joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14004d040
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x1401a1e90]
xor rax, rsp
mov qword [rbp - 0x10], rax
cmp byte [0x1401aa901], 0
je 0x14004d079
lea rax, [0x1401a55c0]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400c3970
add rsp, 0x40
pop rbp
ret
mov eax, dword [0x1401a9d80]
xor r8d, r8d
mov dword [rbp - 0x40], 0x1e0027
lea ecx, [rax + 1]
mov dword [rbp - 0x3c], 0x10000
mov dword [rbp - 0x38], 0x230010
mov dword [rbp - 0x34], 0x3001c
mov dword [rbp - 0x30], 0xf0008
mov dword [rbp - 0x2c], 0x11001e
imul ecx, eax
mov eax, 0x66666667
mov dword [rbp - 0x28], 0x140024
mov dword [rbp - 0x24], 0x1a001f
mov dword [rbp - 0x20], 0x1b001a
mov dword [rbp - 0x1c], 0x430050
mov word [rbp - 0x18], r8w
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
shl eax, 2
sub ecx, eax
cmp ecx, 0xd
jne 0x14004d0f7
inc dword [0x1401aa664]
lea rax, [0x1401a55c0]
lea r9, [0x1401a4d91]
nop word [rax + rax]
movzx ecx, byte [r8 + r9 - 1]
movzx edx, word [rbp + r8*2 - 0x3e]
add r8, 5
xor cx, word [rbp + r8*2 - 0x4a]
mov word [rax + r8*2 - 0xa], cx
movzx ecx, byte [r8 + r9 - 5]
xor dx, cx
movzx ecx, byte [r8 + r9 - 4]
xor cx, word [rbp + r8*2 - 0x46]
mov word [rax + r8*2 - 8], dx
mov word [rax + r8*2 - 6], cx
movzx ecx, byte [r8 + r9 - 3]
xor cx, word [rbp + r8*2 - 0x44]
mov word [rax + r8*2 - 4], cx
movzx ecx, byte [r8 + r9 - 2]
xor cx, word [rbp + r8*2 - 0x42]
mov word [rax + r8*2 - 2], cx
cmp r8, 0x14
jl 0x14004d110
mov byte [0x1401aa901], 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400c3970
add rsp, 0x40
pop rbp
ret

Function at 0x14004d190
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov rax, qword [0x1401a1e90]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp byte [0x1401aa92e], 0
lea rax, [0x1401a56d8]
jne 0x14004d26c
xor r8d, r8d
mov dword [rsp], 0x90006
mov dword [rsp + 4], 0x6001b
mov dword [rsp + 8], 0x1c001c
mov dword [rsp + 0xc], 0x560000
mov dword [rsp + 0x10], 0x5a004b
mov word [rsp + 0x20], r8w
mov dword [rsp + 0x14], 0x520043
mov dword [rsp + 0x18], 0x410047
mov dword [rsp + 0x1c], 0x45005c
lea r9, [0x1401a4d91]
nop word [rax + rax]
movzx ecx, byte [r8 + r9 - 1]
movzx edx, word [rsp + r8*2 + 2]
add r8, 4
xor cx, word [rsp + r8*2 - 8]
mov word [rax + r8*2 - 8], cx
movzx ecx, byte [r8 + r9 - 4]
xor dx, cx
movzx ecx, byte [r8 + r9 - 3]
xor cx, word [rsp + r8*2 - 4]
mov word [rax + r8*2 - 6], dx
mov word [rax + r8*2 - 4], cx
movzx ecx, byte [r8 + r9 - 2]
xor cx, word [rsp + r8*2 - 2]
mov word [rax + r8*2 - 2], cx
cmp r8, 0x10
jl 0x14004d210
mov byte [0x1401aa92e], 1
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400c3970
add rsp, 0x38
ret
Function at 0x14004d280
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov rax, qword [0x1401a1e90]
xor rax, rsp
mov qword [rsp + 0x20], rax
cmp byte [0x1401aa920], 0
je 0x14004d2b5
lea rax, [0x1401a5c58]
mov rcx, qword [rsp + 0x20]
xor rcx, rsp
call fcn.1400c3970
add rsp, 0x38
ret
mov dword [rsp], 0x10019
mov dword [rsp + 4], 0x120008
mov dword [rsp + 8], 0x530010
xor r8d, r8d
mov dword [rsp + 0xc], 0xd0000
mov dword [rsp + 0x10], 0xf0006
mov dword [rsp + 0x14], 0x11004d
mov dword [rsp + 0x18], 0x1d000c
mov dword [rsp + 0x1c], 0x14
lea rdx, [0x1401a5c58]
lea r9, [0x1401a4d91]
nop word [rax + rax]
movzx eax, byte [r8 + r9 - 1]
movzx ecx, word [rsp + r8*2 + 2]
add r8, 5
xor ax, word [rsp + r8*2 - 0xa]
mov word [rdx + r8*2 - 0xa], ax
movzx eax, byte [r8 + r9 - 5]
xor cx, ax
movzx eax, byte [r8 + r9 - 4]
xor ax, word [rsp + r8*2 - 6]
mov word [rdx + r8*2 - 8], cx
movzx ecx, byte [r8 + r9 - 3]
xor cx, word [rsp + r8*2 - 4]
mov word [rdx + r8*2 - 6], ax
mov word [rdx + r8*2 - 4], cx
movzx ecx, byte [r8 + r9 - 2]
xor cx, word [rsp + r8*2 - 2]
mov word [rdx + r8*2 - 2], cx
cmp r8, 0xf
jl 0x14004d310
mov byte [0x1401aa920], 1
mov rax, rdx
mov rcx, qword [rsp + 0x20]
xor rcx, rsp
call fcn.1400c3970
add rsp, 0x38
ret

Function at 0x14004d3a0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1401a1e90]
xor rax, rsp
mov qword [rbp - 8], rax
cmp byte [0x1401aa928], 0
je 0x14004d3d0
lea rax, [0x1401a5c20]
jmp 0x14004d4fd
xor edx, edx
mov dword [rbp - 0x40], 0xd0013
mov dword [rbp - 0x3c], 0x10007
mov dword [rbp - 0x38], 0x120055
mov dword [rbp - 0x34], 2
mov dword [rbp - 0x30], 0x90004
lea r9d, [rdx + 4]
mov dword [rbp - 0x2c], 0xd004d
mov dword [rbp - 0x28], 0x5001c
mov dword [rbp - 0x24], 0x1a0052
mov dword [rbp - 0x20], 0x42000e
mov dword [rbp - 0x1c], 0x60007
mov dword [rbp - 0x18], 0x5000a
mov dword [rbp - 0x14], 0x140011
mov word [rbp - 0x10], dx
lea rbx, [0x1401a5c20]
lea r8, [0x1401a4d91]
nop dword [rax]
movzx eax, byte [rdx + r8 - 1]
movzx ecx, word [rbp + rdx*2 - 0x3e]
add rdx, 6
xor ax, word [rbp + rdx*2 - 0x4c]
mov word [rbx + rdx*2 - 0xc], ax
movzx eax, byte [rdx + r8 - 6]
xor cx, ax
movzx eax, byte [rdx + r8 - 5]
xor ax, word [rbp + rdx*2 - 0x48]
mov word [rbx + rdx*2 - 0xa], cx
mov word [rbx + rdx*2 - 8], ax
movzx eax, byte [rdx + r8 - 4]
xor ax, word [rbp + rdx*2 - 0x46]
mov word [rbx + rdx*2 - 6], ax
movzx eax, byte [rdx + r8 - 3]
xor ax, word [rbp + rdx*2 - 0x44]
mov word [rbx + rdx*2 - 4], ax
movzx eax, byte [rdx + r8 - 2]
xor ax, word [rbp + rdx*2 - 0x42]
mov word [rbx + rdx*2 - 2], ax
cmp rdx, 0x18
jl 0x14004d440
mov ecx, dword [0x1401a9d80]
lea eax, [rcx + 1]
lea r8d, [rcx + 2]
imul r8d, eax
mov eax, 0x66666667
imul r8d, ecx
imul r8d
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
shl eax, 2
sub r8d, eax
cmp r8d, 0xd
jne 0x14004d4f3
mov rcx, r9
call fcn.1400c4130
mov ecx, dword [0x1401a9d80]
mov dword [rax], ecx
mov byte [0x1401aa928], 1
mov rax, rbx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400c3970
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x14004d520
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov rax, qword [0x1401a1e90]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp byte [0x1401aa90c], 0
lea rax, [0x1401a5ad0]
jne 0x14004d5bf
mov dword [rsp], 0x90022
mov dword [rsp + 4], 0x110008
mov dword [rsp + 8], 0x10025
mov dword [rsp + 0xc], 0xf0001
mov dword [rsp + 0x10], 0x19000e
mov dword [rsp + 0x14], 0x2f001e
mov dword [rsp + 0x18], 0x1c000c
mov dword [rsp + 0x1c], 0x7001d
mov dword [rsp + 0x20], 0x580011
mov dword [rsp + 0x24], 0x4a
xor ecx, ecx
lea r8, [0x1401a4d90]
nop dword [rax + rax]
movzx edx, byte [rcx + r8]
inc rcx
xor dx, word [rsp + rcx*2 - 2]
mov word [rax + rcx*2 - 2], dx
cmp rcx, 0x13
jl 0x14004d5a0
mov byte [0x1401aa90c], 1
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400c3970
add rsp, 0x38
ret

Function at 0x14004d5e0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov rax, qword [0x1401a1e90]
xor rax, rsp
mov qword [rsp + 0x20], rax
cmp byte [0x1401aa910], 0
je 0x14004d615
lea rax, [0x1401a53d0]
mov rcx, qword [rsp + 0x20]
xor rcx, rsp
call fcn.1400c3970
add rsp, 0x38
ret
xor edx, edx
mov dword [rsp], 0x3001e
mov dword [rsp + 4], 0x14001f
mov dword [rsp + 8], 0x160058
mov dword [rsp + 0xc], 0x1e001c
mov dword [rsp + 0x10], 0x180004
mov word [rsp + 0x1c], dx
mov dword [rsp + 0x14], 0x50043
mov dword [rsp + 0x18], 0x170000
lea r9, [0x1401a53d0]
lea r8, [0x1401a4d91]
movzx eax, byte [rdx + r8 - 1]
movzx ecx, word [rsp + rdx*2 + 2]
add rdx, 2
xor ax, word [rsp + rdx*2 - 4]
mov word [r9 + rdx*2 - 4], ax
movzx eax, byte [rdx + r8 - 2]
xor cx, ax
mov word [r9 + rdx*2 - 2], cx
cmp rdx, 0xe
jl 0x14004d661
mov ecx, dword [0x1401a9d80]
mov eax, 0x88888889
mov r8d, ecx
imul r8d, ecx
imul r8d
add edx, r8d
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xf
sub r8d, edx
cmp r8d, 5
jne 0x14004d728
test ecx, ecx
je 0x14004d728
mov eax, ecx
and eax, 0x80000001
jge 0x14004d6d2
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x14004d6e7
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
mov ecx, eax
mov dword [0x1401a9d80], eax
jmp 0x14004d6f4
lea ecx, [rcx*2 + 1]
mov dword [0x1401a9d80], ecx
mov eax, 0x55555556
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
mov edx, ecx
sub edx, eax
je 0x14004d716
sub edx, 2
je 0x14004d719
dec edx
je 0x14004d71b
jmp 0x14004d724
add ecx, 2
inc ecx
add ecx, 2
mov dword [0x1401a9d80], ecx
test ecx, ecx
jne 0x14004d6c2
mov byte [0x1401aa910], 1
mov rax, r9
mov rcx, qword [rsp + 0x20]
xor rcx, rsp
call fcn.1400c3970
add rsp, 0x38
ret
Function at 0x14004d750
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x1401a1e90]
xor rax, rsp
mov qword [rbp - 0x10], rax
cmp byte [0x1401aa908], 0
lea rax, [0x1401a5788]
jne 0x14004d817
xor ecx, ecx
mov dword [rbp - 0x40], 0x90017
mov dword [rbp - 0x3c], 0x38001d
mov dword [rbp - 0x38], 0x17001a
mov dword [rbp - 0x34], 0x1b
mov dword [rbp - 0x30], 0x22000e
mov word [rbp - 0x14], cx
mov dword [rbp - 0x2c], 0xc000c
mov dword [rbp - 0x28], 0x1d000d
mov dword [rbp - 0x24], 0x3b0017
mov dword [rbp - 0x20], 0x6003c
mov dword [rbp - 0x1c], 0xf0006
mov dword [rbp - 0x18], 0x4a005d
lea r9, [0x1401a4d91]
nop word [rax + rax]
movzx edx, byte [rcx + r9 - 1]
movzx r8d, word [rbp + rcx*2 - 0x3e]
add rcx, 2
xor dx, word [rbp + rcx*2 - 0x44]
mov word [rax + rcx*2 - 4], dx
movzx edx, byte [rcx + r9 - 2]
xor r8w, dx
mov word [rax + rcx*2 - 2], r8w
cmp rcx, 0x16
jl 0x14004d7e0
mov byte [0x1401aa908], 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400c3970
add rsp, 0x40
pop rbp
ret

Function at 0x14004d830
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x1401a1e90]
xor rax, rsp
mov qword [rbp - 8], rax
cmp byte [0x1401aa91b], 0
lea rax, [0x1401a5318]
jne 0x14004d92e
mov dword [rbp - 0x40], 0x1a001e
mov dword [rbp - 0x3c], 0x2a0019
xor r8d, r8d
mov dword [rbp - 0x38], 0x1d0000
mov dword [rbp - 0x34], 0x14000b
mov dword [rbp - 0x30], 0xf001b
mov dword [rbp - 0x2c], 0x16000e
mov dword [rbp - 0x28], 0x15000c
mov dword [rbp - 0x24], 0x19002d
mov dword [rbp - 0x20], 0x10007
mov dword [rbp - 0x1c], 0xf000b
mov dword [rbp - 0x18], 0x20038
mov qword [rbp - 0x14], 0x10002
lea r9, [0x1401a4d91]
nop word [rax + rax]
movzx ecx, byte [r8 + r9 - 1]
movzx edx, word [rbp + r8*2 - 0x3e]
add r8, 5
xor cx, word [rbp + r8*2 - 0x4a]
mov word [rax + r8*2 - 0xa], cx
movzx ecx, byte [r8 + r9 - 5]
xor dx, cx
movzx ecx, byte [r8 + r9 - 4]
xor cx, word [rbp + r8*2 - 0x46]
mov word [rax + r8*2 - 8], dx
mov word [rax + r8*2 - 6], cx
movzx ecx, byte [r8 + r9 - 3]
xor cx, word [rbp + r8*2 - 0x44]
mov word [rax + r8*2 - 4], cx
movzx ecx, byte [r8 + r9 - 2]
xor cx, word [rbp + r8*2 - 0x42]
mov word [rax + r8*2 - 2], cx
cmp r8, 0x19
jl 0x14004d8c0
mov byte [0x1401aa91b], 1
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400c3970
add rsp, 0x40
pop rbp
ret
Function at 0x14004d940
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov rax, qword [0x1401a1e90]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp byte [0x1401aa904], 0
je 0x14004d975
lea rax, [0x1401a5ba0]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400c3970
add rsp, 0x38
ret
mov eax, dword [0x1401a9d80]
imul eax, eax
and eax, 0x8000000f
jge 0x14004d98c
dec eax
or eax, 0xfffffff0
inc eax
cmp eax, 5
jne 0x14004d997
dec dword [0x1401aa648]
mov dword [rsp], 0x2d0026
mov dword [rsp + 4], 0x190005
mov dword [rsp + 8], 0x10001a
mov dword [rsp + 0xc], 0x14002b
mov dword [rsp + 0x10], 0x240059
mov dword [rsp + 0x14], 0x4f0019
mov dword [rsp + 0x18], 0x4003a
mov dword [rsp + 0x1c], 0x160011
mov dword [rsp + 0x20], 0x11000d
mov dword [rsp + 0x24], 0x19
xor ecx, ecx
lea rax, [0x1401a5ba0]
lea r8, [0x1401a4d90]
nop word [rax + rax]
movzx edx, byte [rcx + r8]
inc rcx
xor dx, word [rsp + rcx*2 - 2]
mov word [rax + rcx*2 - 2], dx
cmp rcx, 0x13
jl 0x14004da00
mov byte [0x1401aa904], 1
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400c3970
add rsp, 0x38
ret

Function at 0x14004da40
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov rax, qword [0x1401a1e90]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp byte [0x1401aa909], 0
je 0x14004da75
lea rax, [0x1401a59f0]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400c3970
add rsp, 0x38
ret
mov r9d, dword [0x1401a9d80]
xor r8d, r8d
mov eax, 0x92492493
lea r10d, [r9 + 1]
mov dword [rsp], 0xd0000
mov dword [rsp + 4], 0x10001b
mov ecx, r10d
mov dword [rsp + 8], 0x7001b
mov dword [rsp + 0xc], 0x1c004e
mov dword [rsp + 0x10], 0x50019
mov dword [rsp + 0x14], 0x42000e
mov dword [rsp + 0x18], 0x100007
imul ecx, r9d
imul ecx
add edx, ecx
mov dword [rsp + 0x1c], 0x10001f
mov word [rsp + 0x20], r8w
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xe
sub ecx, edx
cmp ecx, 7
jne 0x14004db12
test r9d, r9d
je 0x14004db08
dec r9d
je 0x14004daff
mov dword [0x1401a9d80], r10d
jmp 0x14004db12
mov dword [0x1401a9d80], r8d
jmp 0x14004db12
mov dword [0x1401a9d80], 2
lea rdx, [0x1401a59f0]
lea r9, [0x1401a4d91]
movzx eax, byte [r8 + r9 - 1]
movzx ecx, word [rsp + r8*2 + 2]
add r8, 4
xor ax, word [rsp + r8*2 - 8]
mov word [rdx + r8*2 - 8], ax
movzx eax, byte [r8 + r9 - 4]
xor cx, ax
mov word [rdx + r8*2 - 6], cx
movzx ecx, byte [r8 + r9 - 3]
xor cx, word [rsp + r8*2 - 4]
mov word [rdx + r8*2 - 4], cx
movzx ecx, byte [r8 + r9 - 2]
xor cx, word [rsp + r8*2 - 2]
mov word [rdx + r8*2 - 2], cx
cmp r8, 0x10
jl 0x14004db20
mov byte [0x1401aa909], 1
mov rax, rdx
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400c3970
add rsp, 0x38
ret
Function at 0x14004dc70
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1401a1e90]
xor rax, rsp
mov qword [rbp - 8], rax
mov eax, dword [0x1401a9d80]
lea ecx, [rax + 1]
imul ecx, eax
mov eax, 0x2e8ba2e9
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x16
sub ecx, edx
cmp ecx, 5
jne 0x14004dd07
mov rax, qword [str.F6UUowybIopf9A]
or r8, 0xffffffffffffffff
mov qword [rbp - 0x40], rax
mov eax, dword [0x140138be0]
mov rcx, r8
mov dword [rbp - 0x38], eax
movzx eax, word [0x140138be4]
mov word [rbp - 0x34], ax
movzx eax, byte [0x140138be6]
mov byte [rbp - 0x32], al
lea rax, [rbp - 0x40]
inc rcx
cmp byte [rax + rcx], 0
jne 0x14004dce2
mov eax, 4
mul rcx
cmovo rax, r8
mov rcx, rax
call fcn.1400c2fb8
mov rcx, rax
call fcn.1400c4098
cmp byte [0x1401aa92f], 0
je 0x14004dd29
lea rax, [0x1401a5598]
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400c3970
add rsp, 0x60
pop rbp
ret
xor r8d, r8d
mov dword [rbp - 0x30], 0x1c003f
mov dword [rbp - 0x2c], 0x1b000c
mov dword [rbp - 0x28], 0x10025
mov dword [rbp - 0x24], 0xf0001
mov dword [rbp - 0x20], 0x19000e
mov word [rbp - 0x10], r8w
mov dword [rbp - 0x1c], 0x42001e
mov dword [rbp - 0x18], 0x14001a
mov dword [rbp - 0x14], 0x13001e
lea rdx, [0x1401a5598]
lea r9, [0x1401a4d91]
nop word [rax + rax]
movzx eax, byte [r8 + r9 - 1]
movzx ecx, word [rbp + r8*2 - 0x2e]
add r8, 4
xor ax, word [rbp + r8*2 - 0x38]
mov word [rdx + r8*2 - 8], ax
movzx eax, byte [r8 + r9 - 4]
xor cx, ax
mov word [rdx + r8*2 - 6], cx
movzx ecx, byte [r8 + r9 - 3]
xor cx, word [rbp + r8*2 - 0x34]
mov word [rdx + r8*2 - 4], cx
movzx ecx, byte [r8 + r9 - 2]
xor cx, word [rbp + r8*2 - 0x32]
mov word [rdx + r8*2 - 2], cx
cmp r8, 0x10
jl 0x14004dd80
mov byte [0x1401aa92f], 1
mov rax, rdx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400c3970
add rsp, 0x60
pop rbp
ret
Function at 0x1400552c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x30
mov r15, r9
mov r12, r8
mov r14, rcx
call fcn.14000a530
xor edi, edi
mov edx, 0x81
lea r8d, [rdi + 5]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rsi, rax
test rax, rax
je 0x1400553e2
mov edx, 0x81
mov rcx, r14
mov qword [rsp + 0x50], rbx
lea r8d, [rdx + 0x6f]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x140055333
mov rdx, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdx, rsi
mov rcx, r14
mov qword [rsp + 0x58], rbp
mov ebx, edi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x1400553ac
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbp, rax
test rax, rax
je 0x1400553ac
mov rcx, rax
call fcn.140049c20
mov r9, r15
mov r8, r12
mov rcx, r14
mov rdx, rax
mov qword [rsp + 0x20], rdi
mov rsi, rax
call qword [sym.imp.USER32.dll_CreateDialogIndirectParamW]
mov rdi, rax
test rax, rax
jne 0x14005538e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp rsi, rbp
je 0x1400553b4
test rsi, rsi
je 0x1400553b4
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalHandle]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x1400553b4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rbp, qword [rsp + 0x58]
test ebx, ebx
je 0x1400553c5
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rbx, qword [rsp + 0x50]
mov rax, rdi
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r12
ret
mov rax, rdi
jmp 0x1400553cd
Function at 0x1400571f0
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x70
mov qword [rax - 0x48], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rsi, rcx
cmp byte [rcx + 0x10], 0
je 0x14005721e
call fcn.1400573d0
test al, al
je 0x140057374
mov dword [rsp + 0x80], 0
lea rax, [rsi + 0x18]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x80]
mov r8d, 0x1000
mov rdx, qword [rsi + 0x60]
mov rcx, qword [rsi + 0x40]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1400572e3
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
je 0x1400572ae
cmp eax, 0x3e5
je 0x1400572a8
lea rax, str.Channel_read_failure
mov qword [rsp + 0x88], rax
lea rdx, [rsp + 0x88]
lea rcx, [rsp + 0x50]
call fcn.1400c6df8
nop
lea rax, vtable.CRSimpleIPCException.0
mov qword [rsp + 0x50], rax
lea rdx, [0x14016cc40]
lea rcx, [rsp + 0x50]
call fcn.1400cb848
int3
mov byte [rsi + 0x10], 1
jmp 0x1400572e3
lea rcx, [rsp + 0x38]
call fcn.1400c6e70
nop
lea rax, vtable.CRSimpleIPCException.0
mov qword [rsp + 0x38], rax
lea rax, vtable.CRSimpleIPCExceptionDisconnected.0
mov qword [rsp + 0x38], rax
lea rdx, [0x14016cbf8]
lea rcx, [rsp + 0x38]
call fcn.1400cb848
int3
cmp byte [rsi + 0x10], 0
jne 0x140057374
mov rbx, qword [rsi + 0x50]
sub rbx, qword [rsi + 0x48]
mov edx, dword [rsp + 0x80]
add rdx, rbx
lea rcx, [rsi + 0x48]
call fcn.14002d4c0
mov r8d, dword [rsp + 0x80]
mov rcx, qword [rsi + 0x48]
add rcx, rbx
mov rdx, qword [rsi + 0x60]
call fcn.1400c39a0
mov ecx, dword [0x1401a9d80]
lea r8d, [rcx + 2]
lea eax, [rcx + 1]
imul r8d, eax
imul r8d, ecx
mov eax, 0x2aaaaaab
imul r8d
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 2
sub r8d, eax
cmp r8d, 3
jne 0x140057366
lea ecx, [r8 + 1]
call fcn.1400c4130
mov ecx, dword [0x1401a9d80]
mov dword [rax], ecx
mov rcx, qword [rsi + 0x38]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov al, 1
jmp 0x140057376
xor al, al
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140057670
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x70
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0xa0], rbx
mov rdi, rcx
cmp byte [rcx + 0x78], 0
je 0x14005769f
call fcn.140057900
test al, al
je 0x1400578e4
lea rsi, [rdi + 0xb0]
mov rax, qword [rsi + 8]
cmp qword [rsi], rax
jne 0x14005773a
lea rax, [rdi + 0xd0]
mov qword [rsp + 0x98], rax
lea rbx, [rax + 8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
cmp qword [rdi + 0x120], 0
jne 0x1400576e8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x1400578e4
lea rcx, [rdi + 0x100]
lea rdx, [rsp + 0x50]
call fcn.140032150
mov rdx, rax
mov rax, qword [rax]
test rax, rax
je 0x140057707
mov rax, qword [rax]
mov rcx, qword [rax + 0x10]
dec rcx
and rcx, qword [rdx + 0x10]
mov rax, qword [rax + 8]
mov rdx, qword [rax + rcx*8]
add rdx, 8
mov rcx, rsi
call fcn.14002d3a0
mov qword [rdi + 0xc8], 0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [rsp + 0x90], 0
mov rdx, qword [rsi]
mov r8, qword [rsi + 8]
sub r8, rdx
lea rcx, [rdi + 0x80]
add rdx, qword [rdi + 0xc8]
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x90]
mov rcx, qword [rdi + 0xa8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x14005780c
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
je 0x1400577d7
cmp eax, 0x3e5
je 0x1400577d1
lea rax, str.Channel_write_failure
mov qword [rsp + 0x98], rax
lea rdx, [rsp + 0x98]
lea rcx, [rsp + 0x50]
call fcn.1400c6df8
nop
lea rax, vtable.CRSimpleIPCException.0
mov qword [rsp + 0x50], rax
lea rdx, [0x14016cc40]
lea rcx, [rsp + 0x50]
call fcn.1400cb848
int3
mov byte [rdi + 0x78], 1
jmp 0x14005780c
lea rcx, [rsp + 0x38]
call fcn.1400c6e70
nop
lea rax, vtable.CRSimpleIPCException.0
mov qword [rsp + 0x38], rax
lea rax, vtable.CRSimpleIPCExceptionDisconnected.0
mov qword [rsp + 0x38], rax
lea rdx, [0x14016cbf8]
lea rcx, [rsp + 0x38]
call fcn.1400cb848
int3
cmp byte [rdi + 0x78], 0
jne 0x1400578e4
mov eax, dword [rsp + 0x90]
add qword [rdi + 0xc8], rax
mov bpl, 1
mov ecx, dword [0x1401a9d80]
lea r8d, [rcx + 2]
lea eax, [rcx + 1]
imul r8d, eax
imul r8d, ecx
mov eax, 0x4ec4ec4f
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xd
sub r8d, edx
cmp r8d, 9
jne 0x140057871
call fcn.1400c426c
mov ecx, dword [0x1401a9d80]
cmp ecx, eax
jne 0x140057871
dec ecx
mov dword [0x1401a9d80], ecx
mov rax, qword [rsi + 8]
sub rax, qword [rsi]
cmp qword [rdi + 0xc8], rax
jne 0x1400578d1
lea rax, [rdi + 0xd0]
mov qword [rsp + 0x98], rax
lea rbx, [rax + 8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rcx, [rdi + 0x100]
call fcn.140057ce0
mov rax, qword [rsi]
mov qword [rsi + 8], rax
mov qword [rdi + 0xc8], 0
cmp qword [rdi + 0x120], 0
setne bpl
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [rdi + 0xa0]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
movzx eax, bpl
jmp 0x1400578e6
xor al, al
mov rbx, qword [rsp + 0xa0]
add rsp, 0x70
pop rdi
pop rsi
pop rbp
ret
Function at 0x140058b60
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push rbx
xor r9d, r9d
mov rbx, rdx
mov r10, rcx
test r8d, r8d
jle 0x140058bce
mov qword [rsp + 0x10], rdi
mov r11, rcx
sub rbx, rcx
lea rdi, str.Binding_his_foal_unto_the_vine__and_his_asss_colt_unto_the_choice_vine__he_washed_his_garments_in_wine__and_his_clothes_in_the_blood_of_grapes:
nop word [rax + rax]
mov eax, 0x38e38e39
lea r11, [r11 + 1]
imul r9d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, r9d
inc r9d
lea ecx, [rdx + rdx*8]
shl ecx, 4
sub eax, ecx
movsxd rcx, eax
movzx eax, byte [rcx + rdi]
xor al, byte [rbx + r11 - 1]
mov byte [r11 - 1], al
cmp r9d, r8d
jl 0x140058b90
mov rdi, qword [rsp + 0x10]
mov rax, r10
pop rbx
ret