joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140161970
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x40
call fcn.140189b00
sub rsp, rax
mov rax, qword [0x1401f3660]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0xa0]
mov r14, qword [rsp + 0xa8]
mov esi, r8d
movzx r10d, byte [rax]
movzx r8d, byte [rax + 4]
mov ebx, dword [r14]
lea rdi, [rax + 1]
mov qword [rsp + 0x28], rax
shl r10d, 0x18
movzx eax, byte [rdi]
mov rbp, rcx
movzx ecx, byte [rdi + 5]
shl eax, 0x10
shl r8d, 0x18
shl ecx, 8
or r10d, eax
movzx eax, byte [rdi + 1]
mov r12, rdx
shl eax, 8
lea rdx, [rdi + 5]
xor r13d, r13d
or r10d, eax
movzx eax, byte [rdi + 2]
mov r15, r9
or r10d, eax
movzx eax, byte [rdi + 4]
shl eax, 0x10
mov dword [rsp + 0x20], r10d
mov byte [rsp + 0x33], r10b
or r8d, eax
movzx eax, byte [rdx + 1]
or ecx, eax
mov eax, r10d
shr eax, 0x18
or r8d, ecx
mov byte [rsp + 0x30], al
mov eax, r10d
mov dword [rsp + 0x24], r8d
shr eax, 0x10
mov byte [rsp + 0x37], r8b
mov byte [rsp + 0x31], al
mov eax, r10d
shr eax, 8
mov byte [rsp + 0x32], al
mov eax, r8d
shr eax, 0x18
mov byte [rsp + 0x34], al
mov eax, r8d
shr eax, 0x10
mov byte [rsp + 0x35], al
mov eax, r8d
shr eax, 8
test esi, esi
mov byte [rsp + 0x36], al
je 0x140161b46
movzx edx, r8b
movzx r9d, r10b
sub esi, 1
test ebx, ebx
jne 0x140161add
lea rcx, [rsp + 0x20]
mov rdx, r15
call fcn.140160830
mov r10d, dword [rsp + 0x20]
mov r8d, dword [rsp + 0x24]
mov eax, r10d
mov dl, r8b
mov r9b, r10b
shr eax, 0x18
mov byte [rsp + 0x33], r10b
mov byte [rsp + 0x37], dl
mov byte [rsp + 0x30], al
mov eax, r10d
shr eax, 0x10
mov byte [rsp + 0x31], al
mov eax, r10d
shr eax, 8
mov byte [rsp + 0x32], al
mov eax, r8d
shr eax, 0x18
mov byte [rsp + 0x34], al
mov eax, r8d
shr eax, 0x10
mov byte [rsp + 0x35], al
mov eax, r8d
shr eax, 8
add r13d, 1
mov byte [rsp + 0x36], al
movsxd rax, ebx
add ebx, 1
add r12, 1
movzx ecx, byte [rsp + rax + 0x30]
add rbp, 1
and ebx, 7
xor cl, byte [rbp - 1]
test esi, esi
mov byte [r12 - 1], cl
jne 0x140161a70
test r13d, r13d
je 0x140161b46
mov rcx, qword [rsp + 0x28]
mov eax, r10d
shr eax, 0x18
mov byte [rcx], al
mov eax, r10d
shr r10d, 8
shr eax, 0x10
mov byte [rdi], al
mov byte [rdi + 1], r10b
mov byte [rdi + 2], r9b
mov eax, r8d
shr eax, 0x18
mov byte [rdi + 3], al
mov eax, r8d
shr eax, 0x10
shr r8d, 8
mov byte [rdi + 4], al
mov byte [rdi + 5], r8b
mov byte [rdi + 6], dl
mov dword [r14], ebx
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140041910
mov rbx, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140161b70
Capabilities:
Encode data using xor
Encrypt data using blowfish
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
mov eax, reloc.WLDAP32.dll_Ordinal_32
call fcn.140189b00
sub rsp, rax
mov ebx, edx
mov rsi, r8
lea rdx, [0x1401c5470]
mov r8d, 0x1048
mov rdi, rcx
call fcn.140042d30
mov eax, 0x48
mov rdx, rsi
cmp ebx, eax
cmovg ebx, eax
movsxd r8, ebx
add r8, rsi
xor ebx, ebx
mov r9, rbx
nop
nop
movzx ecx, byte [rdx]
add rdx, 1
cmp rdx, r8
cmovae rdx, rsi
shl ecx, 8
movzx eax, byte [rdx]
add rdx, 1
or ecx, eax
cmp rdx, r8
cmovae rdx, rsi
shl ecx, 8
movzx eax, byte [rdx]
add rdx, 1
or ecx, eax
cmp rdx, r8
cmovae rdx, rsi
shl ecx, 8
movzx eax, byte [rdx]
add rdx, 1
or ecx, eax
cmp rdx, r8
cmovae rdx, rsi
xor dword [rdi + r9*4], ecx
add r9, 1
cmp r9, 0x12
jl 0x140161bc0
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x34], ebx
mov rsi, rbx
lea rcx, [rsp + 0x30]
mov rdx, rdi
call fcn.140160830
mov eax, dword [rsp + 0x30]
add rsi, 2
cmp rsi, 0x12
mov dword [rdi + rsi*4 - 8], eax
mov eax, dword [rsp + 0x34]
mov dword [rdi + rsi*4 - 4], eax
jl 0x140161c20
nop
nop
nop
lea rcx, [rsp + 0x30]
mov rdx, rdi
call fcn.140160830
mov eax, dword [rsp + 0x30]
add rbx, 2
cmp rbx, 0x400
mov dword [rdi + rbx*4 + 0x40], eax
mov eax, dword [rsp + 0x34]
mov dword [rdi + rbx*4 + 0x44], eax
jl 0x140161c50
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140183780
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x450
mov rax, qword [0x1401f3660]
xor rax, rsp
mov qword [rsp + 0x440], rax
mov edi, dword [r8]
xor r15d, r15d
mov r12, r8
test edi, edi
mov rbp, rdx
mov r13, rcx
mov esi, r15d
je 0x140183829
mov r14d, 0x400
nop
nop
nop
mov ebx, edi
cmp edi, r14d
lea rcx, [rsp + 0x40]
cmova ebx, r14d
mov rdx, rbp
mov r8d, ebx
call fcn.140042d30
mov rcx, qword [r13]
lea r9, [rsp + 0x30]
lea rdx, [rsp + 0x40]
mov r8d, ebx
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x14018381a
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x5aa
je 0x140183825
xor al, al
jmp 0x14018382f
mov eax, dword [rsp + 0x30]
add esi, eax
sub edi, eax
add rbp, rax
test edi, edi
jne 0x1401837d0
mov dword [r12], esi
mov al, 1
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.140041910
mov rbx, qword [rsp + 0x4a8]
add rsp, 0x450
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140002816
Capabilities:
Delete directory

Disassembly:
mov qword [rsp + 8], rcx
push r15
xor rax, rax
push rax
sub rsp, 0x28
call fcn.140012bb0
mov r15, qword [rsp + 0x28]
cmp r15, 1
jne 0x140002852
push qword [0x1400204d4]
pop rcx
call fcn.140007168
and rax, rax
je 0x140002852
push qword [0x1400204d4]
pop rcx
call fcn.140007204
push qword [0x140020584]
pop rcx
call fcn.14000e1bc
push qword [0x140020564]
pop rcx
call fcn.14000e1bc
call fcn.140004737
push qword [0x140020524]
pop rcx
call fcn.14000e1bc
push qword [0x1400204fc]
pop rcx
call sub.KERNEL32.dll_RemoveDirectoryW
push qword [0x140020594]
pop rcx
call sub.KERNEL32.dll_RemoveDirectoryW
mov rax, qword [rsp + 0x40]
mov qword [0x1400204cc], rax
jmp 0x140001250
Function at 0x14000335d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
xor rax, rax
push rax
push rax
sub rsp, 0x28
call fcn.140012bb0
push qword [rsp + 0x48]
push qword [rsp + 0x48]
pop rcx
pop rdx
call sub.KERNEL32.dll_LoadResource
mov qword [rsp + 0x28], rax
push qword [rsp + 0x48]
push qword [rsp + 0x48]
pop rcx
pop rdx
call sub.KERNEL32.dll_SizeofResource
mov qword [0x1400204e4], rax
push qword [0x1400204e4]
pop rcx
call fcn.14000d130
mov qword [rsp + 0x30], rax
push qword [0x1400204e4]
push qword [rsp + 0x38]
push qword [rsp + 0x38]
pop rcx
pop rdx
pop r8
call fcn.14000d260
push qword [rsp + 0x28]
pop rcx
call sub.KERNEL32.dll_FreeResource
mov rax, qword [rsp + 0x30]
jmp 0x1400033db
add rsp, 0x38
ret

Function at 0x140004612
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
xor rax, rax
push rax
push rax
push rax
push rax
sub rsp, 0x28
call fcn.140012bb0
mov rcx, qword [rsp + 0x70]
call fcn.1400069e4
mov rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0x28]
sub rsp, 0x10
call fcn.140012a60
add rsp, 0x10
mov rdx, qword [rsp + 0x58]
lea rcx, [rsp + 0x30]
sub rsp, 0x10
call fcn.140012a60
add rsp, 0x10
push rcx
sub rsp, 0x28
call fcn.140012930
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.140012930
add rsp, 0x28
pop rcx
push rax
push 0x800
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140008160
add rsp, 0x28
lea rcx, [rsp + 0x40]
pop rdx
call fcn.140012980
push 0x800
push qword [rsp + 0x40]
pop rcx
pop rdx
call sub.KERNEL32.dll_GetSystemDirectoryW
push qword [rsp + 0x38]
pop rcx
call sub.SHLWAPI.DLL_PathAddBackslashW
mov rcx, qword [rsp + 0x38]
push rcx
sub rsp, 0x28
call fcn.140012930
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140012c20
add rsp, 0x28
pop rax
push rax
call fcn.140012d10
pop rdx
add rax, rdx
jmp 0x1400046fa
push rax
mov rcx, qword [rsp + 0x30]
sub rsp, 0x28
call fcn.140012b30
add rsp, 0x28
mov rcx, qword [rsp + 0x38]
sub rsp, 0x28
call fcn.140012b30
add rsp, 0x28
mov rcx, qword [rsp + 0x40]
sub rsp, 0x28
call fcn.140012b30
add rsp, 0x28
pop rax
add rsp, 0x48
ret
Function at 0x140004737
Capabilities:
Delete directory

Disassembly:
push rbp
push r15
xor rax, rax
push rax
push rax
sub rsp, 0x28
call fcn.140012bb0
mov r15, qword [0x140020504]
cmp r15, 1
jne 0x140004806
push qword [0x1400205f4]
pop rcx
call fcn.14000dd04
mov r15, rax
and r15, r15
jle 0x14000479c
mov rcx, qword [0x1400205f4]
call fcn.14000dd0c
mov rcx, qword [0x1400205f4]
call fcn.14000dd20
or rax, rax
je 0x14000479c
mov rbp, qword [0x1400205fc]
push qword [rbp + 0x10]
pop rcx
call fcn.14000e1bc
jmp 0x140004779
push qword [0x1400205e4]
pop rcx
call fcn.14000dd04
mov qword [rsp + 0x28], rax
mov r15, qword [rsp + 0x28]
and r15, r15
jle 0x140004806
push 5
push 0
push 1
push qword [0x1400205e4]
pop rcx
pop rdx
pop r8
pop r9
call fcn.140009060
mov rcx, qword [0x1400205e4]
call fcn.14000dd0c
mov rcx, qword [0x1400205e4]
call fcn.14000dd20
or rax, rax
je 0x140004806
mov rbp, qword [0x1400205ec]
push qword [rbp + 0x14]
pop rcx
call sub.KERNEL32.dll_RemoveDirectoryW
jmp 0x1400047e3
mov rax, 1
jmp 0x140004812
add rsp, 0x38
pop r15
pop rbp
ret

Function at 0x1400069e4
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rcx
call sub.KERNEL32.dll_GetLastError
mov qword [rsp + 0x38], rax
mov rcx, qword [0x14001f180]
call sub.KERNEL32.dll_TlsGetValue
mov rcx, qword [rsp + 0x30]
mov qword [rax + 0x10], rcx
mov rcx, qword [rsp + 0x38]
call sub.KERNEL32.dll_SetLastError
mov rax, qword [rsp + 0x28]
add rsp, 0x48
ret

Function at 0x140007204
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
call fcn.140007194
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateThread]
lea rcx, [0x140021200]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x140020630]
jmp 0x140007240
cmp qword [rbx + 0x18], rdi
je 0x140007247
mov rbx, qword [rbx]
test rbx, rbx
jne 0x140007237
jmp 0x140007261
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbx + 0x10]
lea rcx, [0x140020630]
call fcn.1400123b8
lea rcx, [0x140021200]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x14000727c
Capabilities:
Create thread

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x30
lea rax, [r11 + 0x18]
mov r9, rdx
mov r8, rcx
mov qword [r11 - 0x10], rax
xor edi, edi
mov edx, 0x1000
xor ecx, ecx
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbp, rax
test rax, rax
je 0x140007342
lea rcx, [0x140021200]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x140020630]
jmp 0x140007306
lea rsi, [rbx + 0x10]
xor edx, edx
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x140007303
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rbx]
lea rcx, [0x140020630]
mov rdx, rsi
call fcn.1400123b8
jmp 0x140007306
mov rbx, qword [rbx]
test rbx, rbx
jne 0x1400072d3
mov rdx, qword [0x14001f110]
lea rcx, [0x140020630]
mov rdi, rdx
inc rdx
mov qword [0x14001f110], rdx
lea edx, [rbx + 0x20]
call fcn.140012400
lea rcx, [0x140021200]
mov qword [rax], rbp
mov qword [rax + 8], rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
mov rax, rdi
add rsp, 0x30
pop rdi
ret

Function at 0x140007450
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push r12
push r13
push r15
sub rsp, 0x28
xor r15d, r15d
mov r13d, r9d
mov r12d, edx
mov ebp, r15d
cmp edx, 1
jl 0x1400075b4
mov qword [rsp + 0x50], rbx
test rcx, rcx
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x20], r14
lea r14, [0x14001968c]
mov rbx, r14
mov edi, r15d
cmovne rbx, rcx
test r8, r8
cmovne r14, r8
mov rsi, rbx
movzx ecx, word [r14]
test cx, cx
je 0x140007580
cmp word [r14 + 2], di
je 0x140007580
or rax, 0xffffffffffffffff
nop
inc rax
cmp word [r14 + rax*2], di
jne 0x1400074c0
movsxd r15, eax
nop dword [rax]
mov r8, r15
mov rdx, r14
mov rcx, rbx
call sub.msvcrt.dll_wcsncmp
test eax, eax
je 0x1400074ed
cmp word [rbx], bp
je 0x1400074ed
add rbx, 2
jmp 0x1400074d0
inc edi
cmp edi, r12d
je 0x140007502
cmp word [rbx], bp
je 0x14000750b
lea rbx, [rbx + r15*2]
mov rsi, rbx
jmp 0x1400074d0
mov rbp, rbx
sub rbp, rsi
sar rbp, 1
xor r15d, r15d
mov rcx, rbx
call fcn.140012da0
mov r14, qword [rsp + 0x20]
mov edi, eax
test eax, eax
je 0x14000753a
mov ecx, r13d
call fcn.140012e10
movsxd r8, ebp
mov rdx, rsi
mov rcx, rax
add r8, r8
call sub.msvcrt.dll_memmove
mov edx, r13d
mov ecx, ebp
call fcn.140012e40
test edi, edi
mov rdi, qword [rsp + 0x60]
mov rbx, rax
jne 0x14000755e
movsxd r8, ebp
mov rdx, rsi
mov rcx, rax
call sub.msvcrt.dll_wcsncpy
mov rsi, qword [rsp + 0x58]
movsxd rcx, ebp
mov word [rbx + rcx*2], r15w
mov rbx, qword [rsp + 0x50]
add rsp, 0x28
pop r15
pop r13
pop r12
pop rbp
ret
movzx eax, word [rbx]
cmp ax, cx
je 0x14000758d
test ax, ax
jne 0x1400075a0
inc edi
cmp edi, edx
je 0x1400075a6
test ax, ax
je 0x14000750e
lea rsi, [rbx + 2]
add rbx, 2
jmp 0x140007580
mov rbp, rbx
sub rbp, rsi
sar rbp, 1
jmp 0x14000750e
mov ecx, r9d
add rsp, 0x28
pop r15
pop r13
pop r12
pop rbp
jmp fcn.140012f20
Function at 0x140012980
Capabilities:
Get thread local storage value

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov ecx, dword [0x14001f180]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x28], rax
movsxd rax, dword [rsp + 0x48]
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 0x10]
sub rcx, rax
mov rax, rcx
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x40]
cmp qword [rax], 0
jne 0x1400129e6
movsxd rax, dword [rsp + 0x20]
add rax, 0xa
mov r8, rax
xor edx, edx
mov rcx, qword [0x1400213a0]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, qword [rsp + 0x40]
mov qword [rcx], rax
jmp 0x140012a11
movsxd rax, dword [rsp + 0x20]
add rax, 0xa
mov r9, rax
mov rax, qword [rsp + 0x40]
mov r8, qword [rax]
xor edx, edx
mov rcx, qword [0x1400213a0]
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov rcx, qword [rsp + 0x40]
mov qword [rcx], rax
movsxd rax, dword [rsp + 0x20]
xor edx, edx
mov ecx, 2
div rcx
movsxd rcx, dword [rsp + 0x48]
mov rdx, qword [rsp + 0x28]
add rcx, qword [rdx]
mov r8d, eax
mov rdx, rcx
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax]
call fcn.140012f90
movsxd rax, dword [rsp + 0x48]
mov rcx, qword [rsp + 0x28]
mov qword [rcx + 0x10], rax
add rsp, 0x38
ret

Function at 0x140012bb0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
cmp dword [0x14001f180], 0xffffffff
jne 0x140012bdf
call fcn.1400127d0
mov ecx, dword [0x14001f180]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdx, rax
lea rcx, [0x140012b60]
call fcn.140017434
jmp 0x140012c10
mov ecx, dword [0x14001f180]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
jne 0x140012c10
call fcn.140013360
mov ecx, dword [0x14001f180]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdx, rax
lea rcx, [0x140012b60]
call fcn.140017434
add rsp, 0x28
ret

Function at 0x140012c90
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x38
mov ecx, dword [0x14001f180]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov rax, qword [rax + 0x10]
add rax, 2
mov rcx, qword [rsp + 0x20]
mov qword [rcx + 0x10], rax
add rsp, 0x38
ret

Function at 0x140012cc0
Capabilities:
Get thread local storage value

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x38
mov ecx, dword [0x14001f180]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x20], rax
movsxd rax, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x20]
mov qword [rcx + 0x10], rax
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x20]
add rax, qword [rcx + 0x10]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
add rsp, 0x38
ret

Function at 0x140012d10
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x38
mov ecx, dword [0x14001f180]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
add rsp, 0x38
ret
Function at 0x140015540
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x1400155b5
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x1400155b5
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
add rcx, rbx
and edi, 0xf
jbe 0x1400155a5
nop
cmp rbx, rcx
jae 0x1400155b5
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
add edi, 0xffffffff
jne 0x140015590
cmp rbx, rcx
jae 0x1400155b5
cmp word [rbx], 0
je 0x1400155b5
mov rax, rbx
jmp 0x1400155b7
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1400155d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov eax, r8d
mov rsi, rdx
shr eax, 4
mov edi, r8d
inc ax
mov r14, rcx
movzx edx, ax
mov r8d, 6
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbp, rax
test rax, rax
je 0x1400156eb
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x1400156eb
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x1400156eb
mov rdx, rbp
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
add rcx, rbx
and edi, 0xf
jbe 0x140015679
nop word [rax + rax]
cmp rbx, rcx
jae 0x1400156eb
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
add edi, 0xffffffff
jne 0x140015660
cmp rbx, rcx
jae 0x1400156eb
movzx edi, word [rbx]
test di, di
je 0x1400156eb
mov r10, qword [r14]
mov ecx, 1
movzx edx, di
mov eax, dword [r10 - 0xc]
sub ecx, dword [r10 - 8]
sub eax, edi
or ecx, eax
jge 0x1400156af
mov edx, edi
mov rcx, r14
call fcn.140015d10
mov r10, qword [r14]
movzx edx, word [rbx]
movzx r9d, dx
lea r8, [rbx + 2]
mov rdx, rdi
mov rcx, r10
call fcn.1401cd210
xor edx, edx
test eax, eax
je 0x1400156d2
cmp eax, 0xc
je 0x14001570e
cmp eax, 0x50
jne 0x140015708
mov rcx, qword [r14]
cmp edi, dword [rcx - 0xc]
jg 0x140015714
mov dword [rcx - 0x10], edi
mov eax, 1
mov rcx, qword [r14]
mov word [rcx + rdi*2], dx
jmp 0x1400156ed
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
call fcn.1400302b0
int3
call fcn.1400302d4
int3
mov ecx, 0x80070057
call fcn.140015d80
int3
Function at 0x140015720
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov r14, rcx
mov edi, edx
mov ecx, edx
call fcn.140030de4
mov rsi, rax
test rax, rax
jne 0x140015755
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov eax, edi
mov qword [rsp + 0x30], rbx
shr eax, 4
mov r8d, 6
inc ax
mov qword [rsp + 0x38], rbp
movzx edx, ax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbp, rax
test rax, rax
je 0x14001584d
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x14001584d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x14001584d
mov rdx, rbp
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
add rcx, rbx
and edi, 0xf
jbe 0x1400157de
cmp rbx, rcx
jae 0x14001584d
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
add edi, 0xffffffff
jne 0x1400157c5
cmp rbx, rcx
jae 0x14001584d
movzx edi, word [rbx]
test di, di
je 0x14001584d
mov r10, qword [r14]
mov ebp, 1
mov ecx, ebp
movzx edx, di
mov eax, dword [r10 - 0xc]
sub ecx, dword [r10 - 8]
sub eax, edi
or ecx, eax
jge 0x140015816
mov edx, edi
mov rcx, r14
call fcn.140015d10
mov r10, qword [r14]
movzx edx, word [rbx]
movzx r9d, dx
lea r8, [rbx + 2]
mov rdx, rdi
mov rcx, r10
call fcn.1401cd210
xor ecx, ecx
test eax, eax
je 0x140015839
cmp eax, 0xc
je 0x140015874
cmp eax, 0x50
jne 0x14001586e
mov rax, qword [r14]
cmp edi, dword [rax - 0xc]
jg 0x14001587a
mov dword [rax - 0x10], edi
mov rax, qword [r14]
mov word [rax + rdi*2], cx
jmp 0x140015851
xor ecx, ecx
mov ebp, ecx
mov rbx, qword [rsp + 0x30]
mov eax, ebp
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
call fcn.1400302b0
int3
call fcn.1400302d4
int3
mov ecx, 0x80070057
call fcn.140015d80
int3

Function at 0x1400172c0
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x1c8], 0
mov ebx, edx
mov rdi, rcx
jne 0x1400172e8
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.140038770
test ebx, ebx
jne 0x140017303
mov qword [0x14028d520], 1
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x14029bad4], eax
cmp qword [0x14028d520], 0
je 0x140017331
mov edx, ebx
mov rcx, rdi
call fcn.140038770
movsxd rcx, eax
mov qword [0x14028d520], rcx
mov eax, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
cmp ebx, 2
jl 0x140017321
lea rcx, [0x14029bcf0]
call fcn.140020b00
mov rax, qword [rdi + 0x1c8]
mov rbx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x14029bad4]
mov rcx, qword [rdi + 0x1c8]
mov edx, eax
mov rax, qword [rbx + 0xa0]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp rax