joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140013fa0
Capabilities:
Compare security identifiers

Disassembly:
push rbx
push r12
sub rsp, 0x98
mov rax, qword [0x14012df80]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov r12, rcx
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x70]
lea edx, [rbx + 8]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x140014175
mov qword [rsp + 0xb8], rbp
mov rbp, qword [rsp + 0x70]
lea rax, [rsp + 0x60]
lea edx, [rbx + 2]
mov qword [rsp + 0xc0], rsi
xor r9d, r9d
mov rcx, rbp
xor r8d, r8d
mov qword [rsp + 0xc8], rdi
mov dword [rsp + 0x60], ebx
mov qword [rsp + 0x20], rax
mov rdi, rbx
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x140014085
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x140014085
mov r8d, dword [rsp + 0x60]
test r8, r8
je 0x140014085
mov rcx, qword [r12]
lea edx, [rbx + 8]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
mov rsi, rax
je 0x140014085
mov r9d, dword [rsp + 0x60]
lea rax, [rsp + 0x60]
lea edx, [rbx + 2]
mov r8, rsi
mov rcx, rbp
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x140014076
mov rdi, rsi
jmp 0x140014085
mov rcx, qword [r12]
mov r8, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea rax, [rsp + 0x68]
lea rcx, [rsp + 0x78]
mov r9d, 0x220
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], ebx
mov dword [rsp + 0x40], ebx
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], ebx
mov r8d, 0x20
mov dl, 2
mov dword [rsp + 0x28], ebx
mov byte [rsp + 0x78], bl
mov dword [rsp + 0x20], ebx
mov byte [rsp + 0x79], bl
mov byte [rsp + 0x7a], bl
mov byte [rsp + 0x7b], bl
mov byte [rsp + 0x7c], bl
mov byte [rsp + 0x7d], 5
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x14001412c
cmp dword [rdi], ebx
mov esi, ebx
jbe 0x140014121
mov qword [rsp + 0x90], r13
lea rbp, [rdi + 8]
mov r13d, 1
test ebx, ebx
jne 0x140014119
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rbp]
call qword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
cmovne ebx, r13d
add esi, r13d
add rbp, 0x10
cmp esi, dword [rdi]
jb 0x1400140f5
mov r13, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
test rdi, rdi
mov rsi, qword [rsp + 0xc0]
mov rbp, qword [rsp + 0xb8]
je 0x140014150
mov rcx, qword [r12]
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rdi, qword [rsp + 0xc8]
mov eax, ebx
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1400cd6e0
add rsp, 0x98
pop r12
pop rbx
ret
mov eax, ebx
jmp 0x14001415a
Function at 0x140014180
Capabilities:
Get common file path

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x250
mov rax, qword [0x14012df80]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rsi, r8
mov rbx, rdx
movzx edx, cx
lea r8, [rsp + 0x20]
xor ecx, ecx
xor edi, edi
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x14001422a
mov rcx, qword [rsp + 0x20]
lea rdx, [rsp + 0x30]
call qword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
lea rcx, [rsp + 0x30]
mov r11d, 0x104
sub rcx, rbx
mov edx, edi
nop
nop
lea rax, [r11 + 0x7ffffefa]
test rax, rax
je 0x140014204
movzx eax, word [rcx + rbx]
test ax, ax
je 0x140014204
mov word [rbx], ax
add rbx, 2
sub r11, 1
jne 0x1400141e0
jmp 0x140014209
test r11, r11
jne 0x140014212
sub rbx, 2
mov edx, 0x8007007a
mov word [rbx], di
mov rcx, qword [rsi]
test edx, edx
mov r8, qword [rcx]
mov rdx, qword [rsp + 0x20]
sete dil
call qword [r8 + 0x28]
mov rcx, qword [rsi]
mov rdx, qword [rcx]
call qword [rdx + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov eax, edi
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1400cd6e0
add rsp, 0x250
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400152b0
Capabilities:
Log keystrokes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rdx
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
xor edx, edx
mov rcx, rbx
mov esi, eax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test esi, esi
mov edi, eax
je 0x140015381
test eax, eax
je 0x140015381
cmp esi, eax
je 0x140015381
mov r8d, 1
mov edx, eax
mov ecx, esi
call qword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
je 0x140015381
xor eax, eax
lea r8, [rsp + 0x40]
xor r9d, r9d
xor edx, edx
mov ecx, 0x2000
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x48], eax
call qword [sym.imp.USER32.dll_SystemParametersInfoW]
lea r8, [rsp + 0x48]
xor r9d, r9d
xor edx, edx
mov ecx, 0x2001
call qword [sym.imp.USER32.dll_SystemParametersInfoW]
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetForegroundWindow]
lea r8, [rsp + 0x40]
xor r9d, r9d
xor edx, edx
mov ecx, 0x2001
mov ebx, eax
call qword [sym.imp.USER32.dll_SystemParametersInfoW]
xor r8d, r8d
mov edx, edi
mov ecx, esi
call qword [sym.imp.USER32.dll_AttachThreadInput]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.USER32.dll_SetForegroundWindow]
Function at 0x14001e200
Capabilities:
Get file version info

Disassembly:
mov rax, rsp
push rbx
push rdi
push r12
sub rsp, 0xa0
mov qword [rax + 8], rbp
mov rbp, rdx
xor r12d, r12d
mov qword [rax + 0x10], rsi
lea rdx, [rax + 0x20]
mov rdi, rcx
mov esi, r12d
mov dword [rax + 0x20], r12d
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
mov dword [rsp + 0xd0], eax
je 0x14001e2b9
lea ecx, [r12 + 0x40]
mov edx, eax
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
test rax, rax
mov rbx, rax
je 0x14001e2b9
mov r8d, dword [rsp + 0xd0]
mov edx, dword [rsp + 0xd8]
mov r9, rax
mov rcx, rdi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x14001e2a7
lea r9, [rsp + 0xd0]
lea r8, [rsp + 0x20]
lea rdx, [0x1400fc394]
mov rcx, rbx
mov dword [rsp + 0xd0], r12d
call sub.VERSION.dll_VerQueryValueW
mov rdx, qword [rsp + 0x20]
lea rcx, [rsp + 0x28]
lea r8d, [r12 + 0x34]
mov esi, eax
call fcn.1400cfba0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalHandle]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalFree]
lea rdx, [rsp + 0xd8]
mov rcx, rbp
mov edi, r12d
mov dword [rsp + 0xd8], r12d
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
mov dword [rsp + 0xd0], eax
je 0x14001e363
mov edx, eax
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
test rax, rax
mov rbx, rax
je 0x14001e363
mov r8d, dword [rsp + 0xd0]
mov edx, dword [rsp + 0xd8]
mov r9, rax
mov rcx, rbp
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x14001e351
lea r9, [rsp + 0xd0]
lea r8, [rsp + 0x20]
lea rdx, [0x1400fc394]
mov rcx, rbx
mov dword [rsp + 0xd0], r12d
call sub.VERSION.dll_VerQueryValueW
mov rdx, qword [rsp + 0x20]
lea rcx, [rsp + 0x60]
mov r8d, 0x34
mov edi, eax
call fcn.1400cfba0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalHandle]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rbp, qword [rsp + 0xc0]
test esi, esi
mov rsi, qword [rsp + 0xc8]
je 0x14001e41b
test edi, edi
je 0x14001e41b
mov r9d, dword [rsp + 0x30]
mov r10d, dword [rsp + 0x68]
mov r11d, dword [rsp + 0x34]
cmp r9d, r10d
mov ebx, dword [rsp + 0x6c]
jne 0x14001e3af
cmp r11d, ebx
jne 0x14001e3af
mov eax, r12d
add rsp, 0xa0
pop r12
pop rdi
pop rbx
ret
mov edx, r10d
mov r8d, r9d
shr edx, 0x10
shr r8d, 0x10
cmp r8w, dx
ja 0x14001e41b
cmp r8w, dx
jne 0x14001e3ce
cmp r9w, r10w
ja 0x14001e41b
cmp r8w, dx
jne 0x14001e3ea
cmp r9w, r10w
jne 0x14001e3ea
mov ecx, ebx
mov eax, r11d
shr ecx, 0x10
shr eax, 0x10
cmp ax, cx
ja 0x14001e41b
cmp r8w, dx
jne 0x14001e40c
cmp r9w, r10w
jne 0x14001e40c
mov ecx, ebx
mov eax, r11d
shr ecx, 0x10
shr eax, 0x10
cmp ax, cx
jne 0x14001e40c
cmp r11w, bx
ja 0x14001e41b
or eax, 0xffffffff
add rsp, 0xa0
pop r12
pop rdi
pop rbx
ret
mov eax, 1
add rsp, 0xa0
pop r12
pop rdi
pop rbx
ret
Function at 0x1400212a0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
xor esi, esi
lea rdi, [rcx + 0x48]
mov rbx, rcx
mov dword [rcx + 0x60], esi
mov dword [rcx + 0x64], esi
mov rcx, qword [rdi]
test rcx, rcx
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x40], rsi
je 0x1400212d6
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rcx, qword [rbx + 0x58]
lea rdx, [rsp + 0x78]
mov r9d, 1
mov rax, qword [rcx]
mov qword [rsp + 0x30], rdx
lea rdx, str.LayeredMicrosoft.Networking.Devices
xor r8d, r8d
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rbx
call qword [rax + 0x28]
test eax, eax
mov ebx, eax
jne 0x14002131c
mov rcx, qword [rsp + 0x78]
lea rdx, [rsp + 0x40]
mov rax, qword [rcx]
call qword [rax + 0x28]
mov ebx, eax
cmp ebx, 0x8000000a
je 0x140021328
test ebx, ebx
jne 0x140021348
xor ecx, ecx
lea rax, [rsp + 0x60]
mov r9, rdi
lea r8d, [rcx + 1]
mov edx, 0x7530
mov qword [rsp + 0x20], rax
call qword [sym.imp.ole32.dll_CoWaitForMultipleHandles]
mov ebx, eax
cmp ebx, 0x80010115
jne 0x140021359
lea rcx, str.CoWaitForMultipleHandles___Timeout_n_
jmp 0x140021364
test ebx, ebx
jne 0x14002136a
lea rcx, str.CoWaitForMultipleHandles___S_OK__n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14002137a
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x14002138a
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov rsi, qword [rsp + 0x70]
mov eax, ebx
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x140024d80
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov rdi, rcx
xor r8d, r8d
lea edx, [r8 + 0x69]
call fcn.14009e650
nop
lea rax, [0x1400fe608]
mov qword [rdi], rax
lea rcx, [rdi + 0x100]
call fcn.14009324c
lea rsi, [0x1400ee6e8]
mov qword [rdi + 0x100], rsi
lea rcx, [rdi + 0x1a8]
call fcn.14009324c
mov qword [rdi + 0x1a8], rsi
lea rcx, [rdi + 0x250]
call fcn.14009324c
lea r11, [0x1400f25d8]
mov qword [rdi + 0x250], r11
call fcn.1400a02a0
mov rcx, qword [rax + 8]
mov qword [rdi + 0xe8], rcx
mov rax, qword [rcx + 0x140]
mov qword [rdi + 0xf8], rax
mov rax, qword [rcx + 0x148]
mov qword [rdi + 0xf0], rax
xor ebp, ebp
mov qword [rsp + 0x20], rbp
lea r9, str.pParent_x
lea r8, [0x1400fe120]
lea rdx, [0x1400fe120]
call fcn.140080c70
mov qword [rdi + 0x2f8], rbp
mov dword [rdi + 0x300], ebp
mov dword [rdi + 0x304], ebp
mov dword [rdi + 0x328], 1
mov word [rdi + 0x32c], bp
mov dword [rdi + 0x310], ebp
mov dword [rdi + 0x314], ebp
mov qword [rdi + 0x318], rbp
mov qword [rdi + 0x320], rbp
mov qword [rdi + 0x308], rbp
mov qword [rdi + 0xb0], 0x69
cmp dword [rdi + 0xa8], ebp
jne 0x140024ead
movzx eax, word [rdi + 0xb0]
mov dword [rdi + 0xa8], eax
call fcn.1400a02a0
mov rsi, qword [rax + 0x18]
mov edx, 0x69
lea r8d, [rdx - 0x64]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbx, rbp
test rax, rax
je 0x140024ee8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
mov dword [rsp + 0x70], ebp
lea rcx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_GetProcessDefaultLayout]
test eax, eax
je 0x140024f20
cmp dword [rsp + 0x70], 1
jne 0x140024f20
cmp word [rbx + 2], 0xffff
jne 0x140024f19
cmp word [rbx], 1
jne 0x140024f20
or dword [rbx + 8], 0x400000
jmp 0x140024f20
or dword [rbx + 4], 0x400000
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, rdi
call fcn.14009f338
mov rcx, qword [rdi + 0xf0]
test eax, eax
je 0x140024f53
movabs rax, 0x1000000000000000
or qword [rcx], rax
mov rax, rdi
jmp 0x140024f63
movabs rax, 0xefffffffffffffff
and qword [rcx], rax
mov rax, rdi
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400263a0
Capabilities:
Move file

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov r13, rcx
mov rax, qword [rcx + 0xe8]
mov rbx, qword [rax + 0x178]
test rbx, rbx
je 0x140026486
mov rax, qword [rbx]
cmp dword [rax + 0x174], 4
jl 0x140026486
call fcn.14009d5e8
mov r11, rax
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
jne 0x14002640e
mov ecx, 0x80004005
call fcn.1400034f0
int3
mov rax, qword [rax]
mov rcx, r11
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x80], rax
lea rax, [0x1400fb278]
mov qword [rsp + 0x20], rax
lea r9, str.RemoveResFile
lea r8, [0x1400fe120]
lea rdx, str.private__s::_s__s_
lea rcx, [rsp + 0x80]
call fcn.14000a800
lea rdx, [rsp + 0x80]
mov rcx, rbx
call fcn.14002f200
nop
mov rdx, qword [rsp + 0x80]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140026486
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [r13 + 0x2f8]
test rcx, rcx
je 0x1400265b0
xor r14d, r14d
xor esi, esi
cmp qword [rcx + 0x10], rsi
jle 0x1400265b0
test rsi, rsi
js 0x1400264c3
cmp rsi, qword [rcx + 0x10]
jge 0x1400264c3
test rsi, rsi
js 0x1400265aa
mov rax, qword [rcx + 8]
mov r12, qword [rax + rsi*8]
jmp 0x1400264c6
xor r12d, r12d
mov r15, qword [r13 + 0xf8]
xor ebx, ebx
nop
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x4000000
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x10000
lea r8d, [r9 + 1]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp rbp, 0xffffffffffffffff
jne 0x14002655d
cmp eax, 5
jne 0x140026525
lea ecx, [rax + 0x5f]
call qword [sym.imp.KERNEL32.dll_Sleep]
add ebx, 1
cmp ebx, 0xa
jl 0x1400264d0
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], r12
lea r9, [0x1400fc430]
lea r8, str.FileRemoveEx
lea rdx, str.CCmnFunc
mov rcx, qword [r15 + 8]
call fcn.140080a70
xor edx, edx
lea r8d, [rdx + 4]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
jmp 0x14002658d
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], ebx
lea r9, [0x1400fc3e0]
lea r8, str.FileRemoveEx
lea rdx, str.CCmnFunc
mov rcx, qword [r15 + 8]
call fcn.140081070
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add r14d, 1
add rsi, 1
mov rcx, qword [r13 + 0x2f8]
movsxd rax, r14d
cmp rax, qword [rcx + 0x10]
jge 0x1400265b0
jmp 0x1400264a5
call fcn.1400a0610
int3
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14002c5f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov rbp, rdx
