joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002f6ec
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14002f736
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14002f736
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14002f736
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14002f736
cmp dword [rcx + 0x84], 0xe
jbe 0x14002f736
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14002f738
xor al, al
add rsp, 0x28
ret

Function at 0x14003e77c
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
xor edi, edi
mov esi, edx
mov rbp, rcx
test r8, r8
jne 0x14003e7b3
call fcn.140040da4
mov dword [rax], reloc.WS2_32.dll_shutdown
call fcn.140040c34
xor eax, eax
jmp 0x14003e841
mov rdx, r9
mov rcx, r8
call fcn.14003e718
mov rbx, rax
test rax, rax
je 0x14003e83e
lea rax, [rsp + 0x50]
mov rdx, rsi
mov qword [rsp + 0x28], rax
lea r8, [0x14003e644]
mov eax, dword [rsp + 0x60]
mov r9, rbx
mov rcx, rbp
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdx, rax
test rax, rax
jne 0x14003e82b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140040d18
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x14003e812
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x14003e821
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, rbx
call fcn.14004a42c
jmp 0x14003e83e
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x14003e83b
mov eax, dword [rsp + 0x50]
mov dword [rcx], eax
mov rdi, rdx
mov rax, rdi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret

Function at 0x140041758
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140041554
Function at 0x14004ead0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
movsxd r15, ecx
lea r9, [0x1401f4680]
mov rax, r15
mov rbp, r15
and eax, 0x3f
sar rbp, 6
mov ecx, 4
xor esi, esi
mov r14, rdx
lea rdi, [rax + rax*8]
mov rax, qword [r9 + rbp*8]
lea r13d, [rcx + 6]
mov r10, qword [rax + rdi*8 + 0x28]
test r8, r8
je 0x14004eb27
cmp word [rdx], r13w
jne 0x14004eb27
or byte [rax + rdi*8 + 0x38], cl
jmp 0x14004eb2c
and byte [rax + rdi*8 + 0x38], 0xfb
lea r8, [rdx + r8*2]
mov rbx, r14
cmp r14, r8
jae 0x14004ec51
mov r11d, recv
lea r12d, [r11 - 0xb]
movzx ecx, word [rdx]
cmp cx, 0x1a
je 0x14004ec72
lea r9, [rdx + 2]
cmp cx, r11w
je 0x14004eb65
mov rdx, r9
mov word [rbx], cx
jmp 0x14004eb8c
cmp r9, r8
jae 0x14004eb9c
cmp word [r9], r13w
mov rax, r12
mov ecx, 4
cmove rax, rcx
add rdx, rax
mov eax, r13d
cmp word [r9], r13w
cmovne ax, r11w
mov word [rbx], ax
mov rax, r12
add rbx, rax
cmp rdx, r8
jb 0x14004eb46
jmp 0x14004ec51
lea r9, [rsp + 0x80]
mov qword [rsp + 0x20], rsi
mov r8d, r12d
lea rdx, [rsp + 0x70]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14004ec46
cmp dword [rsp + 0x80], esi
je 0x14004ec46
lea r8, [0x1401f4680]
mov rax, qword [r8 + rbp*8]
test byte [rax + rdi*8 + 0x38], 0x48
je 0x14004ec1e
movzx eax, word [rsp + 0x70]
cmp ax, r13w
jne 0x14004ebee
mov word [rbx], r13w
jmp 0x14004ec4e
mov ecx, recv
mov word [rsp + 0x78], ax
mov word [rbx], cx
mov rax, qword [r8 + rbp*8]
lea rcx, [rax + rdi*8]
mov al, byte [rsp + rsi + 0x78]
mov byte [rcx + rsi + 0x3a], al
inc rsi
cmp rsi, r12
jl 0x14004ebfb
mov rax, qword [r8 + rbp*8]
mov byte [rax + rdi*8 + 0x3c], r13b
jmp 0x14004ec4e
cmp word [rsp + 0x70], r13w
jne 0x14004ec2b
cmp rbx, r14
je 0x14004ebe8
mov rdx, 0xfffffffffffffffe
mov ecx, r15d
lea r8d, [rdx + 3]
call fcn.14004ea2c
cmp word [rsp + 0x70], r13w
je 0x14004ec51
mov ecx, recv
mov word [rbx], cx
add rbx, r12
sub rbx, r14
sar rbx, 1
lea eax, [rbx + rbx]
mov rbx, qword [rsp + 0x88]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea r8, [0x1401f4680]
mov rdx, qword [r8 + rbp*8]
mov al, byte [rdx + rdi*8 + 0x38]
test al, 0x40
jne 0x14004ec4b
or al, r12b
mov byte [rdx + rdi*8 + 0x38], al
jmp 0x14004ec51
Function at 0x140050634
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x14005064a
mov al, 1
jmp 0x1400506aa
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x14005065b
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x1400506a8
mov ecx, dword [rcx + 0x18]
nop
call fcn.140050d9c
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400506a8
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x1400506a8
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1400506a8
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x1400506aa
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x1400513e4
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x14005146b
mov rsi, rbx
cmp word [rax], bp
je 0x14005142a
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x140051414
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x140051410
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.14004a468
mov rdi, rax
test rax, rax
je 0x140051458
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.14014dae0
mov rbp, rdi
xor ecx, ecx
call fcn.14004a42c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140054d50
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140054d78
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140054d78
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140061b50
Capabilities:
Resolve dns

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
movzx ebp, r9w
mov r14, r8
mov rbx, rdx
test rdx, rdx
je 0x140061d88
movzx eax, word [rdx]
test ax, ax
je 0x140061d88
xor r15d, r15d
mov rdi, rdx
mov esi, r15d
movzx edx, ax
lea rcx, str.0123456789.:
call fcn.140030bf4
mov r13d, 0x17
lea r12d, [r13 - 0x15]
test rax, rax
je 0x140061ca2
add rdi, r12
inc esi
movzx eax, word [rdi]
test ax, ax
jne 0x140061b91
cmp esi, 7
jl 0x140061ca2
cmp ebp, r13d
jne 0x140061c3b
lea rdx, [0x1401b7670]
mov rcx, rbx
call fcn.140030c6c
test rax, rax
je 0x140061ca2
xorps xmm0, xmm0
lea r8, [rsp + 0x20]
mov rdx, rbx
mov ecx, r13d
movups xmmword [rsp + 0x20], xmm0
call qword [sym.imp.WS2_32.dll_InetPtonW]
cmp eax, 1
jne 0x140061ca2
mov rax, qword [rsp + 0x20]
lea rdi, [r14 + 8]
lea rsi, [rsp + 0x20]
mov ecx, 4
rep movsd dword [rdi], dword [rsi]
mov word [r14], r13w
sub rax, qword [0x1401ba830]
jne 0x140061c36
mov rax, qword [rsp + 0x28]
sub rax, qword [0x1401ba838]
test rax, rax
jmp 0x140061c94
cmp ebp, r12d
jne 0x140061ca2
lea rdx, [0x1401ba828]
mov rcx, rbx
call fcn.140030c6c
test rax, rax
je 0x140061ca2
lea r8, [rsp + 0xa0]
mov dword [rsp + 0xa0], r15d
mov rdx, rbx
mov ecx, r12d
call qword [sym.imp.WS2_32.dll_InetPtonW]
cmp eax, 1
jne 0x140061ca2
cmp dword [rsp + 0xa0], r15d
lea rdi, [r14 + 4]
lea rsi, [rsp + 0xa0]
mov ecx, 1
rep movsd dword [rdi], dword [rsi]
mov word [r14], r12w
setne al
test al, al
je 0x140061ca2
mov al, 1
jmp 0x140061d8a
xorps xmm0, xmm0
mov qword [rsp + 0x30], r15
xorps xmm1, xmm1
mov qword [rsp + 0xa8], r15
lea r9, [rsp + 0xa8]
mov dword [rsp + 0x38], 1
lea r8, [rsp + 0x30]
mov dword [rsp + 0x3c], 6
xor edx, edx
mov rcx, rbx
movdqu xmmword [rsp + 0x40], xmm0
movdqu xmmword [rsp + 0x50], xmm1
call qword [sym.imp.WS2_32.dll_GetAddrInfoW]
test eax, eax
jne 0x140061d88
mov rdx, qword [rsp + 0xa8]
test rdx, rdx
je 0x140061d88
xor dil, dil
mov rax, rdx
cmp dword [rax + 4], ebp
je 0x140061d25
mov rax, qword [rax + 0x28]
test rax, rax
jne 0x140061d08
mov rcx, rdx
call qword [sym.imp.WS2_32.dll_FreeAddrInfoW]
movzx eax, dil
jmp 0x140061d8a
mov rax, qword [rax + 0x20]
cmp ebp, r13d
jne 0x140061d5e
lea rsi, [rax + 8]
mov ecx, 4
lea rdi, [r14 + 8]
rep movsd dword [rdi], dword [rsi]
mov word [r14], r13w
mov rax, qword [r14 + 8]
sub rax, qword [0x1401f4d80]
jne 0x140061d59
mov rax, qword [r14 + 0x10]
sub rax, qword [0x1401f4d88]
test rax, rax
jmp 0x140061d75
lea rdi, [r14 + 4]
mov ecx, 1
lea rsi, [rax + 4]
rep movsd dword [rdi], dword [rsi]
mov word [r14], r12w
cmp dword [rax + 4], r15d
mov rcx, rdx
setne dil
call qword [sym.imp.WS2_32.dll_FreeAddrInfoW]
movzx eax, dil
jmp 0x140061d8a
xor al, al
mov rbx, qword [rsp + 0xb0]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140062500
Capabilities:
Resolve dns

Disassembly:
mov r11, rsp
mov dword [r11 + 0x18], r8d
mov qword [r11 + 0x10], rdx
mov qword [r11 + 8], rcx
push rbp
push r13
push r14
sub rsp, 0x70
mov r13, r9
mov rax, rdx
test rdx, rdx
je 0x140062712
test r9, r9
je 0x140062712
mov r14, qword [rsp + 0xb0]
mov ebp, dword [rsp + 0xb8]
cmp dword [r14], ebp
jge 0x140062712
mov qword [r11 - 0x30], r12
lea r9, [r11 + 8]
xor r12d, r12d
lea r8, [r11 - 0x68]
mov qword [r11 - 0x68], r12
xorps xmm0, xmm0
xorps xmm1, xmm1
mov dword [rsp + 0x28], 1
xor edx, edx
mov dword [rsp + 0x2c], 6
mov rcx, rax
mov qword [r11 + 8], r12
movdqu xmmword [rsp + 0x30], xmm0
movdqu xmmword [rsp + 0x40], xmm1
call qword [sym.imp.WS2_32.dll_GetAddrInfoW]
test eax, eax
jne 0x140062700
mov qword [rsp + 0xa8], rbx
mov rbx, qword [rsp + 0x90]
test rbx, rbx
je 0x1400626f8
mov qword [rsp + 0x50], r15
movzx r15d, word [rsp + 0xc0]
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x60], rdi
test r15w, r15w
je 0x1400625d5
cmp dword [rbx + 4], r15d
jne 0x1400626ce
mov eax, dword [rbx + 4]
cmp eax, 0x17
jne 0x140062661
cmp byte [0x14021bd61], 0
je 0x1400626ce
mov rsi, qword [rbx + 0x20]
add rsi, 8
mov rax, qword [rsi]
cmp rax, qword [0x1401f4d90]
jne 0x140062613
mov rax, qword [rsi + 8]
cmp rax, qword [0x1401f4d98]
je 0x1400626ce
movsxd rax, dword [r14]
cmp eax, ebp
jge 0x1400626ce
imul rdx, rax, 0x1c
xor eax, eax
mov ecx, 7
add rdx, r13
mov rdi, rdx
rep stosd dword [rdi], eax
lea rdi, [rdx + 8]
mov ecx, 4
rep movsd dword [rdi], dword [rsi]
movzx ecx, word [rsp + 0xa0]
call qword [sym.imp.WS2_32.dll_htons]
movsxd rcx, dword [r14]
imul r8, rcx, 0x1c
add r8, r13
mov word [r8 + 2], ax
mov word [r8], 0x17
jmp 0x1400626bb
cmp eax, 2
jne 0x1400626ce
mov rsi, qword [rbx + 0x20]
add rsi, 4
cmp dword [rsi], 0
je 0x1400626ce
movsxd rax, dword [r14]
cmp eax, ebp
jge 0x1400626ce
imul rdx, rax, 0x1c
xor eax, eax
mov ecx, 7
add rdx, r13
mov rdi, rdx
rep stosd dword [rdi], eax
lea rdi, [rdx + 4]
mov ecx, 1
rep movsd dword [rdi], dword [rsi]
movzx ecx, word [rsp + 0xa0]
call qword [sym.imp.WS2_32.dll_htons]
movsxd rcx, dword [r14]
imul r8, rcx, 0x1c
add r8, r13
mov word [r8 + 2], ax
mov word [r8], 2
mov rdx, qword [rsp + 0x98]
call fcn.140062390
inc dword [r14]
inc r12d
mov rbx, qword [rbx + 0x28]
test rbx, rbx
jne 0x1400625c5
mov rcx, qword [rsp + 0x90]
mov r15, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
call qword [sym.imp.WS2_32.dll_FreeAddrInfoW]
mov rbx, qword [rsp + 0xa8]
mov eax, r12d
mov r12, qword [rsp + 0x58]
add rsp, 0x70
pop r14
pop r13
pop rbp
ret
xor eax, eax
add rsp, 0x70
pop r14
pop r13
pop rbp
ret
Function at 0x140069d20
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x30
cmp byte [rcx + 0x240], 0
mov rbx, rcx
je 0x140069e52
xor ebp, ebp
mov qword [rcx + 0x248], rdx
mov dword [rcx + 0x250], r8d
test rdx, rdx
jne 0x140069d61
mov eax, ebp
jmp 0x140069d6f
mov ecx, dword [rcx + 0x2dc]
mov r8d, r8d
call fcn.140074930
mov dword [rbx + 0x2dc], eax
nop word [rax + rax]
cmp dword [rbx + 0x250], ebp
jbe 0x140069e4e
cmp dword [rbx + 0x268], ebp
jne 0x140069e11
mov rcx, qword [rbx + 0x228]
mov r8d, dword [rbx + 0x2ac]
mov rdx, qword [rbx + 0x2d0]
mov eax, ebp
mov dword [rsp + 0x50], eax
cmp rcx, 0xffffffffffffffff
je 0x140069ddf
test rdx, rdx
je 0x140069ddf
test r8d, r8d
je 0x140069ddf
lea r9, [rsp + 0x50]
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x140069ddb
mov eax, ebp
mov dword [rsp + 0x50], eax
jmp 0x140069ddf
mov eax, dword [rsp + 0x50]
lock add qword [0x1401f4d68], rax
mov eax, dword [rbx + 0x2ac]
cmp dword [rsp + 0x50], eax
jne 0x140069e52
mov rax, qword [rbx + 0x2d0]
mov qword [rbx + 0x260], rax
mov dword [rbx + 0x2ac], ebp
mov dword [rbx + 0x268], 0x100000
mov rdi, qword [rbx + 0x270]
lea rcx, [rbx + 0x248]
xor edx, edx
lea r14, [rbx + 0x2ac]
call fcn.140079520
mov ecx, dword [rbx + 0x270]
sub ecx, edi
add ecx, dword [rbx + 0x2ac]
mov dword [r14], ecx
test eax, eax
je 0x140069d80
cmp eax, 2
sete al
jmp 0x140069e54
mov al, 1
jmp 0x140069e54
xor al, al
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
Function at 0x14006a630
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
xor ebx, ebx
movsxd rdi, r8d
test r8d, r8d
jle 0x14006a660
mov eax, ebx
nop word [rax + rax]
mov byte [rsp + rax + 0x40], dl
inc rax
shr rdx, 8
cmp rax, rdi
jl 0x14006a650
mov rcx, qword [rcx + 0x228]
mov dword [rsp + 0x50], ebx
cmp rcx, 0xffffffffffffffff
je 0x14006a69c
test r8d, r8d
je 0x14006a69c
lea r9, [rsp + 0x50]
mov qword [rsp + 0x20], rbx
mov r8d, edi
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x14006a698
mov dword [rsp + 0x50], ebx
jmp 0x14006a69c
mov ebx, dword [rsp + 0x50]
mov eax, ebx
lock add qword [0x1401f4d68], rax
cmp dword [rsp + 0x50], edi
mov rbx, qword [rsp + 0x48]
sete al
add rsp, 0x30
pop rdi
ret

Function at 0x14006a6c0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
xor ebx, ebx
movsxd rdi, r8d
test r8d, r8d
jle 0x14006a6ef
mov eax, ebx
nop word [rax + rax]
mov byte [rsp + rax + 0x40], dl
inc rax
shr edx, 8
cmp rax, rdi
jl 0x14006a6e0
mov rcx, qword [rcx + 0x228]
mov dword [rsp + 0x50], ebx
cmp rcx, 0xffffffffffffffff
je 0x14006a72b
test r8d, r8d
je 0x14006a72b
lea r9, [rsp + 0x50]
mov qword [rsp + 0x20], rbx
mov r8d, edi
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x14006a727
mov dword [rsp + 0x50], ebx
jmp 0x14006a72b
mov ebx, dword [rsp + 0x50]
mov eax, ebx
lock add qword [0x1401f4d68], rax
cmp dword [rsp + 0x50], edi
mov rbx, qword [rsp + 0x48]
sete al
add rsp, 0x30
pop rdi
ret
Function at 0x14006d820
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r13
push r15
sub rsp, 0x30
mov rsi, rcx
mov ebx, edx
xor ecx, ecx
xor r15b, r15b
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
movzx edx, bx
lea r8, [0x1401c30d8]
mov rcx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbp, rax
test rax, rax
je 0x14006d9c9
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
cmp eax, 0x10
jbe 0x14006d9c9
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
test rax, rax
je 0x14006d9c9
mov edx, ebx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rbp, rax
test rax, rax
je 0x14006d9c9
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
test rax, rax
je 0x14006d99f
mov r8d, ebx
mov rdx, rdi
mov rcx, rax
call fcn.14014dae0
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea r8, [rsp + 0x50]
mov qword [rsp + 0x50], 0
xor edx, edx
mov rcx, rbp
call qword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
jne 0x14006d99f
mov rcx, qword [rsp + 0x50]
call fcn.140019460
mov rcx, qword [rsp + 0x50]
mov rdi, rax
mov rdx, qword [rcx]
call qword [rdx + reloc.WS2_32.dll_recv]
test rdi, rdi
je 0x14006d99f
mov r9d, dword [rsp + 0x70]
lea rcx, [rsi + 0x48]
mov edx, 0x1e0
mov qword [rsp + 0x20], 0
mov r8d, 0xfc
call fcn.140019530
test al, al
je 0x14006d992
mov r8d, dword [rsp + 0x70]
lea rdx, [rsp + 0x20]
mov rcx, qword [rdi + 8]
call qword [sym.imp.gdiplus.dll_GdipCreateHBITMAPFromBitmap]
test eax, eax
je 0x14006d965
mov dword [rdi + 0x10], eax
jmp 0x14006d992
mov rbx, qword [rsp + 0x20]
test rbx, rbx
je 0x14006d992
mov r8d, dword [rsp + 0x70]
mov rdx, rbx
mov rcx, qword [rsi + 0x50]
call qword [sym.imp.COMCTL32.dll_ImageList_AddMasked]
test rbx, rbx
je 0x14006d98f
mov rcx, rbx
call qword [sym.imp.GDI32.dll_DeleteObject]
mov r15b, 1
mov rax, qword [rdi]
mov edx, 1
mov rcx, rdi
call qword [rax]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GlobalFree]
test r15b, r15b
je 0x14006d9c9
mov rcx, qword [rsi + 0x50]
call qword [sym.imp.COMCTL32.dll_ImageList_GetImageCount]
mov dword [rsi + 0x58], eax
mov al, 1
mov dword [rsi + 0x5c], 0
mov byte [rsi + 0x60], 0
jmp 0x14006d9cb
xor al, al
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r13
pop rdi
ret
Function at 0x14006f2c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
xor ebp, ebp
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
cmp qword [rcx + 0x120], rbp
je 0x14006f2ef
mov qword [rcx + 0x120], rbp
mov rcx, qword [rcx + 0x118]
test rcx, rcx
je 0x14006f308
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov qword [rbx + 0x118], rbp
mov rdx, rdi
mov qword [rbx + 0x128], rbp
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [rbx + 0x128], eax
cmp eax, 0x390
jb 0x14006f369
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov qword [rbx + 0x118], rax
test rax, rax
je 0x14006f369
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [rbx + 0x120], rax
test rax, rax
jne 0x14006f373
mov rcx, qword [rbx + 0x118]
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov qword [rbx + 0x118], rbp
mov dword [rbx + 0x128], ebp
xor al, al
jmp 0x14006f375
mov al, 1
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140072600
Capabilities:
Read file on windows

Disassembly:
push rsi
mov eax, 0x2040
call fcn.14002f320
sub rsp, rax
mov rsi, rcx
mov rcx, qword [rdx + 8]
test rcx, rcx
je 0x1400726fc
mov qword [rsp + 0x2060], rbp
xor r9d, r9d
xor ebp, ebp
mov qword [rsp + 0x2068], rdi
mov qword [rsp + 0x30], rbp
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
lea r8d, [rbp + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1400726ec
mov qword [rsp + 0x2050], rbx
nop dword [rax]
mov ebx, ebp
mov r8d, 0x2000
mov eax, ebx
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x2058], ebp
sub r8d, ebx
mov qword [rsp + 0x20], rbp
add rdx, rax
lea r9, [rsp + 0x2058]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400726bb
mov eax, dword [rsp + 0x2058]
test eax, eax
je 0x1400726bb
add ebx, eax
cmp ebx, 0x2000
jb 0x140072672
mov eax, ebx
lock add qword [0x1401f4d70], rax
test ebx, ebx
je 0x1400726db
mov r8d, ebx
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.140072a10
jmp 0x140072670
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x2050]
mov rbp, qword [rsp + 0x2060]
mov rdi, qword [rsp + 0x2068]
add rsp, 0x2040
pop rsi
ret

Function at 0x140072870
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov r11d, edx
mov ebx, r9d
test r8, r8
je 0x1400728cb
test ebx, ebx
je 0x1400728cb
test rcx, rcx
je 0x140072901
xor r10d, r10d
test edx, edx
je 0x140072901
xor r9b, r9b
nop dword [rax + rax]
xor edx, edx
lea rcx, [rcx + 1]
mov eax, r10d
inc r10d
div ebx
add r9b, byte [rdx + r8]
xor byte [rcx - 1], r9b
movzx r9d, byte [rcx - 1]
cmp r10d, r11d
jb 0x1400728a0
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
ret
test rcx, rcx
je 0x140072901
test edx, edx
je 0x140072901
xor dl, dl
lea r9, [0x1401be080]
xor r10d, r10d
mov r8, r11
mov rax, r10
lea rcx, [rcx + 1]
and eax, 0xf
inc r10
add dl, byte [r9 + rax*4]
xor byte [rcx - 1], dl
movzx edx, byte [rcx - 1]
sub r8, 1
jne 0x1400728e3
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
ret

Function at 0x140072980
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
test rcx, rcx
je 0x1400729b1
test edx, edx
je 0x1400729b1
xor r9b, r9b
mov edx, edx
xor r10d, r10d
mov rax, r10
lea rcx, [rcx + 1]
and eax, 0xf
inc r10
add r9b, byte [r8 + rax*4]
xor byte [rcx - 1], r9b
movzx r9d, byte [rcx - 1]
sub rdx, 1
jne 0x140072991
ret

Function at 0x1400729c0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov r9, rcx
test rcx, rcx
je 0x140072a04
test edx, edx
je 0x140072a04
xor al, al
mov r11d, edx
xor r10d, r10d
nop dword [rax]
nop dword [rax + rax]
movzx edx, byte [r9]
lea r9, [r9 + 1]
mov rcx, r10
inc r10
and ecx, 0xf
add al, byte [r8 + rcx*4]
xor al, dl
mov byte [r9 - 1], al
movzx eax, dl
sub r11, 1
jne 0x1400729e0
ret
Function at 0x140078220
Capabilities:
Compute adler32 checksum

Disassembly:
mov r9d, ecx
mov r10, rdx
shr r9d, 0x10
movzx ecx, cx
cmp r8, 1
jne 0x140078264
movzx edx, byte [rdx]
add edx, ecx
cmp edx, 0xfff1
lea r8d, [rdx - 0xfff1]
cmovb r8d, edx
lea eax, [r8 + r9]
cmp eax, 0xfff1
lea ecx, [rax - 0xfff1]
cmovb ecx, eax
shl ecx, 0x10
or ecx, r8d
mov eax, ecx
ret
test rdx, rdx
jne 0x14007826d
lea eax, [rdx + 1]
ret
cmp r8, 0x10
jae 0x1400782bc
test r8, r8
je 0x140078293
nop dword [rax + rax]
movzx eax, byte [r10]
lea r10, [r10 + 1]
add ecx, eax
add r9d, ecx
sub r8, 1
jne 0x140078280
cmp ecx, 0xfff1
lea r8d, [rcx - 0xfff1]
mov eax, 0x80078071
cmovb r8d, ecx
mul r9d
shr edx, 0xf
imul eax, edx, 0xf
add eax, r9d
shl eax, 0x10
or eax, r8d
ret
cmp r8, 0x15b0
jb 0x140078397
mov r11, r8
movabs rax, 0x79baa6bb6398b6f7
mul r8
sub r11, rdx
shr r11, 1
add r11, rdx
shr r11, 0xc
imul rax, r11, 0xffffffffffffea50
add r8, rax
mov edx, 0x2b6
nop word [rax + rax]
movzx eax, byte [r10]
add ecx, eax
movzx eax, byte [r10 + 1]
add r9d, ecx
add ecx, eax
movzx eax, byte [r10 + 2]
add r9d, ecx
add ecx, eax
movzx eax, byte [r10 + 3]
add r9d, ecx
add ecx, eax
movzx eax, byte [r10 + 4]
add r9d, ecx
add ecx, eax
movzx eax, byte [r10 + 5]
add r9d, ecx
add ecx, eax
movzx eax, byte [r10 + 6]
add r9d, ecx
add ecx, eax
movzx eax, byte [r10 + 7]
add r9d, ecx
add r10, 8
add ecx, eax
add r9d, ecx
add edx, 0xffffffff
jne 0x140078300
mov eax, 0x80078071
mul ecx
shr edx, 0xf
imul eax, edx, 0xffff000f
add ecx, eax
mov eax, 0x80078071
mul r9d
shr edx, 0xf
imul eax, edx, 0xffff000f
add r9d, eax
sub r11, 1
jne 0x1400782f0
test r8, r8
je 0x140078449
cmp r8, 8
jb 0x140078410
mov rdx, r8
shr rdx, 3
imul rax, rdx, 0xfffffffffffffff8
add r8, rax
nop word [rax + rax]
movzx eax, byte [r10]
add ecx, eax
movzx eax, byte [r10 + 1]
add r9d, ecx
add ecx, eax
movzx eax, byte [r10 + 2]
add r9d, ecx
add ecx, eax
movzx eax, byte [r10 + 3]
add r9d, ecx
add ecx, eax
movzx eax, byte [r10 + 4]
add r9d, ecx
add ecx, eax
movzx eax, byte [r10 + 5]
add r9d, ecx
add ecx, eax
movzx eax, byte [r10 + 6]
add r9d, ecx
add ecx, eax
movzx eax, byte [r10 + 7]
add r9d, ecx
add r10, 8
add ecx, eax
add r9d, ecx
sub rdx, 1
jne 0x1400783b0
test r8, r8
je 0x140078423
nop
movzx eax, byte [r10]
lea r10, [r10 + 1]
add ecx, eax
add r9d, ecx
sub r8, 1
jne 0x140078410
mov eax, 0x80078071
mul ecx
mov eax, 0x80078071
shr edx, 0xf
imul edx, edx, 0xffff000f
add ecx, edx
mul r9d
shr edx, 0xf
imul edx, edx, 0xffff000f
add r9d, edx
shl r9d, 0x10
or r9d, ecx
mov eax, r9d
ret