joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18010ec90
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x260
mov rax, qword [0x1801903f8]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rdi, rcx
mov rcx, rdx
mov rsi, rdx
call fcn.1800047e0
xor ebx, ebx
test rdi, rdi
je 0x18010ed31
lea rcx, [rsp + 0x42]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x40], bx
call fcn.18007ead0
mov dword [rsp + 0x38], 0x104
lea rax, [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x30], rax
xor edx, edx
mov rcx, rdi
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
or rcx, 0xffffffffffffffff
mov ebx, eax
xor eax, eax
lea rdi, [rsp + 0x40]
lea rdx, [rsp + 0x40]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
mov rcx, rsi
call fcn.180004b00
mov eax, ebx
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.18007e1e0
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x18010ede0
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x260
mov rax, qword [0x1801903f8]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rdi, rcx
mov rcx, rdx
mov rsi, rdx
call fcn.1800047e0
xor ebx, ebx
test rdi, rdi
je 0x18010ee7e
lea rcx, [rsp + 0x42]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x40], bx
call fcn.18007ead0
mov dword [rsp + 0x38], ebx
mov qword [rsp + 0x30], rbx
lea rdx, [rsp + 0x40]
xor r9d, r9d
mov r8d, 0x104
mov rcx, rdi
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
or rcx, 0xffffffffffffffff
mov ebx, eax
xor eax, eax
lea rdi, [rsp + 0x40]
repne scasw ax, word [rdi]
lea rdx, [rsp + 0x40]
not rcx
lea r8d, [rcx - 1]
mov rcx, rsi
call fcn.180004b00
mov eax, ebx
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.18007e1e0
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x18010f0a0
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x830
mov rax, qword [0x1801903f8]
xor rax, rsp
mov qword [rsp + 0x820], rax
mov rdi, rcx
mov rcx, rdx
mov rbx, rdx
call fcn.1800047e0
lea rcx, [rsp + 0x22]
xor esi, esi
xor edx, edx
mov r8d, 0x7fe
mov word [rsp + 0x20], si
call fcn.18007ead0
lea rdx, [rsp + 0x20]
mov r8d, 0x400
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
dec eax
cmp eax, 0x3fe
ja 0x18010f12f
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x20]
repne scasw ax, word [rdi]
lea rdx, [rsp + 0x20]
not rcx
lea r8d, [rcx - 1]
mov rcx, rbx
call fcn.180004b00
lea eax, [rsi + 1]
jmp 0x18010f131
mov eax, esi
mov rcx, qword [rsp + 0x820]
xor rcx, rsp
call fcn.18007e1e0
lea r11, [rsp + 0x830]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x18010f460
Capabilities:
Get disk information

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x78], rbx
mov r14, rdx
mov r13, rcx
or r8, 0xffffffffffffffff
xor edx, edx
mov rcx, r14
call fcn.18011a890
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [r13], eax
mov r12d, 1
xor r15d, r15d
mov ebp, r15d
nop dword [rax + rax]
test dword [r13], r12d
je 0x18010f67a
movzx eax, word [0x18015bb28]
mov word [rsp + 0x70], ax
movzx eax, byte [0x18015bb2a]
mov byte [rsp + 0x72], al
xor eax, eax
mov byte [rsp + 0x73], al
add byte [rsp + 0x70], bpl
call fcn.180032e40
mov ecx, r15d
test rax, rax
setne cl
test ecx, ecx
je 0x18010f6aa
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea r10, [rax + 0x18]
mov qword [rsp + 0x80], r10
lea rcx, [rsp + 0x70]
lea rax, [rsp + 0x70]
test rax, 0xffffffffffff0000
jne 0x18010f544
movzx edi, cx
mov ecx, edi
call fcn.180035ed8
test rax, rax
je 0x18010f642
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x80]
call fcn.180037a70
jmp 0x18010f642
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x70]
repne scasb al, byte [rdi]
not rcx
dec rcx
mov rdi, rcx
test ecx, ecx
jne 0x18010f5c1
lea rdx, [r10 - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], eax
je 0x18010f642
cmp dword [rdx + 0x10], eax
jge 0x18010f590
cmp dword [r10 - 0xc], eax
jl 0x18010f689
mov dword [r10 - 0x10], r15d
mov rax, qword [rsp + 0x80]
mov byte [rax], cl
jmp 0x18010f642
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18010f5a7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x80], rax
jmp 0x18010f642
mov esi, dword [r10 - 0x10]
lea rbx, [rsp + 0x70]
sub rbx, r10
test ecx, ecx
js 0x18010f69f
mov ecx, 1
sub ecx, dword [r10 - 8]
mov eax, dword [r10 - 0xc]
sub eax, edi
or eax, ecx
jge 0x18010f5ff
mov edx, edi
lea rcx, [rsp + 0x80]
call fcn.180033628
mov r10, qword [rsp + 0x80]
movsxd rdx, dword [r10 - 0xc]
mov rcx, r10
cmp rbx, rsi
movsxd rsi, edi
mov r9, rsi
ja 0x18010f61c
lea r8, [rbx + r10]
call fcn.18007f2bc
jmp 0x18010f626
lea r8, [rsp + 0x70]
call fcn.18007f224
mov rax, qword [rsp + 0x80]
cmp edi, dword [rax - 0xc]
jg 0x18010f694
mov dword [rax - 0x10], edi
mov rax, qword [rsp + 0x80]
mov byte [rsi + rax], 0
lea r8, [rsp + 0x80]
mov rdx, qword [r14 + 0x10]
mov rcx, r14
call fcn.18011b2c0
nop
mov rdx, qword [rsp + 0x80]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18010f67a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
inc ebp
add r12d, r12d
cmp ebp, 0x1a
jae 0x18010f6b5
jmp 0x18010f4b0
mov ecx, 0x80070057
call fcn.180004010
int3
mov ecx, 0x80070057
call fcn.180004010
int3
mov ecx, 0x80070057
call fcn.180004010
nop
mov ecx, 0x80004005
call fcn.180004010
int3
mov eax, 1
mov rbx, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x180001513
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
cmp qword [rsp + 0x70], 0
jne 0x180001530
xor eax, eax
jmp 0x180001637
mov rax, qword [rsp + 0x70]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x70]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rsp + 0x70]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0x20]
mov rcx, qword [rsp + 0x70]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x20], 0
jmp 0x18000159a

Function at 0x18000187b
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov ecx, dword [0x1803c6b7b]
xor edx, edx
call fcn.18000163f
xor r15d, r15d
lea rdx, [rbp + 0x50]
xor ecx, ecx
mov qword [rbp + 0x50], r15
mov r14, rax
call fcn.18000163f
mov edx, dword [0x1803c6b53]
lea ecx, [r15 + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edx, dword [0x1803c6b53]
mov rcx, rax
mov rbx, rax
call fcn.180001827
mov rax, qword [rbp + 0x50]
lea r13d, [r15 + 1]
mov edx, r15d
cmp word [rax], r15w
je 0x180001904
movzx eax, word [rax]
mov ecx, r15d
mov word [rcx + rbx], ax
add edx, r13d
mov rax, qword [rbp + 0x50]
lea rcx, [rdx + rdx]
movzx eax, word [rcx + rax]
test ax, ax
jne 0x1800018ec
mov r9, qword [0x1803c6b4b]
mov edx, r15d
cmp word [rbx], r15w
cmp dword [rbx], edi
Function at 0x180001910
Capabilities:
Get file size
Read file on windows

Disassembly:
cmp dword [rbx], edi
je 0x18000191e
add edx, r13d
cmp word [rbx + rdx*2], r15w
jne 0x180001914
lea ecx, [rdx - 1]
jmp 0x18000192e
mov eax, edx
mov edx, ecx
dec ecx
mov word [rbx + rax*2], r15w
cmp word [rbx + rcx*2], 0x5c
jne 0x180001923
mov al, byte [r9]
mov r8d, r15d
jmp 0x180001950
movsx ecx, al
mov eax, edx
add edx, r13d
add r8d, r13d
mov word [rbx + rax*2], cx
mov al, byte [r8 + r9]
test al, al
jne 0x18000193d
mov qword [rsp + 0x30], r15
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
mov r8d, r13d
mov edx, r13d
mov dword [rsp + 0x20], 3
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x180001b19
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, dword [0x1803c6b93]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, ebx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, dword [0x1803c6b93]
mov rcx, rax
mov rbx, rax
call fcn.180001827
lea r9, [rbp + 0x48]
mov dword [rbp + 0x48], r15d
mov r8d, edi
mov qword [rsp + 0x20], r15
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x180001b19
mov eax, dword [0x1803c6ba3]
mov r12d, dword [rbp + 0x48]
add r12, rbx
add rbx, rax
lea rax, [rbx + 4]
mov edx, dword [rax]
add rax, 4
cmp dword [rbx], r15d
jbe 0x180001a10
mov ecx, dword [rbx]
add dword [rax], edx
lea rax, [rax + 4]
sub rcx, r13
jne 0x180001a05
mov eax, dword [reloc.OLEAUT32.dll_VariantClear]
mov rcx, r14
add rbx, rax
lea rdx, [rbx + 1]
call fcn.180001513
mov rdi, rax
test rax, rax
je 0x180001b19
movsx rcx, byte [rbx]
add rbx, rcx
mov rcx, r14
lea rdx, [rbx + 1]
call fcn.180001513
mov r13, rax
test rax, rax
je 0x180001b19
movsx rcx, byte [rbx]
add rbx, rcx
lea rcx, [rbx + 1]
call rdi
test rax, rax
je 0x180001b19
mov edi, dword [reloc.OLEAUT32.dll_VariantTimeToDosDateTime]
lea r9, [rbp + 0x40]
movsx rcx, byte [rbx]
mov r8d, dword [0x1803c6b9f]
add rbx, rcx
movsxd rcx, dword [rax + 0x3c]
cmp al, 0x48
add edi, ebx
Function at 0x18000eb30
Capabilities:
Extract resource via kernel32 functions

Disassembly:
movzx edx, dx
jmp method.CSettingsUDF.virtual_720
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov qword [rcx + 0xf0], rdx
mov rbp, r8
mov rdi, rdx
mov rsi, rcx
cmp rdx, 0x10000
jae 0x1800f896f
cmp dword [rcx + 0xe8], 0
jne 0x1800f896f
movzx eax, di
mov dword [rcx + 0xe8], eax
call fcn.1800ed608
mov r8d, 5
mov rdx, rdi
mov rbx, qword [rax + 0x18]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r9, rbx
mov r8, rbp
mov rdx, rax
mov rcx, rsi
mov rdi, rax
call fcn.1800f8cf4
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rbp, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x180038ca0
Capabilities:
Encode data using xor

Disassembly:
mov r10, rdx
test r8, r8
je 0x180038cdc
lea r11, section..data
nop
movzx eax, byte [r10]
lea r10, [r10 + 1]
movzx r9d, cx
shr r9, 8
xor r9, rax
movzx eax, cx
shl ax, 8
movzx edx, r9b
movzx ecx, word [r11 + rdx*2]
xor cx, ax
sub r8, 1
jne 0x180038cb0
movzx eax, cx
ret

Function at 0x18003dd40
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
sub rsp, 0x38
cmp dword [0x1804d0838], 0
je 0x1800038c2
mov qword [rsp + 0x50], rsi
mov rsi, qword [0x1804d0840]
test rsi, rsi
je 0x180003879
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x58], rdi
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call sub.WS2_32.dll_WSAGetLastError
mov ecx, dword [rsi]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, ebx
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, edi
call sub.WS2_32.dll_WSASetLastError
test rsi, rsi
mov rdi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x48]
je 0x180003879
cmp dword [rsi + 0x44], 1
jne 0x180003879
mov rcx, qword [rsi + 0x10]
mov rax, qword [rsi + 0x18]
lea rdx, [rsp + 0x20]
mov qword [rdx], rcx
lea rcx, [rsp + 0x20]
mov qword [rdx + 8], rax
call fcn.1800034e0
mov rax, qword [0x1804d0840]
xor edx, edx
mov ecx, dword [rax]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
call fcn.1800033e0
mov rcx, qword [0x1804d0828]
mov rsi, qword [rsp + 0x50]
test rcx, rcx
je 0x1800038b0
lea rdx, str.QueueUserAPCEx_Fini
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1800038a3
call rax
mov rcx, qword [0x1804d0828]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, qword [0x1804d0830]
test rcx, rcx
je 0x1800038c2
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 1
add rsp, 0x38
ret
jmp 0x1800037e0

Function at 0x18003df90
Capabilities:
Get file size
Read file on windows

Disassembly:
add rcx, 8
jmp fcn.180001910
Function at 0x1800f36e0
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, rcx
mov rbx, r8
mov rcx, qword [rcx + 0x40]
call fcn.18010771c
mov rdi, rax
test rax, rax
je 0x1800f375c
mov rcx, rax
call qword [sym.imp.USER32.dll_GetDlgCtrlID]
mov esi, eax
test rbx, rbx
je 0x1800f3757
cmp dword [rbx], 0x40
jb 0x1800f3757
mov rcx, qword [rbp + 0x40]
xor r9d, r9d
or dword [rbx + 4], 1
xor r8d, r8d
or qword [rbx + 0x30], 0xffffffffffffffff
mov edx, 0x87
mov qword [rbx + 8], rcx
mov rcx, rdi
mov qword [rbx + 0x10], rdi
call qword [sym.imp.USER32.dll_SendMessageW]
bt rax, 0xd
jb 0x1800f3757
or dword [rbx + 4], 0x80000002
mov rax, rsi
jmp 0x1800f3760
or rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1800f8130
Capabilities:
Get graphical window text

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rsi
movsxd rsi, r8d
mov rbx, rdx
mov rdi, rcx
cmp qword [rcx + 0xd0], 0
jne 0x1800f816e
mov r8d, esi
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x1800f8218
call fcn.1800ed100
mov rcx, rax
test rax, rax
je 0x1800f822e
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x180118ada.0]
add rax, 0x18
mov qword [rsp + 0x40], rax
mov rcx, qword [rdi + 0xd0]
mov rax, qword [rcx]
lea rdx, [rsp + 0x40]
mov rax, qword [rax + 0x118]
call qword [case.0x180118ada.0]
mov rdx, rsi
or rdi, 0xffffffffffffffff
mov r9, rdi
mov r8, qword [rsp + 0x40]
mov rcx, rbx
call fcn.180294f7c
test eax, eax
je 0x1800f81e0
cmp eax, 0xc
je 0x1800f8228
cmp eax, 0x16
je 0x1800f823f
cmp eax, 0x22
je 0x1800f823f
cmp eax, 0x50
jne 0x1800f8239
test rbx, rbx
je 0x1800f81f0
mov rcx, rbx
call fcn.180295218
mov rbx, rax
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov ecx, edi
lock xadd dword [rdx + 0x10], ecx
add ecx, edi
test ecx, ecx
jg 0x1800f8216
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x180118ada.0]
mov eax, ebx
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
call fcn.1800eb7f8
nop
mov ecx, 0x80004005
call fcn.18000def0
nop
call fcn.1800eb7d4
int3
call fcn.1800eb7d4
int3
Function at 0x1800f8930
Capabilities:
Extract resource via kernel32 functions

