joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18007d4e0
Capabilities:
Set console window title

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x90
lea rdi, [rsp + 0x20]
mov ecx, 0x1c
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0xa0]
mov rax, qword [0x180562540]
xor rax, rsp
mov qword [rsp + 0x88], rax
lea rcx, [0x1805d409f]
call fcn.18024f670
call qword [sym.imp.KERNEL32.dll_AllocConsole]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_AttachConsole]
xor ecx, ecx
call fcn.18027bd30
mov r9, rax
lea r8, [0x180402938]
lea rdx, [0x180402940]
lea rcx, [rsp + 0x28]
call fcn.18027c9b0
mov ecx, 1
call fcn.18027bd30
mov r9, rax
lea r8, [0x180402948]
lea rdx, [0x180402940]
lea rcx, [rsp + 0x28]
call fcn.18027c9b0
mov ecx, 2
call fcn.18027bd30
mov r9, rax
lea r8, [0x180402948]
lea rdx, [0x180402940]
lea rcx, [rsp + 0x28]
call fcn.18027c9b0
lea rcx, str.Project_Bo4:
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
lea r8, [0x180077f00]
lea rdx, [fcn.18007d8b0]
lea rcx, [0x18057c338]
call fcn.1801ae190
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov edx, 5
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
xor r9d, r9d
xor r8d, r8d
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [0x18057c3d8], rax
lea rdx, str.Console
lea rcx, [rsp + 0x38]
call fcn.180036e30
nop
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x70]
call fcn.180079170
mov qword [rsp + 0x80], rax
mov rdx, qword [rsp + 0x80]
lea rcx, [0x18057c3c8]
call fcn.18007a400
lea rcx, [rsp + 0x70]
call fcn.18007a3c0
nop
lea rcx, [rsp + 0x38]
call fcn.180037b60
mov rcx, rsp
lea rdx, [0x180402350]
call fcn.18024f440
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.18024f8b0
add rsp, 0x90
pop rdi
ret
Function at 0x180083980
Capabilities:
Convert ip address from string

