joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4512e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
test rbx, rbx
jbe 0x451457
movzx edx, byte [rax]
test edx, edx
jne 0x451314
nop dword [rax]
test r8b, r8b
jne 0x451314
xor eax, eax
xor ebx, ebx
mov rcx, rbx
xor edi, edi
add rsp, 0x10
pop rbp
ret
bt edx, 7
jae 0x451327
xor edx, edx
xor r8d, r8d
xor r9d, r9d
jmp 0x451417
mov r8d, 1
mov r9d, edx
and edx, 1
neg edx
shr r9d, 1
xor edx, r9d
add dword [rsi], edx
nop dword [rax]
cmp rbx, r8
jb 0x451405
sub rbx, r8
sub rcx, r8
mov rdx, rcx
neg rdx
sar rdx, 0x3f
and r8, rdx
lea rdx, [rax + r8]
test rbx, rbx
jbe 0x4513f7
movzx esi, byte [rax + r8]
bt esi, 7
jae 0x45137d
xor eax, eax
xor esi, esi
xor r8d, r8d
jmp 0x4513c0
mov eax, 1
cmp rax, rbx
ja 0x4513ab
add qword [rdi], rsi
sub rcx, rax
sub rbx, rax
mov rsi, rcx
neg rsi
sar rsi, 0x3f
and rax, rsi
add rax, rdx
mov edi, 1
add rsp, 0x10
pop rbp
ret
mov rcx, rbx
call sym.runtime.panicSliceB
lea r8d, [rcx + 7]
mov rcx, r11
mov eax, r12d
nop dword [rax]
cmp rax, rbx
jae 0x4513ef
movzx r9d, byte [rax + rdx]
mov r10d, r9d
and r9d, 0x7f
mov r11, rcx
mov ecx, r8d
shl r9d, cl
lea r12d, [rax + 1]
or esi, r9d
test r10b, 0x80
jne 0x4513b3
mov rcx, r11
mov eax, r12d
jmp 0x451382
mov rcx, rbx
call sym.runtime.panicIndex
xor eax, eax
mov rcx, rax
nop dword [rax]
call sym.runtime.panicIndex
mov eax, r8d
mov rcx, rbx
call sym.runtime.panicSliceB
lea r9d, [rcx + 7]
mov rcx, r12
cmp rbx, rdx
jbe 0x45144d
movzx r10d, byte [rdx + rax]
mov r11d, r10d
and r10d, 0x7f
mov r12, rcx
mov ecx, r9d
shl r10d, cl
inc edx
or r8d, r10d
test r11b, 0x80
jne 0x451410
mov rcx, r12
mov r9d, edx
mov edx, r8d
mov r8d, r9d
jmp 0x45132d
mov eax, edx
mov rcx, rbx
call sym.runtime.panicIndex
xor eax, eax
mov rcx, rax
nop dword [rax]
call sym.runtime.panicIndex
nop
int3
Function at 0x458b40
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x458bef
push rbp
mov rbp, rsp
sub rsp, 0x58
mov qword [rsp + 0x70], rbx
lea rdx, [rsp + 0x68]
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rsi, [sym.runtime.callers.func1]
mov qword [rsp + 0x10], rsi
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdx
mov rdx, r14
mov qword [rsp + 0x28], rdx
lea rdx, [rsp + 8]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call sym.runtime.systemstack.abi0
xorps xmm15, xmm15
mov r14, qword [0x0061cbc8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
add rsp, 0x58
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp sym.runtime.callers

Function at 0x463b20
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp byte [0x0061c98b], 0
je 0x463b2e
jmp sym.aeshashbody
jmp sym.runtime.memhashFallback

Function at 0x463b40
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp byte [0x0061c98b], 0
je 0x463b55
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp sym.aeshashbody
jmp sym.runtime.strhashFallback

Function at 0x463b60
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp byte [0x0061c98b], 0
je 0x463b95
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x0061cfe0]
aesenc xmm0, xmmword [0x0061cff0]
aesenc xmm0, xmmword [0x0061d000]
movq rax, xmm0
ret
jmp sym.runtime.memhash32Fallback

Function at 0x463ba0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp byte [0x0061c98b], 0
je 0x463bd6
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x0061cfe0]
aesenc xmm0, xmmword [0x0061cff0]
aesenc xmm0, xmmword [0x0061d000]
movq rax, xmm0
ret
jmp sym.runtime.memhash64Fallback

Function at 0x4654e0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov rdx, 2
jmp sym.sigtramp

Function at 0x4658e0
Capabilities:
Allocate thread local storage

Disassembly:
push rbp
mov rbp, rsp
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x465914
mov rcx, 0x28
jmp 0x46591f
shl rcx, 3
add rcx, 0x1480
mov qword [0x0061cbc8], rcx
pop rbp
ret
Function at 0x47bb80
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47bc4a
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rax
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call sym.internal_bytealg.IndexByteString.abi0
xorps xmm15, xmm15
mov r14, qword [0x0061cbc8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x47bc2f
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x004da2a0]
xor ebx, ebx
mov rcx, rdx
call sym.runtime.makeslice
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call sym.syscall.encodeWTF16
inc rbx
cmp rcx, rbx
jae 0x47bc1e
mov edi, 1
lea rsi, [0x004da2a0]
call sym.runtime.growslice
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x005276d8]
lea rsi, [0x00526e40]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp sym.syscall.UTF16FromString
Function at 0x4a0e40
Capabilities:
Hash data using fnv

Disassembly:
test byte [rax], al
mov rcx, rbx
and ebx, 0x7f
shl rbx, 5
lea rdx, [rax + rbx]
xor eax, eax
jmp 0x4a0e57
inc rax
cmp rax, 4
jge 0x4a0e6f
lea rbx, [rdx + rax*8]
mov rbx, qword [rbx]
cmp rbx, rcx
jne 0x4a0e54
mov eax, 1
ret
xor eax, eax
movabs rbx, 0xcbf29ce484222325
jmp 0x4a0e80
inc rax
cmp rax, 4
jge 0x4a0e8e
mov rsi, qword [rdx + rax*8]
xor edi, edi
jmp 0x4a0eb7
and ebx, 3
lea rdx, [rdx + rbx*8]
xchg qword [rdx], rcx
xor eax, eax
ret
movzx r8d, sil
xor rbx, r8
inc rdi
shr rsi, 8
movabs r8, 0x100000001b3
imul rbx, r8
cmp rdi, 8
jl 0x4a0e9b
jmp 0x4a0e7d

Function at 0x4af360
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4af4ae
push rbp
mov rbp, rsp
sub rsp, 0x68
movups xmmword [rsp + 0x40], xmm15
mov qword [rsp + 0x30], 0
mov rax, qword [0x005c1b48]
call sym.internal_godebug._Setting_.Value
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x38], rax
movups xmmword [rsp + 0x50], xmm15
mov qword [rsp + 0x60], 0
lea rcx, [sym.net.goDebugNetDNS.func1]
mov qword [rsp + 0x50], rcx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x58], rcx
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x60], rcx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x2b
call sym.internal_bytealg.IndexByteString.abi0
xorps xmm15, xmm15
mov r14, qword [0x0061cbc8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rcx, qword [rsp + 0x18]
cmp rcx, 0xffffffffffffffff
je 0x4af472
mov rdx, qword [rsp + 0x28]
nop dword [rax + rax]
cmp rdx, rcx
jb 0x4af4a8
mov qword [rsp + 0x20], rcx
mov rsi, qword [rsp + 0x50]
mov rax, qword [rsp + 0x38]
mov rbx, rcx
lea rdx, [rsp + 0x50]
call rsi
mov rax, qword [rsp + 0x20]
lea rcx, [rax + 1]
mov rbx, qword [rsp + 0x28]
cmp rbx, rcx
jb 0x4af49d
mov rsi, qword [rsp + 0x50]
sub rbx, rax
dec rbx
mov rdi, rbx
neg rdi
sar rdi, 0x3f
and rcx, rdi
mov rdi, qword [rsp + 0x38]
lea rax, [rdi + rcx]
lea rdx, [rsp + 0x50]
call rsi
mov rcx, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x40]
add rsp, 0x68
pop rbp
ret
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x28]
lea rdx, [rsp + 0x50]
call rcx
mov rcx, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x40]
add rsp, 0x68
pop rbp
ret
mov rax, rcx
mov rcx, rbx
call sym.runtime.panicSliceB
call sym.runtime.panicSliceAlen
nop
call sym.runtime.morestack_noctxt.abi0
jmp sym.net.goDebugNetDNS
Function at 0x4c79e0
Capabilities:
Access peb ldr_data

Disassembly:
lea r12, [rsp - 0x30]
cmp r12, qword [r14 + 0x10]
jbe 0x4c7c29
push rbp
mov rbp, rsp
sub rsp, 0xa8
nop word [rax + rax]
test rax, rax
je 0x4c7c14
mov qword [rsp + 0xb8], rax
mov rbx, qword [rax + 8]
test rbx, rbx
jne 0x4c7a22
xor ebx, ebx
xor ecx, ecx
nop
jmp 0x4c7a3c
mov rdx, qword [rax]
mov rcx, qword [rax + 0x10]
mov rax, rdx
call sym.net.IP.String
mov rcx, rax
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x88], rcx
mov qword [rsp + 0x48], rbx
cmp qword [rax + 0x28], 0
je 0x4c7b51
mov rcx, qword [rax + 0x18]
mov rax, rcx
nop dword [rax + rax]
call sym.internal_itoa.Itoa
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x58], rbx
mov rcx, qword [rsp + 0xb8]
mov r8, qword [rcx + 0x20]
mov r9, qword [rcx + 0x28]
mov rcx, qword [rsp + 0x48]
lea rdi, [0x00526028]
mov esi, 1
lea rax, [rsp + 0x68]
mov rbx, qword [rsp + 0x88]
call sym.runtime.concatstring3
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x3a
call sym.internal_bytealg.IndexByteString.abi0
xorps xmm15, xmm15
mov r14, qword [0x0061cbc8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x4c7b1b
xor eax, eax
lea rbx, [0x004fc69d]
mov ecx, 1
mov rdi, qword [rsp + 0xa0]
mov rsi, qword [rsp + 0x60]
lea r8, [0x004fc6db]
mov r9d, 2
mov r10, qword [rsp + 0x98]
mov r11, qword [rsp + 0x58]
call sym.runtime.concatstring4
jmp 0x4c7b48
xor eax, eax
mov rbx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x60]
lea rdi, [0x00526140]
mov esi, 1
mov r8, qword [rsp + 0x98]
mov r9, qword [rsp + 0x58]
call sym.runtime.concatstring3
add rsp, 0xa8
pop rbp
ret
mov rax, qword [rax + 0x18]
call sym.internal_itoa.Itoa
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x50], rbx
mov rcx, qword [rsp + 0x88]
mov qword [rsp], rcx
mov rdx, qword [rsp + 0x48]
mov qword [rsp + 8], rdx
mov byte [rsp + 0x10], 0x3a
call sym.internal_bytealg.IndexByteString.abi0
xorps xmm15, xmm15
mov r14, qword [0x0061cbc8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
nop
jl 0x4c7bde
xor eax, eax
lea rbx, [0x004fc69d]
mov ecx, 1
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x48]
lea r8, [0x004fc6db]
mov r9d, 2
mov r10, qword [rsp + 0x90]
mov r11, qword [rsp + 0x50]
call sym.runtime.concatstring4
jmp 0x4c7c0b
xor eax, eax
mov rbx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x48]
lea rdi, [0x00526140]
mov esi, 1
mov r8, qword [rsp + 0x90]
mov r9, qword [rsp + 0x50]
call sym.runtime.concatstring3
add rsp, 0xa8
pop rbp
ret
lea rax, [0x004fc966]
mov ebx, 5
add rsp, 0xa8
pop rbp
ret
mov qword [rsp + 8], rax
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
jmp sym.net._TCPAddr_.String
Function at 0x4c8960
Capabilities:
Access peb ldr_data

Disassembly:
lea r12, [rsp - 0x30]
cmp r12, qword [r14 + 0x10]
jbe 0x4c8ba9
push rbp
mov rbp, rsp
sub rsp, 0xa8
nop word [rax + rax]
test rax, rax
je 0x4c8b94
mov qword [rsp + 0xb8], rax
mov rbx, qword [rax + 8]
test rbx, rbx
jne 0x4c89a2
xor ebx, ebx
xor ecx, ecx
nop
jmp 0x4c89bc
mov rdx, qword [rax]
mov rcx, qword [rax + 0x10]
mov rax, rdx
call sym.net.IP.String
mov rcx, rax
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x88], rcx
mov qword [rsp + 0x48], rbx
cmp qword [rax + 0x28], 0
je 0x4c8ad1
mov rcx, qword [rax + 0x18]
mov rax, rcx
nop dword [rax + rax]
call sym.internal_itoa.Itoa
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x58], rbx
mov rcx, qword [rsp + 0xb8]
mov r8, qword [rcx + 0x20]
mov r9, qword [rcx + 0x28]
mov rcx, qword [rsp + 0x48]
lea rdi, [0x00526028]
mov esi, 1
lea rax, [rsp + 0x68]
mov rbx, qword [rsp + 0x88]
call sym.runtime.concatstring3
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x3a
call sym.internal_bytealg.IndexByteString.abi0
xorps xmm15, xmm15
mov r14, qword [0x0061cbc8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x4c8a9b
xor eax, eax
lea rbx, [0x004fc69d]
mov ecx, 1
mov rdi, qword [rsp + 0xa0]
mov rsi, qword [rsp + 0x60]
lea r8, [0x004fc6db]
mov r9d, 2
mov r10, qword [rsp + 0x98]
mov r11, qword [rsp + 0x58]
call sym.runtime.concatstring4
jmp 0x4c8ac8
xor eax, eax
mov rbx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x60]
lea rdi, [0x00526140]
mov esi, 1
mov r8, qword [rsp + 0x98]
mov r9, qword [rsp + 0x58]
call sym.runtime.concatstring3
add rsp, 0xa8
pop rbp
ret
mov rax, qword [rax + 0x18]
call sym.internal_itoa.Itoa
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x50], rbx
mov rcx, qword [rsp + 0x88]
mov qword [rsp], rcx
mov rdx, qword [rsp + 0x48]
mov qword [rsp + 8], rdx
mov byte [rsp + 0x10], 0x3a
call sym.internal_bytealg.IndexByteString.abi0
xorps xmm15, xmm15
mov r14, qword [0x0061cbc8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
nop
jl 0x4c8b5e
xor eax, eax
lea rbx, [0x004fc69d]
mov ecx, 1
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x48]
lea r8, [0x004fc6db]
mov r9d, 2
mov r10, qword [rsp + 0x90]
mov r11, qword [rsp + 0x50]
call sym.runtime.concatstring4
jmp 0x4c8b8b
xor eax, eax
mov rbx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x48]
lea rdi, [0x00526140]
mov esi, 1
mov r8, qword [rsp + 0x90]
mov r9, qword [rsp + 0x50]
call sym.runtime.concatstring3
add rsp, 0xa8
pop rbp
ret
lea rax, [0x004fc966]
mov ebx, 5
add rsp, 0xa8
pop rbp
ret
mov qword [rsp + 8], rax
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
jmp sym.net._UDPAddr_.String
Function at 0x10000a888
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x20
mov r13, rcx
mov r12d, edx
lea rcx, [0x10001c610]
xor edx, edx
xor ebx, ebx
call fcn.1000189dc
lea r14d, [rbx + 1]
mov ebp, r14d
jmp 0x10000a96e
test rbx, rbx
jne 0x10000a97a
mov eax, r12d
lea edx, [rbx + 6]
xor r9d, r9d
shr eax, 4
mov rcx, rsi
add ax, r14w
movzx r8d, ax
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
mov rbx, rax
test rax, rax
je 0x10000a95d
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x10000a90a
xor ebx, ebx
jmp 0x10000a958
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
test rax, rax
je 0x10000a906
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, r12d
mov r11d, eax
add r11, rdi
and ecx, 0xf
jbe 0x10000a947
cmp rdi, r11
jae 0x10000a906
add ecx, 0xffffffff
movzx eax, word [rdi]
lea rdi, [rdi + rax*2 + 2]
jne 0x10000a935
cmp rdi, r11
jae 0x10000a906
movzx eax, word [rdi]
neg ax
sbb rbx, rbx
and rbx, rdi
test rbx, rbx
jne 0x10000a97c
lea rcx, [0x10001c610]
mov edx, ebp
call fcn.1000189dc
add ebp, r14d
mov rsi, rax
test rax, rax
jne 0x10000a8c7
xor esi, esi
test rsi, rsi
jne 0x10000a985
xor eax, eax
jmp 0x10000a993
mov r8d, r12d
mov rdx, rsi
mov rcx, r13
call fcn.10000a9b8
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop r13
pop r12
ret
Function at 0x10000a9b8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x20
mov eax, r8d
mov rbp, rdx
mov r14d, 1
shr eax, 4
mov ebx, r8d
mov rsi, rcx
add ax, r14w
lea r8d, [r14 + 5]
mov rcx, rbp
movzx edx, ax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
xor r13d, r13d
mov r12, rax
cmp rax, r13
je 0x10000ab2e
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
cmp rax, r13
je 0x10000ab2e
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
cmp rax, r13
je 0x10000ab2e
mov rdx, r12
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r11d, eax
add r11, rdi
and ebx, 0xf
jbe 0x10000aa64
cmp rdi, r11
jae 0x10000ab2e
add ebx, 0xffffffff
movzx eax, word [rdi]
lea rdi, [rdi + rax*2 + 2]
jne 0x10000aa4e
cmp rdi, r11
jae 0x10000ab2e
cmp word [rdi], r13w
je 0x10000ab2e
mov rax, qword [rsi]
movzx ebx, word [rdi]
mov ecx, r14d
sub ecx, dword [rax - 8]
mov eax, dword [rax - 0xc]
sub eax, ebx
or ecx, eax
jge 0x10000aa96
mov edx, ebx
mov rcx, rsi
call fcn.10000ac78
movzx ecx, word [rdi]
lea r8, [rdi + 2]
cmp ecx, 0xffffffff
jne 0x10000aab7
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r8
repne scasw ax, word [rdi]
not rcx
sub rcx, r14
add ecx, r14d
movsxd r9, ecx
mov rcx, qword [rsi]
lea rdi, [rbx + rbx]
mov rdx, rdi
add r9, r9
call sub.msvcrt.dll_memcpy_s
cmp eax, r13d
je 0x10000ab06
cmp eax, 0xc
je 0x10000aafb
cmp eax, 0x16
je 0x10000aaf0
cmp eax, 0x22
je 0x10000aaf0
cmp eax, 0x50
je 0x10000ab06
mov ecx, 0x80004005
call fcn.10000af7c
int3
mov ecx, 0x80070057
call fcn.10000af7c
int3
mov ecx, 0x8007000e
call fcn.10000af7c
int3
cmp ebx, r13d
jl 0x10000ab23
mov rcx, qword [rsi]
cmp ebx, dword [rcx - 0xc]
jg 0x10000ab23
mov dword [rcx - 0x10], ebx
mov rcx, qword [rsi]
mov eax, r14d
mov word [rdi + rcx], r13w
jmp 0x10000ab30
mov ecx, 0x80070057
call fcn.10000af7c
int3
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop r13
pop r12
ret
Function at 0x100017bf4
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rcx, qword [0x10001d9b8]
test rcx, rcx
jne 0x100017c1a
call fcn.100017ca8
test eax, eax
je 0x100017c41
mov rcx, qword [0x10001d9b8]
call qword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
test rax, rax
jne 0x100017c95
mov edx, 0x1000
lea r9d, [rax + 0x40]
xor ecx, ecx
mov r8d, edx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
jne 0x100017c45
xor eax, eax
jmp 0x100017c95
mov eax, dword [rax]
mov rcx, qword [0x10001d9b8]
call qword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
mov rdi, rax
test rax, rax
je 0x100017c72
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rax, rdi
jmp 0x100017c95
lea rdi, [rbx + 0xfe0]
mov rcx, qword [0x10001d9b8]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_InterlockedPushEntrySList]
add rbx, 0x20
cmp rbx, rdi
jb 0x100017c79
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x100018a60
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xd0
mov rax, qword [0x10001c138]
xor rax, rsp
mov qword [rsp + 0xc0], rax
xor edx, edx
mov rbx, rcx
lea r8d, [rdx + 0x28]
add rcx, r8
call sub.msvcrt.dll_memset
and qword [rbx + 0x50], 0
and dword [rbx + 0x58], 0
and dword [rbx + 0x5c], 0
lea rax, [0x100000000]
mov esi, 0x94
lea rcx, [rsp + 0x20]
mov r8, rsi
xor edx, edx
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], rax
mov dword [rbx], 0x60
mov byte [rbx + 0x18], 0
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [rsp + 0x30], 2
mov esi, 1
jne 0x100018af3
cmp dword [rsp + 0x24], 5
jb 0x100018b0d
jmp 0x100018b09
cmp dword [rsp + 0x30], esi
jne 0x100018b0d
cmp dword [rsp + 0x24], 4
ja 0x100018b09
jne 0x100018b0d
cmp dword [rsp + 0x28], 0
jbe 0x100018b0d
mov byte [rbx + 0x18], sil
lea rax, [0x1000017c8]
lea rcx, [rbx + 0x28]
mov dword [rbx + 0x1c], 0x800
mov qword [rbx + 0x20], rax
call fcn.100004a2c
movzx ecx, byte [0x10001e058]
test eax, eax
mov rax, rbx
cmovs ecx, esi
mov byte [0x10001e058], cl
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.100018f20
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x100018f20
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x10001c138]
jne 0x100018f3b
rol rcx, 0x10
test cx, 0xffff
jne 0x100018f37
ret 0
ror rcx, 0x10
jmp 0x100019420
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x10001c800]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x10001c8f8]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x1000194a5
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x10001c800]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x1000194c7
mov rax, qword [rsp + 0x88]
mov qword [0x10001c8f8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x10001c898], rax
mov rax, qword [0x10001c8f8]
mov qword [0x10001c770], rax
mov rax, qword [rsp + 0x90]
mov qword [0x10001c880], rax
mov dword [0x10001c760], 0xc0000409
mov dword [0x10001c764], 1
mov rax, qword [0x10001c138]
mov qword [rsp + 0x68], rax
mov rax, qword [0x10001c140]
mov qword [rsp + 0x70], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x100001850]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret

Function at 0x1000192bc
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
cmp rcx, rdx
je 0x100019309
cmp rcx, 0xffffffffffffffff
je 0x100019309
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x100019301
cmp dword [rcx + 0x3c], edx
jl 0x100019301
cmp dword [rcx + 0x3c], 0x10000000
jae 0x100019301
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x100019309
mov rax, rdx
add rsp, 0x18
ret

Function at 0x100019578
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x530
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rbx, qword [rsp + 0x158]
lea rdx, [rsp + 0x40]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_RtlLookupFunctionEntry]
test rax, rax
je 0x1000195e3
and qword [rsp + 0x38], 0
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x50]
mov r9, rax
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x60]
mov r8, rbx
mov qword [rsp + 0x20], rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RtlVirtualUnwind]
jmp 0x100019603
mov rax, qword [rsp + 0x538]
mov qword [rsp + 0x158], rax
lea rax, [rsp + 0x538]
mov qword [rsp + 0xf8], rax
lea rcx, [0x100001860]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add rsp, 0x530
pop rbx
ret