joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14004af90
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x1401f2308]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x14004afbd
xor eax, eax
jmp 0x14004b11d
mov rdx, qword [rcx + 0x40]
mov rax, qword [rdx]
test rax, rax
je 0x14004afe8
mov rdx, qword [rcx + 0x58]
movsxd r8, dword [rdx]
add r8, rax
cmp rax, r8
jae 0x14004afe8
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], dil
mov eax, edi
jmp 0x14004b11d
cmp qword [rcx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x14004b110
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x14004b02b
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x14004b056
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x14004b115
lea rax, [rsp + 0x48]
mov byte [rsp + 0x40], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x41]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x40]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14004b0c5
sub eax, 1
je 0x14004b0c5
cmp eax, 2
jne 0x14004b110
movsx ecx, byte [rsp + 0x40]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x14004b115
mov rsi, qword [rsp + 0x48]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x14004b0f6
lfence
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x14004b110
lea rax, [rsp + 0x40]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x50], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x14004b115
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140160900
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x14004bb40
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x1401f2308]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x14004bc1d
cmp byte [rcx + 0x71], 0
je 0x14004bc1d
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
mov rax, qword [rax + 0x18]
call qword [case.0x1400309a4.0]
cmp eax, 0xffffffff
je 0x14004bc19
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14004bbdb
sub eax, 1
je 0x14004bbdf
cmp eax, 2
jne 0x14004bc19
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140160900
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x14004bc10
lfence
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14004bc19
cmp byte [rbx + 0x71], 0
sete al
jmp 0x14004bbc3
xor al, al
jmp 0x14004bbc3
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140160900
add rsp, 0x60
pop rbx
ret

Function at 0x14004f730
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rdi, r9
mov rcx, r9
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rsi, rax
test rax, rax
je 0x14004f794
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x14004f794
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [rbx + 0x10], rax
test rax, rax
je 0x14004f794
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [rbx + 0x18], eax
test eax, eax
jne 0x14004f7a6
mov qword [rbx + 0x10], 0
xor al, al
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
mov al, 1
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140059c10
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
mov rsi, qword [rsp + 0x40]
xor r11d, r11d
mov rbx, r8
mov rdi, rdx
mov rbp, rcx
test rsi, rsi
je 0x140059c31
mov qword [rsi], r11
test rbp, rbp
je 0x140059ddb
test rsi, rsi
je 0x140059ddb
lea rcx, [rdx + 2]
mov qword [rsi], r11
movabs r8, 0xaaaaaaaaaaaaaaab
mov rax, r8
mul rcx
shr rdx, 1
lea rdx, [rdx*4 + 2]
test rbx, rbx
je 0x140059dd8
cmp r9, rdx
jb 0x140059dd8
mov qword [rsp + 0x20], r12
mov rax, r8
mul rdi
mov qword [rsp + 0x28], r14
lea r12, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
mov r14, rdx
mov rcx, r11
shr r14, 1
je 0x140059d2f
mov qword [rsp + 0x30], r15
mov r15, r14
nop word [rax + rax]
movzx r8d, byte [r11 + rbp]
movzx r10d, byte [r11 + rbp + 1]
mov eax, r8d
movzx r9d, byte [r11 + rbp + 2]
and r8d, 3
shr rax, 2
add r11, 3
shl r8d, 4
mov edx, r8d
mov r8d, r9d
and r8d, 0x3f
movzx eax, byte [rax + r12]
mov byte [rcx + rbx], al
mov eax, r10d
shr rax, 4
and r10d, 0xf
or rdx, rax
shl r10d, 2
movzx eax, byte [rdx + r12]
mov byte [rcx + rbx + 1], al
mov eax, r9d
shr rax, 6
mov edx, r10d
or rdx, rax
movzx eax, byte [rdx + r12]
mov byte [rcx + rbx + 2], al
movzx eax, byte [r8 + r12]
mov byte [rcx + rbx + 3], al
add rcx, 4
sub r15, 1
jne 0x140059cb0
mov r15, qword [rsp + 0x30]
lea rax, [r14 + r14*2]
mov r14, qword [rsp + 0x28]
sub rdi, rax
sub rdi, 1
je 0x140059d91
cmp rdi, 1
jne 0x140059dbe
movzx edx, byte [r11 + rbp]
movzx r8d, byte [r11 + rbp + 1]
mov eax, edx
shr rax, 2
and edx, 3
shl edx, 4
movzx eax, byte [rax + r12]
mov byte [rcx + rbx], al
mov eax, r8d
shr rax, 4
and r8d, 0xf
or rdx, rax
shl r8d, 2
movzx eax, byte [rdx + r12]
mov byte [rcx + rbx + 1], al
movzx eax, byte [r8 + r12]
mov byte [rcx + rbx + 2], al
mov byte [rcx + rbx + 3], 0x3d
jmp 0x140059dba
movzx edx, byte [r11 + rbp]
mov eax, edx
and edx, 3
shr rax, 2
shl edx, 4
movzx eax, byte [rax + r12]
mov byte [rcx + rbx], al
movzx eax, byte [rdx + r12]
mov byte [rcx + rbx + 1], al
mov word [rcx + rbx + 2], 0x3d3d
add rcx, 4
mov r12, qword [rsp + 0x20]
mov al, 1
mov byte [rcx + rbx], 0
inc rcx
mov qword [rsi], rcx
mov rbx, qword [rsp + 0x38]
pop rdi
pop rsi
pop rbp
ret
mov qword [rsi], rdx
mov rbx, qword [rsp + 0x38]
xor al, al
pop rdi
pop rsi
pop rbp
ret
Function at 0x14005a8a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x280
mov rax, qword [0x1401f2308]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rdi, rcx
test rcx, rcx
je 0x14005a98a
xor ebp, ebp
cmp bp, word [rcx]
je 0x14005a98a
mov rsi, rcx
mov rcx, 0xffffffffffffffff
mov rbx, rcx
nop dword [rax]
inc rbx
cmp word [rdi + rbx*2], bp
jne 0x14005a8f0
lea rax, [rbx - 2]
cmp rax, 1
ja 0x14005a91c
cmp word [rdi + 2], 0x3a
jne 0x14005a91c
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14005a98a
test al, 0x10
jmp 0x14005a984
mov eax, 0x5c
cmp ax, word [rdi + rbx*2 - 2]
jne 0x14005a952
mov eax, 2
mul rbx
cmovo rax, rcx
mov rcx, rax
call fcn.140161128
mov r8, rdi
mov rdx, rbx
mov rcx, rax
mov rsi, rax
call fcn.140032170
mov word [rsi + rbx*2 - 2], bp
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
cmp rsi, rdi
je 0x14005a970
mov rcx, rsi
call fcn.140027f70
cmp rbx, 0xffffffffffffffff
je 0x14005a98a
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
test byte [rsp + 0x20], 0x10
je 0x14005a98a
mov al, 1
jmp 0x14005a98c
xor al, al
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140160900
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x14005a9c0
Capabilities:
Create directory

Disassembly:
push rbx
sub rsp, 0x40
xor eax, eax
lea r8, [rsp + 0x28]
xorps xmm0, xmm0
mov qword [rsp + 0x30], rax
mov rbx, rcx
xor r9d, r9d
movups xmmword [rsp + 0x20], xmm0
lea edx, [rax + 1]
mov dword [rsp + 0x20], 0x18
lea rcx, str.D:_A_OICI_GA___SY__A_OICI_GA___BA__A_OICI_GW___BU_
call fcn.14015e940
test eax, eax
jne 0x14005aa01
add rsp, 0x40
pop rbx
ret
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov rcx, qword [rsp + 0x28]
test eax, eax
setne bl
call qword [sym.imp.KERNEL32.dll_LocalFree]
movzx eax, bl
add rsp, 0x40
pop rbx
ret
Function at 0x14005ba50
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rdi
sub rsp, 0x40
mov rbp, rcx
lea rdi, [0x1401aa5f0]
mov rdx, rdi
mov ecx, 0x7d1
call fcn.14005aea0
mov rbx, rax
test rax, rax
jne 0x14005ba9e
lea rdi, [0x1401aa5c8]
mov ecx, 0x7d1
mov rdx, rdi
call fcn.14005aea0
mov rbx, rax
test rax, rax
je 0x14005bb2e
mov r8, rdi
mov edx, 0x7d1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdi, rax
test rax, rax
je 0x14005bb2e
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x14005bb2e
mov rcx, rax
mov qword [rsp + 0x50], rsi
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rsi, rax
test rax, rax
je 0x14005bb29
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
test eax, eax
je 0x14005bb29
call fcn.14005b320
mov r10, rax
test rax, rax
je 0x14005bb29
lea rax, vtable.._AVSvgGroup__1__Svg_CLayoutDataSource_layout__QEAAXK_Z_.0
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x30], rax
lea rdx, [rsp + 0x30]
mov rcx, qword [r10]
mov r9d, ebx
mov r8, rsi
mov rax, qword [rcx + 0x10]
mov rcx, r10
call qword [case.0x1400309a4.0]
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x14005bf50
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rsi, r9
mov rcx, r9
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbp, rax
test rax, rax
je 0x14005bfb2
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x14005bfb2
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
test rax, rax
je 0x14005bfb2
mov rdx, rbp
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
test eax, eax
je 0x14005bfb2
mov qword [rbx], rdi
jmp 0x14005bfb7
xor eax, eax
mov qword [rbx], rax
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov dword [rbx + 8], eax
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14005c420
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rbp
mov qword [rsp + 8], rcx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x70
movzx r15d, r9b
mov ebp, r8d
mov r12, rdx
xor r14d, r14d
xor ebx, ebx
lea rsi, [0x1401fb820]
movzx edi, r8w
mov rcx, qword [rsi]
test rcx, rcx
je 0x14005c48f
movzx edi, bp
mov edx, edi
lea r8, [0x1401aa5c8]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
jne 0x14005c481
inc ebx
add rsi, 8
cmp ebx, 0xa
jl 0x14005c455
jmp 0x14005c48f
movsxd rax, ebx
lea r14, [0x1401fb820]
mov r14, qword [r14 + rax*8]
movzx edx, di
lea r8, [0x1401aa5c8]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
je 0x14005c675
mov rdx, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x14005c675
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
test rax, rax
je 0x14005c675
mov rdx, rbx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SizeofResource]
test eax, eax
je 0x14005c675
mov qword [rsp + 0x60], rdi
mov dword [rsp + 0x68], eax
lea rcx, [rsp + 0x60]
call fcn.14005b150
mov rbx, rax
test rax, rax
je 0x14005c675
cmp dword [rax + 8], 0
je 0x14005c656
mov ecx, dword [rax + 0xc]
test ecx, ecx
je 0x14005c656
mov edx, ecx
call fcn.1400433c0
mov rdi, rax
test rax, rax
je 0x14005c656
mov qword [rsp + 0x60], 0
cmp qword [rax], 0
je 0x14005c55a
call fcn.140043320
lea rdx, [rsp + 0x60]
mov rcx, qword [rdi]
mov rax, qword [rax + 0x48]
call qword [case.0x1400309a4.0]
nop
call fcn.140043320
xor r8d, r8d
lea edx, [r8 + 3]
mov rcx, qword [rsp + 0x60]
mov rax, qword [rax + 0x1f0]
call qword [case.0x1400309a4.0]
call fcn.140043320
mov edx, 3
lea r8d, [rdx - 2]
mov rcx, qword [rsp + 0x60]
mov rax, qword [rax + 0x1f0]
call qword [case.0x1400309a4.0]
mov ecx, dword [rbx + 0xc]
mov dword [rsp + 0xb0], ecx
mov dword [rsp + 0xa0], ecx
mov eax, r15d
imul eax, ecx
mov dword [rsp + 0x58], eax
mov dword [rsp + 0x50], 0
call fcn.140043320
lea rcx, [rsp + 0xb0]
mov qword [rsp + 0x40], rcx
lea rcx, [rsp + 0xa0]
mov qword [rsp + 0x38], rcx
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0xff
xorps xmm3, xmm3
xorps xmm2, xmm2
mov rdx, qword [rbx]
mov rcx, qword [rsp + 0x60]
mov rax, qword [rax + 0x1b8]
call qword [case.0x1400309a4.0]
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0xc0]
mov r8, rdi
mov rdx, r12
call fcn.14005cbf0
mov rcx, rdi
call fcn.140048080
nop
cmp qword [rsp + 0x60], 0
je 0x14005c656
call fcn.140043320
mov rcx, qword [rsp + 0x60]
mov rax, qword [rax + 0x50]
call qword [case.0x1400309a4.0]
call fcn.140043320
mov rcx, qword [rbx]
mov rax, qword [rax + 8]
call qword [case.0x1400309a4.0]
mov edx, reloc.WS2_32.dll_recv
mov rcx, rbx
call fcn.140027f70
mov al, 1
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x14005c690
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
movzx r15d, r9w
mov ebp, r8d
mov r12, rdx
xor r14d, r14d
xor ebx, ebx
lea r13, [0x1401fb820]
mov rsi, r13
movzx edi, r8w
mov rcx, qword [rsi]
test rcx, rcx
je 0x14005c6fa
movzx edi, bp
mov edx, edi
lea r8, [0x1401aa5c8]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
jne 0x14005c6f2
inc ebx
add rsi, 8
cmp ebx, 0xa
jl 0x14005c6c6
jmp 0x14005c6fa
movsxd rax, ebx
mov r14, qword [r13 + rax*8]
movzx edx, di
lea r8, [0x1401aa5c8]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
je 0x14005c8f6
mov rdx, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x14005c8f6
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
test rax, rax
je 0x14005c8f6
mov rdx, rbx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SizeofResource]
test eax, eax
je 0x14005c8f6
mov qword [rsp + 0x60], rdi
mov dword [rsp + 0x68], eax
lea rcx, [rsp + 0x60]
call fcn.14005b150
mov rbx, rax
test rax, rax
je 0x14005c8f6
cmp dword [rax + 8], 0
je 0x14005c8d7
cmp dword [rax + 0xc], 0
je 0x14005c8d7
movzx esi, word [rsp + 0xd0]
mov ebp, r15d
mov edx, esi
mov ecx, r15d
call fcn.1400433c0
mov rdi, rax
test rax, rax
je 0x14005c8d7
mov qword [rsp + 0x60], 0
cmp qword [rax], 0
je 0x14005c7d2
call fcn.140043320
lea rdx, [rsp + 0x60]
mov rcx, qword [rdi]
mov rax, qword [rax + 0x48]
call qword [case.0x1400309a4.0]
nop
call fcn.140043320
xor r8d, r8d
lea edx, [r8 + 3]
mov rcx, qword [rsp + 0x60]
mov rax, qword [rax + 0x1f0]
call qword [case.0x1400309a4.0]
call fcn.140043320
mov edx, 3
lea r8d, [rdx - 2]
mov rcx, qword [rsp + 0x60]
mov rax, qword [rax + 0x1f0]
call qword [case.0x1400309a4.0]
mov dword [rsp + 0xc0], esi
mov dword [rsp + 0xb0], ebp
movzx eax, word [rsp + 0xe0]
imul eax, esi
mov dword [rsp + 0x50], eax
movzx eax, word [rsp + 0xd8]
imul eax, ebp
mov dword [rsp + 0x58], eax
call fcn.140043320
lea rcx, [rsp + 0xc0]
mov qword [rsp + 0x40], rcx
lea rcx, [rsp + 0xb0]
mov qword [rsp + 0x38], rcx
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0xff
xorps xmm3, xmm3
xorps xmm2, xmm2
mov rdx, qword [rbx]
mov rcx, qword [rsp + 0x60]
mov rax, qword [rax + 0x1b8]
call qword [case.0x1400309a4.0]
mov rax, qword [rsp + 0xf0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0xe8]
mov r8, rdi
mov rdx, r12
call fcn.14005cbf0
mov rcx, rdi
call fcn.140048080
nop
cmp qword [rsp + 0x60], 0
je 0x14005c8d7
call fcn.140043320
mov rcx, qword [rsp + 0x60]
mov rax, qword [rax + 0x50]
call qword [case.0x1400309a4.0]
call fcn.140043320
mov rcx, qword [rbx]
mov rax, qword [rax + 8]
call qword [case.0x1400309a4.0]
mov edx, reloc.WS2_32.dll_recv
mov rcx, rbx
call fcn.140027f70
mov al, 1
mov rbx, qword [rsp + 0xb8]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14005e580
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x14005e5f8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x14005e5f8
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
add rcx, rbx
and edi, 0xf
jbe 0x14005e5e5
nop
cmp rbx, rcx
jae 0x14005e5f8
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
add edi, 0xffffffff
jne 0x14005e5d0
cmp rbx, rcx
jae 0x14005e5f8
cmp word [rbx], 0
je 0x14005e5f8
lfence
mov rax, rbx
jmp 0x14005e5fa
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x14005f940
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r12
push r14
push r15
sub rsp, 0x20
lea r12, [0x1401fb820]
mov r14, r8
mov rdi, r12
mov r15, rdx
mov rsi, rcx
xor ebx, ebx
nop
mov rcx, qword [rdi]
test rcx, rcx
je 0x14005f997
mov r8d, reloc.WS2_32.dll_socket
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
jne 0x14005f9b3
inc ebx
add rdi, 8
cmp ebx, 0xa
jl 0x14005f970
xor al, al
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
movsxd rax, ebx
mov rbx, qword [r12 + rax*8]
test rbx, rbx
je 0x14005f997
mov r8d, reloc.WS2_32.dll_socket
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdi, rax
test rax, rax
je 0x14005f997
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x14005f997
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [r15], rax