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0xb0
lea rdi, [rsp + 0x20]
mov ecx, 0x24
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0xc0]
mov rax, qword [0x180562540]
xor rax, rsp
mov qword [rsp + 0xa0], rax
lea rcx, [0x1805d40e0]
call fcn.18024f670
lea rdx, str.127.0.0.1
lea rcx, [rsp + 0x58]
call fcn.180036e30
nop
lea r9, [rsp + 0x58]
lea r8, str.ipv4
lea rdx, str.demonware
lea rcx, [rsp + 0x28]
call fcn.1801d5a50
nop
lea rcx, [rsp + 0x58]
call fcn.180037b60
lea rax, [rsp + 0x84]
mov rdi, rax
xor eax, eax
mov ecx, 4
rep stosb byte [rdi], al
lea rcx, [rsp + 0x28]
call fcn.180069610
lea r8, [rsp + 0x84]
mov rdx, rax
mov ecx, 2
call qword [sym.imp.WS2_32.dll_inet_pton]
cmp eax, 1
jne 0x180083a46
mov eax, dword [rsp + 0x84]
mov dword [0x18057c650], eax
jmp 0x180083a6e
mov dword [0x18057c650], 0x100007f
lea rcx, [rsp + 0x28]
call fcn.180069610
mov r8, rax
lea rdx, str.__network__:_wrong_dw_server_address_specified:__s
mov ecx, 3
call fcn.1800c7330
movabs rcx, 0x144508469
call fcn.180176490
xor edx, edx
mov rcx, rax
call fcn.18007f0e0
movabs rcx, 0x144508455
call fcn.180176490
mov dl, 0xaf
mov rcx, rax
call fcn.18007f0e0
movabs rcx, 0x144b28d98
call fcn.180176490
xor edx, edx
mov rcx, rax
call fcn.18007f0e0
movabs rcx, 0x144a27c70
call fcn.180176490
lea rdx, str.http:__prod.umbrella.demonware.net
mov rcx, rax
call fcn.1801ae830
movabs rcx, 0x144a2baa0
call fcn.180176490
lea rdx, str.http:__prod.uno.demonware.net_v1.0
mov rcx, rax
call fcn.1801ae830
movabs rcx, 0x144a29cb0
call fcn.180176490
lea rdx, str.http:___s:_d_auth_
mov rcx, rax
call fcn.1801ae830
nop
lea rcx, [rsp + 0x28]
call fcn.180037b60
mov rcx, rsp
lea rdx, [0x180403cf0]
call fcn.18024f440
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.18024f8b0
add rsp, 0xb0
pop rdi
ret
Function at 0x1800c6a20
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x80
lea rdi, [rsp + 0x20]
mov ecx, 0x18
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x90]
lea rcx, [0x1805d41f3]
call fcn.18024f670
cmp qword [rsp + 0xa0], 0
jg 0x1800c6a6e
xor eax, eax
jmp 0x1800c6c64
mov rax, qword [rsp + 0x90]
cmp qword [rax + 0x68], 0
je 0x1800c6a9f
mov r8, qword [rsp + 0xa0]
mov rdx, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x90]
call fcn.1800c6c90
jmp 0x1800c6c64
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x90]
call fcn.1800c1ac0
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
jbe 0x1800c6b4d
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x28]
call fcn.1800369f0
mov rax, qword [rax]
mov qword [rsp + 0x58], rax
mov rcx, qword [rsp + 0x90]
call fcn.1800c4a00
mov r8, qword [rsp + 0x58]
mov rdx, rax
mov rcx, qword [rsp + 0x98]
call fcn.18003adc0
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x98]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x98], rax
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x28]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov edx, dword [rsp + 0x58]
mov rcx, qword [rsp + 0x90]
call fcn.1800c4820
mov rax, qword [rsp + 0x90]
cmp qword [rax + 0x80], 0
je 0x1800c6c54
mov rcx, qword [rsp + 0x90]
call fcn.1800c2b50
mov qword [rsp + 0x60], 0xfff
cmp qword [rsp + 0x28], 0xfff
jbe 0x1800c6c02
mov rax, qword [rsp + 0x90]
mov r9, qword [rax + 0x80]
mov r8d, 0xfff
mov edx, 1
mov rcx, qword [rsp + 0x98]
call fcn.1802c24a0
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x98]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x98], rax
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x28]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x68], 0xfff
je 0x1800c6bfd
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x38]
sub rcx, rax
mov rax, rcx
jmp 0x1800c6c64
jmp 0x1800c6b79
cmp qword [rsp + 0x28], 0
jbe 0x1800c6c54
mov rax, qword [rsp + 0x90]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x28]
mov edx, 1
mov rcx, qword [rsp + 0x98]
call fcn.1802c24a0
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x78]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x38]
sub rcx, rax
mov rax, rcx
mov rdi, rax
mov rcx, rsp
lea rdx, [0x180414280]
call fcn.18024f440
mov rax, rdi
add rsp, 0x80
pop rdi
ret
Function at 0x1800c70b0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rdi
sub rsp, 0x330
lea rdi, [rsp + 0x20]
mov ecx, 0xc4
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x340]
mov rax, qword [0x180562540]
xor rax, rsp
mov qword [rsp + 0x328], rax
lea rcx, [0x1805d4245]
call fcn.18024f670
mov edx, 1
lea rcx, [rsp + 0x30]
call fcn.1800c8c30
nop
lea rax, [rsp + 0x40]
lea rdx, [0x180415204]
mov rcx, rax
call fcn.1800c7970
mov qword [rsp + 0x2f0], rax
movsxd rax, dword [rsp + 0x340]
lea rcx, str.DEBUG
mov rax, qword [rcx + rax*8]
mov qword [rsp + 0x2f8], rax
mov rdx, qword [rsp + 0x2f8]
mov rcx, qword [rsp + 0x2f0]
call fcn.1800c7970
lea rdx, [0x180415200]
mov rcx, rax
call fcn.1800c7970
mov qword [rsp + 0x300], rax
mov rax, qword [rsp + 0x348]
mov qword [rsp + 0x308], rax
mov rdx, qword [rsp + 0x308]
mov rcx, qword [rsp + 0x300]
call fcn.1800c7910
mov qword [rsp + 0x310], rax
lea rdx, [0x1800c8460]
mov rcx, qword [rsp + 0x310]
call fcn.1800c9320
lea rdx, [rsp + 0x148]
lea rcx, [rsp + 0x30]
call fcn.1800cb600
nop
lea rcx, [rsp + 0x148]
call fcn.1800895c0
lea rcx, [rsp + 0x148]
call fcn.1800694d0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, [rsp + 0x148]
call fcn.1800694d0
mov rcx, rax
call fcn.18007d8b0
mov edx, 1
lea rcx, [rsp + 0x190]
call fcn.1800c8910
nop
mov r9d, 0x40
mov r8d, 8
lea rdx, str.project_bo4.log
lea rcx, [rsp + 0x190]
call fcn.1800ca220
xor ecx, ecx
call fcn.1800c7080
mov qword [rsp + 0x2b8], rax
lea rcx, [rsp + 0x2b8]
call fcn.1800c7050
mov qword [rsp + 0x2c8], rax
lea rdx, [0x1804151e6]
lea rcx, [rsp + 0x190]
call fcn.1800c7970
mov qword [rsp + 0x318], rax
lea r8, str._Y__m__d__H:_M:_S
mov rdx, qword [rsp + 0x2c8]
lea rcx, [rsp + 0x2d8]
call fcn.1800c8600
mov qword [rsp + 0x320], rax
mov rdx, qword [rsp + 0x320]
mov rcx, qword [rsp + 0x318]
call fcn.1800c75e0
lea rdx, reloc.WS2_32.dll_htons
mov rcx, rax
call fcn.1800c7970
lea rdx, [rsp + 0x148]
mov rcx, rax
call fcn.1800c7910
nop
lea rcx, [rsp + 0x190]
call fcn.1800c9550
nop
lea rcx, [rsp + 0x148]
call fcn.180037b60
nop
lea rcx, [rsp + 0x30]
call fcn.1800c95d0
nop
mov rcx, qword [rsp + 0x348]
call fcn.180037b60
mov rcx, rsp
lea rdx, [0x1804154d0]
call fcn.18024f440
mov rcx, qword [rsp + 0x328]
xor rcx, rsp
call fcn.18024f8b0
add rsp, 0x330
pop rdi
ret
Function at 0x18010af90
Capabilities:
Create process on windows
Terminate process

Disassembly:
push rdi
sub rsp, 0xa0
lea rdi, [rsp + 0x30]
mov ecx, 0x1c
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x180562540]
xor rax, rsp
mov qword [rsp + 0x98], rax
lea rcx, [0x1805d4318]
call fcn.18024f670
lea rcx, [rsp + 0x38]
call fcn.18010b5a0
nop
lea rdx, str.SOFTWAREBlizzard_EntertainmentBattle.net
lea rcx, [rsp + 0x68]
call fcn.180036f00
mov dword [rsp + 0x20], 0x2011f
lea r9, [rsp + 0x68]
mov r8, 0xffffffff80000001
lea rdx, [rsp + 0x54]
lea rcx, [rsp + 0x38]
call fcn.18010b970
lea rcx, [rsp + 0x68]
call fcn.180037c10
lea rcx, [rsp + 0x54]
call fcn.18010b6e0
movzx eax, al
test eax, eax
jne 0x18010b08e
mov r9d, gethostbyname
lea r8, [0x180421578]
lea rdx, str.You_need_to_have_BlackOps4_from_Battle.Net_to_use_this_product...
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.http:__battle.net_
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea rdx, str.__PLATFORM__:_Couldnt_find_Battle.Net_Launcher__Shutting_down...
mov ecx, 1
call fcn.1800c7330
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 1
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
lea rcx, [rsp + 0x38]
call fcn.18010b690
mov rcx, rsp
lea rdx, [0x1804234b0]
call fcn.18024f440
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.18024f8b0
add rsp, 0xa0
pop rdi
ret

Function at 0x180110be0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x60
lea rdi, [rsp + 0x30]
mov ecx, 0xc
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x70]
lea rcx, [0x1805d4324]
call fcn.18024f670
mov rdx, qword [rsp + 0x78]
lea rcx, [rsp + 0x38]
call fcn.180111d70
nop
lea rax, [0x1801109d0]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x70]
add rax, 8
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x38]
call fcn.180112b70
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rsp + 0x48]
xor edx, edx
xor ecx, ecx
call fcn.1802bd070
mov rcx, qword [rsp + 0x70]
mov qword [rcx], rax
mov rax, qword [rsp + 0x70]
cmp qword [rax], 0
je 0x180110c87
lea rcx, [rsp + 0x38]
call fcn.180112d20
jmp 0x180110c9e
mov rax, qword [rsp + 0x70]
mov dword [rax + 8], 0
mov ecx, 6
call fcn.18020e600
nop
lea rcx, [rsp + 0x38]
call fcn.1801122a0
mov rcx, rsp
lea rdx, [0x180424530]
call fcn.18024f440
add rsp, 0x60
pop rdi
ret
Function at 0x180113100
Capabilities:
Hide graphical window

Disassembly:
push rdi
sub rsp, 0x20
lea rcx, [0x1805d4353]
call fcn.18024f670
cmp qword [0x1805825f0], 0
je 0x180113180
mov rcx, qword [0x1805825f0]
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x180113180
xor edx, edx
mov rcx, qword [0x1805825f0]
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x1805825f0]
call qword [sym.imp.USER32.dll_DestroyWindow]
mov qword [0x1805825f0], 0
lea rcx, [0x1805825d8]
call fcn.18007d0a0
movzx eax, al
test eax, eax
je 0x180113173
lea rcx, [0x1805825d8]
call fcn.18007cff0
mov qword [0x1805825f0], 0
jmp 0x18011319f
lea rcx, [0x1805825d8]
call fcn.18007d0a0
movzx eax, al
test eax, eax
je 0x18011319f
lea rcx, [0x1805825d8]
call fcn.180114370
add rsp, 0x20
pop rdi
ret
Function at 0x180113af0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x60
lea rdi, [rsp + 0x30]
mov ecx, 0xc
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x70]
lea rcx, [0x1805d434d]
call fcn.18024f670
mov rdx, qword [rsp + 0x78]
lea rcx, [rsp + 0x38]
call fcn.180113d30
nop
lea rax, [0x180113a60]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x70]
add rax, 8
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x38]
call fcn.180114400
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rsp + 0x48]
xor edx, edx
xor ecx, ecx
call fcn.1802bd070
mov rcx, qword [rsp + 0x70]
mov qword [rcx], rax
mov rax, qword [rsp + 0x70]
cmp qword [rax], 0
je 0x180113b97
lea rcx, [rsp + 0x38]
call fcn.1801144d0
jmp 0x180113bae
mov rax, qword [rsp + 0x70]
mov dword [rax + 8], 0
mov ecx, 6
call fcn.18020e600
nop
lea rcx, [rsp + 0x38]
call fcn.180113f90
mov rcx, rsp
lea rdx, [0x180424e80]
call fcn.18024f440
add rsp, 0x60
pop rdi
ret
Function at 0x18011dc80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x70
lea rcx, [0x1805d43d2]
call fcn.18024f670
cmp dword [rsp + 0x88], 0
jne 0x18011dcb0
xor al, al
jmp 0x18011de7f
mov rax, qword [rsp + 0x80]
mov eax, dword [rax + 0x28]
add eax, dword [rsp + 0x88]
mov eax, eax
mov qword [rsp + 0x48], rax
mov rcx, qword [rsp + 0x80]
call fcn.18006ace0
shl rax, 3
mov rcx, qword [rsp + 0x48]
cmp rcx, rax
jbe 0x18011dceb
xor al, al
jmp 0x18011de7f
mov rax, qword [rsp + 0x80]
mov eax, dword [rax + 0x28]
shr eax, 3
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x24], 0
mov rax, qword [rsp + 0x80]
mov rcx, rax
call fcn.180069610
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x30], rax
cmp dword [rsp + 0x88], 0
jbe 0x18011de7d
cmp dword [rsp + 0x88], 8
jae 0x18011dd4c
mov eax, dword [rsp + 0x88]
mov dword [rsp + 0x50], eax
jmp 0x18011dd54
mov dword [rsp + 0x50], 8
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x38], eax
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
movsx eax, byte [rcx + rax]
and eax, 0xff
mov dword [rsp + 0x54], eax
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x54]
mov dword [rsp + 0x3c], eax
mov rax, qword [rsp + 0x80]
mov eax, dword [rax + 0x28]
and eax, 7
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x40]
mov ecx, dword [rsp + 0x38]
add ecx, eax
mov eax, ecx
cmp eax, 8
jg 0x18011dde0
mov eax, 8
sub eax, dword [rsp + 0x38]
mov ecx, 0xff
mov dword [rsp + 0x58], ecx
movzx ecx, al
mov eax, dword [rsp + 0x58]
sar eax, cl
mov ecx, dword [rsp + 0x40]
mov edx, dword [rsp + 0x3c]
sar edx, cl
mov ecx, edx
and eax, ecx
movsxd rcx, dword [rsp + 0x24]
mov rdx, qword [rsp + 0x30]
mov byte [rdx + rcx], al
jmp 0x18011de3e
mov eax, 8
sub eax, dword [rsp + 0x38]
mov ecx, 0xff
mov dword [rsp + 0x5c], ecx
movzx ecx, al
mov eax, dword [rsp + 0x5c]
sar eax, cl
movsxd rcx, dword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
movsx ecx, byte [rdx + rcx]
mov dword [rsp + 0x60], ecx
mov edx, 8
sub edx, dword [rsp + 0x40]
movzx ecx, dl
mov edx, dword [rsp + 0x60]
shl edx, cl
mov ecx, edx
and eax, ecx
mov ecx, dword [rsp + 0x40]
mov edx, dword [rsp + 0x3c]
sar edx, cl
mov ecx, edx
or eax, ecx
movsxd rcx, dword [rsp + 0x24]
mov rdx, qword [rsp + 0x30]
mov byte [rdx + rcx], al
mov eax, dword [rsp + 0x24]
inc eax
mov dword [rsp + 0x24], eax
mov rax, qword [rsp + 0x80]
mov eax, dword [rax + 0x28]
add eax, dword [rsp + 0x38]
mov rcx, qword [rsp + 0x80]
mov dword [rcx + 0x28], eax
mov eax, dword [rsp + 0x38]
mov ecx, dword [rsp + 0x88]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x88], eax
jmp 0x18011dd27
mov al, 1
add rsp, 0x70
pop rdi
ret
Function at 0x1801682c0
Capabilities:
Terminate process

Disassembly:
push rdi
sub rsp, 0x30
lea rcx, [0x1805d49e4]
call fcn.18024f670
mov eax, 0x7100
mov eax, eax
mov ecx, dword [0x1805857fc]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rax + rcx]
cmp dword [0x18058279c], eax
jle 0x180168328
lea rcx, [0x18058279c]
call fcn.18024f2f0
cmp dword [0x18058279c], 0xffffffff
jne 0x180168328
lea rcx, [rsp + 0x20]
call fcn.1801688b0
mov byte [0x180582798], al
lea rcx, [0x18058279c]
call fcn.18024f290
movzx eax, byte [0x180582798]
test eax, eax
jne 0x180168347
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 1
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x30
pop rdi
ret

Function at 0x180168360
Capabilities:
Terminate process

Disassembly:
push rdi
sub rsp, 0x30
lea rcx, [0x1805d49e4]
call fcn.18024f670
mov eax, 0x7100
mov eax, eax
mov ecx, dword [0x1805857fc]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rax + rcx]
cmp dword [0x1805827a4], eax
jle 0x1801683c8
lea rcx, [0x1805827a4]
call fcn.18024f2f0
cmp dword [0x1805827a4], 0xffffffff
jne 0x1801683c8
lea rcx, [rsp + 0x20]
call fcn.180168990
mov byte [0x1805827a0], al
lea rcx, [0x1805827a4]
call fcn.18024f290
movzx eax, byte [0x1805827a0]
test eax, eax
jne 0x1801683e7
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 1
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x30
pop rdi
ret

Function at 0x1801700f0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x220
lea rdi, [rsp + 0x20]
mov ecx, 0x80
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x230]
mov rax, qword [0x180562540]
xor rax, rsp
mov qword [rsp + 0x210], rax
lea rcx, [0x1805d4a06]
call fcn.18024f670
lea rax, [rsp + 0x30]
mov rdi, rax
xor eax, eax
mov ecx, 0x104
rep stosb byte [rdi], al
mov edx, 0x104
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov r8d, 0xa
lea rdx, str._d3d11.dll
lea rcx, [rsp + 0x168]
call fcn.180038540
mov qword [rsp + 0x1f0], rax
mov rax, qword [rsp + 0x1f0]
mov qword [rsp + 0x1f8], rax
mov r8, qword [rsp + 0x1f8]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x190]
call fcn.1800e0900
mov qword [rsp + 0x200], rax
mov rax, qword [rsp + 0x200]
mov qword [rsp + 0x208], rax
mov rdx, qword [rsp + 0x208]
lea rcx, [rsp + 0x158]
call fcn.1801a40a0
nop
lea rcx, [rsp + 0x190]
call fcn.180037b60
nop
lea rcx, [rsp + 0x168]
call fcn.180037b60
lea rdx, [0x18045cc90]
lea rcx, [rsp + 0x1b8]
call fcn.180036e30
nop
lea rdx, [rsp + 0x1b8]
lea rcx, [rsp + 0x158]
call fcn.180172380
mov qword [rsp + 0x1e8], rax
lea rcx, [rsp + 0x1b8]
call fcn.180037b60
mov rax, qword [rsp + 0x1e8]
mov rdi, rax
mov rcx, rsp
lea rdx, [0x18045c850]
call fcn.18024f440
mov rax, rdi
mov rcx, qword [rsp + 0x210]
xor rcx, rsp
call fcn.18024f8b0
add rsp, 0x220
pop rdi
ret

