joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001ee64
Capabilities:
Query or enumerate registry value

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r14
mov rbp, rsp
sub rsp, 0x40
mov r14, qword [rbp + 0x50]
lea rcx, [rbp - 0x10]
mov rsi, qword [rbp + 0x58]
xor edi, edi
and qword [rbp + 0x40], rdi
mov rbx, r8
and qword [r14], rdi
and dword [rsi], edi
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
nop dword [rax + rax]
test rbx, rbx
je 0x14001eec4
lea r9, [rbp + 0x40]
mov r8d, 0x20019
mov rdx, rbx
xor ecx, ecx
call fcn.14001ec08
mov ebx, eax
test eax, eax
js 0x14001efbe
mov rcx, qword [rbp + 0x40]
lea rax, [rbp + 0x48]
xor r9d, r9d
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], edi
lea rdx, [rbp - 0x10]
lea r8d, [r9 + 2]
call qword [sym.imp.ntdll.dll_NtQueryValueKey]
nop dword [rax + rax]
mov ebx, eax
cmp eax, 0xc0000023
je 0x14001ef07
test eax, eax
js 0x14001efbe
mov ebx, 0xc0000001
jmp 0x14001efbe
mov rcx, qword gs:[0x60]
xor edx, edx
mov r8d, dword [rbp + 0x48]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
jne 0x14001ef38
mov ebx, 0xc000009a
jmp 0x14001efbe
mov rcx, qword [rbp + 0x40]
lea rax, [rbp + 0x30]
mov qword [rsp + 0x28], rax
lea rdx, [rbp - 0x10]
mov eax, dword [rbp + 0x48]
mov r9, rdi
mov r8d, 2
mov dword [rsp + 0x20], eax
call qword [sym.imp.ntdll.dll_NtQueryValueKey]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
js 0x14001efbe
cmp dword [rdi + 4], 1
je 0x14001ef78
mov ebx, 0xc0000024
jmp 0x14001efbe
mov eax, dword [rbp + 0x48]
xor edx, edx
add eax, 0xfffffff4
mov dword [rbp + 0x48], eax
mov rcx, qword gs:[0x60]
mov r8d, eax
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov qword [r14], rax
test rax, rax
je 0x14001ef2e
mov r8d, dword [rbp + 0x48]
lea rdx, [rdi + 0xc]
mov rcx, rax
call sub.msvcrt.dll_memcpy
mov eax, dword [rbp + 0x48]
xor ebx, ebx
mov dword [rsi], eax
mov rcx, qword [rbp + 0x40]
test rcx, rcx
je 0x14001efd3
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
test rdi, rdi
je 0x14001eff6
mov rcx, qword gs:[0x60]
mov r8, rdi
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov eax, ebx
add rsp, 0x40
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x14001f00c
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x70
mov rsi, rdx
xor r14d, r14d
mov rdx, rcx
mov qword [rbp + 0x38], r14
lea rcx, [rbp - 0x40]
mov qword [rbp - 0x48], r14
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
nop dword [rax + rax]
lea rax, [rbp - 0x40]
mov dword [rbp - 0x30], 0x30
xorps xmm0, xmm0
mov qword [rbp - 0x20], rax
lea r8, [rbp - 0x30]
mov qword [rbp - 0x28], r14
lea edx, [r14 + 1]
mov dword [rbp - 0x18], 0x40
lea rcx, [rbp + 0x38]
movdqu xmmword [rbp - 0x10], xmm0
call qword [sym.imp.ntdll.dll_NtOpenSymbolicLinkObject]
nop dword [rax + rax]
test eax, eax
js 0x14001f1da
xor edx, edx
lea rcx, [rbp - 0x50]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
nop dword [rax + rax]
mov edi, r14d
mov dword [rbp + 0x30], r14d
jmp 0x14001f0f9
cmp qword [rbp - 0x48], r14
je 0x14001f0c4
mov rcx, qword gs:[0x60]
xor edx, edx
mov r8, qword [rbp - 0x48]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov eax, dword [rbp + 0x30]
xor edx, edx
mov word [rbp - 0x4e], ax
mov rcx, qword gs:[0x60]
lea edi, [rax + 2]
mov r8d, edi
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov qword [rbp - 0x48], rax
test rax, rax
je 0x14001f1f0
mov rcx, qword [rbp + 0x38]
lea r8, [rbp + 0x30]
lea rdx, [rbp - 0x50]
call qword [sym.imp.ntdll.dll_NtQuerySymbolicLinkObject]
nop dword [rax + rax]
mov ebx, eax
cmp eax, 0xc0000023
je 0x14001f09f
mov rcx, qword [rbp + 0x38]
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
mov rax, qword [rbp - 0x48]
mov qword [rbp + 0x38], r14
test ebx, ebx
js 0x14001f1b4
movzx ecx, word [rbp - 0x50]
lea r8, [rbp - 0x30]
shr rcx, 1
xorps xmm0, xmm0
mov edx, 1
mov word [rax + rcx*2], r14w
lea rax, [rbp - 0x50]
lea rcx, [rbp + 0x38]
mov qword [rbp - 0x20], rax
mov word [rbp - 0x4e], di
mov dword [rbp - 0x30], 0x30
mov qword [rbp - 0x28], r14
mov dword [rbp - 0x18], 0x40
movdqu xmmword [rbp - 0x10], xmm0
call qword [sym.imp.ntdll.dll_NtOpenSymbolicLinkObject]
nop dword [rax + rax]
test eax, eax
jns 0x14001f0f9
mov rax, qword [rbp - 0x48]
mov ebx, r14d
mov qword [rsi], rax
mov rcx, qword [rbp + 0x38]
test rcx, rcx
je 0x14001f1b0
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
mov rax, qword [rbp - 0x48]
mov qword [rbp + 0x38], r14
test ebx, ebx
jns 0x14001f1d8
test rax, rax
je 0x14001f1d8
mov rcx, qword gs:[0x60]
xor edx, edx
mov r8, qword [rbp - 0x48]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov eax, ebx
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
mov ebx, 0xc000009a
jmp 0x14001f193
Function at 0x1400204c4
Capabilities:
Delete registry key
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0x90
xor r15d, r15d
lea rdx, str.RegistryMachineSYSTEMCurrentControlSetControlSyspart
mov r14, rcx
mov dword [rbp + 0x6f], r15d
lea rcx, [rbp - 0x19]
mov qword [rbp + 0x77], r15
mov esi, r15d
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
nop dword [rax + rax]
lea rax, [rbp - 0x19]
mov dword [rbp + 7], 0x30
xorps xmm0, xmm0
mov qword [rbp + 0x17], rax
movdqu xmmword [rbp + 0x27], xmm0
mov qword [rbp + 0xf], r15
mov dword [rbp + 0x1f], 0x40
call fcn.14002066c
mov ebx, eax
test eax, eax
js 0x140020603
lea rax, [rbp + 0x6f]
xor r9d, r9d
mov qword [rsp + 0x30], rax
lea r8, [rbp + 7]
mov dword [rsp + 0x28], 1
lea rcx, [rbp + 0x77]
mov edx, 0xf003f
mov qword [rsp + 0x20], r15
call qword [sym.imp.ntdll.dll_NtCreateKey]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
js 0x140020603
or rax, 0xffffffffffffffff
inc rax
cmp word [r14 + rax*2], r15w
jne 0x140020575
mov rdi, qword [rbp + 0x77]
lea rdx, str.SystemPartition
lea rcx, [rbp - 9]
lea ebx, [rax*2 + 2]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
nop dword [rax + rax]
mov r9d, 1
mov dword [rsp + 0x28], ebx
xor r8d, r8d
mov qword [rsp + 0x20], r14
lea rdx, [rbp - 9]
mov rcx, rdi
call qword [sym.imp.ntdll.dll_NtSetValueKey]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
js 0x140020603
mov ecx, 0x60019
call fcn.14001e610
mov rsi, rax
test rax, rax
jne 0x1400205e5
mov ebx, 0xc0000001
jmp 0x140020603
mov rcx, qword [rbp + 0x77]
mov r8, rax
mov edx, 4
call qword [sym.imp.ntdll.dll_NtSetSecurityObject]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jns 0x140020613
mov rcx, qword [rbp + 0x77]
call qword [sym.imp.ntdll.dll_NtDeleteKey]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x77]
test rcx, rcx
je 0x140020628
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
test rsi, rsi
je 0x14002064b
mov rcx, qword gs:[0x60]
mov r8, rsi
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov eax, ebx
mov rbx, qword [rsp + 0xc0]
add rsp, 0x90
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x14002066c
Capabilities:
Delete registry key

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x20
and qword [rax + 8], 0
lea r9, [rax + 8]
mov r8d, 0x60019
lea rdx, str.RegistryMachineSYSTEMCurrentControlSetControlSyspart
xor ecx, ecx
xor esi, esi
call fcn.14001ec08
mov edi, eax
test eax, eax
jns 0x1400206f9
cmp eax, 0xc0000034
jne 0x1400206aa
xor edi, edi
mov rbx, qword [rsp + 0x30]
test rbx, rbx
je 0x1400206c3
mov rcx, rbx
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
test rsi, rsi
je 0x1400206e6
mov rcx, qword gs:[0x60]
mov r8, rsi
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov rbx, qword [rsp + 0x38]
mov eax, edi
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov ecx, 0xf003f
call fcn.14001e610
mov rbx, qword [rsp + 0x30]
mov rsi, rax
test rax, rax
jne 0x140020717
mov edi, 0xc0000001
jmp 0x1400206af
mov r8, rax
mov edx, 4
mov rcx, rbx
call qword [sym.imp.ntdll.dll_NtSetSecurityObject]
nop dword [rax + rax]
mov edi, eax
test eax, eax
js 0x1400206af
mov rcx, rbx
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
and qword [rsp + 0x30], 0
lea r9, [rsp + 0x30]
mov r8d, 0xf003f
lea rdx, str.RegistryMachineSYSTEMCurrentControlSetControlSyspart
xor ecx, ecx
call fcn.14001ec08
mov edi, eax
test eax, eax
js 0x1400206aa
mov rbx, qword [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.ntdll.dll_NtDeleteKey]
nop dword [rax + rax]
mov edi, eax
jmp 0x1400206af
Function at 0x140021820
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov eax, 0x746e
mov r15, r9
mov rbx, rcx
cmp word [rcx + 0x1c], ax
jne 0x140021a0c
mov rcx, qword [rcx + 0x10]
cmp dword [rcx], 0xbee0bee0
jne 0x140021a0c
xor r9d, r9d
test r15, r15
je 0x14002186e
mov dword [r15], r9d
mov r14, qword [rsp + 0x90]
test r14, r14
je 0x14002187e
mov dword [r14], r9d
mov rbp, qword [rsp + 0x98]
test rbp, rbp
je 0x14002188f
mov dword [rbp], r9d
mov r12, qword [rsp + 0xa0]
test r12, r12
je 0x1400218a0
mov dword [r12], r9d
mov r13, qword [rsp + 0xa8]
test r13, r13
je 0x1400218b1
mov dword [r13], r9d
mov rdi, qword [rsp + 0xb0]
test rdi, rdi
je 0x1400218c1
mov dword [rdi], r9d
mov rax, qword [rsp + 0xb8]
test rax, rax
je 0x1400218d1
mov dword [rax], r9d
test rdx, rdx
jne 0x1400218de
test r8, r8
je 0x1400218de
mov dword [r8], r9d
mov rsi, qword [rsp + 0xc0]
test rsi, rsi
je 0x1400218ee
mov qword [rsi], r9
lea rax, [rcx + 0x88]
mov rcx, rax
mov qword [rsp + 0x70], rax
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_EnterCriticalSection]
nop dword [rax + rax]
xor r8d, r8d
cmp word [rbx + 0x1e], r8w
je 0x14002191d
mov edi, 0x3fa
jmp 0x1400219f9
mov r9, qword [rsp + 0x78]
test r9, r9
je 0x14002195d
mov rax, qword [rbx + 0x28]
xor ecx, ecx
mov rdx, qword [rbx + 0x78]
movzx r8d, word [rax + 0x4a]
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x20], rax
call fcn.140025be8
xor r8d, r8d
mov edi, eax
test eax, eax
jne 0x1400219f9
mov rdi, qword [rsp + 0xb0]
test r15, r15
je 0x14002196c
mov rax, qword [rbx + 0x28]
mov ecx, dword [rax + 0x14]
mov dword [r15], ecx
test r14, r14
je 0x140021983
mov rax, qword [rbx + 0x28]
mov ecx, dword [rax + 0x34]
shr ecx, 1
and ecx, 0x7fff
mov dword [r14], ecx
test rbp, rbp
je 0x140021994
mov rax, qword [rbx + 0x28]
mov ecx, dword [rax + 0x38]
shr ecx, 1
mov dword [rbp], ecx
test r12, r12
je 0x1400219a4
mov rax, qword [rbx + 0x28]
mov ecx, dword [rax + 0x24]
mov dword [r12], ecx
test r13, r13
je 0x1400219b6
mov rax, qword [rbx + 0x28]
mov ecx, dword [rax + 0x3c]
shr ecx, 1
mov dword [r13], ecx
test rdi, rdi
je 0x1400219c4
mov rax, qword [rbx + 0x28]
mov ecx, dword [rax + 0x40]
mov dword [rdi], ecx
mov rdx, qword [rsp + 0xb8]
test rdx, rdx
je 0x1400219de
mov rax, qword [rbx + 0x60]
mov rcx, qword [rax + 0x10]
mov eax, dword [rcx + 0x10]
mov dword [rdx], eax
test rsi, rsi
je 0x1400219f6
mov rax, qword [rbx + 0x28]
mov edx, dword [rax + 4]
mov dword [rsi], edx
mov rax, qword [rbx + 0x28]
mov edx, dword [rax + 8]
mov dword [rsi + 4], edx
mov edi, r8d
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
nop dword [rax + rax]
jmp 0x140021a11
mov edi, 6
mov rbx, qword [rsp + 0x88]
mov eax, edi
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140022bb0
Capabilities:
Get file size
Read file on windows

Disassembly:
mov r9, rdx
xor edx, edx
lea r8d, [rdx + 1]
jmp fcn.140022894

Function at 0x140022bd0
Capabilities:
Get file size
Read file on windows

Disassembly:
mov r9, rdx
mov r8d, 1
mov rdx, rcx
xor ecx, ecx
jmp fcn.140022894

Function at 0x140023050
Capabilities:
Clear file content

Disassembly:
mov qword [rsp + 8], rbp
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
xor esi, esi
xor r14b, r14b
mov eax, 0x746e
cmp word [rcx + 0x1c], ax
jne 0x140023164
mov rsi, qword [rcx + 0x10]
test rsi, rsi
je 0x140023164
cmp dword [rsi], 0xbee0bee0
jne 0x140023164
lea rcx, [rsi + 0x88]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_EnterCriticalSection]
nop dword [rax + rax]
cmp qword [rsi + 0x80], 0
mov r14b, 1
je 0x140023164
cmp dword [rsi + 0xb4], 0
jne 0x1400230c6
xor edi, edi
jmp 0x140023169
mov rcx, rsi
call fcn.140027940
mov edi, eax
test eax, eax
jne 0x140023169
mov rbp, qword [rsi + 0x80]
xor r9d, r9d
mov rcx, rbp
xor r8d, r8d
xor edx, edx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_SetFilePointerEx]
nop dword [rax + rax]
test eax, eax
jne 0x14002310a
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov edi, eax
jmp 0x14002311f
mov rcx, rbp
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_SetEndOfFile]
nop dword [rax + rax]
test eax, eax
je 0x1400230fa
xor edi, edi
test edi, edi
jne 0x140023169
mov rdx, rbp
mov rcx, rsi
call fcn.140028600
mov edi, eax
test eax, eax
jne 0x140023169
mov rcx, rbp
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FlushFileBuffers]
nop dword [rax + rax]
test eax, eax
jne 0x140023155
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov edi, eax
test edi, edi
jne 0x140023169
and dword [rsi + 0xb4], edi
jmp 0x1400230bf
mov edi, 6
mov rcx, rsi
call fcn.140028558
test r14b, r14b
je 0x140023189
lea rcx, [rsi + 0x88]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
nop dword [rax + rax]
mov rbp, qword [rsp + 0x30]
mov eax, edi
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop r14
ret
Function at 0x140026e18
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x1450]
mov eax, 0x1550
call fcn.140030830
sub rsp, rax
mov rax, qword [0x14004f068]
xor rax, rsp
mov qword [rbp + 0x1440], rax
mov rdi, rcx
xor edx, edx
lea rcx, [rbp - 0x60]
mov r8d, 0x1b0
call sub.msvcrt.dll_memset
xor r14d, r14d
or esi, 0xffffffff
cmp dword [0x14004f084], esi
mov ebx, r14d
jne 0x140026eae
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsAlloc]
nop dword [rax + rax]
mov ecx, eax
cmp eax, esi
jne 0x140026e93
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
jmp 0x140026eae
or eax, 0xffffffff
lock cmpxchg dword [0x14004f084], ecx
cmp eax, esi
je 0x140026eae
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsFree]
nop dword [rax + rax]
test ebx, ebx
jne 0x140026fe2
mov ecx, dword [0x14004f084]
mov rdx, rdi
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsSetValue]
nop dword [rax + rax]
mov ecx, 0x1000
cmp dword [rdi + 0x30], ecx
jb 0x140026fdd
mov rsi, qword [rdi + 0x10]
mov eax, dword [rsi + 0x28]
add eax, ecx
cmp eax, ecx
jb 0x140026fdd
cmp eax, dword [rdi + 0x30]
ja 0x140026fdd
xor edx, edx
mov dword [rdi + 0xb0], r14d
mov r8d, 0x12e8
lea rcx, [rbp + 0x150]
call sub.msvcrt.dll_memset
lea rax, [0x140026cf0]
mov qword [rbp - 0x70], r14
mov qword [rsp + 0x70], rax
lea rcx, [rbp + 0x150]
lea rax, [0x140026d80]
xorps xmm0, xmm0
mov qword [rsp + 0x78], rax
movdqu xmmword [rbp - 0x80], xmm0
call fcn.140031bc0
lea rax, [rbp - 0x60]
xor r9d, r9d
mov qword [rbp + 0x188], rax
lea edx, [rbx + 3]
lea rax, [rbp + 0x150]
xor r8d, r8d
mov qword [rbp - 0x60], rax
lea rcx, [rbp + 0x150]
lea rax, [rbp - 0x60]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x38], r14
mov dword [rsp + 0x30], 1
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
call fcn.140031cbc
test eax, eax
jns 0x140026fbe
mov eax, dword [rdi + 0xb0]
neg eax
sbb ebx, ebx
and ebx, 0xfffffc0f
add ebx, 0x3f9
jmp 0x140026fe2
lea r8, [rbp - 0x60]
lea rcx, [rbp + 0x150]
call fcn.140029a64
cmp eax, 0x8000002a
cmove eax, r14d
test eax, eax
jns 0x140026fe2
jmp 0x140026fa6
mov ebx, 0x3f1
lea rsi, [rdi + 0x70]
mov qword [rbp + 0x188], r14
mov rax, qword [rsi]
cmp rax, rsi
je 0x140027025
mov rdi, qword [rax]
cmp qword [rdi + 8], rax
jne 0x140027063
mov rcx, qword [rax + 8]
cmp qword [rcx], rax
jne 0x140027063
mov qword [rcx], rdi
mov qword [rdi + 8], rcx
mov rcx, rax
call qword [sym.imp.msvcrt.dll_free]
nop dword [rax + rax]
mov rax, rdi
cmp rdi, rsi
jne 0x140026ff5
mov ecx, dword [0x14004f084]
xor edx, edx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsSetValue]
nop dword [rax + rax]
mov eax, ebx
mov rcx, qword [rbp + 0x1440]
xor rcx, rsp
call fcn.140030000
lea r11, [rsp + 0x1550]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
mov ecx, 3
int 0x29
int3
Function at 0x140028600
Capabilities:
Encode data using xor
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
xor r15d, r15d
xor r14b, r14b
and dword [rsp + 0x60], r15d
xor esi, esi
mov r12, rdx
mov rdi, rcx
test rcx, rcx
jne 0x140028636
lea ebx, [rcx + 0x57]
jmp 0x14002870b
mov rcx, qword [rcx + 0x10]
mov r9d, 1
test rcx, rcx
je 0x14002868c
lea rdx, [rdi + 0x50]
xor r8d, r8d
mov rax, qword [rdx]
jmp 0x140028658
add r8d, dword [rax + 0x24]
mov rax, qword [rax]
cmp rax, rdx
jne 0x140028651
xor eax, eax
mov dword [rcx + 0x28], r8d
mov rdx, rcx
lea r8d, [rax + 0x7f]
xor eax, dword [rdx]
lea rdx, [rdx + 4]
sub r8, r9
jne 0x14002866a
cmp eax, 0xffffffff
mov edx, 0xfffffffe
cmove eax, edx
test eax, eax
cmove eax, r9d
mov dword [rcx + 0x1fc], eax
mov rcx, qword [rdi + 0x10]
mov eax, dword [rcx + 0x28]
add eax, 0x1000
je 0x140028709
test r14b, r14b
jne 0x1400286a6
mov ebp, 0x1000
jmp 0x1400286ad
mov ebp, dword [rsi + 0x24]
mov rcx, qword [rsi + 0x28]
mov rdx, rcx
lea r9, [rsp + 0x60]
xor ebx, ebx
mov rcx, r12
and qword [rsp + 0x20], rbx
mov r8d, ebp
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_WriteFile]
nop dword [rax + rax]
test eax, eax
jne 0x1400286e0
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
test ebx, ebx
jne 0x14002870b
test r14b, r14b
je 0x1400286ee
mov rsi, qword [rsi]
jmp 0x1400286f5
mov rsi, qword [rdi + 0x50]
mov r14b, 1
mov rcx, qword [rdi + 0x10]
add r15d, ebp
mov eax, dword [rcx + 0x28]
add eax, 0x1000
cmp r15d, eax
jb 0x14002869a
xor ebx, ebx
mov rbp, qword [rsp + 0x70]
mov eax, ebx
mov rbx, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret

Function at 0x140029a34
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
lea edx, [rax + 0x7f]
lea r8d, [rax + 1]
xor eax, dword [rcx]
lea rcx, [rcx + 4]
sub rdx, r8
jne 0x140029a3d
cmp eax, 0xffffffff
mov ecx, 0xfffffffe
cmove eax, ecx
test eax, eax
cmove eax, r8d
ret
Function at 0x14002e42c
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [0x14004f6c0]
mov r11, rdx
mov r10d, dword [0x14004f6c4]
cmp r8, 7
jbe 0x14002e499
lea rdx, [r8 - 8]
shr rdx, 3
inc rdx
imul rax, rdx, 0xfffffffffffffff8
add r8, rax
add ecx, dword [r11]
xor r10d, ecx
rol ecx, 0x14
add ecx, r10d
rol r10d, 9
xor r10d, ecx
rol ecx, 0x1b
add ecx, dword [r11 + 4]
add r11, 8
add ecx, r10d
rol r10d, 0x13
xor r10d, ecx
rol ecx, 0x14
add ecx, r10d
rol r10d, 9
xor r10d, ecx
rol ecx, 0x1b
add ecx, r10d
rol r10d, 0x13
sub rdx, 1
jne 0x14002e454
test r8, r8
je 0x14002e555
sub r8, 1
je 0x14002e54b
sub r8, 1
je 0x14002e520
sub r8, 1
je 0x14002e4eb
sub r8, 2
je 0x14002e52a
sub r8, 1
je 0x14002e4ff
add ecx, dword [r11]
xor r10d, ecx
rol ecx, 0x14
add ecx, r10d
rol r10d, 9
xor r10d, ecx
rol ecx, 0x1b
add ecx, r10d
rol r10d, 0x13
cmp r8, 1
jne 0x14002e555
add r11, 4
movzx edx, byte [r11 + 2]
movzx eax, word [r11]
shl edx, 0x10
or edx, eax
bts edx, 0x1f
jmp 0x14002e55a
add ecx, dword [r11]
xor r10d, ecx
rol ecx, 0x14
add ecx, r10d
rol r10d, 9
xor r10d, ecx
rol ecx, 0x1b
add ecx, r10d
rol r10d, 0x13
add r11, 4
movzx edx, word [r11]
bts edx, 0x17
jmp 0x14002e55a
add ecx, dword [r11]
xor r10d, ecx
rol ecx, 0x14
add ecx, r10d
rol r10d, 9
xor r10d, ecx
rol ecx, 0x1b
add ecx, r10d
rol r10d, 0x13
add r11, 4
movzx edx, byte [r11]
bts edx, 0xf
jmp 0x14002e55a
mov edx, 0x80
add ecx, edx
xor r10d, ecx
rol ecx, 0x14
add ecx, r10d
rol r10d, 9
xor r10d, ecx
rol ecx, 0x1b
add ecx, r10d
rol r10d, 0x13
xor r10d, ecx
rol ecx, 0x14
add ecx, r10d
rol r10d, 9
xor r10d, ecx
rol ecx, 0x1b
add ecx, r10d
rol r10d, 0x13
mov dword [r9 + 4], r10d
mov dword [r9], ecx
ret

Function at 0x14002e754
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
sub rsp, 0x20
xor r9d, r9d
lea rdx, [0x1400412f0]
mov rbx, rcx
lea r8d, [r9 + 1]
call qword [sym.imp.api_ms_win_core_libraryloader_l1_1_0.dll_FindResourceExW]
nop dword [rax + rax]
test rax, rax
jne 0x14002e783
add rsp, 0x20
pop rbx
ret
mov rdx, rax
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp qword [sym.imp.api_ms_win_core_libraryloader_l1_1_0.dll_LoadResource]