joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140011b95
Capabilities:
Write file on windows

Disassembly:
jmp 0x14001cbc0
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1a8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x2e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1c8]
mov rax, qword [0x140037040]
xor rax, rbp
mov qword [rbp + 0x168], rax
lea rcx, [0x140040062]
call fcn.140011bcc
nop
mov rax, qword [rbp + 0x190]
cmp qword [rax + 0x68], 0
je 0x14001cc27
mov rax, qword [rbp + 0x190]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x14001cc2e
mov al, 1
jmp 0x14001cd7e
call fcn.14001137f
mov rcx, qword [rbp + 0x190]
mov rcx, qword [rcx]
mov qword [rbp + 0x158], rcx
mov edx, eax
mov rcx, qword [rbp + 0x190]
mov rax, qword [rbp + 0x158]
call qword [rax + 0x18]
mov dword [rbp + 0x160], eax
call fcn.14001137f
mov ecx, dword [rbp + 0x160]
mov edx, ecx
mov ecx, eax
call fcn.140011947
movzx eax, al
test eax, eax
je 0x14001cc7f
xor al, al
jmp 0x14001cd7e
mov qword [rbp + 8], 0x20
lea rax, [rbp + 0x48]
mov rcx, qword [rbp + 0x190]
add rcx, 0x74
lea rdx, [rbp + 0x68]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [rbp + 0x28]
mov rdx, rcx
mov rax, qword [rbp + 0x190]
mov rcx, qword [rax + 0x68]
call qword [sym.imp.MSVCP140D.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
mov dword [rbp + 0x154], eax
cmp dword [rbp + 0x154], 0
je 0x14001cce4
cmp dword [rbp + 0x154], 1
je 0x14001ccef
cmp dword [rbp + 0x154], 3
je 0x14001cd6d
jmp 0x14001cd7c
mov rax, qword [rbp + 0x190]
mov byte [rax + 0x71], 0
lea rax, [rbp + 0x28]
mov rcx, qword [rbp + 0x68]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x88], rax
cmp qword [rbp + 0x88], 0
jbe 0x14001cd3f
mov rax, qword [rbp + 0x190]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x88]
mov edx, 1
lea rcx, [rbp + 0x28]
call qword [sym.imp.ucrtbased.dll_fwrite]
cmp qword [rbp + 0x88], rax
je 0x14001cd3f
xor al, al
jmp 0x14001cd7e
mov rax, qword [rbp + 0x190]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x14001cd5a
mov dword [rbp + 0x154], 1
jmp 0x14001cd64
mov dword [rbp + 0x154], 0
movzx eax, byte [rbp + 0x154]
jmp 0x14001cd7e
mov rax, qword [rbp + 0x190]
mov byte [rax + 0x71], 0
mov al, 1
jmp 0x14001cd7e
xor al, al
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x14002fb40]
call fcn.1400119b5
mov rax, rdi
mov rcx, qword [rbp + 0x168]
xor rcx, rbp
call fcn.1400115b4
lea rsp, [rbp + 0x178]
pop rdi
pop rbp
ret
Function at 0x1400258c0
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x68
mov ecx, 1
call fcn.140011c35
movzx eax, al
test eax, eax
jne 0x1400258e0
mov ecx, 7
call fcn.1400119c9
nop
mov byte [rsp + 0x20], 0
call fcn.140011a1e
mov byte [rsp + 0x21], al
cmp dword [0x140037880], 1
jne 0x140025904
mov ecx, 7
call fcn.1400119c9
nop
jmp 0x14002595c
cmp dword [0x140037880], 0
jne 0x140025957
mov dword [0x140037880], 1
lea rdx, [0x14002e888]
lea rcx, [0x14002e558]
call fcn.14001158c
test eax, eax
je 0x140025938
mov eax, 0xff
jmp 0x140025a61
lea rdx, [0x14002e448]
lea rcx, [section..rdata]
call fcn.1400119fb
mov dword [0x140037880], 2
jmp 0x14002595c
mov byte [rsp + 0x20], 1
movzx ecx, byte [rsp + 0x21]
call fcn.1400119a1
call fcn.140011884
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x1400259b9
mov rcx, qword [rsp + 0x30]
call fcn.140011492
movzx eax, al
test eax, eax
je 0x1400259b9
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov edx, 2
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call qword [0x140041020]
nop
call fcn.140011915
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x1400259ed
mov rcx, qword [rsp + 0x38]
call fcn.140011492
movzx eax, al
test eax, eax
je 0x1400259ed
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call fcn.140011b63
nop
call fcn.140025ad0
mov dword [rsp + 0x28], eax
call fcn.14001184d
movzx eax, al
test eax, eax
jne 0x140025a0c
mov ecx, dword [rsp + 0x28]
call fcn.1400110f0
nop
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x140025a1b
call fcn.140011b7c
nop
xor edx, edx
mov cl, 1
call fcn.140011456
mov eax, dword [rsp + 0x28]
jmp 0x140025a61
add rsp, 0x68
ret
Function at 0x140001d90
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x140001db8
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x140001dde
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x140001de0
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x140001e39
test ecx, ecx
jle 0x140001e19
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x140001e39
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140001e39
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret

Function at 0x140001e60
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x140001e82
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x140001e98
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x140001eb4
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140001eb6
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140001ef2
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x140001f8e
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x140001f2d
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x140001f6e
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x140001f8e
cmp rbx, rax
ja 0x140001f40
test rbx, rbx
je 0x140001f8e
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
Function at 0x1400023f0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x140008040]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x14000241d
xor eax, eax
jmp 0x140002589
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x140002457
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x140002457
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x140002589
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x14000257c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14000249a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x1400024c5
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140002581
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140002534
sub eax, 1
je 0x140002534
cmp eax, 2
jne 0x14000257c
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140002581
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x140002562
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x14000257c
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x140002581
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140002fd0
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x140002990
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140008040]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140002a63
cmp byte [rcx + 0x71], 0
je 0x140002a63
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x140002a5f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140002a24
sub eax, 1
je 0x140002a28
cmp eax, 2
jne 0x140002a5f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140002fd0
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140002a56
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x140002a5f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x140002a0c
xor al, al
jmp 0x140002a0c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140002fd0
add rsp, 0x60
pop rbx
ret

Function at 0x140003984
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400039ce
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400039ce
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400039ce
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400039ce
cmp dword [rcx + 0x84], 0xe
jbe 0x1400039ce
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400039d0
xor al, al
add rsp, 0x28
ret
Function at 0x653956e0
Capabilities:
Hash data with md5

Disassembly:
sub rsp, 0x28
test rcx, rcx
je 0x6539571a
xor eax, eax
mov dword [rcx + 8], 0x67452301
mov dword [rcx + 0xc], 0xefcdab89
mov dword [rcx + 0x10], 0x98badcfe
mov dword [rcx + 0x14], 0x10325476
mov dword [rcx + 0x18], 0
mov qword [rcx], 0
add rsp, 0x28
ret
lea rdx, str.src_hashes_md5.c
lea rcx, [0x65409131]
mov r8d, 0xe9
call fcn.6539a680
nop
nop
nop word cs:[rax + rax]
Function at 0x65395740
Capabilities:
Hash data with md5

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
test rcx, rcx
mov rbx, rcx
mov rsi, rdx
je 0x65395950
test rdx, rdx
je 0x65395969
mov edx, dword [rcx + 0x18]
mov eax, 0x10
cmp edx, 0x3f
jbe 0x65395774
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
lea r8d, [rdx*8]
add r8, qword [rcx]
mov eax, edx
mov qword [rcx], r8
lea ecx, [rdx + 1]
cmp ecx, 0x38
mov dword [rbx + 0x18], ecx
mov byte [rbx + rax + 0x1c], pe_nt_image_headers64
ja 0x653958d0
cmp ecx, 0x38
lea rdi, [rbx + 0x1c]
je 0x65395899
mov edx, ecx
lea r9d, [rcx + 1]
mov eax, ecx
not edx
mov byte [rbx + rax + 0x1c], 0
and edx, 7
cmp r9d, 0x38
je 0x65395892
test edx, edx
je 0x6539583d
cmp edx, 1
je 0x6539582b
cmp edx, 2
je 0x6539581f
cmp edx, 3
je 0x65395813
cmp edx, 4
je 0x65395806
cmp edx, 5
je 0x653957f9
cmp edx, 6
je 0x653957ed
mov byte [rbx + r9 + 0x1c], 0
lea r9d, [rcx + 2]
mov ecx, r9d
add r9d, 1
mov byte [rbx + rcx + 0x1c], 0
mov r10d, r9d
add r9d, 1
mov byte [rbx + r10 + 0x1c], 0
mov r11d, r9d
add r9d, 1
mov byte [rbx + r11 + 0x1c], 0
mov edx, r9d
add r9d, 1
mov byte [rbx + rdx + 0x1c], 0
mov eax, r9d
add r9d, 1
mov byte [rbx + rax + 0x1c], 0
mov ecx, r9d
add r9d, 1
cmp r9d, 0x38
mov byte [rbx + rcx + 0x1c], 0
je 0x65395892
lea r11d, [r9 + 1]
lea edx, [r9 + 2]
mov r10d, r9d
mov byte [rbx + r10 + 0x1c], 0
lea eax, [r9 + 3]
lea ecx, [r9 + 4]
mov byte [rbx + r11 + 0x1c], 0
lea r10d, [r9 + 5]
mov byte [rbx + rdx + 0x1c], 0
lea r11d, [r9 + 6]
lea edx, [r9 + 7]
add r9d, 8
cmp r9d, 0x38
mov byte [rbx + rax + 0x1c], 0
mov byte [rbx + rcx + 0x1c], 0
mov byte [rbx + r10 + 0x1c], 0
mov byte [rbx + r11 + 0x1c], 0
mov byte [rbx + rdx + 0x1c], 0
jne 0x6539583d
mov dword [rbx + 0x18], 0x38
mov qword [rbx + 0x54], r8
mov rdx, rdi
mov rcx, rbx
call fcn.65394ea0
mov r9d, dword [rbx + 8]
xor eax, eax
mov dword [rsi], r9d
mov edi, dword [rbx + 0xc]
mov dword [rsi + 4], edi
mov r8d, dword [rbx + 0x10]
mov dword [rsi + 8], r8d
mov ebx, dword [rbx + 0x14]
mov dword [rsi + 0xc], ebx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
cmp ecx, 0x40
je 0x65395937
lea edi, [rdx + 2]
mov byte [rbx + rcx + 0x1c], 0
cmp edi, 0x40
je 0x65395930
lea r8d, [rdx + 3]
mov byte [rbx + rdi + 0x1c], 0
cmp r8d, 0x40
je 0x65395930
lea r9d, [rdx + 4]
mov byte [rbx + r8 + 0x1c], 0
cmp r9d, 0x40
je 0x65395930
lea r10d, [rdx + 5]
mov byte [rbx + r9 + 0x1c], 0
cmp r10d, 0x40
je 0x65395930
lea r11d, [rdx + 6]
mov byte [rbx + r10 + 0x1c], 0
cmp r11d, 0x40
je 0x65395930
cmp edx, 0x38
mov byte [rbx + r11 + 0x1c], 0
jne 0x65395930
mov byte [rbx + 0x5b], 0
mov dword [rbx + 0x18], 0x40
lea rdi, [rbx + 0x1c]
mov rcx, rbx
mov rdx, rdi
call fcn.65394ea0
mov r8, qword [rbx]
xor ecx, ecx
jmp 0x653957a5
lea rdx, str.src_hashes_md5.c
lea rcx, [0x65409131]
mov r8d, 0x106
call fcn.6539a680
lea rdx, str.src_hashes_md5.c
lea rcx, [0x6540913c]
mov r8d, 0x107
call fcn.6539a680
nop
nop dword [rax]
nop word cs:[rax + rax]
Function at 0x653dcbf0
Capabilities:
Check for software breakpoints

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
test r8d, r8d
mov rbp, rcx
je 0x653dcc30
mov rcx, qword [rdx + 0x10]
cmp dword [rcx + 8], 0xcd
je 0x653dcc22
test byte [rcx + 0xd], 0x10
jne 0x653dcc22
cmp qword [rdx + 0x28], 0
jne 0x653dcc22
cmp qword [rcx + 0x28], rdx
je 0x653dcc33
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rcx, rdx
mov rsi, qword [rdx + 0x18]
mov rbx, qword [rcx]
mov rdi, qword [rdx + 0x20]
and esi, 0x7fff
test rbx, rbx
je 0x653dcc22
mov edx, dword [rbx + 8]
movsxd r12, esi
cmp edx, 0x5c
je 0x653dccb3
ja 0x653dccd0
lea eax, [rdx - 7]
cmp eax, 1
jbe 0x653dcc22
mov rcx, rbp
call fcn.653dc7e0
test al, 4
jne 0x653dcc22
mov edx, eax
and edx, 3
cmp edx, 3
je 0x653dcd50
mov edx, eax
and edx, 0x300
cmp edx, 0x300
je 0x653dcd80
and eax, 0x30000
mov rcx, rbx
cmp eax, 0x30000
je 0x653dcda6
mov rbx, qword [rcx]
test rbx, rbx
je 0x653dcc22
mov edx, dword [rbx + 8]
cmp edx, 0x5c
jne 0x653dcc54
mov rax, qword [rbx + 0x10]
and eax, 0x7fff
cmp r12, rax
je 0x653dcce3
mov rcx, rbx
jmp 0x653dcc9f
cmp edx, 0xcd
jne 0x653dcc5e
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
cmp word [rbx + 0xc], 0
jne 0x653dcc22
cmp qword [rbx + 0x18], rdi
jne 0x653dcc22
cmp rcx, rbx
mov rax, qword [rbx]
je 0x653dcde0
mov qword [rcx], rax
mov qword [rbx], 0
mov qword [rbx + 8], 0
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 0
mov qword [rbx + 0x20], 0
mov qword [rbx + 0x28], 0
mov rax, qword [rbp + 0x38]
mov rdx, qword [rax + 0x100]
mov qword [rbx], rdx
mov qword [rax + 0x100], rbx
jmp 0x653dcc9f
test al, 8
je 0x653dcdc0
mov edx, dword [rbx + 0x10]
and edx, 0x7fff
cmp edx, esi
je 0x653dcc22
mov edx, dword [rbx + 0x14]
and edx, 0x7fff
cmp edx, esi
jne 0x653dcc78
jmp 0x653dcc22
mov rdx, qword [rbx + 0x18]
and edx, 0x7fff
cmp r12, rdx
je 0x653dcc22
and eax, 0x30000
mov rcx, rbx
cmp eax, 0x30000
jne 0x653dcc9f
mov rax, qword [rbx + 0x20]
and eax, 0x7fff
cmp r12, rax
jne 0x653dcc9f
jmp 0x653dcc22
mov rdx, qword [rbx + 0x10]
and edx, 0x7fff
cmp r12, rdx
jne 0x653dcc78
jmp 0x653dcc22
mov rdx, qword [rbp + 0x38]
mov qword [rdx], rax
jmp 0x653dcd07
Function at 0x653fb110
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
and rsp, 0xfffffffffffffff0
sub rsp, 0x20
cmp dword [rcx + 0x244], 0x10
ja 0x653fb190
mov rbx, rcx
mov ecx, dword [rcx + 0x238]
mov rsi, rdx
mov edi, r8d
call fcn.653fb9a0
test eax, eax
mov r14d, eax
jne 0x653fb196
mov eax, dword [rbx + 0x240]
test eax, eax
jne 0x653fb181
movsxd rcx, dword [rbx + 0x244]
test ecx, ecx
jne 0x653fb1b0
cmp qword [rbx + 0x248], 0
je 0x653fb3a0
lea r13, [rbx + 0x228]
lea r12, [rbx + 0x1f8]
jmp 0x653fb22a
cmp eax, 1
je 0x653fb3b0
nop word [rax + rax]
mov r14d, 0x10
lea rsp, [rbp - 0x38]
mov eax, r14d
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov eax, dword [rbx + 0x23c]
lea r13, [rbx + 0x228]
test eax, eax
jne 0x653fb1f0
cmp ecx, 0xc
jne 0x653fb1f0
mov rax, qword [rbx + 0x228]
mov qword [rbx + 0x208], rax
mov eax, dword [r13 + 8]
mov dword [rbx + 0x214], 0x1000000
mov dword [rbx + 0x210], eax
jmp 0x653fb295
lea eax, [rcx - 1]
lea r12, [rbx + 0x1f8]
lea r8, [rbx + rax + 0x1f9]
mov rdx, r12
movzx eax, byte [rdx + 0x30]
xor byte [rdx], al
add rdx, 1
cmp rdx, r8
jne 0x653fb205
shl rcx, 3
add qword [rbx + 0x248], rcx
mov rdx, r12
mov rcx, rbx
call fcn.653fb960
mov edx, 8
mov rcx, r13
call fcn.6539b190
mov rax, qword [rbx + 0x248]
mov rdx, r12
bswap rax
mov qword [rbx + 0x230], rax
lea rax, [rbx + 0x208]
movzx ecx, byte [rdx + 0x30]
xor byte [rdx], cl
add rdx, 1
cmp rax, rdx
jne 0x653fb252
mov rdx, r12
mov rcx, rbx
call fcn.653fb960
mov rdx, qword [rbx + 0x200]
mov rax, qword [rbx + 0x1f8]
mov rcx, r12
mov qword [rbx + 0x210], rdx
mov qword [rbx + 0x208], rax
mov edx, 0x10
call fcn.6539b190
mov rdx, qword [rbx + 0x210]
mov rax, qword [rbx + 0x208]
mov rcx, r13
mov qword [rbx + 0x220], rdx
mov qword [rbx + 0x218], rax
mov edx, 0x10
call fcn.6539b190
mov qword [rbx + 0x240], 1
mov qword [rbx + 0x248], 0
mov r13d, edi
and r13d, 0xfffffff0
je 0x653fb3d0
lea r15, [rbx + 0x1f8]
xor r12d, r12d
nop dword [rax + rax]
mov eax, r12d
mov rdx, r15
mov rcx, rbx
mov rax, qword [rsi + rax]
xor qword [rbx + 0x1f8], rax
lea eax, [r12 + 8]
add r12d, 0x10
mov rax, qword [rsi + rax]
xor qword [rbx + 0x200], rax
call fcn.653fb960
sub qword [rbx + 0x248], 0xffffffffffffff80
cmp r12d, r13d
jb 0x653fb2f0
mov eax, r12d
add rsi, rax
cmp edi, r12d
jbe 0x653fb196
sub edi, 1
sub edi, r12d
lea r12, [rsi + rdi + 1]
lea rdi, [rbx + 0x1f8]
jmp 0x653fb359
cmp rsi, r12
je 0x653fb196
movsxd rdx, dword [rbx + 0x244]
add rsi, 1
movzx ecx, byte [rsi - 1]
lea eax, [rdx + 1]
mov dword [rbx + 0x244], eax
xor byte [rbx + rdx + 0x1f8], cl
cmp eax, 0x10
jne 0x653fb350
mov rdx, rdi
mov rcx, rbx
call fcn.653fb960
mov dword [rbx + 0x244], 0
sub qword [rbx + 0x248], 0xffffffffffffff80
jmp 0x653fb350
mov r14d, 1
jmp 0x653fb196
mov eax, dword [rbx + 0x244]
cmp eax, 0xf
jg 0x653fb190
xor r12d, r12d
test eax, eax
jne 0x653fb330
jmp 0x653fb2d4
xor r12d, r12d
jmp 0x653fb330
Function at 0x653fb800
Capabilities:
Encode data using xor

Disassembly:
push r14
push r13
push r12
push rbp
mov ebp, 0x10
push rdi
push rsi
push rbx
sub rsp, 0x20
mov eax, dword [rcx + 0x240]
test eax, eax
jne 0x653fb941
cmp dword [rcx + 0x244], 0xf
mov rbx, rcx
ja 0x653fb941
mov ecx, dword [rcx + 0x238]
mov rsi, rdx
mov r12d, r8d
call fcn.653fb9a0
test eax, eax
mov ebp, eax
jne 0x653fb941
mov eax, dword [rbx + 0x244]
lea edx, [rax + r12]
cmp edx, 0xc
jbe 0x653fb862
or dword [rbx + 0x23c], 1
xor edi, edi
test eax, eax
jne 0x653fb8bb
mov r13d, r12d
and r13d, 0xfffffff0
je 0x653fb952
lea r14, [rbx + 0x1f8]
nop dword [rax]
mov eax, edi
mov rdx, r14
mov rcx, rbx
mov rax, qword [rsi + rax]
xor qword [rbx + 0x1f8], rax
lea eax, [rdi + 8]
add edi, 0x10
mov rax, qword [rsi + rax]
xor qword [rbx + 0x200], rax
call fcn.653fb960
sub qword [rbx + 0x248], 0xffffffffffffff80
cmp edi, r13d
jb 0x653fb880
mov eax, edi
add rsi, rax
cmp r12d, edi
jbe 0x653fb941
sub r12d, 1
lea r13, [rbx + 0x1f8]
sub r12d, edi
lea rdi, [rbx + 0x208]
lea r12, [rsi + r12 + 1]
jmp 0x653fb8e5
cmp r12, rsi
je 0x653fb941
movsxd rdx, dword [rbx + 0x244]
add rsi, 1
lea ecx, [rdx + 1]
mov dword [rbx + 0x244], ecx
movzx eax, byte [rsi - 1]
cmp ecx, 0x10
mov byte [rbx + rdx + 0x228], al
jne 0x653fb8e0
mov rdx, r13
nop dword [rax]
movzx ecx, byte [rdx + 0x30]
xor byte [rdx], cl
add rdx, 1
cmp rdi, rdx
jne 0x653fb910
mov rdx, r13
mov rcx, rbx
call fcn.653fb960
sub qword [rbx + 0x248], 0xffffffffffffff80
cmp r12, rsi
mov dword [rbx + 0x244], 0
jne 0x653fb8e5
add rsp, 0x20
mov eax, ebp
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov edi, eax
jmp 0x653fb8bb
Function at 0x65b93058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.65b931df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, pe_nt_image_headers64
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x65b93089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x65b9306f
add dl, dl
jne 0x65b93096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x65b930f6
xor eax, eax
add dl, dl
jne 0x65b930a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x65b931ad
add dl, dl
jne 0x65b930b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x65b930c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x65b930d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x65b930dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x65b930ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x65b9307e
mov eax, 1
add dl, dl
jne 0x65b93106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x65b93113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x65b930fb
sub eax, ebx
mov ebx, 1
jne 0x65b9314c
mov ecx, 1
add dl, dl
jne 0x65b9312e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x65b9313b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x65b93123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x65b9307e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x65b93168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x65b93175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x65b9315d
cmp eax, 0x7d00
jae 0x65b9319b
cmp eax, 0x500
jb 0x65b93196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x65b9307e
cmp eax, 0x7f
ja 0x65b9319e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x65b9307e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x65b931d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x65b9307e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20