mov rdi, rcx
mov r8, rdx
mov edx, 0x6a
call fcn.14009e650
nop
lea rax, [0x1400ff1d8]
mov qword [rdi], rax
lea rcx, [rdi + 0x108]
call fcn.14009324c
lea rsi, [0x1400ee6e8]
mov qword [rdi + 0x108], rsi
lea rcx, [rdi + 0x1b0]
call fcn.14009324c
mov qword [rdi + 0x1b0], rsi
lea rcx, [rdi + 0x258]
call fcn.14009324c
mov qword [rdi + 0x258], rsi
lea rcx, [rdi + 0x300]
call fcn.14009324c
lea rsi, [0x1400ee9a8]
mov qword [rdi + 0x300], rsi
lea rcx, [rdi + 0x3a8]
call fcn.14009324c
mov qword [rdi + 0x3a8], rsi
call fcn.1400a02a0
mov rcx, qword [rax + 8]
mov qword [rdi + 0xe8], rcx
mov rax, qword [rcx + 0x140]
mov qword [rdi + 0xf0], rax
mov rax, qword [rcx + 0x148]
mov qword [rdi + 0xf8], rax
mov rax, qword [rcx + 0x150]
mov qword [rdi + 0x100], rax
mov qword [rsp + 0x20], rbp
lea r9, str.pParent_x
lea r8, [0x1400fec08]
lea rdx, [0x1400fec08]
call fcn.140080c70
mov qword [rdi + 0x450], 0
mov qword [rdi + 0x460], 0
mov word [rdi + 0x458], 0
mov qword [rdi + 0xb0], 0x6a
cmp dword [rdi + 0xa8], 0
jne 0x14002c72e
movzx eax, word [rdi + 0xb0]
mov dword [rdi + 0xa8], eax
call fcn.1400a02a0
mov rsi, qword [rax + 0x18]
mov edx, 0x6a
lea r8d, [rdx - 0x65]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
xor ebx, ebx
test rax, rax
je 0x14002c768
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
mov dword [rsp + 0x70], 0
lea rcx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_GetProcessDefaultLayout]
test eax, eax
je 0x14002c7a4
cmp dword [rsp + 0x70], 1
jne 0x14002c7a4
cmp word [rbx + 2], 0xffff
jne 0x14002c79d
cmp word [rbx], 1
jne 0x14002c7a4
or dword [rbx + 8], 0x400000
jmp 0x14002c7a4
or dword [rbx + 4], 0x400000
mov qword [rsp + 0x20], rsi
xor r9d, r9d
mov r8, rbp
mov rdx, rbx
mov rcx, rdi
call fcn.14009f338
mov rcx, qword [rdi + 0xf8]
test eax, eax
je 0x14002c7d7
movabs rax, 0x1000000000000000
or qword [rcx], rax
mov rax, rdi
jmp 0x14002c7e7
movabs rax, 0xefffffffffffffff
and qword [rcx], rax
mov rax, rdi
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x14002f200
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
sub rsp, 0x80
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov rsi, rdx
xor ebp, ebp
mov qword [rax - 0x68], rbp
mov dword [rax - 0x70], 0x80
mov dword [rax - 0x78], 3
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [rbp + 1]
mov rcx, qword [rcx + 0x10]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14002f3d9
lea r9d, [rbp + 2]
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
call fcn.14009d5e8
mov r11, rax
mov ecx, ebp
test rax, rax
setne cl
test ecx, ecx
jne 0x14002f290
mov ecx, 0x80004005
call fcn.1400034f0
int3
mov rax, qword [rax]
mov rcx, r11
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0xb0], rax
movzx ecx, word [rsp + 0x7e]
movzx edx, word [rsp + 0x7c]
movzx r10d, word [rsp + 0x7a]
movzx r11d, word [rsp + 0x78]
movzx ebx, word [rsp + 0x76]
movzx r9d, word [rsp + 0x72]
movzx r8d, word [rsp + 0x70]
lea rax, [0x1400fdbc8]
mov qword [rsp + 0x50], rax
mov rax, qword [rsi]
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x40], ecx
mov dword [rsp + 0x38], edx
mov dword [rsp + 0x30], r10d
mov dword [rsp + 0x28], r11d
mov dword [rsp + 0x20], ebx
lea rdx, str._04d__02d__02d__02d:_02d:_02d__03d_____s_s
lea rcx, [rsp + 0xb0]
call fcn.14000a800
mov rbx, qword [rsp + 0xb0]
cmp dword [rbx - 8], 1
jle 0x14002f330
mov edx, dword [rbx - 0x10]
lea rcx, [rsp + 0xb0]
call fcn.140003570
mov rbx, qword [rsp + 0xb0]
test rbx, rbx
je 0x14002f382
mov edx, 0x3fffffff
mov rcx, rdx
mov rax, rbx
mov r8d, ebp
cmp word [rax], r8w
je 0x14002f355
add rax, 2
sub rcx, 1
jne 0x14002f343
jmp 0x14002f35a
test rcx, rcx
jne 0x14002f36d
mov r8d, 0x80070057
mov rdx, rbp
mov qword [rsp + 0xb8], rdx
jmp 0x14002f378
sub rdx, rcx
mov qword [rsp + 0xb8], rdx
test r8d, r8d
js 0x14002f388
add rdx, rdx
jmp 0x14002f38b
mov r8d, 0x80070057
mov rdx, rbp
test r8d, r8d
cmovs rdx, rbp
mov qword [rsp + 0x68], rdx
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0xa0]
mov r8d, edx
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14002f3d9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
pop rsi
pop rbp
ret
Function at 0x140031ae0
Capabilities:
Identify system language via api

Disassembly:
push rbx
push rdi
push r12
sub rsp, 0x60
mov rdi, rcx
lea rcx, str.EPEULA64.dll
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
mov r12, rax
je 0x140031ce3
test rdi, rdi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], r15
jne 0x140031b25
mov r13, rbx
jmp 0x140031b29
mov r13, qword [rdi + 0x40]
mov rcx, qword [rdi + 0x180]
mov eax, dword [rcx]
bt rax, 0xe
jae 0x140031b3f
movzx eax, word [rcx + 0x40]
jmp 0x140031b45
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov r15, qword [rdi + 0x188]
movzx eax, ax
mov esi, 0x3fffffff
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x88], rbx
mov r14, rbx
lea rax, str.EpsonEULADialogBoxParam
mov rcx, rsi
cmp word [rax], bx
je 0x140031c2d
add rax, 2
sub rcx, 1
jne 0x140031b71
mov rsi, rbx
test esi, esi
movsxd r8, esi
je 0x140031cc6
mov rcx, qword [r15]
mov edx, 8
mov qword [rsp + 0x80], rbp
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
mov rbp, rax
je 0x140031cbe
lea rdx, str.EpsonEULADialogBoxParam
mov r9d, esi
mov r8, rax
mov rcx, r15
call fcn.140010410
test eax, eax
je 0x140031bdc
mov rdx, rbp
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
mov rcx, qword [r15]
mov r8, rbp
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
test r14, r14
je 0x140031cbe
mov r8, qword [rsp + 0x90]
mov r9d, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
lea rax, [rsp + 0x88]
lea edx, [r9 - 5]
mov rcx, r13
mov qword [rsp + 0x20], rax
call r14
test al, 2
jne 0x140031c45
test al, 1
jne 0x140031c45
mov edx, 0x2b2a
mov r8d, 1
jmp 0x140031cac
test rcx, rcx
je 0x140031b84
sub rsi, rcx
add rsi, rsi
add rsi, 2
jmp 0x140031b87
mov r9, qword [rdi + 0x40]
mov rcx, qword [rdi + 0x180]
mov qword [rsp + 0x30], rbx
mov r8d, 0x124
mov dx, 0x3ed
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
call fcn.14000de80
cmp eax, 7
je 0x140031ca4
mov rcx, qword [rdi + 0x180]
xor r9d, r9d
mov dx, 0x3ec
lea r8d, [r9 + 0x30]
mov qword [rsp + 0x20], rbx
call fcn.14000dab0
mov r11, qword [rdi + 0x180]
mov edx, 0x2b39
mov word [r11 + 0x2a], 3
jmp 0x140031ca9
mov edx, 0x2b20
xor r8d, r8d
mov rcx, qword [rdi + 0x40]
xor r9d, r9d
call qword [sym.imp.USER32.dll_PostMessageW]
mov ebx, 1
mov rbp, qword [rsp + 0x80]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov r15, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
mov r13, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov eax, ebx
add rsp, 0x60
pop r12
pop rdi
pop rbx
ret