joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140039df0
Capabilities:
Encode data using add xor sub operations
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
lea r10, [rcx + 0x9c4]
mov r9, rcx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r8, r10
mov edx, eax
add r10, 4
mov r11d, dword [r10]
xor edx, r11d
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x634]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x140039e07
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
mov eax, r11d
mov r8, r10
mov edx, eax
add r10, 4
mov r11d, dword [r10]
xor edx, r11d
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 - 0xd4c]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x140039e54
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
and dword [r9], ebx
mov rbx, qword [rsp + 8]
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
shr edx, 1
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
ret

Function at 0x14003a448
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x160
mov rax, qword [0x140068fc0]
xor rax, rsp
mov qword [rsp + 0x150], rax
lea r14, [rsp + 0x178]
mov rbp, rdx
mov rsi, qword [r14]
lea rcx, [rsp + 0x24]
xor ebx, ebx
xor edx, edx
mov r8d, 0x12c
mov qword [r14], rbx
call sub.VCRUNTIME140.dll_memset
xor edx, edx
lea ecx, [rbx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rax
mov rdi, rax
call sub.KERNEL32.dll_Process32First
jmp 0x14003a4d7
mov rdx, rbp
lea rcx, [rsp + 0x4c]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
mov rcx, rdi
test eax, eax
je 0x14003a511
lea rdx, [rsp + 0x20]
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x14003a4b8
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [r14], rsi
mov eax, ebx
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.14003d390
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [rsp + 0x28]
jmp 0x14003a4e4

Function at 0x14003a520
Capabilities:
Enumerate gui resources

Disassembly:
sub rsp, 0x38
and qword [rsp + 0x20], 0
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x28], ecx
lea rcx, [0x14003280c]
call qword [sym.imp.USER32.dll_EnumWindows]
test eax, eax
jne 0x14003a559
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xffffffff
jne 0x14003a559
mov rax, qword [rsp + 0x20]
test rax, rax
jne 0x14003a55b
xor eax, eax
add rsp, 0x38
ret
Function at 0x14003da98
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14003dae2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14003dae2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14003dae2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14003dae2
cmp dword [rcx + 0x84], 0xe
jbe 0x14003dae2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14003dae4
xor al, al
add rsp, 0x28
ret
Function at 0x140001770
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x1400017e8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x1400017e8
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
add rcx, rbx
and edi, 0xf
jbe 0x1400017d5
nop
cmp rbx, rcx
jae 0x1400017e8
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
add edi, 0xffffffff
jne 0x1400017c0
cmp rbx, rcx
jae 0x1400017e8
xor eax, eax
cmp word [rbx], ax
cmove rbx, rax
mov rax, rbx
jmp 0x1400017ea
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140002790
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x20
call fcn.140001400
test rax, rax
je 0x14000296a
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rsp + 0x50], rax
mov edx, 0x66
lea rcx, [rsp + 0x50]
call fcn.140001800
mov rax, qword [rsp + 0x50]
movzx ebx, word [rax]
mov ecx, 0x4f
xor r15d, r15d
sub ebx, ecx
jne 0x1400027fb
movzx ebx, word [rax + 2]
sub ebx, 0x4e
jne 0x1400027fb
movzx ebx, word [rax + 4]
movzx ecx, r15w
sub ebx, ecx
lea rdx, [rax - 0x18]
mov esi, 0xffffffff
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140002819
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
test ebx, ebx
jne 0x14000294e
call fcn.140001400
test rax, rax
je 0x14000296a
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x58], rbx
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
movzx r9d, ax
mov edx, 6
xor ecx, ecx
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
mov rbp, rax
test rax, rax
je 0x140002927
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x140002927
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
test rax, rax
je 0x140002927
mov rdx, rbp
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, eax
add rdx, rdi
mov ecx, 5
cmp rdi, rdx
jae 0x140002927
movzx eax, word [rdi]
lea rdi, [rdi + rax*2]
add rdi, 2
add ecx, 0xffffffff
jne 0x1400028a6
cmp rdi, rdx
jae 0x140002927
cmp word [rdi], cx
je 0x140002927
test rdi, rdi
je 0x140002927
movzx ebp, word [rdi]
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, ebp
or eax, ecx
jge 0x1400028ef
mov edx, ebp
lea rcx, [rsp + 0x58]
call fcn.140001c80
mov rbx, qword [rsp + 0x58]
lea r8, [rdi + 2]
movzx r9d, word [rdi]
mov rdx, rbp
mov rcx, rbx
call fcn.140040fb0
test eax, eax
je 0x14000291a
cmp eax, 0xc
je 0x140002980
cmp eax, 0x16
je 0x14000295f
cmp eax, 0x22
je 0x14000295f
cmp eax, 0x50
jne 0x140002975
cmp ebp, dword [rbx - 0xc]
jg 0x14000295f
mov dword [rbx - 0x10], ebp
mov word [rbx + rbp*2], r15w
lea r8, [0x140074e28]
mov rdx, rbx
call fcn.140002330
nop
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], esi
sub esi, 1
jg 0x14000294e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rbx, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x80070057
call fcn.1400012d0
nop
mov ecx, 0x80004005
call fcn.1400012d0
nop
mov ecx, 0x80004005
call fcn.1400012d0
int3
mov ecx, 0x8007000e
call fcn.1400012d0
int3
Function at 0x140002d50
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x280
mov rax, qword [0x140089020]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rdi, rcx
mov qword [rsp + 0x38], rcx
xor esi, esi
mov dword [rsp + 0x30], esi
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x60]
call fcn.14003caa0
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [rsi + 0x25]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
lea rax, [rsp + 0x60]
mov rbx, 0xffffffffffffffff
mov r8, rbx
nop
inc r8
cmp word [rax + r8*2], si
jne 0x140002dd0
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x40]
call fcn.140003db0
nop
lea rdx, str.WindowsPowerShell_v1.0PowerShell.exe
lea rcx, [rsp + 0x40]
call fcn.1400038f0
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rdx, qword [rsp + 0x40]
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
nop word [rax + rax]
inc rbx
cmp word [rdx + rbx*2], 0
jne 0x140002e20
mov r8, rbx
mov rcx, rdi
call fcn.140003db0
mov dword [rsp + 0x30], 1
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x140002e7b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002e76
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002eb6
call fcn.14003a0d0
movdqa xmm0, xmmword [0x14007c4f0]
movdqu xmmword [rsp + 0x50], xmm0
mov word [rsp + 0x40], si
mov rax, rdi
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.14003a0b0
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
call fcn.14004638c
int3
Function at 0x1400031b0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov rdi, rdx
mov rbx, rcx
xor eax, eax
mov dword [rsp + 0x20], eax
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x18], 7
mov word [rcx], ax
mov dword [rsp + 0x20], 1
mov rcx, rdx
cmp qword [rdx + 0x18], 8
jb 0x1400031fa
mov rcx, qword [rdx]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
movsxd rsi, eax
test eax, eax
je 0x14000324e
xor r8d, r8d
mov rdx, rsi
mov rcx, rbx
call fcn.1400035c0
mov rdx, rbx
cmp qword [rbx + 0x18], 8
jb 0x140003227
mov rdx, qword [rbx]
cmp qword [rdi + 0x18], 8
jb 0x140003231
mov rdi, qword [rdi]
mov r8d, esi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
xor r8d, r8d
lea eax, [rsi - 1]
movsxd rdx, eax
mov rcx, rbx
call fcn.1400035c0
mov rax, rbx
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x140003270
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rbp
lea rbp, [rsp - 0x3f]
sub rsp, 0xb0
xor eax, eax
xorps xmm0, xmm0
movups xmmword [rbp - 0x41], xmm0
movups xmmword [rbp - 0x31], xmm0
movups xmmword [rbp - 0x21], xmm0
movups xmmword [rbp - 0x11], xmm0
movups xmmword [rbp - 1], xmm0
movups xmmword [rbp + 0xf], xmm0
movups xmmword [rbp + 0x1f], xmm0
mov dword [rbp - 0x41], 0x70
mov dword [rbp - 0x3d], 0x440
cmp qword [rdx + 0x18], 8
jb 0x1400032c0
mov rdx, qword [rdx]
mov qword [rbp - 0x29], rdx
mov dword [rbp - 0x11], eax
lea rax, str.runas
mov qword [rbp - 0x31], rax
cmp qword [r8 + 0x10], 0
je 0x1400032e7
cmp qword [r8 + 0x18], 8
jb 0x1400032e3
mov r8, qword [r8]
mov qword [rbp - 0x21], r8
cmp qword [r9 + 0x10], 0
je 0x1400032fc
cmp qword [r9 + 0x18], 8
jb 0x1400032f8
mov r9, qword [r9]
mov qword [rbp - 0x19], r9
lea rax, [rbp - 0x41]
mov qword [rbp + 0x4f], rax
lea r8, [rbp + 0x4f]
lea rcx, [rbp + 0x2f]
call fcn.1400039d0
nop
lea rcx, [rbp - 0x41]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x140003356
mov rcx, qword [rbp + 0x27]
test rcx, rcx
je 0x140003348
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x140003344
cmp eax, 0xffffffff
je 0x140003356
mov ebx, 6
jmp 0x140003363
mov rcx, qword [rbp + 0x27]
lea rdx, [rbp + 0x6f]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x140003360
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x140003363
mov ebx, dword [rbp + 0x6f]
lea rcx, [rbp + 0x2f]
call fcn.140003590
mov eax, ebx
mov rbx, qword [rsp + 0xc8]
add rsp, 0xb0
pop rbp
ret
Function at 0x140003380
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
push rdi
sub rsp, 0xe0
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
mov dword [rax - 0x78], 0x68
xorps xmm0, xmm0
movups xmmword [rax - 0x70], xmm0
movups xmmword [rax - 0x60], xmm0
movups xmmword [rax - 0x50], xmm0
movups xmmword [rax - 0x40], xmm0
movups xmmword [rax - 0x30], xmm0
movups xmmword [rax - 0x20], xmm0
mov dword [rax - 0x3c], 1
mov word [rax - 0x38], r9w
xor eax, eax
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], rax
call fcn.140001400
mov rcx, rax
test rax, rax
je 0x140003562
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x50], rax
cmp qword [rbx + 0x18], 8
jb 0x140003400
mov rbx, qword [rbx]
mov r8, rdi
cmp qword [rdi + 0x18], 8
jb 0x14000340d
mov r8, qword [rdi]
mov r9, rbx
lea rdx, str.__s___s
lea rcx, [rsp + 0x50]
call fcn.140001e80
xor r9d, r9d
cmp qword [rsi + 0x10], r9
jne 0x14000342f
mov esi, r9d
jmp 0x140003439
cmp qword [rsi + 0x18], 8
jb 0x140003439
mov rsi, qword [rsi]
mov rax, qword [rsp + 0x110]
mov rcx, qword [rax + 0x10]
test rcx, rcx
jne 0x14000344f
mov rax, r9
jmp 0x140003459
cmp qword [rax + 0x18], 8
jb 0x140003459
mov rax, qword [rax]
neg rcx
sbb edx, edx
and edx, 0x400
mov rbx, qword [rsp + 0x50]
mov rcx, rbx
cmp dword [rbx - 0x10], r9d
cmove rcx, r9
cmp qword [rdi + 0x10], r9
jne 0x14000347f
mov rdi, r9
jmp 0x140003489
cmp qword [rdi + 0x18], 8
jb 0x140003489
mov rdi, qword [rdi]
lea r8, [rsp + 0x58]
mov qword [rsp + 0x48], r8
lea r8, [rsp + 0x70]
mov qword [rsp + 0x40], r8
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], edx
mov dword [rsp + 0x20], r9d
xor r8d, r8d
mov rdx, rcx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x1400034cd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x14000352e
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x1400034ed
cmp eax, 0xffffffff
je 0x14000351d
mov edi, 6
jmp 0x14000352e
lea rdx, [rsp + 0x108]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x14000350e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x14000352e
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x140003527
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x14000352e
mov edi, dword [rsp + 0x108]
lea rdx, [rbx - 0x18]
mov ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x14000354b
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
mov eax, edi
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
mov ecx, 0x80004005
call fcn.1400012d0
int3
Function at 0x140004360
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rsi, rdx
mov rbx, rcx
mov rdi, qword [rcx + 0x10]
test rdi, rdi
je 0x140004417
mov rbx, qword [rcx]
cmp qword [rdi], 0
je 0x1400043e2
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140004402
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140004402
mov qword [rsp + 0x28], 0
mov rdx, qword [rdi]
mov qword [rsp + 0x20], rdx
xor r9d, r9d
xor r8d, r8d
mov rdx, rsi
mov rcx, rbx
call rax
nop
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp dword [rdi + 8], 0
je 0x140004402
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
nop
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov eax, 1
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp byte [0x14008bfc8], 0
jne 0x140004462
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140004452
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14008bfc0], rax
mov byte [0x14008bfc8], 1
jmp 0x140004469
mov rax, qword [0x14008bfc0]
mov byte [0x14008bfc8], 1
jmp 0x140004469
mov rax, qword [0x14008bfc0]
mov rdx, rsi
mov rcx, qword [rbx]
test rax, rax
je 0x1400043eb
xor r9d, r9d
mov r8d, dword [rbx + 8]
call rax
nop
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x140004d50
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x480
mov rax, qword [0x140089020]
xor rax, rsp
mov qword [rsp + 0x470], rax
mov r15, r9
mov rsi, r8
mov rbx, rdx
xor r14d, r14d
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x60], r14
xor edx, edx
lea r8d, [r14 + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x140004dd5
xor edx, edx
lea r8d, [r14 + 2]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x140004dd5
call fcn.1400040e0
mov ebx, eax
jmp 0x140004ef7
mov r8, r15
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
jne 0x140004df6
call fcn.1400040e0
jmp 0x140004ee6
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
mov qword [rsp + 0x40], rax
test rax, rax
jne 0x140004e19
call fcn.1400040e0
jmp 0x140004ee6
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
mov dword [rsp + 0x30], eax
inc eax
cmp eax, ebx
jae 0x140004e3b
mov ebx, 0x8007000e
jmp 0x140004ee8
mov ecx, eax
test eax, eax
je 0x140004e70
xor edx, edx
mov rax, 0xffffffffffffffff
div rcx
cmp rax, 2
jb 0x140004f2f
lea rdx, [rcx + rcx]
cmp rdx, 0x400
jbe 0x140004e70
lea rcx, [rsp + 0x60]
call fcn.140009340
jmp 0x140004e7a
lea rax, [rsp + 0x68]
mov qword [rsp + 0x60], rax
jmp 0x140004e8d
mov rax, qword [rsp + 0x60]
test rax, rax
jne 0x140004e9e
mov ebx, 0x8007000e
jmp 0x140004ee8
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
mov r9d, ebx
mov r8, rsi
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x140004ec3
call fcn.1400040e0
jmp 0x140004ee6
mov ecx, eax
mov rax, qword [rsp + 0x60]
mov word [rax + rcx*2], r14w
mov r8d, dword [rsp + 0x4d0]
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x48]
call fcn.140005c20
mov ebx, eax
test rdi, rdi
je 0x140004ef7
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rax, [rsp + 0x68]
cmp qword [rsp + 0x60], rax
je 0x140004f0e
lea rcx, [rsp + 0x60]
call fcn.1400091d0
nop
mov eax, ebx
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.14003a0b0
add rsp, 0x480
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
mov ecx, 0x80070216
call fcn.1400012d0
int3
Function at 0x140009720
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rsi, rcx
movabs rax, 0xfffffffffffffff
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x1400098d3
lea rax, [rdx - 1]
or rax, rdi
bsr rcx, rax
inc ecx
shl rdi, cl
mov rbx, qword [rsi + 8]
lea rdx, [rdi + rdi]
mov r8, rbx
lea rcx, [rsi + 0x18]
call fcn.1400091f0
lea rax, [rdi - 1]
mov qword [rsi + 0x30], rax
mov qword [rsi + 0x38], rdi
mov qword [rsp + 0x48], rsi
mov rcx, qword [rsi + 8]
mov rcx, qword [rcx]
mov rdx, rcx
cmp rcx, rbx
je 0x140009891
movabs rbp, 0xcbf29ce484222325
movabs rdi, 0x100000001b3
nop dword [rax]
nop word [rax + rax]
mov rdx, qword [rdx]
movzx r9d, byte [rcx + 0x10]
xor r9, rbp
imul r9, rdi
movzx eax, byte [rcx + 0x11]
xor r9, rax
imul r9, rdi
movzx eax, byte [rcx + 0x12]
xor r9, rax
imul r9, rdi
movzx eax, byte [rcx + 0x13]
xor r9, rax
imul r9, rdi
mov r11, qword [rsi + 0x30]
and r11, r9
shl r11, 4
add r11, qword [rsi + 0x18]
mov r9, qword [r11]
cmp r9, rbx
jne 0x140009810
mov qword [r11], rcx
mov qword [r11 + 8], rcx
jmp 0x140009885
mov rax, qword [r11 + 8]
mov r8d, dword [rcx + 0x10]
cmp r8d, dword [rax + 0x10]
jne 0x14000984d
mov r8, qword [rax]
cmp r8, rcx
je 0x140009847
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r9, qword [rdx + 8]
mov qword [r9], r8
mov rax, qword [r8 + 8]
mov qword [rax], rcx
mov qword [r8 + 8], r9
mov qword [rdx + 8], r10
mov qword [rcx + 8], rax
mov qword [r11 + 8], rcx
jmp 0x140009885
cmp r9, rax
je 0x140009861
mov rax, qword [rax + 8]
cmp r8d, dword [rax + 0x10]
je 0x1400098ad
cmp r9, rax
jne 0x140009852
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r9, qword [rdx + 8]
mov qword [r9], rax
mov r8, qword [rax + 8]
mov qword [r8], rcx
mov qword [rax + 8], r9
mov qword [rdx + 8], r10
mov qword [rcx + 8], r8
mov qword [r11], rcx
mov rcx, rdx
cmp rdx, rbx
jne 0x1400097c0
mov qword [rsp + 0x48], 0
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
mov rax, qword [rax]
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r9, qword [rdx + 8]
mov qword [r9], rax
mov r8, qword [rax + 8]
mov qword [r8], rcx
mov qword [rax + 8], r9
mov qword [rdx + 8], r10
mov qword [rcx + 8], r8
jmp 0x140009885
lea rcx, str.invalid_hash_bucket_count
call fcn.1400383bc
int3
Function at 0x14000f7c0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x140089020]
xor rax, rsp
mov qword [rbp - 8], rax
mov rsi, rcx
mov qword [rbp - 0x30], rcx
xor r14d, r14d
mov dword [rbp - 0x60], r14d
lea r9, [rbp - 0x58]
xor r8d, r8d
xor edx, edx
lea rcx, [0x1400646b8]
call qword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
test eax, eax
js 0x14000f994
mov rbx, qword [rbp - 0x58]
mov qword [rbp - 0x28], rbx
mov rax, qword [rbp - 0x58]
movzx ecx, word [rax]
call fcn.1400470e8
movzx ecx, ax
mov rax, qword [rbp - 0x58]
mov word [rax], cx
mov rdi, qword [rbp - 0x58]
mov dword [rbp - 0x18], 0x5c005c
mov dword [rbp - 0x14], 0x5c003f
mov word [rbp - 0x10], r14w
mov rax, qword [rbp - 0x18]
cmp rax, qword [rdi]
je 0x14000f8e4
mov dword [rbp - 0x18], 0x5c005c
mov dword [rbp - 0x14], 0x5c002e
mov word [rbp - 0x10], r14w
mov rax, qword [rbp - 0x18]
cmp rax, qword [rdi]
je 0x14000f8e4
cmp cx, 0x5c
je 0x14000f8ab
cmp cx, 0x2f
je 0x14000f8ab
call fcn.140046ef0
test eax, eax
je 0x14000f8ec
cmp word [rdi + 2], 0x3a
jne 0x14000f8ec
movzx eax, word [rdi + 4]
cmp ax, 0x5c
je 0x14000f8a0
cmp ax, 0x2f
lea eax, [r14 + 3]
jne 0x14000f8a5
mov eax, 2
mov rdi, qword [rbp - 0x58]
jmp 0x14000f8df
movzx eax, word [rdi + 2]
cmp ax, 0x5c
je 0x14000f8bb
cmp ax, 0x2f
jne 0x14000f8ec
cmp word [rdi + 4], 0x2e
jne 0x14000f8ec
movzx eax, word [rdi + 6]
cmp ax, 0x5c
je 0x14000f8d6
cmp ax, 0x2f
je 0x14000f8d6
xor al, al
jmp 0x14000f8d8
mov al, 1
neg al
sbb eax, eax
and eax, 6
cmp eax, 6
jne 0x14000f8ec
add rdi, 8
mov qword [rbp - 0x58], rdi
lea rax, [rbp - 0x50]
mov qword [rbp - 0x20], rax
lea rax, [rbp - 0x50]
mov qword [rbp - 0x18], rax
mov rdx, qword [rbp - 0x58]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x14000f910
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], r14
mov qword [rbp - 0x38], r14
lea rcx, [rbp - 0x50]
call fcn.140003db0
mov edi, 4
mov dword [rbp - 0x60], edi
and edi, 0xfffffffb
mov dword [rbp - 0x60], edi
or edi, 2
mov dword [rbp - 0x60], edi
and edi, 0xfffffffd
mov dword [rbp - 0x60], edi
lea rdx, [rbp - 0x50]
mov rcx, rsi
call fcn.14000f570
or edi, 1
mov dword [rbp - 0x60], edi
test rbx, rbx
je 0x14000f96d
mov rcx, rbx
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rax, rsi
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14003a0b0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
lea rdx, str.Failed_to_get_known_folder_path
lea rcx, [rbp - 0x50]
call fcn.140009dd0
lea rdx, [0x140086e98]
lea rcx, [rbp - 0x50]
call fcn.14003ce28
int3