joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140025860
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rdx, qword [0x1400f90d8]
xor r15d, r15d
mov ebp, ecx
mov rbx, rdx
mov r14d, r15d
mov rsi, qword [rdx + 0x3fe0]
test cl, 0x10
jne 0x140025a0b
mov edi, dword [rdx + 0x40b0]
test edi, edi
je 0x1400258e0
cmp dword [rdx + 0x4034], edi
jne 0x140025a04
mov eax, dword [rdx + 0x407c]
cmp eax, 0xffffffff
cmove eax, r15d
movsxd r15, eax
cmp byte [r15 + rdx + 0xda4], r14b
je 0x140025a04
cmp byte [rsi + 0xd0], r14b
jne 0x140025a04
jmp 0x140025982
cmp byte [rdx + 0xda4], r14b
je 0x140025a04
cmp byte [rsi + 0xd0], r14b
jne 0x140025a04
test byte [rdx + 0x40b8], 1
jne 0x14002591d
cmp dword [rdx + 0x4034], r14d
je 0x140025a04
cmp qword [rdx + 0x4070], rsi
jne 0x140025a04
test bpl, 8
je 0x140025a04
add rdx, 0x40bc
mov rcx, rsi
call fcn.140010ca0
mov edx, eax
mov dword [rbx + 0x40b0], eax
lea rcx, [rbx + 0x40bc]
mov edi, eax
call fcn.140011130
movzx r14d, al
test al, al
je 0x14002596f
cmp byte [rbx + 0x36c0], r15b
je 0x14002596f
mov rdx, rsi
mov ecx, edi
call fcn.140010e60
mov rcx, rsi
call fcn.14001d0a0
cmp dword [rbx + 0x4034], edi
jne 0x140025a04
mov rdx, qword [0x1400f90d8]
mov byte [rbx + 0x4041], r14b
mov rax, qword [rsi + 0x110]
movsxd rcx, dword [rsi + 0x108]
mov r14d, dword [rax + rcx*4 - 4]
movsxd rax, r15d
cmp byte [rax + rdx + 0xda4], 0
jne 0x1400259ad
xor cl, cl
jmp 0x1400259c5
movss xmm1, dword [rdx + 0x38]
movss xmm0, dword [rdx + rax*4 + 0x3740]
mulss xmm1, xmm1
comiss xmm0, xmm1
setae cl
movdqa xmm0, xmmword [0x1400e65a0]
mov qword [rdx + 0x4048], 0xffffffffffffffff
movups xmmword [rdx + 0x4050], xmm0
movd dword [rdx + 0x4060], xmm0
cmp byte [rdx + 0x42ad], 0
mov word [rdx + 0x42c4], 0
setne al
mov byte [rdx + 0x42ac], al
test cl, cl
jne 0x140025a58
xor al, al
jmp 0x140025af6
mov r9d, 0xffffffff
lea rdx, [0x1400d2fd9]
mov edi, r9d
lea r10, [0x1400cdf40]
mov r8b, 0x23
cmp r8b, 0x23
jne 0x140025a38
cmp byte [rdx], r8b
jne 0x140025a38
cmp byte [rdx + 1], r8b
cmove edi, r9d
movzx ecx, dil
movzx eax, r8b
movzx r8d, byte [rdx]
xor rcx, rax
shr edi, 8
inc rdx
xor edi, dword [r10 + rcx*4]
test r8b, r8b
jne 0x140025a25
not edi
cmp byte [rbx + 0x43fc], 0
jne 0x140025a96
call fcn.1400257a0
mov dword [rbx + 0x441c], edi
mov dword [rbx + 0x4420], r14d
mov byte [rbx + 0x43fc], 1
mov dword [rbx + 0x4400], ebp
mov dword [rbx + 0x4408], r15d
cmp edi, dword [rbx + 0x4034]
jne 0x140025a96
mov byte [rbx + 0x4042], 1
mov eax, dword [rbx + 0x3f60]
mov dword [rbx + 0x4404], eax
mov byte [rbx + 0x43fd], 1
test bpl, 1
jne 0x140025ae7
xor ecx, ecx
call fcn.140020190
cmp dword [rbx + 0x4470], 0
je 0x140025ae7
test dword [rbx + 0x4464], 0x1000
je 0x140025ae7
mov rax, qword [rbx + 0x3fe0]
mov byte [rax + 0xd0], 1
mov byte [rax + 0xd2], 1
mov byte [rax + 0xec], 1
test bpl, 0x12
jne 0x140025af4
and dword [rbx + 0x40b8], 0xfffffffe
mov al, 1
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x140080d40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov r9, qword [rcx + 0x190]
mov r10, rcx
movsxd rax, edx
imul rbx, rax, 0x68
add rbx, qword [rcx + 0x18]
mov dword [rcx + 0x7c], edx
test dword [rbx], 0x10000
movss xmm0, dword [rbx + 0x34]
je 0x140080d7c
addss xmm0, dword [rcx + 0x94]
lea rsi, [r9 + 0x118]
movss dword [rsi], xmm0
movss xmm1, dword [rcx + 0xc8]
addss xmm1, dword [rcx + 0x84]
movss dword [r9 + 0x130], xmm0
subss xmm0, dword [r9 + 0x48]
movss dword [r9 + 0x11c], xmm1
subss xmm0, dword [r9 + 0x158]
movss dword [r9 + 0x15c], xmm0
mov eax, dword [rcx + 0x90]
mov dword [r9 + 0x150], eax
movsx eax, byte [rbx + 0x62]
mov dword [r9 + 0x16c], eax
movss dword [r9 + 0x234], xmm1
mov eax, dword [rbx + 0x34]
mov dword [r9 + 0x230], eax
mov eax, dword [rbx + 0x38]
mov dword [r9 + 0x238], eax
mov eax, dword [rbx + 0x3c]
mov dword [r9 + 0x1d4], eax
cmp byte [rbx + 0x5a], 0
jne 0x140080e17
maxss xmm1, dword [rcx + 0x88]
movss dword [r9 + 0x11c], xmm1
movzx eax, byte [rbx + 0x60]
mov byte [r9 + 0xd0], al
cmp byte [rbx + 0x60], 0
je 0x140080e3d
mov rax, qword [0x1400f90d8]
xor ecx, ecx
mov dword [rax + 0x40b0], ecx
mov dword [rax + 0x40b8], ecx
test dword [r10 + 4], 0x100000
je 0x140080e52
mov r8d, 2
jmp 0x140080ed2
movups xmm0, xmmword [rbx + 0x20]
mov rax, qword [r9 + 0x2b8]
movss xmm4, dword [rbx + 0x20]
movss xmm3, dword [rbx + 0x24]
movss xmm2, dword [rbx + 0x28]
movss xmm1, dword [rbx + 0x2c]
movups xmmword [r9 + 0x250], xmm0
movss dword [rsp + 0x20], xmm4
movss dword [rsp + 0x24], xmm3
movss dword [rsp + 0x28], xmm2
movss dword [rsp + 0x2c], xmm1
movss dword [rax + 0x88], xmm4
movss dword [rax + 0x8c], xmm3
movss dword [rax + 0x90], xmm2
movss dword [rax + 0x94], xmm1
mov rax, qword [r9 + 0x2b8]
movups xmm0, xmmword [rsp + 0x20]
movsxd rdx, dword [rax + 0x58]
mov rcx, qword [rax + 0x60]
add rdx, rdx
movups xmmword [rcx + rdx*8 - 0x10], xmm0
movzx r8d, byte [rbx + 0x57]
mov rdx, qword [r9 + 0x2b8]
mov rcx, qword [r10 + 0x1a8]
call fcn.140072c70
mov rdi, qword [0x1400f90d8]
cmp byte [rdi + 0x55c4], 0
je 0x140080f17
cmp byte [rbx + 0x60], 0
jne 0x140080f17
xor r8d, r8d
lea rdx, [0x1400e4d20]
mov rcx, rsi
call fcn.140026030
mov dword [rdi + 0x55f8], 0x7f7fffff
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x140083380
Capabilities:
Hash data with crc32

Disassembly:
mov rax, qword [0x1400f90d8]
mov rdx, qword [rax + 0x44b8]
cmp ecx, 0xffffffff
jne 0x14008339a
cmp dword [rdx + 0x7c], ecx
cmovne ecx, dword [rdx + 0x7c]
cmp ecx, dword [rdx + 0x74]
mov eax, 0xffffffff
cmove ecx, eax
test byte [rdx + 4], 7
je 0x140083419
mov r10d, dword [rdx]
lea r8, [0x1400e4d11]
movzx eax, word [rdx + 0x80]
lea r11, [0x1400cdf40]
not r10d
mov byte [rdx + 0x1f0], cl
mov ecx, r10d
mov byte [rdx + 0x1fe], 1
mov word [rdx + 0x82], ax
mov r9b, 0x23
cmp r9b, 0x23
jne 0x1400833f3
cmp byte [r8], r9b
jne 0x1400833f3
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x1400833e0
not ecx
xor edx, edx
jmp fcn.1400203e0
ret
Function at 0x1400ab6c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x90
mov rax, qword [0x1400f4028]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov r8, rcx
mov ebx, edx
movzx ecx, byte [rcx]
test cl, cl
je 0x1400ab706
lea rax, [r8 + 1]
cmp cl, 0x25
jne 0x1400ab6f6
cmp byte [rax], cl
jne 0x1400ab706
cmp cl, cl
cmovne rax, r8
movzx ecx, byte [rax + 1]
lea r8, [rax + 1]
test cl, cl
jne 0x1400ab6e7
movzx edx, byte [r8]
cmp dl, 0x25
jne 0x1400ab86a
cmp byte [r8 + 1], dl
je 0x1400ab86a
lea r11, [rsp + 0x20]
mov r9, r8
lea eax, [rdx - 0x41]
movsx r10d, dl
cmp al, 0x19
ja 0x1400ab742
lea ecx, [r10 - 0x41]
mov eax, 1
shl eax, cl
test eax, 0x900
je 0x1400ab76a
sub dl, 0x61
cmp dl, 0x19
ja 0x1400ab75c
lea ecx, [r10 - 0x61]
mov eax, 1
shl eax, cl
test eax, 0x2480a80
je 0x1400ab76a
movzx edx, byte [r9 + 1]
inc r9
test dl, dl
jne 0x1400ab725
jmp 0x1400ab76d
inc r9
cmp r8, r9
jae 0x1400ab79f
movabs rdx, 0x800000000000009
nop dword [rax]
movzx ecx, byte [r8]
inc r8
lea eax, [rcx - 0x24]
cmp al, 0x3b
ja 0x1400ab794
bt rdx, rax
jb 0x1400ab79a
mov byte [r11], cl
inc r11
cmp r8, r9
jb 0x1400ab780
xorps xmm3, xmm3
mov byte [r11], 0
cvtss2sd xmm3, xmm2
lea r8, [rsp + 0x20]
mov edx, 0x40
lea rcx, [rsp + 0x40]
movq r9, xmm3
call fcn.14000bcd0
cmp byte [rsp + 0x40], 0x20
lea rcx, [rsp + 0x40]
jne 0x1400ab7d8
nop
inc rcx
cmp byte [rcx], 0x20
je 0x1400ab7d0
lea eax, [rbx - 8]
cmp eax, 1
jbe 0x1400ab858
movzx r9d, byte [rcx]
movzx r8d, r9b
cmp r9b, 0x2d
jne 0x1400ab7f3
movzx r8d, byte [rcx + 1]
lea rdx, [rcx + 1]
movzx eax, r8b
cmovne rdx, rcx
cmp r8b, 0x2b
jne 0x1400ab809
movzx eax, byte [rdx + 1]
lea rcx, [rdx + 1]
xorps xmm1, xmm1
cmovne rcx, rdx
cmp al, 0x30
jl 0x1400ab846
movss xmm2, dword [0x1400e5a14]
cmp al, 0x39
ja 0x1400ab846
movzx eax, al
inc rcx
sub eax, 0x30
mulss xmm1, xmm2
movd xmm0, eax
movzx eax, byte [rcx]
cvtdq2ps xmm0, xmm0
addss xmm0, xmm1
movaps xmm1, xmm0
cmp al, 0x30
jge 0x1400ab820
cmp r9b, 0x2d
jne 0x1400ab865
xorps xmm1, xmmword [0x1400e6560]
movaps xmm0, xmm1
jmp 0x1400ab86d
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atof]
xorps xmm1, xmm1
cvtsd2ss xmm1, xmm0
movaps xmm0, xmm1
jmp 0x1400ab86d
movaps xmm0, xmm2
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1400ac100
add rsp, 0x90
pop rbx
ret
Function at 0x1400abeb0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x90
mov rax, qword [0x1400f4028]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov r8, rcx
mov ebx, edx
movzx ecx, byte [rcx]
test cl, cl
je 0x1400abef6
lea rax, [r8 + 1]
cmp cl, 0x25
jne 0x1400abee6
cmp byte [rax], cl
jne 0x1400abef6
cmp cl, cl
cmovne rax, r8
movzx ecx, byte [rax + 1]
lea r8, [rax + 1]
test cl, cl
jne 0x1400abed7
movzx edx, byte [r8]
cmp dl, 0x25
jne 0x1400ac054
cmp byte [r8 + 1], dl
je 0x1400ac054
lea r11, [rsp + 0x20]
mov r9, r8
lea eax, [rdx - 0x41]
movsx r10d, dl
cmp al, 0x19
ja 0x1400abf32
lea ecx, [r10 - 0x41]
mov eax, 1
shl eax, cl
test eax, 0x900
je 0x1400abf5a
sub dl, 0x61
cmp dl, 0x19
ja 0x1400abf4c
lea ecx, [r10 - 0x61]
mov eax, 1
shl eax, cl
test eax, 0x2480a80
je 0x1400abf5a
movzx edx, byte [r9 + 1]
inc r9
test dl, dl
jne 0x1400abf15
jmp 0x1400abf5d
inc r9
cmp r8, r9
jae 0x1400abf8f
movabs rdx, 0x800000000000009
nop dword [rax]
movzx ecx, byte [r8]
inc r8
lea eax, [rcx - 0x24]
cmp al, 0x3b
ja 0x1400abf84
bt rdx, rax
jb 0x1400abf8a
mov byte [r11], cl
inc r11
cmp r8, r9
jb 0x1400abf70
movaps xmm3, xmm2
mov byte [r11], 0
movq r9, xmm2
lea r8, [rsp + 0x20]
mov edx, 0x40
lea rcx, [rsp + 0x40]
call fcn.14000bcd0
cmp byte [rsp + 0x40], 0x20
lea rcx, [rsp + 0x40]
jne 0x1400abfc8
nop dword [rax + rax]
inc rcx
cmp byte [rcx], 0x20
je 0x1400abfc0
lea eax, [rbx - 8]
cmp eax, 1
jbe 0x1400ac046
movzx r9d, byte [rcx]
movzx r8d, r9b
cmp r9b, 0x2d
jne 0x1400abfe3
movzx r8d, byte [rcx + 1]
lea rdx, [rcx + 1]
movzx eax, r8b
cmovne rdx, rcx
cmp r8b, 0x2b
jne 0x1400abff9
movzx eax, byte [rdx + 1]
lea rcx, [rdx + 1]
xorps xmm1, xmm1
cmovne rcx, rdx
cmp al, 0x30
jl 0x1400ac034
movsd xmm2, qword [0x1400e59b8]
cmp al, 0x39
ja 0x1400ac034
movzx eax, al
inc rcx
sub eax, 0x30
mulsd xmm1, xmm2
movd xmm0, eax
movzx eax, byte [rcx]
cvtdq2pd xmm0, xmm0
addsd xmm1, xmm0
cmp al, 0x30
jge 0x1400ac010
cmp r9b, 0x2d
jne 0x1400ac04f
xorps xmm1, xmmword [0x1400e6550]
movaps xmm0, xmm1
jmp 0x1400ac057
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atof]
movaps xmm1, xmm0
movaps xmm0, xmm1
jmp 0x1400ac057
movaps xmm0, xmm2
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1400ac100
add rsp, 0x90
pop rbx
ret

Function at 0x1400acfc0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400ad00a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400ad00a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400ad00a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400ad00a
cmp dword [rcx + 0x84], 0xe
jbe 0x1400ad00a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400ad00c
xor al, al
add rsp, 0x28
ret
Function at 0x140001070
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x68
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [rsp + 0x40], 2
jae 0x1400010a1
lea rcx, str.Cest_pas_une_vm
call fcn.140001010
mov eax, 1
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400010d0
add rsp, 0x68
ret

Function at 0x140001990
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400019da
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400019da
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400019da
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400019da
cmp dword [rcx + 0x84], 0xe
jbe 0x1400019da
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400019dc
xor al, al
add rsp, 0x28
ret
Function at 0x14114dffc
Capabilities:
Encode data using xor

Disassembly:
jmp 0x14114e006
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x14114e02f
pop rbp
sub rbp, 0x33
sub rbp, 0x114dffc
sub rsp, 0x20
jmp 0x14114e04e
mov rax, 0x114dffc
add rax, rbp
add rax, 0x84
mov rcx, 0x60b
mov rdx, 0xffffffff86be325d
xor byte [rax], dl
inc rax
dec rcx
jne 0x14114e06d
jmp 0x14114e084
adc eax, 0xd4d6b4d4
invalid
Function at 0x140001010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x1400ef110]
xor ecx, ecx
mov dword [rax], 1
mov rax, qword [0x1400ef120]
mov dword [rax], 1
mov rax, qword [0x1400ef130]
mov dword [rax], 1
mov rax, qword [0x1400ef100]
mov dword [rax], 1
mov rax, qword [0x1400eef70]
cmp word [rax], 0x5a4d
jne 0x140001067
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400010d0
mov rax, qword [0x1400ef0f0]
mov dword [0x140119020], ecx
mov eax, dword [rax]
test eax, eax
je 0x1400010c0
mov ecx, 2
call sym.__set_app_type
call dbg.__p__fmode
mov rdx, qword [0x1400ef0a0]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg.__p__commode
mov rdx, qword [0x1400ef080]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg._setargv
mov rax, qword [0x1400ee3a0]
cmp dword [rax], 1
je 0x140001108
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x140001084
movzx edx, word [rax + 0x18]
cmp dx, 0x10b
je 0x140001120
cmp dx, 0x20b
jne 0x140001067
cmp dword [rax + 0x84], 0xe
jbe 0x140001067
mov edx, dword [rax + 0xf8]
xor ecx, ecx
test edx, edx
setne cl
jmp 0x140001067
mov rcx, qword [dbg._matherr]
call dbg.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x140001067
mov r8d, dword [rax + 0xe8]
xor ecx, ecx
test r8d, r8d
setne cl
jmp 0x140001067

Function at 0x140001540
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push rsi
push rbx
xor eax, eax
mov r8b, byte [rdx + rax]
mov byte [rcx + rax], r8b
mov r8b, byte [rdx + rax + 1]
mov byte [rcx + rax + 1], r8b
mov r8b, byte [rdx + rax + 2]
mov byte [rcx + rax + 2], r8b
mov r8b, byte [rdx + rax + 3]
mov byte [rcx + rax + 3], r8b
add rax, 4
cmp rax, 0x10
jne 0x140001544
mov r10d, 4
lea r11, [0x1400eb180]
lea rbx, [0x1400eb068]
movzx r9d, byte [rcx + 0xc]
movzx r8d, byte [rcx + 0xd]
movzx edx, byte [rcx + 0xe]
movzx eax, byte [rcx + 0xf]
test r10b, 3
jne 0x1400015be
mov sil, byte [r11 + r8]
mov r8b, byte [r11 + rdx]
mov dl, byte [r11 + rax]
mov al, byte [r11 + r9]
mov r9d, r10d
shr r9d, 2
xor sil, byte [rbx + r9]
mov r9d, esi
xor r9b, byte [rcx]
xor r8b, byte [rcx + 1]
inc r10d
add rcx, 4
xor dl, byte [rcx - 2]
xor al, byte [rcx - 1]
mov byte [rcx + 0xc], r9b
mov byte [rcx + 0xd], r8b
mov byte [rcx + 0xe], dl
mov byte [rcx + 0xf], al
cmp r10d, 0x2c
jne 0x140001588
pop rbx
pop rsi
ret
Function at 0x14000162f
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov ebx, 1
lea rdi, [0x1400eb180]
mov r12, rcx
mov r8, rdx
mov r13, rdx
mov rdx, rcx
xor ecx, ecx
lea rbp, [r12 + 0x10]
call sym.AddRoundKey_unsigned_char__unsigned_char_____4__4___unsigned_char_const_
lea rax, [r12 + 4]
mov qword [rsp + 0x28], rax
mov rsi, r12
mov rcx, r12
mov rax, rcx
xor r8d, r8d
movzx r9d, byte [rax]
inc r8d
add rax, 4
mov r9b, byte [rdi + r9]
mov byte [rax - 4], r9b
cmp r8b, 4
jne 0x140001679
inc rcx
cmp qword [rsp + 0x28], rcx
jne 0x140001673
mov cl, byte [r12 + 5]
mov al, byte [r12 + 1]
mov byte [r12 + 1], cl
mov cl, byte [r12 + 9]
mov byte [r12 + 5], cl
mov cl, byte [r12 + 0xd]
mov byte [r12 + 0xd], al
mov al, byte [r12 + 2]
mov byte [r12 + 9], cl
mov cl, byte [r12 + 0xa]
mov byte [r12 + 0xa], al
mov al, byte [r12 + 6]
mov byte [r12 + 2], cl
mov cl, byte [r12 + 0xe]
mov byte [r12 + 0xe], al
mov al, byte [r12 + 3]
mov byte [r12 + 6], cl
mov cl, byte [r12 + 0xf]
mov byte [r12 + 3], cl
mov cl, byte [r12 + 0xb]
mov byte [r12 + 0xf], cl
mov cl, byte [r12 + 7]
mov byte [r12 + 7], al
mov byte [r12 + 0xb], cl
cmp ebx, 0xa
je 0x1400017ad
mov r10b, byte [rsi]
mov r8b, byte [rsi + 1]
add rsi, 4
mov r11b, byte [rsi - 2]
mov r9b, byte [rsi - 1]
mov ecx, r10d
xor ecx, r8d
mov r15d, r11d
mov r14d, ecx
movzx ecx, cl
xor r15d, r9d
call sym.xtime_unsigned_char_
xor r14d, r15d
mov ecx, r8d
xor eax, r10d
xor ecx, r11d
xor r10d, r9d
xor eax, r14d
movzx ecx, cl
mov byte [rsi - 4], al
call sym.xtime_unsigned_char_
movzx ecx, r15b
xor r8d, eax
xor r8d, r14d
mov byte [rsi - 3], r8b
call sym.xtime_unsigned_char_
movzx ecx, r10b
xor r11d, eax
xor r11d, r14d
mov byte [rsi - 2], r11b
call sym.xtime_unsigned_char_
xor r9d, eax
xor r9d, r14d
mov byte [rsi - 1], r9b
cmp rbp, rsi
jne 0x14000171d
mov ecx, ebx
mov r8, r13
mov rdx, r12
inc ebx
call sym.AddRoundKey_unsigned_char__unsigned_char_____4__4___unsigned_char_const_
jmp 0x14000166d
mov r8, r13
mov rdx, r12
mov ecx, 0xa
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp sym.AddRoundKey_unsigned_char__unsigned_char_____4__4___unsigned_char_const_
Function at 0x140001a53
Capabilities:
Encode data using xor

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
xor esi, esi
mov rbx, rcx
mov r12, rdx
lea rcx, [rcx + 0xb0]
mov rbp, r8
lea rdi, [r12 + rsi]
cmp rsi, rbp
jae 0x140001a9d
xor eax, eax
mov dl, byte [rcx + rax]
xor byte [rdi + rax], dl
inc rax
cmp rax, 0x10
jne 0x140001a7a
mov rcx, rdi
mov rdx, rbx
add rsi, 0x10
call sym.Cipher_unsigned_char_____4__4___unsigned_char_const_
mov rcx, rdi
jmp 0x140001a6f
mov rax, qword [rcx]
mov rdx, qword [rcx + 8]
mov qword [rbx + 0xb0], rax
mov qword [rbx + 0xb8], rdx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x140001abd
Capabilities:
Encode data using xor

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
xor ebx, ebx
mov rsi, rcx
mov rdi, rdx
mov rbp, r8
lea r12, [rdi + rbx]
cmp rbx, rbp
jae 0x140001b0d
mov rdx, rsi
mov rcx, r12
movups xmm0, xmmword [rdi + rbx]
call sym.InvCipher_unsigned_char_____4__4___unsigned_char_const_
xor eax, eax
mov dl, byte [rsi + rax + 0xb0]
xor byte [r12 + rax], dl
inc rax
cmp rax, 0x10
jne 0x140001aec
movups xmmword [rsi + 0xb0], xmm0
add rbx, 0x10
jmp 0x140001ad2
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x140001b9c
Capabilities:
Encode data using xor
Get memory capacity
Get system information on windows

Disassembly:
push rdi
push rsi
sub rsp, 0xe8
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [rsp + 0x90], 1
ja 0x140001bc1
mov al, 1
jmp 0x140001ca3
mov dword [rsp + 0xa0], 0x40
lea rcx, [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov eax, 0xffffffff
cmp qword [rsp + 0xa8], rax
jbe 0x140001bba
lea rax, [rsp + 0x48]
lea rdi, [rsp + 0x48]
mov ecx, 0x26
mov edx, 0x37
lea rsi, [0x1400eb040]
rep movsb byte [rdi], byte [rsi]
mov rsi, rax
xor word [rax], dx
inc edx
add rax, 2
cmp dx, 0x4a
jne 0x140001c09
xor r9d, r9d
xor edx, edx
mov r8d, 3
mov rcx, rsi
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x70000
mov rcx, rax
lea rax, [rsp + 0x44]
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x18
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov eax, dword [rsp + 0x54]
imul rax, qword [rsp + 0x48]
mov edx, dword [rsp + 0x58]
imul rax, rdx
mov edx, dword [rsp + 0x5c]
imul rax, rdx
movabs rdx, 0x18ffffffff
cmp rax, rdx
setle al
add rsp, 0xe8
pop rsi
pop rdi
ret
Function at 0x140001cad
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push r15
push r14
push r13
push r12
push rdi
push rsi
sub rsp, 0x118
call sym.QuitIfSandboxed__
test al, al
jne 0x140001dff
movabs rax, 0x6a7c787868666c65
mov word [rsp + 0x58], 0x407e
mov dl, 0x37
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x50]
mov r12, rax
xor byte [rax], dl
inc edx
inc rax
cmp dl, 0x41
jne 0x140001ceb
mov r8, r12
mov edx, 0x65
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov r14, rax
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rdx, r14
xor ecx, ecx
mov r13d, eax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r15, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rcx, r13
mov rsi, rax
call sym.malloc
mov rcx, r13
mov rdi, rax
mov r14, rax
rep movsb byte [rdi], byte [rsi]
mov rcx, r15
lea rsi, section..rdata
mov rdi, r12
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov ecx, 0x21
mov rdx, r12
mov al, 0x37
rep movsb byte [rdi], byte [rsi]
xor byte [rdx], al
inc eax
inc rdx
cmp al, 0x58
jne 0x140001d64
lea rax, [rsp + 0x40]
mov rcx, r12
lea r13, [rsp + 0x30]
mov qword [rsp + 0x30], rax
call sym.strlen
mov qword [rsp + 0x28], rax
lea rsi, [r12 + rax]
cmp rax, 0xf
jbe 0x140001db4
lea rdx, [rsp + 0x28]
xor r8d, r8d
mov rcx, r13
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___._M_create_unsigned_long_long__unsigned_long_long_
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x30]
mov r8, rsi
mov rdx, r12
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___._S_copy_chars_char__char_const__char_const_
mov rax, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x30]
mov rcx, r12
mov qword [rsp + 0x38], rax
mov byte [rdx + rax], 0
mov rdx, qword [rsp + 0x30]
call sym.KeyExpansion_unsigned_char__unsigned_char_const_
mov rdx, r12
mov rcx, r14
call sym.InvCipher_unsigned_char_____4__4___unsigned_char_const_
mov rcx, r14
call sym.free
mov rcx, r13
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___._M_dispose__
xor eax, eax
add rsp, 0x118
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x1400020f0
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x38
mov r12, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call dbg.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, [0x1400ed900]
mov r9, rax
call sym.fwrite
mov rbx, qword [rsp + 0x28]
mov ecx, 2
call dbg.__acrt_iob_func
mov rdx, r12
mov rcx, rax
mov r8, rbx
call sym.vfprintf
call sym.abort
nop
nop word [rax + rax]