joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140055460
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov rax, qword [0x1401bce90]
xor rax, rsp
mov qword [rsp + 0x20], rax
cmp byte [0x1401c69b3], 0
je 0x140055495
lea rax, [0x1401c0c50]
mov rcx, qword [rsp + 0x20]
xor rcx, rsp
call fcn.1400ce2d0
add rsp, 0x38
ret
mov dword [rsp], 0x5001b
mov dword [rsp + 4], 0x40011
mov dword [rsp + 8], 0x450008
mov dword [rsp + 0xc], 0x40009
mov dword [rsp + 0x10], 0xc0001
mov dword [rsp + 0x14], 0x170053
mov dword [rsp + 0x18], 0x1c0007
mov dword [rsp + 0x1c], 0x14
xor r8d, r8d
lea rdx, [0x1401c0c50]
lea r9, [0x1401bfd91]
nop word [rax + rax]
movzx eax, byte [r8 + r9 - 1]
movzx ecx, word [rsp + r8*2 + 2]
add r8, 5
xor ax, word [rsp + r8*2 - 0xa]
mov word [rdx + r8*2 - 0xa], ax
movzx eax, byte [r8 + r9 - 5]
xor cx, ax
movzx eax, byte [r8 + r9 - 4]
xor ax, word [rsp + r8*2 - 6]
mov word [rdx + r8*2 - 8], cx
movzx ecx, byte [r8 + r9 - 3]
xor cx, word [rsp + r8*2 - 4]
mov word [rdx + r8*2 - 6], ax
mov word [rdx + r8*2 - 4], cx
movzx ecx, byte [r8 + r9 - 2]
xor cx, word [rsp + r8*2 - 2]
mov word [rdx + r8*2 - 2], cx
cmp r8, 0xf
jl 0x1400554f0
mov byte [0x1401c69b3], 1
mov rax, rdx
mov rcx, qword [rsp + 0x20]
xor rcx, rsp
call fcn.1400ce2d0
add rsp, 0x38
ret

Function at 0x1400556f0
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1401bce90]
xor rax, rsp
mov qword [rbp - 8], rax
mov r8d, dword [0x1401c4d60]
lea eax, [r8 + 1]
lea ecx, [r8 + 2]
imul ecx, eax
mov eax, 0x2aaaaaab
imul ecx, r8d
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 2
sub ecx, eax
cmp ecx, 0xb
jne 0x14005574d
mov eax, 1
test r8d, r8d
cmove r8d, eax
mov dword [0x1401c4d60], r8d
cmp byte [0x1401c69b8], 0
mov qword [rsp + 0x70], rbx
je 0x140055767
lea rax, [0x1401c0c18]
jmp 0x14005584c
xor edx, edx
mov dword [rbp - 0x40], 0x90011
mov dword [rbp - 0x3c], 0x17001e
mov dword [rbp - 0x38], 0x4004d
mov dword [rbp - 0x34], 0x9000b
mov dword [rbp - 0x30], 0xa0003
mov word [rbp - 0x10], dx
mov dword [rbp - 0x2c], 0xb0053
mov dword [rbp - 0x28], 0x40017
mov dword [rbp - 0x24], 0x52
mov dword [rbp - 0x20], 0x49000e
mov dword [rbp - 0x1c], 0x60007
mov dword [rbp - 0x18], 0x40002
mov dword [rbp - 0x14], 0x100018
lea rbx, [0x1401c0c18]
lea r8, [0x1401bfd91]
nop
movzx eax, byte [rdx + r8 - 1]
movzx ecx, word [rbp + rdx*2 - 0x3e]
add rdx, 6
xor ax, word [rbp + rdx*2 - 0x4c]
mov word [rbx + rdx*2 - 0xc], ax
movzx eax, byte [rdx + r8 - 6]
xor cx, ax
movzx eax, byte [rdx + r8 - 5]
xor ax, word [rbp + rdx*2 - 0x48]
mov word [rbx + rdx*2 - 0xa], cx
mov word [rbx + rdx*2 - 8], ax
movzx eax, byte [rdx + r8 - 4]
xor ax, word [rbp + rdx*2 - 0x46]
mov word [rbx + rdx*2 - 6], ax
movzx eax, byte [rdx + r8 - 3]
xor ax, word [rbp + rdx*2 - 0x44]
mov word [rbx + rdx*2 - 4], ax
movzx eax, byte [rdx + r8 - 2]
xor ax, word [rbp + rdx*2 - 0x42]
mov word [rbx + rdx*2 - 2], ax
cmp rdx, 0x18
jl 0x1400557d0
call fcn.140050870
mov byte [0x1401c69b8], 1
mov rax, rbx
mov rbx, qword [rsp + 0x70]
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400ce2d0
add rsp, 0x60
pop rbp
ret
Function at 0x140055870
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x718
mov rax, qword [0x1401bce90]
xor rax, rsp
mov qword [rsp + 0x708], rax
cmp byte [0x1401c699d], 0
je 0x1400558b1
lea rax, [0x1401c0ab0]
mov rcx, qword [rsp + 0x708]
xor rcx, rsp
call fcn.1400ce2d0
add rsp, 0x718
ret
mov ecx, dword [0x1401c4d60]
mov eax, 0x66666667
mov qword [rsp + 0x730], rdi
lea r8d, [rcx + 1]
xor edi, edi
imul r8d, ecx
imul r8d
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
shl eax, 2
sub r8d, eax
cmp r8d, 0xe
jne 0x14005598e
mov qword [rsp + 0x720], rbx
mov qword [rsp + 0x728], rsi
mov qword [rsp + 0x710], r14
lea r14, [rsp + 0x20]
mov esi, edi
nop dword [rax]
mov r9d, edi
nop word [rax + rax]
mov eax, ecx
lea r8d, [rsi + 1]
lea ebx, [r9 + 1]
cdq
idiv r8d
mov eax, ecx
sub eax, esi
mov r8d, edx
imul r8d, eax
mov eax, ecx
lea rcx, [0x14014d9a0]
cdq
idiv ebx
add r8d, eax
sub r8d, r9d
mov edx, r8d
call fcn.1400cf1dc
add r14, 4
mov r9d, ebx
cmp ebx, 0x1b
jge 0x140055967
mov ecx, dword [0x1401c4d60]
jmp 0x140055920
inc esi
cmp esi, 0x10
jge 0x140055976
mov ecx, dword [0x1401c4d60]
jmp 0x140055910
mov rsi, qword [rsp + 0x728]
mov rbx, qword [rsp + 0x720]
mov r14, qword [rsp + 0x710]
mov dword [rsp + 0x6e0], 0xd0020
mov dword [rsp + 0x6e4], 0x70011
mov dword [rsp + 0x6e8], 0x17003d
mov dword [rsp + 0x6ec], 0x60008
mov dword [rsp + 0x6f0], 0x1a0009
mov dword [rsp + 0x6f4], 0x290000
mov dword [rsp + 0x6f8], 0x1d0007
mov dword [rsp + 0x6fc], 0x1d001d
mov dword [rsp + 0x700], 0x530011
mov dword [rsp + 0x704], 0x4a
lea rax, [0x1401c0ab0]
lea rdx, [0x1401bfd90]
nop word [rax + rax]
movzx ecx, byte [rdi + rdx]
inc rdi
xor cx, word [rsp + rdi*2 + 0x6de]
mov word [rax + rdi*2 - 2], cx
cmp rdi, 0x13
jl 0x140055a10
mov byte [0x1401c699d], 1
mov rdi, qword [rsp + 0x730]
mov rcx, qword [rsp + 0x708]
xor rcx, rsp
call fcn.1400ce2d0
add rsp, 0x718
ret
Function at 0x140055a60
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov rax, qword [0x1401bce90]
xor rax, rsp
mov qword [rsp + 0x20], rax
mov ecx, dword [0x1401c4d60]
mov eax, 0x2aaaaaab
mov r8d, ecx
imul r8d, ecx
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 3
sub r8d, eax
cmp r8d, 0xa
jne 0x140055b0b
test ecx, ecx
je 0x140055b0b
mov eax, ecx
and eax, 0x80000001
jge 0x140055ab5
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x140055aca
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
mov ecx, eax
mov dword [0x1401c4d60], eax
jmp 0x140055ad7
lea ecx, [rcx*2 + 1]
mov dword [0x1401c4d60], ecx
mov eax, 0x55555556
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
mov edx, ecx
sub edx, eax
je 0x140055af9
sub edx, 2
je 0x140055afc
dec edx
je 0x140055afe
jmp 0x140055b07
add ecx, 2
inc ecx
add ecx, 2
mov dword [0x1401c4d60], ecx
test ecx, ecx
jne 0x140055aa5
cmp byte [0x1401c69c0], 0
lea rax, [0x1401c03b8]
jne 0x140055ba8
xor r8d, r8d
mov dword [rsp], 0x7001c
mov dword [rsp + 4], 0x20006
mov dword [rsp + 8], 0x40
mov dword [rsp + 0xc], 0x170015
mov dword [rsp + 0x10], 0x1b0003
mov word [rsp + 0x1c], r8w
mov dword [rsp + 0x14], 0x3005d
mov dword [rsp + 0x18], 0x16000b
lea r9, [0x1401bfd91]
nop word [rax + rax]
movzx ecx, byte [r8 + r9 - 1]
movzx edx, word [rsp + r8*2 + 2]
add r8, 2
xor cx, word [rsp + r8*2 - 4]
mov word [rax + r8*2 - 4], cx
movzx ecx, byte [r8 + r9 - 2]
xor dx, cx
mov word [rax + r8*2 - 2], dx
cmp r8, 0xe
jl 0x140055b70
mov byte [0x1401c69c0], 1
mov rcx, qword [rsp + 0x20]
xor rcx, rsp
call fcn.1400ce2d0
add rsp, 0x38
ret
Function at 0x140055bc0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x220]
sub rsp, 0x320
mov rax, qword [0x1401bce90]
xor rax, rsp
mov qword [rbp + 0x210], rax
mov r10d, dword [0x1401c4d60]
mov eax, 0x66666667
xor ecx, ecx
lea edi, [r10 + 1]
lea r8d, [r10 + 2]
imul r8d, edi
imul r8d, r10d
imul r8d
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
shl eax, 2
sub r8d, eax
cmp r8d, 0xc
jne 0x140055c44
mov r9d, ecx
lea r11, [rsp + 0x20]
mov ebx, r10d
inc r9d
dec ebx
lea r11, [r11 + 4]
movsxd rax, r9d
cmp rax, 0xaf
jb 0x140055c30
cmp byte [0x1401c699b], cl
je 0x140055c58
lea rax, [0x1401c0778]
jmp 0x140055d82
mov dword [rbp + 0x1e0], 0xd0015
mov r11d, 4
mov dword [rbp + 0x1e4], 0x2e0004
mov dword [rbp + 0x1e8], 0x10002
mov dword [rbp + 0x1ec], 0x90012
mov dword [rbp + 0x1f0], 0x210009
mov dword [rbp + 0x1f4], 0xa0012
mov dword [rbp + 0x1f8], 0x1c0006
mov dword [rbp + 0x1fc], 0x210017
mov dword [rbp + 0x200], 0xd003c
mov dword [rbp + 0x204], 0xf0006
mov dword [rbp + 0x208], 0x4b0055
mov word [rbp + 0x20c], cx
lea rbx, [0x1401c0778]
lea r8, [0x1401bfd91]
movzx eax, byte [rcx + r8 - 1]
movzx edx, word [rbp + rcx*2 + 0x1e2]
add rcx, 2
xor ax, word [rbp + rcx*2 + 0x1dc]
mov word [rbx + rcx*2 - 4], ax
movzx eax, byte [rcx + r8 - 2]
xor dx, ax
mov word [rbx + rcx*2 - 2], dx
cmp rcx, 0x16
jl 0x140055ce1
imul edi, r10d
mov eax, 0x38e38e39
imul edi
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
add eax, eax
sub edi, eax
cmp edi, 0x11
jne 0x140055d78
mov eax, 0x51eb851f
imul r10d
mov rax, r11
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul edx, edx, 0x64
sub r10d, edx
add r10d, 0x2f4
movsxd rcx, r10d
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.1400cd918
mov rcx, rax
call fcn.1400cf37c
mov byte [0x1401c699b], 1
mov rax, rbx
mov rcx, qword [rbp + 0x210]
xor rcx, rsp
call fcn.1400ce2d0
lea r11, [rsp + 0x320]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x140056070
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov rax, qword [0x1401bce90]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp byte [0x1401c6997], 0
lea rax, [0x1401c0bf0]
jne 0x14005610f
mov dword [rsp], 0x290024
mov dword [rsp + 4], 0xf001c
mov dword [rsp + 8], 0x60002
mov dword [rsp + 0xc], 0x1d0022
mov dword [rsp + 0x10], 0x27005e
mov dword [rsp + 0x14], 0x490007
mov dword [rsp + 0x18], 0x50031
mov dword [rsp + 0x1c], 0xc0011
mov dword [rsp + 0x20], 0x1a000d
mov dword [rsp + 0x24], 0x19
xor ecx, ecx
lea r8, [0x1401bfd90]
nop dword [rax + rax]
movzx edx, byte [rcx + r8]
inc rcx
xor dx, word [rsp + rcx*2 - 2]
mov word [rax + rcx*2 - 2], dx
cmp rcx, 0x13
jl 0x1400560f0
mov byte [0x1401c6997], 1
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400ce2d0
add rsp, 0x38
ret

Function at 0x140056130
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov rax, qword [0x1401bce90]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov r8d, dword [0x1401c4d60]
lea eax, [r8 + 2]
lea ecx, [r8 + 1]
imul eax, ecx
imul eax, r8d
and eax, 0x80000007
jge 0x140056167
dec eax
or eax, 0xfffffff8
inc eax
cmp eax, 7
jne 0x1400561ae
mov eax, 0x51eb851f
imul r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, 4
imul edx, edx, 0x64
sub r8d, edx
add r8d, 0x63
movsxd rcx, r8d
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.1400cd918
mov rcx, rax
call fcn.1400cf37c
cmp byte [0x1401c698a], 0
je 0x1400561d0
lea rax, [0x1401c09a0]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400ce2d0
add rsp, 0x58
ret
xor r8d, r8d
mov dword [rsp + 0x20], 0x90002
mov dword [rsp + 0x24], 0x60002
mov dword [rsp + 0x28], 0x110003
mov dword [rsp + 0x2c], 0x150047
mov dword [rsp + 0x30], 0x6001e
mov word [rsp + 0x40], r8w
mov dword [rsp + 0x34], 0x440010
mov dword [rsp + 0x38], 0x11000c
mov dword [rsp + 0x3c], 0xa001f
lea rdx, [0x1401c09a0]
lea r9, [0x1401bfd91]
nop word [rax + rax]
movzx eax, byte [r8 + r9 - 1]
movzx ecx, word [rsp + r8*2 + 0x22]
add r8, 4
xor ax, word [rsp + r8*2 + 0x18]
mov word [rdx + r8*2 - 8], ax
movzx eax, byte [r8 + r9 - 4]
xor cx, ax
mov word [rdx + r8*2 - 6], cx
movzx ecx, byte [r8 + r9 - 3]
xor cx, word [rsp + r8*2 + 0x1c]
mov word [rdx + r8*2 - 4], cx
movzx ecx, byte [r8 + r9 - 2]
xor cx, word [rsp + r8*2 + 0x1e]
mov word [rdx + r8*2 - 2], cx
cmp r8, 0x10
jl 0x140056230
mov byte [0x1401c698a], 1
mov rax, rdx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400ce2d0
add rsp, 0x58
ret
Function at 0x140056330
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov rax, qword [0x1401bce90]
xor rax, rsp
mov qword [rsp + 0x48], rax
call fcn.140050870
test al, al
jne 0x140056372
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov ecx, dword [0x1401c4d60]
mov edx, 7
test rax, rax
cmove ecx, edx
mov dword [0x1401c4d60], ecx
jmp 0x140056378
mov ecx, dword [0x1401c4d60]
lea eax, [rcx + 1]
lea r8d, [rcx + 2]
imul r8d, eax
mov eax, 0x66666667
imul r8d, ecx
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
add eax, eax
sub r8d, eax
cmp r8d, 8
jne 0x140056416
test ecx, ecx
je 0x140056416
nop dword [rax + rax]
mov eax, ecx
and eax, 0x80000001
jge 0x1400563c0
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x1400563d5
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
mov ecx, eax
mov dword [0x1401c4d60], eax
jmp 0x1400563e2
lea ecx, [rcx*2 + 1]
mov dword [0x1401c4d60], ecx
mov eax, 0x55555556
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
mov edx, ecx
sub edx, eax
je 0x140056404
sub edx, 2
je 0x140056407
dec edx
je 0x140056409
jmp 0x140056412
add ecx, 2
inc ecx
add ecx, 2
mov dword [0x1401c4d60], ecx
test ecx, ecx
jne 0x1400563b0
cmp byte [0x1401c69a7], 0
je 0x140056438
lea rax, [0x1401c0488]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400ce2d0
add rsp, 0x58
ret
xor r8d, r8d
mov dword [rsp + 0x20], 0x18003d
mov dword [rsp + 0x24], 0xd0015
mov dword [rsp + 0x28], 0x17003d
mov dword [rsp + 0x2c], 0x60008
mov dword [rsp + 0x30], 0x1a0009
mov word [rsp + 0x40], r8w
mov dword [rsp + 0x34], 0x440000
mov dword [rsp + 0x38], 0x150011
mov dword [rsp + 0x3c], 0x9001e
lea rdx, [0x1401c0488]
lea r9, [0x1401bfd91]
nop
movzx eax, byte [r8 + r9 - 1]
movzx ecx, word [rsp + r8*2 + 0x22]
add r8, 4
xor ax, word [rsp + r8*2 + 0x18]
mov word [rdx + r8*2 - 8], ax
movzx eax, byte [r8 + r9 - 4]
xor cx, ax
mov word [rdx + r8*2 - 6], cx
movzx ecx, byte [r8 + r9 - 3]
xor cx, word [rsp + r8*2 + 0x1c]
mov word [rdx + r8*2 - 4], cx
movzx ecx, byte [r8 + r9 - 2]
xor cx, word [rsp + r8*2 + 0x1e]
mov word [rdx + r8*2 - 2], cx
cmp r8, 0x10
jl 0x140056490
mov byte [0x1401c69a7], 1
mov rax, rdx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400ce2d0
add rsp, 0x58
ret
Function at 0x140056510
Capabilities:
Check for software breakpoints

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x1401c4d60]
lea eax, [rcx + 1]
lea r8d, [rcx + 2]
imul r8d, eax
mov eax, 0xb21642c9
imul r8d, ecx
imul r8d
add edx, r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x17
sub r8d, edx
cmp r8d, 0xc
jne 0x1400565b4
mov eax, 0x81848da9
xor r8d, r8d
imul ecx
add edx, ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, ecx
imul edx, edx, 0xfd
sub eax, edx
cmp eax, 0xcc
je 0x1400565ab
mov eax, ecx
inc r8d
or eax, 0xffffff56
add ecx, eax
mov eax, ecx
imul eax, ecx
cmp r8d, eax
jg 0x1400565ab
mov eax, 0x81848da9
imul ecx
add edx, ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, ecx
imul edx, edx, 0xfd
sub eax, edx
cmp eax, 0xcc
jne 0x140056571
mov ecx, r8d
mov dword [0x1401c4d60], ecx
cmp byte [0x1401c69a6], 0
jne 0x140056665
mov r8d, ecx
mov eax, 0x66666667
imul r8d, ecx
imul r8d, ecx
imul r8d
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
shl eax, 2
sub r8d, eax
cmp r8d, 0x12
jne 0x140056604
call fcn.1400cebc4
mov ecx, dword [0x1401c4d60]
cmp ecx, eax
jne 0x140056604
dec ecx
mov dword [0x1401c4d60], ecx
movzx eax, byte [0x1401bfd90]
mov byte [0x1401c69a6], 1
xor al, 0x5f
movzx eax, al
mov word [0x1401c0420], ax
movzx eax, byte [0x1401bfd91]
xor al, 0xe
movzx eax, al
mov word [0x1401c0422], ax
movzx eax, byte [0x1401bfd92]
xor al, 2
movzx eax, al
mov word [reloc.OLEAUT32.dll_SysReAllocString], ax
movzx eax, byte [0x1401bfd93]
xor al, 0xc
movzx eax, al
mov word [0x1401c0426], ax
movzx eax, byte [0x1401bfd94]
mov word [0x1401c0428], ax
lea rax, [0x1401c0420]
add rsp, 0x28
ret
Function at 0x14005abc0
Capabilities:
Acquire debug privileges

Disassembly:
push rdi
sub rsp, 0x90
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rsp + 0xa0], rbx
mov rax, qword [0x1401bce90]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov edi, edx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rbx, rax
call fcn.140028e90
mov rcx, rax
lea r9, [rsp + 0x30]
mov r8d, 0x20028
mov rdx, rbx
call fcn.1400400b0
test eax, eax
jne 0x14005ac52
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rsp + 0x68]
call fcn.140050560
mov rbx, rax
call fcn.1400528c0
mov rdx, rax
mov r8, rbx
lea rcx, [rsp + 0x38]
call fcn.140056740
lea rdx, [0x140187320]
lea rcx, [rsp + 0x38]
call fcn.1400d61a8
nop
mov r8d, dword [0x1401c4d60]
mov ecx, r8d
imul ecx, r8d
mov eax, 0x78787879
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x11
sub ecx, edx
cmp ecx, 7
jne 0x14005ac85
inc r8d
mov dword [0x1401c4d60], r8d
lea r8, [rsp + 0x48]
lea rdx, str.SeDebugPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
jne 0x14005ace4
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rsp + 0x68]
call fcn.140050560
mov r10, rax
call fcn.140052f30
mov rdx, rax
mov r8, r10
lea rcx, [rsp + 0x38]
call fcn.140056740
lea rdx, [0x140187320]
lea rcx, [rsp + 0x38]
call fcn.1400d61a8
nop
mov eax, dword [0x1401c4d60]
lea ecx, [rax + 1]
imul ecx, eax
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xe
sub ecx, edx
cmp ecx, 9
jne 0x14005ad18
call fcn.1400cebc4
mov dword [0x1401c4d60], eax
mov dword [rsp + 0x58], 1
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x5c], rax
neg edi
sbb eax, eax
and eax, 2
mov dword [rsp + 0x64], eax
xor eax, eax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [rsp + 0x58]
xor edx, edx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov rcx, qword [rsp + 0x30]
test eax, eax
jne 0x14005ada1
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rsp + 0x68]
call fcn.140050560
mov rbx, rax
call fcn.140051860
mov rdx, rax
mov r8, rbx
lea rcx, [rsp + 0x38]
call fcn.140056740
lea rdx, [0x140187320]
lea rcx, [rsp + 0x38]
call fcn.1400d61a8
nop
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.1400ce2d0
mov rbx, qword [rsp + 0xa0]
add rsp, 0x90
pop rdi
ret
Function at 0x14005add0
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0xc0
mov qword [rsp + 0xa0], 0xfffffffffffffffe
mov rdi, rcx
xor ebx, ebx
mov esi, ebx
mov dword [rsp + 0xf8], ebx
mov eax, dword [0x1401c4d60]
lea r8d, [rax + 1]
imul r8d, eax
mov eax, 0x38e38e39
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
add eax, eax
sub r8d, eax
cmp r8d, 5
jne 0x14005ae52
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r8d, eax
mov eax, 0xcccccccd
mul r8d
shr edx, 6
lea ecx, [rdx + rdx*4]
shl ecx, 4
sub r8d, ecx
lea eax, [r8 + 1]
mov dword [0x1401c4d60], eax
cmp esi, 5
jge 0x14005aff8
mov esi, 1
mov edx, esi
call fcn.14005abc0
mov rcx, rdi
call fcn.140058fd0
mov r11d, eax
mov dword [rsp + 0x100], eax
test eax, eax
je 0x14005aee0
call fcn.140050620
test al, al
jne 0x14005aed8
mov dword [rsp + 0x40], ebx
mov ecx, dword [0x1401c4d60]
mov eax, 0xaf3addc7
imul ecx
add edx, ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xbb
mov eax, ecx
sub eax, edx
cmp eax, 0x8c
je 0x14005aed2
mov eax, ecx
or eax, 0xffffffc2
add ecx, eax
mov dword [0x1401c4d60], ecx
inc ebx
mov dword [rsp + 0x40], ebx
mov eax, ecx
imul eax, ecx
cmp ebx, eax
jg 0x14005aed2
jmp 0x14005ae90
mov dword [0x1401c4d60], ebx
mov eax, r11d
jmp 0x14005b01e
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rdi + 0x1d8], eax
cmp dword [rdi + 0x2d0], 2
jne 0x14005aeff
mov dword [rdi + 0x2d0], 3
mov r8d, dword [rdi + 0x1c8]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rdi + 0x1d0], rax
mov r8d, dword [0x1401c4d60]
mov ecx, r8d
imul ecx, r8d
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 3
sub ecx, eax
cmp ecx, 3
jne 0x14005af54
test r8d, r8d
cmove r8d, esi
mov dword [0x1401c4d60], r8d
mov rax, qword [rdi + 0x1a0]
mov r15d, dword [rax - 0x10]
mov dword [rsp + 0x108], r15d
add rax, 0xffffffffffffffe8
mov qword [rsp + 0xb0], rax
sub esi, dword [rax + 0x10]
mov dword [rsp + 0x60], esi
mov eax, dword [rax + 0xc]
mov dword [rsp + 0x98], eax
or eax, esi
jge 0x14005af96
xor edx, edx
lea rcx, [rdi + 0x1a0]
call fcn.1400023a0
mov rdx, qword [rdi + 0x1a0]
mov qword [rsp + 0xa8], rdx
lea r8d, [r15*2 + 2]
mov rcx, rdi
call fcn.14005b030
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], ebx
mov r9, rdi
lea r8, [0x14005c330]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rdi + 0x128], rax
xor edx, edx
call fcn.14005abc0
jmp 0x14005aff8
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], ebx
mov r9, rdi
lea r8, [0x14005b970]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rdi + 0x1c0], rax
xor eax, eax
add rsp, 0xc0
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
Function at 0x14005e630
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x30
mov r15, r9
mov r12, r8
mov r14, rcx
call fcn.14000a730
xor edi, edi
mov edx, 0x81
lea r8d, [rdi + 5]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rsi, rax
test rax, rax
je 0x14005e752
mov edx, 0x81
mov rcx, r14
mov qword [rsp + 0x50], rbx
lea r8d, [rdx + 0x6f]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x14005e6a3
mov rdx, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdx, rsi
mov rcx, r14
mov qword [rsp + 0x58], rbp
mov ebx, edi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x14005e71c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbp, rax
test rax, rax
je 0x14005e71c
mov rcx, rax
call fcn.140050180
mov r9, r15
mov r8, r12
mov rcx, r14
mov rdx, rax
mov qword [rsp + 0x20], rdi
mov rsi, rax
call qword [sym.imp.USER32.dll_CreateDialogIndirectParamW]
mov rdi, rax
test rax, rax
jne 0x14005e6fe
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp rsi, rbp
je 0x14005e724
test rsi, rsi
je 0x14005e724
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalHandle]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x14005e724
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rbp, qword [rsp + 0x58]
test ebx, ebx
je 0x14005e735
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rbx, qword [rsp + 0x50]
mov rax, rdi
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r12
ret
mov rax, rdi
jmp 0x14005e73d