joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001450
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0x9c0c726c
call fcn.1400027c0
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x140001490
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0x49fee93
call fcn.1400027c0
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x1400014d0
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0x263f6ae8
call fcn.1400027c0
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x140001510
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0x7daf4e00
call fcn.1400027c0
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x140001550
Capabilities:
Execute syscall

Disassembly:
push rcx
push rdx
push r8
push r9
mov ecx, 0x871d998b
call fcn.1400027c0
pop r9
pop r8
pop rdx
pop rcx
mov r10, rcx
syscall
ret

Function at 0x14000156c
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0xc350cfc5
call fcn.1400027c0
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x140001870
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.140002690
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.140002690
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop dword [rax]
Function at 0x140002330
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x1400058b0]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x140002350
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x140002358
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140002350
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x1400023ad
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x1400023a4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x140002350
add rax, 0x28
cmp rax, r9
jne 0x140002390
xor eax, eax
ret

Function at 0x1400023b0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1400058b0]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x1400023cf
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400023d8
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x1400023cf
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x140002470
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1400058b0]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x14000248f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x140002498
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret
Function at 0x140001378
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [0x1400aef20]
mov dword [rax], 1
mov rax, qword [0x1400aef30]
mov dword [rax], 1
mov rax, qword [0x1400aef40]
mov dword [rax], 1
mov rax, qword [0x1400aeea0]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400013c9
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x1400013f5
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
movzx eax, ax
cmp eax, 0x10b
je 0x14000141b
cmp eax, 0x20b
je 0x140001442
jmp 0x140001471
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x5c]
cmp eax, 0xe
ja 0x14000142e
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x6c]
cmp eax, 0xe
ja 0x14000145d
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x1400213e0
Capabilities:
Query environment variable

Disassembly:
push r14
mov eax, 0x10080
push r13
push r12
push rbp
push rdi
push rsi
push rbx
call fcn.14008bc90
sub rsp, rax
xor eax, eax
xor edx, edx
xor esi, esi
mov r14d, 0x28
movzx edi, byte [rcx]
mov word [rsp + 0x80], ax
mov r12, rcx
lea rbp, [rsp + 0x30]
lea r13, [rsp + 0x2e]
mov word [rsp + 0x30], dx
test dil, dil
je 0x140021489
nop dword [rax]
mov rax, r14
lea rbx, [rbp + rsi*2]
sub rax, rsi
cmp word [rbp + rsi*2], 0
je 0x14002144e
nop dword [rax + rax]
add rbx, 2
sub rax, 1
cmp word [rbx], 0
jne 0x140021440
test rax, rax
je 0x14009cbb0
mov rcx, rbx
add rsi, 1
call sub.msvcrt.dll_wcslen
mov r8d, 2
mov rdx, r13
mov byte [rsp + 0x2e], dil
lea rcx, [rbx + rax*2]
mov byte [rsp + 0x2f], 0
call sub.msvcrt.dll_mbstowcs
movzx edi, byte [r12 + rsi]
test dil, dil
jne 0x140021428
lea rbx, [rsp + 0x80]
mov r8d, 0x10000
mov rcx, rbp
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea edx, [rax - 1]
xor eax, eax
cmp edx, 0xffff
ja 0x1400214b8
mov rcx, rbx
call sub.msvcrt.dll__wcsdup
add rsp, 0x10080
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret

Function at 0x1400214d0
Capabilities:
Set environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x88
xor eax, eax
xor esi, esi
mov r13d, 0x28
movzx edi, byte [rcx]
mov word [rsp + 0x30], ax
mov rbp, rcx
mov r14, rdx
lea r15, [rsp + 0x30]
lea r12, [rsp + 0x2e]
test dil, dil
je 0x140021571
nop word [rax + rax]
mov rax, r13
lea rbx, [r15 + rsi*2]
sub rax, rsi
cmp word [r15 + rsi*2], 0
je 0x140021536
nop word [rax + rax]
add rbx, 2
sub rax, 1
cmp word [rbx], 0
jne 0x140021528
test rax, rax
je 0x14009cbb6
mov rcx, rbx
add rsi, 1
call sub.msvcrt.dll_wcslen
mov r8d, 2
mov rdx, r12
mov byte [rsp + 0x2e], dil
lea rcx, [rbx + rax*2]
mov byte [rsp + 0x2f], 0
call sub.msvcrt.dll_mbstowcs
movzx edi, byte [rbp + rsi]
test dil, dil
jne 0x140021510
mov rdx, r14
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
nop
add rsp, 0x88
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1400816d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
cmp byte [0x1400c02e9], 0
mov rbp, rcx
mov r12, rdx
mov rdi, r8
je 0x140081758
lea rdx, [0x1400aadf2]
mov rcx, rdi
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x1400817c0
mov rbx, qword [0x1400c01a0]
jmp 0x140081715
lea rbx, [rdx + rax + 4]
mov rdx, rbx
mov rcx, rdi
call sub.msvcrt.dll_strcmp
mov rcx, rbx
mov esi, eax
call sub.msvcrt.dll_strlen
lea rdx, [rbx + rax + 1]
mov eax, dword [rdx]
test esi, esi
jne 0x140081710
movzx r9d, word [rdx + 4]
lea r8, [rdx + 6]
mov rcx, rbp
mov rdx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp fcn.14006fcf0
mov r8d, 0xa
xor ecx, ecx
mov edx, 3
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
xor ecx, ecx
lea rdx, [rax + 4]
mov qword [0x1400c01a0], rax
mov ebx, dword [rax]
mov qword [0x1400c01a0], rdx
mov r8d, dword [rax + 4]
lea rdx, [rax + 8]
mov qword [0x1400c01a0], rdx
call fcn.140080800
cmp eax, ebx
jne 0x140081828
mov byte [0x1400c02e9], 1
jmp 0x1400816ec
cmp byte [0x1400c02e8], 0
jne 0x140081703
mov rbx, qword [sym.imp.python311.dll_PyDict_New]
call rbx
mov qword [0x1400c0c48], rax
call rbx
mov qword [0x1400c0c40], rax
call rbx
mov qword [0x1400c0c38], rax
call rbx
mov qword [0x1400c0c30], rax
call rbx
mov qword [0x1400c0c28], rax
call rbx
mov qword [0x1400c0c20], rax
call rbx
mov qword [0x1400c0c18], rax
call rbx
mov byte [0x1400c02e8], 1
mov qword [0x1400c0c10], rax
jmp 0x140081703
lea rcx, str.Error__corrupted_constants_object
call sub.msvcrt.dll_puts
call sub.msvcrt.dll_abort
nop
nop word [rax + rax]

Function at 0x14008a970
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call fcn.14009c100
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call fcn.14009c100
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
Function at 0x14008b642
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x1400c1108]
test eax, eax
je 0x14008b6da
lea rax, [0x1400c10e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x1400c1110]
mov qword [rbp - 8], rax
jmp 0x14008b6be
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x14008b6b2
cmp qword [rbp - 0x10], 0
je 0x14008b6b2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x14008b678
lea rax, [0x1400c10e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x14008b6db
nop
add rsp, 0x30
pop rbp
ret

Function at 0x14008b7e0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x14008b808
mov eax, 0
jmp 0x14008b856
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x14008b831
mov eax, 0
jmp 0x14008b856
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x14008b851
mov eax, 0
jmp 0x14008b856
mov eax, 1
add rsp, 0x20
pop rbp
ret

Function at 0x14008b85c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x14008b8da
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x14008b8d1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x14008b8d1
mov rax, qword [rbp - 8]
jmp 0x14008b8ef
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x14008b8a4
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x65001a80
Capabilities:
Create pipe
Create thread
Create two anonymous pipes

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
sub rsp, 0x70
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov r12, rcx
xor r13d, r13d
mov dword [rsp + 0x30], r13d
lea ecx, [r13 + 0x20]
call fcn.6501dbc0
mov rdi, rax
test rax, rax
je 0x65001ace
mov qword [rax], r13
mov qword [rax + 8], r13
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], r13
jmp 0x65001ad1
mov rdi, r13
mov qword [rsp + 0x60], rdi
mov dword [rsp + 0x40], 0x18
mov dword [rsp + 0x50], 1
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x38], r13
xor r9d, r9d
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x65001b67
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rdi + 0x10]
test rsi, rsi
je 0x65001b38
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov qword [rdi + 0x10], rbp
mov rsi, qword [rsp + 0x38]
mov rbp, qword [rdi + 0x18]
test rbp, rbp
je 0x65001b63
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov qword [rdi + 0x18], rsi
xor r9d, r9d
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x65001bd7
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rdi]
test rsi, rsi
je 0x65001ba9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov qword [rdi], rbp
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rdi + 8]
test rsi, rsi
je 0x65001bd3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov qword [rdi + 8], rbp
mov rdx, rdi
mov rcx, r12
call fcn.650012e0
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], r13d
mov r9, rdi
lea r8, [0x65001100]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
test rax, rax
je 0x65001c27
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop
mov rax, r12
jmp 0x65001c2a
mov rax, r12
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
Function at 0x650026f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x20
mov r12d, ecx
movzx r13d, dx
lea rcx, [0x65044b50]
xor r14d, r14d
xor edx, edx
mov rbx, r14
call fcn.6501cdec
lea ebp, [r14 + 1]
test rax, rax
mov rsi, rax
je 0x65002806
nop
nop
test rbx, rbx
jne 0x65002806
mov eax, r12d
lea edx, [rbx + 6]
movzx r9d, r13w
shr eax, 4
mov rcx, rsi
add ax, 1
movzx r8d, ax
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
test rax, rax
mov rdi, rax
jne 0x65002774
mov rbx, r14
jmp 0x650027e9
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x6500278a
mov rbx, r14
jmp 0x650027e4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
mov rbx, rax
jne 0x650027a0
mov rbx, r14
jmp 0x650027e4
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, r12d
mov r11d, eax
add r11, rbx
and ecx, 0xf
jbe 0x650027d2
nop
nop
cmp rbx, r11
jae 0x650027d7
add ecx, 0xffffffff
movzx eax, word [rbx]
lea rbx, [rbx + rax*2 + 2]
jne 0x650027c0
cmp rbx, r11
jb 0x650027dc
mov rbx, r14
jmp 0x650027e4
cmp word [rbx], r14w
cmove rbx, r14
test rbx, rbx
jne 0x65002827
lea rcx, [0x65044b50]
mov edx, ebp
call fcn.6501cdec
add ebp, 1
test rax, rax
mov rsi, rax
jne 0x65002740
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop r13
pop r12
ret
mov rax, rsi
jmp 0x65002808
Function at 0x65003520
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x120
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rsp + 0x158], rbx
mov rdi, r8
mov rbp, rdx
mov rsi, rcx
mov rbx, qword [rcx]
mov ecx, 1
xor eax, eax
xor r13d, r13d
lock cmpxchg dword [0x65047d5c], ecx
jne 0x650035ca
lea r8, [0x65039450]
lea edx, [rcx + 0xa]
lea rcx, [0x65039490]
call fcn.6500bcb0
mov r12, rax
lea r8, [0x650394a0]
lea edx, [r13 + 8]
lea rcx, [0x650392d8]
call fcn.6500c660
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
add dword [0x65044948], 1
test rax, rax
je 0x650035be
mov rdx, r12
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
add dword [0x6504494c], 1
jmp 0x650035c1
mov rax, r13
mov qword [0x65047e88], rax
jmp 0x650035d1
mov rax, qword [0x65047e88]
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, rbx
call rax
mov rbx, rax
mov qword [rsp + 0x40], rax
cmp rax, 0xffffffffffffffff
jne 0x6500368e
mov qword [rsp + 0xf0], 0xf
mov qword [rsp + 0xe8], r13
mov byte [rsp + 0xd8], 0
lea rcx, [rsp + 0x90]
call fcn.6501d310
nop
lea rax, [0x65037068]
mov qword [rsp + 0x90], rax
mov qword [rsp + 0xc8], 0xf
mov qword [rsp + 0xc0], r13
mov byte [rsp + 0xb0], 0
or r9, rbx
xor r8d, r8d
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0xa8]
call fcn.65001e20
nop
lea rdx, [0x65041480]
lea rcx, [rsp + 0x90]
call fcn.6501dc60
nop
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x168]
mov r8d, edi
mov rdx, rbp
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x65003725
mov qword [rsp + 0x118], 0xf
mov qword [rsp + 0x110], r13
mov byte [rsp + 0x100], al
lea rcx, [rsp + 0x50]
call fcn.6501d310
nop
lea rax, [0x65037068]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x88], 0xf
mov qword [rsp + 0x80], r13
mov byte [rsp + 0x70], 0
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsp + 0xf8]
lea rcx, [rsp + 0x68]
call fcn.65001e20
nop
lea rdx, [0x65041480]
lea rcx, [rsp + 0x50]
call fcn.6501dc60
nop
test rbx, rbx
je 0x65003744
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop
mov rdx, qword [rsi]
sub rdx, 0x18
or rax, 0xffffffffffffffff
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x65003764
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov rbx, qword [rsp + 0x158]
add rsp, 0x120
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x65003e00
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x20
mov eax, r8d
mov rbp, rdx
mov ebx, r8d
shr eax, 4
mov rsi, rcx
mov r8d, 6
add ax, 1
mov rcx, rbp
movzx edx, ax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
mov r12, rax
je 0x65003f71
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x65003f71
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
mov rdi, rax
je 0x65003f71
mov rdx, r12
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r11d, eax
add r11, rdi
and ebx, 0xf
jbe 0x65003ea6
nop
cmp rdi, r11
jae 0x65003f71
add ebx, 0xffffffff
movzx eax, word [rdi]
lea rdi, [rdi + rax*2 + 2]
jne 0x65003e90
cmp rdi, r11
jae 0x65003f71
movzx eax, word [rdi]
test ax, ax
je 0x65003f71
movzx ebx, ax
mov rax, qword [rsi]
mov ecx, 1
sub ecx, dword [rax - 8]
mov eax, dword [rax - 0xc]
sub eax, ebx
or ecx, eax
jge 0x65003edc
mov edx, ebx
mov rcx, rsi
call fcn.65002640
movzx ecx, word [rdi]
lea r8, [rdi + 2]
cmp ecx, 0xffffffff
jne 0x65003ef9
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r8
repne scasw ax, word [rdi]
not rcx
and ecx, ecx
movsxd r9, ecx
mov rcx, qword [rsi]
lea rdi, [rbx + rbx]
mov rdx, rdi
add r9, r9
call fcn.6501d7b0
test eax, eax
je 0x65003f47
cmp eax, 0xc
je 0x65003f3c
cmp eax, 0x16
je 0x65003f31
cmp eax, 0x22
je 0x65003f31
cmp eax, 0x50
je 0x65003f47
mov ecx, 0x80004005
call fcn.65001050
int3
mov ecx, 0x80070057
call fcn.65001050
int3
mov ecx, 0x8007000e
call fcn.65001050
int3
test ebx, ebx
js 0x65003f66
mov rcx, qword [rsi]
cmp ebx, dword [rcx - 0xc]
jg 0x65003f66
mov dword [rcx - 0x10], ebx
mov rcx, qword [rsi]
mov eax, 1
mov word [rdi + rcx], 0
jmp 0x65003f73
mov ecx, 0x80070057
call fcn.65001050
int3
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret