joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003b4f2
Capabilities:
Query or enumerate registry value

Disassembly:
jae 0x14003b533
push rdi
xchg dword [rbx + 0x641e33a5], eax
and al, 0x78
add byte [rcx - 0x73], cl
call 0x118473e2e
mov esi, r8d
lea rax, [r11 + 0x20]
mov dword [rsp + 0x40], 0x190004
sbb dword [rax], eax
jl 0x14003b4d1
mov dword [ebx - 0x30], eax
pop rbx
sbb byte [rbx - 0x38], ah
add byte [rbx + rcx*4 - 0x39], cl
mov rdi, rcx
imul ecx, dword [rbx + 0x10b941d1], 0
add byte [rax], al
mov rcx, 0xffffffff80001a01
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop ebp
add byte [rax], al
sbb al, al
jg 0x14003b53f
js 0x14003b54b
mov ecx, dword [rsp - 0x4d]
mov rbx, qword [rcx + rsi*4 + 0x60]
mov edi, ebx
lodsb al, byte [rsi]
mov esi, dword [rsp - 0x2b]
add rsp, 0x50
pop rdi
ret
movzx eax, ax
or eax, 0x80d0001a
test eax, eax
jmp 0x14003b526
lea r9, [rsp + 0x78]
jns 0x14003b516
ret
mov rdx, rdi
mov rcx, 0xffffffff80000002
call fcn.14004c56c
mov eax, dword [rax + riz*4]
js 0x14003b4ec
ror byte [rdi], 0x48
xor dword ss:[rdi - 0x33338134], edi
mov bl, 0xcc
or dword [rax + 0x5c], ecx
pop rsp
pop rsp
and al, 0x56
mov qword [rdi + rbp + 0x20], r9
push rdi
sub rsp, 0x43
mov r8d, dword [rcx]
mov rbx, rcx
movzx ebp, byte [rax + 0x41]
idiv byte [rsi + 4]
je 0x14003b552
mov r13b, reloc.SHCORE.dll_Ordinal_200
lea eax, [rdx + riz*8 + 0x1b]
add ecx, dword [rax + rax]
mov bl, 0x41
mov ecx, gs
add ebx, dword [rsi]
lea eax, [rsp + 0x68]
shr r8d, 0xa
lea rcx, [rbx + 8]
adc r13d, 1
mov dword [rsp + 0x28], edi
and dword [r9 + 1], 0xffffffc7
and al, 0x89
add al, byte [rax]
add byte [rax], al
mov edx, 0xa32bc3
mov byte [rsp + 0x6c], 3
mov qword [rsp + 0x20], rax
call fcn.1400a1ed8
pop rsp
and al, 0x58
add rsp, 0x40
pop rdi
ret

Function at 0x140059afc
Capabilities:
Execute syscall

Disassembly:
sub rsp, 0xffffffffffffffa3
xor eax, eax
mov r9, r8
test rdx, rdx
je 0x140059afc
mov word [r10], sp
mov rcx, r9
mov r8, rdx
mov dword [rcx + rax], 0x86c10000
cmp al, 0xfd
push qword [rax - 0x3b7cb741]
sub bl, al
add ah, byte [rax - 0x33333334]
int3
add rsp, 0x28
ret

Function at 0x14007fb94
Capabilities:
Create process on windows
Create process suspended

Disassembly:
sbb r12d, dword [rdx]
movhps xmm0, qword [rax + rax]
adc al, al
je 0x1401cbdc0
cmp qword [rdi + 0x28], 0xffffffffffffffe9
je 0x16d1cbdbc
or al, 2
add byte [rax], al
add byte [rax - 0x73], cl
mov r15b, 0x48
mov ecx, esi
lea r9, [rbp - 0x72]
and al, 0x20
lea rdx, [rbp - 0x29]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateProcessW]
pxor mm5, qword [rbx - 0x72190000]
xlatb
mov rcx, rdi
mov rbx, rax
test rax, rax
je 0x1401ce287
sahf
mov edx, dword [rbp + 0x24]
invalid
int1
xchg ebp, eax
jmp 0x1401cbdc3
dec dword [rax - 0x6b]
invalid
call fcn.14001b2ec
nop
jmp 0x13faf8283
Function at 0x1400acf34
Capabilities:
Encode data using xor

Disassembly:
pop rbp
ret
or edi, edi
pop rsp
and al, 0xc0
in al, 0x89
je 0x1400acf61
and byte [rax + rcx*2 - 0x7d], al
in al, dx
and byte [rbx + 0x3d8b4801], cl
mov dword [rcx], esp
sal cl, 0x83
loopne 0x1400acf56
cmp al, 6
je 0x1400acff0
add byte [rax], al
mov ebx, dword [rdi + 0x46]
cmp dh, byte [rdx]
add byte [rbp + 0x48ed75ff], al
lea ecx, [0x1593d4000]
in eax, dx
lea rcx, [0x1593d4000]
call fcn.140068d9c
mov edi, eax
lea r8, [rsp + 0x30]
je 0x1400acf04
push rsp
and al, 0x38
or bh, dl
add al, byte [rax]
add byte [rsi + 0x247c8303], dh
cmpsd dword [rsi], dword [rdi]
add byte [rdi + rax*2 - 0x69], al
xchg edx, eax
add ecx, dword [rbx - 0x57ea4830]
add dh, byte [rbp + 0x11]
xor edx, dword [rsp + 0x38]
sbb ecx, 0x9a6
xor eax, edx
and dword [rbx + 0x45131e02], 0x7f
rol dword [rcx - 0x7d], 0xe0
add al, 8
and eax, 0x4c33ca8b
cmp byte [r9 + 0x440400e1], r8b
cmp byte [0x1400b20b7], ah
jl 0x1400acffb
mov rdx, rcx
and al, 0xf6
adc dword [rax], ebp
ret

Function at 0x1401125fc
Capabilities:
Encode data using xor

Disassembly:
jrcxz 0x1401125fe
or eax, dword [rax]
add byte [rax - 0x36], cl
test byte [rax + rbp], ah
add eax, dword [rax]
nop
jo 0x14011267b
add byte [rax], al
add rsp, qword [rbx]
and al, 0
or byte [rax], al
add byte [rax - 0x77], cl
out 0xb1, eax
xchg esp, eax
cli
add byte [rax], al
mov rax, qword [rsp - 0x3ffffce0]
mov esp, dword [rcx + rcx*4 + 0xe82484]
add byte [rax], al
mov ecx, dword [rbp + 0x9824]
add byte [rcx + 0x9c2485], cl
add byte [rax], al
mov rcx, qword [rdi + 0x328f1]
add byte [rdx], dh
mov word [rsp + rbx*4], fs
mov dl, 0
add byte [rcx - 0x7b74f4f8], cl
and al, 0xe2
or al, byte [rax]
add byte [rsi + 0xe203b5], dh
add rdi, qword [rdi - 0x1d75ffdc]
add byte [rax - 0x77], cl
mov word [rax + rsi], fs
add ebp, dword [rcx]
add byte [rax - 0x77], cl
test byte [rax + 0x38], bh
add eax, dword [rax]
push rdi
mov rsp, qword [rbx + 0x7b]
xor byte [rax], ch
add byte [rax], al
and eax, 0x38248c8b
add eax, dword [rax]
add byte [rax - 0x6f47f777], bl
push rax
add byte [rax], al
add rax, qword [rsp + 0xb00]
mov qword [rsp + 0xa6d740], rax
xor edx, edx
xor eax, 0x404a8c8b
cmp byte [rax], al
add dh, al
loopne 0x14011268b
idiv bh
mov eax, 0x90
mov bpl, reloc.SHELL32.dll_DAD_DragLeave
and al, 0xdc
or eax, dword [rax]
add byte [rax + 0x48], cl
test ch, bh
add rax, qword [rax]
add byte [rax + 0x28], bh
add rdx, qword [rsi]
and al, 0xb4
or esi, ecx
add byte [rax + 0x50], cl
push rdx
and al, 0x50
add esi, dword [rax]
mov rdx, qword [rsp + 0x233848]
hlt
Function at 0x14012e2ec
Capabilities:
Encode data using xor

Disassembly:
add rsp, 0x2b
push rbx
test eax, 0x41734157
sub al, byte [rcx + 0x6f]
movabs al, byte [0xe06a81480268]
add byte [rdi], cl
sub dword [rax - 0x1f], esi
movzx edi, word [rax - 0x58]
mov rax, qword [0x1403d1b4c]
js 0x14012e348
invalid
add eax, dword [rax]
lodsb al, byte [rsi]
cmp dword [rdi + 4], 0xffffff97
jne 0x14012e371
call fcn.1400daf5c
mov cl, al
invalid
movss xmm6, dword [0x14035e70c]
movaps xmm7, xmm6
xchg ebx, eax
add esp, dword [rbx]
add byte [rdi], cl
sub dh, bh
mulss xmm6, dword [rbp + 0x77]
mov eax, dword [rbp - 0x79]
xorps xmm0, xmm4
invd
sal bl, 0xf
pop rsi
lock xor ebx, dword [rcx + rbx*2 + 0x7d]
ja 0x14012e375
mov r9d, dword [r15]
push rdi
rol dl, 0x85
invalid

Function at 0x14013df80
Capabilities:
Packed with generic packer

Disassembly:
jns 0x14013df80
add byte [rbp + rax - 0x18], dh
pushfq
out dx, eax
dec dword [rax - 0x7d]
invalid
mov qword [rsp + 0x4e], rbx
mov qword [rdi], rax
and al, 0x18
xlatb
sub rsp, 0x46
lea rdi, [rcx + 0x72000130]
mov rbx, rcx
cmp dword ds:[rdi], 0
je 0x14013dfd5
invalid
movsb byte [rdi], byte [rsi]
mov edi, dword [rcx + 0x30]
add dword [rcx + rax + 0x5c8b2b75], 0x54
js 0x14013e028
and al, 0x30
test eax, eax
mov esp, ebx
mov edi, 0x23eba30
invalid
adc byte [rax - 0x7f], cl
in al, dx
jg 0x14013e036
add ah, dl
or rdx, rax
mov rbx, qword [rdi]
mov edx, dword [rdx + 8]
mov rdi, rcx
mov rax, qword [rax + 0x10]
call qword [0x140fd75c8]
test al, al
test dword [r10 + 1], eax
add byte [rax], al
adc dword [rdi - 0x47], 0x8bb40000
enter 0x3883, 0xffffffffffffff99
xchg esi, eax
xchg byte [rsi + 0x48000002], ah
and eax, 0
add byte [rax], ah
add byte [rax - 0x75], cl
enter 0xffffffffffff97e8, 0x3e
out dx, eax
call qword [rax + rax*8]
je 0x14055e305
invalid

Function at 0x1401dd864
Capabilities:
Encode data using xor

Disassembly:
in al, dx
jg 0x1401dd7f2
adc byte [rbp - 0x75], al
invalid
xchg byte [rax + 0x65], al
ret
adc eax, dword [rax]
add rcx, 0x70088
lea rdx, [0x140315e60]
loope 0x1401dd7a4
xchg byte [rbx], dl
add byte [rax - 0x1f], cl
xor eax, 0
add byte [rax], al
cmp dword [rax + 0x10], 2
cmovne rdx, r8
lock add byte [rax], al
add byte [rbx + 0x49021078], al
cmovne edx, eax
push rbp
mov esp, ebp
js 0x1401dd81a
mov dl, byte [rsi - 0x1c]
dec dword [rax - 0x75]
retf
imul ebx, dword [rdi], 0
js 0x1401dd80e
invalid

Function at 0x1401e8c7c
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
call qword [sym.imp.USER32.dll_GetKeyState]
nop dword [rdx + rdx*8]
xor ecx, ecx
in ax, dx
shr byte [rsi - 0x68], 0xc1
mov eax, ecx
add rsp, 0x28
int3
Function at 0x1401e8e50
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
fstp st(5)
jo 0x1401e8dbb
sar qword [rax + 0x18], cl
push rbp
push r12
cmpsb byte [rsi], byte [rdi]
push rbp
jmp 0x1401e8df8
mov eax, 0xb856ffec
and byte [rax + rax], dl
add al, ch
pop r14
stc
dec dword [rax + 0x2a]
loopne 0x1401e8e2d
mov eax, dword [0x1403d1aef]
xor rdi, qword [rax + 0x10288948]
cwde
add byte [rax], al
insb byte [rdi], dx
xor edi, edi
mov qword [rbp + 0xe30308], r15
mov edi, r9d
and byte [rcx], al
add byte [rdx], dl
invalid
add dword [rsi + 0x68], eax
mov ebp, 0x130
mov qword [rsi], r8
sub byte [rdx + rbx - 0x43], al
xor al, 0xc4
add byte [rax], al
xor eax, eax
invalid
add byte [rbp - 0x7b7a0f40], al
add eax, 0xcb8b0000
mov dword [rbp - 0x20], r15d
mov qword [rbx], r15
adc byte [rbx], al
add byte [rax], al
stosq qword [rdi], rax
mov ebp, 0x3a8
call fcn.1400912a0
mov qword [rbx - 0x7ab78fdc], rbp
mov dword [rbx - 0x7ab78fdc], ebp
retf
ror byte [rdi], 0x84
mov ebx, 0xbe000004
lock add byte [rax], al
movsb byte [rdi], byte [rsi]
xor eax, 0x4146fa8d
mov ebp, esi
lea r13, [0x14102d622]
mov ebx, r15d
mov r11d, r15d
add al, 0xf7
lea edi, [rsi - 0x66]
movzx eax, byte [r13 + 0x6b]
movzx r10d, byte [r9 - 0x49f0ba72]
add r8b, byte [r9 - 0x79]
loop 0x1401e8e37
add eax, r10d
shl r9d, 8
movzx eax, byte [r13]
movsq qword [rdi], qword [rsi]
insd dword [rdi], dx
or byte [rcx - 0x3f], al
loop 0x1401e8eac
or r10d, eax
movzx eax, byte [r13 - 7]
shl r10d, 8
or r10d, eax
movzx esp, byte [r8 + 0x40]
or r9d, eax
scasd eax, dword [rdi]
fiadd dword [rcx - 0x69]
mov dh, 0x45
cld
mov r8d, r11d
shl r9d, 8
or r9d, eax
movzx eax, byte [r13 - 3]
lodsd eax, dword [rsi]
mov ecx, esp
or byte [rbx + rcx - 0x38], al
xor esp, dword [r14 + 0x41c33344]
add dword [rbx + 0x21], 0x41ac9873
invalid

Function at 0x140204e48
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
xor qword [0xff5b9676], 0x48
lea eax, [0x14033ea70]
mov edi, 0x8d480189
add eax, 0x13e142
mov qword [rcx + 8], rax
or byte [r8 - 0x73], cl
add eax, 0x139357

Function at 0x140225f90
Capabilities:
Find taskbar

Disassembly:
and dl, byte [rbx + 0x48]
cmp esp, ebp
mov rax, qword [0x141031b28]
xor rbx, qword [rbp + 0x48]
mov dword [rsp + 0x30], eax
mov rcx, rdx
mov rbx, rdx
call qword [sym.imp.api_ms_win_ntuser_rectangle_l1_1_0.dll_SetRectEmpty]
nop esp
add byte [rax], al
xor edx, edx
lea rcx, str.Shell_TrayWnd
call qword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_FindWindowW]
xchg dword [rdi], ebx
add byte [rax], r8b
test rax, rax
je 0x140225ff2
lea rdx, [rsp + 0x20]
and cl, byte [rbx + 0x76ff48c8]
invalid
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400a05b0
sub qword [rcx], 0x40
pop rbx
ret
Function at 0x14023f2b4
Capabilities:
Query or enumerate registry value

Disassembly:
adc eax, 0x4f8b4800
outsd dx, dword [rsi]
mov dword [rdx + 0x245c8b48], ecx
xor byte [rax - 0x75], cl
or al, 0x24
cmp byte [rax - 0x7d], cl
invalid
jno 0x14023f293
xchg byte [rsi - 0x48], dh
adc byte [rcx - 0x77], cl
or byte [r15 + 0x48], dl
lea eax, [rbp + 0x58d4850]
fisttp word [rdx + 0x14]
jle 0x14023f314
mov edi, edx
mov qword [r11 + 0x5b8d49d8], rcx
fmul dword [rax - 0x73]
add eax, 0xcd0843
mov dword [rsp - 0x6f], 1
mov qword [r11 - 0x1e], rax
mov dword [rsp + 0x48], 0xdf0004
mov rax, qword [rax + 0x48]
invalid
adc byte [rax], al
nop dword [rbx - 0x3f7a5600]
invalid

Function at 0x1402a642c
Capabilities:
Encode data using xor

Disassembly:
add rax, 0xfffffffffffffffe
cmp eax, 1
ja 0x1402a63c8
call 0x1082adecc
cmp eax, 0x33284b8b
rol byte [rbp + rcx*4 + 0x42], cl
int3
mov rax, rsp
je 0x1402a63ba
pop rax
in eax, 0x48
mov dword [rax + 0x10], ebp
mov qword [rax + 0x18], rsi
sal dword [0x1966bbcba], 0x48
sub esp, 0x20
mov rdx, qword [rcx + 0x10]
jb 0x1402a6442
mov rsi, rcx
mov es, word [rbp + 0x4814c880]
mov ecx, dword [rcx + 8]
dec qword [rbx - 0x5f605b7]
nop dword [rax + rax]
mov qword [rsi + 0x10], r14
cmp byte [rsi + rcx*2 + 8], al
test rcx, rcx
leave
je 0x1402a6481
retfq
lea rbx, [rsi + 0xf10080]
test rbx, rbx
je 0x1402b066d
mov rdi, qword [rbx + 8]
or rbp, 0xffffffffffffffff
push rbp
test edi, edi
je 0x1402a64c4
loope 0x1402a646e
xor edi, edi
shl dword [rsi + 0x44], 0x39
xor al, 0x42
jne 0x1402a64a1
lea rcx, [rsi*8 + 2]
xor eax, eax
rep stosb byte [rdi], al
mov rcx, qword [rbx + 8]
call 0x160094efc
jae 0x1402a64cc
mov rdi, qword [rbx + 0x10]
test rdi, rdi
je 0x1402a64f3
mov rcx, rbp
mov rcx, rbp
inc rcx
cmp di, r13w
jne 0x1402a6503
lea rcx, [rcx*2 + 0xe90002]
lodsb al, byte [rsi]
invalid
mov rbp, qword [rsi + 0x35]
test qword [0x13f728872], rsi
invalid
inc rbp
or r10w, word [rcx + 0x33f6756f]
sar ch, 0x8d
or al, 0x6d
invalid
outsd dx, dword [rsi]
jne 0x1402a64fc
xor eax, eax
std
lea ecx, [rbp*2 + 0xc4]
rep stosb byte [rdi], al
mov rcx, qword [rbx + 0x18]
sahf
loope 0x1402a6584
fsubrp st(2)
sal qword [rbx + 0x18], cl
mov rax, qword [rdx + 0x6e934820]
jle 0x1402a652d
mov rbx, rsp
retf
adc al, byte [rax]
call qword [0x1423475c8]
mov qword [rbx + 0x5d], r14
sub dword [rbx + 0x3315284b], ecx
leave
pop rdi
adc dword [rax - 0x1e], ecx
add eax, 0x129aef
call qword [0x140cae4c8]
pop rdi
mov dword [rbx + 0x66], esi
invalid
mov edx, 0x403
call qword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_SendMessageW]
nop dword [rax + rax]
stc
push rax
sub byte [rdx + 1], bh
call qword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_ShowWindow]
nop dword [rbx]
add byte [rax], al
mov rcx, qword [rbx + 0x58]
invalid
Function at 0x1402c0828
Capabilities:
Packed with generic packer

Disassembly:
add byte [rdx + rbp - 0x38], al
mov rcx, qword [rsp + 0x68]
add dword [0xcc2bfa1a], ebp
fsubr st(3)
sbb al, 0x48
mov edx, edi
mov word [rdi], ds
mov byte [rax], al
add byte [rax], al
call qword [0x14034dc38]
invalid
mov eax, ebx
lea r11, [rdx + rbp*4 + 0x60]
fmul dword [rbx - 0x74b6efa5]
jae 0x1402c07c5
invalid
push rbx
adc qword [rbx], 0x20
lea r9, [rsp + 0x30]
mov rcx, 0xffffffff8000d101
mov ecx, 0x8000d101
lea r8, str.ExitReason
xor edx, dword [rdi - 0x47]
lea edx, str.SOFTWAREMicrosoftWindowsCurrentVersionCloudExperienceHost
call fcn.14004c56c
mov ebp, 0xc08cffd8
js 0x1402c080a
mov eax, dword [rsp + 0xf]
test edi, eax
je 0x1402c0864
cmp eax, 1
jne 0x1402c0869
mov ebx, eax
jmp 0x1402c0889
invalid
mov eax, ebx
add rsp, 0x20
ja 0x1402c0834
int3
add byte [rax + 0xd], cl
and al, 0x58
mov rdi, rdx
call fcn.140308588
cmp byte [rsp + rbx + 0x58], 0
lea rax, str.SoftwareMicrosoftWindowsCurrentVersionAppReadiness
lea r8, str.OSDataSoftwareMicrosoftWindowsCurrentVersionAppReadiness
stosq qword [rdi], rax
retf

Function at 0x1402c084c
Capabilities:
Packed with generic packer

Disassembly:
add byte [rdx + rbp - 0x38], al
mov rcx, qword [rsp + 0x68]
add dword [0xcc2bfa1a], ebp
fsubr st(3)
sbb al, 0x48
mov edx, edi
mov word [rdi], ds
mov byte [rax], al
add byte [rax], al
call qword [0x14034dc38]
invalid
mov eax, ebx
lea r11, [rdx + rbp*4 + 0x60]
fmul dword [rbx - 0x74b6efa5]
jae 0x1402c07c5
invalid
push rbx
adc qword [rbx], 0x20
lea r9, [rsp + 0x30]
mov rcx, 0xffffffff8000d101
mov ecx, 0x8000d101
lea r8, str.ExitReason
xor edx, dword [rdi - 0x47]
lea edx, str.SOFTWAREMicrosoftWindowsCurrentVersionCloudExperienceHost
call fcn.14004c56c
mov ebp, 0xc08cffd8
js 0x1402c080a
mov eax, dword [rsp + 0xf]
test edi, eax
je 0x1402c0864
cmp eax, 1
jne 0x1402c0869
mov ebx, eax
jmp 0x1402c0889
invalid
mov eax, ebx
add rsp, 0x20
ja 0x1402c0834
int3
add byte [rax + 0xd], cl
and al, 0x58
mov rdi, rdx
call fcn.140308588
cmp byte [rsp + rbx + 0x58], 0
lea rax, str.SoftwareMicrosoftWindowsCurrentVersionAppReadiness
lea r8, str.OSDataSoftwareMicrosoftWindowsCurrentVersionAppReadiness
stosq qword [rdi], rax
retf
Function at 0x1402d9a38
Capabilities:
Query or enumerate registry value

Disassembly:
lea rdx, [rsp + 0x70]
rcr byte [rsi - 0x7499f501], 0xd8
test eax, eax
jne 0x1402d9a00
mov rcx, qword [rsp + 0x48]
and al, 0x48
ror byte [rbp - 0x99fdbbc], 1
mov dword [rsp + 0x38], eax
lea r9, [rdx + riz*4 - 0x31]
loope 0x1402d9a1f
and al, 0x30
add byte [rdi + rax*8 + 0x44], cl
and al, 0x70
and qword [rsp + 0x1d], 0
in al, 0xd2
and qword [rsp + 0x20], 0
mov dword [rsp + 0x40], 0x100
call qword [0x174346240]
add dword [rax], eax
add byte [rax - 1], cl
adc eax, 0x3406c860
xadd byte [rax + rax], al
lea rcx, [rdi + rdi*4 - 0x1b]
test eax, eax
je 0x1402d9994
call 0x1472bdea0
mov rdx, rsi
mov rbp, qword [rsi - 0x1b5049a]
dec dword [rbx + 0x4c8d48d8]
and al, 0x48
lea rcx, [rsp + 0x48]
call fcn.1402bdea0
mov eax, ebx
mov esp, 0x12d8d8b
add byte [rax], al
invalid
and dword [rsi], ebp
add byte [rax], al
jle 0x1402d99a6
invalid
cwde
mov esp, esi
stosq qword [rdi], rax
sbb byte [r8 - 0x7d], cl
in al, dx
xor qword [r9], 0
js 0x1402d99d6
cmp ecx, dword [r9 - 0x77]
imul ebp, eax, 0xa2058d37
or rax, qword [r8]
mov ecx, 0x7a0008
mov qword [r11 - 0x11], r9
add sil, byte [r13 - 0x28]
add byte [rbx + rcx*4 - 0x37], al
mov dword [rsp + 0x60], ecx
invalid
Function at 0x140705058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1407051df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140705089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14070506f
add dl, dl
jne 0x140705096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1407050f6
xor eax, eax
add dl, dl
jne 0x1407050a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1407051ad
add dl, dl
jne 0x1407050b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407050c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407050d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407050dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1407050ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14070507e
mov eax, 1
add dl, dl
jne 0x140705106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140705113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1407050fb
sub eax, ebx
mov ebx, 1
jne 0x14070514c
mov ecx, 1
add dl, dl
jne 0x14070512e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14070513b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140705123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14070507e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140705168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140705175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14070515d
cmp eax, 0x7d00
jae 0x14070519b
cmp eax, 0x500
jb 0x140705196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14070507e
cmp eax, 0x7f
ja 0x14070519e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14070507e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1407051d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14070507e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140001e20
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001e6a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001e6a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001e6a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001e6a
cmp dword [rcx + 0x84], 0xe
jbe 0x140001e6a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001e6c
xor al, al
add rsp, 0x28
ret

Function at 0x100403a20
Capabilities:
Encode data using xor

Disassembly:
xor al, 0x6c
xor al, 0x64
xor al, 0x67
xor al, 0x41
xor al, 0x3e
xor al, 0x7d
xor al, 0xa2
xor al, 0x9a
xor al, 0xa3
xor al, 0x88
xor al, 0x9d
xor al, 0xa4
xor al, 0x71
xor al, 0x74
xor al, 0x59
xor al, 0x87
xchg dword [rbp*4 - 0x57cb58cc], esi
xor al, 0x99
xor al, 0xa1
xor al, 0x86
xor al, 0xa3
xor al, 0xa3
movabs dword [0xa73490345934a834], eax
xor al, 0xad
xor al, 0xa7
xor al, 0xa8
xor al, 0x99
cdq
xor al, 0xa1
xor al, 0x67
xor al, 0x66
xor al, 0x90
xor al, 0xa7
xor al, 0x9c
xor al, 0x99
xor al, 0xa0
xor al, 0xa0
xor al, 0x67
xor al, 0x66
xor al, 0x62
Function at 0x2fc4d5f50
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x2fc4d6952
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4fb108]
test eax, eax
je 0x2fc4d69ea
lea rax, [0x2fc4fb0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4fb110]
mov qword [rbp - 8], rax
jmp 0x2fc4d69ce
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4d69c2
cmp qword [rbp - 0x10], 0
je 0x2fc4d69c2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4d6988
lea rax, [0x2fc4fb0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4d69eb
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4d6af0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4d6b18
mov eax, 0
jmp 0x2fc4d6b66
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4d6b41
mov eax, 0
jmp 0x2fc4d6b66
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4d6b61
mov eax, 0
jmp 0x2fc4d6b66
mov eax, 1
add rsp, 0x20
pop rbp
ret