Disassembly:
movzx edx, dx
jmp method.CSettingsUDF.virtual_720
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov qword [rcx + 0xf0], rdx
mov rbp, r8
mov rdi, rdx
mov rsi, rcx
cmp rdx, 0x10000
jae 0x1800f896f
cmp dword [rcx + 0xe8], 0
jne 0x1800f896f
movzx eax, di
mov dword [rcx + 0xe8], eax
call fcn.1800ed608
mov r8d, 5
mov rdx, rdi
mov rbx, qword [rax + 0x18]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r9, rbx
mov r8, rbp
mov rdx, rax
mov rcx, rsi
mov rdi, rax
call fcn.1800f8cf4
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rbp, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1800f89cc
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov r14, r8
mov rbx, rdx
mov r15, rcx
xor edi, edi
call fcn.1800ed608
lea r8d, [rdi + 5]
mov rdx, rbx
mov rbp, qword [rax + 0x18]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
test rax, rax
je 0x1800f8a28
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
mov r9, rbp
mov r8, r14
mov rdx, rdi
mov rcx, r15
call fcn.1800f8a60
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rbp, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret

Function at 0x1800fcc08
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
test byte [rdx + 4], 1
mov esi, r8d
mov rbx, qword [rdx + 0x10]
mov rdi, rdx
mov rbp, rcx
jne 0x1800fcc7f
mov rcx, qword [rdi + 8]
mov r8d, 5
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
jne 0x1800fcc4f
call fcn.180105e70
mov rcx, qword [rdi + 8]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbx, rax
test rax, rax
jne 0x1800fcc69
call fcn.180105e70
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
jne 0x1800fcc7f
call fcn.180105e70
call fcn.1800ed608
cmp qword [rax + 0x68], 0
je 0x1800fcc99
mov rdx, rbx
mov rcx, rbp
call fcn.1800fc0cc
mov rbx, rax
mov edx, esi
mov rcx, rbx
call fcn.1800fcef4
mov rcx, qword [rbp + 0xf8]
mov rsi, rax
test rcx, rcx
je 0x1800fccc0
call qword [sym.imp.KERNEL32.dll_GlobalFree]
and qword [rbp + 0xf8], 0
test rsi, rsi
je 0x1800fcccf
mov rbx, rsi
mov qword [rbp + 0xf8], rsi
or dword [rdi + 4], 1
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov qword [rdi + 0x10], rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1800ff1c8
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
cmp qword [rcx + 0xb0], 0
mov edi, r9d
mov rbx, r8
mov rax, rdx
je 0x1800ff243
xor r8d, r8d
call fcn.1800ff490
mov rsi, rax
test rax, rax
je 0x1800ff23f
lea rax, [rsp + 0x50]
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x34]
lea rax, [rsp + 0x30]
xor r8d, r8d
mov rdx, rbx
mov qword [rsp + 0x20], rax
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x1800ff23f
mov eax, dword [rsp + 0x30]
jmp 0x1800ff259
mov eax, edi
jmp 0x1800ff259
mov r9, qword [rcx + 0xd8]
mov r8d, edi
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x1800ffe98
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
cmp qword [rcx], 0
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
je 0x1800ffeff
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1800fff13
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1800fff13
mov rcx, qword [rbx]
xor r9d, r9d
and qword [rsp + 0x28], 0
xor r8d, r8d
mov qword [rsp + 0x20], rcx
mov rdx, rdi
mov rcx, rsi
call qword [case.0x180118ada.0]
jmp 0x1800fff18
cmp dword [rcx + 8], 0
je 0x1800fff13
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x1800fff18
mov eax, 1
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret

Function at 0x18010ee90
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rbx, rdx
mov rcx, qword [rdx]
cmp dword [rcx - 0x10], 0
je 0x18010eec2
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x18010eec2
lea rcx, [rdi + 0x120]
mov rdx, rbx
call fcn.18016b97c
mov rbx, qword [rsp + 0x30]
mov eax, 1
add rsp, 0x20
pop rdi
ret

Function at 0x18010eed4
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, rcx
mov rdi, rdx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x18010eefa
mov r8, rdx
mov rdx, qword [rbx]
call fcn.1800ffe98
jmp 0x18010ef65
cmp byte [0x1804d44e0], 0
jne 0x18010ef3e
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x18010ef2e
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1804d44d8], rax
jmp 0x18010ef35
mov rax, qword [0x1804d44d8]
mov byte [0x1804d44e0], 1
jmp 0x18010ef45
mov rax, qword [0x1804d44d8]
mov rcx, qword [rbx]
mov rdx, rdi
test rax, rax
je 0x18010ef5f
mov r8d, dword [rbx + 8]
xor r9d, r9d
call qword [case.0x180118ada.0]
jmp 0x18010ef65
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x140002edc
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov r8, rcx
test edx, edx
jne 0x140002ee6
xor eax, eax
ret
movzx eax, byte [rcx]
xor eax, 0x4f9ace2f
imul ecx, eax, 0x1000193
cmp edx, 1
jbe 0x140002f13
inc r8
dec edx
movzx eax, byte [r8]
inc r8
xor eax, ecx
imul ecx, eax, 0x1000193
sub rdx, 1
jne 0x140002efe
mov eax, ecx
ret

Function at 0x140002fd0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rdx
mov edi, r8d
mov ebx, ecx
mov edx, r8d
mov rcx, rsi
call fcn.140002edc
xor ebx, eax
test edi, edi
je 0x14000302f
mov r8d, edi
imul ebx, ebx, 0x41c64e6d
mov eax, 0x80808081
add ebx, 0x3039
mov ecx, ebx
shr ecx, 0x10
and ecx, 0x7fff
mul ecx
shr edx, 7
imul eax, edx, 0xff
sub ecx, eax
xor byte [rsi], cl
inc rsi
sub r8, 1
jne 0x140002ffb
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x140001d40
Capabilities:
Write file on windows

Disassembly:
push rsi
sub rsp, 0x30
mov rsi, rcx
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], r8
mov qword [rsp + 0x58], r9
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov ecx, 2
call fcn.140002290
lea rcx, str.Mingw_w64_runtime_failure:_n
mov edx, 0x1b
mov r8d, 1
mov r9, rax
call sub.msvcrt.dll_fwrite
mov ecx, 2
call fcn.140002290
mov r8, qword [rsp + 0x28]
mov rcx, rax
mov rdx, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
int3

Function at 0x1400023b0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rax, qword [0x14000a008]
movzx edx, word [rax]
cmp edx, 0x5a4d
jne 0x14000241c
movsxd rdx, dword [rax + 0x3c]
cmp dword [rax + rdx], 0x4550
jne 0x14000241c
add rax, rdx
movzx edx, word [rax + 0x18]
cmp edx, 0x20b
jne 0x14000241c
movzx edx, word [rax + 6]
test edx, edx
je 0x14000241c
sub rcx, qword [0x14000a008]
movzx r8d, word [rax + 0x14]
add rax, r8
add rax, 0x18
jmp 0x140002408
add rax, 0x28
dec edx
je 0x14000241c
mov r8d, dword [rax + 0xc]
cmp rcx, r8
jb 0x140002400
add r8d, dword [rax + 8]
cmp rcx, r8
jae 0x140002400
jmp 0x14000241e
xor eax, eax
ret

Function at 0x140002420
Capabilities:
Parse pe header

Disassembly:
mov rcx, qword [0x14000a008]
movzx edx, word [rcx]
xor eax, eax
cmp edx, 0x5a4d
jne 0x140002455
movsxd rdx, dword [rcx + 0x3c]
cmp dword [rcx + rdx], 0x4550
jne 0x140002455
movzx r8d, word [rcx + rdx + 0x18]
cmp r8d, 0x20b
jne 0x140002455
movzx eax, word [rcx + rdx + 6]
ret

Function at 0x1400024d0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x14000a008]
movzx ecx, word [rax]
cmp ecx, 0x5a4d
jne 0x1400024fc
movsxd rcx, dword [rax + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x1400024fc
movzx ecx, word [rax + rcx + 0x18]
cmp ecx, 0x20b
je 0x1400024fe
xor eax, eax
ret