joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140002644
Capabilities:
Get common file path
Query environment variable
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r14
lea rbp, [rsp - 0x60]
sub rsp, 0x160
mov rax, qword [0x14000c008]
xor rax, rsp
mov qword [rbp + 0x50], rax
xor esi, esi
mov rdi, r8
mov byte [rcx], sil
mov rbx, rcx
cmp byte [r8], 0x23
lea r12d, [rsi + 1]
jne 0x140002849
add rdi, r12
movsx rcx, byte [rdi]
call qword [sym.imp.USER32.dll_CharUpperA]
nop dword [rax + rax]
mov rcx, rdi
mov r14, rax
call qword [sym.imp.USER32.dll_CharNextA]
nop dword [rax + rax]
mov rcx, rax
call qword [sym.imp.USER32.dll_CharNextA]
nop dword [rax + rax]
mov rdi, rax
cmp r14b, 0x53
je 0x14000282f
cmp r14b, 0x57
je 0x140002819
lea r8, str.SoftwareMicrosoftWindowsCurrentVersionApp_Paths
mov dword [rsp + 0x34], 0x104
lea rax, [rsp + 0x40]
mov edx, 0x104
sub r8, rax
lea rcx, [rsp + 0x40]
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x14000270d
mov al, byte [r8 + rcx]
test al, al
je 0x14000270d
mov byte [rcx], al
add rcx, r12
sub rdx, r12
jne 0x1400026ef
test rdx, rdx
lea rax, [rcx - 1]
mov r8, rdi
mov edx, 0x104
cmovne rax, rcx
lea rcx, [rsp + 0x40]
mov byte [rax], sil
call fcn.140007e08
lea rax, [rsp + 0x38]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x40]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
nop dword [rax + rax]
test eax, eax
jne 0x14000285a
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x20], rbx
lea rdx, [0x140009760]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
nop dword [rax + rax]
test eax, eax
jne 0x140002806
mov eax, dword [rsp + 0x30]
cmp eax, 2
jne 0x1400027ff
mov r8d, 0x104
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
nop dword [rax + rax]
test eax, eax
je 0x1400027fb
lea r8, [rsp + 0x40]
mov edx, 0x104
sub r8, rbx
mov rcx, rbx
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x1400027e8
mov al, byte [r8 + rcx]
test al, al
je 0x1400027e8
mov byte [rcx], al
add rcx, r12
sub rdx, r12
jne 0x1400027ca
test rdx, rdx
lea rax, [rcx - 1]
cmovne rax, rcx
mov byte [rax], sil
mov esi, r12d
jmp 0x140002806
mov eax, dword [rsp + 0x30]
cmp eax, r12d
cmove esi, r12d
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
jmp 0x140002843
mov edx, 0x104
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
nop dword [rax + rax]
jmp 0x14000285a
mov edx, 0x104
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
nop dword [rax + rax]
test esi, esi
jne 0x14000286a
jmp 0x14000285a
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
nop dword [rax + rax]
mov r8, rdi
mov edx, 0x104
mov rcx, rbx
call fcn.140007e08
mov eax, r12d
mov rcx, qword [rbp + 0x50]
xor rcx, rsp
call fcn.1400086f0
mov rbx, qword [rsp + 0x198]
add rsp, 0x160
pop r14
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140002898
Capabilities:
Get file version info

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x48
xor r15d, r15d
mov r12, r9
mov r14, rdx
mov r13, rcx
mov edi, r15d
mov dword [rbp + 0x58], r15d
mov ebx, r15d
cmp dword [rcx + 0x7c], r15d
jle 0x140002a9a
mov eax, r15d
mov qword [rbp - 0x18], rax
mov esi, dword [r13 + 0x80]
lea r8, [r13 + 0x84]
add rsi, rax
mov rcx, r14
mov eax, dword [rsi + r13 + 0xbc]
add r8, rax
call fcn.140002644
test eax, eax
je 0x140002ab3
lea rdx, [rbp + 0x48]
mov rcx, r14
