joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001d600
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x260
mov rax, qword gs:[0x58]
mov rdi, rcx
mov edx, dword [0x1400b4c0c]
mov ecx, 4
mov qword [rsp + 0x290], r15
mov rdx, qword [rax + rdx*8]
mov eax, dword [rcx + rdx]
cmp dword [0x1400b29b8], eax
jg 0x14001d882
xor r15d, r15d
lea rsi, [0x1400b0100]
cmp qword [0x1400b0110], r15
jne 0x14001d7f0
lea rdx, [rsp + 0x50]
mov ecx, 0x105
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
movdqa xmm0, xmmword [0x1400849a0]
lea rax, [rsp + 0x50]
mov rbx, 0xffffffffffffffff
mov word [rsp + 0x30], r15w
movdqu xmmword [rsp + 0x40], xmm0
mov r8, rbx
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], r15w
jne 0x14001d690
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x30]
call fcn.140029ac0
mov rcx, rsi
call fcn.140010ed0
movups xmm0, xmmword [rsp + 0x30]
lea rcx, str.Shell32.dll
movups xmm1, xmmword [rsp + 0x40]
movups xmmword [0x1400b0100], xmm0
movups xmmword [0x1400b0110], xmm1
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbp, rax
test rax, rax
je 0x14001d7f0
lea rdx, str.SHGetKnownFolderPath
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14001d764
lea r9, [rsp + 0x288]
mov qword [rsp + 0x288], r15
xor r8d, r8d
lea rcx, [0x14008b688]
xor edx, edx
call rax
mov rcx, qword [rsp + 0x288]
test eax, eax
js 0x14001d750
cmp word [rcx], r15w
je 0x14001d750
nop word [rax + rax]
inc rbx
cmp word [rcx + rbx*2], r15w
jne 0x14001d730
mov rdx, rcx
mov r8, rbx
mov rcx, rsi
call fcn.140029ac0
mov rcx, qword [rsp + 0x288]
test rcx, rcx
je 0x14001d7e7
call qword [sym.imp.ole32.dll_CoTaskMemFree]
jmp 0x14001d7e7
lea rdx, str.SHGetFolderPathW
mov qword [rsp + 0x280], r14
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
je 0x14001d7df
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x20a
call fcn.1400443c0
xor r9d, r9d
lea rax, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor ecx, ecx
lea edx, [r9 + 0x1a]
call r14
test eax, eax
js 0x14001d7df
cmp eax, 1
je 0x14001d7df
cmp word [rsp + 0x50], r15w
je 0x14001d7df
lea rax, [rsp + 0x50]
inc rbx
cmp word [rax + rbx*2], r15w
jne 0x14001d7c5
mov r8, rbx
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.140029ac0
mov r14, qword [rsp + 0x280]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [rdi + 0x10], r15
mov qword [rdi + 0x18], r15
cmp qword [0x1400b0118], 8
mov rbp, qword [0x1400b0110]
cmovae rsi, qword [0x1400b0100]
mov r15, qword [rsp + 0x290]
cmp rbp, 8
jae 0x14001d82a
movups xmm0, xmmword [rsi]
mov ebx, 7
movups xmmword [rdi], xmm0
jmp 0x14001d864
movabs rax, 0x7ffffffffffffffe
mov rbx, rbp
or rbx, 7
mov rcx, rdi
cmp rbx, rax
cmova rbx, rax
lea rdx, [rbx + 1]
call fcn.140010f40
lea r8, [rbp*2 + 2]
mov qword [rdi], rax
mov rdx, rsi
mov rcx, rax
call fcn.1400438a0
mov qword [rdi + 0x10], rbp
mov rax, rdi
mov qword [rdi + 0x18], rbx
mov rbx, qword [rsp + 0x298]
add rsp, 0x260
pop rdi
pop rsi
pop rbp
ret
lea rcx, [0x1400b29b8]
int3
Function at 0x14001f410
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov rsi, rcx
mov rdi, rdx
mov rcx, rdx
mov r14, r8
mov rdx, qword [rdx + 0x18]
cmp rdx, 8
jb 0x14001f441
mov rcx, qword [rcx]
mov rax, qword [rdi + 0x10]
mov r8, rdi
lea rax, [rcx + rax*2]
jb 0x14001f451
mov r8, qword [rdi]
xor r15d, r15d
mov r9, rax
sub r9, r8
mov ecx, r15d
inc r9
shr r9, 1
cmp r8, rax
lea eax, [r15 + 0x5c]
cmova r9, r15
test r9, r9
je 0x14001f48e
cmp word [r8], 0x2f
jne 0x14001f47e
mov word [r8], ax
add r8, 2
inc rcx
cmp rcx, r9
jne 0x14001f473
mov rdx, qword [rdi + 0x18]
mov rbp, rdi
cmp rdx, 8
jb 0x14001f49a
mov rbp, qword [rdi]
mov edx, eax
mov rcx, rbp
call fcn.1400448f0
mov rbx, rax
test rax, rax
je 0x14001f4b2
add rbx, 2
jmp 0x14001f4b5
mov rbx, rbp
mov rdx, qword [r14 + 0x10]
lea rcx, [rsp + 0x20]
movdqa xmm0, xmmword [0x1400849a0]
inc rdx
movdqu xmmword [rsp + 0x30], xmm0
mov word [rsp + 0x20], r15w
call fcn.140011160
cmp qword [r14 + 0x18], 8
mov r8, qword [r14 + 0x10]
jb 0x14001f4e8
mov r14, qword [r14]
mov rdx, r14
lea rcx, [rsp + 0x20]
call fcn.140029940
mov r8d, 1
lea rdx, [0x140084a44]
lea rcx, [rsp + 0x20]
call fcn.140029940
mov r8, 0xffffffffffffffff
inc r8
cmp word [rbx + r8*2], r15w
jne 0x14001f513
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.140029940
mov qword [rsi + 0x10], r15
mov qword [rsi + 0x18], r15
movups xmm0, xmmword [rax]
movups xmmword [rsi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsi + 0x10], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 7
mov word [rax], r15w
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x14001f58e
mov rcx, qword [rsp + 0x20]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001f589
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001f5d6
call fcn.14003f840
cmp qword [rsi + 0x18], 8
mov rcx, rsi
jb 0x14001f59b
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14001f5b2
test al, 0x10
jne 0x14001f5b2
mov rcx, rsi
call fcn.14001f5e0
mov rcx, rdi
call fcn.140010ed0
mov rbx, qword [rsp + 0x60]
mov rax, rsi
mov rsi, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x68]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
int3
Function at 0x140020040
Capabilities:
Get file size
Read file on windows

Disassembly:
push rbx
push rdi
sub rsp, 0x48
mov rdi, rdx
mov qword [rsp + 0x40], r14
xor r14d, r14d
xor r9d, r9d
mov qword [rsp + 0x30], r14
xor r8d, r8d
mov dword [rsp + 0x28], 0x80
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
inc rax
test rax, 0xfffffffffffffffe
jne 0x14002008e
xor dil, dil
jmp 0x140020118
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x60], rbp
mov rcx, rbx
mov dword [rsp + 0x70], r14d
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebp, eax
cmp dword [rsp + 0x70], r14d
je 0x1400200b4
xor dil, dil
jmp 0x140020113
mov qword [rsp + 0x68], rsi
mov r8, rdi
mov rsi, qword [rdi + 8]
mov rcx, rdi
sub rsi, qword [rdi]
lea rdx, [rsi + rbp]
call fcn.1400188f0
mov rdx, qword [rdi]
lea r9, [rsp + 0x78]
add rdx, rsi
mov dword [rsp + 0x78], r14d
mov r8d, ebp
mov qword [rsp + 0x20], r14
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x14002010b
mov edx, dword [rsp + 0x78]
mov r8, rdi
add rdx, rsi
mov rcx, rdi
call fcn.1400188f0
xor dil, dil
jmp 0x14002010e
mov dil, 1
mov rsi, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x60]
mov r14, qword [rsp + 0x40]
lea rcx, [rbx - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x140020130
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, dil
add rsp, 0x48
pop rdi
pop rbx
ret
Function at 0x140029ef0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rax, 0xcbf29ce484222325
mov r9d, 0
sub r8, rdx
je 0x140029f24
movabs r10, 0x100000001b3
nop
movzx ecx, byte [r9 + rdx]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x140029f10
ret

Function at 0x140029f30
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub r8, rdx
movabs rax, 0xcbf29ce484222325
sar r8, 1
mov r9d, 0
add r8, r8
je 0x140029f74
movabs r10, 0x100000001b3
nop word [rax + rax]
movzx ecx, byte [r9 + rdx]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x140029f60
ret
Function at 0x14002d2b0
Capabilities:
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 8], rcx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x60
mov qword [rax - 0x50], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov rdi, r9
mov rsi, r8
mov r12, rdx
mov r14, rcx
mov r9, qword [r8 + 0x10]
cmp qword [r8 + 0x18], 0x10
jb 0x14002d2ed
mov r8, qword [r8]
movabs rdx, 0xcbf29ce484222325
mov qword [rsp + 0x20], rdx
xor ecx, ecx
movabs r10, 0x100000001b3
mov qword [rsp + 0x28], rcx
cmp rcx, r9
jae 0x14002d32d
movzx eax, byte [rcx + r8]
xor rdx, rax
mov qword [rsp + 0x20], rdx
imul rdx, r10
mov qword [rsp + 0x20], rdx
inc rcx
jmp 0x14002d308
mov r15, qword [r14 + 0x30]
and r15, rdx
mov qword [rsp + 0x40], r15
shl r15, 4
mov rcx, qword [r14 + 0x18]
mov rax, qword [r14 + 8]
mov qword [rsp + 0x48], rax
cmp qword [rcx + r15], rax
jne 0x14002d356
mov rbx, qword [r14 + 8]
jmp 0x14002d367
mov rax, qword [r14 + 0x18]
mov rbx, qword [rax + r15 + 8]
mov rbx, qword [rbx]
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x30], rbx
nop dword [rax]
mov rax, qword [r14 + 0x18]
cmp rbx, qword [r15 + rax]
je 0x14002d407
mov rbx, qword [rbx + 8]
mov qword [rsp + 0x30], rbx
lea rdx, [rbx + 0x10]
mov rax, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x14002d399
mov rdx, qword [rdx]
mov r8, qword [rsi + 0x10]
mov rcx, rsi
cmp qword [rsi + 0x18], 0x10
jb 0x14002d3aa
mov rcx, qword [rsi]
cmp r8, rax
jne 0x14002d402
call fcn.140044560
test eax, eax
jne 0x14002d402
mov rcx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rax], rcx
mov rcx, qword [rdi + 8]
mov rax, qword [rdi]
mov qword [rax + 8], rcx
dec qword [r14 + 0x10]
lea rcx, [rdi + 0x10]
call fcn.14001a4d0
mov qword [rsp + 0x58], 0x50
mov edx, 0x50
mov rcx, rdi
call fcn.14003f840
mov qword [r12], rbx
mov byte [r12 + 8], 0
mov rax, r12
jmp 0x14002d49c
jmp 0x14002d370
mov rax, qword [rdi]
cmp rbx, rax
je 0x14002d43c
mov rcx, qword [rdi + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rbx
mov rcx, qword [rbx + 8]
mov qword [rcx], rdi
mov rdx, qword [rbx + 8]
mov rcx, qword [rax + 8]
mov qword [rbx + 8], rcx
mov rcx, qword [rdi + 8]
mov qword [rax + 8], rcx
mov qword [rdi + 8], rdx
mov rdx, qword [r14 + 0x18]
add rdx, r15
mov rax, qword [rdx]
cmp rax, qword [r14 + 8]
jne 0x14002d45a
mov qword [rdx], rdi
mov rax, qword [r14 + 0x18]
mov qword [rax + r15 + 8], rdi
jmp 0x14002d486
cmp rax, rbx
jne 0x14002d464
mov qword [rdx], rdi
jmp 0x14002d486
mov rax, qword [rdx + 8]
mov rcx, qword [rax]
mov qword [rdx + 8], rcx
cmp rcx, rdi
je 0x14002d486
mov rdx, qword [r14 + 0x18]
mov rax, qword [rdx + r15 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r15 + 8], rcx
mov rcx, r14
int3
mov rbx, qword [rsp + 0x98]
add rsp, 0x60
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x14002de40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov qword [rax - 0x40], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov r12, r9
movzx r15d, r8b
mov r13, rdx
mov r14, rcx
mov rsi, qword [rcx]
mov rbx, qword [rsi + 8]
mov dil, 1
nop dword [rax + rax]
cmp byte [rbx + 0x19], 0
jne 0x14002dec5
mov rsi, rbx
mov rcx, r14
test r15b, r15b
je 0x14002dea6
lea rdx, [rbx + 0x20]
mov r8, r12
call fcn.14001af40
movzx edi, al
xor dil, 1
jmp 0x14002deb5
lea r8, [rbx + 0x20]
mov rdx, r12
call fcn.14001af40
movzx edi, al
test dil, dil
je 0x14002debf
mov rbx, qword [rbx]
jmp 0x14002dec3
mov rbx, qword [rbx + 0x10]
jmp 0x14002de80
mov rbx, rsi
mov qword [rsp + 0x30], rbx
test dil, dil
je 0x14002df26
mov rax, qword [r14]
cmp rsi, qword [rax]
jne 0x14002df13
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
mov r9, rsi
mov r8b, 1
lea rdx, [rsp + 0x40]
mov rcx, r14
call fcn.14002d4c0
mov rcx, qword [rax]
mov qword [r13], rcx
mov byte [r13 + 8], 1
mov rax, r13
jmp 0x14002dfa3
cmp byte [rsi + 0x19], 0
je 0x14002dfbd
mov rbx, qword [rsi + 0x10]
mov qword [rsp + 0x30], rbx
lea rdx, [rbx + 0x20]
mov r8, r12
mov rcx, r14
call fcn.14001af40
test al, al
je 0x14002df70
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
mov r9, rsi
movzx r8d, dil
lea rdx, [rsp + 0x40]
mov rcx, r14
call fcn.14002d4c0
mov rcx, qword [rax]
mov qword [r13], rcx
mov byte [r13 + 8], 1
mov rax, r13
jmp 0x14002dfa3
mov rdi, qword [rsp + 0xa0]
lea rcx, [rdi + 0x20]
call fcn.14001a4d0
mov qword [rsp + 0x48], 0x60
mov edx, 0x60
mov rcx, rdi
call fcn.14003f840
mov qword [r13], rbx
mov byte [r13 + 8], 0
mov rax, r13
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov rax, qword [rsi]
cmp byte [rax + 0x19], 0
je 0x14002dff6
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x14002dfdf
cmp rbx, qword [rax]
jne 0x14002dfdf
mov rbx, rax
mov qword [rsp + 0x30], rax
jmp 0x14002dfc6
cmp byte [rbx + 0x19], 0
jne 0x14002df26
mov rbx, rax
mov qword [rsp + 0x30], rax
jmp 0x14002df26
mov rbx, rax
nop dword [rax]
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
jne 0x14002df21
mov rbx, rax
jmp 0x14002e000
Function at 0x14002e980
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push r12
push r14
sub rsp, 0x50
mov r11, qword [r8 + 0x18]
mov rsi, r8
mov qword [rsp + 0x40], r13
mov r12, rcx
mov qword [rsp + 0x38], r15
mov r10, r8
mov r15, qword [r8 + 0x10]
cmp r11, 0x10
jb 0x14002e9b9
mov r10, qword [r8]
xor r8d, r8d
movabs r9, 0xcbf29ce484222325
test r15, r15
je 0x14002e9f4
movabs rcx, 0x100000001b3
nop word [rax + rax]
movzx eax, byte [r8 + r10]
inc r8
xor r9, rax
imul r9, rcx
cmp r8, r15
jb 0x14002e9e0
mov rax, qword [r12 + 0x18]
mov rcx, qword [r12 + 0x30]
mov r14, qword [r12 + 8]
and rcx, r9
shl rcx, 4
mov qword [rsp + 0x48], rdi
mov r13, qword [rcx + rax]
add rax, 8
add rax, rcx
mov rbx, r13
mov qword [rsp + 0x90], rax
cmp r13, r14
jne 0x14002ea2f
mov rax, r14
jmp 0x14002ea35
mov rax, qword [rax]
mov rax, qword [rax]
cmp rbx, rax
je 0x14002eaaa
lea rdi, [rbx + 0x10]
mov rdx, rsi
cmp r11, 0x10
jb 0x14002ea4a
mov rdx, qword [rsi]
mov r12, qword [rdi + 0x18]
mov rcx, rdi
mov rbp, qword [rdi + 0x10]
cmp r12, 0x10
jb 0x14002ea5e
mov rcx, qword [rdi]
cmp rbp, r15
jne 0x14002ea73
mov r8, rbp
call fcn.140044560
test eax, eax
je 0x14002ea80
mov r11, qword [rsi + 0x18]
mov rbx, qword [rbx]
mov rax, qword [rsp + 0x90]
jmp 0x14002ea25
cmp r12, 0x10
jb 0x14002ea89
mov rdi, qword [rdi]
cmp qword [rsi + 0x18], 0x10
mov rcx, rsi
jb 0x14002ea96
mov rcx, qword [rsi]
cmp r15, rbp
jne 0x14002eaaa
mov r8, r15
mov rdx, rdi
call fcn.140044560
test eax, eax
je 0x14002eaad
mov rbx, r14
mov r15, qword [rsp + 0x38]
mov r13, qword [rsp + 0x40]
cmp rbx, r14
jne 0x14002eb67
mov r12, qword [rsp + 0x80]
lea rax, [rsp + 0x90]
mov qword [rsp + 0x98], rsi
lea r9, [0x1400847b8]
mov rbx, qword [r14]
mov qword [rsp + 0x28], rax
mov rdx, rbx
lea rax, [rsp + 0x98]
lea rcx, [r12 + 8]
mov qword [rsp + 0x20], rax
mov rdi, qword [rbx + 8]
mov r8, rdi
call fcn.14002c5d0
mov rdx, rax
movabs rcx, 0x333333333333332
mov rax, qword [r12 + 0x10]
sub rcx, rax
cmp rcx, 1
jb 0x14002eb8b
inc rax
mov rcx, r12
mov qword [r12 + 0x10], rax
mov qword [rbx + 8], rdx
mov qword [rdi], rdx
mov r9, qword [r12 + 8]
mov rdx, qword [rsp + 0x88]
mov r9, qword [r9]
lea r8, [r9 + 0x10]
call fcn.14002d2b0
mov rax, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x48]
add rsp, 0x50
pop r14
pop r12
pop rsi
pop rbp
pop rbx
ret
mov rbp, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x48]
mov rax, rbp
mov qword [rbp], rbx
mov byte [rbp + 8], 0
add rsp, 0x50
pop r14
pop r12
pop rsi
pop rbp
pop rbx
ret
lea rcx, str.list_T__too_long
int3
Function at 0x14002ecb0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push r15
sub rsp, 0x20
cmp qword [r8 + 0x28], 0x10
lea r10, [r8 + 0x10]
mov r11, qword [r8 + 0x20]
mov rdi, r8
mov r15, rdx
mov rsi, rcx
jb 0x14002ece6
mov r10, qword [r8 + 0x10]
xor r8d, r8d
movabs r9, 0xcbf29ce484222325
test r11, r11
je 0x14002ed24
movabs rcx, 0x100000001b3
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r8 + r10]
inc r8
xor r9, rax
imul r9, rcx
cmp r8, r11
jb 0x14002ed10
mov rdx, qword [rsi + 0x30]
mov rcx, qword [rsi + 0x18]
and rdx, r9
shl rdx, 4
add rcx, rdx
mov rax, qword [rcx]
cmp qword [rcx + 8], rdi
jne 0x14002ed64
cmp rax, rdi
jne 0x14002ed5a
mov rax, qword [rsi + 8]
mov qword [rcx], rax
mov rcx, qword [rsi + 0x18]
mov rax, qword [rsi + 8]
mov qword [rdx + rcx + 8], rax
jmp 0x14002ed6f
mov rax, qword [rdi + 8]
mov qword [rcx + 8], rax
jmp 0x14002ed6f
cmp rax, rdi
jne 0x14002ed6f
mov rax, qword [rdi]
mov qword [rcx], rax
mov rax, qword [rdi + 8]
lea rcx, [rdi + 0x10]
mov rbx, qword [rdi]
mov qword [rax], rbx
mov rdx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rdx + 8], rax
dec qword [rsi + 0x10]
call fcn.14001a4d0
mov edx, 0x50
mov rcx, rdi
call fcn.14003f840
mov rsi, qword [rsp + 0x38]
mov rax, r15
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
mov qword [r15], rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop r15
ret
Function at 0x140030880
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
sub rsp, 0x460
mov r14, rcx
mov qword [rax + 0x10], rbx
add rcx, 8
movaps xmmword [rax - 0x38], xmm6
call fcn.140010eb0
mov rcx, qword [r14 + 0xa0]
call fcn.140032390
cmp qword [r14 + 0x58], 8
lea rcx, [r14 + 0x40]
movaps xmm6, xmm0
jb 0x1400308bf
mov rcx, qword [rcx]
xor edx, edx
lea r8d, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rbx, rax
test rax, rax
jne 0x1400308e2
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xor ebp, ebp
jmp 0x140030a68
xor ebp, ebp
lea r9, [rsp + 0x480]
lea r8, [0x1400327c0]
mov qword [rsp + 0x480], rbp
mov rcx, rbx
lea edx, [rbp + 0xe]
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
mov rdx, qword [rsp + 0x480]
mov rcx, rbx
test rdx, rdx
jne 0x140030922
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x140030a68
mov r8d, 0xe
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rcx, rbx
test rax, rax
jne 0x140030941
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x140030a68
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x14003095d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x140030a68
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
jne 0x140030979
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x140030a68
mov r9d, 0x100
mov qword [rsp + 0x458], r12
mov r8d, r9d
mov dword [rsp + 0x20], ebp
mov edx, 1
mov rcx, rax
call qword [sym.imp.USER32.dll_LookupIconIdFromDirectoryEx]
movzx edx, ax
mov r8d, 3
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov r12, rax
mov rcx, rbx
test rax, rax
jne 0x1400309c4
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x140030a60
mov rdx, r12
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x1400309e0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x140030a60
mov rcx, rax
mov qword [rsp + 0x450], r15
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r15, rax
mov rcx, rbx
test rax, rax
jne 0x140030a04
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x140030a58
mulss xmm6, dword [0x1400889e4]
mov rdx, r12
mov qword [rsp + 0x490], rsi
cvttss2si esi, xmm6
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [rsp + 0x30], ebp
mov r9d, 0x30000
mov edx, eax
mov dword [rsp + 0x28], esi
mov r8d, 1
mov dword [rsp + 0x20], esi
mov rcx, r15
call qword [sym.imp.USER32.dll_CreateIconFromResourceEx]
mov rcx, rbx
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rsi, qword [rsp + 0x490]
mov r15, qword [rsp + 0x450]
mov r12, qword [rsp + 0x458]
movaps xmm6, xmmword [rsp + 0x440]
lea rax, [r14 + 0x80]
cmp qword [rax + 0x18], 8
mov rbx, qword [rsp + 0x488]
jb 0x140030a89
mov rax, qword [rax]
cmp qword [r14 + 0x78], 8
lea r9, [r14 + 0x60]
jb 0x140030a97
mov r9, qword [r9]
lea r8, str._s____s
mov qword [rsp + 0x20], rax
mov edx, 0x200
lea rcx, [rsp + 0x40]
call fcn.140014c60
mov rcx, qword [r14 + 0xa0]
lea r9, [rsp + 0x40]
mov r8, rbp
mov edx, 0x501
call qword [sym.imp.USER32.dll_SendMessageW]
lea rcx, [r14 + 8]
call fcn.140010ec0
add rsp, 0x460
pop r14
pop rdi
pop rbp
ret
Function at 0x1400312b0
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x80
mov r13, rcx
mov r12, rdx
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov esi, dword [rsp + 0x54]
xor edx, edx
mov eax, 0x40000000
xor edi, edi
div rsi
mov r14d, edi
lea ebp, [rdi + 1]
mov r15, rax
shl r15, 2
test r15, r15
je 0x14003138a
mov qword [rsp + 0xb0], rbx
nop dword [rax]
mov rdx, rdi
lea r8, [rsp + 0x20]
imul rdx, rsi
mov r9d, 0x30
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
xor edx, edx
test rax, rax
je 0x14003136f
mov rax, qword [rsp + 0x38]
test rax, rax
je 0x14003136f
div rsi
cmp dword [rsp + 0x40], 0x1000
mov rbx, rax
jne 0x14003137a
mov r8, qword [rsp + 0x28]
cmp r8, r14
jbe 0x14003137a
mov r9d, ebp
mov rdx, r12
mov rcx, r13
mov r14, r8
call fcn.140030f10
test al, al
je 0x14003137a
inc ebp
jmp 0x14003137a
mov eax, 0x10000
div rsi
mov rbx, rax
add rdi, rbx
cmp rdi, r15
jb 0x140031310
mov rbx, qword [rsp + 0xb0]
lea r11, [rsp + 0x80]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret

Function at 0x1400313b0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, rdx
mov rdi, rcx
lea rdx, [0x1400828d0]
call fcn.1400390e0
lea rdx, str.Context:_r_n
mov rcx, rdi
call fcn.1400390e0
mov rax, qword [rbx + 0x78]
lea rdx, str.RDI:____0x_016llx__RSI:_0x_016llx__RAX:___0x_016llx_r_n
mov r9, qword [rbx + 0xa8]
mov rcx, rdi
mov r8, qword [rbx + 0xb0]
mov qword [rsp + 0x20], rax
call fcn.1400390e0
mov rax, qword [rbx + 0x88]
lea rdx, str.RBX:____0x_016llx__RCX:_0x_016llx__RDX:___0x_016llx_r_n
mov r9, qword [rbx + 0x80]
mov rcx, rdi
mov r8, qword [rbx + 0x90]
mov qword [rsp + 0x20], rax
call fcn.1400390e0
movzx eax, word [rbx + 0x38]
lea rdx, str.RIP:____0x_016llx__RBP:_0x_016llx__SegCs:_0x_016llx_r_n
mov r9, qword [rbx + 0xa0]
mov rcx, rdi
mov r8, qword [rbx + 0xf8]
mov dword [rsp + 0x20], eax
call fcn.1400390e0
movzx eax, word [rbx + 0x42]
lea rdx, str.EFlags:_0x_016llx__RSP:_0x_016llx__SegSs:_0x_016llx_r_n
mov r9, qword [rbx + 0x98]
mov rcx, rdi
mov r8d, dword [rbx + 0x44]
mov dword [rsp + 0x20], eax
call fcn.1400390e0
mov rax, qword [rbx + 0xc8]
lea rdx, str.R8:_____0x_016llx__R9:__0x_016llx__R10:___0x_016llx_r_n
mov r9, qword [rbx + 0xc0]
mov rcx, rdi
mov r8, qword [rbx + 0xb8]
mov qword [rsp + 0x20], rax
call fcn.1400390e0
mov rax, qword [rbx + 0xe0]
lea rdx, str.R11:____0x_016llx__R12:_0x_016llx__R13:___0x_016llx_r_n
mov r9, qword [rbx + 0xd8]
mov rcx, rdi
mov r8, qword [rbx + 0xd0]
mov qword [rsp + 0x20], rax
call fcn.1400390e0
mov r9, qword [rbx + 0xf0]
lea rdx, str.R14:____0x_016llx__R15:_0x_016llx_r_n
mov r8, qword [rbx + 0xe8]
mov rcx, rdi
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp fcn.1400390e0
Function at 0x140033e30
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x30
xor r14d, r14d
mov rsi, r8
mov rdi, rdx
mov rbp, rcx
mov ebx, r14d
test r8, r8
je 0x140033eae
mov r15d, 0xffffffff
nop dword [rax]
nop word [rax + rax]
mov rax, rsi
mov dword [rsp + 0x58], r14d
sub rax, rbx
mov qword [rsp + 0x20], r14
cmp rax, r15
lea r9, [rsp + 0x58]
mov rdx, rdi
mov rcx, rbp
cmova eax, r15d
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140033ec9
mov eax, dword [rsp + 0x58]
add rbx, rax
add rdi, rax
cmp rbx, rsi
jb 0x140033e70
mov al, 1
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
xor al, al
jmp 0x140033eb0