joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140295410
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
movzx eax, byte [0x1407399f0]
cmp al, 0x84
je 0x140295440
mov cl, 0x39
nop word cs:[rax + rax]
mov al, 0x10
lock cmpxchg byte [0x1407399f0], cl
je 0x14029544c
cmp al, 0x84
jne 0x140295430
lea rcx, [0x1407399e0]
call fcn.140095530
mov ecx, 0x8f80e066
lea r10, [0x1405f5b30]
mov r11d, 0x8f80e068
add r11, r10
lea r8, [rcx + 2]
xor esi, esi
movabs rdi, 0xaaaaaaaaaaaaaaab
lea rbx, [0x1407399e0]
mov r14d, 0x8f80e067
nop
mov rax, r8
mul rdi
mov r9, rdx
shr r9, 1
and r9, 0xfffffffffffffffc
mov rax, rcx
mul rdi
shr rdx, 1
and rdx, 0xfffffffffffffffc
lea rax, [rdx + rdx*2]
mov rdx, r10
sub rdx, rax
add rdx, rsi
movzx eax, byte [r14 + rdx]
xor al, 0x6b
add byte [rsi + rbx], al
lea rax, [r9 + r9*2]
neg rax
movzx eax, byte [r11 + rax]
xor al, 0x6b
add byte [rsi + rbx + 1], al
add rsi, 2
add r11, 2
add r8, 2
add rcx, 2
cmp rsi, 0x10
jne 0x140295480
mov al, 0x84
xchg byte [0x1407399f0], al
lea rcx, [0x1407399e0]
call fcn.140095530
int3
Function at 0x1402bd150
Capabilities:
Encode data using xor

Disassembly:
mov r9d, ecx
mov edx, 0xa8f2e113
jmp fcn.1402c9270
Function at 0x1402cf130
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x48
lea rbp, [rsp + 0x40]
mov qword [rbp], 0xfffffffffffffffe
mov rsi, rcx
lea rax, [0x1405f6bc8]
mov qword [rcx], rax
mov rdi, qword [rcx + 8]
test rdi, rdi
je 0x1402cf277
nop
mov rdx, qword [rdi + 0x30]
movzx eax, byte [0x14079020a]
mov byte [rbp - 1], al
test al, al
jne 0x1402cf184
cmp rdx, 0x10
jb 0x1402cf26f
nop
mov rax, qword [rdi + 0x18]
movsxd rbx, dword [0x1405f6c6c]
mov r14d, dword [0x1405f6c70]
movsxd r9, dword [0x1405f6c78]
lea rcx, [rdx + 1]
cmp rcx, 0x1000
jb 0x1402cf23f
nop
mov r8, qword [rax - 8]
mov r10d, dword [0x14073e778]
lea ecx, [r10 + 1]
mov r11d, r10d
shl r11d, cl
add rax, 0xfffffffffffffff8
mov qword [rbp - 0x18], r8
sub rax, r8
cmp dword [0x14073e780], 0xbccc102
cmovne r11d, ecx
mov dword [0x14073e778], ecx
mov qword [rbp - 0x20], r10
mov dword [rbp - 8], r11d
test r11d, r10d
je 0x1402cf2bb
xor r12d, r12d
nop
cmp dword [0x14073e788], 0x3a55ad80
mov ecx, 0x26
mov r8d, 0x20
cmove r8, rcx
cmp rax, r8
jae 0x1402cf41d
add rdx, 0x28
cmp dword [0x14073e784], 0x5d9a0085
movzx eax, word [0x1405f6c10]
jne 0x1402cf244
nop
mov dword [0x14073e780], 0x56255ce8
jmp 0x1402cf263
mov rdx, rcx
jmp 0x1402cf267
nop
mov ecx, dword [rbp - 8]
test dword [rbp - 0x20], ecx
sete cl
cmp ax, r12w
setne al
and al, cl
movzx ecx, byte [rbp - 1]
or cl, al
mov byte [0x14079020a], cl
mov rax, qword [rbp - 0x18]
mov rcx, rax
call fcn.140095520
mov rcx, rdi
call fcn.1400954d0
nop
mov qword [rsi + 8], 0
cmp byte [0x1407904a0], 0
jne 0x1402cf293
nop
cmp qword [0x140791138], rsi
jne 0x1402cf29f
nop
mov qword [0x140791138], 0
add rsi, 0x10
mov rcx, rsi
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
jmp 0x1402cfda0
lea r15, [0x1405f6c78]
add r15, r9
cmp dword [0x14073e784], 0x5dbf7b52
jne 0x1402cf2f2
nop
movsxd rcx, dword [r15 + 4]
mov dword [0x14073e788], 0x5055a07
test r14d, r14d
jns 0x1402cf1f5
add rcx, r15
add rcx, 4
jmp 0x1402cf302
nop
movsxd rcx, dword [r15]
test r14d, r14d
jle 0x1402cf1f5
add rcx, r15
lea r9, [0x1405f6c6c]
add rbx, r9
xor r9d, r9d
mov r8d, dword [0x14073e78c]
mov dword [rbp - 0xc], r8d
xor r12d, r12d
xor r10d, r10d
jmp 0x1402cf362
sub r12d, r13d
imul r12d, r13d
imul r9d, r9d
lea r8d, [r9 - 1]
imul r8d, r9d
mov r9d, 4
sub r9d, r8d
mov dword [0x14073e790], 0xde070f76
xor r12d, r13d
cmp r9d, r14d
jge 0x1402cf1f8
movsxd r13, r9d
mov r11, rcx
sub r11, rbx
sub r11, r13
cmp r11, 2
movzx r13d, word [rbx + r13]
jge 0x1402cf403
cmp dword [rbp - 0xc], 0xb469cf34
jne 0x1402cf3d0
lea ecx, [r10 - 1]
mov r8d, 0xffffffff
shl r8d, cl
mov dword [0x14073e784], 0xe63a2f37
add r10d, r8d
dec r10d
mov dword [0x14073e780], 0x49f62117
mov ecx, r11d
shl ecx, 5
lea r11d, [rcx + r11*4]
add r11d, 0xffffff00
mov ecx, 0xfffffff6
jmp 0x1402cf3ef
lea ecx, [r11*8]
mov r8d, 0xffffffff
shl r8d, cl
not r8d
and r13d, r8d
inc r10d
mov ecx, 6
add ecx, r11d
add r9d, ecx
movsxd rcx, r10d
lea r8, [r15 + rcx*4]
movsxd rcx, dword [r15 + rcx*4]
add rcx, r8
nop
cmp dword [0x14073e790], 0x57b20746
jne 0x1402cf330
add r9d, 2
jmp 0x1402cf356
call fcn.1400954e0
int3
jmp fcn.1402ed830
Function at 0x1402d68c0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x30
lea rbp, [rsp + 0x30]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rsi, rdx
mov rdi, rcx
call fcn.140095670
mov qword [rdi + 8], 0
mov byte [rdi + 0x10], 0
mov qword [rdi + 0x18], 0
mov byte [rdi + 0x20], 0
mov qword [rdi + 0x28], 0
mov word [rdi + 0x30], 0
mov qword [rdi + 0x38], 0
mov word [rdi + 0x40], 0
mov qword [rdi + 0x48], 0
mov byte [rdi + 0x50], 0
mov qword [rdi + 0x58], 0
mov byte [rdi + 0x60], 0
test rsi, rsi
nop
mov qword [rbp - 0x10], rdi
je 0x1402d694c
mov rcx, rdi
mov rdx, rsi
call fcn.1400956b0
mov rax, qword [rbp - 0x10]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
nop
movzx eax, byte [0x14073ec10]
cmp al, 0x42
je 0x1402d69d4
mov cl, 0x2d
nop word [rax + rax]
mov al, 5
lock cmpxchg byte [0x14073ec10], cl
je 0x1402d6972
cmp al, 0x42
jne 0x1402d6960
jmp 0x1402d69d4
mov eax, 3
lea rcx, [0x14073ec00]
lea rdx, [0x1405f7220]
nop word cs:[rax + rax]
lea r8d, [rax - 1]
and r8d, 0xe
xor r8, 0xf
movzx r8d, byte [r8 + rdx]
xor r8b, 0xee
add byte [rax + rcx - 3], r8b
mov r8d, eax
not r8d
and r8d, 0xe
movzx r8d, byte [r8 + rdx]
xor r8b, 0xee
add byte [rax + rcx - 2], r8b
add rax, 2
cmp rax, 0x13
jne 0x1402d6990
mov al, 0x42
xchg byte [0x14073ec10], al
call fcn.1402d6da0
int3

Function at 0x1402d73a0
Capabilities:
Encrypt data using speck

Disassembly:
mov edx, ecx
mov r9d, 0x70430d2
jmp fcn.1402e0540

Function at 0x1402d73b0
Capabilities:
Encrypt data using speck

Disassembly:
mov r8d, ecx
mov r9d, 0x25a601a
jmp fcn.1402e0540
Function at 0x1402e2fa0
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
movzx eax, byte [0x140740180]
cmp al, 0xc9
je 0x1402e2fd0
mov cl, 0x4f
nop word [rax + rax]
mov al, 0x92
lock cmpxchg byte [0x140740180], cl
je 0x1402e2fdc
cmp al, 0xc9
jne 0x1402e2fc0
lea rcx, [0x140740170]
call fcn.140095530
mov eax, 0xd70857fe
mov ecx, 0x28f7a810
mov edx, 0xd70857ff
mov r8d, 0x28f7a80f
xor r9d, r9d
mov r10d, 0x88888889
lea r11, [0x140740170]
lea rsi, [0x1405f7900]
nop dword [rax + rax]
mov edi, ecx
imul rdi, r10
shr rdi, 0x23
lea edi, [rdi + rdi*4]
lea edi, [rdi + rdi*2]
add edi, eax
mov ebx, r8d
imul rbx, r10
shr rbx, 0x23
lea ebx, [rbx + rbx*4]
lea ebx, [rbx + rbx*2]
add ebx, edx
movzx ebp, byte [r9 + r11]
movzx r14d, byte [r9 + r11 + 1]
xor bpl, byte [rbx + rsi]
xor bpl, 0xad
mov byte [r9 + r11], bpl
xor r14b, byte [rdi + rsi]
xor r14b, 0xad
mov byte [r9 + r11 + 1], r14b
add r9, 2
add eax, 0xfffffffe
add ecx, 2
add edx, 0xfffffffe
add r8d, 2
cmp r9, 0x10
jne 0x1402e3010
mov al, 0xc9
xchg byte [0x140740180], al
lea rcx, [0x140740170]
call fcn.140095530
int3
Function at 0x140308410
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov rsi, rcx
mov rax, qword [rsp + 0xf0]
mov edi, dword [rsp + 0xe8]
mov r10, qword [rsp + 0xe0]
mov rcx, qword [0x14077ee28]
xor rcx, rsp
mov qword [rsp + 0x70], rcx
mov ecx, edi
and ecx, 0xf
cmp ecx, 4
jae 0x14030846f
cmp ecx, 1
jbe 0x14030849d
cmp ecx, 3
jne 0x1403084d8
mov rcx, rsi
mov rdx, r10
call fcn.14059bcf8
xor esi, esi
jmp 0x140308860
invalid
add ecx, 0xfffffffc
lea r11, [0x1405f8654]
mov qword [rsp + 0x20], r9
mov rcx, rdx
mov rdx, rsi
mov r9, rax
call fcn.1402bd070
mov rsi, rax
jmp 0x140308860
test ecx, ecx
je 0x140308565
mov rcx, qword [r9 + 0x30]
add r9, 0x30
test rcx, rcx
je 0x14030859a
mov rbx, r9
test dil, dil
js 0x140308860
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x28], 0xa0f017f7
invalid
invalid
mov rdx, rax
mov r10, r9
jmp 0x140308538
mov qword [rsp + 0x68], r10
mov qword [rsp + 0x50], r9
mov qword [rsp + 0x48], 0
and al, 0x48
add byte [rax], al
add byte [rax], al
mov edi, 0x84d86a18
mov r8, r9
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x50], r8
cmp r8, rsi
jae 0x140308554
mov qword [rsp + 0x58], r8
xor r12d, r12d
xor r14d, r14d
jmp 0x140308587
test edi, 0x800
jne 0x1403085e8
jmp 0x140308893
mov qword [rsp + 0x58], r8
mov r12, qword [r9 + 8]
test r12, r12
sete r14b
movzx eax, byte [0x140743ba2]
mov r10, r9
cmp al, 0xfb
je 0x1403088ad
xor ebx, ebx
test edi, 0x200
jne 0x140308946
jmp 0x140308770
mov qword [rsp + 0x58], r8
jmp 0x140308755
mov qword [rsp + 0x48], r10
test dil, dil
js 0x140308629
mov qword [rsp + 0x58], r8
lea r12, [rsp + 0x68]
xor r14d, r14d
jmp 0x140308782
Function at 0x14030a8a0
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
mov r9, rcx
mov qword [rsp + 0x28], rdx
mov dword [rsp + 0x20], 0
lea r8, [0x14030aab0]
xor ecx, ecx
xor edx, edx
call fcn.14058522c
nop
add rsp, 0x38
ret

Function at 0x14030ab00
Capabilities:
Encrypt data using speck

Disassembly:
mov ecx, 0x30816d49
jmp fcn.14030ab30
Function at 0x1403260e0
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
movzx eax, byte [0x140746540]
cmp al, 0x4d
je 0x140326110
mov cl, 4
nop word [rax + rax]
mov al, 0x10
lock cmpxchg byte [0x140746540], cl
je 0x14032611c
cmp al, 0x4d
jne 0x140326100
lea rcx, [0x140746530]
call fcn.140095530
mov eax, 0x4aba9026
mov ecx, 0xb5456fea
mov edx, 0x4aba9027
mov r8d, 0xb5456fe9
xor r9d, r9d
mov r10d, 0xf0f0f0f1
lea r11, [0x140746530]
lea rsi, [0x1405f9e10]
nop dword [rax + rax]
mov edi, ecx
imul rdi, r10
shr rdi, 0x24
lea ebx, [rax + rdi]
shl edi, 4
add edi, ebx
mov ebx, r8d
imul rbx, r10
shr rbx, 0x24
lea ebp, [rdx + rbx]
shl ebx, 4
add ebx, ebp
movzx ebp, byte [r9 + r11]
movzx r14d, byte [r9 + r11 + 1]
xor bpl, byte [rbx + rsi]
xor bpl, 0xfc
mov byte [r9 + r11], bpl
xor r14b, byte [rdi + rsi]
xor r14b, 0xfc
mov byte [r9 + r11 + 1], r14b
add r9, 2
add eax, 0xfffffffe
add ecx, 2
add edx, 0xfffffffe
add r8d, 2
cmp r9, 0x10
jne 0x140326150
mov al, 0x4d
xchg byte [0x140746540], al
lea rcx, [0x140746530]
call fcn.140095530
int3
Function at 0x14035bfe0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x50
mov rax, qword [0x14077ee28]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor r15d, r15d
test r8, r8
je 0x14035c1a1
mov rbx, rcx
test rcx, rcx
je 0x14035c1a1
mov r14, rdx
test rdx, rdx
je 0x14035c1a1
mov rdi, r9
test r9, r9
je 0x14035c1a1
mov rsi, r8
cmp r8, 0xf
ja 0x14035c06a
mov r15d, 0x10
sub r15, rsi
lea rdx, [rbx + rsi]
add rdx, 0x50
lea rcx, [rsp + 0x30]
mov r8, r15
call fcn.1405c4870
lea rcx, [rsp + r15]
add rcx, 0x30
mov rdx, r14
mov r8, rsi
call fcn.1405c4870
jmp 0x14035c0e2
movups xmm0, xmmword [r14 + rsi - 0x10]
movaps xmmword [rsp + 0x30], xmm0
mov r13, rsi
shr r13, 4
lea r15, [rbx + 0x50]
lea r12, [rsp + 0x20]
nop word cs:[rax + rax]
mov rax, qword [rbx + 0x20]
mov rcx, rbx
mov rdx, r15
mov r8, r12
call qword [0x140704440]
movups xmm0, xmmword [r14]
movups xmmword [r15], xmm0
mov eax, dword [rsp + 0x20]
xor eax, dword [r14]
mov dword [rdi], eax
mov eax, dword [rsp + 0x24]
xor eax, dword [r14 + 4]
mov dword [rdi + 4], eax
mov eax, dword [rsp + 0x28]
xor eax, dword [r14 + 8]
mov dword [rdi + 8], eax
mov eax, dword [rsp + 0x2c]
xor eax, dword [r14 + 0xc]
mov dword [rdi + 0xc], eax
add rdi, 0x10
add r14, 0x10
dec r13
jne 0x14035c090
mov r15, rsi
and r15, 0xf
je 0x14035c195
mov rax, qword [rbx + 0x20]
lea rdx, [rbx + 0x50]
lea r8, [rsp + 0x20]
mov rcx, rbx
call qword [0x140704440]
mov eax, esi
and eax, 3
cmp r15d, 4
jae 0x14035c114
xor ecx, ecx
jmp 0x14035c15f
sub r15, rax
xor ecx, ecx
nop dword [rax]
movzx edx, byte [rsp + rcx + 0x20]
xor dl, byte [r14 + rcx]
mov byte [rdi + rcx], dl
movzx edx, byte [rsp + rcx + 0x21]
xor dl, byte [r14 + rcx + 1]
mov byte [rdi + rcx + 1], dl
movzx edx, byte [rsp + rcx + 0x22]
xor dl, byte [r14 + rcx + 2]
mov byte [rdi + rcx + 2], dl
movzx edx, byte [rsp + rcx + 0x23]
xor dl, byte [r14 + rcx + 3]
mov byte [rdi + rcx + 3], dl
add rcx, 4
cmp r15, rcx
jne 0x14035c120
test rax, rax
je 0x14035c195
add rdi, rcx
lea rdx, [rsp + rcx]
add rdx, 0x20
add r14, rcx
xor ecx, ecx
nop word cs:[rax + rax]
movzx r8d, byte [rdx + rcx]
xor r8b, byte [r14 + rcx]
mov byte [rdi + rcx], r8b
inc rcx
cmp rax, rcx
jne 0x14035c180
movaps xmm0, xmmword [rsp + 0x30]
movups xmmword [rbx + 0x50], xmm0
mov r15, rsi
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14059b6c0
mov rax, r15
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1403d3080
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x30
mov rdi, r9
mov rsi, r8
mov r14, rcx
mov rbx, qword [rsp + 0x98]
mov r15, qword [rsp + 0x90]
mov r12d, edx
and r12d, 0xf
cmp r12d, 3
ja case.0x1403c8cba.59
cmp r12d, 2
jae 0x1403d3128
test r12d, r12d
call fcn.1403becf0
cmp r12d, 3
mov rax, r15
Function at 0x1404303c0
Capabilities:
Encode data using xor

Disassembly:
mov rdx, rcx
lea rcx, [0x140792608]
jmp fcn.140481770
Function at 0x140468260
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0x60]
mov qword [rbp], 0xfffffffffffffffe
mov rsi, rcx
nop
mov ebx, dword [0x140768cec]
lea rdi, [rbp - 8]
mov rcx, rdi
call fcn.140357460
xor rbx, 0x13156492
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0xb89bc05f
mov r8, rdi
call fcn.14046d990
test rax, rax
je 0x1404682c3
mov rcx, rsi
mov rdx, rax
call fcn.14046b720
mov rax, rsi
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop rbp
ret
nop
movzx eax, byte [0x1407679ae]
cmp al, 0x41
je 0x140468398
mov cl, 0x88
nop word cs:[rax + rax]
mov al, 7
lock cmpxchg byte [0x1407679ae], cl
je 0x1404682f5
cmp al, 0x41
jne 0x1404682e0
jmp 0x140468398
lea r9, [0x14060ebf0]
lea r10, [r9 + 0x5ee88d08]
add r9, 0x5ee88d07
mov ecx, 0x5ee88d08
mov r8d, 0x5ee88d07
movabs r11, 0xbe82fa0be82fa0bf
lea rsi, [0x140767980]
nop word cs:[rax + rax]
mov rax, rcx
mul r11
shr rdx, 5
imul rdi, rdx, 0xffffffffffffffd5
mov rax, r8
mul r11
shr rdx, 5
imul rax, rdx, 0xffffffffffffffd5
movzx edx, byte [rcx + rsi - 0x5ee88d08]
xor dl, byte [r9 + rax]
movzx eax, byte [rcx + rsi - 0x5ee88d07]
xor dl, 0x34
xor al, byte [r10 + rdi]
mov byte [rcx + rsi - 0x5ee88d08], dl
xor al, 0x34
mov byte [rcx + rsi - 0x5ee88d07], al
add r10, 2
add rcx, 2
add r9, 2
add r8, 2
cmp rcx, 0x5ee88d36
jne 0x140468330
mov al, 0x41
xchg byte [0x1407679ae], al
lea rcx, [0x140767980]
lea rsi, [rbp - 0x20]
mov edx, 0x562372f0
mov r9, rsi
call fcn.140474e10
mov rcx, rsi
call fcn.140241850
int3
Function at 0x140472d50
Capabilities:
Encode data using xor
Encrypt data using speck

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0xd8
add byte [rax], al

Function at 0x140474e10
Capabilities:
Hash data using fnv

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0xb8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x30], 0xfffffffffffffffe
mov r14, r8
mov rbx, rcx
mov qword [rbp + 0x20], r9
mov qword [rbp + 0x10], r9
mov eax, r14d
mov qword [rbp + 0x18], rax
mov eax, ebx
mov dword [rbp + 0xc], ebx
mov dword [rbp + 0x28], edx
mov eax, edx
and eax, 0x3f
cmp eax, 0x1b
sbb esi, dword [rsi + 0x6b]
Function at 0x140541470
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rdi, r9
mov esi, r8d
mov r14, rcx
mov rax, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x80]
and r8d, 0x1f
cmp r8d, 9
jae 0x1405414c8
cmp r8d, 3
ja 0x140541504
cmp r8d, 1
jbe 0x14054154d
cmp r8d, 3
je 0x14054155b
test eax, eax
je 0x1405415ff
xor r15d, r15d
jmp 0x1405416cf
cmp r8d, 0xb
jb 0x14054153b
cmp r8d, 0xe
jae 0x140541562
mov r15, rdx
cmp r8d, 0xb
je 0x1405415cb
cmp r8d, 0xc
jne 0x14054155b
nop
mov qword [rsp + 0x28], rdi
cmp rbx, rdi
jbe 0x140541613
xor ecx, ecx
xor r11d, r11d
jmp 0x14054170e
cmp r8d, 5
jbe 0x140541593
cmp r8d, 6
je 0x1405415e7
cmp r8d, 8
jne 0x1405415f1
mov rcx, rbx
mov r8, rdx
mov rdx, rax
mov r9, rdi
call fcn.1405801c0
mov rdi, rax
jmp 0x1405417c2
mov edi, 0xffffffff
cmp r8d, 9
jne 0x1405417c2
nop
ud2
test r8d, r8d
je 0x14054155b
movzx edi, r14b
jmp 0x1405417c2
xor edi, edi
jmp 0x1405417c2
xor ecx, ecx
add r8d, 0xfffffff2
add eax, 0xfffffff2
cmp r8d, 4
jne 0x1405415ba
sub rbx, rax
cmp rbx, 0x7fffffff
mov eax, 0x7fffffff
cmovl rax, rbx
cmp rax, r14
cmovae rax, r14
mov edi, eax
jmp 0x1405417c2
mov ecx, eax
mov rdx, rdi
call fcn.14058036c
mov edi, eax
jmp 0x1405417c2
mov rcx, rdi
mov r8d, 0xd67c374c
call fcn.14053eb70
test r15d, r15d
je 0x1405416bd
jmp 0x14054176c
mov edi, 0xffffffff
jmp 0x1405417c2
nop
mov qword [rax], r14
mov edi, 3
jmp 0x1405417c2
mov rdi, rbx
test sil, 0x40
jne 0x1405417c2
xor ecx, ecx
jmp 0x14054170e
mov rax, r15
mov r8, r15
jmp 0x14054178b
test sil, 0x20
jne 0x14054179f
lea rcx, [rax - 1]
movzx edx, byte [rbx + rax - 1]
mov byte [rdi + rax - 1], dl
test sil, sil
mov rax, rcx
js 0x1405418b6
test rax, rax
jne 0x14054176c
test esi, 0x200
jne 0x1405417a9
xor ecx, ecx
jmp 0x1405418c0
mov rcx, rdi
call fcn.1400954d0
jmp 0x1405417c2
nop
mov rdi, qword [rsp + 0x28]
jmp 0x1405417c2

Function at 0x14057b1b0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
neg rcx
test rax, 7
je 0x14057b1cd
nop
mov dl, byte [rax]
inc rax
test dl, dl
je 0x14057b228
test al, 7
jne 0x14057b1c0
movabs r8, 0x7efefefefefefeff
movabs r11, 0x8101010101010100
mov rdx, qword [rax]
mov r9, r8
add rax, 8
add r9, rdx
not rdx
xor rdx, r9
and rdx, r11
je 0x14057b1e1
mov rdx, qword [rax - 8]
test dl, dl
je 0x14057b252
test dh, dh
je 0x14057b24c
shr rdx, 0x10
test dl, dl
je 0x14057b246
test dh, dh
je 0x14057b240
shr rdx, 0x10
test dl, dl
je 0x14057b23a
test dh, dh
je 0x14057b234
shr edx, 0x10
test dl, dl
je 0x14057b22e
test dh, dh
jne 0x14057b1e1
lea rax, [rax + rcx - 1]
ret
lea rax, [rax + rcx - 2]
ret
lea rax, [rax + rcx - 3]
ret
lea rax, [rax + rcx - 4]
ret
lea rax, [rax + rcx - 5]
ret
lea rax, [rax + rcx - 6]
ret
lea rax, [rax + rcx - 7]
ret
lea rax, [rax + rcx - 8]
ret
Function at 0x140b4d058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.140b4d1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140b4d089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140b4d06f
add dl, dl
jne 0x140b4d096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140b4d0f6
xor eax, eax
add dl, dl
jne 0x140b4d0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140b4d1ad
add dl, dl
jne 0x140b4d0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140b4d0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140b4d0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140b4d0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140b4d0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140b4d07e
mov eax, 1
add dl, dl
jne 0x140b4d106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140b4d113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140b4d0fb
sub eax, ebx
mov ebx, 1
jne 0x140b4d14c
mov ecx, 1
add dl, dl
jne 0x140b4d12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140b4d13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140b4d123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140b4d07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140b4d168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140b4d175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140b4d15d
cmp eax, 0x7d00
jae 0x140b4d19b
cmp eax, 0x500
jb 0x140b4d196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140b4d07e
cmp eax, 0x7f
ja 0x140b4d19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140b4d07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140b4d1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140b4d07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1400038a0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x1400038fd
lea rbx, [0x1400daf30]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x1400038e4
cmp r10, 2
jb 0x1400038e4
cmp byte [r9], r8b
jne 0x1400038e4
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x1400038c0
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x14000393f
lea rbx, [0x1400daf30]
cmp r8b, 0x23
jne 0x140003923
cmp byte [r9], r8b
jne 0x140003923
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x140003910
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x140003a80
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push r14
sub rsp, 0x20
mov r14, r8
test r8, r8
je 0x140003a9a
mov qword [r8], 0
lea rdx, [0x1400daaa8]
call fcn.140003950
mov rbx, rax
test rax, rax
jne 0x140003aba
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rsi
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov esi, eax
cmp eax, 0xffffffff
je 0x140003b93
xor edx, edx
mov r8d, 2
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140003b93
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x140003b93
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140003b93
cmp rdi, 0xffffffffffffffff
je 0x140003b93
mov rax, qword [0x1401cd478]
test rax, rax
je 0x140003b30
inc dword [rax + 0xf4]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
je 0x140003b93
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rdi
je 0x140003b80
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x1401cd478]
test rax, rax
je 0x140003b75
dec dword [rax + 0xf4]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x140003b9c
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test r14, r14
je 0x140003b8e
mov qword [r14], rdi
mov rax, rsi
jmp 0x140003b9e
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret