joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003c028
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x140184e90]
xor rax, rsp
mov qword [rbp - 0x10], rax
xor eax, eax
cmp byte [0x14018d85c], al
je 0x14003c052
lea rax, [0x140188590]
jmp 0x14003c0d0
mov dword [rbp - 0x40], 0x170036
mov dword [rbp - 0x3c], 0x10005
mov r8d, 1
mov dword [rbp - 0x38], 0x3b0001
mov dword [rbp - 0x34], 0xa001d
mov dword [rbp - 0x30], 0x80000
mov dword [rbp - 0x2c], 0x20015
mov dword [rbp - 0x28], 0xb0039
mov dword [rbp - 0x24], 0x40008
mov dword [rbp - 0x20], 0x90007
mov dword [rbp - 0x1c], 0x540055
mov word [rbp - 0x18], ax
lea rdx, [0x140188590]
lea rcx, [0x140187da0]
movzx ecx, byte [rax + rcx]
xor cx, word [rbp + rax*2 - 0x40]
mov word [rdx + rax*2], cx
add rax, r8
cmp rax, 0x14
jl 0x14003c0a9
mov byte [0x14018d85c], r8b
mov rax, rdx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400b0c90
add rsp, 0x40
pop rbp
ret

Function at 0x14003c0e4
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x140184e90]
xor rax, rsp
mov qword [rbp - 8], rax
xor ecx, ecx
cmp byte [0x14018d887], cl
je 0x14003c11a
lea rax, [0x1401886a8]
jmp 0x14003c1d7
mov r9d, 4
mov dword [rbp - 0x30], 0x17
mov dword [rbp - 0x2c], 0x6001e
mov dword [rbp - 0x28], 0x4000d
mov dword [rbp - 0x24], 0x5f0001
mov dword [rbp - 0x20], 0x5d0043
lea edi, [r9 - 3]
mov dword [rbp - 0x1c], 0x410048
mov dword [rbp - 0x18], 0x5e005a
mov dword [rbp - 0x14], 0x5b004b
mov word [rbp - 0x10], cx
lea rbx, [0x1401886a8]
lea rax, [0x140187da0]
movzx eax, byte [rcx + rax]
xor ax, word [rbp + rcx*2 - 0x30]
mov word [rbx + rcx*2], ax
add rcx, rdi
cmp rcx, 0x10
jl 0x14003c167
mov ecx, dword [0x14018cd80]
lea eax, [rcx + 1]
lea r8d, [rcx + 2]
imul r8d, eax
mov eax, 0x2e8ba2e9
imul r8d, ecx
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x16
sub r8d, edx
cmp r8d, r9d
jne 0x14003c1cd
call fcn.1400b1650
mov ecx, dword [0x14018cd80]
cmp ecx, eax
jne 0x14003c1cd
sub ecx, edi
mov dword [0x14018cd80], ecx
mov byte [0x14018d887], dil
mov rax, rbx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400b0c90
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x50
pop rbp
ret

Function at 0x14003c1f4
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rax, qword [0x140184e90]
xor rax, rsp
mov qword [rbp - 0x10], rax
xor eax, eax
cmp byte [0x14018d87b], al
je 0x14003c21e
lea rax, [0x140188c60]
jmp 0x14003c28a
mov dword [rbp - 0x30], 0x80008
mov dword [rbp - 0x2c], 0x12000d
mov r8d, 1
mov dword [rbp - 0x28], 0x4b0001
mov dword [rbp - 0x24], 0x40001
mov dword [rbp - 0x20], 0x8000e
mov dword [rbp - 0x1c], 0x20046
mov dword [rbp - 0x18], 0x20011
mov dword [rbp - 0x14], 3
lea rdx, [0x140188c60]
lea rcx, [0x140187da0]
movzx ecx, byte [rax + rcx]
xor cx, word [rbp + rax*2 - 0x30]
mov word [rdx + rax*2], cx
add rax, r8
cmp rax, 0xf
jl 0x14003c263
mov byte [0x14018d87b], r8b
mov rax, rdx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400b0c90
add rsp, 0x30
pop rbp
ret
Function at 0x14003c29c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x140184e90]
xor rax, rsp
mov qword [rbp - 8], rax
mov ecx, dword [0x14018cd80]
xor ebx, ebx
mov eax, 0x2aaaaaab
lea edi, [rbx + 3]
imul ecx, ecx
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 2
sub ecx, eax
cmp ecx, edi
jne 0x14003c308
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov ecx, dword [0x14018cd80]
lea edx, [rbx + 7]
test rax, rax
cmove ecx, edx
mov dword [0x14018cd80], ecx
cmp byte [0x14018d884], bl
lea rax, [0x1401887c8]
jne 0x14003c39d
mov dword [rbp - 0x40], 0x40002
mov dword [rbp - 0x3c], 0x10002
mov r8d, 1
mov dword [rbp - 0x38], 0xa0044
mov dword [rbp - 0x34], 0x90003
mov dword [rbp - 0x30], 0xe000c
mov dword [rbp - 0x2c], 0x1e0046
mov dword [rbp - 0x28], 0x1a0001
mov dword [rbp - 0x24], 0x40045
mov dword [rbp - 0x20], 0x500013
mov dword [rbp - 0x1c], 0x110002
mov dword [rbp - 0x18], 0x6001f
mov dword [rbp - 0x14], 0x120006
mov word [rbp - 0x10], bx
lea rcx, [0x140187da0]
movzx ecx, byte [rbx + rcx]
xor cx, word [rbp + rbx*2 - 0x40]
mov word [rax + rbx*2], cx
add rbx, r8
cmp rbx, 0x18
jl 0x14003c379
mov byte [0x14018d884], r8b
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400b0c90
mov rbx, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x60
pop rbp
ret

Function at 0x14003c3bc
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rax, qword [0x140184e90]
xor rax, rsp
mov qword [rbp - 8], rax
mov r8d, dword [0x14018cd80]
xor r9d, r9d
lea eax, [r8 + 1]
lea ecx, [r8 + 2]
imul ecx, eax
mov eax, 0x66666667
imul ecx, r8d
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
add eax, eax
sub ecx, eax
cmp ecx, 1
jne 0x14003c47d
jmp 0x14003c478
mov eax, r8d
and eax, 0x80000001
jge 0x14003c41c
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x14003c433
mov eax, r8d
cdq
sub eax, edx
sar eax, 1
mov r8d, eax
mov dword [0x14018cd80], eax
jmp 0x14003c442
lea r8d, [r8*2 + 1]
mov dword [0x14018cd80], r8d
mov eax, 0x55555556
mov ecx, r8d
imul r8d
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
sub ecx, eax
je 0x14003c466
sub ecx, 2
je 0x14003c46a
dec ecx
je 0x14003c46d
jmp 0x14003c478
add r8d, 2
inc r8d
add r8d, 2
mov dword [0x14018cd80], r8d
test r8d, r8d
jne 0x14003c40b
cmp byte [0x14018d85f], r9b
lea rax, [0x140188ad0]
jne 0x14003c4fa
mov dword [rbp - 0x30], 0x33
mov dword [rbp - 0x2c], 0x11000d
mov dword [rbp - 0x28], 0x190034
mov dword [rbp - 0x24], 0x60000
mov dword [rbp - 0x20], 0x1e0006
mov dword [rbp - 0x1c], 0x3c0015
mov dword [rbp - 0x18], 0x30011
mov dword [rbp - 0x14], 0x19000a
mov dword [rbp - 0x10], 0x4a000c
mov dword [rbp - 0xc], 0x4f
lea rcx, [0x140187da0]
movzx ecx, byte [r9 + rcx]
xor cx, word [rbp + r9*2 - 0x30]
mov word [rax + r9*2], cx
inc r9
cmp r9, 0x13
jl 0x14003c4d3
mov byte [0x14018d85f], 1
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400b0c90
add rsp, 0x30
pop rbp
ret
Function at 0x14003c50c
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x140184e90]
xor rax, rsp
mov qword [rbp - 0x10], rax
xor eax, eax
cmp byte [0x14018d861], al
je 0x14003c536
lea rax, [0x140188798]
jmp 0x14003c5b5
mov dword [rbp - 0x40], 6
mov dword [rbp - 0x3c], 0x380018
mov dword [rbp - 0x38], 0xf000b
mov dword [rbp - 0x34], 0x9001a
mov dword [rbp - 0x30], 0x250006
mov dword [rbp - 0x2c], 0x1f0007
mov dword [rbp - 0x28], 0x20010
mov dword [rbp - 0x24], 0x250000
mov dword [rbp - 0x20], 0x140021
mov dword [rbp - 0x1c], 0x180003
mov dword [rbp - 0x18], 0x490048
mov word [rbp - 0x14], ax
lea rdx, [0x140188798]
lea rcx, [0x140187da0]
movzx ecx, byte [rax + rcx]
xor cx, word [rbp + rax*2 - 0x40]
mov word [rdx + rax*2], cx
inc rax
cmp rax, 0x16
jl 0x14003c58e
mov byte [0x14018d861], 1
mov rax, rdx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400b0c90
add rsp, 0x40
pop rbp
ret

Function at 0x14003c5c8
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x140184e90]
xor rax, rsp
mov qword [rbp - 8], rax
xor eax, eax
cmp byte [0x14018d875], al
je 0x14003c5f5
lea rax, [0x140188320]
jmp 0x14003c684
mov dword [rbp - 0x40], 0x13000f
mov dword [rbp - 0x3c], 0x2a001c
mov dword [rbp - 0x38], 0x50011
mov dword [rbp - 0x34], 0x1d000a
mov dword [rbp - 0x30], 0x80013
mov dword [rbp - 0x2c], 0x50005
mov dword [rbp - 0x28], 0xa0011
mov dword [rbp - 0x24], 0x7003a
mov dword [rbp - 0x20], 0x13001a
mov dword [rbp - 0x1c], 0x18000e
mov dword [rbp - 0x18], 0x1002d
mov r8d, 1
mov dword [rbp - 0x14], 0x70015
mov dword [rbp - 0x10], 0x1c
lea rdx, [0x140188320]
lea rcx, [0x140187da0]
movzx ecx, byte [rax + rcx]
xor cx, word [rbp + rax*2 - 0x40]
mov word [rdx + rax*2], cx
add rax, r8
cmp rax, 0x19
jl 0x14003c65d
mov byte [0x14018d875], r8b
mov rax, rdx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400b0c90
add rsp, 0x40
pop rbp
ret
Function at 0x14003c698
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rax, qword [0x140184e90]
xor rax, rsp
mov qword [rbp - 8], rax
mov r8d, dword [0x14018cd80]
mov eax, 0x92492493
xor r9d, r9d
lea ecx, [r8 + 1]
imul ecx, r8d
imul ecx
add edx, ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xe
sub ecx, edx
cmp ecx, 7
jne 0x14003c752
jmp 0x14003c74d
mov eax, r8d
and eax, 0x80000001
jge 0x14003c6f1
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x14003c708
mov eax, r8d
cdq
sub eax, edx
sar eax, 1
mov r8d, eax
mov dword [0x14018cd80], eax
jmp 0x14003c717
lea r8d, [r8*2 + 1]
mov dword [0x14018cd80], r8d
mov eax, 0x55555556
mov ecx, r8d
imul r8d
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
sub ecx, eax
je 0x14003c73b
sub ecx, 2
je 0x14003c73f
dec ecx
je 0x14003c742
jmp 0x14003c74d
add r8d, 2
inc r8d
add r8d, 2
mov dword [0x14018cd80], r8d
test r8d, r8d
jne 0x14003c6e0
cmp byte [0x14018d86e], r9b
lea rax, [0x140188be0]
jne 0x14003c7cf
mov dword [rbp - 0x30], 0x240037
mov dword [rbp - 0x2c], 0x190000
mov dword [rbp - 0x28], 0x8000b
mov dword [rbp - 0x24], 0x1d002a
mov dword [rbp - 0x20], 0x230051
mov dword [rbp - 0x1c], 0x5c0012
mov dword [rbp - 0x18], 0x1b0027
mov dword [rbp - 0x14], 0x80006
mov dword [rbp - 0x10], 0x30010
mov dword [rbp - 0xc], 0x1c
lea rcx, [0x140187da0]
movzx ecx, byte [r9 + rcx]
xor cx, word [rbp + r9*2 - 0x30]
mov word [rax + r9*2], cx
inc r9
cmp r9, 0x13
jl 0x14003c7a8
mov byte [0x14018d86e], 1
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400b0c90
add rsp, 0x30
pop rbp
ret

Function at 0x14003c7e4
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x140184e90]
xor rax, rsp
mov qword [rbp - 8], rax
mov eax, dword [0x14018cd80]
mov edi, 4
mov ecx, eax
imul ecx, eax
imul ecx, eax
mov eax, 0x38e38e39
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
sub ecx, eax
cmp ecx, 6
jne 0x14003c850
mov ecx, edi
call fcn.1400b1450
mov rbx, rax
call fcn.1400b1650
mov rcx, rbx
mov dword [rbx], eax
mov dword [0x14018cd80], eax
call fcn.1400b0c74
xor eax, eax
cmp byte [0x14018d851], al
je 0x14003c863
lea rax, [0x140188800]
jmp 0x14003c8d2
mov dword [rbp - 0x30], 0x40011
mov dword [rbp - 0x2c], 0x10001e
mov r8d, 0x10
mov dword [rbp - 0x28], 0x1f000a
mov dword [rbp - 0x24], 0x15004f
mov dword [rbp - 0x20], 0x20011
mov dword [rbp - 0x1c], 0x510005
mov dword [rbp - 0x18], 0xf001a
mov dword [rbp - 0x14], 0xe0008
mov word [rbp - 0x10], ax
lea rdx, [0x140188800]
lea rcx, [0x140187da0]
movzx ecx, byte [rax + rcx]
xor cx, word [rbp + rax*2 - 0x30]
mov word [rdx + rax*2], cx
inc rax
cmp rax, r8
jl 0x14003c8ac
mov byte [0x14018d851], 1
mov rax, rdx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400b0c90
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x50
pop rbp
ret
Function at 0x14003c8f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x140184e90]
xor rax, rsp
mov qword [rsp + 0x30], rax
xor edi, edi
cmp byte [0x14018d859], dil
je 0x14003c920
lea rax, [0x1401889e8]
jmp 0x14003c9b8
mov r8d, 3
mov dword [rsp + 0x20], 0xb004c
mov dword [rsp + 0x24], 0x30003
lea edx, [r8 + 2]
mov rcx, rdi
lea rbx, [0x1401889e8]
mov dword [rsp + 0x28], edx
lea rax, [0x140187da0]
movzx eax, byte [rcx + rax]
xor ax, word [rsp + rcx*2 + 0x20]
mov word [rbx + rcx*2], ax
inc rcx
cmp rcx, rdx
jl 0x14003c948
mov ecx, dword [0x14018cd80]
mov eax, 0x2aaaaaab
imul ecx, ecx
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 2
sub ecx, eax
cmp ecx, r8d
jne 0x14003c9ae
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov ecx, dword [0x14018cd80]
mov edx, 7
test rax, rax
cmove ecx, edx
mov dword [0x14018cd80], ecx
mov byte [0x14018d859], 1
mov rax, rbx
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400b0c90
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x14003c9d0
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rax, qword [0x140184e90]
xor rax, rsp
mov qword [rbp - 8], rax
xor eax, eax
cmp byte [0x14018d87a], al
je 0x14003c9fa
lea rax, [0x140188568]
jmp 0x14003ca64
mov dword [rbp - 0x30], 0x15002e
mov dword [rbp - 0x2c], 0x1b0009
mov dword [rbp - 0x28], 0x190034
mov dword [rbp - 0x24], 0x60000
mov dword [rbp - 0x20], 0x1e0006
mov dword [rbp - 0x1c], 0x510015
mov dword [rbp - 0x18], 0xb0007
mov dword [rbp - 0x14], 0xd0009
mov word [rbp - 0x10], ax
lea rdx, [0x140188568]
lea rcx, [0x140187da0]
movzx ecx, byte [rax + rcx]
xor cx, word [rbp + rax*2 - 0x30]
mov word [rdx + rax*2], cx
inc rax
cmp rax, 0x10
jl 0x14003ca3d
mov byte [0x14018d87a], 1
mov rax, rdx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400b0c90
add rsp, 0x30
pop rbp
ret
Function at 0x140040224
Capabilities:
Acquire debug privileges

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0x90
mov qword [rbp + 0x17], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
mov rax, qword [0x140184e90]
xor rax, rsp
mov qword [rbp + 0x4f], rax
mov edi, edx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rbx, rax
call fcn.14001fd2c
mov rcx, rax
lea r9, [rbp - 9]
mov r8d, 0x20028
mov rdx, rbx
call fcn.1400306d0
test eax, eax
jne 0x1400402b3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rbp + 0x2f]
call fcn.14003a388
mov rbx, rax
call fcn.14003af84
mov rdx, rax
mov r8, rbx
lea rcx, [rbp - 1]
call fcn.14003cb30
lea rdx, [0x14014f7e8]
lea rcx, [rbp - 1]
call fcn.1400b8b68
nop
lea r8, [rbp + 0xf]
lea rdx, str.SeDebugPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov rcx, qword [rbp - 9]
test eax, eax
jne 0x14004030a
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rbp + 0x2f]
call fcn.14003a388
mov r8, rax
call fcn.14003b2c8
mov rdx, rax
lea rcx, [rbp - 1]
call fcn.14003cb30
lea rdx, [0x14014f7e8]
lea rcx, [rbp - 1]
call fcn.1400b8b68
nop
mov ebx, 1
mov dword [rbp + 0x1f], ebx
mov rax, qword [rbp + 0xf]
mov qword [rbp + 0x23], rax
neg edi
sbb eax, eax
and eax, 2
mov dword [rbp + 0x2b], eax
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [rbp + 0x1f]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov rcx, qword [rbp - 9]
test eax, eax
jne 0x140040383
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rbp + 0x2f]
call fcn.14003a388
mov r8, rax
call fcn.14003a8ec
mov rdx, rax
lea rcx, [rbp - 1]
call fcn.14003cb30
lea rdx, [0x14014f7e8]
lea rcx, [rbp - 1]
call fcn.1400b8b68
nop
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.1400b0c90
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x14004181c
Capabilities:
Encode data using xor
Set registry value

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x140184e90]
xor rax, rsp
mov qword [rbp - 8], rax
mov rsi, rdx
mov rdi, rcx
lea rbx, [rcx + 0x1b0]
mov edx, 0x5c
mov rcx, qword [rbx]
call fcn.1400b3578
or r15d, 0xffffffff
xor r14d, r14d
test rax, rax
jne 0x140041877
mov eax, r15d
jmp 0x14004187d
sub rax, qword [rbx]
sar rax, 1
lea r8d, [rax + 1]
lea rdx, [rbp - 0x38]
mov rcx, rbx
call fcn.14001f244
nop
mov r9d, dword [0x14018cd80]
lea r8d, [r9 + 1]
lea ecx, [r9 + 2]
imul ecx, r8d
imul ecx, r9d
mov eax, 0x2aaaaaab
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
add eax, eax
sub ecx, eax
mov r12d, 2
cmp ecx, r12d
cmove r9d, r8d
mov dword [0x14018cd80], r9d
lea rax, [rbp - 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
mov rdx, qword [rbx]
mov rcx, qword [rdi + 0x2d8]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400419a5
lea r8, [0x140188310]
lea ebx, [rax + 1]
cmp byte [0x14018d883], r14b
jne 0x14004194e
mov dword [rbp - 0x18], 0x2004c
mov dword [rbp - 0x14], 0x14001e
mov dword [rbp - 0x10], 0x1b0017
mov dword [rbp - 0xc], 0x26
mov rcx, r14
lea rax, [0x140187da0]
movzx eax, byte [rcx + rax]
xor ax, word [rbp + rcx*2 - 0x18]
mov word [r8 + rcx*2], ax
add rcx, rbx
cmp rcx, 7
jl 0x14004192a
mov byte [0x14018d883], bl
lea rdx, [rbp - 0x38]
lea rcx, [rbp - 0x28]
call fcn.140016a58
nop
mov dword [rsp + 0x28], 0x20
mov qword [rsp + 0x20], rsi
mov r9d, 3
xor r8d, r8d
mov rdx, qword [rax]
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
mov rdx, qword [rbp - 0x28]
add rdx, 0xffffffffffffffe8
mov ecx, r15d
lock xadd dword [rdx + 0x10], ecx
add ecx, r15d
test ecx, ecx
jg 0x1400419a1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test esi, esi
je 0x1400419e7
call fcn.14003b5fc
mov rdx, rax
lea rcx, [rbp - 0x40]
call fcn.140001cb0
nop
lea rdx, [rbp - 0x40]
mov rcx, rdi
call fcn.1400424e0
nop
mov rdx, qword [rbp - 0x40]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x1400419e4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov bl, r14b
mov rdx, qword [rbp - 0x38]
add rdx, 0xffffffffffffffe8
mov ecx, r15d
lock xadd dword [rdx + 0x10], ecx
add ecx, r15d
test ecx, ecx
jg 0x140041a08
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov al, bl
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400b0c90
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x140042dd0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x30
mov r12, rdx
lea rdx, [rcx + 0x10]
mov r8, rcx
mov rsi, rcx
call fcn.1400039f4
and dword [rsi + 0x44], 0
mov byte [rsi + 0x40], 0
mov r15, qword [0x14018b4f0]
call fcn.140009110
xor edi, edi
mov ebx, 0x81
mov rcx, r15
lea r8d, [rdi + 5]
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbp, rax
test rax, rax
je 0x140042eea
lea r8d, [rbx + 0x6f]
mov edx, ebx
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x140042e5e
mov rdx, rax
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdx, rbp
mov rcx, r15
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x140042ed6
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r14, rax
test rax, rax
je 0x140042ed6
mov rcx, rax
call fcn.140039fb8
and qword [rsp + 0x20], rbx
lea r9, [0x140043810]
mov rdx, rax
mov r8, r12
mov rcx, r15
mov rbp, rax
call qword [sym.imp.USER32.dll_CreateDialogIndirectParamW]
mov rdi, rax
test rax, rax
jne 0x140042eb8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp rbp, r14
je 0x140042ede
test rbp, rbp
je 0x140042ede
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GlobalHandle]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x140042ede
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
je 0x140042eea
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
cmp dword [rsi + 0x44], 0
jge 0x140042f0a
test rdi, rdi
je 0x140042f0a
mov rcx, qword [rsi + 8]
call qword [sym.imp.USER32.dll_DestroyWindow]
mov ecx, dword [rsi + 0x44]
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor edi, edi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rax, rdi
mov rdi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r12
ret
Function at 0x14004569c
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x40], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rbx, rcx
cmp byte [rcx + 0x78], 0
je 0x1400456d0
call fcn.1400458f0
test al, al
je 0x1400458d6
lea rdi, [rbx + 0xb0]
mov rax, qword [rdi + 8]
mov esi, 1
cmp qword [rdi], rax
jne 0x140045764
lea rax, [rbx + 0xd0]
mov qword [rbp + 0x28], rax
lea r14, [rax + 8]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
cmp qword [rbx + 0x120], 0
jne 0x140045716
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x1400458d6
lea rcx, [rbx + 0x100]
lea rdx, [rbp - 0x20]
call fcn.140028bd0
mov rdx, rax
mov rax, qword [rax]
test rax, rax
je 0x140045734
mov rax, qword [rax]
mov rcx, qword [rax + 0x10]
sub rcx, rsi
and rcx, qword [rdx + 0x10]
mov rax, qword [rax + 8]
mov rdx, qword [rax + rcx*8]
add rdx, 8
mov rcx, rdi
call fcn.1400255d8
and qword [rbx + 0xc8], 0
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
and dword [rbp + 0x20], 0
mov rdx, qword [rdi]
mov r8, qword [rdi + 8]
sub r8, rdx
lea rcx, [rbx + 0x80]
add rdx, qword [rbx + 0xc8]
mov qword [rsp + 0x20], rcx
lea r9, [rbp + 0x20]
mov rcx, qword [rbx + 0xa8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x140045818
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
je 0x1400457e7
cmp eax, 0x3e5
je 0x1400457e1
lea rax, str.Channel_write_failure
mov qword [rbp + 0x28], rax
lea rdx, [rbp + 0x28]
lea rcx, [rbp - 0x20]
call fcn.1400b4118
nop
lea rax, vtable.CRSimpleIPCException.0
mov qword [rbp - 0x20], rax
lea rdx, [0x14014f950]
lea rcx, [rbp - 0x20]
call fcn.1400b8b68
int3
mov byte [rbx + 0x78], sil
jmp 0x140045818
lea rcx, [rbp - 0x38]
call fcn.1400b4190
nop
lea rax, vtable.CRSimpleIPCException.0
mov qword [rbp - 0x38], rax
lea rax, vtable.CRSimpleIPCExceptionDisconnected.0
mov qword [rbp - 0x38], rax
lea rdx, [0x14014f908]
lea rcx, [rbp - 0x38]
call fcn.1400b8b68
int3
cmp byte [rbx + 0x78], 0
jne 0x1400458d6
mov eax, dword [rbp + 0x20]
add qword [rbx + 0xc8], rax
mov rax, qword [rdi + 8]
sub rax, qword [rdi]
cmp qword [rbx + 0xc8], rax
jne 0x1400458c4
lea rax, [rbx + 0xd0]
mov qword [rbp + 0x28], rax
lea r14, [rax + 8]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
cmp qword [rbx + 0x120], 0
je 0x1400458a0
mov rcx, qword [rbx + 0x110]
sub rcx, rsi
and rcx, qword [rbx + 0x118]
mov rax, qword [rbx + 0x108]
mov rcx, qword [rax + rcx*8]
mov rax, qword [rcx]
xor edx, edx
call qword [rax]
dec qword [rbx + 0x120]
jne 0x140045899
and qword [rbx + 0x118], 0
jmp 0x1400458a0
add qword [rbx + 0x118], rsi
mov rax, qword [rdi]
mov qword [rdi + 8], rax
and qword [rbx + 0xc8], 0
cmp qword [rbx + 0x120], 0
setne sil
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [rbx + 0xa0]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov al, sil
jmp 0x1400458d8
xor al, al
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x140046700
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xor r11d, r11d
mov r10, rdx
mov r9, rcx
test r8d, r8d
jle 0x140046754
mov rbx, rcx
sub r10, rcx
mov eax, 0x2aaaaaab
imul r11d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, r11d
inc r11d
lea ecx, [rdx + rdx*2]
shl ecx, 5
sub eax, ecx
movsxd rcx, eax
lea rax, str._Jokshan_begat_Sheba__and_Dedan._And_the_sons_of_Dedan_were_Asshurim__and_Letushim__and_Leummim.
mov al, byte [rcx + rax]
xor al, byte [r10 + rbx]
mov byte [rbx], al
inc rbx
cmp r11d, r8d
jl 0x140046719
mov rbx, qword [rsp + 8]
mov rax, r9
ret