joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400012dc
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r15
sub rsp, 0x30
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
xor esi, esi
xor eax, eax
lock cmpxchg qword [0x140003638], rbx
je 0x140001328
cmp rax, rbx
jne 0x14000131b
mov ebx, 1
mov esi, ebx
jmp 0x14000132d
mov ecx, 0x3e8
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x140001300
mov ebx, 1
mov eax, dword [0x140003640]
cmp eax, ebx
jne 0x140001343
mov ecx, 0x1f
call sub.msvcrt.dll__amsg_exit
jmp 0x1400013a8
mov eax, dword [0x140003640]
test eax, eax
jne 0x1400013a2
mov dword [0x140003640], ebx
lea r15, [0x1400022c0]
lea rdi, [0x1400022a8]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], eax
cmp rdi, r15
jae 0x140001394
test eax, eax
jne 0x140001398
cmp qword [rdi], 0
je 0x140001389
mov rax, qword [rdi]
mov rcx, qword [0x140002288]
call rcx
mov dword [rsp + 0x20], eax
add rdi, 8
mov qword [rsp + 0x28], rdi
jmp 0x14000136a
test eax, eax
je 0x1400013a8
mov eax, 0xff
jmp 0x140001484
mov dword [0x140003044], ebx
mov eax, dword [0x140003640]
cmp eax, ebx
jne 0x1400013cf
lea rdx, [0x1400022a0]
lea rcx, [0x140002290]
call sub.msvcrt.dll__initterm
mov dword [0x140003640], 2
test esi, esi
jne 0x1400013dc
xor eax, eax
xchg qword [0x140003638], rax
cmp qword [0x140003648], 0
je 0x140001410
lea rcx, [0x140003648]
call fcn.140001650
test eax, eax
je 0x140001410
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x140003648]
mov r9, qword [0x140002288]
call r9
mov r8, qword [0x140003058]
mov rdx, qword [0x140003050]
mov ecx, dword [0x140003048]
call fcn.14000119c
mov dword [0x140003040], eax
cmp dword [0x140003060], 0
jne 0x140001440
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x140003044], 0
jne 0x140001455
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x140003040]
jmp 0x140001484
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r15
ret
sub rsp, 0x28
call fcn.140163000
add rsp, 0x28
jmp 0x1400012dc

Function at 0x140001550
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14000159c
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140001594
cmp dword [rcx + 0x3c], edx
jl 0x140001594
cmp dword [rcx + 0x3c], 0x10000000
jae 0x140001594
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x14000159c
mov rax, rdx
add rsp, 0x18
ret
Function at 0x140001ec0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001f0a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001f0a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001f0a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001f0a
cmp dword [rcx + 0x84], 0xe
jbe 0x140001f0a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001f0c
xor al, al
add rsp, 0x28
ret

Function at 0x140001d40
Capabilities:
Write file on windows

Disassembly:
push rsi
sub rsp, 0x30
mov rsi, rcx
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], r8
mov qword [rsp + 0x58], r9
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov ecx, 2
call fcn.140002290
lea rcx, str.Mingw_w64_runtime_failure:_n
mov edx, 0x1b
mov r8d, 1
mov r9, rax
call sub.msvcrt.dll_fwrite
mov ecx, 2
call fcn.140002290
mov r8, qword [rsp + 0x28]
mov rcx, rax
mov rdx, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
int3

Function at 0x1400023b0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rax, qword [0x140006008]
movzx edx, word [rax]
cmp edx, 0x5a4d
jne 0x14000241c
movsxd rdx, dword [rax + 0x3c]
cmp dword [rax + rdx], 0x4550
jne 0x14000241c
add rax, rdx
movzx edx, word [rax + 0x18]
cmp edx, 0x20b
jne 0x14000241c
movzx edx, word [rax + 6]
test edx, edx
je 0x14000241c
sub rcx, qword [0x140006008]
movzx r8d, word [rax + 0x14]
add rax, r8
add rax, 0x18
jmp 0x140002408
add rax, 0x28
dec edx
je 0x14000241c
mov r8d, dword [rax + 0xc]
cmp rcx, r8
jb 0x140002400
add r8d, dword [rax + 8]
cmp rcx, r8
jae 0x140002400
jmp 0x14000241e
xor eax, eax
ret

Function at 0x140002420
Capabilities:
Parse pe header

Disassembly:
mov rcx, qword [0x140006008]
movzx edx, word [rcx]
xor eax, eax
cmp edx, 0x5a4d
jne 0x140002455
movsxd rdx, dword [rcx + 0x3c]
cmp dword [rcx + rdx], 0x4550
jne 0x140002455
movzx r8d, word [rcx + rdx + 0x18]
cmp r8d, 0x20b
jne 0x140002455
movzx eax, word [rcx + rdx + 6]
ret

Function at 0x1400024d0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140006008]
movzx ecx, word [rax]
cmp ecx, 0x5a4d
jne 0x1400024fc
movsxd rcx, dword [rax + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x1400024fc
movzx ecx, word [rax + rcx + 0x18]
cmp ecx, 0x20b
je 0x1400024fe
xor eax, eax
ret
Function at 0x140001570
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
lea rax, [rsp + 0x30]
mov rbx, rdx
mov rdi, rcx
mov r9d, 1
lea rdx, str.SOFTWARENVIDIA_CorporationNVControlPanel2Client
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
test r8d, r8d
jne 0x1400015aa
mov rcx, 0xffffffff80000001
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140001605
mov rcx, qword [rsp + 0x30]
mov eax, 4
lea r9, [rsp + 0x68]
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x68], eax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov rdx, rdi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x30]
test eax, eax
jne 0x1400015ff
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x140001607
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x140001614
Capabilities:
Identify system language via api

Disassembly:
push rbx
sub rsp, 0x20
and qword [rsp + 0x40], 0
and dword [rsp + 0x38], 0
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rdx, [rsp + 0x38]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
je 0x14000168b
mov ecx, dword [rsp + 0x38]
test ecx, ecx
je 0x14000168b
cmp ecx, 0xffffffff
je 0x14000168b
lea rdx, [rsp + 0x40]
call sub.WTSAPI32.dll_WTSQueryUserToken
test eax, eax
je 0x14000168b
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
mov word [rbx], ax
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140001684
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x14000168d
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x140001b84
Capabilities:
Identify system language via api

Disassembly:
push rbx
sub rsp, 0x20
xor ebx, ebx
lea rdx, [rsp + 0x38]
lea rcx, str.UserDefinedLocale
xor r8d, r8d
mov word [rsp + 0x30], bx
mov dword [rsp + 0x38], ebx
call fcn.140001570
test eax, eax
jne 0x140001bcd
lea rcx, [rsp + 0x30]
call fcn.140001614
test eax, eax
jne 0x140001bc3
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
jmp 0x140001bc8
movzx eax, word [rsp + 0x30]
movzx ecx, ax
jmp 0x140001bd1
mov ecx, dword [rsp + 0x38]
call fcn.1400019b8
mov ecx, 0x3ff
and ax, cx
mov ecx, 1
cmp ax, cx
je 0x140001bf2
cmp ax, 0xd
je 0x140001bf2
xor eax, eax
jmp 0x140001bf4
mov eax, ecx
add rsp, 0x20
pop rbx
ret
Function at 0x140001bfc
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [rcx]
lea rdx, str.NvCplApiGetSetting
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rdi]
lea rdx, str.NvCplApiSetSetting
mov qword [rdi + 0x10], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rdi]
lea rdx, str.NvCplApiInit
mov qword [rdi + 0x18], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rdi]
lea rdx, str.NvCplApiGetInfo
mov qword [rdi + 8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rdi]
lea rdx, str.NvCplApiEnumSettingValues
mov qword [rdi + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rdi]
lea rdx, str.NvCplApiExecute
mov qword [rdi + 0x28], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor ebx, ebx
mov qword [rdi + 0x30], rax
cmp qword [rdi], rbx
je 0x140001c9f
cmp qword [rdi + 8], rbx
je 0x140001c9f
call fcn.14005699c
test eax, eax
sete bl
xor edx, edx
mov ecx, ebx
call qword [rdi + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140001eb4
Capabilities:
Identify system language via api

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
call fcn.1400678dc
xor edi, edi
lea rdx, [rsp + 0x40]
lea rcx, str.UserDefinedLocale
xor r8d, r8d
mov ebx, 0xa807
mov word [rsp + 0x38], di
mov dword [rsp + 0x40], edi
call fcn.140001570
test eax, eax
jne 0x140001f0b
lea rcx, [rsp + 0x38]
call fcn.140001614
test eax, eax
jne 0x140001f01
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
jmp 0x140001f06
movzx eax, word [rsp + 0x38]
movzx ecx, ax
jmp 0x140001f0f
mov ecx, dword [rsp + 0x40]
call fcn.1400019b8
movzx ecx, ax
movzx edx, ax
and ecx, 0x3ff
shr dx, 0xa
cmp ecx, 0x12
jg 0x14000203b
je 0x140002031
cmp ecx, 0xa
jg 0x140001fd7
je 0x140001fbc
dec ecx
je 0x140001fb2
sub ecx, 3
je 0x140001f91
dec ecx
je 0x140001f87
dec ecx
je 0x140001f7d
dec ecx
je 0x140001f73
dec ecx
je 0x140001f69
dec ecx
jne 0x1400020e4
mov ebx, 0xa80d
jmp 0x1400020e4
mov ebx, 0xa80c
jmp 0x1400020e4
mov ebx, 0xa80b
jmp 0x1400020e4
mov ebx, 0xa80a
jmp 0x1400020e4
mov ebx, 0xa809
jmp 0x1400020e4
movzx eax, dx
cmp eax, 2
je 0x140001fa8
cmp eax, 4
je 0x140001fa8
mov ebx, 0xa823
jmp 0x1400020e4
mov ebx, 0xa822
jmp 0x1400020e4
mov ebx, 0xa808
jmp 0x1400020e4
movzx ecx, dx
dec ecx
je 0x140001fcd
mov ebx, 0xa80f
jmp 0x1400020e4
mov ebx, 0xa80e
jmp 0x1400020e4
sub ecx, 0xb
je 0x140002027
dec ecx
je 0x14000201d
dec ecx
je 0x140002013
dec ecx
je 0x140002009
sub ecx, 2
je 0x140001fff
dec ecx
jne 0x1400020e4
mov ebx, 0xa815
jmp 0x1400020e4
mov ebx, 0xa814
jmp 0x1400020e4
mov ebx, 0xa813
jmp 0x1400020e4
mov ebx, 0xa812
jmp 0x1400020e4
mov ebx, 0xa811
jmp 0x1400020e4
mov ebx, 0xa810
jmp 0x1400020e4
mov ebx, 0xa816
jmp 0x1400020e4
cmp ecx, 0x40
jg 0x1400020d7
cmp ecx, 0x3f
jge 0x1400020df
cmp ecx, 0x1b
jg 0x14000209d
je 0x140002096
sub ecx, 0x13
je 0x14000208f
dec ecx
je 0x140002088
dec ecx
je 0x140002081
dec ecx
je 0x14000206c
cmp ecx, 3
je 0x1400020df
jmp 0x1400020e4
movzx ecx, dx
dec ecx
je 0x14000207a
mov ebx, 0xa81a
jmp 0x1400020e4
mov ebx, 0xa81b
jmp 0x1400020e4
mov ebx, 0xa819
jmp 0x1400020e4
mov ebx, 0xa818
jmp 0x1400020e4
mov ebx, 0xa817
jmp 0x1400020e4
mov ebx, 0xa81d
jmp 0x1400020e4
cmp ecx, 0x1d
je 0x1400020d0
cmp ecx, 0x1e
je 0x1400020c9
cmp ecx, 0x1f
je 0x1400020c2
cmp ecx, 0x21
jle 0x1400020e4
cmp ecx, 0x23
jle 0x1400020df
cmp ecx, 0x24
jne 0x1400020e4
mov ebx, 0xa81e
jmp 0x1400020e4
mov ebx, 0xa821
jmp 0x1400020e4
mov ebx, 0xa820
jmp 0x1400020e4
mov ebx, 0xa81f
jmp 0x1400020e4
lea eax, [rcx - 0x43]
cmp eax, 1
ja 0x1400020e4
mov ebx, 0xa81c
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140008dfc
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx], 0
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
je 0x140008e5f
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140008e73
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140008e73
mov rcx, qword [rbx]
and qword [rsp + 0x28], 0
xor r9d, r9d
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call rax
jmp 0x140008e78
cmp dword [rcx + 8], 0
je 0x140008e73
mov rdx, r8
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x140008e78
mov eax, 1
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x140008e88
Capabilities:
Delete registry key

Disassembly:
cmp qword [rcx + 0x10], 0
je 0x140008e9e
mov r8, rdx
mov rdx, qword [rcx]
mov rcx, qword [rcx + 0x10]
jmp fcn.140008dfc
mov rcx, qword [rcx]
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]

Function at 0x140009018
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x30
xor edi, edi
mov rbx, r8
mov rbp, rdx
mov r12, rcx
test r8, r8
jne 0x140009046
lea eax, [rdi + 0xd]
jmp 0x14000907d
mov rsi, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
lea rsi, [rsi + rax*2]
lea edi, [rdi + rax*2]
cmp eax, 1
jne 0x140009049
mov rcx, qword [r12]
lea r9d, [rax + 6]
xor r8d, r8d
mov rdx, rbp
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r12
ret
Function at 0x14000d548
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0x90
mov rax, qword [0x1402ef1f8]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov bl, r9b
mov rsi, r8
lea r9, [rbp - 0x25]
lea r8, [rbp - 0x21]
call fcn.14000c2c0
test bl, bl
je 0x14000d62f
lea rcx, str.COMCTL32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rdi, rax
test rax, rax
je 0x14000d62f
mov edx, 0x3ee
mov r8d, 5
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x14000d62f
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x14000d62f
lea r8, [rbp - 0x29]
lea rdx, [rbp - 9]
mov rcx, rax
call fcn.14000d0a4
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test ebx, ebx
je 0x14000d62f
movzx edx, word [rbp - 0x29]
lea r9, [rbp - 0x19]
lea r8, [rbp - 0x11]
lea rcx, [rbp - 9]
call fcn.14000c2c0
mov edx, dword [rbp - 0x21]
mov ecx, dword [rsi]
mov r8d, 4
call qword [sym.imp.KERNEL32.dll_MulDiv]
mov edx, dword [rbp - 0xd]
mov ecx, dword [rsi + 4]
mov r8d, 8
mov dword [rsi], eax
call qword [sym.imp.KERNEL32.dll_MulDiv]
mov r8d, dword [rbp - 0x19]
mov edx, dword [rbp - 0x25]
mov dword [rsi + 4], eax
mov ecx, eax
jmp 0x14000d64e
mov edx, dword [rbp - 0x21]
mov ecx, dword [rsi]
mov r8d, 4
call qword [sym.imp.KERNEL32.dll_MulDiv]
mov edx, dword [rbp - 0x1d]
mov ecx, dword [rsi + 4]
mov dword [rsi], eax
mov r8d, 8
call qword [sym.imp.KERNEL32.dll_MulDiv]
mov dword [rsi + 4], eax
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.1401be840
mov rbx, qword [rsp + 0xc8]
add rsp, 0x90
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000d678
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
sub rsp, 0x490
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov rax, qword [0x1402ef1f8]
xor rax, rsp
mov qword [rsp + 0x480], rax
mov r12, r9
mov rdi, r8
mov rax, rdx
xor ebx, ebx
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x70], rbx
xor edx, edx
lea r8d, [rbx + 2]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rsi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x14000d6ec
call fcn.140008bd0
mov ebx, eax
jmp 0x14000d7fb
mov r8, r12
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdi, rax
test rax, rax
jne 0x14000d70d
call fcn.140008bd0
jmp 0x14000d7ef
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r12, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x14000d703
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov dword [rsp + 0x30], eax
inc eax
cmp eax, edi
jae 0x14000d748
mov ebx, 0x8007000e
jmp 0x14000d7f1
mov ecx, eax
test eax, eax
je 0x14000d785
xor edx, edx
or rax, 0xffffffffffffffff
div rcx
cmp rax, 2
jb 0x14000d77b
lea rdx, [rcx + rcx]
cmp rdx, 0x400
jbe 0x14000d785
lea rcx, [rsp + 0x70]
call fcn.140069b98
mov rax, qword [rsp + 0x70]
jmp 0x14000d78f
mov ecx, 0x80070216
call fcn.1400013b4
lea rax, [rsp + 0x78]
mov qword [rsp + 0x70], rax
jmp 0x14000d7a6
test rax, rax
je 0x14000d73e
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
mov r9d, edi
mov r8, r12
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x14000d703
mov ecx, eax
mov rax, qword [rsp + 0x70]
mov word [rax + rcx*2], bx
mov r8d, dword [rsp + 0x4d0]
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.14000baec
mov ebx, eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rax, [rsp + 0x78]
cmp qword [rsp + 0x70], rax
je 0x14000d812
lea rcx, [rsp + 0x70]
call fcn.1400096a0
nop
mov eax, ebx
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.1401be840
mov rbx, qword [rsp + 0x4b0]
add rsp, 0x490
pop r12
pop rdi
pop rsi
ret
Function at 0x14000e034
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
test rdx, rdx
jne 0x14000e058
mov eax, 0x80004003
jmp 0x14000e0ef
mov rcx, qword [0x1402fdea0]
mov edx, 0x68
lea r8d, [rdx - 0x63]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
jne 0x14000e07a
mov eax, 0x8000ffff
jmp 0x14000e0ef
mov rcx, qword [0x1402fdea0]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x14000e073
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
je 0x14000e073
lea rdx, [rsi + 0x1c]
mov r8b, 1
mov rcx, rax
call fcn.14000df90
mov dword [rdi], 0x30
mov edx, dword [rsi + 0x24]
mov rcx, rsi
call fcn.14000cc94
mov rcx, rsi
mov qword [rdi + 8], rax
mov rax, qword [rsi + 0x1c]
mov qword [rdi + 0x10], rax
mov edx, dword [rsi + 0x28]
call fcn.14000cc94
mov rcx, rsi
mov qword [rdi + 0x20], rax
mov edx, dword [rsi + 0x2c]
call fcn.14000cc94
mov qword [rdi + 0x18], rax
mov eax, dword [rsi + 0x30]
mov dword [rdi + 0x28], eax
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140012fd0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
mov rbp, rsp
sub rsp, 0x80
mov qword [rbp - 0x48], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rax, qword [0x1402ef1f8]
xor rax, rsp
mov qword [rbp - 8], rax
mov ebx, edx
mov rsi, rcx
mov qword [rbp - 0x38], rcx
xor edi, edi
mov qword [rcx], rdi
mov qword [rcx + 8], rdi
mov qword [rcx + 0x10], rdi
lea rdx, [rbp - 0x30]
call fcn.140012f78
nop
lea r8, [rbp - 0x30]
cmp qword [rbp - 0x18], 8
cmovae r8, qword [rbp - 0x30]
movzx edx, bx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov r12, rax
test rax, rax
je 0x14001316e
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x14001316e
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x14001316e
mov rdx, r12
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
movsxd r12, eax
mov rdx, r12
lea ecx, [rdi + 0x42]
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov qword [rsi], rax
test rax, rax
je 0x14001316e
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
test rax, rax
je 0x14001316e
mov qword [rbp - 0x60], rdi
mov r8, r12
mov rdx, rbx
mov rcx, rax
call fcn.1401be870
lea r8, [rbp - 0x60]
xor edx, edx
mov rcx, qword [rsi]
call qword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
setns r12b
test r12b, r12b
je 0x14001310e
lea ecx, [rdi + 0x18]
call sub.gdiplus.dll_GdipAlloc
mov rbx, rax
test rax, rax
je 0x1400130ff
mov rcx, qword [rbp - 0x60]
lea rax, vtable.Gdiplus::Image.0
mov qword [rbx], rax
lea rdx, [rbx + 8]
mov qword [rdx], rdi
call sub.gdiplus.dll_GdipLoadImageFromStream
mov dword [rbx + 0x10], eax
jmp 0x140013102
mov rbx, rdi
mov rdx, rbx
lea rcx, [rsi + 8]
call fcn.140012eec
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
test r12b, r12b
jne 0x14001315e
mov ecx, 0x18
call fcn.14005b2a8
mov qword [rbp - 0x40], rax
test rax, rax
je 0x140013149
lea rcx, str.ResourceImage_could_not_load_resource
mov qword [rbp - 0x58], rcx
lea rdx, [rbp - 0x58]
mov rcx, rax
call fcn.1401bf108
mov rdi, rax
mov qword [rbp - 0x50], rdi
lea rdx, [0x1402dd568]
lea rcx, [rbp - 0x50]
call fcn.1401bf5b4
nop
mov rcx, qword [rbp - 0x60]
test rcx, rcx
je 0x14001316e
mov rdx, qword [rcx]
call qword [rdx + reloc.OLEAUT32.dll_SafeArrayGetDim]
nop
cmp qword [rbp - 0x18], 8
jb 0x14001317f
mov rcx, qword [rbp - 0x30]
call fcn.14005b2ec
nop
mov rax, rsi
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1401be840
mov rbx, qword [rsp + 0xc0]
add rsp, 0x80
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140013700
Capabilities:
Create process on windows
Query environment variable

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
push rdi
sub rsp, 0x300
mov rax, qword [0x1402ef1f8]
xor rax, rsp
mov qword [rsp + 0x2f0], rax
mov ebx, 0x104
lea rdx, [r11 - 0x228]
lea rcx, str.ProgramFiles_x86_
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
movsxd rdi, eax
test eax, eax
jne 0x140013756
mov eax, 1
jmp 0x140013871
lea eax, [rdi + 0x32]
xor esi, esi
cmp eax, ebx
jle 0x140013782
movsxd rcx, eax
lea eax, [rsi + 2]
mul rcx
lea rcx, [rsi - 1]
cmovo rax, rcx
mov rcx, rax
call fcn.14005b2f4
mov esi, 1
mov rbx, rax
jmp 0x14001378a
lea rbx, [rsp + 0xe0]
lea eax, [rdi + 1]
lea rdx, str.NVIDIA_Corporation3DTV
mov ebp, 0x5c
movsxd rcx, eax
mov word [rbx + rdi*2], bp
lea rcx, [rbx + rcx*2]
call fcn.1401c0a08
lea r11d, [rdi + 0x18]
lea rdx, str.3DVSerialize.exe
movsxd rax, r11d
mov word [rbx + rax*2], bp
lea eax, [r11 + 1]
movsxd rcx, eax
lea rcx, [rbx + rcx*2]
call fcn.1401c0a08
lea r11d, [rdi + 0x29]
lea ecx, [rbp - 0x3c]
movsxd rax, r11d
lea rdx, str._TestUi
mov word [rbx + rax*2], cx
lea eax, [r11 + 1]
movsxd rcx, eax
lea rcx, [rbx + rcx*2]
call fcn.1401c0a08
lea edi, [rbp + 0xc]
lea rcx, [rsp + 0x70]
mov r8d, edi
xor edx, edx
call fcn.1401bfd60
lea r8d, [rbp - 0x44]
lea rcx, [rsp + 0x50]
xor edx, edx
call fcn.1401bfd60
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x40], rax
and qword [rsp + 0x38], 0
and qword [rsp + 0x30], 0
mov rdx, rbx
xor ecx, ecx
mov dword [rsp + 0x28], 0x4000000
and dword [rsp + 0x20], 0
mov dword [rsp + 0x70], edi
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x140013863
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x14001374c
test esi, esi
je 0x14001386f
mov rcx, rbx
call fcn.14005b2ec
xor eax, eax
mov rcx, qword [rsp + 0x2f0]
xor rcx, rsp
call fcn.1401be840
lea r11, [rsp + 0x300]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140014990
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
test rdx, rdx
jne 0x1400149b4
mov eax, 0x80004003
jmp 0x140014a4d
mov rcx, qword [0x1402fdea0]
mov edx, UnRegisterTypeLib
mov r8d, 5
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
jne 0x1400149d8
mov eax, 0x8000ffff
jmp 0x140014a4d
mov rcx, qword [0x1402fdea0]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x1400149d1
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
je 0x1400149d1
lea rdx, [rsi + 0x1c]
mov r8b, 1
mov rcx, rax
call fcn.14000df90
mov dword [rdi], 0x30
mov edx, dword [rsi + 0x24]
mov rcx, rsi
call fcn.14000cc94
mov rcx, rsi
mov qword [rdi + 8], rax
mov rax, qword [rsi + 0x1c]
mov qword [rdi + 0x10], rax
mov edx, dword [rsi + 0x28]
call fcn.14000cc94
mov rcx, rsi
mov qword [rdi + 0x20], rax
mov edx, dword [rsi + 0x2c]
call fcn.14000cc94
mov qword [rdi + 0x18], rax
mov eax, dword [rsi + 0x30]
mov dword [rdi + 0x28], eax
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret