joyce8/EMBER2024-capa huggingface dataset:
Function at 0x529a10
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rbp, rsp
mov rsi, rcx
lea rdi, [rbp + 0x20]
movsq qword [rdi], qword [rsi]
movsq qword [rdi], qword [rsi]
cmp qword [0x00670878], 0
jne 0x529ac5
xor rcx, rcx
mov edx, 0x1000
mov r8d, 0x1000
mov r9d, 0x40
call sub.kernel32.dll_VirtualAlloc_1
mov rbx, rax
mov rax, qword [0x00670870]
mov qword [rbx], rax
lea rcx, [0x00638d34]
lea rdx, [rbx + 8]
mov r8d, 8
call fcn.00408ce0
lea rax, [0x005299d0]
mov qword [rbx + 0x10], rax
lea rsi, [rbx + 0x18]
mov byte [rsi], 0xe8
mov rcx, rsi
lea rdx, [rbx + 8]
call fcn.00529a00
mov dword [rsi + 1], eax
mov rax, qword [0x00670878]
mov qword [rsi + 5], rax
mov qword [0x00670878], rsi
add rsi, 0x15
mov rax, rbx
neg rax
lea rax, [rsi + rax]
cmp rax, 0xfed
jl 0x529a83
mov qword [0x00670870], rbx
mov rax, qword [0x00670878]
mov rsi, qword [0x00670878]
mov rcx, qword [rsi + 5]
mov qword [0x00670878], rcx
lea rdi, [rsi + 5]
lea rsi, [rbp + 0x20]
movsq qword [rdi], qword [rsi]
movsq qword [rdi], qword [rsi]
lea rsp, [rbp + 0x38]
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x56c0e0
Capabilities:
Get system information on windows

Disassembly:
push rbp
sub rsp, 0x60
mov rbp, rsp
mov byte [rbp + 0x5f], 0
mov dword [rbp + 0x28], 0
mov word [rbp + 0x28], 0
lea rcx, [rbp + 0x28]
call sub.kernel32.dll_GetNativeSystemInfo_1
movzx rcx, word [rbp + 0x28]
cmp cx, 0xf
ja 0x56c123
mov ax, 1
shl eax, cl
movzx rcx, word [0x0056c134]
test ax, cx
setne al
jmp 0x56c126
xor rax, rax
mov byte [rbp + 0x5f], al
movzx rax, byte [rbp + 0x5f]
lea rsp, [rbp + 0x60]
pop rbp
ret

Function at 0x56d1d0
Capabilities:
Query environment variable

Disassembly:
push rbp
push rbx
sub rsp, 0x38
mov rbp, rsp
mov qword [rbp + 0x50], rcx
mov qword [rbp + 0x58], rdx
mov byte [rbp + 0x60], r8b
mov rax, qword [rbp + 0x58]
mov qword [rax], 0
mov rcx, qword [rbp + 0x50]
call fcn.004111f0
mov rcx, rax
xor rdx, rdx
xor r8, r8
call sub.kernel32.dll_GetEnvironmentVariableW
mov dword [rbp + 0x28], eax
mov rcx, qword [rbp + 0x58]
mov edx, dword [rbp + 0x28]
call fcn.00411480
mov rcx, qword [rbp + 0x50]
call fcn.004111f0
mov rbx, rax
mov rax, qword [rbp + 0x58]
mov rcx, qword [rax]
call fcn.004111f0
mov rcx, rbx
mov rdx, rax
mov r8d, dword [rbp + 0x28]
call sub.kernel32.dll_GetEnvironmentVariableW
mov dword [rbp + 0x28], eax
cmp dword [rbp + 0x28], 0
setne al
mov byte [rbp + 0x2f], al
cmp byte [rbp + 0x2f], 0
jne 0x56d25b
mov rcx, qword [rbp + 0x58]
call fcn.0040f800
jmp 0x56d276
mov rcx, qword [rbp + 0x58]
mov edx, dword [rbp + 0x28]
call fcn.00411480
cmp byte [rbp + 0x60], 0
je 0x56d276
mov rcx, qword [rbp + 0x58]
call fcn.0056d290
movzx rax, byte [rbp + 0x2f]
lea rsp, [rbp + 0x38]
pop rbx
pop rbp
ret
Function at 0x573780
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push rbp
sub rsp, 0x70
mov rbp, rsp
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x38], rbp
mov qword [rbp + 0x80], rcx
nop
cmp byte [0x00670958], 0
je 0x57392e
call fcn.00417430
cmp qword [rax + 0x910], 0
je 0x57392e
lea rcx, [rbp + 0x68]
call sub.kernel32.dll_QueryPerformanceCounter_1
call fcn.00417430
mov rax, qword [rax + 0x910]
sub qword [rbp + 0x68], rax
cmp qword [rbp + 0x68], 0
jle 0x57392e
cmp qword [rbp + 0x68], 0x124f80
jge 0x57392e
lea rcx, [rbp + 0x48]
mov rdx, qword [rbp + 0x80]
xor r8, r8
call fcn.004104f0
call sub.kernel32.dll_GetCurrentThreadId_1
lea rcx, [rbp + 0x30]
mov edx, eax
call fcn.0056bed0
lea rcx, [rbp + 0x58]
mov edx, 3
mov r8, qword [rbp + 0x30]
lea r9, [0x005739ec]
mov rax, qword [rbp + 0x48]
mov qword [rsp + 0x20], rax
call fcn.00410970
lea rcx, [0x00670930]
call sub.kernel32.dll_EnterCriticalSection_1
nop
cmp qword [0x00670928], 0
jne 0x573870
mov rcx, qword [0x00567b68]
mov dl, 1
call fcn.0040c4c0
mov qword [0x00670928], rax
mov rcx, qword [0x00670928]
mov rdx, qword [rbp + 0x58]
mov rax, qword [0x00670928]
mov rax, qword [rax]
call qword [rax + 0xa8]
mov dword [rbp + 0x64], eax
cmp dword [rbp + 0x64], 0
jge 0x5738dc
mov rcx, qword [0x00573618]
mov dl, 1
call fcn.0040c4c0
mov qword [rbp + 0x50], rax
mov rax, qword [rbp + 0x50]
mov rcx, qword [rbp + 0x68]
mov qword [rax + 0x10], rcx
mov rax, qword [rbp + 0x50]
mov qword [rax + 8], 1
mov rcx, qword [0x00670928]
mov rdx, qword [rbp + 0x58]
mov r8, qword [rbp + 0x50]
mov rax, qword [0x00670928]
mov rax, qword [rax]
call qword [rax + 0x78]
jmp 0x573921
mov rcx, qword [0x00670928]
mov edx, dword [rbp + 0x64]
mov rax, qword [0x00670928]
mov rax, qword [rax]
call qword [rax + 0x30]
mov rcx, rax
mov rdx, qword [0x00573618]
call fcn.0040ca60
mov qword [rbp + 0x50], rax
mov rax, qword [rbp + 0x50]
lea rax, [rax + 0x10]
mov rcx, qword [rbp + 0x68]
add qword [rax], rcx
mov rax, qword [rbp + 0x50]
lea rax, [rax + 8]
add qword [rax], 1
nop
lea rcx, [0x00670930]
call sub.kernel32.dll_LeaveCriticalSection_1
call fcn.00417430
lea rcx, [0x910]
lea rcx, [rax + rcx]
call sub.kernel32.dll_QueryPerformanceCounter_1
nop
lea rcx, [rbp + 0x30]
call fcn.0040f850
lea rcx, [rbp + 0x48]
call fcn.0040f850
lea rcx, [rbp + 0x58]
call fcn.0040f850
lea rsp, [rbp + 0x70]
pop rbp
ret
Function at 0x576450
Capabilities:
Query environment variable

Disassembly:
push rbp
push rbx
sub rsp, 0x38
mov rbp, rsp
mov qword [rbp + 0x20], 0
mov qword [rbp + 0x50], rcx
nop
lea rcx, [rbp + 0x20]
mov edx, 1
call fcn.00411480
mov rax, qword [rbp + 0x50]
mov rcx, qword [rax]
call fcn.004111f0
mov rbx, rax
mov rcx, qword [rbp + 0x20]
call fcn.004111f0
mov rcx, rbx
mov rdx, rax
xor r8, r8
call sub.kernel32.dll_ExpandEnvironmentStringsW
mov dword [rbp + 0x28], eax
lea rcx, [rbp + 0x20]
mov edx, dword [rbp + 0x28]
call fcn.00411480
mov rax, qword [rbp + 0x50]
mov rcx, qword [rax]
call fcn.004111f0
mov rbx, rax
mov rcx, qword [rbp + 0x20]
call fcn.004111f0
mov rcx, rbx
mov rdx, rax
mov r8d, dword [rbp + 0x28]
call sub.kernel32.dll_ExpandEnvironmentStringsW
test eax, eax
setne al
mov byte [rbp + 0x2f], al
cmp byte [rbp + 0x2f], 0
je 0x5764f5
lea rcx, [rbp + 0x20]
call fcn.005762e0
mov rcx, qword [rbp + 0x50]
mov rdx, qword [rbp + 0x20]
call fcn.0040fe30
nop
lea rcx, [rbp + 0x20]
call fcn.0040f800
movzx rax, byte [rbp + 0x2f]
lea rsp, [rbp + 0x38]
pop rbx
pop rbp
ret

Function at 0x576540
Capabilities:
Get common file path

Disassembly:
push rbp
sub rsp, 0x30
mov rbp, rsp
mov qword [rbp + 0x40], rcx
mov rcx, qword [rbp + 0x40]
call fcn.0040f800
xor rcx, rcx
xor rdx, rdx
call sub.kernel32.dll_GetCurrentDirectoryW
mov dword [rbp + 0x2c], eax
cmp dword [rbp + 0x2c], 0
je 0x576595
mov rcx, qword [rbp + 0x40]
mov edx, dword [rbp + 0x2c]
call fcn.00411480
mov rax, qword [rbp + 0x40]
mov rcx, qword [rax]
call fcn.004111f0
mov ecx, dword [rbp + 0x2c]
mov rdx, rax
call sub.kernel32.dll_GetCurrentDirectoryW
mov rcx, qword [rbp + 0x40]
call fcn.005762e0
mov rax, qword [rbp + 0x40]
lea rsp, [rbp + 0x30]
pop rbp
ret

Function at 0x5765a0
Capabilities:
Query environment variable

Disassembly:
push rbp
push rbx
sub rsp, 0x38
mov rbp, rsp
mov qword [rbp + 0x50], rcx
mov qword [rbp + 0x58], rdx
mov byte [rbp + 0x60], r8b
mov rax, qword [rbp + 0x58]
mov qword [rax], 0
mov rcx, qword [rbp + 0x50]
call fcn.004111f0
mov rcx, rax
xor rdx, rdx
xor r8, r8
call sub.kernel32.dll_GetEnvironmentVariableW
mov dword [rbp + 0x28], eax
mov rcx, qword [rbp + 0x58]
mov edx, dword [rbp + 0x28]
call fcn.00411480
mov rcx, qword [rbp + 0x50]
call fcn.004111f0
mov rbx, rax
mov rax, qword [rbp + 0x58]
mov rcx, qword [rax]
call fcn.004111f0
mov rcx, rbx
mov rdx, rax
mov r8d, dword [rbp + 0x28]
call sub.kernel32.dll_GetEnvironmentVariableW
mov dword [rbp + 0x28], eax
cmp dword [rbp + 0x28], 0
setne al
mov byte [rbp + 0x2f], al
cmp byte [rbp + 0x2f], 0
jne 0x57662b
mov rcx, qword [rbp + 0x58]
call fcn.0040f800
jmp 0x576646
mov rcx, qword [rbp + 0x58]
mov edx, dword [rbp + 0x28]
call fcn.00411480
cmp byte [rbp + 0x60], 0
je 0x576646
mov rcx, qword [rbp + 0x58]
call fcn.00576450
movzx rax, byte [rbp + 0x2f]
lea rsp, [rbp + 0x38]
pop rbx
pop rbp
ret
Function at 0x576b90
Capabilities:
Get system information on windows

Disassembly:
push rbp
sub rsp, 0x180
mov rbp, rsp
mov byte [rbp + 0x17f], 0x11
mov rax, qword [0x00653618]
mov eax, dword [rax]
sub eax, 2
test eax, eax
jne 0x576ced
mov rax, qword [0x00652ab0]
mov eax, dword [rax]
sub eax, 5
test eax, eax
je 0x576bd6
sub eax, 1
test eax, eax
jne 0x576ced
jmp 0x576c7a
mov rax, qword [0x006531b0]
mov eax, dword [rax]
sub eax, 1
cmp eax, 0xffffffff
je 0x576bf8
test eax, eax
je 0x576c04
sub eax, 1
test eax, eax
jne 0x576ced
jmp 0x576c10
mov byte [rbp + 0x17f], 0xa
jmp 0x576ced
mov byte [rbp + 0x17f], 0xb
jmp 0x576ced
mov dword [rbp + 0x2c], 0x11c
mov dword [rbp + 0x148], 0
lea rcx, [rbp + 0x148]
call sub.kernel32.dll_GetNativeSystemInfo
mov ecx, 0x59
call sub.user32.dll_GetSystemMetrics
test eax, eax
je 0x576c48
mov byte [rbp + 0x17f], 0xe
jmp 0x576ced
cmp word [rbp + 0x148], 0
je 0x576c71
lea rcx, [rbp + 0x2c]
call sub.kernel32.dll_GetVersionExW_1
test eax, eax
je 0x576c71
cmp byte [rbp + 0x146], 1
jne 0x576c71
mov byte [rbp + 0x17f], 0xd
jmp 0x576ced
mov byte [rbp + 0x17f], 0xc
jmp 0x576ced
mov rax, qword [0x006531b0]
mov eax, dword [rax]
sub eax, 1
cmp eax, 0xffffffff
je 0x576c91
test eax, eax
jne 0x576ced
jmp 0x576cc0
mov dword [rbp + 0x2c], 0x11c
lea rcx, [rbp + 0x2c]
call sub.kernel32.dll_GetVersionExW_1
test eax, eax
je 0x576cb7
cmp byte [rbp + 0x146], 1
jne 0x576cb7
mov byte [rbp + 0x17f], 0xf
jmp 0x576ced
mov byte [rbp + 0x17f], 0x10
jmp 0x576ced
mov dword [rbp + 0x2c], 0x11c
lea rcx, [rbp + 0x2c]
call sub.kernel32.dll_GetVersionExW_1
test eax, eax
je 0x576ce6
cmp byte [rbp + 0x146], 1
jne 0x576ce6
mov byte [rbp + 0x17f], 0x11
jmp 0x576ced
mov byte [rbp + 0x17f], 0x12
movzx rax, byte [rbp + 0x17f]
lea rsp, [rbp + 0x180]
pop rbp
ret

Function at 0x576d00
Capabilities:
Get system information on windows

Disassembly:
push rbp
sub rsp, 0x90
mov rbp, rsp
mov qword [rbp + 0x58], 0
nop
cmp byte [0x006419c0], 0
jne 0x576e1f
mov byte [0x006419c0], 1
lea rcx, [rbp + 0x60]
mov edx, 0x30
xor r8, r8
call fcn.0040a6d0
lea rcx, [rbp + 0x60]
call sub.kernel32.dll_GetSystemInfo_1
mov eax, dword [rbp + 0x80]
mov dword [0x006419b4], eax
mov eax, dword [rbp + 0x88]
mov dword [0x006419b8], eax
mov eax, dword [rbp + 0x64]
mov dword [0x006419bc], eax
call fcn.00576b90
mov byte [0x006419a8], al
movzx rax, byte [0x006419a8]
cmp rax, 0xe
jg 0x576da9
cmp rax, 0xe
je 0x576df3
sub rax, 0xa
test rax, rax
je 0x576dcf
sub rax, 1
test rax, rax
je 0x576dd8
sub rax, 1
test rax, rax
je 0x576de1
sub rax, 1
test rax, rax
jne 0x576e1e
jmp 0x576dea
sub rax, 0xf
test rax, rax
je 0x576dfc
sub rax, 1
test rax, rax
je 0x576e05
sub rax, 1
test rax, rax
je 0x576e0e
sub rax, 1
test rax, rax
jne 0x576e1e
jmp 0x576e17
mov byte [0x006419a9], 1
jmp 0x576e1e
mov byte [0x006419aa], 1
jmp 0x576e1e
mov byte [0x006419ab], 1
jmp 0x576e1e
mov byte [0x006419ac], 1
jmp 0x576e1e
mov byte [0x006419ad], 1
jmp 0x576e1e
mov byte [0x006419ae], 1
jmp 0x576e1e
mov byte [0x006419af], 1
jmp 0x576e1e
mov byte [0x006419b0], 1
jmp 0x576e1e
mov byte [0x006419b1], 1
nop
lea rcx, [rbp + 0x58]
call fcn.0040f800
lea rsp, [rbp + 0x90]
pop rbp
ret
Function at 0x577b90
Capabilities:
Get file attributes

Disassembly:
push rbp
sub rsp, 0x50
mov rbp, rsp
mov qword [rbp + 0x28], rbp
mov qword [rbp + 0x60], rcx
call fcn.00417430
cmp byte [rax + 0x7b4], 0
je 0x577bbb
lea rcx, [rbp + 0x40]
call fcn.0056c0a0
test al, al
jne 0x577bc0
xor rax, rax
jmp 0x577bc2
mov al, 1
mov byte [rbp + 0x4f], al
nop
mov rcx, qword [rbp + 0x60]
call sub.kernel32.dll_GetFileAttributesW
mov dword [rbp + 0x3c], eax
nop
cmp byte [rbp + 0x4f], 0
je 0x577c03
mov rcx, qword [rbp + 0x40]
call fcn.0056c0c0
test al, al
jne 0x577c03
mov rcx, qword [0x004276a8]
mov dl, 1
lea r8, [0x00577c70]
call fcn.0043b450
mov rcx, rax
call fcn.0040ea20
mov eax, dword [rbp + 0x3c]
lea rsp, [rbp + 0x50]
pop rbp
ret

Function at 0x577cb0
Capabilities:
Set file attributes

Disassembly:
push rbp
sub rsp, 0x50
mov rbp, rsp
mov qword [rbp + 0x28], rbp
mov qword [rbp + 0x60], rcx
mov dword [rbp + 0x68], edx
call fcn.00417430
cmp byte [rax + 0x7b4], 0
je 0x577cde
lea rcx, [rbp + 0x40]
call fcn.0056c0a0
test al, al
jne 0x577ce3
xor rax, rax
jmp 0x577ce5
mov al, 1
mov byte [rbp + 0x4f], al
nop
mov rcx, qword [rbp + 0x60]
mov edx, dword [rbp + 0x68]
call sub.kernel32.dll_SetFileAttributesW
mov dword [rbp + 0x3c], eax
nop
cmp byte [rbp + 0x4f], 0
je 0x577d29
mov rcx, qword [rbp + 0x40]
call fcn.0056c0c0
test al, al
jne 0x577d29
mov rcx, qword [0x004276a8]
mov dl, 1
lea r8, [0x00577da0]
call fcn.0043b450
mov rcx, rax
call fcn.0040ea20
mov eax, dword [rbp + 0x3c]
lea rsp, [rbp + 0x50]
pop rbp
ret

Function at 0x577de0
Capabilities:
Create directory

Disassembly:
push rbp
sub rsp, 0x50
mov rbp, rsp
mov qword [rbp + 0x28], rbp
mov qword [rbp + 0x60], rcx
mov qword [rbp + 0x68], rdx
call fcn.00417430
cmp byte [rax + 0x7b4], 0
je 0x577e0f
lea rcx, [rbp + 0x40]
call fcn.0056c0a0
test al, al
jne 0x577e14
xor rax, rax
jmp 0x577e16
mov al, 1
mov byte [rbp + 0x4f], al
nop
mov rcx, qword [rbp + 0x60]
mov rdx, qword [rbp + 0x68]
call sub.kernel32.dll_CreateDirectoryW
mov dword [rbp + 0x3c], eax
nop
cmp byte [rbp + 0x4f], 0
je 0x577e5b
mov rcx, qword [rbp + 0x40]
call fcn.0056c0c0
test al, al
jne 0x577e5b
mov rcx, qword [0x004276a8]
mov dl, 1
lea r8, [0x00577ed0]
call fcn.0043b450
mov rcx, rax
call fcn.0040ea20
mov eax, dword [rbp + 0x3c]
lea rsp, [rbp + 0x50]
pop rbp
ret

Function at 0x577f10
Capabilities:
Move file

Disassembly:
push rbp
sub rsp, 0x50
mov rbp, rsp
mov qword [rbp + 0x28], rbp
mov qword [rbp + 0x60], rcx
mov qword [rbp + 0x68], rdx
call fcn.00417430
cmp byte [rax + 0x7b4], 0
je 0x577f3f
lea rcx, [rbp + 0x40]
call fcn.0056c0a0
test al, al
jne 0x577f44
xor rax, rax
jmp 0x577f46
mov al, 1
mov byte [rbp + 0x4f], al
nop
mov rcx, qword [rbp + 0x60]
mov rdx, qword [rbp + 0x68]
call sub.kernel32.dll_MoveFileW
mov dword [rbp + 0x3c], eax
nop
cmp byte [rbp + 0x4f], 0
je 0x577f8b
mov rcx, qword [rbp + 0x40]
call fcn.0056c0c0
test al, al
jne 0x577f8b
mov rcx, qword [0x004276a8]
mov dl, 1
lea r8, [0x00578000]
call fcn.0043b450
mov rcx, rax
call fcn.0040ea20
mov eax, dword [rbp + 0x3c]
lea rsp, [rbp + 0x50]
pop rbp
ret
Function at 0x578040
Capabilities:
Delete file

Disassembly:
push rbp
sub rsp, 0x50
mov rbp, rsp
mov qword [rbp + 0x28], rbp
mov qword [rbp + 0x60], rcx
call fcn.00417430
cmp byte [rax + 0x7b4], 0
je 0x57806b
lea rcx, [rbp + 0x40]
call fcn.0056c0a0
test al, al
jne 0x578070
xor rax, rax
jmp 0x578072
mov al, 1
mov byte [rbp + 0x4f], al
nop
mov rcx, qword [rbp + 0x60]
call sub.kernel32.dll_DeleteFileW
mov dword [rbp + 0x3c], eax
nop
cmp byte [rbp + 0x4f], 0
je 0x5780b3
mov rcx, qword [rbp + 0x40]
call fcn.0056c0c0
test al, al
jne 0x5780b3
mov rcx, qword [0x004276a8]
mov dl, 1
lea r8, [0x00578120]
call fcn.0043b450
mov rcx, rax
call fcn.0040ea20
mov eax, dword [rbp + 0x3c]
lea rsp, [rbp + 0x50]
pop rbp
ret

Function at 0x57d250
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbp
sub rsp, 0x40
mov rbp, rsp
mov qword [rbp + 0x28], rbp
mov qword [rbp + 0x50], rcx
mov qword [rbp + 0x58], rdx
mov dword [rbp + 0x60], r8d
mov qword [rbp + 0x68], r9
mov rax, qword [rbp + 0x68]
mov dword [rax], 0
cmp dword [rbp + 0x60], 0
jbe 0x57d332
mov dword [rbp + 0x38], 0
mov rcx, qword [rbp + 0x50]
mov edx, dword [rbp + 0x60]
mov r8d, 0x40
lea r9, [rbp + 0x38]
call sub.kernel32.dll_VirtualProtect
test eax, eax
setne al
mov byte [rbp + 0x37], al
cmp byte [rbp + 0x37], 0
je 0x57d332
nop
mov rcx, qword [rbp + 0x58]
mov rdx, qword [rbp + 0x50]
mov r8d, dword [rbp + 0x60]
call fcn.00408ce0
mov rax, qword [rbp + 0x68]
mov ecx, dword [rbp + 0x60]
mov dword [rax], ecx
mov eax, dword [rbp + 0x38]
sub eax, 0x10
cmp eax, 0x77
ja 0x57d2fa
lea rcx, [0x0057d3b4]
mov rdx, rcx
and rdx, 3
sub rcx, rdx
add rdx, rdx
add rdx, rdx
add rdx, rdx
add eax, edx
bt dword [rcx], eax
setb al
jmp 0x57d2fd
xor rax, rax
test al, al
je 0x57d316
call sub.kernel32.dll_GetCurrentProcess
mov rcx, rax
mov rdx, qword [rbp + 0x50]
mov r8d, dword [rbp + 0x60]
call sub.kernel32.dll_FlushInstructionCache
nop
mov dword [rbp + 0x3c], 0
mov rcx, qword [rbp + 0x50]
mov edx, dword [rbp + 0x60]
mov r8d, dword [rbp + 0x38]
lea r9, [rbp + 0x3c]
call sub.kernel32.dll_VirtualProtect
mov rax, qword [rbp + 0x68]
mov eax, dword [rax]
cmp eax, dword [rbp + 0x60]
sete al
mov byte [rbp + 0x37], al
movzx rax, byte [rbp + 0x37]
lea rsp, [rbp + 0x40]
pop rbp
ret
Function at 0x57e3b0
Capabilities:
Get file size

Disassembly:
push rbp
push rbx
sub rsp, 0x68
mov rbp, rsp
mov qword [rbp + 0x38], rbp
mov qword [rbp + 0x80], rcx
mov byte [rbp + 0x88], dl
mov qword [rbp + 0x90], r8
mov word [rbp + 0x98], r9w
cmp byte [rbp + 0x88], 0
je 0x57e3fd
mov rcx, qword [rbp + 0x80]
movzx rdx, byte [rbp + 0x88]
call fcn.0040cf20
mov qword [rbp + 0x80], rax
nop
mov rcx, qword [rbp + 0x80]
xor rdx, rdx
call fcn.0040c4c0
mov rcx, qword [rbp + 0x90]
movzx edx, word [rbp + 0x98]
call fcn.00432730
mov rcx, qword [rbp + 0x80]
mov qword [rcx + 0x20], rax
mov rax, qword [rbp + 0x80]
cmp qword [rax + 0x20], 0xffffffffffffffff
jne 0x57e43e
call fcn.0043ebc0
movzx rax, word [rbp + 0x98]
and ax, 0xf
cmp ax, 2
jne 0x57e460
mov dword [rbp + 0x5c], 8
mov dword [rbp + 0x58], 1
jmp 0x57e46e
mov dword [rbp + 0x5c], 2
mov dword [rbp + 0x58], 4
mov rax, qword [rbp + 0x80]
mov rcx, qword [rax + 0x20]
xor rdx, rdx
mov r8d, dword [rbp + 0x5c]
xor r9, r9
mov dword [rsp + 0x20], 0
mov qword [rsp + 0x28], 0
call sub.kernel32.dll_CreateFileMappingW
mov rcx, qword [rbp + 0x80]
mov qword [rcx + 0x28], rax
mov rax, qword [rbp + 0x80]
cmp qword [rax + 0x28], 0
jne 0x57e4db
mov rcx, qword [rbp + 0x80]
call fcn.0057e660
mov rcx, qword [0x0057e128]
mov dl, 1
mov r8, qword [0x00652d38]
call fcn.0043b6e0
mov rcx, rax
call fcn.0040ea20
mov rax, qword [rbp + 0x80]
mov rcx, qword [rax + 0x28]
mov edx, dword [rbp + 0x58]
xor r8, r8
xor r9, r9
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_MapViewOfFile
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x48], 0
jne 0x57e531
mov rcx, qword [rbp + 0x80]
call fcn.0057e660
mov rcx, qword [0x0057e268]
mov dl, 1
mov r8, qword [0x00653360]
call fcn.0043b6e0
mov rcx, rax
call fcn.0040ea20
mov rax, qword [rbp + 0x80]
mov rcx, qword [rax + 0x20]
xor rdx, rdx
call sub.kernel32.dll_GetFileSize_1
mov dword [rbp + 0x54], eax
cmp dword [rbp + 0x54], 0xffffffff
jne 0x57e57f
mov rcx, qword [rbp + 0x48]
call sub.kernel32.dll_UnmapViewOfFile
mov rcx, qword [rbp + 0x80]
call fcn.0057e660
mov rcx, qword [0x0057e268]
mov dl, 1
mov r8, qword [0x00653128]
call fcn.0043b6e0
mov rcx, rax
call fcn.0040ea20
mov rcx, qword [rbp + 0x80]
mov rdx, qword [rbp + 0x48]
mov r8d, dword [rbp + 0x54]
call fcn.0050e420
cmp byte [rbp + 0x88], 0
je 0x57e5ee
mov rcx, qword [rbp + 0x80]
call fcn.0040cf60
mov qword [rbp + 0x80], rax
jmp 0x57e5ee
mov rax, qword [rbp + 0x80]
lea rsp, [rbp + 0x68]
pop rbx
pop rbp
ret

Function at 0x57e930
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
sub rsp, 0x30
mov rbp, rsp
mov qword [rbp + 0x40], rcx
cmp qword [rbp + 0x40], 0
je 0x57e96c
mov rcx, qword [rbp + 0x40]
call sub.kernel32.dll_GetFileAttributesW
mov dword [rbp + 0x28], eax
cmp dword [rbp + 0x28], 0xffffffff
je 0x57e960
mov eax, dword [rbp + 0x28]
test eax, 0x10
je 0x57e965
xor rax, rax
jmp 0x57e967
mov al, 1
mov byte [rbp + 0x2f], al
jmp 0x57e970
mov byte [rbp + 0x2f], 0
movzx rax, byte [rbp + 0x2f]
lea rsp, [rbp + 0x30]
pop rbp
ret
Function at 0x595d90
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbp
push rbx
sub rsp, 0x48
mov rbp, rsp
mov qword [rbp + 0x28], 0
mov qword [rbp + 0x20], 0
mov qword [rbp + 0x60], rcx
mov qword [rbp + 0x68], rdx
nop
mov rcx, qword [rbp + 0x68]
lea rdx, [0x00595f28]
mov r8d, 0xa
call sub.kernel32.dll_FindResourceW
mov rcx, qword [rbp + 0x60]
test rax, rax
setne al
mov byte [rcx + 8], al
mov rax, qword [rbp + 0x60]
cmp byte [rax + 8], 0
je 0x595e6f
mov rcx, qword [rbp + 0x68]
mov rdx, qword [rbp + 0x60]
mov rax, qword [rbp + 0x60]
lea r8, [rax + 0x28]
lea r9, [0x00595d10]
call fcn.0043e760
mov rax, qword [rbp + 0x60]
cmp qword [rax + 0x18], 0
jne 0x595e3d
lea rcx, [rbp + 0x20]
mov rdx, qword [rbp + 0x68]
call fcn.0057e980
lea rcx, [rbp + 0x28]
mov rdx, qword [rbp + 0x20]
call fcn.0057e820
mov rax, qword [rbp + 0x60]
lea rcx, [rax + 0x18]
mov rdx, qword [rbp + 0x28]
lea r8, [0x00595f4c]
call fcn.00411650
mov rax, qword [rbp + 0x60]
cmp byte [rax + 0x39], 0
je 0x595e6f
mov rax, qword [rbp + 0x60]
mov rax, qword [rax + 0x10]
mov rcx, rax
mov rbx, qword [rax]
call qword [rbx + 0x148]
mov rax, qword [rbp + 0x60]
mov rax, qword [rax + 0x20]
mov rcx, rax
mov rbx, qword [rax]
call qword [rbx + 0x148]
mov rcx, qword [rbp + 0x68]
lea rdx, [0x00595f56]
mov r8d, 0xa
call sub.kernel32.dll_FindResourceW
mov qword [rbp + 0x38], rax
cmp qword [rbp + 0x38], 0
je 0x595ee2
mov rcx, qword [rbp + 0x68]
mov rdx, qword [rbp + 0x38]
call sub.kernel32.dll_LoadResource
mov qword [rbp + 0x30], rax
cmp qword [rbp + 0x30], 0
je 0x595ee2
mov rcx, qword [rbp + 0x30]
call sub.kernel32.dll_LockResource
mov rbx, rax
mov rcx, qword [rbp + 0x68]
mov rdx, qword [rbp + 0x38]
call sub.kernel32.dll_SizeofResource
mov rcx, qword [rbp + 0x60]
lea rcx, [rcx + 0x30]
mov rdx, rbx
mov r8d, eax
call fcn.00412950
mov rax, qword [rbp + 0x60]
lea rcx, [rax + 0x30]
call fcn.00580620
nop
lea rcx, [rbp + 0x20]
mov edx, 2
call fcn.0040f8e0
lea rsp, [rbp + 0x48]
pop rbx
pop rbp
ret
Function at 0x5bc680
Capabilities:
Suspend thread

Disassembly:
push rbp
sub rsp, 0x90
mov rbp, rsp
mov qword [rbp + 0x70], 0
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x60], 0
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x78], rbp
mov qword [rbp + 0xa0], rcx
nop
cmp byte [0x006470e8], 0
je 0x5bc763
lea rcx, [rbp + 0x68]
mov rax, qword [rbp + 0xa0]
mov edx, dword [rax + 0x18]
call fcn.00431ee0
mov rax, qword [rbp + 0xa0]
mov rcx, qword [rax]
lea rdx, [rbp + 0x60]
call fcn.0040c110
lea rcx, [rbp + 0x58]
mov rdx, qword [rbp + 0xa0]
call fcn.00578530
lea rcx, [rbp + 0x70]
mov edx, 8
lea r8, [0x005bc824]
mov rax, qword [rbp + 0xa0]
mov r9, qword [rax + 8]
lea rax, [0x005bc858]
mov qword [rsp + 0x20], rax
mov rax, qword [rbp + 0x68]
mov qword [rsp + 0x28], rax
lea rax, [0x005bc868]
mov qword [rsp + 0x30], rax
mov rax, qword [rbp + 0x60]
mov qword [rsp + 0x38], rax
lea rax, [0x005bc888]
mov qword [rsp + 0x40], rax
mov rax, qword [rbp + 0x58]
mov qword [rsp + 0x48], rax
call fcn.00411770
mov rcx, qword [rbp + 0x70]
call fcn.005b9670
mov rax, qword [rbp + 0xa0]
movzx rax, byte [rax + 0x1e]
mov byte [rbp + 0x8f], al
nop
mov rax, qword [rbp + 0xa0]
mov byte [rax + 0x1e], 1
mov rax, qword [rbp + 0xa0]
mov rcx, qword [rax + 0x10]
call sub.kernel32.dll_SuspendThread
mov rcx, qword [rbp + 0xa0]
test eax, eax
setge dl
call fcn.005bb850
jmp 0x5bc7c3
nop
lea rcx, [rbp + 0x58]
mov edx, 4
call fcn.0040f8e0
lea rsp, [rbp + 0x90]
pop rbp
ret

Function at 0x5bc890
Capabilities:
Resume thread

Disassembly:
push rbp
add rsp, 0xffffffffffffff80
mov rbp, rsp
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x60], 0
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x90], rcx
nop
cmp byte [0x006470e8], 0
je 0x5bc96c
lea rcx, [rbp + 0x60]
mov rax, qword [rbp + 0x90]
mov edx, dword [rax + 0x18]
call fcn.00431ee0
mov rax, qword [rbp + 0x90]
mov rcx, qword [rax]
lea rdx, [rbp + 0x58]
call fcn.0040c110
lea rcx, [rbp + 0x50]
mov rdx, qword [rbp + 0x90]
call fcn.00578530
lea rcx, [rbp + 0x68]
mov edx, 8
lea r8, [0x005bc9f4]
mov rax, qword [rbp + 0x90]
mov r9, qword [rax + 8]
lea rax, [0x005bca24]
mov qword [rsp + 0x20], rax
mov rax, qword [rbp + 0x60]
mov qword [rsp + 0x28], rax
lea rax, [0x005bca34]
mov qword [rsp + 0x30], rax
mov rax, qword [rbp + 0x58]
mov qword [rsp + 0x38], rax
lea rax, [0x005bca54]
mov qword [rsp + 0x40], rax
mov rax, qword [rbp + 0x50]
mov qword [rsp + 0x48], rax
call fcn.00411770
mov rcx, qword [rbp + 0x68]
call fcn.005b9670
mov rax, qword [rbp + 0x90]
mov rcx, qword [rax + 0x10]
call sub.kernel32.dll_ResumeThread
mov dword [rbp + 0x7c], eax
mov rcx, qword [rbp + 0x90]
cmp dword [rbp + 0x7c], 0
setge dl
call fcn.005bb850
cmp dword [rbp + 0x7c], 1
jne 0x5bc9a3
mov rax, qword [rbp + 0x90]
mov byte [rax + 0x1e], 0
nop
lea rcx, [rbp + 0x50]
mov edx, 4
call fcn.0040f8e0
lea rsp, [rbp + 0x80]
pop rbp
ret