joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001dde4
Capabilities:
Get common file path

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
lea rcx, [0x100083100]
mov rax, qword [0x100083100]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x50], rbx
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
mov edi, 0x105
sub eax, edi
or eax, ecx
jge 0x10001de36
mov edx, edi
lea rcx, [rsp + 0x50]
call fcn.100020154
mov rbx, qword [rsp + 0x50]
cmp dword [rbx - 0xc], edi
jge 0x10001de46
mov ecx, 0x80070057
call fcn.1000201f8
int3
mov dword [rbx - 0x10], edi
and word [rbx + 0x20a], 0
mov edx, edi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
or rsi, 0xffffffffffffffff
test eax, eax
je 0x10001df89
xor eax, eax
mov rcx, rsi
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
test ecx, ecx
js 0x10001df7e
cmp ecx, dword [rbx - 0xc]
jg 0x10001df7e
mov dword [rbx - 0x10], ecx
movsxd rax, ecx
and word [rbx + rax*2], 0
lea rcx, [0x100083100]
mov rax, qword [0x100083100]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x58], rax
lea rdx, [0x100001f80]
lea rcx, [rsp + 0x60]
call fcn.100020428
nop
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x50]
call fcn.100032a84
mov dil, al
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
mov ecx, esi
lock xadd dword [rdx + 0x10], ecx
add ecx, esi
test ecx, ecx
jg 0x10001def8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test dil, dil
je 0x10001df51
mov rdi, qword [rsp + 0x58]
mov rdx, rdi
lea rcx, [0x1000837c0]
call fcn.10003092c
mov ebx, eax
lea rdx, [rdi - 0x18]
mov ecx, esi
lock xadd dword [rdx + 0x10], ecx
add ecx, esi
test ecx, ecx
jg 0x10001df2e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, esi
test eax, eax
jg 0x10001df4d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, ebx
jmp 0x10001dfa5
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, esi
test eax, eax
jg 0x10001df77
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x50]
jmp 0x10001df89
mov rbx, qword [rsp + 0x50]
jmp 0x10001df89
mov ecx, 0x80070057
call fcn.1000201f8
nop
lea rdx, [rbx - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, esi
test eax, eax
jg 0x10001dfa3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
Function at 0x10001fc18
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x20
mov r13, rcx
mov r12d, edx
lea rcx, [0x100083910]
xor edx, edx
xor ebx, ebx
call fcn.10006b828
lea ebp, [rbx + 1]
jmp 0x10001fcf5
test rbx, rbx
jne 0x10001fd01
mov eax, r12d
lea edx, [rbx + 6]
xor r9d, r9d
shr eax, 4
mov rcx, rsi
add ax, 1
movzx r8d, ax
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
test rax, rax
mov rbx, rax
je 0x10001fce4
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x10001fc91
xor ebx, ebx
jmp 0x10001fcdf
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
mov rdi, rax
je 0x10001fc8d
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, r12d
mov r11d, eax
add r11, rdi
and ecx, 0xf
jbe 0x10001fcce
cmp rdi, r11
jae 0x10001fc8d
add ecx, 0xffffffff
movzx eax, word [rdi]
lea rdi, [rdi + rax*2 + 2]
jne 0x10001fcbc
cmp rdi, r11
jae 0x10001fc8d
movzx eax, word [rdi]
neg ax
sbb rbx, rbx
and rbx, rdi
test rbx, rbx
jne 0x10001fd03
lea rcx, [0x100083910]
mov edx, ebp
call fcn.10006b828
add ebp, 1
test rax, rax
mov rsi, rax
jne 0x10001fc4e
xor esi, esi
test rsi, rsi
jne 0x10001fd0c
xor eax, eax
jmp 0x10001fd1a
mov r8d, r12d
mov rdx, rsi
mov rcx, r13
call fcn.10001fd3c
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r13
pop r12
pop rdi
ret
Function at 0x10001fd3c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x20
mov eax, r8d
mov rbp, rdx
mov ebx, r8d
shr eax, 4
mov rsi, rcx
mov r8d, 6
add ax, 1
mov rcx, rbp
movzx edx, ax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
mov r12, rax
je 0x10001fea5
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x10001fea5
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
mov rdi, rax
je 0x10001fea5
mov rdx, r12
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r11d, eax
add r11, rdi
and ebx, 0xf
jbe 0x10001fddd
cmp rdi, r11
jae 0x10001fea5
add ebx, 0xffffffff
movzx eax, word [rdi]
lea rdi, [rdi + rax*2 + 2]
jne 0x10001fdc7
cmp rdi, r11
jae 0x10001fea5
cmp word [rdi], 0
je 0x10001fea5
mov rax, qword [rsi]
movzx ebx, word [rdi]
mov ecx, 1
sub ecx, dword [rax - 8]
mov eax, dword [rax - 0xc]
sub eax, ebx
or ecx, eax
jge 0x10001fe11
mov edx, ebx
mov rcx, rsi
call fcn.100020154
movzx ecx, word [rdi]
lea r8, [rdi + 2]
cmp ecx, 0xffffffff
jne 0x10001fe2e
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r8
repne scasw ax, word [rdi]
not rcx
and ecx, ecx
movsxd r9, ecx
mov rcx, qword [rsi]
lea rdi, [rbx + rbx]
mov rdx, rdi
add r9, r9
call fcn.10006c1dc
test eax, eax
je 0x10001fe7c
cmp eax, 0xc
je 0x10001fe71
cmp eax, 0x16
je 0x10001fe66
cmp eax, 0x22
je 0x10001fe66
cmp eax, 0x50
je 0x10001fe7c
mov ecx, 0x80004005
call fcn.1000201f8
int3
mov ecx, 0x80070057
call fcn.1000201f8
int3
mov ecx, 0x8007000e
call fcn.1000201f8
int3
test ebx, ebx
js 0x10001fe9a
mov rcx, qword [rsi]
cmp ebx, dword [rcx - 0xc]
jg 0x10001fe9a
mov dword [rcx - 0x10], ebx
mov rcx, qword [rsi]
mov eax, 1
and word [rdi + rcx], 0
jmp 0x10001fea7
mov ecx, 0x80070057
call fcn.1000201f8
int3
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret
Function at 0x10002d264
Capabilities:
Set file attributes

Disassembly:
mov qword [rsp + 0x10], rdx
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov r15, r8
mov rbp, rdx
mov rbx, rcx
mov rcx, r8
call fcn.1000202e8
lea rdx, [0x10000a394]
mov rcx, qword [rbx]
call qword [sym.imp.msvcrt.dll__wfopen]
mov r13, rax
test rax, rax
jne 0x10002d2fd
mov edx, 0x80
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rdx, [0x10000a394]
mov rcx, qword [rbx]
call qword [sym.imp.msvcrt.dll__wfopen]
mov r13, rax
test rax, rax
jne 0x10002d2fd
mov rcx, qword [rbp]
test rcx, rcx
je 0x10002d2f6
lock add dword [rcx + 8], 0xffffffff
jne 0x10002d2f1
test rcx, rcx
je 0x10002d2f1
mov rax, qword [rcx]
lea edx, [r13 + 1]
call qword [rax]
and qword [rbp], 0
xor eax, eax
jmp 0x10002d3f2
mov rax, qword [rbp]
mov r12, qword [rax + 0x10]
test r12, r12
je 0x10002d3bf
xor eax, eax
test r12, r12
setne al
test eax, eax
je 0x10002d3b4
mov rbx, qword [r12 + 0x10]
mov r12, qword [r12]
test rbx, rbx
je 0x10002d331
lock add dword [rbx + 8], 1
mov qword [rsp + 0x60], rbx
mov rax, qword [rbx + 0x18]
cmp dword [rax - 0x10], 0
jne 0x10002d356
mov r8, qword [rbx + 0x20]
lea rdx, [0x10000a3a0]
mov rcx, r13
call qword [sym.imp.msvcrt.dll_fwprintf]
jmp 0x10002d395
mov r8, qword [rbx + 0x20]
lea rdx, [0x10000a3a0]
mov rcx, r13
call qword [sym.imp.msvcrt.dll_fwprintf]
mov r8, qword [rbx + 0x18]
lea rdx, [0x10000a3b0]
mov rcx, r13
call qword [sym.imp.msvcrt.dll_fwprintf]
mov r11, qword [r15]
cmp dword [r11 - 0x10], 0
jne 0x10002d395
lea rdx, [rbx + 0x18]
mov rcx, r15
call fcn.10001f050
nop
lock add dword [rbx + 8], 0xffffffff
jne 0x10002d3a9
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [rax]
test r12, r12
jne 0x10002d30e
jmp 0x10002d3bf
mov ecx, 0x80004005
call fcn.1000201f8
int3
mov rcx, r13
call qword [sym.imp.msvcrt.dll_fclose]
nop
mov rcx, qword [rbp]
test rcx, rcx
je 0x10002d3ed
lock add dword [rcx + 8], 0xffffffff
jne 0x10002d3e8
test rcx, rcx
je 0x10002d3e8
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
and qword [rbp], 0
mov eax, 1
mov rbx, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x10003092c
Capabilities:
Check mutex on windows
Get file size
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rsi
mov qword [rax + 8], rcx
push rdi
sub rsp, 0x80
mov rsi, rdx
xor edi, edi
and dword [rax - 0x48], edi
and dword [rax + 8], edi
cmp qword [0x1000837c0], 0xffffffffffffffff
je 0x10003095c
lea eax, [rdi + 1]
jmp 0x100030a7b
lea rcx, [rsp + 0x48]
call fcn.100068f30
test eax, eax
je 0x100030971
xor eax, eax
jmp 0x100030a7b
lea r8, [0x100009ba0]
xor edx, edx
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [0x1000837c8], rax
test rax, rax
jne 0x1000309a2
lea rcx, [rsp + 0x48]
call fcn.1000690dc
xor eax, eax
jmp 0x100030a7b
lea rcx, [rsp + 0x48]
call fcn.1000690dc
and qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov edx, 0xc0000000
lea r8d, [r9 + 3]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x1000837c0], rax
cmp rax, 0xffffffffffffffff
jne 0x1000309f6
lea rcx, [0x1000837c0]
call fcn.100030ab4
xor eax, eax
jmp 0x100030a7b
xor esi, esi
mov dword [rsp + 0x40], esi
xor edx, edx
mov rcx, qword [0x1000837c8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x100030a22
cmp eax, 0x80
je 0x100030a22
cmp eax, 0x102
jne 0x100030a68
lea edi, [rsi + 1]
jmp 0x100030a68
mov edi, 1
mov esi, edi
mov dword [rsp + 0x40], edi
xor edx, edx
mov rcx, qword [0x1000837c0]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
test eax, eax
jne 0x100030a68
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x90]
lea r8d, [rdi + 1]
lea rdx, [0x100006354]
mov rcx, qword [0x1000837c0]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, eax
test esi, esi
je 0x100030a79
mov rcx, qword [0x1000837c8]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, edi
mov rsi, qword [rsp + 0x98]
add rsp, 0x80
pop rdi
ret

Function at 0x100030af8
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push r12
sub rsp, 0x40
mov esi, r8d
mov r12, rdx
xor edi, edi
and dword [rax + 8], edi
and dword [rax - 0x18], edi
cmp qword [0x1000837c0], 0xffffffffffffffff
jne 0x100030b30
xor eax, eax
jmp 0x100030bb1
xor ebx, ebx
mov dword [rsp + 0x30], ebx
mov edx, 0x3e8
mov rcx, qword [0x1000837c8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x100030b5c
cmp eax, 0x80
je 0x100030b5c
cmp eax, 0x102
je 0x100030b65
jmp 0x100030b9e
mov ebx, 1
mov dword [rsp + 0x30], ebx
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov rcx, qword [0x1000837c0]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
lea r8d, [rsi + rsi]
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x50]
mov rdx, r12
mov rcx, qword [0x1000837c0]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, eax
test ebx, ebx
je 0x100030baf
mov rcx, qword [0x1000837c8]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, edi
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r12
ret
Function at 0x100030bf0
Capabilities:
Manipulate console buffer

Disassembly:
mov rax, rsp
push rbx
push rsi
push rdi
sub rsp, 0x50
xor ebx, ebx
mov dword [rax + 0x18], ebx
mov word [rax + 8], bx
mov word [rax + 0xa], bx
call fcn.100033d10
cmp eax, 2
je 0x100030db7
lea rcx, [0x10000a9a8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
cmp rax, rbx
mov rdi, rax
je 0x100030db7
lea rdx, [0x10000a9c8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp rax, rbx
je 0x100030dae
or ecx, 0xffffffff
call rax
cmp eax, ebx
je 0x100030dae
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
cmp rax, 0xffffffffffffffff
mov qword [0x1000844f8], rax
je 0x100030da8
lea rdx, [0x100084094]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleMode]
cmp eax, ebx
je 0x100030da8
mov edx, dword [0x100084094]
mov rcx, qword [0x1000844f8]
or edx, 3
call qword [sym.imp.KERNEL32.dll_SetConsoleMode]
cmp eax, ebx
je 0x100030da8
mov rcx, qword [0x1000844f8]
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
cmp eax, ebx
je 0x100030da8
movsx rsi, word [rsp + 0x34]
mov word [0x100084092], 1
mov rcx, rsi
mov word [0x100084090], si
shl rcx, 2
cmp rcx, rsi
jb 0x100030da8
call qword [sym.imp.msvcrt.dll_malloc]
cmp rax, rbx
mov qword [0x100084500], rax
je 0x100030d54
movzx ecx, word [rsp + 0x36]
mov r8d, dword [0x100084090]
mov word [rsp + 0x78], bx
mov word [rsp + 0x8a], cx
add cx, 1
mov word [rsp + 0x7a], bx
mov r9d, dword [rsp + 0x78]
mov word [rsp + 0x8e], cx
lea rcx, [rsp + 0x88]
mov qword [rsp + 0x20], rcx
mov rcx, qword [0x1000844f8]
mov rdx, rax
mov word [rsp + 0x88], bx
mov word [rsp + 0x8c], si
call qword [sym.imp.KERNEL32.dll_ReadConsoleOutputW]
movzx eax, word [rsp + 0x36]
movsx r8d, word [rsp + 0x34]
mov rcx, qword [0x1000844f8]
mov word [rsp + 0x72], ax
lea rax, [rsp + 0x80]
mov word [rsp + 0x70], bx
mov r9d, dword [rsp + 0x70]
mov dx, 0x20
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_FillConsoleOutputCharacterW]
cmp eax, ebx
je 0x100030da8
mov edx, dword [rsp + 0x70]
mov rcx, qword [0x1000844f8]
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
mov ebx, 1
jmp 0x100030dae
call qword [sym.imp.KERNEL32.dll_FreeConsole]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, ebx
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x100030dc8
Capabilities:
Manipulate console buffer

Disassembly:
sub rsp, 0x58
cmp qword [0x100084500], 0
je 0x100030e91
mov rcx, qword [0x1000844f8]
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
je 0x100030e7c
movzx ecx, word [rsp + 0x36]
movzx eax, word [0x100084092]
mov r8d, dword [0x100084090]
and word [rsp + 0x60], 0
and word [rsp + 0x62], 0
mov rdx, qword [0x100084500]
mov r9d, dword [rsp + 0x60]
and word [rsp + 0x68], 0
add ax, cx
mov word [rsp + 0x6e], ax
mov word [rsp + 0x6a], cx
mov rcx, qword [0x1000844f8]
lea rax, [rsp + 0x68]
mov word [rsp + 0x6c], r8w
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteConsoleOutputW]
test eax, eax
je 0x100030e7c
movzx eax, word [rsp + 0x6c]
mov rcx, qword [0x1000844f8]
add ax, 1
mov word [rsp + 0x60], ax
movzx eax, word [rsp + 0x6e]
mov word [rsp + 0x62], ax
mov edx, dword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
mov rcx, qword [0x100084500]
call qword [sym.imp.msvcrt.dll_free]
and qword [0x100084500], 0
mov edx, dword [0x100084094]
mov rcx, qword [0x1000844f8]
call qword [sym.imp.KERNEL32.dll_SetConsoleMode]
or qword [0x1000844f8], 0xffffffffffffffff
add rsp, 0x58
jmp qword [sym.imp.KERNEL32.dll_FreeConsole]
insb byte [rdi], dx
add byte gs:[rax], al
fadd dword [rbx]
push rbx
je 0x1000820d7
jbe 0x1000820f9
outsb dx, byte [rsi]
je 0x100082097
add byte [rsi], dh
jb 0x100082102
invalid
add byte [rbx + 0x68], al
invalid
insd dword [rdi], dx
jo 0x1000820fc
pop rax
add ebx, dword [rdi + 0x76]
jae 0x100082170
ja 0x100082174
jb 0x10008216f
outsb dx, byte [rsi]
je 0x10008216f
add cl, bh
add al, 0x77
invalid
add byte [rdi], bh
invalid
invalid
pop rcx
push r8
pop r8
pop rdi
pop rdx
add bh, ch
add al, 0x77
invalid
Function at 0x100030f74
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x20
mov rsi, qword [rcx + 8]
mov rbx, rcx
mov rcx, qword [rcx]
xor r12d, r12d
xor ebp, ebp
xor edi, edi
call qword [sym.imp.msvcrt.dll_feof]
test eax, eax
jne 0x100031070
mov r9, qword [rbx]
lea edx, [rax + 1]
lea rcx, [rsp + 0x40]
mov r8, rdx
call qword [sym.imp.msvcrt.dll_fread]
cmp rax, 1
jne 0x100031061
mov al, byte [rsp + 0x40]
cmp al, 0x2c
je 0x100031070
cmp al, 0xa
je 0x100031070
mov rdx, qword [rbx + 0x10]
add r12, 1
cmp r12, rdx
jbe 0x100031029
mov rcx, qword [rbx + 8]
test rcx, rcx
jne 0x100031002
mov ecx, 0x106
mov qword [rbx + 0x10], 0x104
call qword [sym.imp.msvcrt.dll_malloc]
jmp 0x100031017
add rdx, 0x104
mov qword [rbx + 0x10], rdx
add rdx, 2
call qword [sym.imp.msvcrt.dll_realloc]
test rax, rax
je 0x100031049
mov qword [rbx + 8], rax
lea rsi, [rax + r12 - 1]
mov al, byte [rsp + 0x40]
mov byte [rsi], al
cmp byte [rsp + 0x40], 0x20
je 0x10003103d
test rbp, rbp
mov rdi, rsi
jne 0x10003103d
mov rbp, rsi
mov rcx, qword [rbx]
add rsi, 1
jmp 0x100030f97
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x10003105d
call qword [sym.imp.msvcrt.dll_free]
and qword [rbx + 8], 0
xor eax, eax
jmp 0x100031081
mov rcx, qword [rbx]
call qword [sym.imp.msvcrt.dll_fclose]
and qword [rbx], 0
jmp 0x10003105d
cmp qword [rbx], 0
je 0x10003105d
mov byte [rdi + 1], 0
mov rax, rbp
mov byte [rdi + 2], 0
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r12
pop rdi
pop rsi
ret

Function at 0x100031638
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
sub rsp, 0x20
movzx ebx, cx
mov rcx, qword [0x100084508]
test rcx, rcx
je 0x100031676
movzx edx, bx
mov r8d, 5
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x100031676
mov rcx, qword [0x100084508]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x1000316ab
mov rcx, qword [0x100084510]
test rcx, rcx
je 0x1000316b6
movzx edx, bx
mov r8d, 5
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x1000316b6
mov rcx, qword [0x100084510]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x1000316b6
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
jmp 0x1000316b8
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x1000318d8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
test rcx, rcx
mov rbx, rdx
mov rdi, rcx
je 0x1000319c1
test rdx, rdx
je 0x1000319c1
xor r9d, r9d
lea rdx, [0x10000ac60]
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
test rax, rax
je 0x1000319b6
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
mov rdi, rax
je 0x1000319b6
xor r9d, r9d
lea rdx, [0x10000ac60]
mov rcx, rbx
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
test rax, rax
je 0x1000319b6
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
mov r11, rax
je 0x1000319b6
mov eax, 0xfecdfecd
cmp dword [rdi], eax
jne 0x1000319c1
cmp dword [r11], eax
jne 0x1000319c1
mov rdx, qword [rdi + 0x1c]
cmp rdx, qword [r11 + 0x1c]
jne 0x100031985
mov rdx, qword [rdi + 0x24]
cmp rdx, qword [r11 + 0x24]
jne 0x100031985
xor eax, eax
jmp 0x10003198a
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x1000319af
mov rdx, qword [rdi + 0x2c]
cmp rdx, qword [r11 + 0x2c]
jne 0x1000319a6
mov rdx, qword [rdi + 0x34]
cmp rdx, qword [r11 + 0x34]
jne 0x1000319a6
xor eax, eax
jmp 0x1000319ab
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x1000319c1
mov eax, 1
jmp 0x1000319c3
mov ecx, 0xd
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1000321e0
Capabilities:
Check os version

Disassembly:
sub rsp, 0x158
mov rax, qword [0x100083138]
xor rax, rsp
mov qword [rsp + 0x140], rax
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x11c
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x100032235
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov edx, dword [rsp + 0x30]
mov ecx, dword [rsp + 0x24]
xor eax, eax
lea r8d, [rax + 1]
sub edx, r8d
je 0x1000322a1
cmp edx, r8d
jne 0x1000322bb
cmp ecx, 5
jne 0x100032297
mov ecx, dword [rsp + 0x28]
test ecx, ecx
je 0x100032290
sub ecx, r8d
je 0x100032280
cmp ecx, r8d
je 0x10003226a
lea eax, [r8 + 0x13]
jmp 0x1000322bb
cmp word [rsp + 0x134], r8w
mov ecx, 0x10
cmovae eax, ecx
or eax, 4
jmp 0x1000322bb
cmp word [rsp + 0x134], 2
mov ecx, 8
jmp 0x100032278
mov eax, 4
jmp 0x1000322bb
cmp ecx, 4
ja 0x1000322d3
mov eax, 2
cmp ecx, 4
jne 0x1000322bb
mov ecx, dword [rsp + 0x28]
test ecx, ecx
je 0x1000322b8
cmp ecx, 0xa
je 0x1000322b8
cmp ecx, 0x5a
jne 0x1000322bb
mov eax, r8d
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.10006bd80
add rsp, 0x158
ret
cmp ecx, 6
jne 0x1000322ed
cmp dword [rsp + 0x28], eax
jne 0x1000322ed
cmp dword [rsp + 0x2c], 0x1554
jae 0x1000322ed
lea eax, [rcx + 0x3a]
jmp 0x1000322bb
mov eax, 0x20
jmp 0x1000322bb

Function at 0x100032464
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x100083138]
xor rax, rsp
mov qword [rsp + 0x48], rax
cmp word [0x100084a08], 0
jne 0x100032540
lea rax, [r11 - 0x20]
lea rdx, [0x100009ad0]
mov r9d, 1
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x30], 6
mov qword [r11 - 0x38], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100032540
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea rdx, [0x100009b88]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x100032540
lea rsi, [0x100009770]
mov rdi, rsi
mov rdx, qword [rdi]
lea rcx, [rsp + 0x40]
mov r8d, 3
call sub.msvcrt.dll__wcsnicmp
test eax, eax
je 0x10003252e
add ebx, 1
add rdi, 0x10
cmp ebx, 0x1c
jb 0x100032509
jmp 0x100032540
movsxd rax, ebx
add rax, rax
movzx eax, word [rsi + rax*8 + 8]
mov word [0x100084a08], ax
mov ax, word [0x100084a08]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.10006bd80
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret

Function at 0x100032d64
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x100032d7a
xor al, al
jmp 0x100032d81
shr eax, 4
not al
and al, 1
add rsp, 0x28
ret