joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14029d610
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
lea rcx, [rsp + rcx + 0x10]
mov rsi, qword [rcx + rsi*8 - 0x460]
dec byte [rsp + rdx - 0x5061c]
shr qword [rsp + rdx*8 - 0x283100], 0xe7
lea r10, [rdx + r10 - 0x50629]
inc dword [rsp + rdx - 0x50621]
mov qword [r10 + rdx - 0x50621], rsi
call fcn.140273deb
xor edx, 0x53be3f28
inc edx
bt r8w, r10w
xchg r10d, ecx
push rbp
movsx ebp, r8w
sub r11, rcx
jne 0x1401e8f70
xor dword [rsp + r8 - 0x42a5252a], edx
shr ecx, 0xaa
jnp fcn.140171fdc
jbe 0x140272bf0
pop rbp
shr r11b, 0x83
sar al, 0x61
movsxd rdx, edx
add rdi, rdx
lea rdx, [rcx + rax*8 + 0x7abb4525]
or cx, word [rsi + r8 - 0x42a5252a]
call fcn.14020ecc3
lea rsi, [rdx + rsi - 0xf623]
shrd ax, r9w, cl
mov word [rsi + rdx*4 - 0x3d89c], ax
mov r11d, 0xb384c99a
jmp rdi
sar edx, 0x68
rol cx, 1
add cx, 0xdcbc
neg ebp
mov qword [rsp + rdx - 0x50621], rbp
jo 0x1402d15cc
not cx
shr qword [rsp + rsi*4 - 0x22e], 0x3e
setb byte [rsp + rsi - 0x81]
xor bx, cx
jmp 0x1401d3118

Function at 0x14029efc9
Capabilities:
Authenticate hmac

Disassembly:
mov qword [rsp + rdx*4 + 0x3b887d48], r9
ret 0x20
adc r9, rax
lea rdi, [r8 + rbx*4 + 0x441e09a5]
jmp 0x140216915
mov rsi, qword [rsp + rdi*2 - 0x17c06]
or r10b, bl
movsxd rax, eax
pop rdi
jae 0x140290593

Function at 0x14029f01e
Capabilities:
Authenticate hmac

Disassembly:
xor dword [rsp + rcx*4 - 0x40000], ebp
jmp 0x1402994aa
pop r11
xor rsi, rdx
movsxd rbp, ebp
adc r9, rbp
rol si, 0xcf
cqo
jae fcn.140196815
btc ecx, 0x30
mov qword [rsp + rcx*2 - 0x2015c], r11
lea rsi, [rax*4 + 0x5596cf11]
xchg cx, ax
jae 0x14025b2c6
Function at 0x1402be850
Capabilities:
Authenticate hmac

Disassembly:
dec cx
xor cx, 0x48a8
add cx, 0x4bbf
mov qword [rsp], rdi
lea r11, [rdi + rdi*4 - 0x4cf0e76b]
movsx esi, dil
neg cx
lea rax, [rsi + rdi - 0x63584b75]
add dword [rsp + rsi - 0x2f], 0xe1115701
xor r9w, cx
movzx edx, word [rsp + rsi - 0x2e]
lea rbx, [rsi + rbx - 0x31]
ror r11b, 0xe7
movzx ebp, ax
call fcn.1401907c5

Function at 0x1402c6683
Capabilities:
Authenticate hmac

Disassembly:
mov edi, 0xdea2af25
movzx eax, di
pop rsi
lea r10, [rax + rax*2 - 0x32d2e0f2]
lea rsi, [rax + rsi - 0xaf2a]
lea rbx, [rbx + r10 + 0x32d0d37f]
movsx r9d, di
cdqe
mov eax, dword [rbx + rax*2 - 0x15e4a]
movzx r11d, r9b
btc di, 0xa8

Function at 0x1402cb289
Capabilities:
Authenticate hmac

Disassembly:
movzx edx, cx
lea r8, [r8 + r10*2 - 0x476]
adc ebx, r9d
call fcn.140308cb6
adc r9, rbp
movsx r8d, dx
mov dx, word [r10 + rax - 0x2600]
mov qword [rsp + rax*2 - 0x4bf8], rax
mov cl, byte [r10 + rax*8 - 0x12ffe]
push rsi
lea r10, [r10 + rax*2 - 0x4bfe]
shr dx, cl
mov ebx, dword [rsp + rax - 0x25e5]
xchg qword [rsp + rax - 0x25e8], rbx
add dword [rsp + rax*2 - 0x4beb], r8d
mov word [rax + r10 - 0x2600], dx
movsx edx, si
mov qword [rsp + rax - 0x2600], r9
ret 0x20
lea rdx, [rax + rsi*8 + 0x2883d27]
movsxd rcx, ecx
add r10, rcx
pop rax
pop rdx
pop rax
jmp fcn.1401c0627
inc si
sal ebx, 0x70
sbb byte [rsp + rbx*8 + 3], r8b
neg si
pop rbx
sar r8d, 0x39
xor si, 0x408a
call fcn.1401e1ce3
add r8, 2
mov ebp, ecx
movzx ebx, byte [rdi]
movzx eax, cx
lea rdx, [rcx + rcx + 0x2e324b11]
call fcn.14017f3d9
movzx esi, ax
mov r9, qword [rsp + rbp*2 - 0x5fbe]
jmp 0x1401eaf68
xor dword [rsp + rsi*2 - 0xe4a8], ebp
cwde
mov r11, qword [rsp + rax*2 - 0x4be8]
movsxd rbp, ebp
and rsi, 0xffffffff9bb414a0
jnp 0x1401e679d
jns 0x1401ebb11
lea rbp, [rax*4 - 0x3945d8c7]
xor dword [rsp + rcx - 0x7065f715], r8d
btc rcx, rdx
mul byte [rsp + rcx - 0x6065f71b]
mov r11, qword [rsp + rbx*2 - 0x17065ee]
movsxd r8, r8d
add r9, r8
ror bl, 0xe7
movzx bx, byte [r10 + rcx - 0x6065f71d]
lea rsi, [rcx + rbp*4 - 0x31d288ea]
mov cl, byte [r10 + rcx - 0x6065f71b]
inc byte [rsp + 3]
btc ebp, 0x36
lea r10, [r10 + rbp*2 - 0x4fa08bc0]
call fcn.14019ea26
mov eax, 0x7134b98
lea r10, [rax + rax*4 + 0x4101f807]
lea r8, [rax + rax*2 + 0x3004589b]
lea rbx, [rbx + rax*2 - 0xe269734]
cdq
mov ecx, dword [rbx + rax*4 - 0x1c4d2e60]
movzx r9d, r10b
cwde
xor ecx, ebp
sub r10b, 0x80
mov r11d, r8d
not ecx
cbw
shr r10, 0x9c
ror ecx, 3
call fcn.1402d3894
ror byte [rsp + r10 - 0x237], 6
mov r9d, dword [r10 + r8 - 0x239]
jae 0x14019f862
mov r9w, word [r8]
mov ecx, 0x9a27e02f
jmp 0x14021effd

Function at 0x1402cc6d9
Capabilities:
Authenticate hmac

Disassembly:
pop rax
pop rdi
pop r11
pop r10
pop rcx
pop rdx
pop r10
jns fcn.14015fcee

Function at 0x1402ecc55
Capabilities:
Authenticate hmac

Disassembly:
xor edx, 0x71cd68f
mov qword [rsp + r9*2 - 0x1d265eb6], rsi
lea rbp, [rbx + rbx*8 + 0x5d842302]
not r10
xor dword [rsp + r9*2 - 0x1d265eb6], edx
btc ebp, ebx
pop rsi
ror rcx, 1
dec bp
movsxd rdx, edx
ror cx, 0xeb
xchg r10, rbp
call fcn.14018a2b7
Function at 0x1402f6b28
Capabilities:
Encode data using base64

Disassembly:
mov ecx, dword [rsp + rsi*2]
lea r9, [r9 + rsi*4 - 7]
xchg esi, edx
xor bpl, bl
call fcn.1402e977a
mov ax, word [r11 + r10 + 0x7a4f4452]
sal ebp, 0xc4
adc r10, rsi
and byte [rsp + r11 + 0x7a4f4454], 0xa
adc bpl, byte [rsp + r11 + 0x7a4f4457]
and byte [rsp + r11 + 0x7a4f4458], 0x84
movzx ebp, byte [r11 + r9 + 0x7a4f4452]
je 0x1401abae0
movsxd rcx, ecx
mov edi, 0xb2158e96
mov qword [rsp + r11 + 0x7a4f4452], 0x5590df32
add r8, rcx
not dword [rsp + rbp - 0x14]
sar word [rsp + r11 + 0x7a4f4454], 3
jp 0x1402515d7

Function at 0x1402f6b53
Capabilities:
Encode data using base64

Disassembly:
ror qword [rsp + rdi - 0x243342b3], 0x70
lea rbx, [rdi + rbx - 0x243342bf]
lea r9, [r11 + rax*8 + 0x5920af00]
call fcn.14024445a
mov ebx, 0xc6860395
mov eax, 0xaabf8f9d
movzx ebp, bl
mov ebx, dword [r11 + rbp*2 - 0x12a]
or rax, 0xffffffffc92ffa03
jne 0x140308bfe
adc rsi, r9
call fcn.14026bc9d
shrd r11, rbp, cl
lea rax, [rsi + rax*2 + 0x35242fb9]
and sil, 0x8d
mov qword [rbx + rsi*4 - 0x6819010], r11
mov qword [rsp + rsi*2 - 0x340c808], r10
ret
xor ebx, r10d
not si
lea ebx, [rbx + rax*2 + 0x55b0fb7b]
lea rcx, [rbp*4 - 0x1c4ffadc]
lea rdx, [rbp + 0x24bc5a14]
ror ebx, 3
not ebx
ror ebx, 2
shr cl, 2
movsx r8d, si
btc ecx, edx
push r10
xor dword [rsp + rax + 0x14400061], ebx
pop r10
movsxd rbx, ebx
push rbp
inc qword [rsp + rax*2 + 0x288000c2]
add r9, rbx
mul cl
mov r8d, dword [rdi + rax*2 + 0x2881dabc]
dec al
mov cl, byte [rdi + rax + 0x1440ed63]
call fcn.1401c52c8
ror r9w, 1
mov qword [rsp + r11 - 0x61b3577d], r11
shr dword [rsp + rdi - 0x243342b9], 0x3c
xor bp, r9w
push rdi
lea r8, [r11 + r8 - 0x61b3577f]
cdq
shl edx, 0xdd
xadd word [rsp + rdi - 0x243342ae], dx
mov word [rdx + r8], r9w
jge 0x1401df0a6
call fcn.1402b7820
jns 0x1401ef937
xor sil, r10b
lea r8, [r8*8 + 0x11237f00]
pop rdx
lea rbp, [rax + rbp - 0xae]
call fcn.1402bab5a
movzx esi, bp
lea r11, [r11 + rax + 0x14400065]
jae 0x14027bc1d
Function at 0x50364d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 0x18], r8
mov qword [rax + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x148]
sub rsp, 0x208
movsxd r14, dword [rdx + 0x3c]
mov rbx, rdx
mov eax, dword [r14 + rdx + 0x88]
test eax, eax
je 0x503724
lea rdi, [rdx + rax]
mov esi, dword [rdi + 0x18]
test esi, esi
je 0x503724
mov r8d, dword [rdi + 0xc]
xor ecx, ecx
mov eax, dword [rdi + 0x20]
add r8, rdx
mov r12d, dword [rdi + 0x1c]
add rax, rdx
mov r13d, dword [rdi + 0x24]
add r12, rdx
mov qword [rbp + 0x158], rax
add r13, rdx
mov al, byte [r8]
test al, al
je 0x5036db
xor edx, edx
inc ecx
or al, 0x20
mov byte [rbp + rdx - 0x10], al
mov edx, ecx
mov al, byte [rcx + r8]
test al, al
jne 0x5036c9
mov byte [rbp + rcx - 0x10], 0
mov rdx, r9
lea rcx, [rbp - 0x10]
call fcn.00505bb5
mov qword [rsp + 0x20], rax
mov rax, qword [rbp + 0x158]
lea ecx, [rsi - 1]
mov rdx, qword [rbp + 0x168]
mov esi, ecx
mov r15d, ecx
mov ecx, dword [rax + rcx*4]
add rcx, rbx
call fcn.00505bb5
xor rax, qword [rsp + 0x20]
cmp rax, qword [rbp + 0x160]
je 0x50373a
test esi, esi
jne 0x5036f1
xor eax, eax
add rsp, 0x208
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
movzx eax, word [r13 + r15*2]
mov r8d, dword [r12 + rax*4]
add r8, rbx
cmp r8, rdi
jb 0x5037fa
mov eax, dword [r14 + rbx + 0x8c]
add rax, rdi
cmp r8, rax
jae 0x5037fa
xor r10d, r10d
mov r9d, r10d
cmp byte [r8], r10b
je 0x50378e
cmp r9d, 0x3c
jae 0x50378e
mov eax, r9d
mov cl, byte [rax + r8]
mov byte [rsp + rax + 0x30], cl
cmp cl, 0x2e
je 0x50378e
inc r9d
cmp byte [r9 + r8], r10b
jne 0x50376f
lea eax, [r9 + 1]
mov edx, eax
mov byte [rsp + rax + 0x30], 0x64
lea eax, [r9 + 2]
mov byte [rsp + rax + 0x30], 0x6c
lea eax, [r9 + 3]
mov byte [rsp + rax + 0x30], 0x6c
lea eax, [r9 + 4]
lea r9, [rdx + r8]
mov byte [rsp + rax + 0x30], r10b
mov edx, r10d
cmp byte [r9], r10b
je 0x5037d7
cmp edx, 0x7f
jae 0x5037d7
mov ecx, edx
inc edx
mov al, byte [rcx + r9]
mov byte [rsp + rcx + 0x70], al
cmp byte [rdx + r9], r10b
jne 0x5037c0
mov rcx, qword [rbp + 0x150]
lea r9, [rsp + 0x70]
mov eax, edx
lea r8, [rsp + 0x30]
mov rdx, rbx
mov byte [rsp + rax + 0x70], r10b
call fcn.00503805
mov r8, rax
mov rax, r8
jmp 0x503726
Function at 0x503805
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rax, qword gs:[0x30]
xor r11d, r11d
mov rsi, r9
mov r14, r8
mov rbp, rdx
mov rdi, rcx
mov r10, qword [rax + 0x60]
mov rax, qword [r10 + 0x18]
mov rbx, qword [rax + 0x10]
cmp qword [rbx + 0x30], r11
je 0x503876
test r11, r11
jne 0x503897
mov rdx, qword [rbx + 0x30]
cmp rdx, rbp
je 0x503867
xor r9d, r9d
mov r8, rsi
mov rcx, rdi
call fcn.00505999
mov r11, rax
mov rbx, qword [rbx]
cmp qword [rbx + 0x30], 0
jne 0x503848
test r11, r11
jne 0x503897
mov rdx, r14
mov rcx, rdi
call fcn.005058b1
test rax, rax
je 0x503894
mov rdx, rsi
mov rcx, rax
call qword [rdi + 0x38]
mov r11, rax
jmp 0x503897
xor r11d, r11d
mov rbx, qword [rsp + 0x30]
mov rax, r11
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x505655
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xb0
mov rax, qword gs:[0x30]
mov rsi, rcx
add rcx, 0x348
mov rbp, rdx
mov r15, qword [rax + 0x60]
call qword [rsi + 0x40]
xor ecx, ecx
movsxd r9, dword [rax + 0x3c]
add r9, rax
movzx r10d, word [r9 + 0x14]
movzx r8d, word [r9 + 6]
add r10, r9
test r8d, r8d
je 0x5056c5
mov r9d, dword [rsi + 0x340]
lea rdx, [rcx + rcx*4]
cmp dword [r10 + rdx*8 + 0x18], r9d
je 0x5056fa
inc ecx
cmp ecx, r8d
jb 0x5056b3
mov ebx, dword [rsp + 0xe0]
mov rdi, qword [rsp + 0xe0]
call qword [rsi + 0xc0]
xor edx, edx
test ebx, ebx
je 0x50571a
mov r8, rdi
lea rcx, [r8 + 8]
mov r14, r8
mov r8, rcx
cmp qword [rcx], rax
je 0x50570c
inc edx
cmp edx, ebx
jb 0x5056e3
jmp 0x505722
mov edi, dword [r10 + rdx*8 + 0x24]
mov ebx, dword [r10 + rdx*8 + 0x20]
add rdi, rax
shr ebx, 3
jmp 0x5056d4
mov rdx, rbp
mov rcx, r14
call qword [rsi + 0x1f0]
jmp 0x505722
mov r14, qword [rsp + 0xe0]
call qword [rsi + 0xb8]
xor ebp, ebp
lea r9d, [rbp + 1]
test ebx, ebx
je 0x505773
lea rcx, [rdi + 8]
cmp qword [rcx], rax
je 0x505748
add ebp, r9d
add rcx, 8
cmp ebp, ebx
jb 0x505736
jmp 0x505773
mov r8b, r9b
lea rcx, [rsp + 0x20]
mov rdx, r14
call qword [rsi + 0x1d0]
lea rcx, [rdi + rbp*8]
mov r8d, 0x10
lea rdx, [rsp + 0x20]
call fcn.005060c1
mov r9d, 1
mov rax, qword [r15 + 0x18]
mov rdi, qword [rax + 0x10]
jmp 0x505882
lea r12, [rsi + 0x370]
mov cl, byte [r12]
xor ebp, ebp
xor edx, edx
mov r15d, r9d
test cl, cl
je 0x50587f
xor r8d, r8d
cmp cl, 0x3b
je 0x5057d0
cmp edx, 0x80
jae 0x5057d0
xor eax, eax
mov byte [rsp + r8 + 0x30], cl
cmp cl, 0x77
cmovne eax, r15d
cmp cl, 0x70
mov r15d, eax
cmove ebp, r9d
add edx, r9d
mov r8d, edx
mov cl, byte [rdx + r12]
test cl, cl
jne 0x50579d
test edx, edx
je 0x50587f
lea ecx, [rdx + 1]
mov byte [rsp + rdx + 0x30], 0
mov rdx, qword [rdi + 0x30]
lea r8, [rsp + 0x30]
add r12, rcx
xor r9d, r9d
mov rcx, rsi
call fcn.00505999
mov rbx, rax
mov r9d, 1
test rax, rax
je 0x505787
test r15d, r15d
je 0x505842
test ebp, ebp
je 0x505822
call rbx
mov rbx, rax
mov r9d, 1
test rax, rax
je 0x505787
mov rdx, qword [rbx]
mov rcx, rsi
call fcn.00503dd1
mov r9d, 1
test eax, eax
je 0x505787
mov rax, qword [rsp + 0x28]
jmp 0x505877
test ebp, ebp
je 0x50585a
call rbx
mov rbx, rax
mov r9d, 1
test rax, rax
je 0x505787
mov rdx, qword [rbx]
mov rcx, rsi
call fcn.00503dd1
mov r9d, 1
test eax, eax
je 0x505787
mov rax, qword [r14 + 8]
mov qword [rbx], rax
jmp 0x505787
mov rdi, qword [rdi]
cmp qword [rdi + 0x30], 0
jne 0x505780
lea r11, [rsp + 0xb0]
mov eax, r9d
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x5058b1
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x60
or r10d, 0xffffffff
xor r8d, r8d
mov rsi, rcx
cmp byte [rdx], r8b
je 0x5058e8
cmp r8d, 0x40
jae 0x5058e8
mov al, byte [r8 + rdx]
mov byte [rsp + r8 + 0x20], al
inc r8d
cmp byte [r8 + rdx], 0
jne 0x5058cf
lea eax, [r8 - 4]
mov byte [rsp + r8 + 0x20], 0
cmp byte [rsp + rax + 0x20], 0x2e
je 0x505923
mov byte [rsp + r8 + 0x20], 0x2e
inc r8d
mov byte [rsp + r8 + 0x20], 0x64
inc r8d
mov byte [rsp + r8 + 0x20], 0x6c
inc r8d
lea eax, [r8 + 1]
mov byte [rsp + r8 + 0x20], 0x6c
mov byte [rsp + rax + 0x20], 0
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rax, qword [rcx + 0x18]
mov rdi, qword [rax + 0x10]
mov rbx, qword [rdi + 0x30]
test rbx, rbx
je 0x50597a
movsxd rax, dword [rbx + 0x3c]
mov ecx, dword [rax + rbx + 0x88]
xor eax, eax
test ecx, ecx
je 0x50596d
mov edx, dword [rcx + rbx + 0xc]
lea rcx, [rsp + 0x20]
add rdx, rbx
call fcn.0050611d
mov r10d, eax
xor eax, eax
test r10d, r10d
je 0x505992
mov rdi, qword [rdi]
test r10d, r10d
jne 0x505938
test rax, rax
jne 0x505982
lea rcx, [rsp + 0x20]
call qword [rsi + 0x30]
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
mov rax, rbx
jmp 0x505982
Function at 0x505999
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x18], r8
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xa0
xor r11d, r11d
mov rdi, rdx
mov r10, rcx
mov ebx, r11d
test rdx, rdx
je 0x505b21
movsxd r15, dword [rdx + 0x3c]
mov eax, dword [r15 + rdx + 0x88]
test eax, eax
je 0x505b21
lea rsi, [rdx + rax]
mov r14d, dword [rsi + 0x1c]
mov r13d, dword [rsi + 0x20]
add r14, rdx
mov r12d, dword [rsi + 0x24]
add r13, rdx
add r12, rdx
test r8, r8
je 0x505b11
mov ebp, dword [rsi + 0x18]
test ebp, ebp
je 0x505b21
lea eax, [rbp - 1]
mov rdx, r8
mov ecx, dword [r13 + rax*4]
mov ebp, eax
add rcx, rdi
mov qword [rsp + 0xe8], rax
call fcn.005060fd
xor r11d, r11d
test eax, eax
jne 0x505a48
mov rax, qword [rsp + 0xe8]
movzx eax, word [r12 + rax*2]
mov ebx, dword [r14 + rax*4]
add rbx, rdi
test ebp, ebp
je 0x505a59
mov r8, qword [rsp + 0xf0]
test rbx, rbx
je 0x505a10
mov r10, qword [rsp + 0xe0]
cmp rbx, rsi
jb 0x505b0c
mov eax, dword [r15 + rdi + 0x8c]
add rax, rsi
cmp rbx, rax
jae 0x505b0c
mov r8d, r11d
cmp byte [rbx], r11b
je 0x505aa4
cmp r8d, 0x3c
jae 0x505aa4
mov eax, r8d
mov cl, byte [rax + rbx]
mov byte [rsp + rax + 0x20], cl
cmp cl, 0x2e
je 0x505aa4
inc r8d
cmp byte [r8 + rbx], r11b
jne 0x505a86
lea eax, [r8 + 1]
mov edx, eax
mov byte [rsp + rax + 0x20], 0x64
lea eax, [r8 + 2]
mov byte [rsp + rax + 0x20], 0x6c
lea eax, [r8 + 3]
mov byte [rsp + rax + 0x20], 0x6c
lea eax, [r8 + 4]
lea r8, [rdx + rbx]
mov byte [rsp + rax + 0x20], r11b
mov edx, r11d
cmp byte [r8], r11b
je 0x505aed
cmp edx, 0x3f
jae 0x505aed
mov ecx, edx
inc edx
mov al, byte [rcx + r8]
mov byte [rsp + rcx + 0x60], al
cmp byte [rdx + r8], r11b
jne 0x505ad6
mov eax, edx
lea r9, [rsp + 0x60]
lea r8, [rsp + 0x20]
mov rdx, rdi
mov rcx, r10
mov byte [rsp + rax + 0x60], r11b
call fcn.00503805
mov rbx, rax
mov rax, rbx
jmp 0x505b23
sub r9d, dword [rsi + 0x10]
mov ebx, dword [r14 + r9*4]
add rbx, rdi
jmp 0x505a61
xor eax, eax
mov rbx, qword [rsp + 0xf8]
add rsp, 0xa0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret

Function at 0x505b41
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x30]
mov rdi, r8
mov rsi, rdx
mov rbp, rcx
xor r10d, r10d
mov r9, qword [rax + 0x60]
mov rax, qword [r9 + 0x18]
mov rbx, qword [rax + 0x10]
jmp 0x505b94
test r10, r10
jne 0x505b9d
mov r9, rdi
mov r8, rsi
mov rdx, rax
mov rcx, rbp
call fcn.0050364d
mov rbx, qword [rbx]
mov r10, rax
mov rax, qword [rbx + 0x30]
test rax, rax
jne 0x505b78
mov rbx, qword [rsp + 0x30]
mov rax, r10
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x505c81
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x10
movups xmm0, xmmword [rcx]
mov qword [rsp + 0x28], rdx
mov ecx, edx
mov r8d, dword [rsp + 0x2c]
xor r10d, r10d
movups xmmword [rsp], xmm0
mov edx, dword [rsp + 0xc]
mov r11d, dword [rsp + 8]
mov ebx, dword [rsp + 4]
mov r9d, dword [rsp]
mov eax, edx
ror ecx, 8
add ecx, r8d
mov edx, ebx
xor ecx, r9d
ror edx, 8
add edx, r9d
rol r8d, 3
xor edx, r10d
rol r9d, 3
xor r9d, edx
xor r8d, ecx
inc r10d
mov ebx, r11d
mov r11d, eax
cmp r10d, 0x1b
jb 0x505cae
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x2c], r8d
mov rax, qword [rsp + 0x28]
add rsp, 0x10
pop rbx
ret

Function at 0x505cf5
Capabilities:
Encode data using xor
Encrypt data using chaskey

Disassembly:
test r9d, r9d
je 0x505e43
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r14
mov rbp, rsp
sub rsp, 0x10
mov r11, rcx
lea rax, [rbp - 0x10]
sub r11, rax
lea r14, [rdx + 0xf]
mov rdi, r8
mov r12d, 0x10
lea rax, [rbp - 0x10]
cmp rax, r14
ja 0x505d4c
lea rax, [rbp - 1]
cmp rax, rdx
jb 0x505d4c
movups xmm0, xmmword [rdx]
movdqu xmmword [rbp - 0x10], xmm0
jmp 0x505d54
movups xmm0, xmmword [rdx]
movdqu xmmword [rbp - 0x10], xmm0
lea rcx, [rbp - 0x10]
mov r8d, 4
mov eax, dword [r11 + rcx]
xor dword [rcx], eax
lea rcx, [rcx + 4]
sub r8, 1
jne 0x505d5e
mov r8d, dword [rbp - 4]
mov rbx, r12
mov eax, dword [rbp - 8]
mov r10d, dword [rbp - 0xc]
mov ecx, dword [rbp - 0x10]
add ecx, r10d
add eax, r8d
rol r10d, 5
xor r10d, ecx
rol r8d, 8
xor r8d, eax
rol ecx, 0x10
add eax, r10d
add ecx, r8d
rol r10d, 7
rol r8d, 0xd
xor r10d, eax
xor r8d, ecx
rol eax, 0x10
sub rbx, 1
jne 0x505d7f
mov dword [rbp - 4], r8d
lea r8d, [rbx + 4]
mov dword [rbp - 0x10], ecx
lea rcx, [rbp - 0x10]
mov dword [rbp - 0xc], r10d
mov dword [rbp - 8], eax
mov eax, dword [rcx + r11]
xor dword [rcx], eax
lea rcx, [rcx + 4]
sub r8, 1
jne 0x505dc9
cmp r9d, r12d
mov ecx, r9d
cmova ecx, r12d
mov r10d, ecx
test ecx, ecx
je 0x505e07
lea rbx, [rbp - 0x10]
mov r8, rdi
sub rbx, rdi
mov esi, r10d
mov al, byte [rbx + r8]
xor byte [r8], al
inc r8
sub rsi, 1
jne 0x505df7
sub r9d, ecx
mov r8d, r12d
add rdi, r10
lea eax, [r8 - 1]
add byte [rax + rdx], 1
jne 0x505e22
dec r8d
test r8d, r8d
jg 0x505e10
test r9d, r9d
jne 0x505d30
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x10
pop r14
pop r12
pop rbp
ret
Function at 0x505e45
Capabilities:
Decompress data using aplib

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x40
mov al, byte [rcx]
or r14d, 0xffffffff
and dword [rbp - 0xc], 0
xor r9d, r9d
mov byte [rdx], al
xor edi, edi
lea rax, [rdx + 1]
mov rbx, rdx
mov qword [rbp - 0x18], rax
mov r11d, r14d
lea rax, [rcx + 1]
mov qword [rbp - 0x20], rax
lea esi, [rdi + 1]
lea rcx, [rbp - 0x20]
call fcn.00506089
test eax, eax
je 0x506045
lea rcx, [rbp - 0x20]
call fcn.00506089
test eax, eax
je 0x505f4b
lea rcx, [rbp - 0x20]
call fcn.00506089
test eax, eax
je 0x505f07
xor r9d, r9d
lea r10d, [r9 + 4]
lea rcx, [rbp - 0x20]
call fcn.00506089
lea r9d, [rax + r9*2]
sub r10d, esi
jne 0x505ec0
test r9d, r9d
je 0x505ef4
mov rdx, qword [rbp - 0x18]
mov rax, rdx
mov ecx, r9d
sub rax, rcx
mov al, byte [rax]
mov byte [rdx], al
add rdx, rsi
mov qword [rbp - 0x18], rdx
jmp 0x50605f
mov rax, qword [rbp - 0x18]
mov byte [rax], 0
add rax, rsi
mov qword [rbp - 0x18], rax
jmp 0x50605f
mov rax, qword [rbp - 0x20]
movzx r11d, byte [rax]
add rax, rsi
mov ecx, r11d
mov qword [rbp - 0x20], rax
and ecx, esi
add ecx, 2
shr r11d, 1
je 0x505f44
mov rdx, qword [rbp - 0x18]
mov r8d, r11d
neg r8
mov al, byte [r8 + rdx]
mov byte [rdx], al
add rdx, rsi
add ecx, r14d
jne 0x505f2d
mov qword [rbp - 0x18], rdx
jmp 0x506040
mov edi, esi
jmp 0x506040
mov r10d, esi
lea rcx, [rbp - 0x20]
call fcn.00506089
lea rcx, [rbp - 0x20]
lea r10d, [rax + r10*2]
call fcn.00506089
test eax, eax
jne 0x505f4e
test r9d, r9d
jne 0x505fb5
cmp r10d, 2
jne 0x505fb5
mov r9d, esi
lea rcx, [rbp - 0x20]
call fcn.00506089
lea rcx, [rbp - 0x20]
lea r9d, [rax + r9*2]
call fcn.00506089
test eax, eax
jne 0x505f76
test r9d, r9d
je 0x506040
mov rcx, qword [rbp - 0x18]
mov edx, r11d
neg rdx
mov al, byte [rdx + rcx]
mov byte [rcx], al
add rcx, rsi
add r9d, r14d
jne 0x505fa3
jmp 0x50603c
mov rcx, qword [rbp - 0x20]
xor r9d, esi
sub r10d, r9d
mov r9d, esi
shl r10d, 8
movzx r11d, byte [rcx]
add r11d, 0xfffffe00
add r11d, r10d
add rcx, rsi
mov qword [rbp - 0x20], rcx
lea rcx, [rbp - 0x20]
call fcn.00506089
lea rcx, [rbp - 0x20]
lea r9d, [rax + r9*2]
call fcn.00506089
test eax, eax
jne 0x505fdb
cmp r11d, 0x7d00
lea eax, [r9 + 1]
cmovb eax, r9d
cmp r11d, 0x500
lea ecx, [rax + 1]
cmovb ecx, eax
cmp r11d, 0x80
lea r8d, [rcx + 2]
cmovae r8d, ecx
test r8d, r8d
je 0x506040
mov rcx, qword [rbp - 0x18]
mov edx, r11d
neg rdx
mov al, byte [rdx + rcx]
mov byte [rcx], al
add rcx, rsi
add r8d, r14d
jne 0x50602f
mov qword [rbp - 0x18], rcx
mov r9d, esi
jmp 0x506062
mov rdx, qword [rbp - 0x20]
mov rcx, qword [rbp - 0x18]
mov al, byte [rdx]
mov byte [rcx], al
add rcx, rsi
add rdx, rsi
mov qword [rbp - 0x18], rcx
mov qword [rbp - 0x20], rdx
xor r9d, r9d
test edi, edi
je 0x505e8a
mov eax, dword [rbp - 0x18]
mov rsi, qword [rsp + 0x58]
sub eax, ebx
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x60]
mov r14, qword [rsp + 0x68]
add rsp, 0x40
pop rbp
ret
Function at 0x140001910
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rdx
mov qword [rax + 0x18], r8
mov qword [rax + 0x20], r9
push rbx
sub rsp, 0x80
mov qword [rax - 0x10], rbp
mov rbx, rcx
mov qword [rax - 0x18], rsi
mov qword [rax - 0x20], rdi
mov qword [rax - 0x28], r12
mov qword [rax - 0x30], r13
lea r13, [rax + 0x10]
mov qword [rax - 0x38], r14
mov qword [rax - 0x40], r15
call fcn.140008da0
xor r15d, r15d
mov qword [rsp + 0x28], r13
mov r9, rbx
mov qword [rsp + 0x20], r15
xor r8d, r8d
xor edx, edx
mov rcx, qword [rax]
mov r14, rax
or rcx, 2
call fcn.14001e714
test eax, eax
mov r12, 0xffffffffffffffff
mov ebp, r15d
cmovs eax, r12d
movsxd rcx, eax
test eax, eax
mov eax, 2
cmovns rbp, rcx
lea rsi, [rbp + 1]
mul rsi
lea rdx, [0x1400517d0]
cmovo rax, r12
mov rcx, rax
call fcn.1400151c8
mov rbx, rax
test rax, rax
je 0x1400019eb
lea rax, [rsi - 1]
mov edi, r15d
cmp rax, 0x7ffffffe
mov ecx, 0x80070057
cmova edi, ecx
test edi, edi
js 0x140001a98
test rsi, rsi
jne 0x140001a31
mov rax, qword [rsp + 0x90]
cmp word [rax], r15w
je 0x140001aa9
lea rcx, str.DbgPrint_crash._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov r15, qword [rsp + 0x48]
mov r14, qword [rsp + 0x50]
mov r13, qword [rsp + 0x58]
mov r12, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
test rbx, rbx
je 0x140001a28
mov rcx, rbx
call fcn.1400151c0
add rsp, 0x80
pop rbx
ret
mov rcx, qword [r14]
mov r8, rbp
mov r9, qword [rsp + 0x90]
or rcx, 1
mov qword [rsp + 0x28], r13
mov rdx, rbx
mov edi, r15d
mov qword [rsp + 0x20], r15
call fcn.14001e714
test eax, eax
cmovs eax, r12d
test eax, eax
js 0x140001a79
movsxd rcx, eax
cmp rcx, rbp
ja 0x140001a79
jne 0x140001a83
mov word [rbx + rbp*2], r15w
mov rcx, rbx
jmp 0x1400019f2
mov word [rbx + rbp*2], r15w
mov edi, 0x8007007a
test edi, edi
jns 0x140001aa9
movabs rax, 0x7fffffffffffffff
and rsi, rax
jbe 0x140001aa1
jmp 0x140001a9d
test rsi, rsi
je 0x140001aa1
mov word [rbx], r15w
test edi, edi
js 0x1400019eb
mov rcx, rbx
jmp 0x1400019f2