joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140022f40
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x140022f56
mov al, 1
jmp 0x140022fb6
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x140022f67
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x140022fb4
mov ecx, dword [rcx + 0x18]
nop
call fcn.14001f8a4
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140022fb4
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x140022fb4
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x140022fb4
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x140022fb6
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x140024290
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.140017634
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x14002431a
cmp byte [rbp - 0x21], r15b
je 0x140024315
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x140024350
call fcn.14001a3fc
test eax, eax
jne 0x14002433c
cmp byte [rbp - 0x21], r15b
je 0x140024334
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x140024350
cmp byte [rbp - 0x21], r15b
je 0x14002434d
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.14001d8cc
test eax, eax
jne 0x1400243f0
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.140017634
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x14002438f
cmp byte [rbp - 0x21], r15b
je 0x1400243c4
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x1400243c4
call fcn.14001a3fc
test eax, eax
jne 0x1400243b0
cmp byte [rbp - 0x21], r15b
je 0x1400243a9
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x1400243c4
cmp byte [rbp - 0x21], r15b
je 0x1400243c1
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.14001d8cc
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x1400243f0
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x1400243f3
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x140024401
mov rcx, rdi
call fcn.140019800
cmp byte [rbp + 0x3f], r15b
je 0x140024410
mov rcx, qword [rbp + 0x27]
call fcn.140019800
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x1400011f8
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
lea rax, [rsp + 0x30]
mov rbx, rdx
mov rdi, rcx
mov r9d, 1
lea rdx, str.SOFTWARENVIDIA_CorporationNVControlPanel2Client
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
test r8d, r8d
jne 0x140001232
mov rcx, 0xffffffff80000001
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000128d
mov rcx, qword [rsp + 0x30]
mov eax, 4
lea r9, [rsp + 0x68]
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x68], eax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov rdx, rdi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x30]
test eax, eax
jne 0x140001287
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x14000128f
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x14000129c
Capabilities:
Identify system language via api

Disassembly:
push rbx
sub rsp, 0x20
and qword [rsp + 0x40], 0
and dword [rsp + 0x38], 0
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rdx, [rsp + 0x38]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
je 0x140001313
mov ecx, dword [rsp + 0x38]
test ecx, ecx
je 0x140001313
cmp ecx, 0xffffffff
je 0x140001313
lea rdx, [rsp + 0x40]
call sub.WTSAPI32.dll_WTSQueryUserToken
test eax, eax
je 0x140001313
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
mov word [rbx], ax
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14000130c
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x140001315
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x14000180c
Capabilities:
Identify system language via api

Disassembly:
push rbx
sub rsp, 0x20
xor ebx, ebx
lea rdx, [rsp + 0x38]
lea rcx, str.UserDefinedLocale
xor r8d, r8d
mov word [rsp + 0x30], bx
mov dword [rsp + 0x38], ebx
call fcn.1400011f8
test eax, eax
jne 0x140001855
lea rcx, [rsp + 0x30]
call fcn.14000129c
test eax, eax
jne 0x14000184b
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
jmp 0x140001850
movzx eax, word [rsp + 0x30]
movzx ecx, ax
jmp 0x140001859
mov ecx, dword [rsp + 0x38]
call fcn.140001640
mov ecx, 0x3ff
and ax, cx
mov ecx, 1
cmp ax, cx
je 0x14000187a
cmp ax, 0xd
je 0x14000187a
xor eax, eax
jmp 0x14000187c
mov eax, ecx
add rsp, 0x20
pop rbx
ret
Function at 0x140001884
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [rcx]
lea rdx, str.NvCplApiGetSetting
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rdi]
lea rdx, str.NvCplApiSetSetting
mov qword [rdi + 0x10], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rdi]
lea rdx, str.NvCplApiInit
mov qword [rdi + 0x18], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rdi]
lea rdx, str.NvCplApiGetInfo
mov qword [rdi + 8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rdi]
lea rdx, str.NvCplApiEnumSettingValues
mov qword [rdi + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rdi]
lea rdx, str.NvCplApiExecute
mov qword [rdi + 0x28], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor ebx, ebx
mov qword [rdi + 0x30], rax
cmp qword [rdi], rbx
je 0x140001927
cmp qword [rdi + 8], rbx
je 0x140001927
call fcn.140055ff4
test eax, eax
sete bl
xor edx, edx
mov ecx, ebx
call qword [rdi + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140001b3c
Capabilities:
Identify system language via api

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
call fcn.14005c010
xor edi, edi
lea rdx, [rsp + 0x40]
lea rcx, str.UserDefinedLocale
xor r8d, r8d
mov ebx, 0xa807
mov word [rsp + 0x38], di
mov dword [rsp + 0x40], edi
call fcn.1400011f8
test eax, eax
jne 0x140001b93
lea rcx, [rsp + 0x38]
call fcn.14000129c
test eax, eax
jne 0x140001b89
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
jmp 0x140001b8e
movzx eax, word [rsp + 0x38]
movzx ecx, ax
jmp 0x140001b97
mov ecx, dword [rsp + 0x40]
call fcn.140001640
movzx ecx, ax
movzx edx, ax
and ecx, 0x3ff
shr dx, 0xa
cmp ecx, 0x12
jg 0x140001cc3
je 0x140001cb9
cmp ecx, 0xa
jg 0x140001c5f
je 0x140001c44
dec ecx
je 0x140001c3a
sub ecx, 3
je 0x140001c19
dec ecx
je 0x140001c0f
dec ecx
je 0x140001c05
dec ecx
je 0x140001bfb
dec ecx
je 0x140001bf1
dec ecx
jne 0x140001d6c
mov ebx, 0xa80d
jmp 0x140001d6c
mov ebx, 0xa80c
jmp 0x140001d6c
mov ebx, 0xa80b
jmp 0x140001d6c
mov ebx, 0xa80a
jmp 0x140001d6c
mov ebx, 0xa809
jmp 0x140001d6c
movzx eax, dx
cmp eax, 2
je 0x140001c30
cmp eax, 4
je 0x140001c30
mov ebx, 0xa823
jmp 0x140001d6c
mov ebx, 0xa822
jmp 0x140001d6c
mov ebx, 0xa808
jmp 0x140001d6c
movzx ecx, dx
dec ecx
je 0x140001c55
mov ebx, 0xa80f
jmp 0x140001d6c
mov ebx, 0xa80e
jmp 0x140001d6c
sub ecx, 0xb
je 0x140001caf
dec ecx
je 0x140001ca5
dec ecx
je 0x140001c9b
dec ecx
je 0x140001c91
sub ecx, 2
je 0x140001c87
dec ecx
jne 0x140001d6c
mov ebx, 0xa815
jmp 0x140001d6c
mov ebx, 0xa814
jmp 0x140001d6c
mov ebx, 0xa813
jmp 0x140001d6c
mov ebx, 0xa812
jmp 0x140001d6c
mov ebx, 0xa811
jmp 0x140001d6c
mov ebx, 0xa810
jmp 0x140001d6c
mov ebx, 0xa816
jmp 0x140001d6c
cmp ecx, 0x40
jg 0x140001d5f
cmp ecx, 0x3f
jge 0x140001d67
cmp ecx, 0x1b
jg 0x140001d25
je 0x140001d1e
sub ecx, 0x13
je 0x140001d17
dec ecx
je 0x140001d10
dec ecx
je 0x140001d09
dec ecx
je 0x140001cf4
cmp ecx, 3
je 0x140001d67
jmp 0x140001d6c
movzx ecx, dx
dec ecx
je 0x140001d02
mov ebx, 0xa81a
jmp 0x140001d6c
mov ebx, 0xa81b
jmp 0x140001d6c
mov ebx, 0xa819
jmp 0x140001d6c
mov ebx, 0xa818
jmp 0x140001d6c
mov ebx, 0xa817
jmp 0x140001d6c
mov ebx, 0xa81d
jmp 0x140001d6c
cmp ecx, 0x1d
je 0x140001d58
cmp ecx, 0x1e
je 0x140001d51
cmp ecx, 0x1f
je 0x140001d4a
cmp ecx, 0x21
jle 0x140001d6c
cmp ecx, 0x23
jle 0x140001d67
cmp ecx, 0x24
jne 0x140001d6c
mov ebx, 0xa81e
jmp 0x140001d6c
mov ebx, 0xa821
jmp 0x140001d6c
mov ebx, 0xa820
jmp 0x140001d6c
mov ebx, 0xa81f
jmp 0x140001d6c
lea eax, [rcx - 0x43]
cmp eax, 1
ja 0x140001d6c
mov ebx, 0xa81c
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140008420
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx], 0
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
je 0x140008483
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140008497
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140008497
mov rcx, qword [rbx]
and qword [rsp + 0x28], 0
xor r9d, r9d
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call rax
jmp 0x14000849c
cmp dword [rcx + 8], 0
je 0x140008497
mov rdx, r8
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x14000849c
mov eax, 1
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x1400084ac
Capabilities:
Delete registry key

Disassembly:
cmp qword [rcx + 0x10], 0
je 0x1400084c2
mov r8, rdx
mov rdx, qword [rcx]
mov rcx, qword [rcx + 0x10]
jmp fcn.140008420
mov rcx, qword [rcx]
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]

Function at 0x14000863c
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x30
xor edi, edi
mov rbx, r8
mov rbp, rdx
mov r12, rcx
test r8, r8
jne 0x14000866a
lea eax, [rdi + 0xd]
jmp 0x1400086a1
mov rsi, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
lea rsi, [rsi + rax*2]
lea edi, [rdi + rax*2]
cmp eax, 1
jne 0x14000866d
mov rcx, qword [r12]
lea r9d, [rax + 6]
xor r8d, r8d
mov rdx, rbp
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r12
ret
Function at 0x14000c938
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0x90
mov rax, qword [0x1402ee230]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov bl, r9b
mov rsi, r8
lea r9, [rbp - 0x25]
lea r8, [rbp - 0x21]
call fcn.14000b7c0
test bl, bl
je 0x14000ca1f
lea rcx, str.COMCTL32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rdi, rax
test rax, rax
je 0x14000ca1f
mov edx, 0x3ee
mov r8d, 5
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x14000ca1f
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x14000ca1f
lea r8, [rbp - 0x29]
lea rdx, [rbp - 9]
mov rcx, rax
call fcn.14000c490
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test ebx, ebx
je 0x14000ca1f
movzx edx, word [rbp - 0x29]
lea r9, [rbp - 0x19]
lea r8, [rbp - 0x11]
lea rcx, [rbp - 9]
call fcn.14000b7c0
mov edx, dword [rbp - 0x21]
mov ecx, dword [rsi]
mov r8d, 4
call qword [sym.imp.KERNEL32.dll_MulDiv]
mov edx, dword [rbp - 0xd]
mov ecx, dword [rsi + 4]
mov r8d, 8
mov dword [rsi], eax
call qword [sym.imp.KERNEL32.dll_MulDiv]
mov r8d, dword [rbp - 0x19]
mov edx, dword [rbp - 0x25]
mov dword [rsi + 4], eax
mov ecx, eax
jmp 0x14000ca3e
mov edx, dword [rbp - 0x21]
mov ecx, dword [rsi]
mov r8d, 4
call qword [sym.imp.KERNEL32.dll_MulDiv]
mov edx, dword [rbp - 0x1d]
mov ecx, dword [rsi + 4]
mov dword [rsi], eax
mov r8d, 8
call qword [sym.imp.KERNEL32.dll_MulDiv]
mov dword [rsi + 4], eax
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.1401bea40
mov rbx, qword [rsp + 0xc8]
add rsp, 0x90
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000ca68
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
sub rsp, 0x490
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov rax, qword [0x1402ee230]
xor rax, rsp
mov qword [rsp + 0x480], rax
mov r12, r9
mov rdi, r8
mov rax, rdx
xor ebx, ebx
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x70], rbx
xor edx, edx
lea r8d, [rbx + 2]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rsi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x14000cadc
call fcn.1400081f4
mov ebx, eax
jmp 0x14000cbeb
mov r8, r12
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdi, rax
test rax, rax
jne 0x14000cafd
call fcn.1400081f4
jmp 0x14000cbdf
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r12, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x14000caf3
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov dword [rsp + 0x30], eax
inc eax
cmp eax, edi
jae 0x14000cb38
mov ebx, 0x8007000e
jmp 0x14000cbe1
mov ecx, eax
test eax, eax
je 0x14000cb75
xor edx, edx
or rax, 0xffffffffffffffff
div rcx
cmp rax, 2
jb 0x14000cb6b
lea rdx, [rcx + rcx]
cmp rdx, 0x400
jbe 0x14000cb75
lea rcx, [rsp + 0x70]
call fcn.140008cc8
mov rax, qword [rsp + 0x70]
jmp 0x14000cb7f
mov ecx, 0x80070216
call fcn.140001000
lea rax, [rsp + 0x78]
mov qword [rsp + 0x70], rax
jmp 0x14000cb96
test rax, rax
je 0x14000cb2e
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
mov r9d, edi
mov r8, r12
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x14000caf3
mov ecx, eax
mov rax, qword [rsp + 0x70]
mov word [rax + rcx*2], bx
mov r8d, dword [rsp + 0x4d0]
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.14000b154
mov ebx, eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rax, [rsp + 0x78]
cmp qword [rsp + 0x70], rax
je 0x14000cc02
lea rcx, [rsp + 0x70]
call fcn.14005e33c
nop
mov eax, ebx
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.1401bea40
mov rbx, qword [rsp + 0x4b0]
add rsp, 0x490
pop r12
pop rdi
pop rsi
ret
Function at 0x14000d3fc
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
test rdx, rdx
jne 0x14000d420
mov eax, 0x80004003
jmp 0x14000d4b7
mov rcx, qword [0x1402fce40]
mov edx, 0x68
lea r8d, [rdx - 0x63]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
jne 0x14000d442
mov eax, 0x8000ffff
jmp 0x14000d4b7
mov rcx, qword [0x1402fce40]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x14000d43b
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
je 0x14000d43b
lea rdx, [rsi + 0x1c]
mov r8b, 1
mov rcx, rax
call fcn.14000d358
mov dword [rdi], 0x30
mov edx, dword [rsi + 0x24]
mov rcx, rsi
call fcn.140013a6c
mov rcx, rsi
mov qword [rdi + 8], rax
mov rax, qword [rsi + 0x1c]
mov qword [rdi + 0x10], rax
mov edx, dword [rsi + 0x28]
call fcn.140013a6c
mov rcx, rsi
mov qword [rdi + 0x20], rax
mov edx, dword [rsi + 0x2c]
call fcn.140013a6c
mov qword [rdi + 0x18], rax
mov eax, dword [rsi + 0x30]
mov dword [rdi + 0x28], eax
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1400123c4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
mov rbp, rsp
sub rsp, 0x80
mov qword [rbp - 0x48], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rax, qword [0x1402ee230]
xor rax, rsp
mov qword [rbp - 8], rax
mov ebx, edx
mov rsi, rcx
mov qword [rbp - 0x38], rcx
xor edi, edi
mov qword [rcx], rdi
mov qword [rcx + 8], rdi
mov qword [rcx + 0x10], rdi
lea rdx, [rbp - 0x30]
call fcn.14001236c
nop
lea r8, [rbp - 0x30]
cmp qword [rbp - 0x18], 8
cmovae r8, qword [rbp - 0x30]
movzx edx, bx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov r12, rax
test rax, rax
je 0x140012562
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x140012562
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x140012562
mov rdx, r12
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
movsxd r12, eax
mov rdx, r12
lea ecx, [rdi + 0x42]
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov qword [rsi], rax
test rax, rax
je 0x140012562
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
test rax, rax
je 0x140012562
mov qword [rbp - 0x60], rdi
mov r8, r12
mov rdx, rbx
mov rcx, rax
call fcn.1401bdb70
lea r8, [rbp - 0x60]
xor edx, edx
mov rcx, qword [rsi]
call qword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
setns r12b
test r12b, r12b
je 0x140012502
lea ecx, [rdi + 0x18]
call sub.gdiplus.dll_GdipAlloc
mov rbx, rax
test rax, rax
je 0x1400124f3
mov rcx, qword [rbp - 0x60]
lea rax, vtable.Gdiplus::Image.0
mov qword [rbx], rax
lea rdx, [rbx + 8]
mov qword [rdx], rdi
call sub.gdiplus.dll_GdipLoadImageFromStream
mov dword [rbx + 0x10], eax
jmp 0x1400124f6
mov rbx, rdi
mov rdx, rbx
lea rcx, [rsi + 8]
call fcn.1400122e0
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
test r12b, r12b
jne 0x140012552
mov ecx, 0x18
call fcn.14005a668
mov qword [rbp - 0x40], rax
test rax, rax
je 0x14001253d
lea rcx, str.ResourceImage_could_not_load_resource
mov qword [rbp - 0x58], rcx
lea rdx, [rbp - 0x58]
mov rcx, rax
call fcn.1401be46c
mov rdi, rax
mov qword [rbp - 0x50], rdi
lea rdx, [0x1402dbe48]
lea rcx, [rbp - 0x50]
call fcn.1401be918
nop
mov rcx, qword [rbp - 0x60]
test rcx, rcx
je 0x140012562
mov rdx, qword [rcx]
call qword [rdx + reloc.OLEAUT32.dll_SafeArrayGetDim]
nop
cmp qword [rbp - 0x18], 8
jb 0x140012573
mov rcx, qword [rbp - 0x30]
call fcn.14005a6ac
nop
mov rax, rsi
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1401bea40
mov rbx, qword [rsp + 0xc0]
add rsp, 0x80
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140012ac8
Capabilities:
Create process on windows
Query environment variable

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
push rdi
sub rsp, 0x300
mov rax, qword [0x1402ee230]
xor rax, rsp
mov qword [rsp + 0x2f0], rax
mov ebx, 0x104
lea rdx, [r11 - 0x228]
lea rcx, str.ProgramFiles_x86_
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
movsxd rdi, eax
test eax, eax
jne 0x140012b1e
mov eax, 1
jmp 0x140012c39
lea eax, [rdi + 0x32]
xor esi, esi
cmp eax, ebx
jle 0x140012b4a
movsxd rcx, eax
lea eax, [rsi + 2]
mul rcx
lea rcx, [rsi - 1]
cmovo rax, rcx
mov rcx, rax
call fcn.14005a6b4
mov esi, 1
mov rbx, rax
jmp 0x140012b52
lea rbx, [rsp + 0xe0]
lea eax, [rdi + 1]
lea rdx, str.NVIDIA_Corporation3DTV
mov ebp, 0x5c
movsxd rcx, eax
mov word [rbx + rdi*2], bp
lea rcx, [rbx + rcx*2]
call fcn.1401bfe28
lea r11d, [rdi + 0x18]
lea rdx, str.3DVSerialize.exe
movsxd rax, r11d
mov word [rbx + rax*2], bp
lea eax, [r11 + 1]
movsxd rcx, eax
lea rcx, [rbx + rcx*2]
call fcn.1401bfe28
lea r11d, [rdi + 0x29]
lea ecx, [rbp - 0x3c]
movsxd rax, r11d
lea rdx, str._TestUi
mov word [rbx + rax*2], cx
lea eax, [r11 + 1]
movsxd rcx, eax
lea rcx, [rbx + rcx*2]
call fcn.1401bfe28
lea edi, [rbp + 0xc]
lea rcx, [rsp + 0x70]
mov r8d, edi
xor edx, edx
call fcn.1401bf180
lea r8d, [rbp - 0x44]
lea rcx, [rsp + 0x50]
xor edx, edx
call fcn.1401bf180
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x40], rax
and qword [rsp + 0x38], 0
and qword [rsp + 0x30], 0
mov rdx, rbx
xor ecx, ecx
mov dword [rsp + 0x28], 0x4000000
and dword [rsp + 0x20], 0
mov dword [rsp + 0x70], edi
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x140012c2b
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140012b14
test esi, esi
je 0x140012c37
mov rcx, rbx
call fcn.14005a6ac
xor eax, eax
mov rcx, qword [rsp + 0x2f0]
xor rcx, rsp
call fcn.1401bea40
lea r11, [rsp + 0x300]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140013eb4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
test rdx, rdx
jne 0x140013ed8
mov eax, 0x80004003
jmp 0x140013f71
mov rcx, qword [0x1402fce40]
mov edx, UnRegisterTypeLib
mov r8d, 5
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
jne 0x140013efc
mov eax, 0x8000ffff
jmp 0x140013f71
mov rcx, qword [0x1402fce40]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x140013ef5
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
je 0x140013ef5
lea rdx, [rsi + 0x1c]
mov r8b, 1
mov rcx, rax
call fcn.14000d358
mov dword [rdi], 0x30
mov edx, dword [rsi + 0x24]
mov rcx, rsi
call fcn.140013a6c
mov rcx, rsi
mov qword [rdi + 8], rax
mov rax, qword [rsi + 0x1c]
mov qword [rdi + 0x10], rax
mov edx, dword [rsi + 0x28]
call fcn.140013a6c
mov rcx, rsi
mov qword [rdi + 0x20], rax
mov edx, dword [rsi + 0x2c]
call fcn.140013a6c
mov qword [rdi + 0x18], rax
mov eax, dword [rsi + 0x30]
mov dword [rdi + 0x28], eax
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret