joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000f770
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x12], 0
je 0x14000f798
xor eax, eax
mov r8d, 0xd38
nop
movzx edx, ax
sub dx, r8w
xor word [rcx + rax*2], dx
inc rax
cmp rax, 8
jb 0x14000f780
mov byte [rcx + 0x12], 0
ret

Function at 0x14000f7a0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x16], 0
je 0x14000f7c8
xor eax, eax
mov r8d, 0xd38
nop
movzx edx, ax
sub dx, r8w
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0xa
jb 0x14000f7b0
mov byte [rcx + 0x16], 0
ret

Function at 0x14000f7d0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x18], 0
je 0x14000f7f8
xor eax, eax
mov r8d, 0xd38
nop
movzx edx, ax
sub dx, r8w
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0xb
jb 0x14000f7e0
mov byte [rcx + 0x18], 0
ret

Function at 0x14000f800
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x1a], 0
je 0x14000f828
xor eax, eax
mov r8d, 0xd38
nop
movzx edx, ax
sub dx, r8w
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0xc
jb 0x14000f810
mov byte [rcx + 0x1a], 0
ret

Function at 0x14000f830
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x14], 0
je 0x14000f858
xor eax, eax
mov r8d, 0xd38
nop
movzx edx, ax
sub dx, r8w
xor word [rcx + rax*2], dx
inc rax
cmp rax, 9
jb 0x14000f840
mov byte [rcx + 0x14], 0
ret

Function at 0x14000ff60
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x14001f040]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140010033
cmp byte [rcx + 0x71], 0
je 0x140010033
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x14001002f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14000fff4
sub eax, 1
je 0x14000fff8
cmp eax, 2
jne 0x14001002f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400122d0
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140010026
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14001002f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x14000ffdc
xor al, al
jmp 0x14000ffdc
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400122d0
add rsp, 0x60
pop rbx
ret
Function at 0x140012120
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, rcx
mov r10d, 0x270
mov ecx, dword [rcx]
cmp ecx, r10d
jne 0x140012181
lea r8, [r9 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x140012140
mov ecx, dword [r9]
jmp 0x140012268
cmp ecx, 0x4e0
jb 0x140012268
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, r11d
lea r10, [r10 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x630]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x1400121a0
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop dword [rax + rax]
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, r11d
lea r10, [r10 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 - 0xd50]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x1400121f0
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret

Function at 0x140012ddc
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140012e26
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140012e26
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140012e26
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140012e26
cmp dword [rcx + 0x84], 0xe
jbe 0x140012e26
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140012e28
xor al, al
add rsp, 0x28
ret
Function at 0x14001313c
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x140013176
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x14001317b
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x1400131c4
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x140015760]
cmp byte [rcx + rax], 0
je 0x1400131c4
dec r8
sub rdx, 1
jne 0x1400131aa
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret
Function at 0x1400010c0
Capabilities:
Accept command line arguments
Extract resource via kernel32 functions

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rdi, rdx
mov rsi, rcx
mov rcx, qword [rcx]
test rcx, rcx
je 0x1400010e4
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rsi], 0
lea rax, str.8A69D345_D564_463c_AFF1_A69D9E530F96
mov qword [rsi + 8], rax
xor eax, eax
mov qword [rsi + 0x10], rax
mov qword [rsi + 0x16], rax
mov byte [rsi + 0x1e], 1
mov qword [rsi + 0x20], rax
mov edx, 1
mov r8d, 0xa
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x140001165
mov r14, rax
mov rcx, rdi
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x140001165
mov rbx, rax
mov rcx, rdi
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_SizeofResource]
test eax, eax
je 0x140001165
mov edi, eax
and eax, 1
jne 0x140001165
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
je 0x140001165
and edi, 0xfffffffe
cmp word [rdi + rax - 2], 0
jne 0x140001165
mov qword [rsi + 0x20], rax
lea rdi, [rsp + 0x34]
mov dword [rdi], 0
mov qword [rsp + 0x20], 2
lea rdx, str.SoftwareGoogle
lea r8, str.ChromeInstallerCleanup
mov rcx, 0xffffffff80000001
mov r9, rdi
call fcn.1400037f0
cmp word [rdi], 0x30
setne cl
xor al, 1
or al, cl
mov byte [rsi + 0x1e], al
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rsi
mov rdx, rax
call fcn.1400011c0
nop
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x1400011c0
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, rcx
mov qword [rcx + 0x10], rdx
lea rbx, [rcx + 0x18]
mov rcx, rdx
mov rdx, rbx
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov rdi, rax
mov qword [rsi], rax
test rax, rax
je 0x140001306
cmp dword [rbx], 2
jl 0x1400012ca
mov ebp, 1
lea r14, str.__system_level
mov r13, qword [sym.imp.KERNEL32.dll_lstrcmpiW]
lea r15, str.__chrome_beta
lea r12, str.__chrome_dev
mov rax, qword [rsi]
mov rcx, qword [rax + rbp*8]
mov rdx, r14
call r13
test eax, eax
je 0x140001298
mov rax, qword [rsi]
mov rcx, qword [rax + rbp*8]
mov rdx, r15
call r13
test eax, eax
je 0x14000129e
mov rax, qword [rsi]
mov rcx, qword [rax + rbp*8]
mov rdx, r12
call r13
test eax, eax
je 0x1400012a7
mov rax, qword [rsi]
mov rcx, qword [rax + rbp*8]
lea rdx, str.__chrome_sxs
call r13
test eax, eax
je 0x1400012b0
mov rax, qword [rsi]
mov rcx, qword [rax + rbp*8]
lea rdx, str.__cleanup
call r13
test eax, eax
je 0x140001292
mov rax, qword [rsi]
mov rcx, qword [rax + rbp*8]
lea rdx, str.__chrome_frame
call r13
test eax, eax
jne 0x1400012bb
mov byte [rsi + 0x1d], 1
jmp 0x1400012bb
mov byte [rsi + 0x1c], 1
jmp 0x1400012bb
lea rax, str.8237E44A_0054_442C_B6B6_EA0509993955
jmp 0x1400012b7
lea rax, str.401C381F_E0DE_4B85_8BD8_3F3F14FBDA57
jmp 0x1400012b7
lea rax, str.4ea16ac7_fd5a_47c3_875b_dbf4a2008c20
mov qword [rsi + 8], rax
inc rbp
movsxd rax, dword [rbx]
cmp rbp, rax
jl 0x140001220
cmp byte [rsi + 0x1c], 0
jne 0x140001306
xor eax, eax
lea rbx, [rsp + 0x22]
mov word [rbx + 4], ax
mov word [rbx], ax
lea rcx, str.GoogleUpdateIsMachine
mov rdx, rbx
mov r8d, 2
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
cmp eax, 1
sete al
cmp word [rbx], 0x31
sete cl
and cl, al
mov byte [rsi + 0x1c], cl
test rdi, rdi
setne al
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140001ab0
Capabilities:
Self delete using alternate data streams

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
movaps xmmword [rsp + 0x70], xmm6
mov rsi, rdx
mov rdi, rcx
mov dword [rdx], 1
mov r15, qword [sym.imp.KERNEL32.dll_CreateFileW]
xorps xmm6, xmm6
lea rbx, [rsp + 0x40]
mov r13, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x2200000
mov dword [rsp + 0x20], 3
mov rcx, rdi
mov edx, 0x10000
mov r8d, 7
xor r9d, r9d
call r15
cmp rax, 0xffffffffffffffff
je 0x140001b48
mov r14, rax
mov byte [rsp + 0x40], 1
mov rcx, rax
mov edx, 4
mov r8, rbx
mov r9d, 1
call qword [sym.imp.KERNEL32.dll_SetFileInformationByHandle]
test eax, eax
je 0x140001b53
mov rcx, r14
call r13
jmp 0x140001aea
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12d, eax
jmp 0x140001b62
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12d, eax
mov rcx, r14
call r13
mov ebp, r12d
and ebp, 0xfffffffe
cmp ebp, 2
je 0x140001c61
cmp r12d, 0x91
je 0x140001bf9
cmp r12d, 0x20
je 0x140001bf9
cmp r12d, 5
jne 0x140001c61
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x2200000
mov dword [rsp + 0x20], 3
mov rcx, rdi
mov edx, 0x180
mov r8d, 7
xor r9d, r9d
call r15
cmp rax, 0xffffffffffffffff
je 0x140001bf9
mov r14, rax
movaps xmmword [rsp + 0x50], xmm6
movaps xmmword [rsp + 0x40], xmm6
mov qword [rsp + 0x60], 0
mov rcx, rax
xor edx, edx
mov r8, rbx
mov r9d, 0x28
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandleEx]
test eax, eax
je 0x140001bf3
mov eax, dword [rsp + 0x60]
test al, 1
jne 0x140001c32
mov rcx, r14
call r13
mov eax, dword [rsi]
cmp eax, 0x64
je 0x140001c61
inc eax
mov dword [rsi], eax
mov rax, qword [0x1400070b8]
test rax, rax
je 0x140001c22
mov rcx, qword [0x1400070c0]
call qword [0x140009008]
jmp 0x140001aea
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140001aea
and eax, 0xfffffffe
mov dword [rsp + 0x60], eax
mov rcx, r14
xor edx, edx
mov r8, rbx
mov r9d, 0x28
call qword [sym.imp.KERNEL32.dll_SetFileInformationByHandle]
mov r12d, eax
mov rcx, r14
call r13
test r12d, r12d
jne 0x140001aea
jmp 0x140001bf9
cmp ebp, 2
sete al
movaps xmm6, xmmword [rsp + 0x70]
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1400020f0
Capabilities:
Create process on windows
Get file attributes

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xe8
mov edi, r9d
mov rbx, rdx
mov rsi, rcx
xorps xmm0, xmm0
lea rax, [rsp + 0x80]
movaps xmmword [rax], xmm0
xor ecx, ecx
mov qword [rax + 0x60], rcx
movaps xmmword [rax + 0x50], xmm0
movaps xmmword [rax + 0x40], xmm0
movaps xmmword [rax + 0x30], xmm0
movaps xmmword [rax + 0x20], xmm0
movaps xmmword [rax + 0x10], xmm0
mov dword [rax], 0x68
lea rdx, [rsp + 0x60]
mov qword [rdx + 0x10], rcx
movaps xmmword [rdx], xmm0
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x40], rax
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 0
mov rcx, rbx
mov rdx, r8
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x1400021a7
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x5c], 0
mov rcx, qword [rsp + 0x60]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x1400021d0
mov edi, 0x6b
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1400021f5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp ebp, 3
je 0x140002209
cmp ebp, 2
je 0x1400021f5
mov eax, dword [rsp + 0x138]
mov dword [rsi], eax
mov dword [rsi + 4], ebp
jmp 0x1400021fa
mov rcx, qword [rsp + 0x60]
lea rdx, [rsp + 0x5c]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x14000219a
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov edi, dword [rsp + 0x5c]
mov dword [rsi], edi
mov dword [rsi + 4], eax
mov rax, rsi
add rsp, 0xe8
pop rbx
pop rbp
pop rdi
pop rsi
ret
mov ecx, dword [rsp + 0x130]
mov dword [rsi], ecx
jmp 0x1400021f7
Function at 0x140002cc0
Capabilities:
Get disk information

Disassembly:
push rsi
push rdi
sub rsp, 0x2a8
mov rsi, rdx
mov qword [rdx], 0
xor eax, eax
lea rdx, [rsp + 0x4e]
mov word [rdx + 0x208], ax
mov word [rdx], ax
mov dword [rsp + 0x40], 0
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetVolumePathNameW]
test eax, eax
je 0x140002dd1
xor eax, eax
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x38], 0
lea rcx, [rsp + 0x4e]
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x140002dd1
test byte [rsp + 0x40], 8
mov dil, 1
je 0x140002dd4
lea rcx, [rsp + 0x40]
mov qword [rcx], 0
call fcn.140002be0
xor edi, edi
test al, al
je 0x140002dd4
lea rcx, [rsp + 0x4e]
mov word [rcx + 0x258], di
mov word [rcx], di
lea r8, [0x1400054c0]
mov edx, 0x12c
call fcn.1400032b0
test al, al
je 0x140002de2
mov r8, qword [rsp + 0x40]
lea rcx, [rsp + 0x4e]
mov edx, 0x12c
call fcn.1400032b0
test al, al
je 0x140002de0
lea r8, [0x14000557a]
lea rcx, [rsp + 0x4e]
mov edx, 0x12c
call fcn.1400032b0
test al, al
je 0x140002de0
lea rcx, [rsp + 0x4e]
mov edx, 1
mov r8, rsi
xor r9d, r9d
call sub.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW
test eax, eax
setne dil
jmp 0x140002de2
mov dil, 1
mov eax, edi
add rsp, 0x2a8
pop rdi
pop rsi
ret
xor edi, edi
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x140002dd4
Function at 0x140002df0
Capabilities:
Create directory
Generate random numbers via rtlgenrandom

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov rsi, r8
mov rdi, rdx
mov r15, rcx
mov qword [r8], 0x6c
mov edx, 0x104
mov rcx, rdi
mov r8, r15
call fcn.140003270
test al, al
je 0x140002f29
lea r8, [0x140005652]
mov ebx, 0x104
mov edx, 0x104
mov rcx, rdi
call fcn.1400032b0
test al, al
je 0x140002f29
mov edx, 0x104
mov rcx, rdi
call fcn.140003240
sub rbx, rax
cmp rbx, 0xb
jb 0x140002f29
mov r14, rax
xorps xmm0, xmm0
lea rdx, [rsp + 0x38]
movaps xmmword [rdx - 8], xmm0
mov qword [rdx + 8], 0
mov dword [rdx - 8], 0x18
mov rcx, r15
call fcn.140002cc0
test al, al
je 0x140002f18
mov qword [rsi], 0x6d
lea r15, [rdi + r14*2]
mov rbp, r14
add rbp, 5
mov r13d, 0xfffffff6
lea r12, [rsp + 0x2c]
mov rcx, r12
mov edx, 4
call sub.ADVAPI32.dll_SystemFunction036
mov edx, 4
mov rcx, r12
mov r8, r15
mov r9, rbx
call fcn.1400031e0
cmp rbp, 0x103
ja 0x140002edf
mov word [rdi + r14*2 + 0xa], 0
mov edx, 0x104
mov rcx, rdi
lea r8, str..tmp
call fcn.1400032b0
mov rdx, qword [rsp + 0x38]
test rdx, rdx
lea rax, [rsp + 0x30]
cmovne rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x140002f3c
inc r13d
jne 0x140002eae
jmp 0x140002f57
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 0x75
mov qword [rsi], rax
xor eax, eax
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea r8, [0x140005588]
mov edx, 0x104
mov rcx, rdi
call fcn.1400032b0
mov qword [rsi], 0
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140002f67
call qword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [rsi], 0
sete al
jmp 0x140002f2b
Function at 0x140003520
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x248
mov rbx, rdx
mov rsi, rcx
mov rdx, qword [rcx]
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x1400035f8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
je 0x1400035f8
mov rdi, rax
lea r14, [rsp + 0x30]
mov rcx, r14
call fcn.140001c80
mov rcx, r14
mov rdx, rbx
call fcn.140001ce0
test al, al
je 0x140003621
mov rdx, qword [rsi]
mov rcx, qword [rsi + 8]
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov sil, 1
test eax, eax
je 0x140003623
mov r13d, eax
xor ebp, ebp
mov ebx, 0x800000
mov r14, qword [sym.imp.KERNEL32.dll_WriteFile]
mov r15, r13
sub r15, rbp
cmp r15, rbx
cmovae r15, rbx
mov dword [rsp + 0x2c], 0
lea r12, [rdi + rbp]
lea rcx, [rsp + 0x30]
call fcn.140001e50
mov qword [rsp + 0x20], 0
mov rcx, rax
mov rdx, r12
mov r8d, r15d
lea r9, [rsp + 0x2c]
call r14
test eax, eax
je 0x1400035fc
add rbp, r15
cmp rbp, r13
jb 0x1400035ad
jmp 0x140003623
xor esi, esi
jmp 0x14000362d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
lea rdi, [rsp + 0x30]
mov rcx, rdi
call fcn.140001d90
mov rcx, rdi
call fcn.140001ca0
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor esi, esi
lea rcx, [rsp + 0x30]
call fcn.140001ca0
mov eax, esi
add rsp, 0x248
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x140003680
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rdi, r9
mov rsi, r8
lea r9, [rsp + 0x34]
mov dword [r9], 0
lea eax, [rdi + rdi]
lea r8, [rsp + 0x30]
mov dword [r8], eax
mov rcx, qword [rcx]
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x20], rsi
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400036f8
mov eax, 0x32
cmp dword [rsp + 0x34], 1
jne 0x1400036f8
mov ecx, dword [rsp + 0x30]
cmp rcx, 2
jb 0x1400036f1
mov eax, ecx
and eax, 0xfffffffe
cmp word [rax + rsi - 2], 0
je 0x1400036f6
shr rcx, 1
mov eax, 0xea
cmp rcx, rdi
jae 0x1400036f8
lea rsi, [rsi + rcx*2]
mov word [rsi], 0
xor eax, eax
add rsp, 0x38
pop rdi
pop rsi
ret

Function at 0x140003700
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x38
lea r9, [rsp + 0x34]
mov dword [r9], 0
lea rax, [rsp + 0x30]
mov dword [rax], 4
mov rcx, qword [rcx]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r8
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140003750
mov eax, 0x32
cmp dword [rsp + 0x34], 4
jne 0x140003750
xor ecx, ecx
cmp dword [rsp + 0x30], 4
mov eax, 0xe8
cmove eax, ecx
add rsp, 0x38
ret

Function at 0x140003760
Capabilities:
Set registry value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov rcx, r8
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [rax*2 + 2]
mov rcx, qword [rbx]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rsi
mov rdx, rdi
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
Function at 0x1400037b0
Capabilities:
Set registry value

Disassembly:
sub rsp, 0x38
lea rax, [rsp + 0x34]
mov dword [rax], r8d
mov rcx, qword [rcx]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 4
xor r8d, r8d
mov r9d, 4
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
add rsp, 0x38
ret

Function at 0x1400037f0
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rsi, r9
mov rdi, r8
lea rax, [rsp + 0x38]
mov qword [rax], 0
mov qword [rsp + 0x20], rax
xor ebx, ebx
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000389b
mov rbx, qword [rsp + 0x80]
lea r9, [rsp + 0x34]
mov dword [r9], 0
lea eax, [rbx + rbx]
lea rdx, [rsp + 0x30]
mov dword [rdx], eax
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rsi
mov rdx, rdi
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140003896
mov eax, 0x32
cmp dword [rsp + 0x34], 1
jne 0x140003896
mov ecx, dword [rsp + 0x30]
cmp rcx, 2
jb 0x14000388f
mov edx, ecx
and edx, 0xfffffffe
cmp word [rdx + rsi - 2], 0
je 0x140003894
shr rcx, 1
cmp rcx, rbx
jae 0x140003896
lea rsi, [rsi + rcx*2]
mov word [rsi], 0
xor eax, eax
test eax, eax
sete bl
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1400038ab
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret

Function at 0x140003a00
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
movsxd r8, dword [0x14000003c]
lea rsi, [0x140000000]
add r8, rsi
mov rbx, rdx
mov rdi, rcx
cmp dword [r8 + 0x84], 0xd
jbe 0x140003a78
mov r10d, dword [r8 + 0xf0]
xor r9d, r9d
test r10d, r10d
je 0x140003a78
movzx ecx, word [r8 + 0x14]
movzx r11d, word [r8 + 6]
add rcx, 0x18
mov r10d, dword [r10 + rsi + 0xc]
add rcx, r8
test r11d, r11d
je 0x140003a78
mov eax, dword [rcx + 0xc]
cmp r10d, eax
jb 0x140003a6c
mov edx, dword [rcx + 8]
add eax, edx
cmp r10d, eax
jb 0x140003a8a
inc r9d
add rcx, 0x28
cmp r9d, r11d
jb 0x140003a5a
xor eax, eax
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
mov dword [rdi], edx
mov eax, dword [rcx + 0x24]
mov dword [rbx], eax
mov eax, dword [rcx + 0xc]
add rax, rsi
jmp 0x140003a7a