joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18005d1b3
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x1800a1658]
jne 0x180059b1a
rol rcx, 0x10
test cx, 0xffff
jne 0x180059b16
repz ret
ror rcx, 0x10
jmp 0x18005d10c
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x1800a5f50]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x1800a6048]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x18005d191
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x1800a5f50]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x18005d1b3
mov rax, qword [rsp + 0x88]
mov qword [0x1800a6048], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x1800a5fe8], rax
mov rax, qword [0x1800a6048]
mov qword [0x1800a5ec0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x1800a5fd0], rax
mov dword [0x1800a5eb0], 0xc0000409
mov dword [0x1800a5eb4], 1
mov rax, qword [0x1800a1658]
mov qword [rsp + 0x68], rax
mov rax, qword [0x1800a1660]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x1800a5f48], eax
mov ecx, 1
call fcn.18005bac4
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x18007f670]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x1800a5f48], 0
jne 0x18005d23a
mov ecx, 1
call fcn.18005bac4
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret

Function at 0x18005f9c4
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
lea edx, [r8 + 1]
jmp 0x18005f838
Function at 0x180060ee4
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov ebp, r8d
mov r13, rdx
mov r14, rcx
call fcn.18005b564
xor ebx, ebx
mov rdi, rax
cmp qword [0x1800a68b8], rbx
jne 0x180060fea
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x1800610bf
lea rdx, str.MessageBoxA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1800610bf
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x1800a68b8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x1800a68c0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
mov qword [0x1800a68c8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov r11, rax
mov qword [0x1800a68d8], rax
test rax, rax
je 0x180060fe1
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov qword [0x1800a68d0], rax
jmp 0x180060ff1
mov rax, qword [0x1800a68d0]
jmp 0x180060ff8
mov rax, qword [0x1800a68d0]
mov r11, qword [0x1800a68d8]
cmp rax, rdi
je 0x180061060
cmp r11, rdi
je 0x180061060
mov rcx, rax
call sub.KERNEL32.dll_DecodePointer
mov rcx, qword [0x1800a68d8]
mov rsi, rax
call sub.KERNEL32.dll_DecodePointer
mov r12, rax
test rsi, rsi
je 0x180061060
test rax, rax
je 0x180061060
call rsi
test rax, rax
je 0x18006105a
lea rcx, [rsp + 0x88]
mov r9d, 0xc
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x18006105a
test byte [rsp + 0x38], 1
jne 0x180061060
bts ebp, 0x15
jmp 0x18006109e
mov rcx, qword [0x1800a68c0]
cmp rcx, rdi
je 0x18006109e
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x18006109e
call rax
mov rbx, rax
test rax, rax
je 0x18006109e
mov rcx, qword [0x1800a68c8]
cmp rcx, rdi
je 0x18006109e
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x18006109e
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x1800a68b8]
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x1800610bf
mov r9d, ebp
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x1800610c1
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x140001158
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
call fcn.1400018e4
add rsp, 0x28
jmp 0x140001158
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push r14
sub rsp, 0xb0
xor eax, eax
mov dword [rsp + 0x44], eax
xor edx, edx
lea r8d, [rax + 0x64]
lea rcx, [rsp + 0x40]
call sub.msvcrt.dll_memset
and dword [rsp + 0x20], 0
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
xor edi, edi
xor eax, eax
lock cmpxchg qword [0x14000ebd8], rbx
je 0x1400011b8
cmp rax, rbx
jne 0x1400011cd
mov edi, 1
mov eax, dword [0x14000ebe0]
cmp eax, 1
jne 0x1400011da
lea ecx, [rax + 0x1e]
call sub.msvcrt.dll__amsg_exit
jmp 0x140001243
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400011a1
mov eax, dword [0x14000ebe0]
test eax, eax
jne 0x140001239
mov dword [0x14000ebe0], 1
lea r14, [0x14000b6d8]
lea rbx, [0x14000b6c0]
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x24], eax
cmp rbx, r14
jae 0x14000122b
test eax, eax
jne 0x14000122f
cmp qword [rbx], 0
je 0x140001220
mov rax, qword [rbx]
call fcn.14000a010
mov dword [rsp + 0x24], eax
add rbx, 8
mov qword [rsp + 0x30], rbx
jmp 0x140001205
test eax, eax
je 0x140001243
mov eax, 0xff
jmp 0x140001391
mov dword [0x14000e284], 1
mov eax, dword [0x14000ebe0]
cmp eax, 1
jne 0x14000126b
lea rdx, [0x14000b6b8]
lea rcx, [0x14000b6a8]
call sub.msvcrt.dll__initterm
mov dword [0x14000ebe0], 2
test edi, edi
jne 0x140001278
xor eax, eax
xchg qword [0x14000ebd8], rax
cmp qword [0x14000ebe8], 0
je 0x1400012a7
lea rcx, [0x14000ebe8]
call fcn.140001850
test eax, eax
je 0x1400012a7
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x14000ebe8]
call fcn.14000a010
mov rax, qword [sym.imp.msvcrt.dll__acmdln]
mov rbx, qword [rax]
mov qword [rsp + 0x28], rbx
mov edi, dword [rsp + 0x20]
movzx ecx, byte [rbx]
cmp cl, 0x20
ja 0x140001333
test cl, cl
je 0x1400012ca
test edi, edi
jne 0x140001333
dec cl
cmp cl, 0x1f
ja 0x1400012dd
inc rbx
mov qword [rsp + 0x28], rbx
mov cl, byte [rbx]
jmp 0x1400012ca
test byte [rsp + 0x7c], 1
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rbx
xor edx, edx
lea rcx, [0x140000000]
call fcn.1400080ac
mov dword [0x14000e280], eax
cmp dword [0x14000e2a0], 0
jne 0x14000131c
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x14000e284], 0
jne 0x140001331
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x14000e280]
jmp 0x140001391
cmp cl, 0x22
jne 0x140001345
xor eax, eax
test edi, edi
sete al
mov edi, eax
mov dword [rsp + 0x20], eax
call qword [sym.imp.msvcrt.dll__ismbblead]
test eax, eax
je 0x140001357
inc rbx
mov qword [rsp + 0x28], rbx
inc rbx
mov qword [rsp + 0x28], rbx
jmp 0x1400012ba
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop r14
ret
Function at 0x140003130
Capabilities:
Compare security identifiers

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0x90
mov rax, qword [0x14000e040]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov eax, dword [0x14000e1bc]
xor esi, esi
mov qword [rbp + 0x2f], rsi
mov dword [rbp + 0x27], esi
mov dword [rbp + 0x3f], esi
lea edi, [rsi + 2]
mov word [rbp + 0x43], 0x500
mov qword [rbp + 0x37], rsi
mov dword [rbp + 0x2b], esi
cmp eax, edi
jne 0x140003309
lea rcx, [rbp + 0x2b]
call fcn.140002590
test eax, eax
jne 0x1400032f8
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
nop dword [rax + rax]
mov rcx, rax
lea r8, [rbp + 0x2f]
lea edx, [rsi + 8]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
nop dword [rax + rax]
test eax, eax
je 0x140003309
mov rcx, qword [rbp + 0x2f]
lea rax, [rbp + 0x27]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, edi
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
nop dword [rax + rax]
test eax, eax
jne 0x1400032e3
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
cmp eax, 0x7a
jne 0x1400032e3
mov edx, dword [rbp + 0x27]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
je 0x1400032e3
mov r9d, dword [rbp + 0x27]
lea rax, [rbp + 0x27]
mov rcx, qword [rbp + 0x2f]
mov r8, rbx
mov edx, edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
nop dword [rax + rax]
test eax, eax
je 0x1400032d4
lea rax, [rbp + 0x37]
mov r9d, 0x220
mov qword [rsp + 0x50], rax
lea rcx, [rbp + 0x3f]
mov dword [rsp + 0x48], esi
mov r8d, 0x20
mov dword [rsp + 0x40], esi
mov dl, dil
mov dword [rsp + 0x38], esi
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
nop dword [rax + rax]
test eax, eax
je 0x1400032d4
mov edi, esi
cmp dword [rbx], esi
jbe 0x1400032c4
mov rdx, qword [rbp + 0x37]
mov ecx, edi
add rcx, rcx
mov rcx, qword [rbx + rcx*8 + 8]
call qword [sym.imp.ADVAPI32.dll_EqualSid]
nop dword [rax + rax]
test eax, eax
jne 0x1400032b3
inc edi
cmp edi, dword [rbx]
jb 0x14000328d
jmp 0x1400032c4
mov dword [0x14000e1bc], 1
mov dword [rbp + 0x2b], 1
mov rcx, qword [rbp + 0x37]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
nop dword [rax + rax]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x2f]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
mov eax, dword [rbp + 0x2b]
jmp 0x140003309
mov eax, dword [rbp + 0x2b]
test eax, eax
je 0x140003309
mov dword [0x14000e1bc], 1
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.140008f40
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x140004158
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rdi, rcx
mov ebx, 1
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
nop dword [rax + rax]
cmp eax, 0xffffffff
je 0x1400041eb
test al, 0x10
jne 0x1400041eb
cmp dword [0x14000f660], 0
jne 0x1400041d7
test byte [0x14000ed78], bl
jne 0x1400041d7
mov r8, qword [0x14000e888]
lea r9, [0x140006720]
mov qword [rsp + 0x28], 6
mov edx, 0x7d3
and qword [rsp + 0x20], 0
mov qword [0x14000f890], rdi
call fcn.1400064a0
sub rax, 6
je 0x1400041d7
sub rax, rbx
je 0x1400041f9
cmp rax, 0x832
jne 0x1400041d7
mov dword [0x14000f660], ebx
mov edx, 0x80
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
nop dword [rax + rax]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
xor ebx, ebx
jmp 0x1400041eb
Function at 0x140004204
Capabilities:
Create directory
Delete directory
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x170
mov rax, qword [0x14000e040]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov esi, r8d
mov r9, rcx
test edx, edx
je 0x140004311
lea rdx, [rsp + 0x50]
call fcn.140004fe8
test eax, eax
je 0x1400043c6
lea rbx, [0x14000f670]
mov edi, 0x104
lea r8, [rsp + 0x50]
mov edx, edi
mov rcx, rbx
sub r8, rbx
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x140004280
mov al, byte [r8 + rcx]
test al, al
je 0x140004280
mov byte [rcx], al
inc rcx
sub rdx, 1
jne 0x140004261
test rdx, rdx
lea rax, [rcx - 1]
cmovne rax, rcx
mov byte [rax], 0
test byte [0x14000fec4], 0x20
je 0x1400042fe
xorps xmm0, xmm0
lea rcx, [rsp + 0x20]
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
nop dword [rax + rax]
movzx ecx, word [rsp + 0x20]
test ecx, ecx
je 0x1400042ed
sub ecx, 1
je 0x1400042e4
sub ecx, 1
je 0x1400042db
cmp ecx, 1
jne 0x1400042fe
lea r8, [0x14000ba28]
jmp 0x1400042f4
lea r8, str.alpha
jmp 0x1400042f4
lea r8, str.mips
jmp 0x1400042f4
lea r8, str.i386
mov edx, edi
mov rcx, rbx
call fcn.14000896c
lea r8, [0x14000b760]
mov edx, edi
mov rcx, rbx
call fcn.14000896c
jmp 0x140004350
lea rbx, [0x14000f670]
mov edi, 0x104
mov rcx, rbx
sub r9, rbx
lea rax, [rdi + 0x7ffffefa]
test rax, rax
je 0x140004342
mov al, byte [r9 + rcx]
test al, al
je 0x140004342
mov byte [rcx], al
inc rcx
sub rdi, 1
jne 0x140004323
test rdi, rdi
lea rax, [rcx - 1]
cmovne rax, rcx
mov byte [rax], 0
mov rcx, rbx
call fcn.140005ee0
test eax, eax
jne 0x14000437b
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
nop dword [rax + rax]
test eax, eax
je 0x14000439a
mov dword [0x14000ed60], 1
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call fcn.140005b50
test eax, eax
je 0x1400043a7
and dword [0x14000f5a4], 0
mov eax, 1
jmp 0x1400043c8
call fcn.140006580
mov dword [0x14000f5a4], eax
jmp 0x1400043c6
cmp dword [0x14000ed60], 0
je 0x1400043c6
and dword [0x14000ed60], 0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
nop dword [rax + rax]
xor eax, eax
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.140008f40
lea r11, [rsp + 0x170]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1400043f4
Capabilities:
Delete file
Delete registry value
Persist via run registry key
Set current directory
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x160
mov rax, qword [0x14000e040]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rbx, qword [0x14000f668]
jmp 0x140004476
cmp dword [0x14000ed64], 0
mov rdi, rbx
jne 0x140004454
cmp dword [0x14000fec0], 0
jne 0x140004454
mov rcx, qword [rbx]
mov edx, 0x80
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
nop dword [rax + rax]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
nop dword [rax + rax]
mov rcx, qword [rdi]
mov rbx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_LocalFree]
nop dword [rax + rax]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
nop dword [rax + rax]
test rbx, rbx
jne 0x14000441c
mov eax, dword [0x14000ed60]
mov ebx, 1
test eax, eax
je 0x14000451f
cmp dword [0x14000ed64], 0
jne 0x14000451f
cmp dword [0x14000fec0], 0
jne 0x14000451f
lea r8, [0x14000f670]
mov edx, 0x104
lea rax, [rsp + 0x40]
sub r8, rax
lea rcx, [rsp + 0x40]
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x1400044db
mov al, byte [r8 + rcx]
test al, al
je 0x1400044db
mov byte [rcx], al
add rcx, rbx
sub rdx, rbx
jne 0x1400044bd
test rdx, rdx
lea rax, [rcx - 1]
cmovne rax, rcx
test byte [0x14000fec4], 0x20
mov byte [rax], 0
je 0x1400044fc
lea rcx, [rsp + 0x40]
call fcn.140008a04
lea rcx, [0x14000b830]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
nop dword [rax + rax]
lea rcx, [rsp + 0x40]
call fcn.1400026b4
mov eax, dword [0x14000ed60]
cmp word [0x14000fed8], bx
je 0x140004595
test eax, eax
je 0x140004595
and qword [rsp + 0x30], 0
cmp byte [0x14000e830], 0
je 0x140004595
lea rax, [rsp + 0x30]
mov r9d, 0x20006
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
nop dword [rax + rax]
test eax, eax
jne 0x140004595
mov rcx, qword [rsp + 0x30]
lea rdx, [0x14000e830]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
and dword [0x14000ed60], 0
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.140008f40
mov rbx, qword [rsp + 0x170]
add rsp, 0x160
pop rdi
ret
Function at 0x140004714
Capabilities:
Get common file path
Set current directory

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x260
mov rax, qword [0x14000e040]
xor rax, rsp
mov qword [rsp + 0x250], rax
xor edi, edi
cmp word [0x14000ed78], di
jne 0x140004769
cmp dword [0x14000ed64], edi
jne 0x14000475c
call fcn.1400056c8
test eax, eax
je 0x14000485d
cmp word [0x14000ed78], di
jne 0x140004769
call fcn.1400045c4
test eax, eax
je 0x14000485d
call fcn.140004f28
test eax, eax
je 0x14000485d
call fcn.14000522c
test eax, eax
je 0x14000485d
mov ebx, 0x105
lea rcx, [rsp + 0x30]
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
nop dword [rax + rax]
lea r8, str.advapi32.dll
mov edx, ebx
lea rcx, [rsp + 0x30]
call fcn.14000896c
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
je 0x1400047f0
lea rdx, str.DecryptFileA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
nop dword [rax + rax]
test rax, rax
je 0x1400047f0
xor edx, edx
lea rcx, [0x14000f670]
call fcn.14000a010
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop dword [rax + rax]
cmp dword [0x14000ed64], edi
jne 0x14000489a
cmp dword [0x14000fec0], edi
jne 0x14000489a
mov edx, 0x104
lea rcx, [rsp + 0x140]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
nop dword [rax + rax]
test eax, eax
jne 0x140004881
mov edx, 0x4f0
xor r9d, r9d
mov dword [rsp + 0x28], edi
xor r8d, r8d
mov dword [rsp + 0x20], FDICopy
xor ecx, ecx
call fcn.1400061d8
call fcn.140006580
mov dword [0x14000f5a4], eax
xor eax, eax
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140008f40
mov rbx, qword [rsp + 0x270]
add rsp, 0x260
pop rdi
ret
mov edx, 2
lea rcx, [rsp + 0x140]
mov r8d, edx
call fcn.140005b50
test eax, eax
je 0x14000485d
lea rcx, [0x14000f670]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
nop dword [rax + rax]
test eax, eax
jne 0x1400048b8
mov edx, 0x4bc
jmp 0x140004839
cmp dword [0x14000ed6c], edi
jne 0x140004938
lea rax, [0x14000f0a0]
mov ecx, 0x28
mov dword [rax], 1
lea rax, [rax + 0x20]
sub rcx, 1
jne 0x1400048cc
test byte [0x14000ed78], 1
jne 0x140004954
test byte [0x14000fec4], 1
jne 0x140004954
mov eax, dword [0x14000e21c]
lea r9, [0x1400049c0]
neg eax
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
sbb rdx, rdx
xor r8d, r8d
add rdx, 0x7d5
call fcn.1400064a0
test rax, rax
je 0x14000495d
lea rcx, [0x140006ed0]
call fcn.140007c68
test eax, eax
je 0x14000485d
mov dword [0x14000f5a4], edi
mov eax, dword [0x14000f088]
test al, 0x40
jne 0x14000496c
test al, al
js 0x14000496c
movzx ecx, word [0x14000fed8]
call fcn.1400034f4
jmp 0x14000496e
call fcn.140004bf0
test eax, eax
jne 0x14000491e
mov dword [0x14000f5a4], 0x8007042b
jmp 0x14000485d
mov eax, edi
mov dword [0x14000fedc], eax
mov eax, dword [0x14000ed64]
test eax, eax
jne 0x140004999
cmp dword [0x14000fec0], edi
jne 0x140004999
call fcn.1400072ac
test eax, eax
je 0x14000485d
mov eax, dword [0x14000ed64]
cmp word [0x14000ed78], di
jne 0x1400049ab
test eax, eax
jne 0x1400049ab
call fcn.140004e44
mov eax, 1
jmp 0x14000485f
Function at 0x140004bf0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
xor r8d, r8d
lea rcx, str.CABINET
xor edx, edx
call fcn.140005150
mov r8d, 0xa
mov dword [0x14000f5c8], eax
lea rdx, str.CABINET
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
nop dword [rax + rax]
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
nop dword [rax + rax]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
nop dword [rax + rax]
mov qword [0x14000f5c0], rax
test rax, rax
je 0x140004e31
mov rcx, qword [0x14000e888]
test rcx, rcx
je 0x140004cb6
mov edx, 0x842
call qword [sym.imp.USER32.dll_GetDlgItem]
nop dword [rax + rax]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
nop dword [rax + rax]
mov rcx, qword [0x14000e888]
mov edx, 0x841
call qword [sym.imp.USER32.dll_GetDlgItem]
nop dword [rax + rax]
mov rcx, rax
mov edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
nop dword [rax + rax]
call fcn.140007ed0
test eax, eax
jne 0x140004cc9
mov edx, 0x4ba
jmp 0x140004d94
lea rax, [0x14000f5cc]
mov qword [rsp + 0x40], rax
lea r9, [0x140008750]
mov dword [rsp + 0x38], 1
lea rax, [0x140008800]
mov qword [rsp + 0x30], rax
lea r8, [fcn.1400084f0]
lea rax, [fcn.140008240]
mov qword [rsp + 0x28], rax
lea rdx, [0x1400084d0]
lea rax, [0x140008890]
lea rcx, [0x140008220]
mov qword [rsp + 0x20], rax
call qword [sym.imp.Cabinet.dll_FDICreate]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
je 0x140004d88
lea rax, [0x14000f5c0]
xor r9d, r9d
mov qword [rsp + 0x30], rax
lea r8, [0x14000b760]
and qword [rsp + 0x28], 0
lea rax, [0x1400082b0]
lea rdx, str.MEMCAB
mov qword [rsp + 0x20], rax
mov rcx, rdi
call qword [sym.imp.Cabinet.dll_FDICopy]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
je 0x140004db5
mov rcx, rdi
call qword [sym.imp.Cabinet.dll_FDIDestroy]
nop dword [rax + rax]
test eax, eax
jne 0x140004db5
mov edx, dword [0x14000f5cc]
add edx, 0x514
and dword [rsp + 0x28], 0
xor r9d, r9d
mov rcx, qword [0x14000e888]
xor r8d, r8d
mov dword [rsp + 0x20], FDICopy
call fcn.1400061d8
xor ebx, ebx
mov rcx, qword [0x14000f5c0]
test rcx, rcx
je 0x140004dd5
call qword [sym.imp.KERNEL32.dll_FreeResource]
nop dword [rax + rax]
and qword [0x14000f5c0], 0
test ebx, ebx
jne 0x140004dff
cmp dword [0x14000f65c], ebx
jne 0x140004dff
and dword [rsp + 0x28], ebx
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], FDICopy
mov edx, 0x4f8
xor ecx, ecx
call fcn.1400061d8
test byte [0x14000ed78], 1
jne 0x140004e2f
test byte [0x14000fec4], 1
jne 0x140004e2f
mov rcx, qword [0x14000e888]
xor r9d, r9d
movsxd r8, ebx
mov edx, 0xfa1
call qword [sym.imp.USER32.dll_SendMessageA]
nop dword [rax + rax]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret