joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42df40
Capabilities:
Hash data using murmur3

Disassembly:
cmp rsp, qword [r14 + 0x18]
jbe 0x42e1e6
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
test byte [rax], al
lea rsi, [rax + 0x16d0]
mov rcx, qword [rax + 0x16c0]
sub rcx, rsi
shr rcx, 3
cmp rcx, 0x200
ja 0x42e1da
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x30], rcx
mov qword [rax + 0x16c0], 0
cmp byte [0x008533db], 0
jne 0x42dfa2
xor edx, edx
xor ebx, ebx
nop
jmp 0x42dfeb
xor edx, edx
jmp 0x42dfce
mov qword [rsp + 0x28], rdx
mov rcx, qword [rax + rdx*8 + 0x16d0]
mov rax, rcx
call fcn.0041e5e0
mov rcx, qword [rsp + 0x28]
lea rdx, [rcx + 1]
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
cmp rdx, rcx
jl 0x42dfa6
add rax, 0x16c0
call fcn.0042de00
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
inc rdx
cmp rdx, rcx
jge 0x42e172
mov rsi, qword [rax + rdx*8 + 0x16d0]
nop dword [rax]
cmp rsi, 0x1000
jb 0x42dfe8
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rbx
mov rax, rsi
xor ebx, ebx
mov rcx, rbx
nop dword [rax + rax]
call fcn.00413540
test rax, rax
jne 0x42e042
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
nop
jmp 0x42dfe8
nop
mov rsi, rcx
shr rcx, 3
and rsi, 7
mov rdx, rcx
mov rcx, rsi
mov r8d, 1
shl r8d, cl
nop
add rdx, qword [rbx + 0x50]
movzx esi, byte [rdx]
test r8b, sil
je 0x42e085
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
nop
jmp 0x42dfe8
nop
lock or byte [rdx], r8b
nop
nop
mov rcx, qword [rbx + 0x18]
nop
movabs rsi, 0x800000000000
lea r8, [rsi + rcx]
mov r9, r8
shr r8, 0x2a
cmp r8, 0x40
jae 0x42e1cd
lea r10, [0x00825838]
mov r8, qword [r10 + r8*8]
shr r9, 0x16
and r9, 0xfffff
mov r9, qword [r8 + r9*8]
test byte [r9], al
test byte [r8], al
mov r8, rcx
shr rcx, 0x10
and rcx, 0x3f
movzx r10d, byte [r9 + rcx + 0x21040]
lea r9, [r9 + rcx]
lea r9, [r9 + 0x21040]
shr r8, 0xd
and r8, 7
mov rcx, r8
mov r8d, 1
shl r8d, cl
test r8b, r10b
jne 0x42e10c
lock or byte [r9], r8b
movzx r8d, byte [rbx + 0x62]
test r8b, 1
je 0x42e145
mov r8, qword [rsp + 0x48]
mov r9, qword [r8 + 0x16a8]
add r9, qword [rbx + 0x68]
mov qword [r8 + 0x16a8], r9
mov rax, r8
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
jmp 0x42dfe8
mov r8, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
cmp r8, rcx
jae 0x42e1c5
mov r9, qword [rsp + 0x48]
mov qword [r9 + r8*8 + 0x16d0], rax
lea rbx, [r8 + 1]
mov rax, r9
mov rdx, qword [rsp + 0x28]
jmp 0x42dfe8
cmp rbx, 0x200
ja 0x42e1b7
lea rdx, [rax + 0x16d0]
lea rsi, [rax + 0x1698]
mov rcx, rbx
mov edi, 0x200
mov rbx, rdx
mov rax, rsi
call fcn.00423ca0
mov rdx, qword [rsp + 0x48]
lea rax, [rdx + 0x16c0]
call fcn.0042de00
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov rcx, rbx
mov edx, 0x200
nop
call fcn.00462cc0
mov rax, r8
call fcn.00462c40
mov rax, r8
mov ecx, 0x40
call fcn.00462c60
mov edx, 0x200
nop
call fcn.00462ca0
nop
mov qword [rsp + 8], rax
call fcn.00464c80
mov rax, qword [rsp + 8]
jmp fcn.0042df40
Function at 0x4500c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov qword [rsp + 0x20], rax
test rbx, rbx
jbe 0x450238
movzx edx, byte [rax]
nop
test edx, edx
jne 0x4500fc
test r8b, r8b
jne 0x4500fc
xor eax, eax
xor ebx, ebx
mov rcx, rbx
xor edi, edi
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
bt edx, 7
jae 0x45010f
xor edx, edx
xor r8d, r8d
xor r9d, r9d
jmp 0x4501f8
mov r8d, 1
mov r9d, edx
and edx, 1
neg edx
shr r9d, 1
xor edx, r9d
add dword [rsi], edx
cmp rbx, r8
jb 0x4501e6
sub rbx, r8
sub rcx, r8
mov rdx, rcx
neg rcx
sar rcx, 0x3f
and r8, rcx
lea rsi, [rax + r8]
test rbx, rbx
jbe 0x4501dc
movzx r8d, byte [rax + r8]
bt r8d, 7
jae 0x450163
xor eax, eax
xor ecx, ecx
xor r8d, r8d
jmp 0x4501a6
mov eax, 1
cmp rax, rbx
ja 0x450195
add qword [rdi], r8
sub rdx, rax
sub rbx, rax
mov rcx, rdx
neg rdx
sar rdx, 0x3f
and rax, rdx
add rax, rsi
mov edi, 1
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov rcx, rbx
call fcn.00462d00
lea r8d, [rcx + 7]
mov ecx, eax
mov eax, r10d
cmp rax, rbx
jae 0x4501d4
movzx r9d, byte [rax + rsi]
lea r10d, [rax + 1]
mov r11d, r9d
and r9d, 0x7f
mov eax, ecx
mov ecx, r8d
shl r9d, cl
or eax, r9d
test r11b, 0x80
jne 0x45019d
mov r8d, eax
mov eax, r10d
jmp 0x450168
mov rcx, rbx
call fcn.00462c40
xor eax, eax
mov rcx, rbx
call fcn.00462c40
mov eax, r8d
mov rcx, rbx
call fcn.00462d00
lea r9d, [rcx + 7]
mov rcx, r12
cmp rbx, rdx
jbe 0x45022e
movzx r10d, byte [rdx + rax]
inc edx
mov r11d, r10d
and r10d, 0x7f
mov r12, rcx
mov ecx, r9d
shl r10d, cl
or r8d, r10d
test r11b, 0x80
jne 0x4501f1
mov rcx, r12
mov r9d, edx
mov edx, r8d
mov r8d, r9d
jmp 0x450115
mov eax, edx
mov rcx, rbx
call fcn.00462c40
xor eax, eax
mov rcx, rbx
nop dword [rax]
call fcn.00462c40
nop
int3
Function at 0x457a40
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x457b0a
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov qword [rsp + 0x70], rbx
mov qword [rsp + 8], 0
mov qword [rsp + 0x10], 0
lea rdx, [rsp + 0x18]
movups xmmword [rdx], xmm15
lea rdx, [rsp + 0x28]
movups xmmword [rdx], xmm15
lea rdx, [rsp + 0x38]
movups xmmword [rdx], xmm15
lea rdx, [rsp + 0x48]
movups xmmword [rdx], xmm15
lea rdx, [0x00457b40]
mov qword [rsp + 0x10], rdx
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x18], rdx
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x20], rdx
mov rdx, r14
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rdi
lea rax, [rsp + 8]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.00460400
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
nop
call fcn.00460540
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00457a40

Function at 0x45eb40
Capabilities:
Access peb ldr_data

Disassembly:
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov r13, 0
mov qword [rsp + 0x20], r13
mov byte [rsp + 0x17], 0
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x70], 0
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
mov rcx, qword [rcx + 0x30]
nop
inc dword [rcx + 0x244]
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
mov rdx, qword [rcx + 0x30]
nop
mov rsi, rcx
mov qword [rdx + 0x138], rcx
mov rcx, qword [rsi + 0x30]
mov qword [rsi + 0xe8], rcx
lea rcx, fcn.00441040
mov qword [rsp + 0x20], rcx
mov byte [rsp + 0x17], 1
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
mov rcx, qword [rcx + 0x30]
mov qword [rsp + 0x18], rcx
mov rdx, qword [rsp + 0x38]
mov qword [rcx + 0x2e0], rdx
mov rdx, qword [rsp + 0x40]
mov qword [rcx + 0x2e8], rdx
lea rdx, [rsp + 0x48]
mov qword [rcx + 0x2f0], rdx
lea rbx, [rcx + 0x2e0]
mov rax, qword [0x007fd6a0]
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
call fcn.00403de0
mov rcx, qword [rsp + 0x18]
mov rdx, qword [rcx + 0x2f8]
mov rsi, qword [rcx + 0x300]
mov rcx, qword [rcx + 0x308]
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x70], rcx
mov byte [rsp + 0x17], 0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
call fcn.00441040
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
Function at 0x4626e0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, qword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x008537a0]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
nop
nop
xor rax, rdx
ret
cmp byte [0x008533da], 0
je 0x462716
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x00853a20]
aesenc xmm0, xmmword [0x00853a30]
aesenc xmm0, xmmword [0x00853a40]
movq rax, xmm0
ret
jmp 0x409980

Function at 0x464080
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x30
mov rcx, 0xfffffffffffffff4
mov qword [rsp], rcx
mov rax, qword [sym.imp.KERNEL32.DLL_GetStdHandle]
call rax
mov rcx, rax
mov qword [rsp], rcx
lea rdx, [0x008539a0]
mov qword [rsp + 8], rdx
lea r8d, [0x008533f8]
mov qword [rsp + 0x10], r8
lea r9, [rsp + 0x28]
mov qword [r9], 0
mov qword [rsp + 0x18], r9
mov qword [rsp + 0x20], 0
mov rax, qword [sym.imp.KERNEL32.DLL_WriteFile]
call rax
call fcn.004625e0
add rsp, 0x30
ret

Function at 0x464f60
Capabilities:
Access peb ldr_data

Disassembly:
sub rsp, 0x78
mov qword [rsp + 0x70], rbp
lea rbp, [rsp + 0x70]
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x30], r9
mov qword [rsp + 0x38], r10
mov qword [rsp + 0x40], r11
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x50], rax
call fcn.0045ee20
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret

Function at 0x465000
Capabilities:
Access peb ldr_data

Disassembly:
sub rsp, 0x90
mov qword [rsp + 0x88], rbp
lea rbp, [rsp + 0x88]
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x30], r9
mov qword [rsp + 0x38], r10
mov qword [rsp + 0x40], r11
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x68], rax
call fcn.0045ef60
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x88]
add rsp, 0x90
ret
Function at 0x509c40
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [rsp + 8]
mov rax, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x18]
mov rdx, qword [rsp + 0x20]
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
add rbx, 0x10
pxor xmm4, xmm4
cmp ecx, 0xc
je 0x509d10
jb 0x509d6f
movups xmm2, xmmword [rax + 0x10]
movups xmmword [rbx], xmm2
add rbx, 0x10
aeskeygenassist xmm1, xmm2, 1
call fcn.00509a60
aeskeygenassist xmm1, xmm0, 1
call fcn.00509a80
aeskeygenassist xmm1, xmm2, 2
call fcn.00509a60
aeskeygenassist xmm1, xmm0, 2
call fcn.00509a80
aeskeygenassist xmm1, xmm2, 4
call fcn.00509a60
aeskeygenassist xmm1, xmm0, 4
call fcn.00509a80
aeskeygenassist xmm1, xmm2, 8
call fcn.00509a60
aeskeygenassist xmm1, xmm0, 8
call fcn.00509a80
aeskeygenassist xmm1, xmm2, 0x10
call fcn.00509a60
aeskeygenassist xmm1, xmm0, 0x10
call fcn.00509a80
aeskeygenassist xmm1, xmm2, 0x20
call fcn.00509a60
aeskeygenassist xmm1, xmm0, 0x20
call fcn.00509a80
aeskeygenassist xmm1, xmm2, 0x40
call fcn.00509a60
jmp 0x509ddd
movq xmm2, qword [rax + 0x10]
aeskeygenassist xmm1, xmm2, 1
call fcn.005099c0
aeskeygenassist xmm1, xmm2, 2
call fcn.00509a20
aeskeygenassist xmm1, xmm2, 4
call fcn.005099c0
aeskeygenassist xmm1, xmm2, 8
call fcn.00509a20
aeskeygenassist xmm1, xmm2, 0x10
call fcn.005099c0
aeskeygenassist xmm1, xmm2, 0x20
call fcn.00509a20
aeskeygenassist xmm1, xmm2, 0x40
call fcn.005099c0
aeskeygenassist xmm1, xmm2, 0x80
call fcn.00509a20
jmp 0x509ddd
aeskeygenassist xmm1, xmm0, 1
call fcn.00509980
aeskeygenassist xmm1, xmm0, 2
call fcn.00509980
aeskeygenassist xmm1, xmm0, 4
call fcn.00509980
aeskeygenassist xmm1, xmm0, 8
call fcn.00509980
aeskeygenassist xmm1, xmm0, 0x10
call fcn.00509980
aeskeygenassist xmm1, xmm0, 0x20
call fcn.00509980
aeskeygenassist xmm1, xmm0, 0x40
call fcn.00509980
aeskeygenassist xmm1, xmm0, 0x80
call fcn.00509980
aeskeygenassist xmm1, xmm0, 0x1b
call fcn.00509980
aeskeygenassist xmm1, xmm0, 0x36
call fcn.00509980
sub rbx, 0x10
movups xmm1, xmmword [rbx]
movups xmmword [rdx], xmm1
dec rcx
movups xmm1, xmmword [rbx - 0x10]
aesimc xmm0, xmm1
movups xmmword [rdx + 0x10], xmm0
sub rbx, 0x10
add rdx, 0x10
dec rcx
jne 0x509dea
movups xmm0, xmmword [rbx - 0x10]
movups xmmword [rdx + 0x10], xmm0
ret
Function at 0x140fb9058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.140fb91df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140fb9089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140fb906f
add dl, dl
jne 0x140fb9096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140fb90f6
xor eax, eax
add dl, dl
jne 0x140fb90a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140fb91ad
add dl, dl
jne 0x140fb90b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140fb90c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140fb90d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140fb90dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140fb90ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140fb907e
mov eax, 1
add dl, dl
jne 0x140fb9106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140fb9113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140fb90fb
sub eax, ebx
mov ebx, 1
jne 0x140fb914c
mov ecx, 1
add dl, dl
jne 0x140fb912e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140fb913b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140fb9123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140fb907e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140fb9168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140fb9175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140fb915d
cmp eax, 0x7d00
jae 0x140fb919b
cmp eax, 0x500
jb 0x140fb9196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140fb907e
cmp eax, 0x7f
ja 0x140fb919e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140fb907e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140fb91d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140fb907e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20

Function at 0x140135d75
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp], r10
jmp 0x140174556
add r9, 0xa
shld rdi, rdx, cl
mov qword [r9], rdi
call fcn.140162875
push r11
lea r10, [0x140136170]
mov r11d, 0xe88c689
movzx r11d, byte [rbp + r11*4 - 0x3a231a24]
push 0x7f9106b7
xor r11d, ebx
and r11d, 0xff
mov r11d, dword [r10 + r11*4]
shr ebx, 8
rol word [rsp + 6], 0xc9
xor ebx, r11d
sar dword [rsp + 1], 0x3e
shr byte [rsp + 2], 0x67
inc rbp
xor ebx, 0xc291732d
shr byte [rsp + 1], 0xe1
dec rcx
push 0x259dada6
lea rsp, [rsp + 0x10]
jne 0x14017455f
pop r11
mov r10d, 0x2082bab2
call fcn.1401718fb
push 0xffffffffff38e726
call fcn.14016b917
mov edi, 0x5413e784
rol edi, 0x73
mov rdi, qword [r9 + rdi*2 - 0x7845413e]
mov rdx, qword [r9 + 8]
mov ecx, 0x99a6cb83
neg cx
mov cl, byte [r9 + 0x10]
jns 0x14015e1e3
Function at 0x1805a1058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1805a11df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1805a1089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1805a106f
add dl, dl
jne 0x1805a1096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1805a10f6
xor eax, eax
add dl, dl
jne 0x1805a10a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1805a11ad
add dl, dl
jne 0x1805a10b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1805a10c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1805a10d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1805a10dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1805a10ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1805a107e
mov eax, 1
add dl, dl
jne 0x1805a1106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1805a1113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1805a10fb
sub eax, ebx
mov ebx, 1
jne 0x1805a114c
mov ecx, 1
add dl, dl
jne 0x1805a112e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1805a113b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1805a1123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1805a107e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1805a1168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1805a1175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1805a115d
cmp eax, 0x7d00
jae 0x1805a119b
cmp eax, 0x500
jb 0x1805a1196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1805a107e
cmp eax, 0x7f
ja 0x1805a119e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1805a107e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1805a11d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1805a107e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20

Function at 0x18067a4a4
Capabilities:
Encode data using xor

Disassembly:
test rsi, rsi
jmp 0x1806855c2
mov rsi, qword [r11 + 8]
add r11, 0xc
xor ecx, ecx
mov qword [rsp], 0x269d6c3c
jmp 0x180663857
lea rsp, [rsp + 0x10]
je 0x180684413
mov eax, 0x1b9bb03b
jmp 0x18066f80d
Function at 0x140001194
Capabilities:
Create directory

Disassembly:
mov eax, 0x3bf255f0
mov rcx, qword [rsp + 0x48]
and al, 0x48

Function at 0x1400011a0
Capabilities:
Create directory

Disassembly:
and al, 0x3c
xor eax, 0x8b02fe61
inc byte [rdx]
invalid
push rsp

Function at 0x1400011c4
Capabilities:
Create directory

Disassembly:
add bh, bh
ror byte [rax - 0x73], 1
lea ecx, str.:
mov rax, qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
add eax, 0x4e7b
xor edx, edx
call rax
ror byte [rax - 0x75], 1
or eax, 0x4e78
js sym.DUI70.dll_public:_void___cdecl_DirectUI::StyleSheet::constructor_void____ptr64
add byte [rax], al

Function at 0x140001228
Capabilities:
Create directory

Disassembly:
mov rdx, qword [rsp + 0x30]
mov qword [rsp + 0x20], rcx
and al, 0x20
invalid
invalid

Function at 0x140001230
Capabilities:
Create directory

Disassembly:
mov rdx, qword [rsp + 0x30]
mov qword [rsp + 0x20], rcx
and al, 0x20
invalid
invalid

Function at 0x140001240
Capabilities:
Create directory

Disassembly:
ror dword [rax - 0x2d], 1
loop 0x140001281
invalid
mov dword [rsp + 0x48], edx
mov rdx, qword [rsp + 0x40]
and al, 0x40
invalid
invalid

Function at 0x14000124c
Capabilities:
Create directory

Disassembly:
cmp byte [0x18169b633], ah
mov dword [rsp + 0x54], eax
mov r8, qword [rsp + 0x20]
and al, 0x20

Function at 0x140001250
Capabilities:
Create directory

Disassembly:
cmp byte [0x18169b633], ah
mov dword [rsp + 0x54], eax
mov r8, qword [rsp + 0x20]
and al, 0x20

Function at 0x1400012a8
Capabilities:
Terminate process

Disassembly:
add byte [rcx], dh
invalid
mov ecx, eax
ror dword [rax - 0x73], 0x94

Function at 0x1400012e0
Capabilities:
Terminate process

Disassembly:
cwde
add al, byte [rax]
add byte [rax - 0x39], cl
invalid
invalid
test byte [rax + rbx*4], ah
cwde

Function at 0x1400012e4
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x298], 0x2921e42d

Function at 0x1400012e8
Capabilities:
Terminate process

Disassembly:
cwde
add al, byte [rax]
add byte [0x18c2934d5], ch
sub eax, 0x4c2921e4
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
add byte [r8], r8b

Function at 0x1400012f4
Capabilities:
Terminate process

Disassembly:
add byte [r8], r8b
xor eax, eax
mov esi, eax
mov qword [rsp + 0x70], rcx
mov dword [rsp + 0x70], ecx

Function at 0x14000134c
Capabilities:
Terminate process

Disassembly:
jl 0x140001392
mov edx, dword [sym.imp.KERNEL32.dll_GetBinaryTypeW]
invalid
invalid

Function at 0x140001350
Capabilities:
Terminate process

Disassembly:
lea r9, [rsp + 0x7c]
mov r10, qword [rsp + 0x60]

Function at 0x140001358
Capabilities:
Terminate process

Disassembly:
and al, 0x60
mov qword [rsp + 0x38], rcx
mov rcx, r10
mov qword [rsp + 0x30], rdx
invalid
Function at 0x1400037f0
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x80
xor eax, eax
mov dword [rsp + 0x6c], 0x6669cab2
mov r9d, dword [rsp + 0x6c]
xor r9d, 0x6669cab2
mov r10d, r8d
xor r10d, 0xffffffff
mov dword [rsp + 0x7c], r10d
cmp r8d, r9d
mov qword [rsp + 0x60], rdx
mov dword [rsp + 0x5c], r8d
mov qword [rsp + 0x50], rcx
mov dword [rsp + 0x4c], eax
je 0x1400038a4
mov eax, dword [rsp + 0x4c]
lea rcx, [0x1400252c0]
mov edx, eax
and edx, 0xf
mov edx, edx
mov r8d, edx
mov edx, dword [rsp + 0x6c]
xor edx, 0x6669cab3
mov r9, qword [rsp + 0x50]
mov qword [rsp + 0x40], rcx
mov rcx, r9
mov r10, qword [rsp + 0x60]
mov dword [rsp + 0x3c], edx
mov rdx, r10
mov qword [rsp + 0x30], r8
mov r8d, eax
mov r11, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x30]
movzx r9d, byte [r11 + rsi]
mov dword [rsp + 0x2c], eax
call sym.DUI70.dll_public:_void___cdecl_DirectUI::ScrollBar::constructor_void____ptr64
mov eax, dword [rsp + 0x2c]
mov r8d, dword [rsp + 0x3c]
add eax, r8d
mov r8d, dword [rsp + 0x5c]
cmp eax, r8d
mov dword [rsp + 0x4c], eax
jne 0x140003832
add rsp, 0x80
pop rsi
ret

Function at 0x140003980
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x48
mov eax, 0x173a69d7
mov edx, 0x4223d576
mov dword [rsp + 0x3c], 0x25b1be8b
sub edx, dword [rsp + 0x3c]
mov dword [rsp + 0x38], edx
mov edx, dword [rsp + 0x38]
add edx, 0x496e9615
mov r8d, dword [rcx + 0x3c]
mov qword [rsp + 0x40], 0x3a880ee1
movsxd r9, r8d
mov r10, rcx
add r10, r9
mov r8d, dword [rcx + r9]
cmp eax, edx
mov qword [rsp + 0x30], r10
mov dword [rsp + 0x2c], r8d
jae 0x1400039f3
xor eax, eax
mov ecx, dword [rsp + 0x2c]
sub ecx, 0x4550
mov edx, eax
mov r8, qword [rsp + 0x30]
cmove rdx, r8
mov rax, rdx
mov dword [rsp + 0x28], ecx
add rsp, 0x48
ret
mov rax, qword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, 0x3a59ad19
call rax
xor ecx, ecx
mov eax, ecx
add rsp, 0x48
ret
Function at 0x140001378
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [0x1400c90a0]
mov dword [rax], 1
mov rax, qword [0x1400c90b0]
mov dword [rax], 1
mov rax, qword [0x1400c90c0]
mov dword [rax], 1
mov rax, qword [0x1400c9020]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400013c9
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x1400013f5
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
movzx eax, ax
cmp eax, 0x10b
je 0x14000141b
cmp eax, 0x20b
je 0x140001442
jmp 0x140001471
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x5c]
cmp eax, 0xe
ja 0x14000142e
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x6c]
cmp eax, 0xe
ja 0x14000145d
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov eax, 0
add rsp, 0x20
pop rbp
ret