joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001b820
Capabilities:
Identify system language via api

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x50], rsi
mov esi, r8d
movzx ebx, dx
mov ebp, ecx
xor edi, edi
cmp di, dx
jne 0x10001b97a
cmp dword [0x1000824d8], edi
je 0x10001ba39
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx ebx, ax
movzx ecx, ax
call fcn.100023d94
cmp eax, edi
je 0x10001b88a
movzx r8d, bx
lea rdx, [0x100007c50]
lea ecx, [rdi + 1]
call fcn.10001d66c
jmp 0x10001ba39
cmp esi, edi
je 0x10001b8a8
movzx r8d, bx
lea rdx, [0x100007c90]
mov ecx, 1
call fcn.10001d66c
jmp 0x10001ba39
movzx r8d, bx
lea rdx, [0x100007d10]
mov ecx, 3
call fcn.10001d66c
cmp ebp, edi
jne 0x10001b970
lea rcx, [0x100081100]
mov rax, qword [0x100081100]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x58], rax
lea rcx, [0x100081100]
mov rax, qword [0x100081100]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x58]
mov ecx, 0x1388
call fcn.10002e370
lea rdx, [rsp + 0x20]
mov ecx, 0x13c7
call fcn.10002e370
mov r9d, 0x30
mov r8, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x20]
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
nop
lea rdx, [rbx - 0x18]
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, ebx
cmp eax, edi
jg 0x10001b951
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, ebx
cmp eax, edi
jg 0x10001b970
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov edi, 0x717
jmp 0x10001ba39
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
cmp ax, bx
je 0x10001ba39
mov edx, 0x10
lea r8d, [rdx - 0xf]
movzx ecx, bx
call fcn.10002e22c
cmp eax, edi
jne 0x10001ba24
movzx esi, bx
mov r8d, esi
lea rdx, [0x100007d88]
mov ecx, 1
call fcn.10001d66c
cmp dword [0x1000824d8], edi
je 0x10001ba39
movzx ecx, bx
call fcn.100024014
cmp eax, edi
je 0x10001ba0e
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
cmp ax, bx
jne 0x10001b9ee
mov r8d, esi
lea rdx, [0x100007dc0]
mov ecx, 1
call fcn.10001d66c
jmp 0x10001ba39
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx r9d, ax
mov r8d, esi
lea rdx, [0x100007e40]
mov ecx, 1
call fcn.10001d66c
jmp 0x10001ba39
mov r8d, esi
lea rdx, [0x100007f60]
mov ecx, 2
call fcn.10001d66c
jmp 0x10001ba39
movzx r8d, bx
lea rdx, [0x100007ff0]
mov ecx, 2
call fcn.10001d66c
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x10001d100
Capabilities:
Get common file path

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
lea rcx, [0x100081100]
mov rax, qword [0x100081100]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x50], rbx
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
mov edi, 0x105
sub eax, edi
or eax, ecx
jge 0x10001d157
mov edx, edi
lea rcx, [rsp + 0x50]
call fcn.10001edf8
mov rbx, qword [rsp + 0x50]
cmp dword [rbx - 0xc], edi
jge 0x10001d167
mov ecx, 0x80070057
call fcn.10001f28c
int3
mov dword [rbx - 0x10], edi
xor ebp, ebp
mov word [rbx + 0x20a], bp
mov edx, edi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
or rsi, 0xffffffffffffffff
cmp eax, ebp
je 0x10001d2a9
xor eax, eax
mov rcx, rsi
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
dec rcx
cmp ecx, ebp
jl 0x10001d29e
cmp ecx, dword [rbx - 0xc]
jg 0x10001d29e
mov dword [rbx - 0x10], ecx
movsxd rax, ecx
mov word [rbx + rax*2], bp
lea rcx, [0x100081100]
mov rax, qword [0x100081100]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x58], rax
lea rdx, [0x100001fa0]
lea rcx, [rsp + 0x60]
call fcn.10001e134
nop
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x50]
call fcn.10002f9d0
mov dil, al
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
mov ecx, esi
lock xadd dword [rdx + 0x10], ecx
add ecx, esi
cmp ecx, ebp
jg 0x10001d218
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
cmp dil, bpl
je 0x10001d271
mov rdi, qword [rsp + 0x58]
mov rdx, rdi
lea rcx, [0x1000817c0]
call fcn.10002d9a4
mov ebx, eax
lea rdx, [rdi - 0x18]
mov ecx, esi
lock xadd dword [rdx + 0x10], ecx
add ecx, esi
cmp ecx, ebp
jg 0x10001d24e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, esi
cmp eax, ebp
jg 0x10001d26d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, ebx
jmp 0x10001d2c5
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, esi
cmp eax, ebp
jg 0x10001d297
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x50]
jmp 0x10001d2a9
mov rbx, qword [rsp + 0x50]
jmp 0x10001d2a9
mov ecx, 0x80070057
call fcn.10001f28c
nop
lea rdx, [rbx - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, esi
cmp eax, ebp
jg 0x10001d2c3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
mov rbx, qword [rsp + 0x68]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
Function at 0x10001ea54
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x20
mov r13, rcx
mov r12d, edx
lea rcx, [0x100081910]
xor edx, edx
xor ebx, ebx
call fcn.10005c6b0
lea r14d, [rbx + 1]
mov ebp, r14d
jmp 0x10001eb3a
test rbx, rbx
jne 0x10001eb46
mov eax, r12d
lea edx, [rbx + 6]
xor r9d, r9d
shr eax, 4
mov rcx, rsi
add ax, r14w
movzx r8d, ax
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
mov rbx, rax
test rax, rax
je 0x10001eb29
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x10001ead6
xor ebx, ebx
jmp 0x10001eb24
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
test rax, rax
je 0x10001ead2
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, r12d
mov r11d, eax
add r11, rdi
and ecx, 0xf
jbe 0x10001eb13
cmp rdi, r11
jae 0x10001ead2
add ecx, 0xffffffff
movzx eax, word [rdi]
lea rdi, [rdi + rax*2 + 2]
jne 0x10001eb01
cmp rdi, r11
jae 0x10001ead2
movzx eax, word [rdi]
neg ax
sbb rbx, rbx
and rbx, rdi
test rbx, rbx
jne 0x10001eb48
lea rcx, [0x100081910]
mov edx, ebp
call fcn.10005c6b0
add ebp, r14d
mov rsi, rax
test rax, rax
jne 0x10001ea93
xor esi, esi
test rsi, rsi
jne 0x10001eb51
xor eax, eax
jmp 0x10001eb5f
mov r8d, r12d
mov rdx, rsi
mov rcx, r13
call fcn.10001eb9c
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop r13
pop r12
ret
Function at 0x10001eb9c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x20
mov eax, r8d
mov rbp, rdx
mov r14d, 1
shr eax, 4
mov ebx, r8d
mov rsi, rcx
add ax, r14w
lea r8d, [r14 + 5]
mov rcx, rbp
movzx edx, ax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
xor r13d, r13d
mov r12, rax
cmp rax, r13
je 0x10001ed12
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
cmp rax, r13
je 0x10001ed12
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
cmp rax, r13
je 0x10001ed12
mov rdx, r12
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r11d, eax
add r11, rdi
and ebx, 0xf
jbe 0x10001ec48
cmp rdi, r11
jae 0x10001ed12
add ebx, 0xffffffff
movzx eax, word [rdi]
lea rdi, [rdi + rax*2 + 2]
jne 0x10001ec32
cmp rdi, r11
jae 0x10001ed12
cmp word [rdi], r13w
je 0x10001ed12
mov rax, qword [rsi]
movzx ebx, word [rdi]
mov ecx, r14d
sub ecx, dword [rax - 8]
mov eax, dword [rax - 0xc]
sub eax, ebx
or ecx, eax
jge 0x10001ec7a
mov edx, ebx
mov rcx, rsi
call fcn.10001edf8
movzx ecx, word [rdi]
lea r8, [rdi + 2]
cmp ecx, 0xffffffff
jne 0x10001ec9b
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r8
repne scasw ax, word [rdi]
not rcx
sub rcx, r14
add ecx, r14d
movsxd r9, ecx
mov rcx, qword [rsi]
lea rdi, [rbx + rbx]
mov rdx, rdi
add r9, r9
call fcn.10005cfb4
cmp eax, r13d
je 0x10001ecea
cmp eax, 0xc
je 0x10001ecdf
cmp eax, 0x16
je 0x10001ecd4
cmp eax, 0x22
je 0x10001ecd4
cmp eax, 0x50
je 0x10001ecea
mov ecx, 0x80004005
call fcn.10001f28c
int3
mov ecx, 0x80070057
call fcn.10001f28c
int3
mov ecx, 0x8007000e
call fcn.10001f28c
int3
cmp ebx, r13d
jl 0x10001ed07
mov rcx, qword [rsi]
cmp ebx, dword [rcx - 0xc]
jg 0x10001ed07
mov dword [rcx - 0x10], ebx
mov rcx, qword [rsi]
mov eax, r14d
mov word [rdi + rcx], r13w
jmp 0x10001ed14
mov ecx, 0x80070057
call fcn.10001f28c
int3
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop r13
pop r12
ret
Function at 0x10002a9cc
Capabilities:
Set file attributes

Disassembly:
mov qword [rsp + 0x10], rdx
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov r15, r8
mov rbp, rdx
mov rbx, rcx
mov rcx, r8
call fcn.10001e65c
lea rdx, [0x100009a84]
mov rcx, qword [rbx]
call qword [sym.imp.msvcrt.dll__wfopen]
mov r13, rax
test rax, rax
jne 0x10002aa65
mov edx, 0x80
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rdx, [0x100009a84]
mov rcx, qword [rbx]
call qword [sym.imp.msvcrt.dll__wfopen]
mov r13, rax
test rax, rax
jne 0x10002aa65
mov rcx, qword [rbp]
test rcx, rcx
je 0x10002aa5e
lock add dword [rcx + 8], 0xffffffff
jne 0x10002aa59
test rcx, rcx
je 0x10002aa59
mov rax, qword [rcx]
lea edx, [r13 + 1]
call qword [rax]
and qword [rbp], 0
xor eax, eax
jmp 0x10002ab5a
mov rax, qword [rbp]
mov r12, qword [rax + 0x10]
test r12, r12
je 0x10002ab27
xor eax, eax
test r12, r12
setne al
test eax, eax
je 0x10002ab1c
mov rbx, qword [r12 + 0x10]
mov r12, qword [r12]
test rbx, rbx
je 0x10002aa99
lock add dword [rbx + 8], 1
mov qword [rsp + 0x60], rbx
mov rax, qword [rbx + 0x18]
cmp dword [rax - 0x10], 0
jne 0x10002aabe
mov r8, qword [rbx + 0x20]
lea rdx, [0x100009a90]
mov rcx, r13
call qword [sym.imp.msvcrt.dll_fwprintf]
jmp 0x10002aafd
mov r8, qword [rbx + 0x20]
lea rdx, [0x100009a90]
mov rcx, r13
call qword [sym.imp.msvcrt.dll_fwprintf]
mov r8, qword [rbx + 0x18]
lea rdx, [0x100009aa0]
mov rcx, r13
call qword [sym.imp.msvcrt.dll_fwprintf]
mov r11, qword [r15]
cmp dword [r11 - 0x10], 0
jne 0x10002aafd
lea rdx, [rbx + 0x18]
mov rcx, r15
call fcn.10001e1c8
nop
lock add dword [rbx + 8], 0xffffffff
jne 0x10002ab11
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [rax]
test r12, r12
jne 0x10002aa76
jmp 0x10002ab27
mov ecx, 0x80004005
call fcn.10001f28c
int3
mov rcx, r13
call qword [sym.imp.msvcrt.dll_fclose]
nop
mov rcx, qword [rbp]
test rcx, rcx
je 0x10002ab55
lock add dword [rcx + 8], 0xffffffff
jne 0x10002ab50
test rcx, rcx
je 0x10002ab50
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
and qword [rbp], 0
mov eax, 1
mov rbx, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x10002d9a4
Capabilities:
Check mutex on windows
Get file size
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rsi
mov qword [rax + 8], rcx
push rdi
sub rsp, 0x80
mov rsi, rdx
xor edi, edi
and dword [rax - 0x48], edi
and dword [rax + 8], edi
cmp qword [0x1000817c0], 0xffffffffffffffff
je 0x10002d9d4
lea eax, [rdi + 1]
jmp 0x10002daf3
lea rcx, [rsp + 0x48]
call fcn.100057130
test eax, eax
je 0x10002d9e9
xor eax, eax
jmp 0x10002daf3
lea r8, [0x1000062a0]
xor edx, edx
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [case.0x10002deff.46], rax
test rax, rax
jne 0x10002da1a
lea rcx, [rsp + 0x48]
call fcn.1000572dc
xor eax, eax
jmp 0x10002daf3
lea rcx, [rsp + 0x48]
call fcn.1000572dc
and qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov edx, 0xc0000000
lea r8d, [r9 + 3]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x1000817c0], rax
cmp rax, 0xffffffffffffffff
jne 0x10002da6e
lea rcx, [0x1000817c0]
call fcn.10002db0c
xor eax, eax
jmp 0x10002daf3
xor esi, esi
mov dword [rsp + 0x40], esi
xor edx, edx
mov rcx, qword [case.0x10002deff.46]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x10002da9a
cmp eax, 0x80
je 0x10002da9a
cmp eax, 0x102
jne 0x10002dae0
lea edi, [rsi + 1]
jmp 0x10002dae0
mov edi, 1
mov esi, edi
mov dword [rsp + 0x40], edi
xor edx, edx
mov rcx, qword [0x1000817c0]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
test eax, eax
jne 0x10002dae0
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x90]
lea r8d, [rdi + 1]
lea rdx, [0x1000025c4]
mov rcx, qword [0x1000817c0]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, eax
test esi, esi
je 0x10002daf1
mov rcx, qword [case.0x10002deff.46]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, edi
mov rsi, qword [rsp + 0x98]
add rsp, 0x80
pop rdi
ret

Function at 0x10002db50
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push r12
sub rsp, 0x40
mov esi, r8d
mov r12, rdx
xor edi, edi
and dword [rax + 8], edi
and dword [rax - 0x18], edi
cmp qword [0x1000817c0], 0xffffffffffffffff
jne 0x10002db88
xor eax, eax
jmp 0x10002dc09
xor ebx, ebx
mov dword [rsp + 0x30], ebx
mov edx, 0x3e8
mov rcx, qword [case.0x10002deff.46]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x10002dbb4
cmp eax, 0x80
je 0x10002dbb4
cmp eax, 0x102
je 0x10002dbbd
jmp 0x10002dbf6
mov ebx, 1
mov dword [rsp + 0x30], ebx
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov rcx, qword [0x1000817c0]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
lea r8d, [rsi + rsi]
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x50]
mov rdx, r12
mov rcx, qword [0x1000817c0]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, eax
test ebx, ebx
je 0x10002dc07
mov rcx, qword [case.0x10002deff.46]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, edi
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r12
ret
Function at 0x10002dc28
Capabilities:
Manipulate console buffer

Disassembly:
mov rax, rsp
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x58
xor ebx, ebx
mov dword [rax + 0x18], ebx
mov word [rax + 8], bx
mov word [rax + 0xa], bx
call fcn.1000309d4
cmp eax, 3
je 0x10002de05
lea rcx, [0x10000a098]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rdi, rax
cmp rax, rbx
je 0x10002de05
lea rdx, [0x10000a0b8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp rax, rbx
je 0x10002ddfc
or ecx, 0xffffffff
call rax
cmp eax, ebx
je 0x10002ddfc
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [0x100082508], rax
cmp rax, 0xffffffffffffffff
je 0x10002ddf6
lea rdx, [0x100082094]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleMode]
cmp eax, ebx
je 0x10002ddf6
mov edx, dword [0x100082094]
mov rcx, qword [0x100082508]
or edx, 3
call qword [sym.imp.KERNEL32.dll_SetConsoleMode]
cmp eax, ebx
je 0x10002ddf6
mov rcx, qword [0x100082508]
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
cmp eax, ebx
je 0x10002ddf6
movsx rsi, word [rsp + 0x34]
lea eax, [rbx + 4]
lea ebp, [rbx + 1]
mov word [0x100082090], si
mov word [0x100082092], bp
mul rsi
cmp rdx, rbx
jne 0x10002ddf6
mov rcx, rax
call qword [sym.imp.msvcrt.dll_malloc]
mov qword [0x100082510], rax
cmp rax, rbx
je 0x10002dd98
movzx ecx, word [rsp + 0x36]
mov r8d, dword [0x100082090]
mov word [rsp + 0x88], bx
mov word [rsp + 0x9a], cx
add cx, bp
mov word [rsp + 0x8a], bx
mov r9d, dword [rsp + 0x88]
mov word [rsp + 0x9e], cx
lea rcx, [rsp + 0x98]
mov qword [rsp + 0x20], rcx
mov rcx, qword [0x100082508]
mov rdx, rax
mov word [rsp + 0x98], bx
mov word [rsp + 0x9c], si
call qword [sym.imp.KERNEL32.dll_ReadConsoleOutputW]
movzx eax, word [rsp + 0x36]
movsx r8d, word [rsp + 0x34]
mov rcx, qword [0x100082508]
mov word [rsp + 0x82], ax
lea rax, [rsp + 0x90]
mov word [rsp + 0x80], bx
mov r9d, dword [rsp + 0x80]
mov edx, 0x20
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_FillConsoleOutputCharacterW]
cmp eax, ebx
je 0x10002ddf6
mov edx, dword [rsp + 0x80]
mov rcx, qword [0x100082508]
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
mov ebx, ebp
jmp 0x10002ddfc
call qword [sym.imp.KERNEL32.dll_FreeConsole]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, ebx
add rsp, 0x58
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x10002dfc0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x20
mov rsi, qword [rcx + 8]
mov rbx, rcx
mov rcx, qword [rcx]
xor r12d, r12d
xor ebp, ebp
xor edi, edi
call qword [sym.imp.msvcrt.dll_feof]
test eax, eax
jne 0x10002e0ba
mov r9, qword [rbx]
lea edx, [rax + 1]
lea rcx, [rsp + 0x40]
mov r8, rdx
call qword [sym.imp.msvcrt.dll_fread]
cmp rax, 1
jne 0x10002e0ab
mov al, byte [rsp + 0x40]
cmp al, 0x2c
je 0x10002e0ba
cmp al, 0xa
je 0x10002e0ba
mov rdx, qword [rbx + 0x10]
inc r12
cmp r12, rdx
jbe 0x10002e074
mov rcx, qword [rbx + 8]
test rcx, rcx
jne 0x10002e04d
mov ecx, 0x106
mov qword [rbx + 0x10], 0x104
call qword [sym.imp.msvcrt.dll_malloc]
jmp 0x10002e062
add rdx, 0x104
mov qword [rbx + 0x10], rdx
add rdx, 2
call qword [sym.imp.msvcrt.dll_realloc]
test rax, rax
je 0x10002e093
mov qword [rbx + 8], rax
lea rsi, [rax + r12 - 1]
mov al, byte [rsp + 0x40]
mov byte [rsi], al
cmp byte [rsp + 0x40], 0x20
je 0x10002e088
mov rdi, rsi
test rbp, rbp
jne 0x10002e088
mov rbp, rsi
mov rcx, qword [rbx]
inc rsi
jmp 0x10002dfe3
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x10002e0a7
call qword [sym.imp.msvcrt.dll_free]
and qword [rbx + 8], 0
xor eax, eax
jmp 0x10002e0cb
mov rcx, qword [rbx]
call qword [sym.imp.msvcrt.dll_fclose]
and qword [rbx], 0
jmp 0x10002e0a7
cmp qword [rbx], 0
je 0x10002e0a7
mov byte [rdi + 1], 0
mov rax, rbp
mov byte [rdi + 2], 0
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r12
pop rdi
pop rsi
ret

Function at 0x10002e670
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
sub rsp, 0x20
movzx ebx, cx
mov rcx, qword [0x100082518]
test rcx, rcx
je 0x10002e6ae
movzx edx, bx
mov r8d, 5
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x10002e6ae
mov rcx, qword [0x100082518]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x10002e6e3
mov rcx, qword [0x100082520]
test rcx, rcx
je 0x10002e6ee
movzx edx, bx
mov r8d, 5
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x10002e6ee
mov rcx, qword [0x100082520]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x10002e6ee
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
jmp 0x10002e6f0
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x10002e910
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rbx, rcx
test rcx, rcx
je 0x10002e9d6
test rdx, rdx
je 0x10002e9d6
xor r9d, r9d
lea rdx, [0x10000a348]
lea esi, [r9 + 1]
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
test rax, rax
jne 0x10002e957
xor ebx, ebx
jmp 0x10002e966
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbx, rax
lea rdx, [0x10000a348]
xor r9d, r9d
mov r8, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
test rax, rax
je 0x10002e98d
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rbx, rbx
je 0x10002e9cb
test rax, rax
je 0x10002e9cb
mov ecx, 0xfecdfecd
cmp dword [rbx], ecx
jne 0x10002e9c5
cmp dword [rax], ecx
jne 0x10002e9c5
mov rdx, qword [rbx + 0x1c]
cmp rdx, qword [rax + 0x1c]
jne 0x10002e9bc
mov rdx, qword [rbx + 0x24]
cmp rdx, qword [rax + 0x24]
jne 0x10002e9bc
xor eax, eax
jmp 0x10002e9c1
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x10002e9c7
xor esi, esi
mov eax, esi
jmp 0x10002e9d8
mov ecx, 0xd
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x10002eabc
Capabilities:
Check os version

Disassembly:
sub rsp, 0x158
mov rax, qword [0x100081138]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov eax, dword [0x100082a38]
test eax, eax
jne 0x10002ebc1
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x11c
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x10002eb1f
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov ecx, dword [rsp + 0x30]
mov edx, dword [rsp + 0x24]
xor eax, eax
lea r8d, [rax + 1]
mov dword [0x100082a38], eax
sub ecx, r8d
je 0x10002eba1
cmp ecx, r8d
jne 0x10002ebc1
cmp edx, 5
jne 0x10002eb8f
mov ecx, dword [rsp + 0x28]
test ecx, ecx
je 0x10002eb88
sub ecx, r8d
je 0x10002eb73
cmp ecx, r8d
je 0x10002eb5d
lea eax, [rdx + 0xf]
jmp 0x10002ebbb
cmp word [rsp + 0x134], r8w
mov ecx, 0x10
cmovae eax, ecx
or eax, 4
jmp 0x10002ebbb
mov edx, 8
lea ecx, [rdx - 6]
cmp word [rsp + 0x134], cx
cmovae eax, edx
jmp 0x10002eb6e
mov eax, 4
jmp 0x10002ebbb
cmp edx, 4
ja 0x10002ebd9
mov ecx, 2
mov eax, ecx
mov dword [0x100082a38], ecx
cmp edx, 4
jne 0x10002ebc1
mov ecx, dword [rsp + 0x28]
test ecx, ecx
je 0x10002ebb8
cmp ecx, 0xa
je 0x10002ebb8
cmp ecx, 0x5a
jne 0x10002ebc1
mov eax, r8d
mov dword [0x100082a38], eax
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.10005cbe0
add rsp, 0x158
ret
mov eax, 0x20
jmp 0x10002ebbb
Function at 0x10002fbcc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x10002fbe2
xor al, al
jmp 0x10002fbe9
shr eax, 4
not al
and al, 1
add rsp, 0x28
ret