test rax, rax
je 0x14005f997
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [r14], eax
test eax, eax
je 0x14005f997
lea ecx, [rax + 1]
call fcn.140161128
mov r8d, dword [r14]
mov rcx, rax
mov rdx, qword [r15]
mov rbx, rax
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [r14]
mov byte [rcx + rbx], 0
mov rcx, rbx
mov r8d, dword [r14]
call fcn.140008b90
mov al, 1
mov qword [r15], rbx
jmp 0x14005f999
Function at 0x140060a60
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x30
movzx ebp, dx
lea rbx, [0x1401fb820]
mov rsi, rcx
call fcn.14005af20
xor r15d, r15d
lea r12, [0x1401a3ce0]
cmp rbx, rax
je 0x140060b45
movzx eax, bp
shr ax, 4
inc ax
movzx r14d, ax
mov rdi, qword [rbx]
mov r8, r14
movzx r9d, word [0x1401fb870]
mov rcx, rdi
mov edx, 6
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
test rax, rax
je 0x140060b29
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
je 0x140060b29
movzx edx, word [rax]
lea rax, [rax + 2]
mov ecx, ebp
and ecx, 0xf
je 0x140060b10
nop word [rax + rax]
lea rax, [rax + rdx*2]
movzx edx, word [rax]
add rax, 2
sub ecx, 1
jne 0x140060b00
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rdx
test rdx, rdx
je 0x140060b33
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rsi], xmm0
jmp 0x140060b4c
mov qword [rsp + 0x20], r12
mov qword [rsp + 0x28], r15
add rbx, 8
call fcn.14005af20
cmp rbx, rax
jne 0x140060ab1
mov qword [rsi], r12
mov qword [rsi + 8], r15
mov rbx, qword [rsp + 0x50]
mov rax, rsi
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r12
ret
Function at 0x1400801f0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push rdi
sub rsp, 0x20
mov rdi, rcx
test rcx, rcx
je 0x1400802c5
xor eax, eax
cmp ax, word [rcx]
je 0x1400802c5
mov qword [rsp + 0x38], rbp
xor ecx, ecx
xor bpl, bpl
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x1400802b6
mov qword [rsp + 0x30], rbx
mov rbx, 0xffffffffffffffff
mov qword [rsp + 0x40], rsi
inc rbx
cmp word [rdi + rbx*2], 0
jne 0x140080236
inc rbx
mov ecx, 0x42
lea rdx, [rbx + rbx]
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rsi, rax
test rax, rax
je 0x1400802a6
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
test rax, rax
je 0x14008029d
mov r8, rdi
mov rdx, rbx
mov rcx, rax
call fcn.140032170
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
call qword [sym.imp.USER32.dll_EmptyClipboard]
mov rdx, rsi
mov ecx, ntohs
call qword [sym.imp.USER32.dll_SetClipboardData]
test rax, rax
je 0x14008029d
mov bpl, 1
jmp 0x1400802a6
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalFree]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
movzx eax, bpl
mov rbp, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
xor al, al
add rsp, 0x20
pop rdi
ret

Function at 0x1400807e0
Capabilities:
Get geographical location

Disassembly:
sub rsp, 0x28
cmp byte [0x1401fdc08], 0
jne 0x1400808ce
xor r9d, r9d
mov qword [rsp + 0x30], rbx
xor r8d, r8d
mov qword [rsp + 0x20], rdi
mov ecx, 0x400
lea edx, [r9 + 0x11]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov r9d, 4
mov dword [0x1401fdc1c], 1
lea rdi, [0x1401fdc10]
mov dword [0x1401fdc18], eax
mov r8, rdi
mov dword [0x1401fdc20], 3
mov ecx, 0x400
mov dword [0x1401fdc38], 0
lea edx, [r9 + 0xa]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov rbx, 0xffffffffffffffff
mov rax, rbx
nop dword [rax]
inc rax
cmp word [rdi + rax*2], 0
jne 0x140080860
cmp rax, 3
mov r9d, 4
mov ecx, 0x400
cmova rdi, qword [0x1401fdc28]
mov qword [0x1401fdc28], rdi
lea rdi, [0x1401fdc40]
mov r8, rdi
lea edx, [r9 + 0xb]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
nop dword [rax]
inc rbx
cmp word [rdi + rbx*2], 0
jne 0x1400808a0
cmp rbx, 3
mov byte [0x1401fdc08], 1
mov rbx, qword [rsp + 0x30]
cmova rdi, qword [0x1401fdc30]
mov qword [0x1401fdc30], rdi
mov rdi, qword [rsp + 0x20]
lea rax, [0x1401fdc18]
add rsp, 0x28
ret