joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140002280
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
movzx r8d, word [rcx + 6]
lea rax, [rcx + rax + 0x18]
test r8w, r8w
je 0x1400022cd
lea ecx, [r8 - 1]
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
mov rcx, r8
cmp rdx, r8
jb 0x1400022c4
add ecx, dword [rax + 8]
cmp rdx, rcx
jb 0x1400022cf
add rax, 0x28
cmp rax, r9
jne 0x1400022b0
xor eax, eax
ret

Function at 0x1400022d0
Capabilities:
Parse pe header

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov rsi, rcx
call sym.strlen
cmp rax, 8
ja 0x140002368
mov rdx, qword [0x140009740]
xor ebx, ebx
cmp word [rdx], 0x5a4d
jne 0x140002356
movsxd rax, dword [rdx + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
jne 0x140002356
cmp word [rax + 0x18], 0x20b
jne 0x140002356
movzx edx, word [rax + 0x14]
lea rbx, [rax + rdx + 0x18]
movzx edx, word [rax + 6]
test dx, dx
je 0x140002368
lea eax, [rdx - 1]
lea rax, [rax + rax*4]
lea rdi, [rbx + rax*8 + 0x28]
jmp 0x140002341
add rbx, 0x28
cmp rbx, rdi
je 0x140002368
mov r8d, 8
mov rdx, rsi
mov rcx, rbx
call sym.strncmp
test eax, eax
jne 0x140002338
mov rax, rbx
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
xor ebx, ebx
mov rax, rbx
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x140002380
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x140009740]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x1400023a0
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x1400023a8
ret
cmp word [r8 + 0x18], 0x20b
jne 0x1400023a0
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x1400023fd
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x1400023f4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x1400023a0
add rax, 0x28
cmp rax, r9
jne 0x1400023e0
xor eax, eax
ret

Function at 0x140002400
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140009740]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x14000241f
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x140002428
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x14000241f
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x140002440
Capabilities:
Parse pe header

Disassembly:
mov r8, qword [0x140009740]
xor eax, eax
cmp word [r8], 0x5a4d
jne 0x140002460
movsxd rdx, dword [r8 + 0x3c]
add rdx, r8
cmp dword [rdx], 0x4550
je 0x140002468
ret
cmp word [rdx + 0x18], 0x20b
jne 0x140002460
movzx eax, word [rdx + 0x14]
movzx r8d, word [rdx + 6]
lea rax, [rdx + rax + 0x18]
test r8w, r8w
je 0x1400024b0
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea rdx, [rax + rdx*8 + 0x28]
nop dword [rax]
test byte [rax + 0x27], 0x20
je 0x1400024a7
test rcx, rcx
je 0x140002460
sub rcx, 1
add rax, 0x28
cmp rdx, rax
jne 0x140002498
xor eax, eax
ret
Function at 0x1400024c0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140009740]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x1400024df
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x1400024e8
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret

Function at 0x140002500
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x140009740]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x140002520
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x140002528
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140002520
sub rcx, rdx
movzx r9d, word [r8 + 6]
movzx edx, word [r8 + 0x14]
lea rdx, [r8 + rdx + 0x18]
test r9w, r9w
je 0x140002520
lea eax, [r9 - 1]
lea rax, [rax + rax*4]
lea r9, [rdx + rax*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rdx + 0xc]
mov rax, r8
cmp rcx, r8
jb 0x140002574
add eax, dword [rdx + 8]
cmp rcx, rax
jb 0x140002580
add rdx, 0x28
cmp rdx, r9
jne 0x140002560
xor eax, eax
ret
mov eax, dword [rdx + 0x24]
not eax
shr eax, 0x1f
ret

Function at 0x140002590
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov r11, qword [0x140009740]
xor r8d, r8d
cmp word [r11], 0x5a4d
mov r10d, ecx
jne 0x1400025b4
movsxd rcx, dword [r11 + 0x3c]
add rcx, r11
cmp dword [rcx], 0x4550
je 0x1400025c0
mov rax, r8
ret
cmp word [rcx + 0x18], 0x20b
jne 0x1400025b4
mov eax, dword [rcx + 0x90]
test eax, eax
je 0x1400025b4
movzx edx, word [rcx + 0x14]
movzx r9d, word [rcx + 6]
lea rdx, [rcx + rdx + 0x18]
test r9w, r9w
je 0x1400025b4
lea ecx, [r9 - 1]
lea rcx, [rcx + rcx*4]
lea r9, [rdx + rcx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rdx + 0xc]
mov rcx, r8
cmp rax, r8
jb 0x14000260c
add ecx, dword [rdx + 8]
cmp rax, rcx
jb 0x140002620
add rdx, 0x28
cmp r9, rdx
jne 0x1400025f8
xor r8d, r8d
mov rax, r8
ret
add rax, r11
jmp 0x140002630
sub r10d, 1
add rax, 0x14
mov ecx, dword [rax + 4]
test ecx, ecx
jne 0x14000263e
mov edx, dword [rax + 0xc]
test edx, edx
je 0x140002615
test r10d, r10d
jg 0x140002628
mov r8d, dword [rax + 0xc]
add r8, r11
mov rax, r8
ret
Function at 0x14002ef40
Capabilities:
Get graphical window text

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x14002ef96
mov rax, qword [rsp + 0x50]
cmp qword [rax + 0xa0], 0
jne 0x14002ef96
mov edx, 0x100
lea rcx, str.f:dd_vctools_vc7libs_ship_atlmfc_srcmfcwinocc.cpp
call fcn.14006ca30
test eax, eax
je 0x14002ef96
int3
mov rax, qword [rsp + 0x50]
cmp qword [rax + 0xa0], 0
jne 0x14002efc2
mov r8d, dword [rsp + 0x60]
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x14002f033
lea rcx, [rsp + 0x20]
call fcn.140017800
nop
mov rax, qword [rsp + 0x50]
mov rax, qword [rax + 0xa0]
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx + 0xa0]
mov rax, qword [rax]
lea rdx, [rsp + 0x20]
call qword [rax + 0x128]
lea rcx, [rsp + 0x20]
call fcn.1400178e0
movsxd rdx, dword [rsp + 0x60]
mov r9, 0xffffffffffffffff
mov r8, rax
mov rcx, qword [rsp + 0x58]
call fcn.14002f040
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [rsp + 0x28], eax
lea rcx, [rsp + 0x20]
call fcn.140017890
mov eax, dword [rsp + 0x28]
add rsp, 0x48
ret
Function at 0x140031e80
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
cmp qword [rsp + 0x68], 0
jne 0x140031eb8
mov edx, 0x62
lea rcx, str.f:dd_vctools_vc7libs_ship_atlmfc_srcmfc_appui3.cpp
call fcn.14006ca30
test eax, eax
je 0x140031eb8
int3
cmp qword [rsp + 0x70], 0
jne 0x140031ed8
mov edx, 0x63
lea rcx, str.f:dd_vctools_vc7libs_ship_atlmfc_srcmfc_appui3.cpp
call fcn.14006ca30
test eax, eax
je 0x140031ed8
int3
mov rax, qword [rsp + 0x60]
cmp qword [rax + 0xa8], 0
je 0x140031fa9
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
call fcn.140031dc0
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jne 0x140031f10
mov eax, dword [rsp + 0x78]
jmp 0x140031ff1
mov dword [rsp + 0x40], 4
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [rsp + 0x44], eax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rsp + 0x44], 0
jne 0x140031fa1
cmp dword [rsp + 0x30], 4
je 0x140031f79
mov edx, reloc.OLEAUT32.dll_VarBstrFromDate
lea rcx, str.f:dd_vctools_vc7libs_ship_atlmfc_srcmfc_appui3.cpp
call fcn.14006ca30
test eax, eax
je 0x140031f79
int3
mov eax, dword [rsp + 0x40]
cmp rax, 4
je 0x140031f9b
mov edx, reloc.OLEAUT32.dll_VarBstrFromDisp
lea rcx, str.f:dd_vctools_vc7libs_ship_atlmfc_srcmfc_appui3.cpp
call fcn.14006ca30
test eax, eax
je 0x140031f9b
int3
mov eax, dword [rsp + 0x48]
jmp 0x140031ff1
mov eax, dword [rsp + 0x78]
jmp 0x140031ff1
mov rax, qword [rsp + 0x60]
cmp qword [rax + 0xd0], 0
jne 0x140031fd0
mov edx, 0x79
lea rcx, str.f:dd_vctools_vc7libs_ship_atlmfc_srcmfc_appui3.cpp
call fcn.14006ca30
test eax, eax
je 0x140031fd0
int3
mov r9, qword [rsp + 0x60]
mov r9, qword [r9 + 0xd0]
mov r8d, dword [rsp + 0x78]
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
add rsp, 0x58
ret
Function at 0x140033af0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x70
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x30], 0
cmp qword [rsp + 0x90], 0
je 0x140033c86
call fcn.14006d190
mov qword [rsp + 0x38], rax
mov r8d, 0xf0
mov rdx, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
je 0x140033bf2
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x140033bbd
lea rcx, [0x1402f0108]
call fcn.140001096
mov rbx, rax
mov r8d, 0x16f
lea rdx, str.f:dd_vctools_vc7libs_ship_atlmfc_srcmfcoccmgr.cpp
lea rcx, [rsp + 0x50]
call fcn.140001244
lea r9, str.DLGINIT_resource_was_found__but_could_not_be_loaded._n
xor r8d, r8d
mov rdx, rbx
mov rcx, rax
call fcn.1400174f0
xor eax, eax
jmp 0x140033d2f
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140033bed
mov edx, 0x175
lea rcx, str.f:dd_vctools_vc7libs_ship_atlmfc_srcmfcoccmgr.cpp
call fcn.14006ca30
test eax, eax
je 0x140033bed
int3
jmp 0x140033c86
mov rax, qword [rsp + 0x98]
mov rax, qword [rax + 8]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
jne 0x140033c23
mov edx, 0x17d
lea rcx, str.f:dd_vctools_vc7libs_ship_atlmfc_srcmfcoccmgr.cpp
call fcn.14006ca30
test eax, eax
je 0x140033c23
int3
mov rax, qword [rsp + 0x48]
cmp qword [rax], 0xffffffffffffffff
je 0x140033c86
mov rax, qword [rsp + 0x48]
cmp qword [rax], 0
je 0x140033c76
lea rcx, [0x1402f0108]
call fcn.140001096
mov rbx, rax
mov r8d, 0x183
lea rdx, str.f:dd_vctools_vc7libs_ship_atlmfc_srcmfcoccmgr.cpp
lea rcx, [rsp + 0x60]
call fcn.140001244
lea r9, str.Dialog_has_OLE_controls__but_no_matching_DLGINIT_resource._n
xor r8d, r8d
mov rdx, rbx
mov rcx, rax
call fcn.1400174f0
jmp 0x140033c86
mov rax, qword [rsp + 0x48]
add rax, 8
mov qword [rsp + 0x48], rax
jmp 0x140033c23
mov dword [rsp + 0x28], 1
cmp qword [rsp + 0x20], 0
je 0x140033cc5
mov rax, qword [rsp + 0x80]
mov rax, qword [rax]
mov r9, qword [rsp + 0x98]
mov r8, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x80]
call qword [rax + 0x40]
mov dword [rsp + 0x28], eax
cmp qword [rsp + 0x20], 0
je 0x140033cea
cmp qword [rsp + 0x30], 0
je 0x140033cea
mov rcx, qword [rsp + 0x30]
call fcn.140033d40
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rax, qword [rsp + 0x88]
cmp qword [rax + 0x98], 0
je 0x140033d2b
mov rax, qword [rsp + 0x88]
mov rax, qword [rax + 0x98]
mov rcx, qword [rsp + 0x88]
mov rcx, qword [rcx + 0x98]
mov rax, qword [rax]
mov rdx, qword [rsp + 0x98]
call qword [rax + 0x150]
mov eax, dword [rsp + 0x28]
add rsp, 0x70
pop rbx
ret
Function at 0x140037540
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [rsp + 0x58]
shr rax, 0x10
test rax, rax
je 0x14003758c
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x58]
call fcn.1400916e0
test eax, eax
jne 0x14003758c
mov edx, 0x98
lea rcx, str.f:dd_vctools_vc7libs_ship_atlmfc_srcmfcdlgcore.cpp
call fcn.14006ca30
test eax, eax
je 0x14003758c
int3
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x58]
mov qword [rcx + 0xb0], rax
mov rax, qword [rsp + 0x50]
mov rax, qword [rax + 0xb0]
shr rax, 0x10
test rax, rax
jne 0x1400375e0
mov rax, qword [rsp + 0x50]
cmp dword [rax + 0xa8], 0
jne 0x1400375e0
mov rax, qword [rsp + 0x50]
mov rax, qword [rax + 0xb0]
and rax, 0xffff
movzx ecx, ax
mov rax, qword [rsp + 0x50]
mov dword [rax + 0xa8], ecx
xor edx, edx
mov rcx, qword [rsp + 0x58]
call fcn.140038f90
test eax, eax
jne 0x140037625
xor eax, eax
test eax, eax
jne 0x14003760e
mov edx, reloc.OLEAUT32.dll_LoadRegTypeLib
lea rcx, str.f:dd_vctools_vc7libs_ship_atlmfc_srcmfcdlgcore.cpp
call fcn.14006ca30
test eax, eax
je 0x14003760e
int3
mov rax, qword [rsp + 0x50]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x50]
call qword [rax + 0x248]
xor eax, eax
jmp 0x14003768b
call fcn.14006d190
mov qword [rsp + 0x28], rax
mov r8d, 5
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov qword [rsp + 0x38], rax
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x28]
mov r8, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x50]
call fcn.1400376c0
mov dword [rsp + 0x30], eax
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [rsp + 0x30]
add rsp, 0x48
ret

Function at 0x140037800
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], 0
call fcn.14006d190
mov qword [rsp + 0x28], rax
mov r8d, 5
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov qword [rsp + 0x30], rax
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
je 0x140037877
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jne 0x140037897
mov edx, 0xdf
lea rcx, str.f:dd_vctools_vc7libs_ship_atlmfc_srcmfcdlgcore.cpp
call fcn.14006ca30
test eax, eax
je 0x140037897
int3
mov r9, qword [rsp + 0x28]
mov r8, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
call fcn.1400378e0
mov dword [rsp + 0x20], eax
mov rcx, qword [rsp + 0x40]
call fcn.140033d40
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [rsp + 0x20]
add rsp, 0x58
ret
Function at 0x14003c780
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x30
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x14003c7ba
mov edx, 0x45d
lea rcx, [0x1402660e0]
call fcn.14006ca30
test eax, eax
je 0x14003c7ba
int3
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0xa0], 0
jne 0x14003c817
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov dword [rsp + 0x20], eax
mov ebx, dword [rsp + 0x20]
add ebx, 1
mov edx, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x48]
call fcn.140049700
mov r8d, ebx
mov rdx, rax
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_GetWindowTextA]
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x48]
call fcn.140024780
jmp 0x14003c83d
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 0xa0]
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx + 0xa0]
mov rax, qword [rax]
mov rdx, qword [rsp + 0x48]
call qword [rax + 0x128]
add rsp, 0x30
pop rbx
ret

Function at 0x140045890
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x30], 0
cmp qword [rsp + 0x68], 0
je 0x140045936
call fcn.14006d190
mov qword [rsp + 0x38], rax
mov r8d, 0xf0
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
je 0x140045936
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x140045906
xor eax, eax
jmp 0x140045972
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140045936
mov edx, 0x1047
lea rcx, [0x1402660e0]
call fcn.14006ca30
test eax, eax
je 0x140045936
int3
mov rdx, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x60]
call fcn.140045980
mov dword [rsp + 0x28], eax
cmp qword [rsp + 0x20], 0
je 0x14004596e
cmp qword [rsp + 0x30], 0
je 0x14004596e
mov rcx, qword [rsp + 0x30]
call fcn.140033d40
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [rsp + 0x28]
add rsp, 0x58
ret
Function at 0x140050a30
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x98
mov r8d, 0x16d
lea rdx, str.f:dd_vctools_vc7libs_ship_atlmfc_srcmfc_bartool.cpp
mov rcx, qword [rsp + 0xa0]
call fcn.14006c350
cmp qword [rsp + 0xa8], 0
jne 0x140050a7e
mov edx, 0x16e
lea rcx, str.f:dd_vctools_vc7libs_ship_atlmfc_srcmfc_bartool.cpp
call fcn.14006ca30
test eax, eax
je 0x140050a7e
int3
call fcn.14006d190
mov qword [rsp + 0x30], rax
mov r8d, 0xf1
mov rdx, qword [rsp + 0xa8]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
jne 0x140050ab5
xor eax, eax
jmp 0x140050c8a
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
jne 0x140050ad9
xor eax, eax
jmp 0x140050c8a
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140050af8
xor eax, eax
jmp 0x140050c8a
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 1
je 0x140050b1d
mov edx, 0x17d
lea rcx, str.f:dd_vctools_vc7libs_ship_atlmfc_srcmfc_bartool.cpp
call fcn.14006ca30
test eax, eax
je 0x140050b1d
int3
mov rax, qword [rsp + 0x20]
movzx ecx, word [rax + 6]
mov eax, 4
mul rcx
mov rcx, rax
mov rax, 0xffffffffffffffff
cmovo rcx, rax
mov r8d, 0x17f
lea rdx, str.f:dd_vctools_vc7libs_ship_atlmfc_srcmfc_bartool.cpp
call fcn.140013e10
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x50], 0
jmp 0x140050b72
mov eax, dword [rsp + 0x50]
add eax, 1
mov dword [rsp + 0x50], eax
mov rax, qword [rsp + 0x20]
movzx eax, word [rax + 6]
cmp dword [rsp + 0x50], eax
jge 0x140050ba7
mov rcx, qword [rsp + 0x20]
call fcn.140050ca0
mov r11, rax
movsxd rax, dword [rsp + 0x50]
movzx edx, word [r11 + rax*2]
movsxd rcx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x28]
mov dword [rax + rcx*4], edx
jmp 0x140050b67
mov rax, qword [rsp + 0x20]
movzx r8d, word [rax + 6]
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0xa0]
call fcn.140050f90
mov dword [rsp + 0x38], eax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x70], rax
mov rcx, qword [rsp + 0x70]
call fcn.140014530
cmp dword [rsp + 0x38], 0
je 0x140050c71
mov rax, qword [rsp + 0x20]
movzx r8d, word [rax + 4]
mov rax, qword [rsp + 0x20]
movzx edx, word [rax + 2]
lea rcx, [rsp + 0x58]
call fcn.1401ba7d0
mov r11, qword [rsp + 0x20]
movzx r8d, word [r11 + 4]
add r8d, 7
mov rax, qword [rsp + 0x20]
movzx edx, word [rax + 2]
add edx, 7
lea rcx, [rsp + 0x60]
call fcn.1401ba7d0
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x80], rax
mov r8, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0xa0]
call fcn.140050670
mov rdx, qword [rsp + 0xa8]
mov rcx, qword [rsp + 0xa0]
call fcn.140050cb0
mov dword [rsp + 0x38], eax
mov rcx, qword [rsp + 0x40]
call fcn.140033d40
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [rsp + 0x38]
add rsp, 0x98
ret
Function at 0x1400aa8e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [rsp + 0x58]
mov eax, dword [rax + 4]
and eax, 1
test eax, eax
je 0x1400aa912
mov rax, qword [rsp + 0x58]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x28], rax
jmp 0x1400aa985
mov r8d, 5
mov rdx, qword [rsp + 0x58]
mov rdx, qword [rdx + 0x10]
mov rcx, qword [rsp + 0x58]
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jne 0x1400aa942
call fcn.140082f00
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x58]
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x1400aa968
call fcn.140082f00
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x1400aa985
call fcn.140082f00
call fcn.1400799d0
cmp qword [rax + 0x68], 0
je 0x1400aa9a5
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x50]
call fcn.1400aa870
mov qword [rsp + 0x28], rax
mov edx, dword [rsp + 0x60]
mov rcx, qword [rsp + 0x28]
call fcn.1400aa730
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x50]
cmp qword [rax + 0xb8], 0
je 0x1400aa9e9
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx + 0xb8]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov r11, qword [rsp + 0x50]
mov qword [r11 + 0xb8], 0
cmp qword [rsp + 0x20], 0
je 0x1400aaa0c
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x20]
mov qword [rcx + 0xb8], rax
mov rcx, qword [rsp + 0x58]
mov rax, qword [rsp + 0x28]
mov qword [rcx + 0x10], rax
mov rax, qword [rsp + 0x58]
mov ecx, dword [rax + 4]
or ecx, 1
mov rax, qword [rsp + 0x58]
mov dword [rax + 4], ecx
add rsp, 0x48
ret

Function at 0x1400b8af0
Capabilities:
Move file

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne 0x1400b8b24
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, qword [rsp + 0x30]
mov ecx, eax
call fcn.140090ca0
add rsp, 0x28
ret

Function at 0x1400b8b30
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x1400b8b5a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, qword [rsp + 0x30]
mov ecx, eax
call fcn.140090ca0
add rsp, 0x28
ret