joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140066b1c
Capabilities:
Query environment variable

Disassembly:
jmp 0x140102d44
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor r14d, r14d
mov rbx, rax
test rax, rax
je 0x140102e2c
mov rsi, rax
cmp word [rax], r14w
je 0x140102d97
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], r14w
jne 0x140102d7f
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], r14w
jne 0x140102d7b
mov qword [rsp + 0x38], r14
sub rsi, rbx
mov qword [rsp + 0x30], r14
add rsi, 2
sar rsi, 1
mov r8, rbx
mov r9d, esi
mov dword [rsp + 0x28], r14d
xor edx, edx
mov qword [rsp + 0x20], r14
xor ecx, ecx
call fcn.140067530
movsxd rbp, eax
test eax, eax
je 0x140102e2c
mov r9d, 0x66
lea r8, str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
mov rcx, rbp
lea edx, [r9 - 0x64]
call fcn.1400668ce
mov rdi, rax
test rax, rax
je 0x140102e1a
mov qword [rsp + 0x38], r14
mov r9d, esi
mov qword [rsp + 0x30], r14
mov r8, rbx
mov dword [rsp + 0x28], ebp
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rax
call fcn.140067530
test eax, eax
je 0x140102e1a
mov rsi, rdi
mov rdi, r14
jmp 0x140102e1d
mov rsi, r14
mov edx, 2
mov rcx, rdi
call fcn.1400658c5
jmp 0x140102e2f
mov rsi, r14
test rbx, rbx
je 0x140102e3d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rbx, qword [rsp + 0x50]
mov rax, rsi
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x140066b26
Capabilities:
Allocate thread local storage

Disassembly:
jmp 0x1400992b0
mov qword [rsp + 8], rcx
sub rsp, 0x48
call fcn.140098c80
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1400992f1
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x140183020]
jmp 0x1400992f7
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
add rsp, 0x48
ret

Function at 0x140066b99
Capabilities:
Get geographical location

Disassembly:
jmp 0x1400fb750
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x48
call fcn.1400fa6d0
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x1400fb7a3
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x38], rax
mov r9d, dword [rsp + 0x68]
mov r8, qword [rsp + 0x60]
mov edx, dword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x38]
call qword [0x140183020]
jmp 0x1400fb7c5
xor edx, edx
mov rcx, qword [rsp + 0x50]
call fcn.1400663e7
mov r9d, dword [rsp + 0x68]
mov r8, qword [rsp + 0x60]
mov edx, dword [rsp + 0x58]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
add rsp, 0x48
ret
Function at 0x140066ba3
Capabilities:
Terminate process

Disassembly:
jmp 0x140076700
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x140066dc9
Capabilities:
Print debug messages

Disassembly:
jmp 0x1401191e0
mov qword [rsp + 8], rcx
push rbp
sub rsp, 0x50
lea rbp, [rsp + 0x30]
mov rax, qword [0x140170018]
xor rax, rbp
mov qword [rbp + 0x18], rax
cmp qword [rbp + 0x30], 0
jne 0x140119206
jmp 0x140119283
mov rcx, qword [rbp + 0x30]
call fcn.140066699
inc rax
mov qword [rbp], rax
cmp qword [rbp], 0
jne 0x14011921f
jmp 0x140119283
mov rax, qword [rbp]
shl rax, 1
mov rcx, rax
add rcx, 0xf
cmp rcx, rax
ja 0x14011923c
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1400658f7
sub rsp, rax
lea rax, [rsp + 0x30]
mov qword [rbp + 8], rax
mov rax, qword [rbp]
dec rax
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0x30]
mov r8, qword [rbp]
mov rdx, qword [rbp + 8]
lea rcx, [rbp + 0x10]
call fcn.140065cda
test eax, eax
jne 0x140119283
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [rbp + 0x18]
xor rcx, rbp
call fcn.140066851
lea rsp, [rbp + 0x20]
pop rbp
ret

Function at 0x14006721f
Capabilities:
Parse pe header

Disassembly:
jmp 0x140077230
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140077250
xor al, al
jmp 0x1400772d1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140077263
xor al, al
jmp 0x1400772d1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14007728d
xor al, al
jmp 0x1400772d1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x1400772a1
xor al, al
jmp 0x1400772d1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x1400772b3
xor al, al
jmp 0x1400772d1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x1400772cf
xor al, al
jmp 0x1400772d1
mov al, 1
add rsp, 0x38
ret
Function at 0x1400676a7
Capabilities:
Terminate process

Disassembly:
jmp 0x140099f90
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov ecx, 0x17
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x140099fbe
mov ecx, 5
int 0x29
mov r8d, 1
mov edx, 0xc0000417
mov ecx, 2
call fcn.140067e18
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000417
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x140067751
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x1400fb540
mov dword [rsp + 8], ecx
sub rsp, 0x38
call fcn.1400fa550
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1400fb575
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov ecx, dword [rsp + 0x40]
mov rax, qword [rsp + 0x28]
call qword [0x140183020]
jmp 0x1400fb57f
mov ecx, dword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add rsp, 0x38
ret

Function at 0x140067bde
Capabilities:
Set thread local storage value

Disassembly:
jmp 0x1400fb5a0
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x38
call fcn.1400fa590
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1400fb5df
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rdx, qword [rsp + 0x48]
mov ecx, dword [rsp + 0x40]
mov rax, qword [rsp + 0x28]
call qword [0x140183020]
jmp 0x1400fb5ee
mov rdx, qword [rsp + 0x48]
mov ecx, dword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
add rsp, 0x38
ret

Function at 0x140067e6d
Capabilities:
Print debug messages

Disassembly:
jmp 0x1400f8d70
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
add rsp, 0x28
ret
Function at 0x140067f03
Capabilities:
Set thread local storage value

Disassembly:
jmp 0x1400993f0
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.140098d40
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x140099439
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rdx, qword [rsp + 0x58]
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x140183020]
jmp 0x140099448
mov rdx, qword [rsp + 0x58]
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
add rsp, 0x48
ret

Function at 0x140067fa3
Capabilities:
Set environment variable

Disassembly:
jmp 0x14011c4d0
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xa8
lea rcx, [rsp + 0x70]
call fcn.1400662c0
lea rcx, [rsp + 0x40]
call fcn.1400662c0
call fcn.140066ad1
mov r8d, eax
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0xb0]
call fcn.1400660e5
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x14011c53f
mov dword [rsp + 0x24], 0
lea rcx, [rsp + 0x40]
call fcn.1400665b8
lea rcx, [rsp + 0x70]
call fcn.1400665b8
mov eax, dword [rsp + 0x24]
jmp 0x14011c5cc
call fcn.140066ad1
mov r8d, eax
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0xb8]
call fcn.1400660e5
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0
je 0x14011c586
mov dword [rsp + 0x2c], 0
lea rcx, [rsp + 0x40]
call fcn.1400665b8
lea rcx, [rsp + 0x70]
call fcn.1400665b8
mov eax, dword [rsp + 0x2c]
jmp 0x14011c5cc
lea rcx, [rsp + 0x40]
call fcn.140066248
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x70]
call fcn.140066248
mov rcx, qword [rsp + 0x38]
mov rdx, rcx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov dword [rsp + 0x30], eax
lea rcx, [rsp + 0x40]
call fcn.1400665b8
lea rcx, [rsp + 0x70]
call fcn.1400665b8
mov eax, dword [rsp + 0x30]
add rsp, 0xa8
ret
Function at 0x6d7d4320
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x6d7f55e4]
test esi, esi
mov rbx, rcx
mov rbp, rdx
mov rdi, r8
jle 0x6d7d44a8
mov rax, qword [0x6d7f55e8]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp rbx, rdx
jb 0x6d7d436c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rbx, rdx
jb 0x6d7d43f5
add ecx, 1
add rax, 0x28
cmp ecx, esi
jne 0x6d7d4350
mov rcx, rbx
call sym.__mingw_GetSectionForAddress
test rax, rax
mov r12, rax
je 0x6d7d44dd
mov rax, qword [0x6d7f55e8]
lea rsi, [rsi + rsi*4]
shl rsi, 3
add rax, rsi
mov qword [rax + 0x20], r12
mov dword [rax], 0
call sym._GetPEImageBase
mov ecx, dword [r12 + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x6d7f55e8]
mov qword [rax + rsi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x6d7d44c0
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x6d7d43ee
sub eax, 0x40
and eax, 0xffffffbf
jne 0x6d7d4450
add dword [0x6d7f55e4], 1
cmp edi, 8
jae 0x6d7d4423
test dil, 4
jne 0x6d7d4494
test edi, edi
je 0x6d7d4418
movzx eax, byte [rbp]
test dil, 2
mov byte [rbx], al
jne 0x6d7d44af
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov eax, edi
sub edi, 1
mov rdx, qword [rbp + rax - 8]
cmp edi, 8
mov qword [rbx + rax - 8], rdx
jb 0x6d7d4418
and edi, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov rcx, qword [rbp + rdx]
cmp eax, edi
mov qword [rbx + rdx], rcx
jb 0x6d7d443c
jmp 0x6d7d4418
add rsi, qword [0x6d7f55e8]
mov r8d, 0x40
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r9, rsi
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x6d7d43ee
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call sym.__report_error
mov eax, dword [rbp]
mov edi, edi
mov dword [rbx], eax
mov eax, dword [rbp + rdi - 4]
mov dword [rbx + rdi - 4], eax
jmp 0x6d7d4418
xor esi, esi
jmp 0x6d7d4377
mov edi, edi
movzx eax, word [rbp + rdi - 2]
mov word [rbx + rdi - 2], ax
jmp 0x6d7d4418
mov rax, qword [0x6d7f55e8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov edx, dword [r12 + 8]
mov r8, qword [rax + rsi + 0x18]
call sym.__report_error
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call sym.__report_error
nop
nop dword [rax]

Function at 0x6d7d4c30
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x6d7f58c0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x6d7f58a0]
test rbx, rbx
je 0x6d7d4c84
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x6d7d4c7b
test rsi, rsi
je 0x6d7d4c7b
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x6d7d4c60
lea rcx, [0x6d7f58c0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x6d7d4ec0
Capabilities:
Parse pe header

Disassembly:
cmp word [rcx], 0x5a4d
je 0x6d7d4ed0
xor eax, eax
ret
jmp sym._ValidateImageBase.part.0

Function at 0x6d7d4ee0
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x6d7d4f21
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
mov r8d, dword [rax + 0xc]
cmp r8, rdx
mov rcx, r8
ja 0x6d7d4f18
add ecx, dword [rax + 8]
cmp rcx, rdx
ja 0x6d7d4f23
add rax, 0x28
cmp rax, r9
jne 0x6d7d4f04
xor eax, eax
ret

Function at 0x6d7d4fc0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x6d7f21f0]
cmp word [r8], 0x5a4d
mov rdx, rcx
jne 0x6d7d502d
mov rcx, r8
call sym._ValidateImageBase.part.0
test eax, eax
je 0x6d7d502d
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x6d7d502d
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x6d7d5024
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x6d7d502f
add rax, 0x28
cmp rax, r9
jne 0x6d7d5010
xor eax, eax
add rsp, 0x28
ret

Function at 0x6d7d5130
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x6d7f21f0]
xor eax, eax
cmp word [r8], 0x5a4d
mov rdx, rcx
je 0x6d7d5150
add rsp, 0x28
ret
mov rcx, r8
call sym._ValidateImageBase.part.0
test eax, eax
je 0x6d7d5148
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x6d7d51ad
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x6d7d51a4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x6d7d51b4
add rax, 0x28
cmp rax, r9
jne 0x6d7d5190
xor eax, eax
add rsp, 0x28
ret
mov eax, dword [rax + 0x24]
not eax
shr eax, 0x1f
add rsp, 0x28
ret

Function at 0x6d7d51d0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r11, qword [0x6d7f21f0]
cmp word [r11], 0x5a4d
mov r9d, ecx
jne 0x6d7d523e
mov rcx, r11
call sym._ValidateImageBase.part.0
test eax, eax
je 0x6d7d523e
movsxd rax, dword [r11 + 0x3c]
add rax, r11
mov edx, dword [rax + 0x90]
test edx, edx
je 0x6d7d523e
movzx ecx, word [rax + 0x14]
lea rcx, [rax + rcx + 0x18]
movzx eax, word [rax + 6]
test eax, eax
je 0x6d7d523e
sub eax, 1
lea rax, [rax + rax*4]
lea rax, [rcx + rax*8 + 0x28]
mov r10d, dword [rcx + 0xc]
cmp rdx, r10
mov r8, r10
jb 0x6d7d5235
add r8d, dword [rcx + 8]
cmp rdx, r8
jb 0x6d7d5245
add rcx, 0x28
cmp rcx, rax
jne 0x6d7d5220
xor eax, eax
add rsp, 0x28
ret
add rdx, r11
jne 0x6d7d5258
jmp 0x6d7d523e
sub r9d, 1
add rdx, 0x14
mov ecx, dword [rdx + 4]
test ecx, ecx
jne 0x6d7d5266
mov eax, dword [rdx + 0xc]
test eax, eax
je 0x6d7d523e
test r9d, r9d
jg 0x6d7d5250
mov eax, dword [rdx + 0xc]
add rax, r11
add rsp, 0x28
ret
Function at 0x6d7d55a0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call sym.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call sym.__acrt_iob_func
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sym.vfprintf
call sym.abort
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x14000cf00
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x80
mov rbx, r8
mov edi, edx
test r8, r8
je 0x14000d0d0
mov rax, qword [rcx]
call qword [rax]
mov rbp, rax
test edi, edi
je 0x14000cf70
cmp edi, 3
je 0x14000cf70
sub edi, 1
je 0x14000cf5f
cmp edi, 1
jne 0x14000d0d0
movzx edx, bx
mov rcx, rax
call qword [sym.imp.USER32.dll_LoadIconW]
jmp 0x14000d0d2
movzx edx, bx
mov rcx, rbp
call qword [sym.imp.USER32.dll_LoadCursorW]
jmp 0x14000d0d2
movzx edx, bx
mov r8d, 0xa
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov r15, rax
test rax, rax
je 0x14000d0d0
xor ebx, ebx
mov esi, ebx
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r14, rax
test rax, rax
je 0x14000d0d0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r12, rax
test rax, rax
je 0x14000d036
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
mov qword [rsp + 0x70], rbx
mov rdx, r15
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r8d, eax
mov rdx, r12
lea rcx, [rsp + 0x50]
call fcn.14000aba0
test rax, rax
je 0x14000d00f
mov rsi, qword [rsp + 0x50]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
mov qword [rsp + 0x70], rbx
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x14000d036
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
mov qword [rsp + 0x70], rbx
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FreeResource]
test rsi, rsi
je 0x14000d0d0
cmp edi, 3
jne 0x14000d0cb
lea r8, [rsp + 0x30]
lea edx, [rdi + 0x1d]
mov rcx, rsi
call qword [sym.imp.GDI32.dll_GetObjectW]
test eax, eax
je 0x14000d0bd
mov edx, dword [rsp + 0x38]
test edx, edx
je 0x14000d0bd
lea ecx, [rdx + 1]
and ecx, 0xfffffffe
mov dword [rsp + 0x20], 1
xor r9d, r9d
lea r8d, [rdi + 0x1e]
call qword [sym.imp.COMCTL32.dll_ImageList_Create]
mov rdi, rax
test rax, rax
je 0x14000d0bd
mov r8d, 0xff00ff
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.COMCTL32.dll_ImageList_AddMasked]
test eax, eax
jns 0x14000d0ba
mov rcx, rdi
call qword [sym.imp.COMCTL32.dll_ImageList_Destroy]
mov rcx, rsi
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rax, rbx
jmp 0x14000d0d2
mov rbx, rdi
mov rcx, rsi
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rax, rbx
jmp 0x14000d0d2
mov rax, rsi
jmp 0x14000d0d2
xor eax, eax
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
Function at 0x14000d190
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push r14
sub rsp, 0x20
xor esi, esi
mov r14, r9
mov qword [r8 + 0x28], rsi
mov rbx, r8
mov rbp, rdx
test rdx, rdx
jne 0x14000d1c2
lea eax, [rdx + 1]
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rsi
pop rbp
ret
mov rax, qword [rcx]
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], r15
call qword [rax]
movzx edx, bp
mov r8, r14
mov rcx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov r15, rax
test rax, rax
je 0x14000d2b7
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbp, rax
test rax, rax
je 0x14000d2b7
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r14, rax
test rax, rax
je 0x14000d2ae
mov rdx, r15
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov qword [rbx + 0x28], rsi
cmp qword [rbx + 0x20], rdi
jl 0x14000d28c
cmp rdi, 1
jne 0x14000d24a
movzx ecx, byte [r14]
mov rax, qword [rbx + 0x18]
mov byte [rax], cl
inc qword [rbx + 0x28]
jmp 0x14000d2a9
cmp rdi, 2
jne 0x14000d261
movzx ecx, word [r14]
mov rax, qword [rbx + 0x18]
mov word [rax], cx
add qword [rbx + 0x28], rdi
jmp 0x14000d2a9
cmp rdi, 4
jne 0x14000d276
mov ecx, dword [r14]
mov rax, qword [rbx + 0x18]
mov dword [rax], ecx
add qword [rbx + 0x28], rdi
jmp 0x14000d2a9
cmp rdi, 8
jne 0x14000d28c
mov rcx, qword [r14]
mov rax, qword [rbx + 0x18]
mov qword [rax], rcx
add qword [rbx + 0x28], rdi
jmp 0x14000d2a9
test eax, eax
je 0x14000d2a9
mov rdx, rdi
mov rcx, rbx
call fcn.14000e9c0
mov r8, rdi
mov rdx, r14
mov rcx, rax
call fcn.1400157f0
mov esi, 1
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov r15, qword [rsp + 0x48]
mov rax, rsi
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rsi
pop rbp
ret
Function at 0x14000d990
Capabilities:
Accept command line arguments

Disassembly:
push rdi
push r14
sub rsp, 0x28
mov r14, rcx
call fcn.140009db0
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
movzx edx, word [rax]
test dx, dx
je 0x14000d9c3
nop
cmp dx, 0x20
ja 0x14000d9c3
movzx edx, word [rax + 2]
add rax, 2
test dx, dx
jne 0x14000d9b0
movzx r8d, word [rax]
movzx ecx, r8w
cmp r8w, 0x22
jne 0x14000d9d6
movzx ecx, word [rax + 2]
mov edx, 0x22
lea rdi, [rax + 2]
mov r9d, 0x20
cmovne rdi, rax
cmovne dx, r9w
cmp cx, dx
je 0x14000da05
test cx, cx
je 0x14000da0e
movzx ecx, word [rdi + 2]
add rdi, 2
cmp cx, dx
jne 0x14000d9f3
test cx, cx
je 0x14000da0e
add rdi, 2
cmp r8w, 0x22
jne 0x14000da1f
cmp word [rdi], r9w
jne 0x14000da1f
add rdi, 2
movzx eax, word [rdi]
test ax, ax
je 0x14000dbae
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x20], r15
xor r15d, r15d
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbp
cmp ax, 0x22
jne 0x14000daf2
movzx eax, word [rdi + 2]
add rdi, 2
mov rsi, rdi
test ax, ax
je 0x14000da73
nop dword [rax]
cmp ax, 0x22
je 0x14000da73
movzx eax, word [rsi + 2]
add rsi, 2
test ax, ax
jne 0x14000da60
mov rbx, rsi
sub rbx, rdi
sar rbx, 1
test rbx, rbx
jle 0x14000daa8
mov rax, qword [r14]
add rbx, rbx
mov rcx, r14
lea rdx, [rbx + 2]
call qword [rax]
mov r8, rbx
mov rdx, rdi
mov rcx, rax
mov rbp, rax
call fcn.1400157f0
mov word [rbx + rbp], r15w
jmp 0x14000daab
mov rbp, r15
mov rbx, qword [r14 + 0x30]
lea rcx, [r14 + 8]
mov rax, qword [rcx + 0x20]
sub rax, rbx
cmp rax, 8
jl 0x14000dacf
mov rax, qword [rcx + 0x18]
mov qword [rbx + rax], rbp
add qword [rcx + 0x28], 8
jmp 0x14000dadc
lea rdx, [rbx + 8]
call fcn.14000e9c0
mov qword [rax + rbx], rbp
mov rdi, rsi
cmp word [rsi], r15w
je 0x14000db8e
lea rdi, [rsi + 2]
jmp 0x14000db8e
cmp ax, 0x20
jbe 0x14000db8a
mov rsi, rdi
nop
cmp ax, 0x22
je 0x14000db19
cmp ax, 0x20
jbe 0x14000db19
movzx eax, word [rsi + 2]
add rsi, 2
test ax, ax
jne 0x14000db00
mov rbx, rsi
sub rbx, rdi
sar rbx, 1
test rbx, rbx
jle 0x14000db4e
mov rax, qword [r14]
add rbx, rbx
mov rcx, r14
lea rdx, [rbx + 2]
call qword [rax]
mov r8, rbx
mov rdx, rdi
mov rcx, rax
mov rbp, rax
call fcn.1400157f0
mov word [rbx + rbp], r15w
jmp 0x14000db51
mov rbp, r15
mov rbx, qword [r14 + 0x30]
lea rcx, [r14 + 8]
mov rax, qword [rcx + 0x20]
sub rax, rbx
cmp rax, 8
jl 0x14000db78
mov rax, qword [rcx + 0x18]
mov rdi, rsi
mov qword [rbx + rax], rbp
add qword [rcx + 0x28], 8
jmp 0x14000db8e
lea rdx, [rbx + 8]
call fcn.14000e9c0
mov rdi, rsi
mov qword [rax + rbx], rbp
jmp 0x14000db8e
add rdi, 2
movzx eax, word [rdi]
test ax, ax
jne 0x14000da42
mov r15, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov rax, qword [r14 + 0x30]
shr rax, 3
add rsp, 0x28
pop r14
pop rdi
ret
Function at 0x1400168a0
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14001670b
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14001670b
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14001670b
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14001670b
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14001670b
cmp dword [rcx + 0x84], 0xe
jbe 0x14001670b
cmp dword [rcx + 0xf8], 0
je 0x14001670b
mov ecx, ebx
call fcn.1400167bc
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.140016598
nop
cmp dword [rbp + 0x20], 0
je 0x140016759
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140016764
int3
xor r8d, r8d
xor edx, edx
jmp 0x14001669c