Function at 0x18017bc00
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x20
lea rcx, [0x1805d4d78]
call fcn.18024f670
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add rsp, 0x20
pop rdi
ret
Function at 0x1801a4a30
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x90
lea rdi, [rsp + 0x20]
mov ecx, 0x1c
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0xa0]
mov dword [rsp + 0x78], 0
lea rcx, [0x1805d5477]
call fcn.18024f670
mov rcx, qword [rsp + 0xa8]
call fcn.1801a69d0
mov qword [rsp + 0x80], rax
mov eax, dword [rsp + 0x78]
or eax, 1
mov dword [rsp + 0x78], eax
mov rcx, qword [rsp + 0xa0]
call fcn.1801a4b50
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
movzx eax, word [rax + 0x14]
mov rcx, qword [rsp + 0x58]
lea rax, [rcx + rax + 0x18]
mov qword [rsp + 0x68], rax
xor eax, eax
mov word [rsp + 0x74], ax
jmp 0x1801a4add
movzx eax, word [rsp + 0x74]
inc ax
mov word [rsp + 0x74], ax
mov rax, qword [rsp + 0x68]
add rax, 0x28
mov qword [rsp + 0x68], rax
movzx eax, word [rsp + 0x74]
mov rcx, qword [rsp + 0x58]
movzx ecx, word [rcx + 6]
cmp eax, ecx
jge 0x1801a4b1a
cmp qword [rsp + 0x68], 0
je 0x1801a4b0b
lea rdx, [rsp + 0x68]
mov rcx, qword [rsp + 0xa8]
call fcn.1801a7b40
jmp 0x1801a4b18
lea rcx, str.There_was_an_invalid_section_:O
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x1801a4ac2
mov rax, qword [rsp + 0xa8]
mov rdi, rax
mov rcx, rsp
lea rdx, [0x18046a4a0]
call fcn.18024f440
mov rax, rdi
add rsp, 0x90
pop rdi
ret

Function at 0x1801a5030
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x70
lea rdi, [rsp + 0x20]
mov ecx, 0x14
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x80]
mov dword [rsp + 0x48], 0
lea rcx, [0x1805d5477]
call fcn.18024f670
lea rdx, [fcn.1801a5030]
lea rcx, [rsp + 0x28]
call fcn.1801a4180
movzx eax, word [rsp + 0x88]
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x28]
call fcn.1801a4360
mov r8d, 0xa
mov rcx, qword [rsp + 0x50]
mov rdx, rcx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jne 0x1801a50dc
mov rcx, qword [rsp + 0x80]
call fcn.18005c350
mov eax, dword [rsp + 0x48]
or eax, 1
mov dword [rsp + 0x48], eax
mov rax, qword [rsp + 0x80]
jmp 0x1801a517c
lea rcx, [rsp + 0x28]
call fcn.1801a4360
mov rdx, qword [rsp + 0x38]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
jne 0x1801a5123
mov rcx, qword [rsp + 0x80]
call fcn.18005c350
mov eax, dword [rsp + 0x48]
or eax, 1
mov dword [rsp + 0x48], eax
mov rax, qword [rsp + 0x80]
jmp 0x1801a517c
lea rcx, [rsp + 0x28]
call fcn.1801a4360
mov rdx, qword [rsp + 0x38]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov eax, eax
mov qword [rsp + 0x58], rax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [rsp + 0x60], rax
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x80]
call fcn.180036ea0
mov eax, dword [rsp + 0x48]
or eax, 1
mov dword [rsp + 0x48], eax
mov rax, qword [rsp + 0x80]
mov rdi, rax
mov rcx, rsp
lea rdx, [0x18046a600]
call fcn.18024f440
mov rax, rdi
add rsp, 0x70
pop rdi
ret