joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400834b0
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x140148020]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140083514
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov rcx, rbx
test eax, eax
jne 0x14008352e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400a24f0
add rsp, 0x50
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400a24f0
add rsp, 0x50
pop rbx
ret

Function at 0x140083550
Capabilities:
Get common file path
Set current directory

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x480
mov rax, qword [0x140148020]
xor rax, rsp
mov qword [rsp + 0x470], rax
mov rbx, rdx
mov rdi, rcx
xor edx, edx
lea rcx, [rsp + 0x260]
mov r8d, 0x208
call fcn.1400a5270
lea rdx, [rsp + 0x260]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
xor r9d, r9d
xor edx, edx
mov rcx, rdi
lea r8d, [r9 + 2]
call fcn.140041d70
xor r14d, r14d
mov rbx, rax
mov dword [rsp + 0x30], r14d
mov ebp, r14d
mov word [rsp + 0x34], r14w
mov dword [rsp + 0x25c], r14d
test rax, rax
jne 0x1400835e7
mov eax, 0x10000
jmp 0x14008360a
cmp dword [rax], 1
je 0x1400835f3
mov eax, 0x80000
jmp 0x14008360a
mov rcx, qword [rax + 8]
lea r8, [rsp + 0x30]
mov edx, 0xffffffff
call fcn.140040ff0
mov ebp, dword [rsp + 0x30]
mov dword [0x14015166c], eax
mov esi, r14d
mov edi, r14d
test ebp, ebp
jle 0x1400836b4
nop
mov dword [rsp + 0x30], r14d
mov word [rsp + 0x34], r14w
mov dword [rsp + 0x25c], r14d
test rbx, rbx
jne 0x140083649
mov dword [0x14015166c], 0x10000
mov esi, 0x10000
jmp 0x1400836aa
mov eax, dword [rbx]
cmp eax, 1
je 0x140083657
mov ecx, 0x80000
jmp 0x14008366b
mov rcx, qword [rbx + 8]
lea r8, [rsp + 0x30]
mov edx, edi
call fcn.140040ff0
mov ecx, eax
mov eax, dword [rbx]
mov dword [0x14015166c], ecx
cmp eax, 1
je 0x140083687
mov dword [0x14015166c], 0x80000
mov esi, 0x80000
jmp 0x1400836aa
mov rcx, qword [rbx + 8]
lea r8, [rsp + 0x34]
xor r9d, r9d
mov dword [rsp + 0x20], 2
mov edx, edi
call fcn.140041890
mov esi, eax
mov dword [0x14015166c], eax
inc edi
cmp edi, ebp
jl 0x140083620
mov rcx, rbx
call fcn.140041fe0
lea rcx, [rsp + 0x260]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov eax, esi
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.1400a24f0
lea r11, [rsp + 0x480]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x140083700
Capabilities:
Get common file path
Set current directory

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x480
mov rax, qword [0x140148020]
xor rax, rsp
mov qword [rsp + 0x470], rax
mov rbx, r8
mov r14, rdx
mov rdi, rcx
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x260]
call fcn.1400a5270
lea rdx, [rsp + 0x260]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
xor r9d, r9d
xor edx, edx
mov rcx, rdi
lea r8d, [r9 + 2]
call fcn.140041d70
xor r15d, r15d
mov rbx, rax
mov dword [rsp + 0x30], r15d
mov ebp, r15d
mov word [rsp + 0x34], r15w
mov dword [rsp + 0x25c], r15d
test rax, rax
jne 0x140083798
mov eax, 0x10000
jmp 0x1400837bb
cmp dword [rax], 1
je 0x1400837a4
mov eax, 0x80000
jmp 0x1400837bb
mov rcx, qword [rax + 8]
lea r8, [rsp + 0x30]
mov edx, 0xffffffff
call fcn.140040ff0
mov ebp, dword [rsp + 0x30]
mov dword [0x14015166c], eax
mov esi, 0x500
mov edi, r15d
test ebp, ebp
jle 0x14008387a
mov dword [rsp + 0x30], r15d
mov word [rsp + 0x34], r15w
mov dword [rsp + 0x25c], r15d
test rbx, rbx
jne 0x1400837f0
mov eax, 0x10000
jmp 0x14008380c
cmp dword [rbx], 1
je 0x1400837fc
mov eax, 0x80000
jmp 0x14008380c
mov rcx, qword [rbx + 8]
lea r8, [rsp + 0x30]
mov edx, edi
call fcn.140040ff0
mov rdx, r14
mov dword [0x14015166c], eax
lea rcx, [rsp + 0x34]
call fcn.1400a9534
test eax, eax
je 0x14008382b
inc edi
cmp edi, ebp
jl 0x1400837d1
jmp 0x14008387a
test rbx, rbx
jne 0x140083841
mov dword [0x14015166c], 0x10000
mov esi, 0x10000
jmp 0x14008387a
cmp dword [rbx], 1
je 0x140083857
mov dword [0x14015166c], 0x80000
mov esi, 0x80000
jmp 0x14008387a
mov rcx, qword [rbx + 8]
lea r8, [rsp + 0x34]
xor r9d, r9d
mov dword [rsp + 0x20], 2
mov edx, edi
call fcn.140041890
mov esi, eax
mov dword [0x14015166c], eax
mov rcx, rbx
call fcn.140041fe0
lea rcx, [rsp + 0x260]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test esi, esi
sete al
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.1400a24f0
mov rbx, qword [rsp + 0x4c8]
add rsp, 0x480
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140083d30
Capabilities:
Get token membership

Disassembly:
sub rsp, 0x88
mov rax, qword [0x140148020]
xor rax, rsp
mov qword [rsp + 0x78], rax
xor ecx, ecx
mov word [rsp + 0x6c], 0x500
lea rax, [rsp + 0x60]
mov dword [rsp + 0x70], ecx
mov qword [rsp + 0x50], rax
xor r9d, r9d
mov dword [rsp + 0x48], ecx
mov dl, 1
mov dword [rsp + 0x40], ecx
lea r8d, [rcx + 0x12]
mov dword [rsp + 0x38], ecx
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], ecx
mov dword [rsp + 0x68], ecx
lea rcx, [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x140083dae
mov rdx, qword [rsp + 0x60]
lea r8, [rsp + 0x70]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [rsp + 0x70]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1400a24f0
add rsp, 0x88
ret
Function at 0x1400855d0
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x190]
sub rsp, 0x290
mov rax, qword [0x140148020]
xor rax, rsp
mov qword [rbp + 0x180], rax
mov rax, r8
mov rbx, rcx
mov qword [rsp + 0x68], rcx
xor esi, esi
mov dword [rsp + 0x40], esi
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov qword [rcx], rsi
mov qword [rcx + 8], rsi
mov qword [rcx + 0x10], rsi
mov dword [rsp + 0x40], 1
mov qword [rsp + 0x70], rsi
cmp qword [r8 + 0x18], 8
jb 0x140085631
mov rax, qword [r8]
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x20], rcx
mov r9d, 0x20019
xor r8d, r8d
mov rdx, rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14008577e
mov edi, esi
xor edx, edx
mov r8d, 0x200
lea rcx, [rbp - 0x80]
call fcn.1400a5270
mov dword [rsp + 0x78], 0x100
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x78]
lea r8, [rbp - 0x80]
xor edx, edx
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x140085773
nop dword [rax]
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], rsi
lea rax, [rbp - 0x80]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x1400856d0
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x48]
call fcn.140004fe0
nop
mov rdx, qword [rbx + 8]
cmp rdx, qword [rbx + 0x10]
je 0x14008571f
movups xmm0, xmmword [rsp + 0x48]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rsp + 0x58]
movups xmmword [rdx + 0x10], xmm1
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], 7
mov word [rsp + 0x48], si
add qword [rbx + 8], 0x20
jmp 0x14008572d
lea r8, [rsp + 0x48]
mov rcx, rbx
call fcn.140082dc0
nop
lea rcx, [rsp + 0x48]
call fcn.1400053f0
inc edi
mov dword [rsp + 0x78], 0x100
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x78]
lea r8, [rbp - 0x80]
mov edx, edi
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x1400856b0
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, rbx
mov rcx, qword [rbp + 0x180]
xor rcx, rsp
call fcn.1400a24f0
mov rbx, qword [rsp + 0x2b8]
add rsp, 0x290
pop rdi
pop rsi
pop rbp
ret
Function at 0x140085a00
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x140148020]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rdi, rcx
mov r8d, 0x104
lea rcx, str.APPDATA
mov rbx, rdx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
xor edx, edx
mov ecx, 0x80070057
test eax, eax
cmovne ecx, edx
je 0x140085a5e
lea r8, str.MicrosoftWindowsStart_MenuPrograms_
mov edx, 0x104
mov rcx, rbx
call fcn.1400a9718
neg eax
sbb ecx, ecx
and ecx, 0x80070057
test ecx, ecx
js 0x140085aac
lea r8, str..lnk
mov rdx, rdi
lea rcx, [rsp + 0x20]
call fcn.140084820
cmp qword [rsp + 0x38], 8
lea r8, [rsp + 0x20]
mov edx, 0x104
mov rcx, rbx
cmovae r8, qword [rsp + 0x20]
call fcn.1400a9718
neg eax
lea rcx, [rsp + 0x20]
sbb ebx, ebx
and ebx, 0x80070057
call fcn.1400053f0
mov eax, ebx
jmp 0x140085aae
mov eax, ecx
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400a24f0
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret

Function at 0x140086310
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
lea rcx, str.SHELL32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
je 0x14008640a
lea rdx, str.SetCurrentProcessExplicitAppUserModelID
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140151850], rax
test rax, rax
je 0x14008640a
lea rcx, str.PROPSYS.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
je 0x14008640a
lea rdx, str.PropVariantToString
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140151858], rax
test rax, rax
je 0x14008640a
lea rcx, str.COMBASE.DLL
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
test rax, rax
je 0x140086405
lea rdx, str.RoGetActivationFactory
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140151860], rax
test rax, rax
je 0x140086405
lea rdx, str.WindowsCreateStringReference
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140151868], rax
test rax, rax
je 0x140086405
lea rdx, str.WindowsGetStringRawBuffer
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140151870], rax
test rax, rax
je 0x140086405
lea rdx, str.WindowsDeleteString
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140151878], rax
mov rbx, qword [rsp + 0x20]
cmp qword [0x140151850], 0
je 0x140086443
cmp qword [0x140151858], 0
je 0x140086443
cmp qword [0x140151860], 0
je 0x140086443
cmp qword [0x140151868], 0
je 0x140086443
cmp qword [0x140151878], 0
je 0x140086443
mov al, 1
add rsp, 0x28
ret
xor al, al
add rsp, 0x28
ret
Function at 0x14008b6e0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
lea r11, [0x140110ab0]
mov r9, rdx
not ecx
test dl, 3
je 0x14008b715
test r8, r8
je 0x14008b715
movzx edx, byte [r9]
mov eax, ecx
xor rdx, rax
shr ecx, 8
movzx eax, dl
inc r9
dec r8
xor ecx, dword [r11 + rax*4]
test r9b, 3
jne 0x14008b6f1
mov r10, r8
and r10, 0xfffffffffffffff0
add r10, r9
cmp r9, r10
jae 0x14008b7ec
nop dword [rax + rax]
xor ecx, dword [r9]
movzx edx, cl
shr ecx, 8
xor ecx, dword [r11 + rdx*4]
movzx edx, cl
shr ecx, 8
xor ecx, dword [r11 + rdx*4]
movzx edx, cl
shr ecx, 8
xor ecx, dword [r11 + rdx*4]
movzx edx, cl
shr ecx, 8
xor ecx, dword [r11 + rdx*4]
xor ecx, dword [r9 + 4]
movzx edx, cl
shr ecx, 8
xor ecx, dword [r11 + rdx*4]
movzx edx, cl
shr ecx, 8
xor ecx, dword [r11 + rdx*4]
movzx edx, cl
shr ecx, 8
xor ecx, dword [r11 + rdx*4]
movzx edx, cl
shr ecx, 8
xor ecx, dword [r11 + rdx*4]
xor ecx, dword [r9 + 8]
movzx edx, cl
shr ecx, 8
xor ecx, dword [r11 + rdx*4]
movzx edx, cl
shr ecx, 8
xor ecx, dword [r11 + rdx*4]
movzx edx, cl
shr ecx, 8
xor ecx, dword [r11 + rdx*4]
movzx edx, cl
shr ecx, 8
xor ecx, dword [r11 + rdx*4]
xor ecx, dword [r9 + 0xc]
add r9, 0x10
movzx edx, cl
shr ecx, 8
xor ecx, dword [r11 + rdx*4]
movzx edx, cl
shr ecx, 8
xor ecx, dword [r11 + rdx*4]
movzx edx, cl
shr ecx, 8
xor ecx, dword [r11 + rdx*4]
movzx edx, cl
shr ecx, 8
xor ecx, dword [r11 + rdx*4]
cmp r9, r10
jb 0x14008b730
and r8d, 0xf
add r8, r9
cmp r9, r8
jae 0x14008b81b
nop dword [rax + rax]
movzx edx, byte [r9]
mov eax, ecx
xor rdx, rax
shr ecx, 8
movzx eax, dl
inc r9
xor ecx, dword [r11 + rax*4]
cmp r9, r8
jb 0x14008b800
not ecx
mov eax, ecx
ret
Function at 0x14008da10
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push r15
sub rsp, 0x20
mov eax, dword [rcx + 0x80]
mov rdi, rdx
mov r8d, eax
mov r14, rcx
shr r8, 3
and eax, 7
shl eax, 3
and r8d, 0xf
mov ecx, eax
mov rdx, 0xffffffffffffffff
shl rdx, cl
mov eax, 0x80
not rdx
shl rax, cl
and rdx, qword [r14 + r8*8]
xor esi, esi
xor rdx, rax
mov qword [r14 + r8*8], rdx
inc r8
cmp r8, 0xf
jb 0x14008da91
jne 0x14008da7a
mov qword [r14 + 0x78], rsi
lea rbx, [r14 + 0x88]
mov rdx, r14
mov rcx, rbx
call fcn.14008bf30
mov r8, rsi
jmp 0x14008da98
lea rbx, [r14 + 0x88]
lea rax, [r8*8]
xor edx, edx
mov r8d, 0x78
lea rcx, [rax + r14]
sub r8, rax
and r8, 0xfffffffffffffff8
call fcn.1400a5270
mov rax, qword [r14 + 0x80]
mov rdx, r14
shl rax, 3
mov rcx, rbx
bswap rax
mov qword [r14 + 0x78], rax
call fcn.14008bf30
test rdi, rdi
je 0x14008dbe8
mov edx, dword [r14 + 0xc8]
movzx eax, dil
or al, bl
or al, dl
test al, 7
jne 0x14008dbc5
lea rcx, [rdx + 7]
shr rcx, 3
lea r8, [rbx + rdx]
cmp rbx, r8
cmova rcx, rsi
test rcx, rcx
je 0x14008db9d
cmp rcx, 8
jb 0x14008db9d
cmp dword [0x140148028], 2
jl 0x14008db9d
lea rax, [rcx - 1]
lea rax, [rbx + rax*8]
lea rdx, [rdi - 8]
lea rdx, [rdx + rcx*8]
cmp rdi, rax
ja 0x14008db3e
cmp rdx, rbx
jae 0x14008db9d
and rcx, 0xfffffffffffffff8
movdqu xmm0, xmmword [rbx]
add rsi, 8
pshufb xmm0, xmmword [0x140129560]
movdqu xmmword [rdi], xmm0
movdqu xmm0, xmmword [rbx + 0x10]
pshufb xmm0, xmmword [0x140129560]
movdqu xmmword [rdi + 0x10], xmm0
movdqu xmm0, xmmword [rbx + 0x20]
pshufb xmm0, xmmword [0x140129560]
movdqu xmmword [rdi + 0x20], xmm0
movdqu xmm0, xmmword [rbx + 0x30]
add rbx, 0x40
pshufb xmm0, xmmword [0x140129560]
movdqu xmmword [rdi + 0x30], xmm0
add rdi, 0x40
cmp rsi, rcx
jb 0x14008db42
cmp rbx, r8
jae 0x14008dbe8
sub rdi, rbx
nop word [rax + rax]
mov rax, qword [rbx]
bswap rax
mov qword [rdi + rbx], rax
add rbx, 8
cmp rbx, r8
jb 0x14008dbb0
jmp 0x14008dbe8
test rdx, rdx
je 0x14008dbe8
mov rcx, rsi
nop dword [rax]
movzx eax, byte [rbx]
lea rbx, [rbx + 1]
xor rcx, 7
inc esi
mov byte [rcx + rdi], al
movsxd rcx, esi
cmp rcx, rdx
jb 0x14008dbd0
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
Function at 0x140090bc0
Capabilities:
Encode data using xor
Hash data using sha512

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
mov rdi, rcx
add rcx, 0x40
xor edx, edx
mov r8d, 0x140
call fcn.1400a5270
movabs rax, 0x6a09e667f3bcc908
mov r8d, 2
mov qword [rdi], rax
movabs rax, 0xbb67ae8584caa73b
mov qword [rdi + 8], rax
movabs rax, 0x3c6ef372fe94f82b
mov qword [rdi + 0x10], rax
movabs rax, 0xa54ff53a5f1d36f1
mov qword [rdi + 0x18], rax
movabs rax, 0x510e527fade682d1
mov qword [rdi + 0x20], rax
movabs rax, 0x9b05688c2b3e6c1f
mov qword [rdi + 0x28], rax
movabs rax, 0x1f83d9abfb41bd6b
mov qword [rdi + 0x30], rax
movabs rax, 0x5be0cd19137e2179
mov qword [rdi + 0x38], rax
lea rax, [rbx + 6]
sub rdi, rbx
nop dword [rax]
movzx ecx, byte [rax]
movzx edx, byte [rax + 1]
shl rdx, 8
or rdx, rcx
movzx ecx, byte [rax - 1]
shl rdx, 8
or rdx, rcx
movzx ecx, byte [rax - 2]
shl rdx, 8
or rdx, rcx
movzx ecx, byte [rax - 3]
shl rdx, 8
or rdx, rcx
movzx ecx, byte [rax - 4]
shl rdx, 8
or rdx, rcx
movzx ecx, byte [rax - 5]
shl rdx, 8
or rdx, rcx
movzx ecx, byte [rax - 6]
shl rdx, 8
or rdx, rcx
xor qword [rax + rdi - 6], rdx
movzx ecx, byte [rax + 8]
movzx edx, byte [rax + 9]
shl rdx, 8
or rdx, rcx
movzx ecx, byte [rax + 7]
shl rdx, 8
or rdx, rcx
movzx ecx, byte [rax + 6]
shl rdx, 8
or rdx, rcx
movzx ecx, byte [rax + 5]
shl rdx, 8
or rdx, rcx
movzx ecx, byte [rax + 4]
shl rdx, 8
or rdx, rcx
movzx ecx, byte [rax + 3]
shl rdx, 8
or rdx, rcx
movzx ecx, byte [rax + 2]
shl rdx, 8
or rdx, rcx
xor qword [rax + rdi + 2], rdx
movzx ecx, byte [rax + 0x10]
movzx edx, byte [rax + 0x11]
shl rdx, 8
or rdx, rcx
movzx ecx, byte [rax + 0xf]
shl rdx, 8
or rdx, rcx
movzx ecx, byte [rax + 0xe]
shl rdx, 8
or rdx, rcx
movzx ecx, byte [rax + 0xd]
shl rdx, 8
or rdx, rcx
movzx ecx, byte [rax + 0xc]
shl rdx, 8
or rdx, rcx
movzx ecx, byte [rax + 0xb]
shl rdx, 8
or rdx, rcx
movzx ecx, byte [rax + 0xa]
shl rdx, 8
or rdx, rcx
xor qword [rax + rdi + 0xa], rdx
movzx ecx, byte [rax + 0x18]
movzx edx, byte [rax + 0x19]
shl rdx, 8
or rdx, rcx
movzx ecx, byte [rax + 0x17]
shl rdx, 8
or rdx, rcx
movzx ecx, byte [rax + 0x16]
shl rdx, 8
or rdx, rcx
movzx ecx, byte [rax + 0x15]
shl rdx, 8
or rdx, rcx
movzx ecx, byte [rax + 0x14]
shl rdx, 8
lea rax, [rax + 0x20]
or rdx, rcx
movzx ecx, byte [rax - 0xd]
shl rdx, 8
or rdx, rcx
movzx ecx, byte [rax - 0xe]
shl rdx, 8
or rdx, rcx
xor qword [rax + rdi - 0xe], rdx
sub r8, 1
jne 0x140090c60
mov rbx, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rdi
ret
Function at 0x140093400
Capabilities:
Encode data using xor

Disassembly:
movzx eax, cl
xor r10d, r10d
or al, r8b
or al, r9b
test al, 3
jne 0x1400934e3
lea rdx, [r9 + 3]
shr rdx, 2
lea r11, [r8 + r9]
cmp r8, r11
cmova rdx, r10
test rdx, rdx
je 0x1400934c0
cmp rdx, 0x10
jb 0x1400934c0
cmp dword [0x140148028], 2
jl 0x1400934c0
lea rax, [r8 - 4]
lea rax, [rax + rdx*4]
lea r9, [rcx - 4]
lea r9, [r9 + rdx*4]
cmp rcx, rax
ja 0x14009345d
cmp r9, r8
jae 0x1400934c0
and rdx, 0xfffffffffffffff0
movdqu xmm0, xmmword [r8]
add r10, 0x10
pshufb xmm0, xmmword [0x140129580]
movdqu xmmword [rcx], xmm0
movdqu xmm0, xmmword [r8 + 0x10]
pshufb xmm0, xmmword [0x140129580]
movdqu xmmword [rcx + 0x10], xmm0
movdqu xmm0, xmmword [r8 + 0x20]
pshufb xmm0, xmmword [0x140129580]
movdqu xmmword [rcx + 0x20], xmm0
movdqu xmm0, xmmword [r8 + 0x30]
add r8, 0x40
pshufb xmm0, xmmword [0x140129580]
movdqu xmmword [rcx + 0x30], xmm0
add rcx, 0x40
cmp r10, rdx
jb 0x140093461
cmp r8, r11
jae 0x14009350a
sub rcx, r8
nop dword [rax + rax]
mov eax, dword [r8]
bswap eax
mov dword [rcx + r8], eax
add r8, 4
cmp r8, r11
jb 0x1400934d0
ret
test r9, r9
je 0x14009350a
mov rdx, r10
nop dword [rax + rax]
movzx eax, byte [r8]
lea r8, [r8 + 1]
xor rdx, 3
inc r10d
mov byte [rdx + rcx], al
movsxd rdx, r10d
cmp rdx, r9
jb 0x1400934f0
ret

Function at 0x140093510
Capabilities:
Check if file exists
Delete file
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov rax, qword [0x140148020]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov r14, r8
mov rdi, rdx
mov rbp, rcx
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x140093546
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor ecx, ecx
xor bl, bl
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov r8, r14
mov rdx, rdi
mov rcx, rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdi, rax
test rax, rax
je 0x140093624
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x14009361b
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r14, rax
test rax, rax
je 0x14009361b
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
test eax, eax
je 0x14009361b
mov qword [rsp + 0x30], 0
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x20], 2
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x14009361b
lea r9, [rsp + 0x40]
mov dword [rsp + 0x40], 0
mov r8d, esi
mov qword [rsp + 0x20], 0
mov rdx, r14
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, 1
movzx ebx, bl
test eax, eax
cmovne ebx, ecx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeResource]
movzx eax, bl
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400a24f0
add rsp, 0x50
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140093660
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
lea rax, str.Start_Controller_Thread
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rax
mov rcx, qword [0x1401515f8]
lea r9, str.BaseController::Start
lea r8, str.D:_a1_sinstaller_cppPCManagerInstallerBaseModuleBaseController.cpp
mov dword [rsp + 0x20], InitCommonControls
mov edx, 4
call fcn.140080e40
mov qword [rdi + 0x10], rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rdi + 0x18], eax
mov r9, rdi
lea r8, [0x140093640]
xor edx, edx
lea rax, [rdi + 0x1c]
xor ecx, ecx
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rdi + 0x20], rax
test rax, rax
jne 0x140093711
mov rcx, qword [0x1401515f8]
lea rax, str.Create_Install_Controller_Thread_failed.
mov qword [rsp + 0x28], rax
lea r9, str.BaseController::Start
lea r8, str.D:_a1_sinstaller_cppPCManagerInstallerBaseModuleBaseController.cpp
mov dword [rsp + 0x20], 0x14
mov edx, 1
call fcn.140080e40
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret