joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000afddc
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x38
mov r12, rdx
mov rdx, r9
mov rdi, r9
mov r13, r8
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x1000affaf
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdx, rdi
mov rcx, rbx
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
test rbp, rbp
je 0x1000affa6
test eax, eax
je 0x1000affa6
lea rdx, [0x100002840]
mov ecx, 0xa8
call fcn.10007b104
mov rbx, rax
test rax, rax
je 0x1000afedd
and qword [rbx + 0x38], 0
and qword [rbx + 0x40], 0
and qword [rbx + 0x50], 0
and qword [rbx + 0x58], 0
mov dword [rbx + 8], 1
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x28], rdi
mov qword [rbx + 0x30], rbp
mov qword [rbx + 0x48], rsi
mov byte [rbx + 0x60], 0
lea rax, [0x10002e720]
mov rcx, r12
mov qword [rbx], rax
or rax, 0xffffffffffffffff
mov qword [rbx + 0x18], rax
mov qword [rbx + 0x20], rax
and qword [rbx + 0x68], 0
and qword [rbx + 0x70], 0
and qword [rbx + 0x80], 0
mov qword [rbx + 0x78], 0x64
and qword [rbx + 0x88], 0
and qword [rbx + 0x90], 0
and qword [rbx + 0xa0], 0
mov qword [rbx + 0x98], 0xa
mov rax, qword [r12]
call qword [rax + 8]
jmp 0x1000afedf
xor ebx, ebx
test rbx, rbx
jne 0x1000afef7
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, 0x8007000e
jmp 0x1000affb4
mov rcx, rbx
call fcn.1000af014
mov edi, eax
test eax, eax
jns 0x1000aff15
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx + 0x10]
mov eax, edi
jmp 0x1000affb4
mov rdx, qword [rbx + 0x30]
mov rax, qword [rdx + 0x10]
lea rcx, [rdx + 0x20]
lea rsi, [rdx + rax]
mov qword [rsp + 0x20], rcx
cmp rcx, rsi
jae 0x1000aff4c
lea rdx, [rsp + 0x20]
mov r8, rsi
mov rcx, rbx
call fcn.1000af0a8
mov edi, eax
test eax, eax
js 0x1000aff4e
cmp qword [rsp + 0x20], rsi
jb 0x1000aff2f
xor edi, edi
test edi, edi
js 0x1000aff90
mov rcx, qword [rbx + 0x38]
mov rax, qword [rbx + 0x50]
lea r8, [rcx + rax]
mov qword [rsp + 0x20], rcx
mov rax, r8
sub rax, rcx
cmp rax, 8
jae 0x1000aff76
mov eax, 0x8876038f
jmp 0x1000aff8e
lea r9, [rbx + 0x88]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.1000b04f8
test eax, eax
jns 0x1000aff9e
mov edi, eax
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x10]
jmp 0x1000aff0e
mov qword [r13], rbx
xor eax, eax
jmp 0x1000affb4
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, 0x8876038b
add rsp, 0x38
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1000e4918
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov rdi, qword [rcx + 8]
mov rbx, rcx
test rdi, rdi
je 0x1000e496d
cmp qword [rcx], 0
je 0x1000e496d
cmp dword [rcx + 0x10], 0
jle 0x1000e4969
mov r8d, dword [rbx + 0x10]
mov rcx, qword [rbx]
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1000e496d
mov ecx, dword [rsp + 0x40]
sub dword [rbx + 0x10], ecx
add rdi, rcx
cmp dword [rbx + 0x10], 0
jg 0x1000e493a
xor eax, eax
jmp 0x1000e4972
mov eax, 0x80004005
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x1000e4fa4
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov r10, qword [rdx + 8]
mov rbp, rcx
test r10, r10
je 0x1000e4fc7
mov r10, qword [r10]
jmp 0x1000e4fd9
mov r10, qword [rdx + 0x10]
test r10, r10
je 0x1000e4fd6
mov r10, qword [r10 + 8]
jmp 0x1000e4fd9
xor r10d, r10d
mov rbx, qword [rdx]
mov rsi, qword [rdx + 0x18]
test r10, r10
jne 0x1000e4fef
mov eax, 0x80004005
jmp 0x1000e514d
and dword [rsp + 0x58], 0
xor eax, eax
mov rdi, r10
and qword [rsp + 0x20], rax
or r14, 0xffffffffffffffff
lea r9, [rsp + 0x58]
mov rcx, r14
mov rdx, r10
repne scasb al, byte [rdi]
not rcx
mov r8d, ecx
mov rcx, qword [rbp + 0x60]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1000e502d
mov eax, 0x8007000e
jmp 0x1000e514d
xor eax, eax
mov rcx, r14
mov rdi, rbx
and qword [rsp + 0x20], rax
repne scasb al, byte [rdi]
lea r9, [rsp + 0x58]
not rcx
mov rdx, rbx
mov r8d, ecx
mov rcx, qword [rbp + 0x60]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1000e5023
test rsi, rsi
je 0x1000e5120
xor ebx, ebx
cmp qword [rsi], rbx
jbe 0x1000e5120
mov rax, qword [rsi + 0x18]
movsxd rcx, ebx
mov rdi, qword [rax + rcx*8]
cmp dword [rdi], 0
je 0x1000e50b3
mov rcx, qword [rbp + 0x60]
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x58]
lea rdx, [0x10002e437]
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1000e5023
and qword [rsp + 0x20], 0
mov r8d, 4
mov rdx, rdi
jmp 0x1000e50fd
cmp qword [rdi + 8], 0
je 0x1000e5114
mov rcx, qword [rbp + 0x60]
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x58]
lea rdx, [0x10002e438]
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1000e5023
mov rdx, qword [rdi + 8]
xor eax, eax
mov rcx, r14
mov rdi, rdx
repne scasb al, byte [rdi]
and qword [rsp + 0x20], rax
not rcx
mov r8d, ecx
mov rcx, qword [rbp + 0x60]
lea r9, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1000e5023
inc rbx
cmp rbx, qword [rsi]
jb 0x1000e506c
mov rcx, qword [rbp + 0x60]
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x58]
lea rdx, [0x10002e439]
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_WriteFile]
neg eax
sbb eax, eax
not eax
and eax, 0x8007000e
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x1000e6534
Capabilities:
Get memory capacity

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x60
mov rbp, rcx
lea rcx, [0x1000322b8]
mov esi, 1
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
je 0x1000e6592
lea rdx, [0x1000322c8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
je 0x1000e6584
mov rcx, rbp
call rdi
mov esi, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test rdi, rdi
jne 0x1000e65e9
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x38
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov rax, qword [rsp + 0x30]
mov r11d, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x40]
and qword [rbp + 0x38], 0
mov qword [rbp + 0x10], rax
mov rax, qword [rsp + 0x50]
mov dword [rbp + 4], r11d
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x30], rax
mov rax, qword [rsp + 0x38]
mov qword [rbp + 0x18], rax
mov rax, qword [rsp + 0x28]
mov qword [rbp + 8], rax
mov rax, qword [rsp + 0x48]
mov qword [rbp + 0x28], rax
lea r11, [rsp + 0x60]
mov eax, esi
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1000e8ecc
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x90
mov rbp, rcx
mov rcx, qword [r8 + 0x50]
mov r13d, r9d
mov rax, qword [rcx]
mov rbx, r8
mov r14, rdx
call qword [rax + 0x18]
mov ecx, dword [rbp + 0x208]
xor r8d, r8d
mov esi, dword [rax + 0xc]
mov rdi, rax
lea edx, [r8 + 1]
add rsi, qword [r14]
mov r12d, dword [rdi + 4]
lea r9, [rsp + 0x80]
mov qword [rsp + 0x78], rsi
mov eax, r8d
mov dword [rsp + 0xe0], r12d
test dl, cl
jne 0x1000e8f48
cmp r13d, r8d
je 0x1000e8f48
or ecx, edx
mov dword [rbp + 0x204], r8d
mov dword [rbp + 0x208], ecx
cmp qword [rbx + 0x58], r8
je 0x1000e9083
mov eax, dword [rdi + 0x10]
mov r15d, dword [rdi + 0x14]
movzx r13d, r8w
add rax, qword [r14]
add r15, qword [r14]
mov qword [rsp + 0xd0], rax
mov eax, dword [rdi + 0x18]
add rax, qword [r14]
cmp r8w, word [rbx + 0x76]
jae 0x1000e9079
mov rsi, qword [rsp + 0xd0]
mov r12, rax
mov r14d, edx
movzx eax, r13w
lea rdx, [rax + rax*2]
mov eax, dword [rbp + 0x60]
shl rdx, 4
add rdx, qword [rbx + 0x48]
mov r11, qword [rdx + 8]
mov rcx, qword [r11 + 0x10]
cmp dword [rcx], eax
jbe 0x1000e9055
mov r10, qword [rdx + 0x10]
movzx ecx, word [r10 + 4]
cmp ecx, r8d
je 0x1000e9019
sub ecx, r14d
je 0x1000e9009
cmp ecx, r14d
jne 0x1000e9055
movzx eax, word [r10 + 6]
shl eax, 2
cdqe
lea r8, [rsi + rax*8]
or dword [rsp + 0x38], 0xffffffff
movzx r9d, word [r10 + 8]
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x30], rax
mov rax, qword [rbx + 0x58]
mov qword [rsp + 0x28], r10
mov rdx, r11
mov rcx, rbp
mov qword [rsp + 0x20], rax
call fcn.1000f0794
jmp 0x1000e9052
movzx eax, word [r10 + 6]
shl eax, 2
cdqe
lea r8, [r12 + rax*8]
jmp 0x1000e8fd7
or dword [rsp + 0x38], 0xffffffff
movzx eax, word [r10 + 6]
movzx r9d, word [r10 + 8]
lea r8, [r15 + rax*8]
lea rax, [rsp + 0xd0]
mov rdx, r11
mov qword [rsp + 0x30], rax
mov rax, qword [rbx + 0x58]
mov qword [rsp + 0x28], r10
mov rcx, rbp
mov qword [rsp + 0x20], rax
call fcn.1000f0c48
xor r8d, r8d
add r13w, r14w
cmp r13w, word [rbx + 0x76]
jb 0x1000e8f8a
mov rsi, qword [rsp + 0x78]
mov r12d, dword [rsp + 0xe0]
mov r14, qword [rsp + 0xd8]
mov r9d, dword [rdi + 0x10]
mov eax, dword [rdi + 8]
add r9, qword [r14]
mov rdx, qword [rbx + 0x68]
mov rcx, qword [rbx + 0x60]
mov dword [rsp + 0x68], r12d
mov dword [rsp + 0x60], r12d
mov dword [rsp + 0x58], r12d
mov dword [rsp + 0x50], r8d
mov dword [rsp + 0x48], eax
mov dword [rsp + 0x40], r8d
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], r8
lea r8, [rsp + 0x80]
call fcn.1000935d8
mov rbx, qword [rsp + 0xe8]
add rsp, 0x90
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1000fa728
Capabilities:
Get system information on windows

Disassembly:
push rbx
sub rsp, 0x50
and qword [rcx], 0
mov rbx, rcx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x24]
and dword [rbx + 0xc], 0
and dword [rbx + 0x10], 0
and dword [rbx + 0x14], 0
lea edx, [rax - 1]
add eax, 0xffff
not edx
and edx, eax
mov dword [rbx + 8], edx
lea eax, [rdx + 0xfffff]
lea ecx, [rdx - 1]
not ecx
and ecx, eax
mov rax, rbx
mov dword [rbx + 0x18], ecx
add rsp, 0x50
pop rbx
ret
Function at 0x10013757c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x28
xor r11d, r11d
mov rbx, rcx
mov r14d, r11d
mov dword [rsp + 0x70], r11d
mov r8d, r11d
cmp dword [rcx + 0xc], r11d
jbe 0x1001375c0
mov rdx, r11
mov rax, qword [rbx + 0x20]
inc r8d
mov rcx, qword [rdx + rax]
add rdx, 8
or dword [rcx + 0x30], 0xffffffff
cmp r8d, dword [rbx + 0xc]
jb 0x1001375a7
mov r12d, r11d
mov dword [rsp + 0x78], r11d
cmp dword [rbx + 0x10], r11d
jbe 0x100137782
mov r13, r11
mov qword [rsp + 0x88], r11
mov rax, qword [rbx + 0x28]
mov rdi, qword [r13 + rax]
test dword [rdi], 0xfff00000
je 0x100137764
lea r8, [rsp + 0x80]
xor edx, edx
mov rcx, rdi
mov r15d, r11d
call fcn.100150044
mov r10d, eax
cmp eax, r11d
je 0x1001376e0
mov r9, qword [rsp + 0x80]
mov r13, qword [rbx + 0x20]
mov r14d, dword [r9]
mov rax, qword [r13 + r14*8]
cmp dword [rax + 0x30], 0xffffffff
je 0x1001376ac
mov esi, 1
cmp r10d, esi
jbe 0x10013767c
lea rbp, [r9 + 4]
mov r12d, dword [rbp]
mov rax, qword [r13 + r12*8]
cmp dword [rax + 0x30], 0xffffffff
je 0x100137677
mov rax, qword [r13 + r14*8]
mov ecx, dword [rax + 0x30]
mov rax, qword [r13 + r12*8]
mov rdx, qword [r13 + rcx*8]
mov ecx, dword [rax + 0x30]
mov rax, qword [r13 + rcx*8]
mov ecx, dword [rax + 0xc]
cmp dword [rdx + 0xc], ecx
jne 0x100137677
inc esi
add rbp, 4
cmp esi, r10d
jb 0x10013763b
cmp esi, r10d
jb 0x1001376ac
cmp r10d, r11d
jbe 0x10013769f
mov edx, r10d
mov ecx, dword [r9]
mov rax, qword [rbx + 0x20]
mov rcx, qword [rax + rcx*8]
mov eax, dword [rcx + 0x30]
mov dword [r9], eax
add r9, 4
sub rdx, 1
jne 0x100137684
mov r14d, 1
mov dword [rsp + 0x70], r14d
jmp 0x1001376b1
mov r14d, dword [rsp + 0x70]
inc r15d
lea r8, [rsp + 0x80]
mov rcx, rdi
mov edx, r15d
call fcn.100150044
mov r10d, eax
cmp eax, r11d
jne 0x100137613
mov r12d, dword [rsp + 0x78]
mov r13, qword [rsp + 0x88]
mov eax, dword [rdi]
and eax, 0xfff00000
cmp eax, 0x10000000
jne 0x100137764
mov r10d, r11d
cmp dword [rdi + 0x10], r11d
jbe 0x100137764
mov rsi, r11
mov rax, qword [rdi + 0x18]
mov rdx, qword [rbx + 0x20]
mov ebp, dword [rsi + rax]
mov rax, qword [rdi + 8]
mov ecx, dword [rsi + rax]
mov r9, qword [rdx + rbp*8]
mov r8, qword [rdx + rcx*8]
mov eax, dword [r8 + 4]
cmp dword [r9 + 4], eax
jne 0x100137757
mov eax, dword [r8 + 8]
cmp dword [r9 + 8], eax
jne 0x100137757
mov eax, dword [r8 + 0x10]
cmp dword [r9 + 0x10], eax
jne 0x100137757
mov eax, dword [r8 + 0x14]
cmp dword [r9 + 0x14], eax
jne 0x100137757
mov eax, dword [r8 + 0x18]
cmp dword [r9 + 0x18], eax
jne 0x100137757
cmp dword [r8 + 0x38], 0xffffffff
jne 0x100137757
cmp dword [r9 + 0x3c], r11d
jne 0x100137757
mov dword [r8 + 0x30], ebp
inc r10d
add rsi, 4
cmp r10d, dword [rdi + 0x10]
jb 0x1001376fa
inc r12d
add r13, 8
mov dword [rsp + 0x78], r12d
mov qword [rsp + 0x88], r13
cmp r12d, dword [rbx + 0x10]
jb 0x1001375dd
cmp r14d, r11d
sete r11b
mov eax, r11d
add rsp, 0x28
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x100170358
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x48
test rcx, rcx
jne 0x100170398
lea rax, [0x100037390]
mov byte [rsp + 0x30], 1
lea r8d, [rcx + 1]
mov qword [rsp + 0x28], rax
lea rax, [0x1000373b0]
xor edx, edx
mov r9d, 0xfffe
mov qword [rsp + 0x20], rax
call fcn.10017156c
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
add rsp, 0x48
ret

Function at 0x1001707b4
Capabilities:
Get session user name

Disassembly:
mov rax, rsp
mov dword [rax + 0x10], edx
mov qword [rax + 8], rcx
push rbx
push rsi
push rdi
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rdi, rcx
and dword [rax + 0x18], 0
lea rdx, [0x100002660]
lea rcx, [rax - 0x30]
call fcn.10016e414
nop
mov esi, 0xff
mov dword [rsp + 0x68], esi
mov eax, 2
mul rsi
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.100179d98
mov rbx, rax
test rax, rax
jne 0x100170836
lea rdx, [rsp + 0x28]
mov rcx, rdi
call fcn.10016e3a0
mov dword [rsp + 0x70], 1
mov rcx, qword [rsp + 0x38]
call sub.msvcrt.dll_free
mov rax, rdi
jmp 0x1001708a8
lea r8, [rsp + 0x68]
mov rdx, rax
mov ecx, 3
call sub.Secur32.dll_GetUserNameExW
test al, al
je 0x10017085b
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.10016e658
jmp 0x10017087e
mov dword [rsp + 0x68], esi
lea rdx, [rsp + 0x68]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x10017087e
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.10016e658
mov rcx, rbx
call sub.msvcrt.dll_free
lea rdx, [rsp + 0x28]
mov rcx, rdi
call fcn.10016e3a0
mov dword [rsp + 0x70], 1
mov rcx, qword [rsp + 0x38]
call sub.msvcrt.dll_free
mov rax, rdi
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x100170acc
Capabilities:
Check if file exists
Create process on windows
Query environment variable

Disassembly:
push rbx
sub rsp, 0x290
mov rax, qword [0x100190170]
xor rax, rsp
mov qword [rsp + 0x280], rax
xor ebx, ebx
cmp cl, bl
jne 0x100170af4
xor al, al
jmp 0x100170b76
lea rcx, [rsp + 0x72]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x70], bx
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x30]
lea rdx, [0x1000373d8]
mov r8d, 0x3e
call sub.msvcrt.dll_memcpy
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x30]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp eax, ebx
je 0x100170aed
lea rcx, [rsp + 0x70]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, ebx
je 0x100170aed
lea r8, [rsp + 0x70]
lea rdx, [0x100027470]
xor r9d, r9d
xor ecx, ecx
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], rbx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp rax, 0x20
setg al
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.10017a260
add rsp, 0x290
pop rbx
ret
Function at 0x100170fe0
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
and dword [rsp + 0x38], 0
lea rdx, [rsp + 0x38]
mov rcx, rax
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov ebx, 1
cmp dword [rsp + 0x38], ebx
mov r11, rax
mov r8d, ebx
jle 0x10017104c
lea rcx, [rax + 8]
mov rdx, qword [rcx]
mov r9, rdi
sub r9, rdx
movzx eax, word [rdx]
movzx r10d, word [rdx + r9]
sub eax, r10d
jne 0x10017103a
add rdx, 2
test r10d, r10d
jne 0x100171024
test eax, eax
je 0x10017104e
add r8d, ebx
add rcx, 8
cmp r8d, dword [rsp + 0x38]
jl 0x10017101b
xor bl, bl
mov rcx, r11
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov al, bl
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x100171104
Capabilities:
Check os version

Disassembly:
sub rsp, 0x168
mov rax, qword [0x100190170]
xor rax, rsp
mov qword [rsp + 0x150], rax
test rcx, rcx
jne 0x100171129
xor al, al
jmp 0x100171253
cmp qword [0x10019f918], 0
mov qword [0x10019f8f0], rcx
mov qword [0x10019f8e8], rdx
mov byte [0x10019f581], r8b
jne 0x100171251
lea rcx, [0x100037450]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x10019f918], rax
test rax, rax
je 0x10017120c
lea rdx, [0x100037468]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x10019f918]
lea rdx, [0x100037478]
mov qword [0x10019f8f8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp qword [0x10019f8f8], 0
mov qword [0x10019f908], rax
jne 0x1001711aa
test rax, rax
je 0x10017120c
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x30], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x10017120c
cmp dword [rsp + 0x34], 6
jb 0x10017120c
cmp dword [rsp + 0x38], 0
jne 0x10017120c
cmp dword [rsp + 0x40], 2
jne 0x10017120c
cmp dword [rsp + 0x3c], 0x147c
jae 0x10017120c
mov rax, qword [0x10019f8f8]
and qword [0x10019f8f8], 0
mov qword [0x10019f900], rax
mov rax, qword [0x10019f908]
and qword [0x10019f908], 0
mov qword [0x10019f910], rax
and dword [rsp + 0x20], 0
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_GetProcessDefaultLayout]
mov r11b, byte [rsp + 0x20]
mov edx, 0xbb8
and r11b, 1
mov ecx, 0x40
mov dword [0x10019f7fc], edx
mov byte [0x10019aa83], r11b
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
and qword [0x10019f428], 0
mov qword [0x10019f9a0], rax
mov al, 1
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.10017a260
add rsp, 0x168
ret
Function at 0x1001765f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov r12, rcx
mov rbp, rcx
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r12
mov r14, rdx
repne scasw ax, word [rdi]
mov eax, 0x40000000
not rcx
dec rcx
cmp ecx, eax
mov rsi, rcx
cmova esi, eax
xor r13d, r13d
cmp esi, 1
jb 0x10017670e
cmp word [r12], 0x7c
jne 0x10017670e
lea rcx, [r12 + 2]
lea r8d, [r13 + 0xa]
xor edx, edx
call qword [sym.imp.msvcrt.dll_wcstoul]
mov ebx, eax
cmp eax, r13d
je 0x10017670e
shr eax, 4
xor ecx, ecx
inc eax
movzx r13d, ax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov r8, r13
mov rcx, rax
xor eax, eax
lea edx, [rax + 6]
movzx r9d, ax
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
mov rdi, rax
xor eax, eax
cmp rdi, rax
jne 0x1001766c4
call qword [sym.imp.KERNEL32.dll_GetThreadLocale]
xor ecx, ecx
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
movzx r9d, di
mov r8, r13
mov edx, 6
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
xor r13d, r13d
mov rdi, rax
cmp rax, r13
je 0x10017670e
jmp 0x1001766c7
xor r13d, r13d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
cmp rax, r13
je 0x10017670e
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdx, rax
cmp rax, r13
je 0x10017670e
and ebx, 0xf
jbe 0x100176707
mov edi, ebx
movzx ecx, word [rdx]
inc ecx
sub rdi, 1
lea rdx, [rdx + rcx*2]
jne 0x1001766f8
movzx esi, word [rdx]
lea r12, [rdx + 2]
lea ecx, [rsi + 1]
mov eax, 2
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.100179d98
mov rbx, rax
cmp rax, r13
jne 0x10017673b
xor eax, eax
jmp 0x1001767e2
lea rdi, [rsi + rsi]
mov rdx, r12
mov rcx, rax
mov r8, rdi
call sub.msvcrt.dll_memcpy
mov word [rdi + rbx], r13w
or rsi, 0xffffffffffffffff
xor eax, eax
mov rcx, rsi
mov rdi, rbx
mov qword [rsp + 0x70], r13
repne scasw ax, word [rdi]
not rcx
cmp rcx, 1
jne 0x1001767aa
mov rcx, rbx
call sub.msvcrt.dll_free
xor eax, eax
mov rcx, rsi
mov rdi, rbp
repne scasw ax, word [rdi]
not rcx
and ecx, ecx
mov edi, ecx
lea rdx, [rcx + rcx]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov r8, rbp
mov rdx, rdi
mov rcx, rax
mov qword [rsp + 0x70], rax
call sub.msvcrt.dll_wcscpy_s
jmp 0x1001767dd
lea rax, [rsp + 0x70]
mov qword [rsp + 0x30], r14
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov ecx, 0x500
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
mov rcx, rbx
call sub.msvcrt.dll_free
mov rax, qword [rsp + 0x70]
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x1001772dc
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
cmp qword [rcx + 8], 0
mov rbx, rcx
je 0x1001772f1
call fcn.100177328
lea rax, [rbx + 0x10]
lea r8, [0x1001772b4]
mov r9, rbx
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
mov byte [rbx + 0x14], 1
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 8], rax
add rsp, 0x30
pop rbx
ret
Function at 0x100179a90
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x100190170]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov bpl, r8b
mov edi, edx
mov rsi, rcx
lea rbx, [rsp + 0x60]
cmp edx, 0x40
ja 0x100179b3d
je 0x100179b31
mov eax, edx
sub eax, 1
je 0x100179b25
sub eax, 1
je 0x100179b19
sub eax, 2
je 0x100179b0d
sub eax, 4
je 0x100179b01
sub eax, 8
je 0x100179af5
cmp eax, 0x10
jne 0x100179b69
lea rbx, [0x100038320]
jmp 0x100179bd0
lea rbx, [0x1000382f8]
jmp 0x100179bd0
lea rbx, [0x1000382d8]
jmp 0x100179bd0
lea rbx, [0x100038308]
jmp 0x100179bd0
lea rbx, [0x1000382c0]
jmp 0x100179bd0
lea rbx, [0x1000382b0]
jmp 0x100179bd0
lea rbx, [0x100038348]
jmp 0x100179bd0
cmp edx, 0x80
je 0x100179bc9
cmp edx, 0x100
je 0x100179bc0
cmp edx, 0x200
je 0x100179bb7
cmp edx, 0x400
je 0x100179bae
cmp edx, 0x800
je 0x100179ba5
mov rax, qword [0x10019f4c8]
test rax, rax
je 0x100179b86
mov ecx, edx
call rax
mov rbx, rax
test rax, rax
jne 0x100179bd0
lea rbx, [rsp + 0x60]
or r8, 0xffffffffffffffff
lea r9, [0x1000383b8]
lea rcx, [rsp + 0x60]
lea edx, [r8 + 0x11]
mov dword [rsp + 0x20], edi
call sub.msvcrt.dll__snwprintf_s
jmp 0x100179bd0
lea rbx, [0x1000383a8]
jmp 0x100179bd0
lea rbx, [0x100038398]
jmp 0x100179bd0
lea rbx, [0x100038380]
jmp 0x100179bd0
lea rbx, [0x100038370]
jmp 0x100179bd0
lea rbx, [0x100038358]
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
lea rdi, [rcx - 1]
test bpl, bpl
je 0x100179c8c
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 2
je 0x100179c70
and qword [rsp + 0x30], 0
and qword [rsp + 0x50], 0
lea r9, [rsp + 0x48]
lea rcx, [0x1000382a0]
mov edx, 0xc0000000
mov r8d, 2
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x48], 0x18
mov dword [rsp + 0x58], 1
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
test rax, rax
je 0x100179ca7
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
mov r8d, edi
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteConsoleW]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x100179ca7
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
mov r8d, edi
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteConsoleW]
jmp 0x100179ca7
and qword [rsp + 0x20], rax
lea r8d, [rcx + rcx - 2]
lea r9, [rsp + 0x40]
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.10017a260
mov rbx, qword [rsp + 0xc0]
add rsp, 0x90
pop rdi
pop rsi
pop rbp
ret