joyce8/EMBER2024-capa huggingface dataset:
Function at 0x648240
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x64824d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x64825d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x648245
lea eax, [rcx + 1]
jmp 0x64826b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x64827e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x648264
sub eax, 3
jb 0x64829e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x6482ed
sar eax, 1
movsxd rbp, eax
jb 0x6482d4
jmp 0x6482ac
add ebx, ebx
jne 0x6482aa
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x6482d4
inc ecx
add ebx, ebx
jne 0x6482ba
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x6482d4
call r11
adc ecx, ecx
add ebx, ebx
jne 0x6482cd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x6482bc
add ecx, 2
jmp 0x6482d9
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.00648202
jmp 0x64824d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0xe0a00
mov dl, 0x1d
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x648339
cmp rsi, rcx
jae 0x648341
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x648320
cmp al, 0x8f
ja 0x648320
cmp byte [rsi - 2], 0xf
je 0x648326
sub al, 0xe8
cmp al, 1
ja 0x64830a
cmp rsi, rcx
jae 0x648341
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x648310
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x648341
lodsb al, byte [rsi]
jmp 0x648320
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x244000]
mov eax, dword [rdi]
or eax, eax
je 0x64839e
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x248000]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x64834e
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x648398
mov qword [rbx], rax
add rbx, 8
jmp 0x64836e
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x6483d8
cmp al, 0xef
ja 0x6483ca
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x6483aa
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x6483b9
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x64842c
sub rsp, 0xffffffffffffff80
jmp 0x464400
Function at 0x41e540
Capabilities:
Hash data using murmur3

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
cmp byte [0x005823d3], 0
jne 0x41e6a5
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
sub rdx, qword [rbx + 0x18]
nop
test rdx, rdx
jne 0x41e64e
xor eax, eax
nop
nop
nop
mov rcx, rax
shr rax, 3
and rcx, 7
mov edx, 1
shl edx, cl
nop
add rax, qword [rbx + 0x50]
lock or byte [rax], dl
nop
nop
mov rcx, qword [rbx + 0x18]
nop
movabs rdx, 0x800000000000
lea rax, [rdx + rcx]
mov rdx, rax
shr rax, 0x2a
cmp rax, 0x40
jae 0x41e69a
lea rbx, [0x005799a0]
mov rax, qword [rbx + rax*8]
shr rdx, 0x16
and rdx, 0xfffff
mov rdx, qword [rax + rdx*8]
test byte [rdx], al
test byte [rax], al
mov rax, rcx
shr rcx, 0x10
and rcx, 0x3f
movzx ebx, byte [rdx + rcx + 0x21040]
lea rdx, [rdx + rcx]
lea rdx, [rdx + 0x21040]
shr rax, 0xd
and rax, 7
mov rcx, rax
mov esi, 1
shl esi, cl
test sil, bl
jne 0x41e60f
lock or byte [rdx], sil
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov rax, qword [rax + 0x30]
mov rax, qword [rax + 0xa0]
test byte [rax], al
mov rcx, qword [rsp + 0x30]
add qword [rax + 0x16a8], rcx
mov rcx, qword [rsp + 0x38]
add qword [rax + 0x16b0], rcx
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
cmp word [rbx + 0x5e], 0
je 0x41e66a
movzx ecx, byte [rbx + 0x65]
cmp cl, 0x40
sbb rax, rax
shr rdx, cl
and rax, rdx
jmp 0x41e575
movzx ecx, byte [rbx + 0x65]
cmp cl, 0x40
sbb rax, rax
movzx esi, byte [rbx + 0x66]
cmp sil, 0x40
sbb rdi, rdi
shr rdx, cl
and rax, rdx
movzx edx, word [rbx + 0x5c]
imul rax, rdx
mov ecx, esi
shr rax, cl
and rax, rdi
jmp 0x41e575
mov ecx, 0x40
nop
call fcn.00462c20
lea rax, [0x004c5353]
mov qword [rsp], rax
mov qword [rsp + 8], 0x2c
call fcn.00434180
nop
int3
Function at 0x425e40
Capabilities:
Access peb ldr_data

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4260ae
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
nop
lea rax, [0x00582350]
mov qword [rsp], rax
call fcn.0040a600
lea rax, [0x005822c0]
mov qword [rsp], rax
call fcn.004167c0
mov rax, qword [rsp + 8]
mov qword [rsp + 0x48], rax
nop
nop
lea rcx, [0x00582350]
mov qword [rsp], rcx
call fcn.0040a860
mov rax, qword [rsp + 0x48]
mov byte [rax + 0xa], 1
lea rdi, [rax + 0x10]
cmp dword [0x00582610], 0
jne 0x42609f
mov rcx, qword [rsp + 0x68]
mov qword [rax + 0x10], rcx
mov qword [rsp + 0x40], rdi
mov rcx, qword [rsp + 0x70]
mov qword [rax + 0x18], rcx
cmp dword [0x00582610], 0
nop dword [rax]
jne 0x426078
mov rcx, qword [rsp + 0x78]
mov qword [rax + 0x20], rcx
mov rcx, qword [rsp + 0x80]
mov qword [rax + 0x28], rcx
mov rcx, qword [rsp + 0x60]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
call fcn.004259a0
cmp byte [rsp + 0x10], 0
je 0x426016
cmp dword [0x00582408], 0
jne 0x425f34
mov byte [rsp + 0x88], 1
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov rax, qword [rsp + 0x60]
mov qword [rsp], rax
xorps xmm0, xmm0
movups xmmword [rsp + 8], xmm0
call fcn.00411820
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov rcx, qword [rax + 0x30]
mov rdx, qword [rsp + 0x18]
nop
inc dword [rcx + 0xd8]
mov rcx, qword [rax + 0x30]
mov qword [rsp + 0x30], rcx
mov rbx, qword [rcx + 0xa0]
test byte [rbx], al
test byte [rax], al
mov qword [rsp], rdx
lea rax, [rbx + 0x1698]
mov qword [rsp + 0x38], rax
mov qword [rsp + 8], rax
call fcn.0041d360
mov rax, qword [rsp + 0x40]
mov qword [rsp], rax
mov qword [rsp + 8], 8
lea rax, [0x0053a181]
mov qword [rsp + 0x10], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x20], 0
call fcn.0041d1c0
nop
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x30]
mov edx, dword [rcx + 0xd8]
lea ebx, [rdx - 1]
mov dword [rcx + 0xd8], ebx
cmp edx, 1
jne 0x425f22
cmp byte [rax + 0xb1], 0
je 0x425f22
mov qword [rax + 0x10], 0xfffffffffffffade
jmp 0x425f22
nop
nop
lea rax, [0x00582350]
mov qword [rsp], rax
call fcn.0040a600
nop
mov rax, qword [0x005822f0]
sub rax, qword [0x005822c0]
mov qword [0x005822f0], rax
mov rax, qword [0x005822d8]
mov rcx, qword [rsp + 0x48]
mov qword [rcx], rax
mov qword [0x005822d8], rcx
nop
nop
lea rax, [0x00582350]
mov qword [rsp], rax
call fcn.0040a860
mov byte [rsp + 0x88], 0
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
lea rcx, [rax + 0x20]
mov rdi, rcx
mov rbx, qword [rsp + 0x78]
call fcn.004628a0
lea rdi, [rax + 0x28]
mov rcx, qword [rsp + 0x80]
call fcn.00462860
jmp 0x425efb
mov rcx, qword [rsp + 0x68]
call fcn.00462860
jmp 0x425ec8
call fcn.00460b00
jmp fcn.00425e40
Function at 0x455880
Capabilities:
Access peb ldr_data

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x455961
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov qword [rsp + 8], 0
mov qword [rsp + 0x10], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x18], xmm0
movups xmmword [rsp + 0x28], xmm0
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
lea rcx, [0x0045d5c0]
mov qword [rsp + 0x10], rcx
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x18], rcx
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 8]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.004609a0
mov rax, qword [rsp + 8]
mov qword [rsp + 0x88], rax
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
nop
ret
call fcn.00460b00
jmp fcn.00455880
Function at 0x4626a0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, qword [0x00582660]
mov rcx, qword [rsp + 8]
mov rcx, qword [rcx]
mov rdx, qword [rsp + 0x10]
lea rax, [rdx + rax*8]
xor rcx, rax
movabs rax, 0xea38ec9079f01541
imul rax, rcx
rol rax, 0x1f
movabs rcx, 0x2723a30d96da1399
imul rcx, rax
mov rax, rcx
shr rcx, 0x1d
xor rax, rcx
movabs rcx, 0x83cf8eadf876d2d7
imul rcx, rax
mov rax, rcx
shr rcx, 0x20
xor rax, rcx
mov qword [rsp + 0x18], rax
ret
cmp byte [0x005823d2], 0
je 0x4626dd
mov rax, qword [rsp + 8]
movq xmm0, qword [rsp + 0x10]
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x005828c0]
aesenc xmm0, xmmword [0x005828d0]
aesenc xmm0, xmmword [0x005828e0]
movq qword [rsp + 0x18], xmm0
ret
jmp 0x408f60

Function at 0x463f40
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x30
mov rcx, 0xfffffffffffffff4
mov qword [rsp], rcx
mov rax, qword [sym.imp.kernel32.dll_GetStdHandle]
call rax
mov rcx, rax
mov qword [rsp], rcx
lea rdx, [0x00582840]
mov qword [rsp + 8], rdx
lea r8d, [0x005823e4]
mov qword [rsp + 0x10], r8
lea r9, [rsp + 0x28]
mov qword [r9], 0
mov qword [rsp + 0x18], r9
mov qword [rsp + 0x20], 0
mov rax, qword [sym.imp.kernel32.dll_WriteFile]
call rax
add rsp, 0x30
ret
Function at 0x140001210
Capabilities:
Enumerate processes

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x330
mov rdi, rsp
mov ecx, 0xcc
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x340]
mov qword [rsp + 0x320], 0xfffffffffffffffe
mov rax, qword [0x1401bb8b8]
xor rax, rsp
mov qword [rsp + 0x328], rax
lea rcx, [rsp + 0x30]
call fcn.140001d70
nop
mov r8d, 0x238
xor edx, edx
lea rcx, [rsp + 0xb0]
call fcn.140060770
mov dword [rsp + 0xb0], 0x238
xor edx, edx
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rsp + 0x2f8], rax
cmp qword [rsp + 0x2f8], 0xffffffffffffffff
jne 0x1400012c1
mov dword [rsp + 0x310], 0
lea rcx, [rsp + 0x30]
call fcn.140001eb0
mov eax, dword [rsp + 0x310]
jmp 0x1400013a5
lea rdx, [rsp + 0xb0]
mov rcx, qword [rsp + 0x2f8]
call sub.KERNEL32.dll_Process32FirstW
mov dword [rsp + 0x300], eax
cmp dword [rsp + 0x300], 0
je 0x14000137b
lea rdx, [rsp + 0xdc]
lea rcx, [rsp + 0x30]
call fcn.14004ae70
movsxd rax, dword [rsp + 0x348]
mov r8, rax
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x340]
call fcn.1400035a0
mov dword [rsp + 0x94], eax
cmp dword [rsp + 0x94], 0
jne 0x14000135a
mov rcx, qword [rsp + 0x2f8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0xb8]
mov dword [rsp + 0x314], eax
lea rcx, [rsp + 0x30]
call fcn.140001eb0
mov eax, dword [rsp + 0x314]
jmp 0x1400013a5
lea rdx, [rsp + 0xb0]
mov rcx, qword [rsp + 0x2f8]
call sub.KERNEL32.dll_Process32NextW
mov dword [rsp + 0x300], eax
jmp 0x1400012dd
mov rcx, qword [rsp + 0x2f8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x318], 0
lea rcx, [rsp + 0x30]
call fcn.140001eb0
mov eax, dword [rsp + 0x318]
mov rdi, rax
mov rcx, rsp
lea rdx, reloc.OLEAUT32.dll_SysReAllocString
call fcn.14005d920
mov rax, rdi
mov rcx, qword [rsp + 0x328]
xor rcx, rsp
call fcn.14005db80
add rsp, 0x330
pop rdi
ret
Function at 0x1400013e0
Capabilities:
Allocate or change rwx memory
Create thread
Inject thread
Spawn thread to rwx shellcode

Disassembly:
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rdi
sub rsp, 0x140
mov rdi, rsp
mov ecx, 0x50
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x150]
mov qword [rsp + 0x118], 0xfffffffffffffffe
lea rcx, [rsp + 0x48]
call fcn.14003b920
nop
mov r8d, 1
mov rdx, qword [rsp + 0x158]
lea rcx, [rsp + 0xd8]
call fcn.14000a710
mov qword [rsp + 0x120], rax
mov rax, qword [rsp + 0x120]
mov qword [rsp + 0x128], rax
mov rdx, qword [rsp + 0x128]
lea rcx, [rsp + 0x48]
call fcn.140001f00
nop
lea rcx, [rsp + 0xd8]
call fcn.140001df0
lea rcx, [rsp + 0x48]
call fcn.140002680
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x90], rax
mov dword [rsp + 0xa4], 0
mov r8d, dword [rsp + 0x150]
xor edx, edx
mov ecx, 0x1f0fff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0xb8], rax
cmp qword [rsp + 0xb8], 0
je 0x1400015fd
mov rcx, qword [rsp + 0x90]
call fcn.14007be00
inc rax
mov qword [rsp + 0xc0], rax
mov dword [rsp + 0x20], 0x40
mov r9d, 0x1000
mov r8, qword [rsp + 0xc0]
xor edx, edx
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rsp + 0xc8], rax
cmp qword [rsp + 0xc8], 0
je 0x1400015ef
mov qword [rsp + 0x20], 0
mov r9, qword [rsp + 0xc0]
mov r8, qword [rsp + 0x90]
mov rdx, qword [rsp + 0xc8]
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0x20], rax
mov r9, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov qword [rsp + 0xd0], rax
cmp qword [rsp + 0xd0], 0
je 0x1400015d0
mov edx, 0xffffffff
mov rcx, qword [rsp + 0xd0]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rdx, [rsp + 0xa4]
mov rcx, qword [rsp + 0xd0]
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov rcx, qword [rsp + 0xd0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, qword [rsp + 0xc8]
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rsp + 0xa4], 0
je 0x140001614
mov dword [rsp + 0x130], 1
jmp 0x14000161f
mov dword [rsp + 0x130], 0
mov eax, dword [rsp + 0x130]
mov dword [rsp + 0x110], eax
lea rcx, [rsp + 0x48]
call fcn.140001df0
mov eax, dword [rsp + 0x110]
mov edi, eax
mov rcx, rsp
lea rdx, reloc.OLEAUT32.dll_SysReAllocString
call fcn.14005d920
mov eax, edi
add rsp, 0x140
pop rdi
ret
Function at 0x14000f180
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x170
mov rdi, rsp
mov ecx, 0x5c
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x180]
mov qword [rsp + 0x158], 0xfffffffffffffffe
cmp qword [rsp + 0x180], 0
je 0x14000f1d7
mov rax, qword [rsp + 0x180]
jmp 0x14000f36a
lea rcx, [rsp + 0x40]
call fcn.140001d70
nop
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
cdqe
mov qword [rsp + 0xa8], rax
cmp qword [rsp + 0xa8], 0
je 0x14000f20e
lea rdx, [0x14013ae60]
lea rcx, [rsp + 0x40]
call fcn.14004b350
lea rcx, [rsp + 0xb8]
call fcn.14003b920
nop
lea rcx, [rsp + 0x108]
call fcn.14003b920
nop
xor r8d, r8d
lea rdx, [rsp + 0x108]
mov rcx, qword [rsp + 0x188]
call fcn.14002b4b0
mov qword [rsp + 0x160], rax
xor r8d, r8d
lea rdx, [rsp + 0xb8]
mov rcx, qword [rsp + 0x190]
call fcn.14002b4b0
mov rcx, qword [rsp + 0x160]
mov qword [rsp + 0x20], rcx
mov r9, qword [rsp + 0x198]
mov r8, rax
lea rdx, [0x14013ae68]
lea rcx, [rsp + 0x40]
call fcn.14004bf80
mov rcx, qword [rsp + 0x1a0]
call fcn.14000f390
test rax, rax
jne 0x14000f2c0
lea rdx, [0x14013ae9c]
lea rcx, [rsp + 0x40]
call fcn.14004b350
mov rdx, qword [rsp + 0x1a0]
lea rcx, [rsp + 0x40]
call fcn.14004b350
lea rcx, [rsp + 0x40]
call fcn.14004a960
mov qword [rsp + 0x148], rax
cmp qword [rsp + 0xa8], 0
je 0x14000f2ee
mov rcx, qword [rsp + 0x148]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
int3
mov r9d, SafeArrayGetLBound
lea r8, [0x14013aea8]
mov rdx, qword [rsp + 0x148]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
test eax, eax
jne 0x14000f32c
mov r8d, 0x41
lea rdx, str.G:win_androidplugins_vprj_winclasslib_sys_baselibswin_basecpp_vol_assert.cpp
lea rcx, [0x14013af78]
call fcn.14007bad0
xor eax, eax
mov rax, qword [rsp + 0x180]
mov qword [rsp + 0x150], rax
lea rcx, [rsp + 0x108]
call fcn.140001df0
nop
lea rcx, [rsp + 0xb8]
call fcn.140001df0
nop
lea rcx, [rsp + 0x40]
call fcn.140001eb0
mov rax, qword [rsp + 0x150]
mov rdi, rax
mov rcx, rsp
lea rdx, [0x14013d040]
call fcn.14005d920
mov rax, rdi
add rsp, 0x170
pop rdi
ret
Function at 0x140016b90
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov rdi, rsp
mov ecx, SafeArrayGetLBound
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x50]
cmp qword [rsp + 0x70], 0
je 0x140016c0d
cmp qword [rsp + 0x58], 0
je 0x140016c0d
cmp qword [rsp + 0x60], 0
jl 0x140016c0d
mov rax, qword [rsp + 0x50]
cmp qword [rax + 0x1f8], 0
jne 0x140016c0d
mov rax, qword [rsp + 0x50]
cmp qword [rax + 0xa0], 0
jne 0x140016c0d
mov rax, qword [rsp + 0x50]
cmp qword [rax + 0xa8], 0
jne 0x140016c0d
mov qword [rsp + 0x20], 1
jmp 0x140016c16
mov qword [rsp + 0x20], 0
mov r9d, GetAltMonthNames
lea r8, [0x140140d40]
lea rdx, str.pVolAppRuntimeClass___NULL__hInstance___NULL__npArgC___0__m_hInstance__NULL__m_pVolAppObject__NULL__m_blpComInitSucceeded__FALSE
mov rcx, qword [rsp + 0x20]
call fcn.14000f120
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
mov qword [rax + 0x1f8], rcx
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x60]
mov qword [rax + 0x200], rcx
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x68]
mov qword [rax + 0x208], rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov rcx, qword [rsp + 0x50]
mov dword [rcx + 0x210], eax
mov edx, 2
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
jl 0x140016c94
mov qword [rsp + 0x28], 1
jmp 0x140016c9d
mov qword [rsp + 0x28], 0
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x28]
mov qword [rax + 0xa8], rcx
xor ecx, ecx
call fcn.140030e40
mov rax, qword [rsp + 0x50]
movsd qword [rax + 0xb0], xmm0
mov rcx, qword [rsp + 0x70]
call fcn.14000e1f0
mov rcx, qword [rsp + 0x50]
mov qword [rcx + 0xa0], rax
call fcn.14000a560
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx + 0xa0]
mov rdx, qword [rsp + 0x50]
mov rdx, qword [rdx + 0xa0]
mov qword [rsp + 0x30], rdx
mov rcx, qword [rcx]
mov qword [rsp + 0x38], rcx
mov rdx, rax
mov rax, qword [rsp + 0x30]
mov rcx, rax
mov rax, qword [rsp + 0x38]
call qword [rax + 0x68]
test eax, eax
jne 0x140016d5c
mov rax, qword [rsp + 0x50]
mov rax, qword [rax + 0xa0]
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx + 0xa0]
mov rax, qword [rax]
call qword [rax + 0x60]
mov r9d, 0x15d
lea r8, [0x140140e40]
lea rdx, [0x1401409c4]
xor ecx, ecx
call fcn.14000f120
mov ecx, 0xffffffff
call fcn.14007c750
add rsp, 0x40
pop rdi
ret
Function at 0x140017380
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0xb0
mov rdi, rsp
mov ecx, 0x2c
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0xc0]
mov qword [rsp + 0x90], 0xfffffffffffffffe
cmp dword [rsp + 0xc8], 0
jl 0x1400173db
cmp dword [rsp + 0xc8], 4
jge 0x1400173db
mov qword [rsp + 0x98], 1
jmp 0x1400173e7
mov qword [rsp + 0x98], 0
mov r9d, 0x244
lea r8, [0x140141350]
lea rdx, str.enImageType___0__enImageType____NUM_VOL_RES_IMAGE_TYPES
mov rcx, qword [rsp + 0x98]
call fcn.14000f120
cmp qword [rsp + 0xd0], 0
je 0x14001759f
mov rax, qword [rsp + 0xc0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xc0]
call qword [rax]
mov qword [rsp + 0x20], rax
cmp dword [rsp + 0xc8], 0
je 0x140017449
cmp dword [rsp + 0xc8], 3
jne 0x14001754d
movzx eax, word [rsp + 0xd0]
mov r8d, 0xa
mov edx, eax
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x14001754b
mov qword [rsp + 0x30], 0
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x14001750b
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
je 0x140017500
lea rcx, [rsp + 0x58]
call fcn.140018a10
nop
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov eax, eax
mov r8d, eax
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x58]
call fcn.140010910
test rax, rax
je 0x1400174f6
lea rcx, [rsp + 0x58]
call fcn.140012d10
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x58]
call fcn.140010670
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_FreeResource]
cmp qword [rsp + 0x30], 0
je 0x14001754b
cmp dword [rsp + 0xc8], 3
jne 0x140017544
mov rcx, qword [rsp + 0x30]
call fcn.1400182f0
mov qword [rsp + 0x88], rax
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rax, qword [rsp + 0x88]
jmp 0x1400175a1
mov rax, qword [rsp + 0x30]
jmp 0x1400175a1
jmp 0x14001759f
mov eax, dword [rsp + 0xc8]
mov dword [rsp + 0xa0], eax
cmp dword [rsp + 0xa0], 1
je 0x140017571
cmp dword [rsp + 0xa0], 2
je 0x140017588
jmp 0x14001759f
movzx eax, word [rsp + 0xd0]
mov edx, eax
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.USER32.dll_LoadCursorW]
jmp 0x1400175a1
movzx eax, word [rsp + 0xd0]
mov edx, eax
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.USER32.dll_LoadIconW]
jmp 0x1400175a1
xor eax, eax
mov rdi, rax
mov rcx, rsp
lea rdx, [0x140144d00]
call fcn.14005d920
mov rax, rdi
add rsp, 0xb0
pop rdi
ret
Function at 0x14002e7e0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov rdi, rsp
mov ecx, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x40]
cmp qword [rsp + 0x48], 0
jle 0x14002e816
mov qword [rsp + 0x20], 1
jmp 0x14002e81f
mov qword [rsp + 0x20], 0
mov r9d, 0x99b
lea r8, [0x140152730]
lea rdx, str.npBufLength___0
mov rcx, qword [rsp + 0x20]
call fcn.14000f120
mov rax, qword [rsp + 0x48]
shl rax, 1
mov r8d, 1
mov rdx, rax
mov rcx, qword [rsp + 0x40]
call fcn.1400283b0
mov r9d, 0x99c
lea r8, [0x1401527a0]
lea rdx, str.IsValidAddress___psBuf____npBufLength__sizeof__TCHAR____TRUE_
mov rcx, rax
call fcn.14000f120
mov rdx, qword [rsp + 0x40]
mov ecx, dword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
jbe 0x14002e892
mov qword [rsp + 0x28], 1
jmp 0x14002e89b
mov qword [rsp + 0x28], 0
mov rax, qword [rsp + 0x28]
add rsp, 0x30
pop rdi
ret

Function at 0x14002e8b0
Capabilities:
Set current directory

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x20
mov rdi, rsp
mov ecx, 8
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x30]
call fcn.14000ed40
mov r9d, 0x9ae
lea r8, [0x140152810]
lea rdx, str.IsValidString__szNewDir_
mov rcx, rax
call fcn.14000f120
mov rcx, qword [rsp + 0x30]
call fcn.14000f390
test rax, rax
je 0x14002e907
xor eax, eax
jmp 0x14002e914
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
cdqe
add rsp, 0x20
pop rdi
ret

Function at 0x14002ee60
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0xb0
mov rdi, rsp
mov ecx, 0x2c
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0xc0]
mov qword [rsp + 0xa0], 0xfffffffffffffffe
mov rcx, qword [rsp + 0xc0]
call fcn.14000ed40
mov r9d, 0x712
lea r8, [0x140151050]
lea rdx, [0x1401510a8]
mov rcx, rax
call fcn.14000f120
mov rcx, qword [rsp + 0xc0]
call fcn.14000f390
test rax, rax
je 0x14002eecf
xor eax, eax
jmp 0x14002ef36
lea rcx, [rsp + 0x30]
call fcn.140001d70
nop
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0xc0]
call fcn.14002ef60
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14002ef08
mov qword [rsp + 0xa8], 1
jmp 0x14002ef14
mov qword [rsp + 0xa8], 0
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0x98], rax
lea rcx, [rsp + 0x30]
call fcn.140001eb0
mov rax, qword [rsp + 0x98]
mov rdi, rax
mov rcx, rsp
lea rdx, [0x140157690]
call fcn.14005d920
mov rax, rdi
add rsp, 0xb0
pop rdi
ret