call qword [sym.imp.VERSION.dll_GetFileVersionInfoSizeA]
nop dword [rax + rax]
mov r14d, eax
test eax, eax
je 0x140002a6a
mov edx, r14d
mov ecx, 0x42
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
je 0x140002aaa
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
nop dword [rax + rax]
mov r15, rax
test rax, rax
je 0x140002aa1
mov edx, dword [rbp + 0x48]
mov r8d, r14d
mov r14, qword [rbp + 0x50]
mov r9, rax
mov rcx, r14
call qword [sym.imp.VERSION.dll_GetFileVersionInfoA]
nop dword [rax + rax]
test eax, eax
je 0x140002a56
lea r9, [rbp + 0x60]
mov rcx, r15
lea r8, [rbp - 0x10]
lea rdx, [0x14000987c]
call qword [sym.imp.VERSION.dll_VerQueryValueA]
nop dword [rax + rax]
xor r15d, r15d
test eax, eax
je 0x140002a59
cmp dword [rbp + 0x60], r15d
je 0x140002a59
mov rax, qword [rbp - 0x10]
lea rcx, [r13 + 0x90]
add rcx, rsi
mov edx, r15d
mov r9d, dword [rax + 0xc]
mov r8d, dword [rax + 8]
cmp r8d, dword [rcx - 0xc]
jae 0x1400029dc
or eax, 0xffffffff
jmp 0x1400029f1
jbe 0x1400029e5
mov eax, 1
jmp 0x1400029f1
cmp r9d, dword [rcx - 8]
jb 0x1400029d7
mov eax, r15d
seta al
mov dword [rbp + rdx - 0x28], eax
cmp r8d, dword [rcx]
jae 0x1400029ff
or eax, 0xffffffff
jmp 0x140002a14
jbe 0x140002a08
mov eax, 1
jmp 0x140002a14
cmp r9d, dword [rcx + 4]
jb 0x1400029fa
mov eax, r15d
seta al
mov dword [rbp + rdx - 0x20], eax
add rcx, 0x18
add rdx, 4
cmp rdx, 8
jl 0x1400029d1
cmp dword [rbp - 0x28], r15d
jl 0x140002a32
cmp dword [rbp - 0x20], r15d
jle 0x140002a59
cmp dword [rbp - 0x24], r15d
jl 0x140002a3e
cmp dword [rbp - 0x1c], r15d
jle 0x140002a59
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
nop dword [rax + rax]
mov dword [r12], ebx
mov esi, r15d
jmp 0x140002abf
xor r15d, r15d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
nop dword [rax + rax]
jmp 0x140002a82
cmp dword [rsi + r13 + 0x84], r15d
jne 0x140002ab3
cmp dword [rsi + r13 + 0x88], r15d
jne 0x140002ab3
mov r14, qword [rbp + 0x50]
mov rax, qword [rbp - 0x18]
inc ebx
add rax, 0x3c
mov qword [rbp - 0x18], rax
cmp ebx, dword [r13 + 0x7c]
jl 0x1400028dc
mov esi, 1
jmp 0x140002ab6
mov esi, dword [rbp + 0x58]
mov dword [r12], ebx
jmp 0x140002abf
mov esi, dword [rbp + 0x58]
mov dword [r12], ebx
jmp 0x140002ace
mov esi, dword [rbp + 0x58]
mov dword [r12], ebx
test rdi, rdi
je 0x140002ace
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
mov eax, esi
add rsp, 0x48
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140002d70
Capabilities:
Check os version
Shutdown system

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rbx, r8
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetVersion]
nop dword [rax + rax]
xor esi, esi
test eax, eax
js 0x140002de9
cmp al, 6
jb 0x140002de9
lea rcx, [0x140009880]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
nop dword [rax + rax]
test rax, rax
je 0x140002de9
lea rdx, str.HeapSetInformation
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
nop dword [rax + rax]
test rax, rax
je 0x140002de9
movabs r10, 0x93b5969b18548370
xor r9d, r9d
lea edx, [rsi + 1]
xor r8d, r8d
xor ecx, ecx
call qword [vtable.H_MA8HI.0]
mov rdx, rbx
mov dword [0x14000d544], esi
mov rcx, rdi
call fcn.140002edc
test eax, eax
je 0x140002ea5
call fcn.140003214
mov ebx, eax
call fcn.1400063dc
test ebx, ebx
je 0x140002ea5
cmp byte [0x14000cd1a], sil
jne 0x140002ea5
mov edi, dword [0x14000de5c]
test dil, 1
je 0x140002ea5
test dil, 2
jne 0x140002e53
cmp dword [0x14000d540], esi
jne 0x140002e53
movzx ecx, word [0x14000de78]
mov ebx, dword [0x14000de7c]
call fcn.1400023c0
cmp ebx, eax
je 0x140002ea5
test dil, 4
jne 0x140002e84
mov dword [rsp + 0x28], 4
lea r8, [0x140009760]
xor r9d, r9d
mov dword [rsp + 0x20], 0x40
mov edx, 0x522
xor ecx, ecx
call fcn.140004f2c
cmp eax, 6
jne 0x140002ea5
cmp word [0x14000de78], si
jne 0x140002ea0
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.USER32.dll_ExitWindowsEx]
nop dword [rax + rax]
jmp 0x140002ea5
call fcn.140001bf4
mov rcx, qword [0x14000c830]
test rcx, rcx
je 0x140002ebd
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
mov eax, dword [0x14000d544]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x140003214
Capabilities:
Get common file path
Set current directory

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x260
mov rax, qword [0x14000c008]
xor rax, rsp
mov qword [rsp + 0x250], rax
xor edi, edi
cmp word [0x14000cd18], di
jne 0x140003269
cmp dword [0x14000cd04], edi
jne 0x14000325c
call fcn.140006294
test eax, eax
je 0x140003368
cmp word [0x14000cd18], di
jne 0x140003269
call fcn.140004064
test eax, eax
je 0x140003368
call fcn.1400061d4
test eax, eax
je 0x140003368
call fcn.1400068f0
test eax, eax
je 0x140003368
mov ebx, 0x105
lea rcx, [rsp + 0x30]
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
nop dword [rax + rax]
lea r8, str.advapi32.dll
mov edx, ebx
lea rcx, [rsp + 0x30]
call fcn.140007e08
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
je 0x1400032fb
lea rdx, str.DecryptFileA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
nop dword [rax + rax]
test rax, rax
je 0x1400032fb
movabs r10, 0xd1e917fd76db3a70
xor edx, edx
lea rcx, [0x14000d610]
call qword [vtable.H_MA8HI.0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop dword [rax + rax]
cmp dword [0x14000cd04], edi
jne 0x1400033a5
cmp dword [0x14000de60], edi
jne 0x1400033a5
mov edx, 0x104
lea rcx, [rsp + 0x140]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
nop dword [rax + rax]
test eax, eax
jne 0x14000338c
mov edx, 0x4f0
xor r9d, r9d
mov dword [rsp + 0x28], edi
xor r8d, r8d
mov dword [rsp + 0x20], FDIDestroy
xor ecx, ecx
call fcn.140004f2c
call fcn.140007958
mov dword [0x14000d544], eax
xor eax, eax
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1400086f0
mov rbx, qword [rsp + 0x270]
add rsp, 0x260
pop rdi
ret
mov edx, 2
lea rcx, [rsp + 0x140]
mov r8d, edx
call fcn.140006f14
test eax, eax
je 0x140003368
lea rcx, [0x14000d610]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
nop dword [rax + rax]
test eax, eax
jne 0x1400033c3
mov edx, 0x4bc
jmp 0x140003344
cmp dword [0x14000cd0c], edi
jne 0x14000345f
lea rax, [0x14000d040]
mov ecx, 0x28
mov dword [rax], 1
lea rax, [rax + 0x20]
sub rcx, 1
jne 0x1400033db
test byte [0x14000cd18], 1
jne 0x14000342d
test byte [0x14000de64], 1
jne 0x14000342d
mov eax, dword [0x14000c1ac]
lea r9, [0x140003a50]
neg eax
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
sbb rdx, rdx
xor r8d, r8d
add rdx, 0x7d5
call fcn.140007d28
test rax, rax
jmp 0x140003434
call fcn.140005f80
test eax, eax
jne 0x140003445
mov dword [0x14000d544], 0x8007042b
jmp 0x140003368
lea rcx, [0x140007b10]
call fcn.140007984
test eax, eax
je 0x140003368
mov dword [0x14000d544], edi
mov eax, dword [0x14000d028]
test al, 0x40
jne 0x14000347b
test al, al
js 0x14000347b
movzx ecx, word [0x14000de78]
call fcn.1400023c0
jmp 0x14000347d
mov eax, edi
mov dword [0x14000de7c], eax
mov eax, dword [0x14000cd04]
test eax, eax
jne 0x1400034a8
cmp dword [0x14000de60], edi
jne 0x1400034a8
call fcn.1400041b4
test eax, eax
je 0x140003368
mov eax, dword [0x14000cd04]
cmp word [0x14000cd18], di
jne 0x1400034ba
test eax, eax
jne 0x1400034ba
call fcn.140004a54
mov eax, 1
jmp 0x14000336a
Function at 0x140004838
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x180]
sub rsp, 0x280
mov rax, qword [0x14000c008]
xor rax, rsp
mov qword [rbp + 0x170], rax
mov rbx, rcx
mov esi, 1
test rcx, rcx
jne 0x140004874
xor eax, eax
jmp 0x140004a28
xor eax, eax
xorps xmm0, xmm0
mov qword [rsp + 0x68], rax
xor r9d, r9d
lea rax, [rsp + 0x58]
xor r8d, r8d
mov qword [rsp + 0x48], rax
xor ecx, ecx
mov qword [rsp + 0x40], rdx
mov rdx, rbx
and qword [rsp + 0x38], 0
and qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x20
and dword [rsp + 0x20], 0
movups xmmword [rsp + 0x58], xmm0
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
nop dword [rax + rax]
test eax, eax
je 0x1400049bb
mov rcx, qword [rsp + 0x58]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x58]
lea rdx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
nop dword [rax + rax]
cmp dword [0x14000cd08], 0
mov edi, dword [rsp + 0x50]
jne 0x140004926
mov ecx, dword [0x14000de5c]
test sil, cl
je 0x140004926
test cl, 2
jne 0x140004926
mov eax, edi
and eax, 0xff000000
cmp eax, 0xaa000000
cmove ecx, edi
mov dword [0x14000de5c], ecx
test dword [0x14000de64], 0x800
je 0x14000493a
mov dword [0x14000d544], edi
jmp 0x140004984
cmp dword [0x14000d540], 0
jne 0x14000497a
movzx ecx, word [0x14000de78]
mov ebx, dword [0x14000de7c]
call fcn.1400023c0
cmp ebx, eax
jne 0x14000497a
mov eax, edi
and eax, 0xff000000
cmp eax, 0xaa000000
jne 0x14000496c
test sil, dil
jne 0x14000497a
test dword [0x14000de64], 0x200
je 0x140004984
jmp 0x140004932
mov dword [0x14000d544], 0xbc2
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
test dword [0x14000de64], 0x400
je 0x140004a26
cmp dword [rsp + 0x50], 0
jge 0x140004a26
jmp 0x140004a24
call fcn.140007958
mov dword [0x14000d544], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
and qword [rsp + 0x30], 0
xor r9d, r9d
mov r8d, eax
mov dword [rsp + 0x28], 0x200
lea rax, [rsp + 0x70]
xor edx, edx
mov ecx, 0x1000
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
nop dword [rax + rax]
and dword [rsp + 0x28], 0
lea r9, [rsp + 0x70]
mov r8, rbx
mov dword [rsp + 0x20], FDIDestroy
mov edx, 0x4c4
xor ecx, ecx
call fcn.140004f2c
xor esi, esi
mov eax, esi
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.1400086f0
mov rbx, qword [rsp + 0x2b0]
add rsp, 0x280
pop rdi
pop rsi
pop rbp
ret
Function at 0x140004b70
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x20], rsi
mov qword [rax + 0x18], r8
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
mov r15, rcx
lea rcx, str.SHELL32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
nop dword [rax + rax]
xor ebx, ebx
mov rsi, rax
test rax, rax
je 0x140004d7f
lea rdx, str.SHBrowseForFolder
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
nop dword [rax + rax]
mov r12, rax
test rax, rax
je 0x140004d69
mov edx, 0xc3
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
nop dword [rax + rax]
mov qword [rsp + 0xb0], rax
test rax, rax
je 0x140004d69
lea rdx, str.SHGetPathFromIDList
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
nop dword [rax + rax]
mov r13, rax
test rax, rax
je 0x140004d69
cmp byte [0x14000cba0], bl
lea rdi, [0x14000cba0]
mov ebp, 0x104
jne 0x140004c82
mov rdx, rdi
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
nop dword [rax + rax]
or rdx, 0xffffffffffffffff
inc rdx
cmp byte [rdi + rdx], bl
jne 0x140004c46
add rdx, rdi
mov rcx, rdi
call qword [sym.imp.USER32.dll_CharPrevA]
nop dword [rax + rax]
mov r14, rax
cmp byte [rax], 0x5c
jne 0x140004c82
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.USER32.dll_CharPrevA]
nop dword [rax + rax]
cmp byte [rax], 0x3a
je 0x140004c82
mov byte [r14], bl
lea rax, [0x14000c850]
mov byte [0x14000ca60], bl
mov qword [rsp + 0x48], rax
lea rax, [0x140004b40]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rbx
mov dword [rsp + 0x50], 1
mov qword [rsp + 0x60], rdi
movabs r10, 0xf8943f41765bb270
lea rcx, [rsp + 0x30]
mov rax, r12
call qword [vtable.H_MA8HI.0]
mov r14, rax
test rax, rax
je 0x140004d4d
movabs r10, 0xa6d536591253a870
mov rcx, rax
mov rdx, rdi
mov rax, r13
call qword [vtable.H_MA8HI.0]
cmp byte [0x14000cba0], bl
je 0x140004d32
lea rcx, [0x14000ca60]
sub rdi, rcx
lea rax, [rbp + 0x7ffffefa]
test rax, rax
je 0x140004d25
mov al, byte [rdi + rcx]
test al, al
je 0x140004d25
mov byte [rcx], al
inc rcx
sub rbp, 1
jne 0x140004d07
test rbp, rbp
lea rax, [rcx - 1]
cmovne rax, rcx
mov byte [rax], bl
movabs r10, 0xce709ee7125b9070
mov rax, qword [rsp + 0xb0]
mov rcx, r14
call qword [vtable.H_MA8HI.0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop dword [rax + rax]
cmp byte [0x14000ca60], bl
setne bl
mov eax, ebx
jmp 0x140004da0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop dword [rax + rax]
mov edx, 0x4c1
jmp 0x140004d84
mov edx, 0x4c2
mov dword [rsp + 0x28], ebx
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], FDIDestroy
mov rcx, r15
call fcn.140004f2c
xor eax, eax
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1400051f8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rsi, rdx
mov ebp, r8d
mov rdx, rcx
mov rdi, rcx
xor ecx, ecx
mov r8d, 0xa
call qword [sym.imp.KERNEL32.dll_FindResourceA]
nop dword [rax + rax]
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
nop dword [rax + rax]
mov ebx, eax
cmp eax, ebp
ja 0x1400052b1
test rsi, rsi
je 0x1400052b1
test eax, eax
je 0x1400052c9
mov r8d, 0xa
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
nop dword [rax + rax]
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
nop dword [rax + rax]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
je 0x1400052c9
mov r9d, ebx
mov edx, ebp
mov r8, rax
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_memcpy_s]
nop dword [rax + rax]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeResource]
nop dword [rax + rax]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
xor eax, eax
jmp 0x1400052b3

Function at 0x1400053b8
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
nop dword [rax + rax]
cmp eax, 0xffffffff
je 0x14000545f
shr eax, 4
not eax
and eax, 1
je 0x14000545f
xor ebx, ebx
cmp dword [0x14000d600], ebx
jne 0x140005442
test byte [0x14000cd18], 1
jne 0x140005442
mov r8, qword [0x14000c828]
lea r9, [0x140003980]
mov qword [rsp + 0x28], 6
mov edx, 0x7d3
mov qword [rsp + 0x20], rbx
mov qword [0x14000d830], rdi
call fcn.140007d28
sub rax, 6
je 0x140005442
sub rax, 1
je 0x14000545b
cmp rax, 0x832
jne 0x140005442
mov dword [0x14000d600], 1
mov edx, 0x80
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
nop dword [rax + rax]
mov ebx, 1
mov eax, ebx
jmp 0x140005464
mov eax, 1
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x1400055c0
Capabilities:
Create directory

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r13
push r14
push r15
sub rsp, 0x40
xor r14d, r14d
lea r13, [0x14000d040]
mov ebx, edx
mov rsi, rcx
mov rax, r13
lea edi, [r14 + 1]
cmp dword [rax], edi
je 0x14000560a
add r14d, edi
lea rcx, [0x14000d540]
add rax, 0x20
cmp rax, rcx
jl 0x1400055f3
cmp r14d, 0x28
jne 0x14000563d
and dword [rsp + 0x28], 0
xor r9d, r9d
mov rcx, qword [0x14000c828]
xor r8d, r8d
mov edx, 0x4bb
mov dword [rsp + 0x20], FDIDestroy
call fcn.140004f2c
or rax, 0xffffffffffffffff
jmp 0x1400057f6
lea rdx, str.MEMCAB
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
nop dword [rax + rax]
test eax, eax
jne 0x140005694
test ebx, 0x10b
jne 0x140005634
movsxd rdx, r14d
mov rcx, rdx
shl rcx, 5
and dword [rcx + r13], eax
mov rax, qword [0x14000d560]
and dword [rcx + r13 + 0x10], 0
mov qword [rcx + r13 + 8], rax
mov eax, dword [0x14000d568]
mov dword [rcx + r13 + 0x14], eax
mov dword [rcx + r13 + 4], edi
jmp 0x1400057f3
test bl, 8
je 0x1400056a2
or rcx, 0xffffffffffffffff
jmp 0x1400057cd
mov eax, ebx
and al, 3
neg al
sbb ebp, ebp
and ebp, 0xc0000000
add ebp, 0x80000000
bt ebx, 8
jae 0x1400056d8
bt ebx, 0xa
jae 0x1400056c6
mov ebx, edi
jmp 0x1400056e8
and ebx, 0x200
neg ebx
sbb ebx, ebx
and ebx, 0xfffffffe
add ebx, 4
jmp 0x1400056e8
and ebx, 0x200
neg ebx
sbb ebx, ebx
and ebx, 2
add ebx, 3
and qword [rsp + 0x30], 0
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
xor r8d, r8d
mov edx, ebp
mov dword [rsp + 0x20], ebx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateFileA]
nop dword [rax + rax]
mov rcx, rax
cmp rax, 0xffffffffffffffff
jne 0x1400057cd
cmp ebx, 3
je 0x1400057cd
cmp byte [rsi], 0
je 0x1400057a1
mov al, byte [rsi + 1]
lea rdi, [rsi + 2]
xor r15d, r15d
cmp al, 0x3a
jne 0x140005745
cmp byte [rdi], 0x5c
jne 0x140005745
lea rdi, [rsi + 3]
jmp 0x140005754
cmp byte [rsi], 0x5c
jne 0x140005758
cmp al, 0x5c
jne 0x140005758
mov r15d, 2
mov al, byte [rdi]
jmp 0x14000579d
lea rdi, [rsi + 1]
jmp 0x14000579d
cmp al, 0x5c
jne 0x140005789
cmp byte [rdi - 1], 0x3a
je 0x140005789
test r15d, r15d
je 0x140005772
dec r15d
jmp 0x140005789
xor edx, edx
mov byte [rdi], 0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
nop dword [rax + rax]
mov byte [rdi], 0x5c
mov rcx, rdi
call qword [sym.imp.USER32.dll_CharNextA]
nop dword [rax + rax]
mov rdi, rax
mov al, byte [rax]
test al, al
jne 0x14000575e
and qword [rsp + 0x30], 0
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
xor r8d, r8d
mov edx, ebp
mov dword [rsp + 0x20], ebx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateFileA]
nop dword [rax + rax]
mov rcx, rax
movsxd rdx, r14d
mov rax, rdx
shl rax, 5
mov qword [rax + r13 + 0x18], rcx
cmp rcx, 0xffffffffffffffff
je 0x1400057ef
and dword [rax + r13], 0
and dword [rax + r13 + 4], 0
jmp 0x1400057f3
or rdx, 0xffffffffffffffff
mov rax, rdx
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r13
ret