], 7
mov qword [rbp - 9], rsi
mov word [rbp - 0x19], si
cmp word [rdx], si
jne 0x14000237a
mov r8d, esi
jmp 0x14000238a
or r8, 0xffffffffffffffff
nop
inc r8
cmp word [rdx + r8*2], si
jne 0x140002380
lea rcx, [rbp - 0x19]
call fcn.140003b00
lea rdx, [rbp - 0x19]
lea rcx, [rbp + 0x2f]
call fcn.140005430
mov r8, qword [rbp - 1]
cmp r8, 8
jb 0x1400023ba
mov rdx, qword [rbp - 0x19]
lea rcx, [rbp - 0x19]
inc r8
call fcn.1400049d0
mov r8d, 0x3b
mov qword [rsp + 0xa0], rdi
lea rdx, str.tgbyuN980moiu2niyuwsic_67ter6gibGr8238n_7845f_
mov qword [rbp + 0x27], 0xf
lea rcx, [rbp + 0xf]
mov qword [rbp + 0x1f], rsi
mov byte [rbp + 0xf], sil
call fcn.140003e10
lea rdx, [rbp + 0x2f]
lea rcx, [rbp - 0x19]
call fcn.140001f00
mov r8, rax
lea r9, [rbp + 0xf]
mov rcx, rbx
call fcn.140002100
cmp qword [rbp + 0x47], 8
lea rcx, [rbp + 0x2f]
cmovae rcx, qword [rbp + 0x2f]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
test rax, rax
je 0x140002441
lea rdx, str.MyFunction
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
jne 0x140002475
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ebx, 1
mov rax, qword [rbp + 0x27]
mov rdi, qword [rsp + 0xa0]
cmp rax, 0x10
jb 0x1400024eb
mov rcx, qword [rbp + 0xf]
inc rax
cmp rax, 0x1000
jb 0x1400024e6
test cl, 0x1f
je 0x1400024cb
jmp 0x140002538
mov r8d, 0x56
mov qword [rbp - 1], 7
lea rdx, str.y73487BNc7783g6__6fvbwdux_982873eHM___38J_H_MGEni75u_FFg6NEuUGb3tv
mov qword [rbp - 9], rsi
lea rcx, [rbp - 0x19]
mov word [rbp - 0x19], si
call fcn.140003b00
lea rcx, [rbp - 0x19]
call rdi
mov r8, qword [rbp - 1]
cmp r8, 8
jb 0x1400024bb
mov rdx, qword [rbp - 0x19]
lea rcx, [rbp - 0x19]
inc r8
call fcn.1400049d0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ebx, esi
jmp 0x140002446
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x14000253e
sub rcx, rax
cmp rcx, 8
jb 0x140002544
cmp rcx, 0x27
ja 0x14000254a
mov rcx, rax
call fcn.14000783c
mov r8, qword [rbp + 0x47]
mov qword [rbp + 0x27], 0xf
mov qword [rbp + 0x1f], rsi
mov byte [rbp + 0xf], sil
cmp r8, 8
jb 0x140002515
mov rdx, qword [rbp + 0x2f]
lea rcx, [rbp + 0x2f]
inc r8
call fcn.1400049d0
mov eax, ebx
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.140007230
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
call fcn.14000c0c4
int3
call fcn.14000c0c4
int3
call fcn.14000c0c4
int3
call fcn.14000c0c4
int3
Function at 0x140010ef4
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x140010f63
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140010f63
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140010f63
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140010f63
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140010f63
cmp dword [rcx + 0x84], 0xe
jbe 0x140010f63
cmp dword [rcx + 0xf8], 0
je 0x140010f63
mov ecx, ebx
call fcn.140011014
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.140010df0
nop
cmp dword [rbp + 0x20], 0
je 0x140010fb1
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140010fbc
int3
xor r8d, r8d
xor edx, edx
jmp 0x140010ef4

Function at 0x1400110f8
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x140010f63
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140010f63
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140010f63
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140010f63
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140010f63
cmp dword [rcx + 0x84], 0xe
jbe 0x140010f63
cmp dword [rcx + 0xf8], 0
je 0x140010f63
mov ecx, ebx
call fcn.140011014
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.140010df0
nop
cmp dword [rbp + 0x20], 0
je 0x140010fb1
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140010fbc
int3
xor r8d, r8d
xor edx, edx
jmp 0x140010ef4

Function at 0x1400142ec
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x140014302
mov al, 1
jmp 0x140014362
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x140014313
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x140014360
mov ecx, dword [rcx + 0x18]
nop
call fcn.14001bab8
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140014360
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x140014360
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x140014360
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x140014362
xor al, al
add rsp, 0x20
pop rbx
ret