joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400049a4
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x180]
sub rsp, 0x280
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x170], rax
xor eax, eax
mov rbx, rcx
xor r9d, r9d
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x58]
xor r8d, r8d
mov esi, 1
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rdx
and qword [rsp + 0x38], 0
and qword [rsp + 0x30], 0
mov rdx, rcx
xor ecx, ecx
mov dword [rsp + 0x28], 0x20
and dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x140004aff
mov rcx, qword [rsp + 0x58]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x58]
lea rdx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [0x14000abc8], 0
mov edi, dword [rsp + 0x50]
jne 0x140004a76
mov ecx, dword [0x14000be3c]
test sil, cl
je 0x140004a76
test cl, 2
jne 0x140004a76
mov eax, edi
and eax, 0xff000000
cmp eax, 0xaa000000
cmove ecx, edi
mov dword [0x14000be3c], ecx
test dword [0x14000be44], 0x800
je 0x140004a8a
mov dword [0x14000be5c], edi
jmp 0x140004ad4
cmp dword [0x14000be58], 0
jne 0x140004aca
movzx ecx, word [0x14000be54]
mov ebx, dword [0x14000be50]
call fcn.140002634
cmp ebx, eax
jne 0x140004aca
mov eax, edi
and eax, 0xff000000
cmp eax, 0xaa000000
jne 0x140004abc
test sil, dil
jne 0x140004aca
test dword [0x14000be44], 0x200
je 0x140004ad4
jmp 0x140004a82
mov dword [0x14000be5c], 0xbc2
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test dword [0x14000be44], 0x400
je 0x140004b6d
cmp dword [rsp + 0x50], 0
jge 0x140004b6d
jmp 0x140004b6b
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov dword [0x14000be5c], ecx
call qword [sym.imp.KERNEL32.dll_GetLastError]
and qword [rsp + 0x30], 0
mov r8d, eax
lea rax, [rsp + 0x70]
xor r9d, r9d
xor edx, edx
mov ecx, 0x1000
mov dword [rsp + 0x28], 0x200
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
and dword [rsp + 0x28], 0
lea r9, [rsp + 0x70]
mov r8, rbx
mov edx, 0x4c4
xor ecx, ecx
mov dword [rsp + 0x20], FDICopy
call fcn.140004fd8
xor esi, esi
mov eax, esi
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.140008340
mov rbx, qword [rsp + 0x2b0]
add rsp, 0x280
pop rdi
pop rsi
pop rbp
ret
Function at 0x140004c98
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x20], rsi
mov qword [rax + 0x18], r8
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
mov r15, rcx
lea rcx, str.SHELL32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor ebx, ebx
mov rsi, rax
test rax, rax
je 0x140004e5b
lea rdx, str.SHBrowseForFolder
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0xb0], rax
test rax, rax
je 0x140004e4b
mov edx, 0xc3
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r12, rax
test rax, rax
je 0x140004e4b
lea rdx, str.SHGetPathFromIDList
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r13, rax
test rax, rax
je 0x140004e4b
cmp byte [0x14000b420], bl
lea rdi, [0x14000b420]
mov ebp, 0x104
jne 0x140004d80
mov rdx, rdi
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
or rdx, 0xffffffffffffffff
inc rdx
cmp byte [rdi + rdx], bl
jne 0x140004d50
add rdx, rdi
mov rcx, rdi
call qword [sym.imp.USER32.dll_CharPrevA]
mov r14, rax
cmp byte [rax], 0x5c
jne 0x140004d80
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.USER32.dll_CharPrevA]
cmp byte [rax], 0x3a
je 0x140004d80
mov byte [r14], bl
mov r14, qword [rsp + 0xb0]
lea rax, [0x14000a840]
mov byte [0x14000aa50], bl
mov qword [rsp + 0x48], rax
lea rax, [0x140004c70]
mov rcx, r14
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x50], 1
mov qword [rsp + 0x60], rdi
call qword [0x14000d528]
lea rcx, [rsp + 0x30]
call r14
mov r14, rax
test rax, rax
je 0x140004e35
mov rcx, r13
call qword [0x14000d528]
mov rdx, rdi
mov rcx, r14
call r13
cmp byte [0x14000b420], bl
je 0x140004e26
lea rcx, [0x14000aa50]
sub rdi, rcx
lea rax, [rbp + 0x7ffffefa]
test rax, rax
je 0x140004e1c
mov al, byte [rdi + rcx]
test al, al
je 0x140004e1c
mov byte [rcx], al
inc rcx
dec rbp
jne 0x140004dff
test rbp, rbp
jne 0x140004e24
dec rcx
mov byte [rcx], bl
mov rcx, r12
call qword [0x14000d528]
mov rcx, r14
call r12
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp byte [0x14000aa50], bl
setne bl
mov eax, ebx
jmp 0x140004e7c
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edx, 0x4c1
jmp 0x140004e60
mov edx, 0x4c2
xor r9d, r9d
xor r8d, r8d
mov rcx, r15
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], FDICopy
call fcn.140004fd8
xor eax, eax
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140005298
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rsi, rdx
mov ebp, r8d
mov rdi, rcx
mov rdx, rcx
mov r8d, 0xa
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
cmp eax, ebp
ja 0x14000532b
test rsi, rsi
je 0x14000532b
test eax, eax
jne 0x1400052e4
xor eax, eax
jmp 0x14000532d
mov r8d, 0xa
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
test rax, rax
je 0x1400052e0
mov r9, rbx
mov rdx, rbp
mov r8, rax
mov rcx, rsi
call fcn.14000878c
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140005530
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x40
lea rdi, [0x14000af00]
mov ebx, edx
mov rsi, rcx
mov rax, rdi
xor r14d, r14d
cmp dword [rax], 1
je 0x140005572
lea rcx, [0x14000b400]
add rax, 0x20
inc r14d
cmp rax, rcx
jl 0x14000555a
cmp r14d, 0x28
jne 0x1400055a5
and dword [rsp + 0x28], 0
mov rcx, qword [0x14000a810]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x4bb
mov dword [rsp + 0x20], FDICopy
call fcn.140004fd8
or rax, 0xffffffffffffffff
jmp 0x140005753
lea rdx, str.MEMCAB
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x140005603
bt ebx, 8
jb 0x14000559c
test bl, 8
jne 0x14000559c
test bl, 1
jne 0x14000559c
test bl, 2
jne 0x14000559c
movsxd rdx, r14d
mov rcx, rdx
shl rcx, 5
and dword [rcx + rdi], eax
mov rax, qword [0x14000b540]
and dword [rcx + rdi + 0x10], 0
mov qword [rcx + rdi + 8], rax
mov eax, dword [0x14000b548]
mov dword [rcx + rdi + 4], 1
mov dword [rcx + rdi + 0x14], eax
jmp 0x140005750
test bl, 8
je 0x140005611
or rcx, 0xffffffffffffffff
jmp 0x14000572c
test bl, 2
jne 0x140005621
mov r15d, 0x80000000
test bl, 1
je 0x140005627
mov r15d, 0x40000000
bt ebx, 8
jae 0x14000564c
bt ebx, 0xa
jae 0x14000563a
mov ebx, 1
jmp 0x14000565c
and ebx, 0x200
neg ebx
sbb ebx, ebx
and ebx, 0xfffffffe
add ebx, 4
jmp 0x14000565c
and ebx, 0x200
neg ebx
sbb ebx, ebx
and ebx, 2
add ebx, 3
and qword [rsp + 0x30], 0
xor r9d, r9d
xor r8d, r8d
mov edx, r15d
mov rcx, rsi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rcx, rax
cmp rax, 0xffffffffffffffff
jne 0x14000572c
cmp ebx, 3
je 0x14000572c
mov al, byte [rsi]
test al, al
je 0x140005705
lea rdi, [rsi + 1]
xor ebp, ebp
cmp byte [rdi], 0x3a
jne 0x1400056b3
cmp byte [rsi + 2], 0x5c
jne 0x1400056b3
lea rdi, [rsi + 3]
jmp 0x1400056c4
cmp al, 0x5c
jne 0x1400056c4
cmp byte [rdi], al
jne 0x1400056c4
lea rdi, [rsi + 2]
mov ebp, 2
cmp byte [rdi], 0
je 0x1400056fe
cmp byte [rdi], 0x5c
jne 0x1400056ed
cmp byte [rdi - 1], 0x3a
je 0x1400056ed
test ebp, ebp
je 0x1400056dc
dec ebp
jmp 0x1400056ed
xor edx, edx
mov rcx, rsi
mov byte [rdi], 0
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov byte [rdi], 0x5c
mov rcx, rdi
call qword [sym.imp.USER32.dll_CharNextA]
mov rdi, rax
cmp byte [rax], 0
jne 0x1400056c9
lea rdi, [0x14000af00]
and qword [rsp + 0x30], 0
xor r9d, r9d
xor r8d, r8d
mov edx, r15d
mov rcx, rsi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rcx, rax
movsxd rdx, r14d
mov rax, rdx
shl rax, 5
mov qword [rax + rdi + 0x18], rcx
cmp rcx, 0xffffffffffffffff
je 0x14000574c
and dword [rax + rdi], 0
and dword [rax + rdi + 4], 0
jmp 0x140005750
or rdx, 0xffffffffffffffff
mov rax, rdx
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
Function at 0x140005f80
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
lea rcx, [0x140001368]
xor r8d, r8d
xor edx, edx
call fcn.140005298
lea rdx, [0x140001368]
mov r8d, 0xa
xor ecx, ecx
mov dword [0x14000b548], eax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [0x14000b540], rax
test rax, rax
je 0x140006179
mov rcx, qword [0x14000a810]
test rcx, rcx
je 0x14000601c
mov edx, 0x842
call qword [sym.imp.USER32.dll_GetDlgItem]
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x14000a810]
mov edx, 0x841
call qword [sym.imp.USER32.dll_GetDlgItem]
mov edx, 5
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
call fcn.140005e50
test eax, eax
jne 0x14000602f
mov edx, 0x4ba
jmp 0x1400060e8
lea rax, [0x14000b54c]
lea r9, [0x140005780]
lea r8, [fcn.140005530]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], 1
lea rax, [0x140005960]
mov qword [rsp + 0x30], rax
lea rax, [fcn.1400058f0]
lea rdx, [0x140005a10]
mov qword [rsp + 0x28], rax
lea rax, [0x140005820]
lea rcx, [0x1400059f0]
mov qword [rsp + 0x20], rax
call qword [sym.imp.Cabinet.dll_FDICreate]
mov rdi, rax
test rax, rax
je 0x1400060dc
lea rax, [0x14000b540]
lea r8, [0x140001129]
lea rdx, str.MEMCAB
mov qword [rsp + 0x30], rax
and qword [rsp + 0x28], 0
lea rax, [0x140005a20]
xor r9d, r9d
mov rcx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.Cabinet.dll_FDICopy]
mov ebx, eax
test eax, eax
je 0x140006109
mov rcx, rdi
call qword [sym.imp.Cabinet.dll_FDIDestroy]
test eax, eax
jne 0x140006109
mov edx, dword [0x14000b54c]
add edx, 0x514
mov rcx, qword [0x14000a810]
and dword [rsp + 0x28], 0
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], FDICopy
call fcn.140004fd8
xor ebx, ebx
mov rcx, qword [0x14000b540]
test rcx, rcx
je 0x140006123
call qword [sym.imp.KERNEL32.dll_FreeResource]
and qword [0x14000b540], 0
test ebx, ebx
jne 0x14000614d
cmp dword [0x14000b5dc], ebx
jne 0x14000614d
and dword [rsp + 0x28], ebx
xor r9d, r9d
xor r8d, r8d
mov edx, 0x4f8
xor ecx, ecx
mov dword [rsp + 0x20], FDICopy
call fcn.140004fd8
test byte [0x14000abd8], 1
jne 0x140006177
test byte [0x14000be44], 1
jne 0x140006177
mov rcx, qword [0x14000a810]
movsxd r8, ebx
xor r9d, r9d
mov edx, 0xfa1
call qword [sym.imp.USER32.dll_SendMessageA]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x140006384
Capabilities:
Check if file exists
Create directory
Delete directory
Delete file
Get common file path
Get file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x140
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov r14, rcx
xor esi, esi
xor edi, edi
mov rbx, rdx
mov rbp, rcx
sub r14, rdx
lea r8, [0x140001398]
lea rcx, [rsp + 0x20]
mov r9d, esi
mov edx, 0x104
call fcn.1400015c0
inc esi
mov edx, 0x104
mov rcx, rbx
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x1400063fc
mov al, byte [r14 + rcx]
test al, al
je 0x1400063fc
mov byte [rcx], al
inc rcx
dec rdx
jne 0x1400063de
test rdx, rdx
jne 0x140006404
dec rcx
mov byte [rcx], dil
lea r8, [rsp + 0x20]
mov edx, 0x104
mov rcx, rbx
call fcn.140007b48
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140006495
cmp esi, 0x190
jl 0x1400063bb
lea rdx, [0x1400013a4]
mov r9, rbx
xor r8d, r8d
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
je 0x14000646b
mov rcx, rbx
mov edi, 1
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov eax, edi
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.140008340
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x140006438
mov dword [0x14000abc0], 1
mov edi, 1
jmp 0x14000646b
Function at 0x1400064bc
Capabilities:
Create directory
Delete directory
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x170
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov esi, r8d
mov r9, rcx
test edx, edx
je 0x1400065aa
lea rdx, [rsp + 0x50]
call fcn.140006384
test eax, eax
je 0x140006636
lea rbx, [0x14000b5f0]
lea r8, [rsp + 0x50]
mov edi, 0x104
mov rcx, rbx
sub r8, rbx
mov edx, edi
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x140006537
mov al, byte [r8 + rcx]
test al, al
je 0x140006537
mov byte [rcx], al
inc rcx
dec rdx
jne 0x140006519
test rdx, rdx
jne 0x14000653f
dec rcx
mov byte [rcx], 0
test byte [0x14000be44], 0x20
je 0x140006597
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx ecx, word [rsp + 0x20]
test ecx, ecx
je 0x140006586
dec ecx
je 0x14000657d
dec ecx
je 0x140006574
dec ecx
jne 0x140006597
lea r8, [0x1400013c0]
jmp 0x14000658d
lea r8, [0x1400013b8]
jmp 0x14000658d
lea r8, [0x1400013b0]
jmp 0x14000658d
lea r8, [0x1400013a8]
mov edx, edi
mov rcx, rbx
call fcn.140007b48
lea r8, [0x140001129]
mov edx, edi
mov rcx, rbx
call fcn.140007b48
jmp 0x1400065e5
lea rbx, [0x14000b5f0]
mov edi, 0x104
mov rcx, rbx
sub r9, rbx
lea rax, [rdi + 0x7ffffefa]
test rax, rax
je 0x1400065da
mov al, byte [r9 + rcx]
test al, al
je 0x1400065da
mov byte [rcx], al
inc rcx
dec rdi
jne 0x1400065bc
test rdi, rdi
jne 0x1400065e2
dec rcx
mov byte [rcx], 0
mov rcx, rbx
call fcn.140006af0
test eax, eax
jne 0x14000660a
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x14000663a
mov dword [0x14000abc0], 1
test esi, esi
je 0x140006656
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call fcn.140006c54
test eax, eax
jne 0x140006656
cmp dword [0x14000abc0], eax
je 0x140006636
and dword [0x14000abc0], eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
xor eax, eax
jmp 0x140006662
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov dword [0x14000be5c], ecx
jmp 0x140006636
and dword [0x14000be5c], 0
mov eax, 1
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.140008340
lea r11, [rsp + 0x170]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140006af0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rbp, rcx
or rdi, 0xffffffffffffffff
inc rdi
cmp byte [rdi + rcx], 0
jne 0x140006b0b
add edi, 0x14
mov ecx, 0x40
mov edx, edi
mov ebx, edi
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rsi, rax
test rax, rax
jne 0x140006b7d
and dword [rsp + 0x28], eax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x4b5
xor ecx, ecx
mov dword [rsp + 0x20], FDICopy
call fcn.140004fd8
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
xor eax, eax
mov dword [0x14000be5c], ecx
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
lea rax, [rdi - 1]
mov edx, 0x7ffffffe
cmp rax, rdx
ja 0x140006bbf
mov r8, rbp
sub rdx, rbx
mov rcx, rsi
sub r8, rsi
lea rax, [rdx + rbx]
test rax, rax
je 0x140006bb2
mov al, byte [r8 + rcx]
test al, al
je 0x140006bb2
mov byte [rcx], al
inc rcx
dec rbx
jne 0x140006b97
test rbx, rbx
jne 0x140006bba
dec rcx
mov byte [rcx], 0
jmp 0x140006bc6
test edi, edi
je 0x140006bc6
mov byte [rsi], 0
lea r8, [0x1400013d8]
mov edx, edi
mov rcx, rsi
call fcn.140007b48
and qword [rsp + 0x30], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, rsi
mov dword [rsp + 0x28], 0x4000080
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rcx, rsi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_LocalFree]
cmp rbx, 0xffffffffffffffff
je 0x140006b4c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140006b4c
test al, 0x10
je 0x140006b4c
and dword [0x14000be5c], 0
mov eax, 1
jmp 0x140006b68
Function at 0x1400076a4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x38], rax
xor r14d, r14d
mov r13, rcx
mov esi, 1
xor r9d, r9d
jmp 0x140007747
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
test rax, rax
je 0x140007785
mov r15d, dword [rax]
mov r12d, dword [rax + 4]
lea rbp, [rax + 8]
or rax, 0xffffffffffffffff
inc rax
cmp byte [rax + rbp], 0
jne 0x14000770e
mov rcx, r13
lea rbx, [rax + 1]
call qword [0x14000d528]
lea r9, [rbx + rbp]
mov r8, rbp
mov edx, r12d
mov ecx, r15d
call r13
mov rcx, rdi
test eax, eax
je 0x14000777b
call qword [sym.imp.KERNEL32.dll_FreeResource]
add r14d, esi
mov r9d, r14d
lea r8, [0x1400013f8]
lea rcx, [rsp + 0x20]
mov edx, reloc.Cabinet.dll_FDICreate
call fcn.1400015c0
lea rdx, [rsp + 0x20]
mov r8d, 0xa
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
test rax, rax
jne 0x1400076df
jmp 0x140007791
xor esi, esi
call qword [sym.imp.KERNEL32.dll_FreeResource]
jmp 0x140007791
mov dword [0x14000be5c], 0x80070714
xor esi, esi
mov eax, esi
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140008340
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret

Function at 0x14000794c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub rsp, 0x148
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x130], rax
lea r9, [0x14000b5f0]
lea rax, [rsp + 0x20]
mov edx, 0x104
sub r9, rax
mov r8d, edx
lea rcx, [rsp + 0x20]
lea rax, [r8 + 0x7ffffefa]
test rax, rax
je 0x14000799f
mov al, byte [r9 + rcx]
test al, al
je 0x14000799f
mov byte [rcx], al
inc rcx
dec r8
jne 0x140007981
test r8, r8
jne 0x1400079a7
dec rcx
mov byte [rcx], 0
lea r8, [0x1400011d0]
lea rcx, [rsp + 0x20]
call fcn.140007b48
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400079e2
test al, 0x10
jne 0x1400079e2
xor edx, edx
lea rcx, [rsp + 0x20]
lea r8d, [rdx + 8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
jmp 0x1400079ef
lea rcx, [0x1400011d0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.140008340
add rsp, 0x148
ret
Function at 0x140007a10
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rbx, qword [0x14000b528]
mov rbp, r8
mov r8d, 5
mov rcx, rbx
mov rsi, r9
call qword [sym.imp.KERNEL32.dll_FindResourceA]
test rax, rax
je 0x140007a93
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rdi, rax
test rax, rax
je 0x140007a93
mov rax, qword [rsp + 0x60]
mov r9, rsi
mov r8, rbp
mov rdx, rdi
mov rcx, rbx
test rax, rax
jne 0x140007a76
and qword [rsp + 0x20], rax
jmp 0x140007a7b
mov qword [rsp + 0x20], rax
call qword [sym.imp.USER32.dll_DialogBoxIndirectParamA]
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_FreeResource]
cmp rbx, 0xffffffffffffffff
jne 0x140007ab7
and dword [rsp + 0x28], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 0x4fb
xor ecx, ecx
mov dword [rsp + 0x20], FDICopy
call fcn.140004fd8
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x140007de8
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
lea rbp, [rax - 0x18]
sub rsp, 0x110
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp], rax
mov esi, dword [0x14000a1fc]
mov dword [rsp + 0x30], InitCommonControls
cmp esi, 0xfffffffe
jne 0x140007f61
lea rcx, [rsp + 0x50]
xor edi, edi
mov dword [rsp + 0x50], 0x94
mov dword [0x14000a1fc], edi
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x140007f5b
lea esi, [rdi + 1]
cmp dword [rsp + 0x60], esi
jne 0x140007f5b
cmp dword [rsp + 0x54], 4
jne 0x140007f5b
cmp dword [rsp + 0x58], 0xa
jae 0x140007f5b
lea ecx, [rdi + 0x4a]
call qword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x140007f5b
lea rax, [rsp + 0x38]
lea rdx, [0x140001408]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140007f5b
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x10]
lea rdx, [0x140001129]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x38]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x140007ef4
mov eax, dword [0x14000a1fc]
jmp 0x140007f63
lea rdx, [rbp - 0x10]
mov cl, byte [rdx]
lea eax, [rcx - 0x30]
cmp al, 9
ja 0x140007f0e
add edi, 0xfffffffd
movsx eax, cl
shl edi, 4
add edi, eax
jmp 0x140007f2d
cmp cl, 0x61
jl 0x140007f16
add cl, 0xe0
movsx r8d, cl
sub r8d, 0x37
lea eax, [r8 - 0xa]
cmp eax, 5
ja 0x140007f3b
shl edi, 4
add edi, r8d
mov rcx, rdx
call qword [sym.imp.USER32.dll_CharNextA]
mov rdx, rax
jmp 0x140007ef8
lea rax, [rbp - 0x10]
cmp rdx, rax
je 0x140007f5b
and edi, 0x3ff
cmp edi, esi
je 0x140007f53
cmp edi, 0xd
jne 0x140007f5b
mov dword [0x14000a1fc], esi
jmp 0x140007f61
mov esi, dword [0x14000a1fc]
mov eax, esi
mov rcx, qword [rbp]
xor rcx, rsp
call fcn.140008340
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret