joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140059700
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x1401cde90]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov ecx, dword [0x1401d5d60]
mov eax, 0x2aaaaaab
mov r8d, ecx
imul r8d, ecx
imul r8d
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea edx, [rdx + rdx*2]
shl edx, 2
sub r8d, edx
cmp r8d, 7
jne 0x140059759
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov ecx, dword [0x1401d5d60]
lea r8d, [rcx + 1]
mov eax, 0x2aaaaaab
xor ebx, ebx
imul r8d, ecx
imul r8d
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
add eax, eax
sub r8d, eax
cmp r8d, 5
jne 0x1400597dc
mov eax, 0x2f149903
mov r8d, ebx
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, ecx
imul edx, edx, 0x57
sub eax, edx
cmp eax, 0x7b
je 0x1400597d3
mov eax, ecx
inc r8d
or eax, 0xffffff4b
add ecx, eax
mov eax, ecx
imul eax, ecx
cmp r8d, eax
jg 0x1400597d3
mov eax, 0x2f149903
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, ecx
imul edx, edx, 0x57
sub eax, edx
cmp eax, 0x7b
jne 0x1400597a0
mov ecx, r8d
mov dword [0x1401d5d60], ecx
cmp byte [0x1401d7a34], bl
je 0x1400597f0
lea rax, [0x1401d1800]
jmp 0x1400598e4
lea eax, [rcx + 1]
lea r8d, [rcx + 2]
imul r8d, eax
mov eax, 0x92492493
imul r8d, ecx
imul r8d
add edx, r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 7
sub r8d, edx
cmp r8d, 2
jne 0x140059835
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_GetMailslotInfo]
mov dword [rbp - 0x50], 0x170026
mov dword [rbp - 0x4c], 0xb
mov dword [rbp - 0x48], 0xe001b
mov dword [rbp - 0x44], 0x50035
mov dword [rbp - 0x40], 0x19001b
mov dword [rbp - 0x3c], 1
mov dword [rbp - 0x38], 0x50003
mov dword [rbp - 0x34], 0x550058
mov dword [rbp - 0x30], 0x70038
mov dword [rbp - 0x2c], 0x30004
mov dword [rbp - 0x28], 0xe0001
mov dword [rbp - 0x24], 0x1c001d
mov dword [rbp - 0x20], 0x16004a
mov dword [rbp - 0x1c], 0x80011
mov dword [rbp - 0x18], 0x10006
mov dword [rbp - 0x14], 0x16
lea r9, [0x1401d1800]
lea rcx, [0x1401d0d90]
movzx eax, byte [rbx + rcx]
inc rbx
xor ax, word [rbp + rbx*2 - 0x52]
mov word [r9 + rbx*2 - 2], ax
cmp rbx, 0x1f
jl 0x1400598b3
mov byte [0x1401d7a34], 1
call fcn.140055390
test al, al
jne 0x1400598e1
inc dword [0x1401d7664]
mov rax, r9
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400d37e0
mov rbx, qword [rsp + 0x90]
add rsp, 0x80
pop rbp
ret
Function at 0x140059c40
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x1401cde90]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov eax, dword [0x1401d5d60]
xor ebx, ebx
mov ecx, eax
imul ecx, eax
imul ecx, eax
mov eax, 0x38e38e39
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
add eax, eax
sub ecx, eax
cmp ecx, 0xc
jne 0x140059c9c
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
cmp byte [0x1401d7a23], bl
je 0x140059cbe
lea rax, [0x1401d15c0]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400d37e0
add rsp, 0x60
pop rbx
ret
mov dword [rsp + 0x30], 0x13
mov dword [rsp + 0x34], 0x12001c
mov dword [rsp + 0x38], 0x40006
mov dword [rsp + 0x3c], 0x50000f
mov dword [rsp + 0x40], 0x450054
mov dword [rsp + 0x44], 0x550047
mov dword [rsp + 0x48], 0x450041
mov dword [rsp + 0x4c], 0x570045
mov word [rsp + 0x50], bx
lea rdx, [0x1401d15c0]
lea r8, [0x1401d0d91]
movzx eax, byte [rbx + r8 - 1]
movzx ecx, word [rsp + rbx*2 + 0x32]
add rbx, 4
xor ax, word [rsp + rbx*2 + 0x28]
mov word [rdx + rbx*2 - 8], ax
movzx eax, byte [rbx + r8 - 4]
xor cx, ax
mov word [rdx + rbx*2 - 6], cx
movzx ecx, byte [rbx + r8 - 3]
xor cx, word [rsp + rbx*2 + 0x2c]
mov word [rdx + rbx*2 - 4], cx
movzx ecx, byte [rbx + r8 - 2]
xor cx, word [rsp + rbx*2 + 0x2e]
mov word [rdx + rbx*2 - 2], cx
cmp rbx, 0x10
jl 0x140059d11
mov byte [0x1401d7a23], 1
mov rax, rdx
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400d37e0
add rsp, 0x60
pop rbx
ret
Function at 0x140059d80
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov rax, qword [0x1401cde90]
xor rax, rsp
mov qword [rsp + 0x40], rax
call fcn.140055320
test al, al
jne 0x140059de4
mov ecx, dword [0x1401d5d60]
mov eax, 0x51eb851f
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, 4
imul edx, edx, 0x64
sub ecx, edx
add ecx, 0x141
movsxd rcx, ecx
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.1400d2e28
mov rcx, rax
call fcn.1400d3f08
cmp byte [0x1401d7a2d], 0
je 0x140059e06
lea rax, [0x1401d1590]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400d37e0
add rsp, 0x58
ret
mov dword [rsp + 0x20], 0x8000c
mov dword [rsp + 0x24], 0x6000f
mov dword [rsp + 0x28], 0x4b000a
mov dword [rsp + 0x2c], 0xb000f
mov dword [rsp + 0x30], 0x100019
mov dword [rsp + 0x34], 0x160049
mov dword [rsp + 0x38], 0x19000a
mov dword [rsp + 0x3c], 0xd
xor r8d, r8d
lea rdx, [0x1401d1590]
lea r9, [0x1401d0d91]
nop word [rax + rax]
movzx eax, byte [r8 + r9 - 1]
movzx ecx, word [rsp + r8*2 + 0x22]
add r8, 5
xor ax, word [rsp + r8*2 + 0x16]
mov word [rdx + r8*2 - 0xa], ax
movzx eax, byte [r8 + r9 - 5]
xor cx, ax
movzx eax, byte [r8 + r9 - 4]
xor ax, word [rsp + r8*2 + 0x1a]
mov word [rdx + r8*2 - 8], cx
movzx ecx, byte [r8 + r9 - 3]
xor cx, word [rsp + r8*2 + 0x1c]
mov word [rdx + r8*2 - 6], ax
mov word [rdx + r8*2 - 4], cx
movzx ecx, byte [r8 + r9 - 2]
xor cx, word [rsp + r8*2 + 0x1e]
mov word [rdx + r8*2 - 2], cx
cmp r8, 0xf
jl 0x140059e60
mov byte [0x1401d7a2d], 1
mov rax, rdx
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400d37e0
add rsp, 0x58
ret
Function at 0x140059f60
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x1401cde90]
xor rax, rsp
mov qword [rbp - 8], rax
cmp byte [0x1401d7a10], 0
je 0x140059f99
lea rax, [0x1401d1558]
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400d37e0
add rsp, 0x40
pop rbp
ret
mov ecx, dword [0x1401d5d60]
xor r9d, r9d
lea eax, [rcx + 1]
lea r8d, [rcx + 2]
imul r8d, eax
mov eax, 0x2aaaaaab
imul r8d, ecx
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 3
sub r8d, eax
cmp r8d, 1
jne 0x14005a03f
mov eax, 0xdd67c8a7
mov r8d, r9d
imul ecx
add edx, ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, ecx
imul edx, edx, 0x94
sub eax, edx
cmp eax, 0x10
je 0x14005a038
nop word [rax + rax]
mov eax, ecx
inc r8d
or eax, 0xffffff0d
add ecx, eax
mov eax, ecx
imul eax, ecx
cmp r8d, eax
jg 0x14005a038
mov eax, 0xdd67c8a7
imul ecx
add edx, ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, ecx
imul edx, edx, 0x94
sub eax, edx
cmp eax, 0x10
jne 0x14005a000
mov dword [0x1401d5d60], r8d
mov dword [rbp - 0x40], 0x40006
mov dword [rbp - 0x3c], 0x150000
mov dword [rbp - 0x38], 0xa004f
mov dword [rbp - 0x34], 0x6000d
mov dword [rbp - 0x30], 0x16001b
mov dword [rbp - 0x2c], 0xa0049
mov dword [rbp - 0x28], 0x1001a
mov dword [rbp - 0x24], 0x8004b
mov dword [rbp - 0x20], 0x49000d
mov dword [rbp - 0x1c], 0x160008
mov dword [rbp - 0x18], 0x9001f
mov dword [rbp - 0x14], 0x110000
mov word [rbp - 0x10], r9w
lea rdx, [0x1401d1558]
lea r8, [0x1401d0d91]
nop word [rax + rax]
movzx eax, byte [r9 + r8 - 1]
movzx ecx, word [rbp + r9*2 - 0x3e]
add r9, 6
xor ax, word [rbp + r9*2 - 0x4c]
mov word [rdx + r9*2 - 0xc], ax
movzx eax, byte [r9 + r8 - 6]
xor cx, ax
movzx eax, byte [r9 + r8 - 5]
xor ax, word [rbp + r9*2 - 0x48]
mov word [rdx + r9*2 - 0xa], cx
movzx ecx, byte [r9 + r8 - 3]
xor cx, word [rbp + r9*2 - 0x44]
mov word [rdx + r9*2 - 8], ax
movzx eax, byte [r9 + r8 - 4]
xor ax, word [rbp + r9*2 - 0x46]
mov word [rdx + r9*2 - 4], cx
movzx ecx, byte [r9 + r8 - 2]
xor cx, word [rbp + r9*2 - 0x42]
mov word [rdx + r9*2 - 6], ax
mov word [rdx + r9*2 - 2], cx
cmp r9, 0x18
jl 0x14005a0b0
mov byte [0x1401d7a10], 1
mov rax, rdx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400d37e0
add rsp, 0x40
pop rbp
ret

Function at 0x14005a150
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov rax, qword [0x1401cde90]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp byte [0x1401d7a17], 0
lea rax, [0x1401d1978]
jne 0x14005a1ef
mov dword [rsp], 0x37
xor ecx, ecx
mov dword [rsp + 4], 0x5000f
mov dword [rsp + 8], 0x19003f
mov dword [rsp + 0xc], 0x9000e
mov dword [rsp + 0x10], 0x60011
mov dword [rsp + 0x14], 0x28001a
mov dword [rsp + 0x18], 0x18000a
mov dword [rsp + 0x1c], 0x150004
mov dword [rsp + 0x20], 0x530012
mov dword [rsp + 0x24], 0x45
lea r8, [0x1401d0d90]
nop dword [rax + rax]
movzx edx, byte [rcx + r8]
inc rcx
xor dx, word [rsp + rcx*2 - 2]
mov word [rax + rcx*2 - 2], dx
cmp rcx, 0x13
jl 0x14005a1d0
mov byte [0x1401d7a17], 1
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400d37e0
add rsp, 0x38
ret
Function at 0x14005a210
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x68
mov rax, qword [0x1401cde90]
xor rax, rsp
mov qword [rsp + 0x50], rax
cmp byte [0x1401d7a2a], 0
je 0x14005a245
lea rax, [0x1401d16b0]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400d37e0
add rsp, 0x68
ret
mov qword [rsp + 0x60], rbx
mov ebx, dword [0x1401d5d60]
xor ecx, ecx
lea r8d, [rbx + 1]
mov eax, 0x2aaaaaab
mov dword [rsp + 0x30], 0xa000b
mov dword [rsp + 0x34], 0x18
mov dword [rsp + 0x38], 0xe0042
mov dword [rsp + 0x3c], 0x180013
imul r8d, ebx
imul r8d
sar edx, 2
mov dword [rsp + 0x40], 0x7001b
mov dword [rsp + 0x44], 0x20047
mov eax, edx
mov dword [rsp + 0x48], 0x130006
mov word [rsp + 0x4c], cx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 3
sub r8d, eax
cmp r8d, 0xf
jne 0x14005a2d5
mov r9d, ecx
lea r10, [rsp]
mov r11d, ebx
inc r9d
dec r11d
lea r10, [r10 + 4]
movsxd rax, r9d
cmp rax, 0xc
jb 0x14005a2c2
mov rbx, qword [rsp + 0x60]
lea rax, [0x1401d16b0]
lea r9, [0x1401d0d91]
nop dword [rax + rax]
movzx edx, byte [rcx + r9 - 1]
movzx r8d, word [rsp + rcx*2 + 0x32]
add rcx, 2
xor dx, word [rsp + rcx*2 + 0x2c]
mov word [rax + rcx*2 - 4], dx
movzx edx, byte [rcx + r9 - 2]
xor r8w, dx
mov word [rax + rcx*2 - 2], r8w
cmp rcx, 0xe
jl 0x14005a2f0
mov byte [0x1401d7a2a], 1
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400d37e0
add rsp, 0x68
ret
Function at 0x14005a340
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x4f20]
mov eax, 0x5020
call fcn.1400d8890
sub rsp, rax
mov rax, qword [0x1401cde90]
xor rax, rsp
mov qword [rbp + 0x4f10], rax
mov ebx, dword [0x1401d5d60]
mov eax, 0x4ec4ec4f
mov ecx, ebx
imul ecx, ebx
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xd
sub ecx, edx
cmp ecx, 2
jne 0x14005a3b9
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
mov eax, 0xcccccccd
mul ebx
shr edx, 6
lea ecx, [rdx + rdx*4]
shl ecx, 4
sub ebx, ecx
inc ebx
mov dword [0x1401d5d60], ebx
call fcn.140055230
xor edi, edi
test al, al
jne 0x14005a436
lea rcx, [rsp + 0x52]
xor edx, edx
mov r8d, 0x4fb0
mov word [rsp + 0x50], di
call fcn.1400d8c20
mov r10d, edi
mov r9d, edi
mov rax, rdi
test r10, r10
je 0x14005a410
test rax, rax
je 0x14005a410
lea rcx, [r9 + rax]
lea r8, [rsp + 0x50]
lea r8, [r8 + rcx*2]
lea rcx, [r9 + rax]
movzx edx, word [rsp + rcx*2 - 0x7a]
inc dx
add dx, word [r8 - 2]
mov word [r8], dx
inc rax
cmp rax, 0x65
jl 0x14005a3e4
add r9, 0x65
inc r10
cmp r9, 0x27d9
jl 0x14005a3e1
movsx ebx, word [rbp + 0x4f00]
mov dword [0x1401d5d60], ebx
cmp byte [0x1401d7a37], dil
je 0x14005a44b
lea rax, [0x1401d1a58]
jmp 0x14005a592
mov ecx, ebx
mov eax, 0x2aaaaaab
imul ecx, ebx
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 3
sub ecx, eax
cmp ecx, 0x11
jne 0x14005a48c
mov ecx, 1
cmp ebx, ecx
jle 0x14005a484
mov eax, ebx
cdq
idiv ecx
inc ecx
add ecx, edx
cmp ecx, ebx
jl 0x14005a477
mov ebx, ecx
mov dword [0x1401d5d60], ecx
mov dword [rsp + 0x20], 2
mov dword [rsp + 0x24], 0x2c001a
mov dword [rsp + 0x28], 0xf0000
mov dword [rsp + 0x2c], 0x60014
mov dword [rsp + 0x30], 0x3d0011
mov dword [rsp + 0x34], 0xb0008
mov dword [rsp + 0x38], 0x19000b
mov dword [rsp + 0x3c], 0x29000e
mov dword [rsp + 0x40], 0xd003f
mov dword [rsp + 0x44], 0x1f0009
mov dword [rsp + 0x48], 0x460048
mov word [rsp + 0x4c], di
lea r9, [0x1401d1a58]
lea rdx, [0x1401d0d91]
nop word [rax + rax]
movzx eax, byte [rdi + rdx - 1]
movzx ecx, word [rsp + rdi*2 + 0x22]
add rdi, 2
xor ax, word [rsp + rdi*2 + 0x1c]
mov word [r9 + rdi*2 - 4], ax
movzx eax, byte [rdi + rdx - 2]
xor cx, ax
mov word [r9 + rdi*2 - 2], cx
cmp rdi, 0x16
jl 0x14005a500
lea r8d, [rbx + 2]
lea ecx, [rbx + 1]
mov eax, 0x2aaaaaab
mov byte [0x1401d7a37], 1
imul r8d, ecx
imul r8d, ebx
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 3
sub r8d, eax
cmp r8d, 0x10
jne 0x14005a58f
mov eax, 0xfd
mov r8d, 0x36
nop
test r8d, r8d
je 0x14005a585
cdq
mov ecx, r8d
idiv r8d
mov eax, ecx
mov r8d, edx
test ecx, ecx
jne 0x14005a570
lea ecx, [r8 + rax]
mov dword [0x1401d5d60], ecx
mov rax, r9
mov rcx, qword [rbp + 0x4f10]
xor rcx, rsp
call fcn.1400d37e0
lea r11, [rsp + 0x5020]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x14005a5c0
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1401cde90]
xor rax, rsp
mov qword [rbp - 8], rax
call fcn.140055580
cmp byte [0x1401d7a1f], 0
lea rax, [0x1401d15f8]
jne 0x14005a6ce
mov dword [rbp - 0x40], 0x13000b
mov dword [rbp - 0x3c], 0x3e001e
mov dword [rbp - 0x38], 0x5001a
mov dword [rbp - 0x34], 0x120004
mov dword [rbp - 0x30], 0x100004
mov dword [rbp - 0x2c], 0x11000a
mov dword [rbp - 0x28], 0x11000a
mov dword [rbp - 0x24], 0xb0034
mov dword [rbp - 0x20], 0xa0004
mov dword [rbp - 0x1c], 0x1f0004
mov dword [rbp - 0x18], 0xe002d
mov dword [rbp - 0x14], 0x40013
mov dword [rbp - 0x10], 0x1e
xor r8d, r8d
lea r9, [0x1401d0d91]
nop word [rax + rax]
movzx ecx, byte [r8 + r9 - 1]
movzx edx, word [rbp + r8*2 - 0x3e]
add r8, 5
xor cx, word [rbp + r8*2 - 0x4a]
mov word [rax + r8*2 - 0xa], cx
movzx ecx, byte [r8 + r9 - 5]
xor dx, cx
movzx ecx, byte [r8 + r9 - 4]
xor cx, word [rbp + r8*2 - 0x46]
mov word [rax + r8*2 - 8], dx
mov word [rax + r8*2 - 6], cx
movzx ecx, byte [r8 + r9 - 3]
xor cx, word [rbp + r8*2 - 0x44]
mov word [rax + r8*2 - 4], cx
movzx ecx, byte [r8 + r9 - 2]
xor cx, word [rbp + r8*2 - 0x42]
mov word [rax + r8*2 - 2], cx
cmp r8, 0x19
jl 0x14005a660
mov byte [0x1401d7a1f], 1
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400d37e0
add rsp, 0x60
pop rbp
ret

Function at 0x14005a6e0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x108
mov rax, qword [0x1401cde90]
xor rax, rsp
mov qword [rsp + 0xf8], rax
mov r8d, dword [0x1401d5d60]
lea eax, [r8 + 1]
lea ecx, [r8 + 2]
imul ecx, eax
mov eax, 0x92492493
imul ecx, r8d
imul ecx
add edx, ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 7
sub ecx, edx
cmp ecx, 2
jne 0x14005a73e
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
mov r8d, dword [0x1401d5d60]
mov eax, r8d
imul eax, r8d
and eax, 0x80000007
jge 0x14005a753
dec eax
or eax, 0xfffffff8
inc eax
xor ecx, ecx
cmp eax, 2
jne 0x14005a77f
mov r9d, ecx
test r8d, r8d
je 0x14005a778
mov edx, r8d
mov eax, r8d
and edx, 1
add r9d, edx
cdq
sub eax, edx
sar eax, 1
mov r8d, eax
jne 0x14005a762
mov dword [0x1401d5d60], r9d
cmp byte [0x1401d7a27], cl
lea rax, [0x1401d18c8]
jne 0x14005a832
mov dword [rsp + 0xd0], 0x240033
mov dword [rsp + 0xd4], 0xd0002
mov dword [rsp + 0xd8], 0x80000
mov dword [rsp + 0xdc], 0x120024
mov dword [rsp + 0xe0], 0x3b0046
mov dword [rsp + 0xe4], 0x48001d
mov dword [rsp + 0xe8], 0x3c
mov dword [rsp + 0xec], 0x40008
mov dword [rsp + 0xf0], 0x1a000e
mov dword [rsp + 0xf4], 0x16
lea r8, [0x1401d0d90]
nop word [rax + rax]
movzx edx, byte [rcx + r8]
inc rcx
xor dx, word [rsp + rcx*2 + 0xce]
mov word [rax + rcx*2 - 2], dx
cmp rcx, 0x13
jl 0x14005a810
mov byte [0x1401d7a27], 1
mov rcx, qword [rsp + 0xf8]
xor rcx, rsp
call fcn.1400d37e0
add rsp, 0x108
ret
Function at 0x14005a850
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x1401cde90]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov r9d, dword [0x1401d5d60]
mov eax, 0x2aaaaaab
mov ebx, 4
mov ecx, r9d
imul ecx, r9d
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 3
sub ecx, eax
cmp ecx, 0x11
jne 0x14005a8dc
mov eax, 0x51eb851f
imul r9d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, ebx
imul edx, edx, 0x64
sub r9d, edx
add r9d, 0x63
movsxd rcx, r9d
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.1400d2e28
mov rcx, rax
call fcn.1400d3f08
mov r9d, dword [0x1401d5d60]
cmp byte [0x1401d7a19], 0
je 0x14005a8ff
lea rax, [0x1401d1a88]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400d37e0
add rsp, 0x60
pop rbx
ret
xor edx, edx
mov dword [rsp + 0x20], 0x40015
mov dword [rsp + 0x24], 0x4001c
mov dword [rsp + 0x28], 0x1f0001
mov dword [rsp + 0x2c], 0x1a0041
mov dword [rsp + 0x30], 0x1a0006
mov word [rsp + 0x40], dx
mov dword [rsp + 0x34], 0x45000a
mov dword [rsp + 0x38], 0x140001
mov dword [rsp + 0x3c], 0x20006
lea r8, [0x1401d1a88]
lea r10, [0x1401d0d91]
nop word [rax + rax]
movzx eax, byte [rdx + r10 - 1]
movzx ecx, word [rsp + rdx*2 + 0x22]
xor ax, word [rsp + rdx*2 + 0x20]
mov word [r8 + rdx*2], ax
movzx eax, byte [rdx + r10]
xor cx, ax
movzx eax, byte [rdx + r10 + 1]
xor ax, word [rsp + rdx*2 + 0x24]
mov word [r8 + rdx*2 + 2], cx
mov word [r8 + rdx*2 + 4], ax
movzx eax, byte [rdx + r10 + 2]
xor ax, word [rsp + rdx*2 + 0x26]
mov word [r8 + rdx*2 + 6], ax
add rdx, rbx
cmp rdx, 0x10
jl 0x14005a960
lea ecx, [r9 + 1]
mov eax, 0x2e8ba2e9
mov byte [0x1401d7a19], 1
imul ecx, r9d
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x16
sub ecx, edx
cmp ecx, 7
jne 0x14005aa33
movsd xmm3, qword [0x140162fc8]
movsd xmm5, qword [0x140162ff0]
movd xmm4, r9d
xorps xmm2, xmm2
movaps xmmword [rsp + 0x50], xmm6
movsd xmm6, qword [0x140162fc0]
cvtdq2pd xmm4, xmm4
addsd xmm2, xmm3
movaps xmm0, xmm2
mulsd xmm0, xmm2
comisd xmm0, xmm4
jbe 0x14005aa1a
subsd xmm2, xmm3
divsd xmm3, xmm5
movaps xmm1, xmm2
movaps xmm0, xmm4
mulsd xmm1, xmm2
subsd xmm0, xmm1
comisd xmm0, xmm6
ja 0x14005aa01
movaps xmm6, xmmword [rsp + 0x50]
mov rax, r8
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400d37e0
add rsp, 0x60
pop rbx
ret
Function at 0x14005ab10
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov rax, qword [0x1401cde90]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp byte [0x1401d7a08], 0
lea rax, [0x1401d1870]
jne 0x14005abec
xor r8d, r8d
mov dword [rsp], 0x15002a
mov dword [rsp + 4], 0xf000b
mov dword [rsp + 8], 0x19003f
mov dword [rsp + 0xc], 0x9000e
mov dword [rsp + 0x10], 0x60011
mov word [rsp + 0x20], r8w
mov dword [rsp + 0x14], 0x45001a
mov dword [rsp + 0x18], 0x10001c
mov dword [rsp + 0x1c], 0x10007
lea r9, [0x1401d0d91]
nop word [rax + rax]
movzx ecx, byte [r8 + r9 - 1]
movzx edx, word [rsp + r8*2 + 2]
add r8, 4
xor cx, word [rsp + r8*2 - 8]
mov word [rax + r8*2 - 8], cx
movzx ecx, byte [r8 + r9 - 4]
xor dx, cx
movzx ecx, byte [r8 + r9 - 3]
xor cx, word [rsp + r8*2 - 4]
mov word [rax + r8*2 - 6], dx
mov word [rax + r8*2 - 4], cx
movzx ecx, byte [r8 + r9 - 2]
xor cx, word [rsp + r8*2 - 2]
mov word [rax + r8*2 - 2], cx
cmp r8, 0x10
jl 0x14005ab90
mov byte [0x1401d7a08], 1
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400d37e0
add rsp, 0x38
ret
Function at 0x14005f2a0
Capabilities:
Acquire debug privileges

Disassembly:
push rdi
sub rsp, 0x90
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rsp + 0xa0], rbx
mov rax, qword [0x1401cde90]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov edi, edx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rbx, rax
call fcn.14002ce50
mov rcx, rax
lea r9, [rsp + 0x30]
mov r8d, 0x20028
mov rdx, rbx
call fcn.140043ea0
test eax, eax
jne 0x14005f332
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rsp + 0x68]
call fcn.140055170
mov rbx, rax
call fcn.140057570
mov rdx, rax
mov r8, rbx
lea rcx, [rsp + 0x38]
call fcn.14005aed0
lea rdx, [0x140198300]
lea rcx, [rsp + 0x38]
call fcn.1400db6b8
nop
call fcn.140055600
lea r8, [rsp + 0x48]
lea rdx, str.SeDebugPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
jne 0x14005f396
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rsp + 0x68]
call fcn.140055170
mov r10, rax
call fcn.140057ac0
mov rdx, rax
mov r8, r10
lea rcx, [rsp + 0x38]
call fcn.14005aed0
lea rdx, [0x140198300]
lea rcx, [rsp + 0x38]
call fcn.1400db6b8
nop
mov dword [rsp + 0x58], 1
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x5c], rax
neg edi
sbb eax, eax
and eax, 2
mov dword [rsp + 0x64], eax
call fcn.140055230
test al, al
jne 0x14005f3ce
mov ecx, 4
call fcn.1400d3fa0
mov ecx, dword [0x1401d5d60]
mov dword [rax], ecx
xor eax, eax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [rsp + 0x58]
xor edx, edx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov rcx, qword [rsp + 0x30]
test eax, eax
jne 0x14005f43a
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rsp + 0x68]
call fcn.140055170
mov rbx, rax
call fcn.1400563e0
mov rdx, rax
mov r8, rbx
lea rcx, [rsp + 0x38]
call fcn.14005aed0
lea rdx, [0x140198300]
lea rcx, [rsp + 0x38]
call fcn.1400db6b8
nop
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.1400d37e0
mov rbx, qword [rsp + 0xa0]
add rsp, 0x90
pop rdi
ret
Function at 0x140062740
Capabilities:
Get disk size

Disassembly:
sub rsp, 0x38
mov rcx, qword [rcx]
test rcx, rcx
je 0x140062797
cmp rcx, 0xffffffffffffffff
je 0x140062758
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x1401d5d60]
mov eax, 0xb21642c9
imul ecx, ecx
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x17
sub ecx, edx
cmp ecx, 0xb
jne 0x140062797
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
add rsp, 0x38
ret

Function at 0x1400631a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x30
mov r15, r9
mov r12, r8
mov r14, rcx
call fcn.14000a8d0
xor edi, edi
mov edx, 0x81
lea r8d, [rdi + 5]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rsi, rax
test rax, rax
je 0x1400632c2
mov edx, 0x81
mov rcx, r14
mov qword [rsp + 0x50], rbx
lea r8d, [rdx + 0x6f]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x140063213
mov rdx, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdx, rsi
mov rcx, r14
mov qword [rsp + 0x58], rbp
mov ebx, edi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x14006328c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbp, rax
test rax, rax
je 0x14006328c
mov rcx, rax
call fcn.140054d90
mov r9, r15
mov r8, r12
mov rcx, r14
mov rdx, rax
mov qword [rsp + 0x20], rdi
mov rsi, rax
call qword [sym.imp.USER32.dll_CreateDialogIndirectParamW]
mov rdi, rax
test rax, rax
jne 0x14006326e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp rsi, rbp
je 0x140063294
test rsi, rsi
je 0x140063294
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalHandle]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x140063294
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rbp, qword [rsp + 0x58]
test ebx, ebx
je 0x1400632a5
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rbx, qword [rsp + 0x50]
mov rax, rdi
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r12
ret
mov rax, rdi
jmp 0x1400632ad