joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003082c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x20
xor edi, edi
xor ebx, ebx
mov rsi, rdx
mov rbp, rcx
test rdx, rdx
je 0x140030894
call fcn.14000efe0
mov r8d, 0xf0
mov rdx, rsi
mov r12, qword [rax + 0x18]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x140030894
mov rdx, rax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbx, rax
test rax, rax
je 0x1400308b6
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
mov rdx, rdi
mov rcx, rbp
call fcn.140030218
mov esi, eax
test rdi, rdi
je 0x1400308b4
test rbx, rbx
je 0x1400308b4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret

Function at 0x140030e80
Capabilities:
Move file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx], 0
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
je 0x140030ee5
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140030ef9
lea rdx, str.MoveFileTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140030ef9
mov rcx, qword [rbx]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x28], rcx
mov rcx, rsi
mov rdx, rdi
mov dword [rsp + 0x20], 2
call rax
jmp 0x140030efb
cmp dword [rcx + 8], 0
je 0x140030ef9
mov rdx, r8
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_MoveFileW]
jmp 0x140030efb
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x140031228
Capabilities:
Move file

Disassembly:
push rbx
sub rsp, 0x20
mov rax, r8
mov rbx, rcx
test r8, r8
je 0x140031249
mov r8, rdx
mov rdx, rcx
mov rcx, rax
call fcn.140030e80
jmp 0x14003124f
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x140031263
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, rbx
mov ecx, eax
call fcn.140032cf4
add rsp, 0x20
pop rbx
ret

Function at 0x14003126c
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
mov rdi, rcx
test rdx, rdx
je 0x1400312c2
cmp qword [rdx], 0
je 0x1400312b8
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400312cc
lea rdx, str.DeleteFileTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400312be
mov rdx, qword [rbx]
mov rcx, rdi
call rax
jmp 0x1400312c8
cmp dword [rdx + 8], 0
jne 0x1400312c2
xor eax, eax
jmp 0x1400312c8
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1400312dc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, rdi
mov ecx, eax
call fcn.140032cf4
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140034ecc
Capabilities:
Query or enumerate registry value

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rsi
mov rdi, r9
mov rsi, r8
mov rbx, rcx
lea rcx, [rsp + 0x40]
call fcn.14000ce2c
nop
cmp rbx, 0xffffffff80000000
jne 0x140034f58
call fcn.14000dd04
cmp eax, 1
jne 0x140034f58
lea r8, [rsp + 0x40]
lea rdx, str.SoftwareClasses_
lea rcx, [rsp + 0x20]
call fcn.1400233e8
nop
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.14000c3c4
nop
mov rdx, qword [rsp + 0x20]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140034f51
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, 0xffffffff80000001
mov r9, rdi
mov r8, rsi
mov rdx, qword [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueW]
mov ebx, eax
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x140034f8f
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov eax, ebx
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x140034fa4
Capabilities:
Set registry value

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rsi
mov rdi, r9
mov esi, r8d
mov rbx, rcx
lea rcx, [rsp + 0x50]
call fcn.14000ce2c
nop
cmp rbx, 0xffffffff80000000
jne 0x140035030
call fcn.14000dd04
cmp eax, 1
jne 0x140035030
lea r8, [rsp + 0x50]
lea rdx, str.SoftwareClasses_
lea rcx, [rsp + 0x30]
call fcn.1400233e8
nop
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.14000c3c4
nop
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140035029
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, 0xffffffff80000001
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x20], eax
mov r9, rdi
mov r8d, esi
mov rdx, qword [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueW]
mov ebx, eax
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x14003506f
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov eax, ebx
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x140035084
Capabilities:
Delete registry key

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x48], rbx
mov rdi, r8
mov rbx, rcx
lea rcx, [rsp + 0x40]
call fcn.14000ce2c
nop
cmp rbx, 0xffffffff80000000
jne 0x140035108
call fcn.14000dd04
cmp eax, 1
jne 0x140035108
lea r8, [rsp + 0x40]
lea rdx, str.SoftwareClasses_
lea rcx, [rsp + 0x50]
call fcn.1400233e8
nop
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.14000c3c4
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140035101
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, 0xffffffff80000001
test rdi, rdi
je 0x14003511f
mov r8, qword [rsp + 0x40]
mov rdx, rbx
mov rcx, rdi
call fcn.14001a358
jmp 0x14003512d
mov rdx, qword [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ebx, eax
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14003514f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, ebx
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x14003f2cc
Capabilities:
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx], 0
mov edi, r8d
mov rsi, rdx
mov rbx, rcx
je 0x14003f31d
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14003f331
lea rdx, str.SetFileAttributesTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14003f331
mov r8, qword [rbx]
mov edx, edi
mov rcx, rsi
call rax
jmp 0x14003f333
cmp dword [rcx + 8], 0
je 0x14003f331
mov edx, r8d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
jmp 0x14003f333
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x1400952a0
Capabilities:
Delete registry value

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x40
and dword [rax - 0x20], 0
and qword [rax - 0x18], 0
mov rdi, rcx
mov rdx, 0xffffffff80000002
lea rcx, [rax - 0x28]
lea r8, str.SoftwareMicrosoftWindowsCurrentVersionPreviewHandlers
mov r9d, 0x2001f
mov qword [rax - 0x28], rdx
call fcn.14001a5d8
test eax, eax
jne 0x140095305
mov rcx, qword [rsp + 0x20]
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp qword [rsp + 0x20], 0
je 0x140095300
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
and qword [rsp + 0x20], 0
and dword [rsp + 0x28], 0
lea r8, [0x1402849a8]
lea rcx, [rsp + 0x20]
mov r9d, 0x2001f
mov rdx, 0xffffffff80000000
call fcn.14001a5d8
test eax, eax
jne 0x140095348
lea rcx, [rsp + 0x20]
mov rdx, rdi
call fcn.140095198
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x140095358
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ecx, ecx
jmp 0x14009534d
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x140095358
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
add rsp, 0x40
pop rdi
ret
Function at 0x1400e72a4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x20
mov r12, r8
mov rbx, rdx
mov r13, rcx
xor edi, edi
call fcn.14000efe0
lea r8d, [rdi + 5]
mov rbp, qword [rax + 0x18]
mov rdx, rbx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rcx, rbp
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
test rax, rax
je 0x1400e7300
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
mov r9, rbp
mov r8, r12
mov rdx, rdi
mov rcx, r13
call fcn.1400e6d34
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r13
pop r12
pop rdi
ret

Function at 0x1400e7394
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, r8
mov rdi, rdx
mov rsi, rcx
mov qword [rcx + 0xe0], rdx
test rdx, 0xffffffffffff0000
jne 0x1400e73d3
cmp dword [rcx + 0xd8], 0
jne 0x1400e73d3
movzx eax, dx
mov dword [rcx + 0xd8], eax
call fcn.14000efe0
mov r8d, 5
mov rdx, rdi
mov rbx, qword [rax + 0x18]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rcx, rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r9, rbx
mov r8, rbp
mov rdx, rax
mov rcx, rsi
mov rdi, rax
call fcn.1400e7338
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1400f41ac
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x20
xor ebx, ebx
mov rdi, r8
mov rsi, rdx
mov r13, rcx
test r8, r8
jne 0x1400f41dd
call fcn.14000efe0
mov rdi, qword [rax + 0x18]
mov r8, qword [0x14038ab90]
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbp, rax
test rax, rax
jne 0x1400f41fc
xor eax, eax
jmp 0x1400f4248
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
test rax, rax
je 0x1400f41f8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r12, rax
test rax, rax
je 0x1400f423d
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rdx, r12
mov rcx, r13
mov r8d, eax
call fcn.1400f4070
mov ebx, eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r13
pop r12
pop rdi
ret
Function at 0x1401120c4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0xd0
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rax, qword [0x14037f168]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov edi, r8d
mov r13, rdx
mov r12, rcx
xor r14d, r14d
mov eax, r14d
test r8d, r8d
setne al
test eax, eax
jne 0x140112110
call fcn.14000d728
int3
call fcn.14000efe0
mov rbx, qword [rax + 0x18]
movzx edx, di
mov r8d, 0xf1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
jne 0x140112137
xor eax, eax
jmp 0x1401121d6
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbx, rax
test rax, rax
je 0x140112130
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
test rax, rax
jne 0x140112167
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeResource]
jmp 0x140112130
mov ebp, r14d
cmp r14w, word [rax + 6]
jae 0x1401121c8
lea rsi, [rax + 8]
movzx edx, word [rsi]
test edx, edx
je 0x1401121ba
cmp edx, 0xffffffff
je 0x1401121ba
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
xor r9d, r9d
or r8d, 0xffffffff
lea rcx, [rsp + 0x40]
call fcn.1400fa08c
nop
or r9d, 0xffffffff
mov r8, rax
mov rdx, r13
mov rcx, r12
call fcn.140111ba8
nop
lea rcx, [rsp + 0x40]
call fcn.1400f856c
inc ebp
add rsi, 2
movzx ecx, word [rdi + 6]
cmp ebp, ecx
jl 0x140112175
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, 1
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.140229090
add rsp, 0xd0
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x140119bcc
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
cmp dword [rcx + 0x28], ebx
je 0x140119bdd
xor eax, eax
jmp 0x140119c0b
mov rcx, qword [rcx + 8]
lea rax, [rsp + 0x40]
mov r9d, 4
mov dword [rsp + 0x40], r8d
mov dword [rsp + 0x28], r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
sete bl
mov eax, ebx
add rsp, 0x30
pop rbx
ret

Function at 0x140119da0
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
cmp dword [rcx + 0x28], ebx
je 0x140119db1
xor eax, eax
jmp 0x140119dd5
mov rcx, qword [rcx + 8]
mov dword [rsp + 0x28], r9d
mov qword [rsp + 0x20], r8
mov r9d, 3
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
sete bl
mov eax, ebx
add rsp, 0x30
pop rbx
ret

Function at 0x140119ddc
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
sub rsp, 0x38
mov rcx, qword [rcx + 8]
lea rax, [r11 + 8]
lea r9, [r11 + 0x20]
mov qword [r11 - 0x10], rax
mov qword [r11 - 0x18], r8
xor r8d, r8d
mov dword [rsp + 0x40], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor edx, edx
test eax, eax
jne 0x140119e1e
mov ecx, dword [rsp + 0x58]
sub ecx, 4
neg ecx
sbb eax, eax
and eax, 0xd
test eax, eax
sete dl
mov eax, edx
add rsp, 0x38
ret
Function at 0x140119f30
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rdi, r9
mov rbx, r8
mov rsi, rdx
mov rbp, rcx
test rdx, rdx
jne 0x140119f5b
call fcn.14000d728
int3
test rbx, rbx
jne 0x140119f66
call fcn.14000d728
int3
test r9, r9
jne 0x140119f71
call fcn.14000d728
int3
and qword [r8], 0
and dword [r9], 0
mov rcx, qword [rcx + 8]
mov qword [rsp + 0x28], r9
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x48]
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140119ff4
cmp dword [rsp + 0x48], 3
jne 0x140119ff4
test eax, eax
jne 0x140119ff4
cmp dword [rdi], eax
je 0x140119ff4
mov ecx, dword [rdi]
call fcn.140009420
lea r9, [rsp + 0x48]
xor r8d, r8d
mov qword [rbx], rax
mov rcx, qword [rbp + 8]
mov rdx, rsi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140119fe8
cmp dword [rsp + 0x48], 3
jne 0x140119fe8
test eax, eax
jne 0x140119fe8
mov eax, 1
jmp 0x140119ff6
mov rcx, qword [rbx]
call fcn.140009464
and qword [rbx], 0
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret

Function at 0x14011a100
Capabilities:
Delete registry value

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx + 8]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
xor ecx, ecx
test eax, eax
sete cl
mov eax, ecx
add rsp, 0x28
ret

Function at 0x1401a8b0c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
test byte [rdx + 4], 1
mov esi, r8d
mov rbx, rdx
mov rbp, rcx
je 0x1401a8b35
mov rdi, qword [rdx + 0x10]
jmp 0x1401a8b86
mov rdx, qword [rdx + 0x10]
mov rcx, qword [rbx + 8]
mov r8d, 5
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdi, rax
test rax, rax
jne 0x1401a8b56
call fcn.14000fdcc
mov rcx, qword [rbx + 8]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rdi, rax
test rax, rax
jne 0x1401a8b70
call fcn.14000fdcc
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
test rax, rax
jne 0x1401a8b86
call fcn.14000fdcc
call fcn.14000efe0
cmp qword [rax + 0x68], 0
je 0x1401a8ba0
mov rdx, rdi
mov rcx, rbp
call fcn.1401a6de0
mov rdi, rax
mov edx, esi
mov rcx, rdi
call fcn.1401a894c
mov rcx, qword [rbp + 0xe8]
mov rsi, rax
test rcx, rcx
je 0x1401a8bc7
call qword [sym.imp.KERNEL32.dll_GlobalFree]
and qword [rbp + 0xe8], 0
test rsi, rsi
je 0x1401a8bd6
mov rdi, rsi
mov qword [rbp + 0xe8], rsi
or dword [rbx + 4], 1
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov qword [rbx + 0x10], rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1401c7278
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
test rdx, rdx
jne 0x1401c72a1
xor eax, eax
jmp 0x1401c7321
test rbx, rbx
je 0x1401c729a
test r9, r9
jne 0x1401c72b9
call fcn.14000efe0
mov r9, qword [rax + 0x18]
test r9, r9
je 0x1401c729a
mov r8, rbx
mov rdx, rsi
mov rcx, r9
mov qword [rdi + 0x10], r9
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
je 0x1401c729a
mov rcx, qword [rdi + 0x10]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebp, eax
test eax, eax
je 0x1401c729a
mov rcx, qword [rdi + 0x10]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
test rax, rax
je 0x1401c729a
mov rbx, qword [rdi]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r8d, ebp
mov rcx, rdi
mov rdx, rax
call qword [rbx + reloc.OLEAUT32.dll_VariantClear]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x14022a01c
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.140229e8c

Function at 0x140233e07
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x14037f168]
jne 0x1402290aa
rol rcx, 0x10
test cx, 0xffff
jne 0x1402290a6
repz ret
ror rcx, 0x10
jmp 0x140233d60
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x14038e020]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x14038e118]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x140233de5
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x14038e020]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x140233e07
mov rax, qword [rsp + 0x88]
mov qword [0x14038e118], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x14038e0b8], rax
mov rax, qword [0x14038e118]
mov qword [0x14038df90], rax
mov rax, qword [rsp + 0x90]
mov qword [0x14038e0a0], rax
mov dword [0x14038df80], 0xc0000409
mov dword [0x14038df84], 1
mov rax, qword [0x14037f168]
mov qword [rsp + 0x68], rax
mov rax, qword [0x14037f170]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x14038e018], eax
mov ecx, 1
call fcn.14024ce8c
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x1402f4880]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x14038e018], 0
jne 0x140233e8e
mov ecx, 1
call fcn.14024ce8c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x14024f4c8
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [0x14037f168]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.14023037c
xor ebx, ebx
cmp qword [0x14038f170], rbx
mov rdi, rax
jne 0x14024f5db
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x14024f6b2
lea rdx, [0x1402f6df0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14024f6b2
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, [0x1402f6de0]
mov rcx, rsi
mov qword [0x14038f170], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, [0x1402f6dc8]
mov rcx, rsi
mov qword [0x14038f178], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetUserObjectInformationW
mov rcx, rsi
mov qword [0x14038f180], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov r11, rax
mov qword [0x14038f190], rax
test rax, rax
je 0x14024f5d2
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x14038f188], rax
jmp 0x14024f5e2
mov rax, qword [0x14038f188]
jmp 0x14024f5e9
mov rax, qword [0x14038f188]
mov r11, qword [0x14038f190]
cmp rax, rdi
je 0x14024f650
cmp r11, rdi
je 0x14024f650
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rcx, qword [0x14038f190]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov r12, rax
test rsi, rsi
je 0x14024f650
test rax, rax
je 0x14024f650
call rsi
test rax, rax
je 0x14024f64a
lea rcx, [rsp + 0x30]
mov r9d, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x14024f64a
test byte [rsp + 0x40], 1
jne 0x14024f650
bts ebp, 0x15
jmp 0x14024f690
mov rcx, qword [0x14038f178]
cmp rcx, rdi
je 0x14024f690
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x14024f690
call rax
mov rbx, rax
test rax, rax
je 0x14024f690
mov rcx, qword [0x14038f180]
cmp rcx, rdi
je 0x14024f690
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x14024f690
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x14038f170]
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x14024f6b2
mov r9d, ebp
mov r8, r14
mov rdx, r13
mov rcx, rbx
call rax
jmp 0x14024f6b4
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140229090
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret