joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100005260
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x80
mov r12, rcx
lea rcx, [0x10000f460]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor ebx, ebx
mov rdi, rax
cmp rax, rbx
je 0x100005401
lea rdx, [0x10000f490]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
cmp rax, rbx
je 0x1000053f1
mov edx, 0xc3
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r15, rax
cmp rax, rbx
je 0x1000053f1
lea rdx, [0x10000f4a8]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r13, rax
cmp rax, rbx
je 0x1000053f1
lea rsi, [0x1000104a0]
mov ebp, 0x104
cmp byte [0x1000104a0], bl
jne 0x100005348
mov rdx, rsi
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov rcx, rsi
movsxd rdx, eax
add rdx, rsi
call qword [sym.imp.USER32.dll_CharPrevA]
mov qword [rsp + 0x30], rax
cmp byte [rax], 0x5c
jne 0x100005348
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.USER32.dll_CharPrevA]
cmp byte [rax], 0x3a
je 0x100005348
mov rax, qword [rsp + 0x30]
mov byte [rax], bl
lea rax, [0x10000ffe0]
lea rcx, [rsp + 0x40]
mov byte [0x10000fcd0], bl
mov qword [rsp + 0x58], rax
lea rax, [0x100005238]
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rbx
mov dword [rsp + 0x60], 1
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rsi
call r14
mov r12, rax
cmp rax, rbx
je 0x1000053db
mov rdx, rsi
mov rcx, rax
call r13
cmp byte [0x1000104a0], bl
je 0x1000053d5
lea rcx, [0x10000fcd0]
sub rsi, rcx
lea rax, [rbp + 0x7ffffefa]
cmp rax, rbx
je 0x1000053cb
mov al, byte [rsi + rcx]
cmp al, bl
je 0x1000053cb
mov byte [rcx], al
inc rcx
sub rbp, 1
jne 0x1000053ad
cmp rbp, rbx
jne 0x1000053d3
dec rcx
mov byte [rcx], bl
mov rcx, r12
call r15
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp byte [0x10000fcd0], bl
setne bl
mov eax, ebx
jmp 0x100005422
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edx, 0x4c1
jmp 0x100005406
mov edx, 0x4c2
xor r9d, r9d
xor r8d, r8d
mov rcx, r12
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 0x10
call fcn.100005574
xor eax, eax
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1000057f4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rsi, rdx
mov ebx, r8d
mov rbp, rcx
mov rdx, rcx
mov r8d, 0xa
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
cmp eax, ebx
ja 0x100005884
test rsi, rsi
je 0x100005884
test eax, eax
jne 0x100005840
xor eax, eax
jmp 0x100005886
mov r8d, 0xa
mov rdx, rbp
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x10000583c
mov r8, rdi
mov rdx, rax
mov rcx, rsi
call sub.msvcrt.dll_memcpy
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, edi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x10000595c
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rdi, rcx
mov ebx, 1
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1000059ef
shr eax, 4
not eax
and eax, ebx
je 0x1000059ef
cmp dword [0x100010660], 0
jne 0x1000059e1
test byte [0x100011418], bl
jne 0x1000059e1
mov r8, qword [0x100010448]
mov rcx, qword [0x100010ee0]
lea r9, [0x1000040ac]
mov edx, 0x7d3
mov qword [rsp + 0x28], 6
and qword [rsp + 0x20], 0
mov qword [0x100010890], rdi
call fcn.100007e70
sub rax, 6
je 0x1000059e1
sub rax, rbx
je 0x1000059fc
cmp rax, 0x832
jne 0x1000059e1
mov dword [0x100010660], ebx
mov edx, 0x80
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
xor ebx, ebx
jmp 0x1000059ef
Function at 0x100005b1c
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x40
lea rdi, [0x100010f00]
mov ebx, edx
mov rsi, rcx
mov rax, rdi
xor r12d, r12d
cmp dword [rax], 1
je 0x100005b5e
lea rcx, [0x100011400]
add rax, 0x20
inc r12d
cmp rax, rcx
jl 0x100005b46
cmp r12d, 0x28
jne 0x100005b91
and dword [rsp + 0x28], 0
mov rcx, qword [0x100010448]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x4bb
mov dword [rsp + 0x20], 0x10
call fcn.100005574
or rax, 0xffffffffffffffff
jmp 0x100005d3f
lea rdx, [0x10000f428]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x100005bef
bt ebx, 8
jb 0x100005b88
test bl, 8
jne 0x100005b88
test bl, 1
jne 0x100005b88
test bl, 2
jne 0x100005b88
movsxd rdx, r12d
mov rcx, rdx
shl rcx, 5
and dword [rcx + rdi], eax
mov rax, qword [0x1000105c0]
and dword [rcx + rdi + 0x10], 0
mov qword [rcx + rdi + 8], rax
mov eax, dword [0x1000105c8]
mov dword [rcx + rdi + 4], 1
mov dword [rcx + rdi + 0x14], eax
jmp 0x100005d3c
test bl, 8
je 0x100005bfd
or rcx, 0xffffffffffffffff
jmp 0x100005d18
test bl, 2
jne 0x100005c0d
mov r13d, 0x80000000
test bl, 1
je 0x100005c13
mov r13d, 0x40000000
bt ebx, 8
jae 0x100005c38
bt ebx, 0xa
jae 0x100005c26
mov ebx, 1
jmp 0x100005c48
and ebx, 0x200
neg ebx
sbb ebx, ebx
and ebx, 0xfffffffe
add ebx, 4
jmp 0x100005c48
and ebx, 0x200
neg ebx
sbb ebx, ebx
and ebx, 2
add ebx, 3
and qword [rsp + 0x30], 0
xor r9d, r9d
xor r8d, r8d
mov edx, r13d
mov rcx, rsi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rcx, rax
cmp rax, 0xffffffffffffffff
jne 0x100005d18
cmp ebx, 3
je 0x100005d18
mov al, byte [rsi]
test al, al
je 0x100005cf1
lea rdi, [rsi + 1]
xor ebp, ebp
cmp byte [rdi], 0x3a
jne 0x100005c9f
cmp byte [rsi + 2], 0x5c
jne 0x100005c9f
lea rdi, [rsi + 3]
jmp 0x100005cb0
cmp al, 0x5c
jne 0x100005cb0
cmp byte [rdi], al
jne 0x100005cb0
lea rdi, [rsi + 2]
mov ebp, 2
cmp byte [rdi], 0
je 0x100005cea
cmp byte [rdi], 0x5c
jne 0x100005cd9
cmp byte [rdi - 1], 0x3a
je 0x100005cd9
test ebp, ebp
je 0x100005cc8
dec ebp
jmp 0x100005cd9
xor edx, edx
mov rcx, rsi
mov byte [rdi], 0
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov byte [rdi], 0x5c
mov rcx, rdi
call qword [sym.imp.USER32.dll_CharNextA]
mov rdi, rax
cmp byte [rax], 0
jne 0x100005cb5
lea rdi, [0x100010f00]
and qword [rsp + 0x30], 0
xor r9d, r9d
xor r8d, r8d
mov edx, r13d
mov rcx, rsi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rcx, rax
movsxd rdx, r12d
mov rax, rdx
shl rax, 5
mov qword [rax + rdi + 0x18], rcx
cmp rcx, 0xffffffffffffffff
je 0x100005d38
and dword [rax + rdi], 0
and dword [rax + rdi + 4], 0
jmp 0x100005d3c
or rdx, 0xffffffffffffffff
mov rax, rdx
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r13
pop r12
pop rdi
ret
Function at 0x100005ff4
Capabilities:
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x150
mov rax, qword [0x10000f100]
xor rax, rsp
mov qword [rsp + 0x140], rax
xor ebp, ebp
mov rdi, rdx
cmp dword [0x10001065c], ebp
je 0x100006041
cmp ecx, 3
jne 0x100006038
mov rcx, qword [rdx + 0x28]
call fcn.100005ec8
or rax, 0xffffffffffffffff
jmp 0x10000620f
cmp ecx, ebp
je 0x100006205
sub ecx, 1
je 0x1000061c2
sub ecx, 1
je 0x100006151
sub ecx, 1
je 0x10000606a
cmp ecx, 1
je 0x100006038
jmp 0x1000061c2
mov rsi, qword [rdx + 8]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenA]
lea rcx, [0x100010670]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_lstrlenA]
lea ecx, [rbx + rax + 1]
cmp ecx, 0x104
jge 0x100006038
lea rdx, [0x100010670]
lea rcx, [rsp + 0x30]
mov r8, rsi
call fcn.1000058a4
cmp eax, ebp
je 0x100006038
mov rbx, qword [rdi + 0x28]
lea rsi, [0x100010f00]
shl rbx, 5
cmp dword [rbx + rsi + 4], 1
je 0x100006038
movzx edx, word [rdi + 0x32]
movzx ecx, word [rdi + 0x30]
lea r8, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_DosDateTimeToFileTime]
cmp eax, ebp
je 0x100006038
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
cmp eax, ebp
je 0x100006038
mov rcx, qword [rbx + rsi + 0x18]
lea r9, [rsp + 0x20]
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_SetFileTime]
cmp eax, ebp
je 0x100006038
mov rcx, qword [rdi + 0x28]
call fcn.100005ec8
cmp word [rdi + 0x34], bp
jne 0x10000612f
mov edx, 0x80
jmp 0x100006136
movzx edx, word [rdi + 0x34]
and edx, 0x27
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
neg eax
sbb rax, rax
and eax, 2
dec rax
jmp 0x10000620f
mov rcx, qword [0x100010448]
cmp rcx, rbp
je 0x10000616c
mov r8, qword [rdx + 8]
mov edx, 0x837
call qword [sym.imp.USER32.dll_SetDlgItemTextA]
mov rdi, qword [rdi + 8]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenA]
lea rcx, [0x100010670]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_lstrlenA]
lea ecx, [rbx + rax + 1]
cmp ecx, 0x104
jge 0x100006038
lea rdx, [0x100010670]
lea rcx, [rsp + 0x30]
mov r8, rdi
call fcn.1000058a4
cmp eax, ebp
je 0x100006038
lea rcx, [rsp + 0x30]
call fcn.10000595c
cmp eax, ebp
jne 0x1000061c6
xor eax, eax
jmp 0x10000620f
lea rcx, [rsp + 0x30]
mov edx, 0x8302
mov r8d, 0x180
call fcn.100005b1c
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x100006038
lea rcx, [rsp + 0x30]
call fcn.100005a08
cmp eax, ebp
je 0x100006038
inc dword [0x100010880]
mov rax, rbx
jmp 0x10000620f
mov rcx, rdx
call fcn.100006240
cdqe
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.10000c9f0
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1000063f8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
lea rcx, [0x1000017f8]
xor r8d, r8d
xor edx, edx
call fcn.1000057f4
lea rdx, [0x1000017f8]
mov r8d, 0xa
xor ecx, ecx
mov dword [0x1000105c8], eax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [0x1000105c0], rax
test rax, rax
je 0x100006580
mov rcx, qword [0x100010448]
test rcx, rcx
je 0x10000649b
mov edx, 0x842
call qword [sym.imp.USER32.dll_GetDlgItem]
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x100010448]
mov edx, 0x841
call qword [sym.imp.USER32.dll_GetDlgItem]
mov edx, 5
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
mov rax, qword [0x1000105c0]
mov rcx, rax
call fcn.100006344
test eax, eax
jne 0x1000064ae
mov edx, 0x4ba
jmp 0x1000064ef
lea rcx, [0x1000105cc]
call fcn.1000083fc
mov rdi, rax
test rax, rax
je 0x1000064e3
lea rcx, [0x1000105c0]
mov rdx, rax
call fcn.10000862c
mov ebx, eax
test eax, eax
je 0x100006510
mov rcx, rdi
call fcn.1000084e8
test eax, eax
jne 0x100006510
mov edx, dword [0x1000105cc]
add edx, 0x514
mov rcx, qword [0x100010448]
and dword [rsp + 0x28], 0
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 0x10
call fcn.100005574
xor ebx, ebx
mov rcx, qword [0x1000105c0]
test rcx, rcx
je 0x10000652a
call qword [sym.imp.KERNEL32.dll_FreeResource]
and qword [0x1000105c0], 0
test ebx, ebx
jne 0x100006554
cmp dword [0x10001065c], ebx
jne 0x100006554
and dword [rsp + 0x28], ebx
xor r9d, r9d
xor r8d, r8d
mov edx, 0x4f8
xor ecx, ecx
mov dword [rsp + 0x20], 0x10
call fcn.100005574
test byte [0x100011418], 1
jne 0x10000657e
test byte [0x100010ec4], 1
jne 0x10000657e
mov rcx, qword [0x100010448]
movsxd r8, ebx
xor r9d, r9d
mov edx, 0xfa1
call qword [sym.imp.USER32.dll_SendMessageA]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x10000677c
Capabilities:
Check if file exists
Create directory
Delete directory
Delete file
Get common file path
Get file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
sub rsp, 0x140
mov rax, qword [0x10000f100]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov rbp, rcx
xor esi, esi
xor ebx, ebx
mov rdi, rdx
mov r12, rcx
sub rbp, rdx
lea r8, [0x100001828]
lea rcx, [rsp + 0x20]
mov r9d, esi
mov edx, 0x104
call fcn.100001ac4
inc esi
mov edx, 0x104
mov rcx, rdi
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x1000067f4
mov al, byte [rcx + rbp]
test al, al
je 0x1000067f4
mov byte [rcx], al
inc rcx
sub rdx, 1
jne 0x1000067d6
test rdx, rdx
jne 0x1000067fc
dec rcx
mov byte [rcx], bl
lea r8, [rsp + 0x20]
mov edx, 0x104
mov rcx, rdi
call fcn.100007fc0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x10000688c
cmp esi, 0x190
jl 0x1000067b3
lea rdx, [0x100001834]
mov r9, rdi
xor r8d, r8d
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
je 0x100006862
mov rcx, rdi
mov ebx, 1
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov eax, ebx
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.10000c9f0
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x10000682f
mov dword [0x100011400], 1
mov ebx, 1
jmp 0x100006862
Function at 0x1000068b4
Capabilities:
Create directory
Delete directory
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x170
mov rax, qword [0x10000f100]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov esi, r8d
mov r9, rcx
mov ebx, 0x104
test edx, edx
je 0x1000069af
lea rdx, [rsp + 0x50]
mov r8d, ebx
call fcn.10000677c
test eax, eax
je 0x100006a37
lea rdi, [0x100010670]
lea r8, [rsp + 0x50]
mov rdx, rbx
mov rcx, rdi
sub r8, rdi
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x100006934
mov al, byte [r8 + rcx]
test al, al
je 0x100006934
mov byte [rcx], al
inc rcx
sub rdx, 1
jne 0x100006915
test rdx, rdx
jne 0x10000693c
dec rcx
mov byte [rcx], 0
test byte [0x100010ec4], 0x20
je 0x10000699c
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx r11d, word [rsp + 0x20]
test r11d, r11d
je 0x10000698b
sub r11d, 1
je 0x100006982
sub r11d, 1
je 0x100006979
cmp r11d, 1
jne 0x10000699c
lea r8, [0x100001850]
jmp 0x100006992
lea r8, [0x100001848]
jmp 0x100006992
lea r8, [0x100001840]
jmp 0x100006992
lea r8, [0x100001838]
mov edx, ebx
mov rcx, rdi
call fcn.100007fc0
lea r8, [0x1000015b9]
mov edx, ebx
mov rcx, rdi
call fcn.100007fc0
jmp 0x1000069e6
lea rdi, [0x100010670]
mov rcx, rdi
sub r9, rdi
lea rax, [rbx + 0x7ffffefa]
test rax, rax
je 0x1000069db
mov al, byte [r9 + rcx]
test al, al
je 0x1000069db
mov byte [rcx], al
inc rcx
sub rbx, 1
jne 0x1000069bc
test rbx, rbx
jne 0x1000069e3
dec rcx
mov byte [rcx], 0
mov rcx, rdi
call fcn.100006f74
test eax, eax
jne 0x100006a0b
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x100006a3b
mov dword [0x100011400], 1
test esi, esi
je 0x100006a48
xor r8d, r8d
mov edx, esi
mov rcx, rdi
call fcn.1000070bc
test eax, eax
jne 0x100006a48
cmp dword [0x100011400], eax
je 0x100006a37
and dword [0x100011400], eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
xor eax, eax
jmp 0x100006a54
call fcn.100007b14
mov dword [0x100010488], eax
jmp 0x100006a37
and dword [0x100010488], 0
mov eax, 1
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.10000c9f0
lea r11, [rsp + 0x170]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x100006f74
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, 0x40
lea ebp, [rax + 0x14]
mov edx, ebp
mov ebx, ebp
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, rax
test rax, rax
jne 0x100006feb
and dword [rsp + 0x28], eax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x4b5
xor ecx, ecx
mov dword [rsp + 0x20], 0x10
call fcn.100005574
call fcn.100007b14
mov dword [0x100010488], eax
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
test ebp, ebp
je 0x100007031
cmp rbx, 0x7fffffff
ja 0x100007031
mov r8d, 0x7ffffffe
mov r9, rsi
mov rcx, rax
sub r8, rbx
sub r9, rax
lea rax, [r8 + rbx]
test rax, rax
je 0x100007026
mov al, byte [r9 + rcx]
test al, al
je 0x100007026
mov byte [rcx], al
inc rcx
sub rbx, 1
jne 0x10000700a
test rbx, rbx
jne 0x10000702e
dec rcx
mov byte [rcx], 0
lea r8, [0x100001868]
mov edx, ebp
mov rcx, rdi
call fcn.100007fc0
and qword [rsp + 0x30], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, rdi
mov dword [rsp + 0x28], 0x4000080
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_LocalFree]
cmp rbx, 0xffffffffffffffff
je 0x100006fc9
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x100006fc9
test al, 0x10
je 0x100006fc9
and dword [0x100010488], 0
mov eax, 1
jmp 0x100006fd6
Function at 0x100007b3c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov rax, qword [0x10000f100]
xor rax, rsp
mov qword [rsp + 0x38], rax
xor r13d, r13d
mov r14, rcx
mov ebp, 1
xor r9d, r9d
jmp 0x100007bc3
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r12, rax
test rax, rax
je 0x100007bfd
mov esi, dword [rax]
mov edi, dword [rax + 4]
lea rcx, [rax + 8]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
lea r8, [r12 + 8]
mov edx, edi
movsxd r9, eax
mov ecx, esi
lea r9, [r9 + r12 + 9]
call r14
mov rcx, r12
test eax, eax
je 0x100007bf3
call qword [sym.imp.KERNEL32.dll_FreeResource]
add r13d, ebp
mov r9d, r13d
lea r8, [0x1000019a0]
lea rcx, [rsp + 0x20]
mov edx, 0x14
call fcn.100001ac4
lea rdx, [rsp + 0x20]
mov r8d, 0xa
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
test rax, rax
jne 0x100007b71
jmp 0x100007c09
xor ebp, ebp
call qword [sym.imp.KERNEL32.dll_FreeResource]
jmp 0x100007c09
mov dword [0x100010488], 0x80070714
xor ebp, ebp
mov eax, ebp
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.10000c9f0
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret

Function at 0x100007dac
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub rsp, 0x148
mov rax, qword [0x10000f100]
xor rax, rsp
mov qword [rsp + 0x130], rax
lea r9, [0x100010670]
lea rax, [rsp + 0x20]
mov edx, 0x104
sub r9, rax
mov r8, rdx
lea rcx, [rsp + 0x20]
lea rax, [r8 + 0x7ffffefa]
test rax, rax
je 0x100007e00
mov al, byte [r9 + rcx]
test al, al
je 0x100007e00
mov byte [rcx], al
inc rcx
sub r8, 1
jne 0x100007de1
test r8, r8
jne 0x100007e08
dec rcx
mov byte [rcx], 0
lea r8, [0x100001660]
lea rcx, [rsp + 0x20]
call fcn.100007fc0
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x100007e43
test al, 0x10
jne 0x100007e43
xor edx, edx
lea rcx, [rsp + 0x20]
lea r8d, [rdx + 8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
jmp 0x100007e50
lea rcx, [0x100001660]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.10000c9f0
add rsp, 0x148
ret
Function at 0x100007e70
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rbx, qword [0x100010ee0]
mov rbp, r8
mov r8d, 5
mov rcx, rbx
mov rsi, r9
call qword [sym.imp.KERNEL32.dll_FindResourceA]
test rax, rax
je 0x100007ef3
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rdi, rax
test rax, rax
je 0x100007ef3
mov rax, qword [rsp + 0x60]
mov r9, rsi
mov r8, rbp
mov rdx, rdi
mov rcx, rbx
test rax, rax
jne 0x100007ed6
and qword [rsp + 0x20], rax
jmp 0x100007edb
mov qword [rsp + 0x20], rax
call qword [sym.imp.USER32.dll_DialogBoxIndirectParamA]
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_FreeResource]
cmp rbx, 0xffffffffffffffff
jne 0x100007f17
and dword [rsp + 0x28], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 0x4fb
xor ecx, ecx
mov dword [rsp + 0x20], 0x10
call fcn.100005574
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x100008254
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x110
mov rax, qword [0x10000f100]
xor rax, rsp
mov qword [rsp + 0x100], rax
mov esi, dword [0x10000f414]
mov dword [rsp + 0x30], 0xc
cmp esi, 0xfffffffe
jne 0x1000083cc
lea rcx, [rsp + 0x50]
xor edi, edi
mov dword [rsp + 0x50], 0x94
mov dword [0x10000f414], edi
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp eax, edi
je 0x1000083c6
lea esi, [rdi + 1]
cmp dword [rsp + 0x60], esi
jne 0x1000083c6
cmp dword [rsp + 0x54], 4
jne 0x1000083c6
cmp dword [rsp + 0x58], 0xa
jae 0x1000083c6
lea ecx, [rdi + 0x4a]
call qword [sym.imp.USER32.dll_GetSystemMetrics]
cmp eax, edi
je 0x1000083c6
lea rax, [rsp + 0x38]
lea rdx, [0x1000019b0]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, edi
jne 0x1000083c6
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xf0]
lea rdx, [0x1000015b9]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x38]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, edi
je 0x10000835f
mov eax, dword [0x10000f414]
jmp 0x1000083ce
lea rcx, [rsp + 0xf0]
mov al, byte [rcx]
cmp al, 0x30
jl 0x10000837e
cmp al, 0x39
jg 0x10000837e
add edi, 0xfffffffd
movsx eax, al
shl edi, 4
add edi, eax
jmp 0x100008397
cmp al, 0x61
jl 0x100008384
add al, 0xe0
movsx edx, al
sub edx, 0x37
lea eax, [rdx - 0xa]
cmp eax, 5
ja 0x1000083a2
shl edi, 4
add edi, edx
call qword [sym.imp.USER32.dll_CharNextA]
mov rcx, rax
jmp 0x100008367
lea rax, [rsp + 0xf0]
cmp rcx, rax
je 0x1000083c6
and edi, 0x3ff
cmp edi, esi
je 0x1000083be
cmp edi, 0xd
jne 0x1000083c6
mov dword [0x10000f414], esi
jmp 0x1000083cc
mov esi, dword [0x10000f414]
mov eax, esi
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.10000c9f0
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret