joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180011404
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x90
xor r14d, r14d
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
mov rsi, rdx
movsxd rdi, r9d
mov rbp, rcx
test r9d, r9d
jle 0x1800115f3
lea rbx, [r8 + 0x20]
xor r13d, r13d
lea r8d, [r14 + 1]
mov r11d, 0x100
xorps xmm7, xmm7
movss xmm6, dword [rbx - 0x20]
comiss xmm6, xmm7
jbe 0x1800114a5
movsxd r10, dword [rsi + 0x1c]
mov r9, qword [rsi]
movsx ecx, r11w
movzx eax, byte [r10 + r9 + 7]
movzx edx, byte [r10 + r9 + 6]
imul edx, ecx
movsx ecx, r11w
add dx, ax
movzx eax, byte [r10 + r9 + 5]
movsx r8d, dx
movzx edx, byte [r10 + r9 + 4]
imul edx, ecx
add ax, dx
cwde
sub eax, r8d
mov r8d, 1
movd xmm0, eax
jmp 0x1800114c6
movsxd rdx, dword [rsi + 0x14]
mov rax, qword [rsi]
xorps xmm6, xmmword [0x18004aa20]
movzx ecx, byte [rdx + rax + 0x12]
movzx eax, byte [rdx + rax + 0x13]
shl ecx, 8
add ecx, eax
movd xmm0, ecx
mov al, byte [rbp + 0x18]
xor r15d, r15d
cvtdq2ps xmm0, xmm0
mov byte [rbx], al
mov al, byte [rbp + 0x1c]
mov byte [rbx + 1], al
divss xmm6, xmm0
cmp dword [rbx - 0x10], r15d
jle 0x1800115e6
mov rcx, qword [rsp + 0xe0]
mov rax, r13
shl rax, 4
add rcx, 6
xor r12d, r12d
add rcx, rax
mov qword [rsp + 0x60], rcx
mov eax, dword [rbx - 0x1c]
test eax, eax
je 0x180011510
lea edx, [rax + r15]
jmp 0x180011518
mov rax, qword [rbx - 0x18]
mov edx, dword [r12 + rax]
mov rcx, rsi
call fcn.18000ea40
mov edx, eax
xorps xmm3, xmm3
mov eax, dword [rbp + 0x1c]
xorps xmm2, xmm2
mov rcx, rsi
cvtsi2ss xmm3, rax
mov eax, dword [rbp + 0x18]
cvtsi2ss xmm2, rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x54]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0xd8]
mov qword [rsp + 0x30], rax
mulss xmm3, xmm6
mulss xmm2, xmm6
movss dword [rsp + 0x28], xmm7
movss dword [rsp + 0x20], xmm7
call fcn.18000f8f4
mov rcx, qword [rsp + 0x60]
mov r8d, 1
movzx eax, word [rbp + 0x18]
add r14d, r8d
sub ax, word [rsp + 0xd8]
add r13, r8
add ax, word [rbp + 0x14]
add r15d, r8d
add ax, word [rsp + 0x50]
add r12, 4
sub ax, r8w
mov word [rcx - 2], ax
movzx eax, word [rbp + 0x1c]
sub ax, word [rsp + 0x54]
add ax, word [rbp + 0x14]
add ax, word [rsp + 0x58]
sub ax, r8w
mov word [rcx], ax
add rcx, 0x10
mov qword [rsp + 0x60], rcx
cmp r15d, dword [rbx - 0x10]
jl 0x180011503
mov r11d, 0x100
add rbx, 0x28
sub rdi, r8
jne 0x180011454
movaps xmm7, xmmword [rsp + 0x70]
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov eax, r14d
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x180012b24
Capabilities:
Compute adler32 checksum

Disassembly:
mov qword [rsp + 8], rbx
mov rbx, rdx
mov eax, 0x5e6ea9af
mul r8d
mov r11d, r8d
xor r9d, r9d
shr edx, 0xb
mov r10d, 1
imul eax, edx, 0x15b0
sub r11d, eax
test r8d, r8d
je 0x180012c13
xor ecx, ecx
cmp r11d, 7
jbe 0x180012bbe
lea edx, [rcx + 7]
movzx eax, byte [rbx]
add ecx, 8
add r10d, eax
add edx, 8
movzx eax, byte [rbx + 1]
add r9d, r10d
add r10d, eax
movzx eax, byte [rbx + 2]
add r9d, r10d
add r10d, eax
movzx eax, byte [rbx + 3]
add r9d, r10d
add r10d, eax
movzx eax, byte [rbx + 4]
add r9d, r10d
add r10d, eax
movzx eax, byte [rbx + 5]
add r9d, r10d
add r10d, eax
movzx eax, byte [rbx + 6]
add r9d, r10d
add r10d, eax
movzx eax, byte [rbx + 7]
add r9d, r10d
add r10d, eax
add rbx, 8
add r9d, r10d
cmp edx, r11d
jb 0x180012b60
cmp ecx, r11d
jae 0x180012bdc
mov eax, r11d
sub eax, ecx
mov ecx, eax
movzx eax, byte [rbx]
inc rbx
add r10d, eax
add r9d, r10d
sub rcx, 1
jne 0x180012bca
mov eax, 0x80078071
mul r10d
shr edx, 0xf
imul eax, edx, 0xffff000f
add r10d, eax
mov eax, 0x80078071
mul r9d
shr edx, 0xf
imul ecx, edx, 0xffff000f
add r9d, ecx
sub r8d, r11d
mov r11d, 0x15b0
jne 0x180012b55
mov rbx, qword [rsp + 8]
shl r9d, 0x10
lea eax, [r10 + r9]
ret
Function at 0x18002065c
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
xor edx, edx
mov cl, 0x66
call fcn.180001060
mov edx, 1
mov byte [rbp - 0x20], al
call fcn.180001060
mov edx, 2
mov byte [rbp - 0x1f], al
mov cl, 0x20
call fcn.180001060
mov edx, 3
mov byte [rbp - 0x1e], al
mov cl, 0x36
call fcn.180001060
mov edx, 4
mov byte [rbp - 0x1d], al
mov cl, 0x33
call fcn.180001060
mov edx, 5
mov byte [rbp - 0x1c], al
mov cl, 0x20
call fcn.180001060
mov edx, 6
mov byte [rbp - 0x1b], al
mov cl, 0x30
call fcn.180001060
mov edx, 7
mov byte [rbp - 0x1a], al
call fcn.180001060
movdqa xmm0, xmmword [0x18004a9e0]
lea rcx, [rbp - 0x20]
mov byte [rbp - 0x19], al
xor eax, eax
mov byte [rbp - 0x18], al
movdqa xmmword [rbp - 0x10], xmm0
movd xmm0, dword [rbp - 0x10]
movd xmm1, eax
add eax, 4
pshufd xmm1, xmm1, 0
paddd xmm1, xmmword [0x18004a9b0]
andps xmm1, xmmword [0x18004a9d0]
packuswb xmm1, xmm1
packuswb xmm1, xmm1
paddb xmm1, xmm0
movd xmm0, dword [rcx]
xorps xmm1, xmm0
movd dword [rcx], xmm1
lea rcx, [rcx + 4]
cmp eax, 8
jb 0x1800206ec
movups xmm0, xmmword [0x180050900]
lea r8, [rbp - 0x20]
mov byte [rbp - 0x18], 0
lea rdx, [rbp - 0x10]
lea rcx, [rbp + 0x18]
movdqu xmmword [rbp - 0x10], xmm0
call fcn.180029b14
mov dword [rbp + 0x10], 0xa3f0ac80
mov dword [rbp + 0x14], 0xed18ed18
mov rcx, qword [rbp + 0x10]
xor rcx, qword [rax]
mov qword [0x18004c2e0], rcx
add rsp, 0x40
pop rbp
ret
Function at 0x180021ed4
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rcx
push rbp
mov rbp, rsp
sub rsp, 0x50
xor edx, edx
mov cl, 0x45
call fcn.180001060
mov edx, 1
mov byte [rbp - 0x20], al
mov cl, 0x38
call fcn.180001060
mov edx, 2
mov byte [rbp - 0x1f], al
mov cl, 0x20
call fcn.180001060
mov edx, 3
mov byte [rbp - 0x1e], al
mov cl, 0x3f
call fcn.180001060
mov edx, 4
mov byte [rbp - 0x1d], al
mov cl, 0x20
call fcn.180001060
mov edx, 5
mov byte [rbp - 0x1c], al
mov cl, 0x3f
call fcn.180001060
mov edx, 6
mov byte [rbp - 0x1b], al
mov cl, 0x20
call fcn.180001060
mov edx, 7
mov byte [rbp - 0x1a], al
mov cl, 0x3f
call fcn.180001060
mov edx, 8
mov byte [rbp - 0x19], al
mov cl, 0x20
call fcn.180001060
mov edx, 9
mov byte [rbp - 0x18], al
mov cl, 0x3f
call fcn.180001060
mov edx, 0xa
mov byte [rbp - 0x17], al
mov cl, 0x20
call fcn.180001060
mov edx, 0xb
mov byte [rbp - 0x16], al
mov cl, 0x34
call fcn.180001060
mov edx, 0xc
mov byte [rbp - 0x15], al
mov cl, 0x38
call fcn.180001060
mov edx, 0xd
mov byte [rbp - 0x14], al
mov cl, 0x20
call fcn.180001060
mov edx, 0xe
mov byte [rbp - 0x13], al
mov cl, 0x38
call fcn.180001060
mov edx, 0xf
mov byte [rbp - 0x12], al
mov cl, 0x42
call fcn.180001060
mov edx, 0x10
mov byte [rbp - 0x11], al
mov cl, 0x20
call fcn.180001060
mov edx, 0x11
mov byte [rbp - 0x10], al
mov cl, 0x44
call fcn.180001060
mov edx, 0x12
mov byte [rbp - 0xf], al
mov cl, 0x38
call fcn.180001060
mov edx, 0x13
mov byte [rbp - 0xe], al
mov cl, 0x20
call fcn.180001060
mov byte [rbp - 0xd], al
mov edx, 0x14
mov cl, 0x34
call fcn.180001060
mov edx, 0x15
mov byte [rbp - 0xc], al
mov cl, 0x43
call fcn.180001060
mov edx, 0x16
mov byte [rbp - 0xb], al
mov cl, 0x20
call fcn.180001060
mov edx, 0x17
mov byte [rbp - 0xa], al
mov cl, 0x38
call fcn.180001060
mov edx, 0x18
mov byte [rbp - 9], al
mov cl, 0x44
call fcn.180001060
mov edx, 0x19
mov byte [rbp - 8], al
mov cl, 0x20
call fcn.180001060
mov edx, 0x1a
mov byte [rbp - 7], al
mov cl, 0x34
call fcn.180001060
mov edx, 0x1b
mov byte [rbp - 6], al
mov cl, 0x44
call fcn.180001060
mov edx, 0x1c
mov byte [rbp - 5], al
mov cl, 0x20
call fcn.180001060
mov edx, 0x1d
mov byte [rbp - 4], al
mov cl, 0x45
call fcn.180001060
mov edx, 0x1e
mov byte [rbp - 3], al
mov cl, 0x34
call fcn.180001060
mov byte [rbp - 2], al
xor eax, eax
mov byte [rbp - 1], al
xor edx, edx
movsxd rcx, edx
lea eax, [rdx + 0x13]
inc edx
xor byte [rbp + rcx - 0x20], al
cmp edx, 0x1f
jb 0x1800220b6
movups xmm0, xmmword [0x180050920]
lea r8, [rbp - 0x20]
mov byte [rbp - 1], 0
lea rdx, [rbp - 0x30]
lea rcx, [rbp + 0x10]
movdqu xmmword [rbp - 0x30], xmm0
call fcn.180029b14
mov rdx, qword [rax]
inc rdx
movsxd rcx, dword [rdx]
add rcx, 4
add rcx, rdx
mov qword [rax], rcx
lea rax, [0x18004c3f0]
mov qword [0x18004c3f0], rcx
add rsp, 0x50
pop rbp
ret
Function at 0x18002933c
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rdx, qword [0x1800509b8]
mov rdi, rcx
movaps xmmword [rax - 0x18], xmm6
mov rax, qword [rdx + 0x18]
mov rbx, qword [rax + 0x10]
add rax, 0x20
cmp rbx, rax
je 0x1800294b9
movdqa xmm6, xmmword [0x18004a9e0]
xor r14d, r14d
mov r8, qword [0x180050990]
mov r9, qword [0x180050968]
mov rsi, qword [rbx + 0x60]
test r8, r8
jne 0x1800294da
test r9, r9
je 0x1800294df
xor edx, edx
mov cl, 0x5f
call fcn.180001060
lea edx, [r8 + 1]
mov byte [rbp - 0x30], al
mov cl, 0x77
call fcn.180001060
lea edx, [r8 + 2]
mov byte [rbp - 0x2f], al
mov cl, 0x63
call fcn.180001060
lea edx, [r8 + 3]
mov byte [rbp - 0x2e], al
mov cl, 0x73
call fcn.180001060
lea edx, [r8 + 4]
mov byte [rbp - 0x2d], al
mov cl, 0x69
call fcn.180001060
lea edx, [r8 + 5]
mov byte [rbp - 0x2c], al
mov cl, 0x63
call fcn.180001060
lea edx, [r8 + 6]
mov byte [rbp - 0x2b], al
mov cl, 0x6d
call fcn.180001060
lea edx, [r8 + 7]
mov byte [rbp - 0x2a], al
mov cl, 0x70
call fcn.180001060
mov byte [rbp - 0x29], al
lea rcx, [rbp - 0x30]
xor eax, eax
movdqa xmmword [rbp - 0x20], xmm6
mov byte [rbp - 0x28], al
movd xmm0, dword [rbp - 0x20]
movd xmm1, eax
add eax, 4
pshufd xmm1, xmm1, 0
paddd xmm1, xmmword [0x18004a9b0]
andps xmm1, xmmword [0x18004a9d0]
packuswb xmm1, xmm1
packuswb xmm1, xmm1
paddb xmm1, xmm0
movd xmm0, dword [rcx]
xorps xmm1, xmm0
movd dword [rcx], xmm1
lea rcx, [rcx + 4]
cmp eax, 8
jb 0x180029425
lea rdx, [rbp - 0x30]
mov byte [rbp - 0x28], r14b
mov rcx, r9
call fcn.18002952c
mov r8, rax
mov qword [0x180050990], rax
mov rdx, rsi
mov rcx, rdi
call r8
test eax, eax
je 0x180029519
mov rdx, qword [0x1800509b8]
mov r8, qword [0x180050990]
mov r9, qword [0x180050968]
mov rax, qword [rdx + 0x18]
mov rbx, qword [rbx]
add rax, 0x20
cmp rbx, rax
jne 0x180029393
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov r14, qword [rsp + 0x78]
movaps xmm6, xmmword [rsp + 0x40]
add rsp, 0x50
pop rbp
ret
test r9, r9
jne 0x18002947f
mov rax, r14
cmp word [rdi], r14w
je 0x18002950b
mov rcx, r14
movzx r10d, word [rcx + rsi]
test r10w, r10w
je 0x18002950b
cmp word [rcx + rdi], r10w
jne 0x1800294a5
inc rax
lea rcx, [rax + rax]
cmp word [rcx + rdi], r14w
jne 0x1800294eb
cmp word [rdi + rax*2], r14w
je 0x18002951f
cmp word [rsi + rax*2], r14w
je 0x1800294a5
mov rax, qword [rbx + 0x30]
jmp 0x1800294bb
cmp word [rsi + rax*2], r14w
je 0x180029519
jmp 0x1800294a5
Function at 0x18002952c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
movsxd rax, dword [rcx + 0x3c]
mov r9, rcx
mov r14, rdx
mov r8d, dword [rax + rcx + 0x88]
add r8, rcx
mov edi, dword [r8 + 0x1c]
mov esi, dword [r8 + 0x24]
add rdi, rcx
mov r10d, dword [r8 + 0x20]
add rsi, rcx
mov ebp, dword [r8 + 0x18]
add r10, rcx
xor ecx, ecx
test ebp, ebp
je 0x1800295cd
mov r8d, dword [r10]
xor edx, edx
add r8, r9
cmp byte [r8], dl
je 0x1800295a4
mov rbx, r14
mov rax, r8
sub rbx, r8
mov r11b, byte [rax + rbx]
test r11b, r11b
je 0x1800295a4
cmp byte [rax], r11b
jne 0x1800295c3
inc rax
inc rdx
cmp byte [rax], 0
jne 0x18002958b
cmp byte [rdx + r8], 0
mov al, byte [r14 + rdx]
je 0x1800295bf
test al, al
je 0x1800295c3
movzx ecx, word [rsi + rcx*2]
mov eax, dword [rdi + rcx*4]
add rax, r9
jmp 0x1800295cf
test al, al
je 0x1800295b3
inc ecx
add r10, 4
cmp ecx, ebp
jb 0x180029575
xor eax, eax
mov rbx, qword [rsp + 0x10]
mov rbp, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
pop r14
ret

Function at 0x180029620
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [0x180050948]
mov rbx, rcx
test rax, rax
jne 0x1800296cc
xor edx, edx
mov cl, 0x73
call fcn.180001060
mov edx, 1
mov byte [rsp + 0x38], al
mov cl, 0x74
call fcn.180001060
mov edx, 2
mov byte [rsp + 0x39], al
mov cl, 0x72
call fcn.180001060
mov edx, 3
mov byte [rsp + 0x3a], al
mov cl, 0x6c
call fcn.180001060
mov edx, 4
mov byte [rsp + 0x3b], al
mov cl, 0x65
call fcn.180001060
mov edx, 5
mov byte [rsp + 0x3c], al
mov cl, 0x6e
call fcn.180001060
mov byte [rsp + 0x3d], al
xor eax, eax
mov byte [rsp + 0x3e], al
xor edx, edx
movsxd rcx, edx
lea eax, [rdx + 0x13]
inc edx
xor byte [rsp + rcx + 0x38], al
cmp edx, 6
jb 0x18002969e
mov rcx, qword [0x180050968]
lea rdx, [rsp + 0x38]
mov byte [rsp + 0x3e], 0
call fcn.18002952c
mov qword [0x180050948], rax
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp rax
Function at 0x1800296d8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbp
push rbx
push rsi
push rdi
push r14
mov rbp, rsp
sub rsp, 0x30
mov rax, qword [0x180050998]
lea r14, [rbp + 0x48]
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
test rax, rax
jne 0x1800297d2
xor edx, edx
mov cl, 0x5f
call fcn.180001060
mov edx, 1
mov byte [rbp - 0x10], al
mov cl, 0x76
call fcn.180001060
mov edx, 2
mov byte [rbp - 0xf], al
mov cl, 0x73
call fcn.180001060
mov edx, 3
mov byte [rbp - 0xe], al
mov cl, 0x6e
call fcn.180001060
mov edx, 4
mov byte [rbp - 0xd], al
mov cl, 0x70
call fcn.180001060
mov edx, 5
mov byte [rbp - 0xc], al
mov cl, 0x72
call fcn.180001060
mov edx, 6
mov byte [rbp - 0xb], al
mov cl, 0x69
call fcn.180001060
mov edx, 7
mov byte [rbp - 0xa], al
mov cl, 0x6e
call fcn.180001060
mov edx, 8
mov byte [rbp - 9], al
mov cl, 0x74
call fcn.180001060
mov edx, 9
mov byte [rbp - 8], al
mov cl, 0x66
call fcn.180001060
mov byte [rbp - 7], al
xor eax, eax
mov byte [rbp - 6], al
xor edx, edx
movsxd rcx, edx
lea eax, [rdx + 0x13]
inc edx
xor byte [rbp + rcx - 0x10], al
cmp edx, 0xa
jb 0x1800297a6
mov rcx, qword [0x180050968]
lea rdx, [rbp - 0x10]
mov byte [rbp - 6], 0
call fcn.18002952c
mov qword [0x180050998], rax
mov r9, r14
mov r8, rbx
mov rdx, rdi
mov rcx, rsi
call rax
add rsp, 0x30
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x18002995c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x180050930]
mov rbx, rcx
test rax, rax
jne 0x180029af6
xor edx, edx
mov cl, 0x4e
call fcn.180001060
mov edx, 1
mov byte [rbp - 0x20], al
mov cl, 0x74
call fcn.180001060
mov edx, 2
mov byte [rbp - 0x1f], al
mov cl, 0x55
call fcn.180001060
mov edx, 3
mov byte [rbp - 0x1e], al
mov cl, 0x73
call fcn.180001060
mov edx, 4
mov byte [rbp - 0x1d], al
mov cl, 0x65
call fcn.180001060
mov edx, 5
mov byte [rbp - 0x1c], al
mov cl, 0x72
call fcn.180001060
mov edx, 6
mov byte [rbp - 0x1b], al
mov cl, 0x53
call fcn.180001060
mov edx, 7
mov byte [rbp - 0x1a], al
mov cl, 0x65
call fcn.180001060
mov edx, 8
mov byte [rbp - 0x19], al
mov cl, 0x74
call fcn.180001060
mov edx, 9
mov byte [rbp - 0x18], al
mov cl, 0x57
call fcn.180001060
mov edx, 0xa
mov byte [rbp - 0x17], al
mov cl, 0x69
call fcn.180001060
mov edx, 0xb
mov byte [rbp - 0x16], al
mov cl, 0x6e
call fcn.180001060
mov edx, 0xc
mov byte [rbp - 0x15], al
mov cl, 0x64
call fcn.180001060
mov edx, 0xd
mov byte [rbp - 0x14], al
mov cl, 0x6f
call fcn.180001060
mov edx, 0xe
mov byte [rbp - 0x13], al
mov cl, 0x77
call fcn.180001060
mov edx, 0xf
mov byte [rbp - 0x12], al
mov cl, 0x4c
call fcn.180001060
mov edx, 0x10
mov byte [rbp - 0x11], al
mov cl, 0x6f
call fcn.180001060
mov edx, 0x11
mov byte [rbp - 0x10], al
mov cl, 0x6e
call fcn.180001060
mov edx, 0x12
mov byte [rbp - 0xf], al
mov cl, 0x67
call fcn.180001060
mov edx, 0x13
mov byte [rbp - 0xe], al
mov cl, 0x50
call fcn.180001060
mov byte [rbp - 0xd], al
mov edx, 0x14
mov cl, 0x74
call fcn.180001060
mov edx, 0x15
mov byte [rbp - 0xc], al
mov cl, 0x72
call fcn.180001060
mov byte [rbp - 0xb], al
xor eax, eax
mov byte [rbp - 0xa], al
xor edx, edx
movsxd rcx, edx
lea eax, [rdx + 0x13]
inc edx
xor byte [rbp + rcx - 0x20], al
cmp edx, 0x16
jb 0x180029aca
mov rcx, qword [0x180050978]
lea rdx, [rbp - 0x20]
mov byte [rbp - 0xa], 0
call fcn.18002952c
mov qword [0x180050930], rax
lea r8, [0x18001cbac]
mov edx, 0xfffffffc
mov rcx, rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
jmp rax
Function at 0x180029b14
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x320]
sub rsp, 0x420
mov r14d, dword [rdx + 8]
mov r12, rdx
mov rdi, rcx
mov edx, 0x400
lea rcx, [rsp + 0x20]
mov rbx, r8
call fcn.180029d62
mov rcx, rbx
call fcn.180029620
mov edx, dword [rsp + 0x20]
mov qword [rbp + 0x360], rbx
lea rsi, [rbx + rax]
cmp rbx, rsi
jae 0x180029cab
mov rcx, rbx
mov r15, rbx
cmp byte [rbx], 0x3f
jne 0x180029b9c
lea rbx, [rcx + 1]
mov qword [rbp + 0x360], rbx
cmp byte [rbx], 0x3f
jne 0x180029b8f
inc rbx
movsxd rax, edx
or dword [rsp + rax*4 + 0x24], 0xffffffff
jmp 0x180029c88
mov rax, qword [0x180050940]
test rax, rax
jne 0x180029c66
xor edx, edx
mov cl, 0x73
call fcn.180001060
mov edx, 1
mov byte [rbp + 0x358], al
mov cl, 0x74
call fcn.180001060
mov edx, 2
mov byte [rbp + 0x359], al
mov cl, 0x72
call fcn.180001060
mov edx, 3
mov byte [rbp + 0x35a], al
mov cl, 0x74
call fcn.180001060
mov edx, 4
mov byte [rbp + 0x35b], al
mov cl, 0x6f
call fcn.180001060
mov edx, 5
mov byte [rbp + 0x35c], al
mov cl, 0x75
call fcn.180001060
mov edx, 6
mov byte [rbp + 0x35d], al
mov cl, 0x6c
call fcn.180001060
mov byte [rbp + 0x35e], al
xor eax, eax
mov byte [rbp + 0x35f], al
xor edx, edx
movsxd rcx, edx
lea eax, [rdx + 0x13]
inc edx
xor byte [rbp + rcx + 0x358], al
cmp edx, 7
jb 0x180029c31
mov rcx, qword [0x180050968]
lea rdx, [rbp + 0x358]
mov byte [rbp + 0x35f], 0
call fcn.18002952c
mov qword [0x180050940], rax
mov r8d, 0x10
lea rdx, [rbp + 0x360]
mov rcx, r15
call rax
movsxd rcx, dword [rsp + 0x20]
mov rbx, qword [rbp + 0x360]
mov dword [rsp + rcx*4 + 0x24], eax
mov edx, dword [rsp + 0x20]
inc edx
inc rbx
mov dword [rsp + 0x20], edx
mov qword [rbp + 0x360], rbx
mov rcx, rbx
mov r15, rbx
cmp rbx, rsi
jb 0x180029b77
mov r10, qword [r12]
xor r8d, r8d
sub r14d, edx
je 0x180029cf2
xor r9d, r9d
test edx, edx
je 0x180029cdf
mov r11d, dword [rsp + r9*4 + 0x24]
lea eax, [r9 + r8]
movzx eax, byte [rax + r10]
cmp eax, r11d
je 0x180029cd7
cmp r11d, 0xffffffff
jne 0x180029cea
inc r9d
cmp r9d, edx
jb 0x180029cbe
mov eax, r8d
add rax, r10
mov qword [rdi], rax
jmp 0x180029cf6
inc r8d
cmp r8d, r14d
jb 0x180029cb7
and qword [rdi], 0
lea r11, [rsp + 0x420]
mov rax, rdi
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret

Function at 0x180029d20
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0x50
syscall
ret

Function at 0x180029d41
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0x1003
syscall
ret

Function at 0x180029d4c
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0x1049
syscall
ret

Function at 0x180029d57
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0x1005
syscall
ret
Function at 0x141263e70
Capabilities:
Encode data using xor

Disassembly:
jmp 0x141263e7a
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x141263ea3
pop rbp
sub rbp, 0x33
sub rbp, 0x1263e70
sub rsp, 0x20
jmp 0x141263ec2
mov rax, 0x1263e70
add rax, rbp
add rax, 0x84
mov rcx, 0x60b
mov rdx, 0xffffffffcf63f600
xor byte [rax], dl
inc rax
dec rcx
jne 0x141263ee1
jmp 0x141263ef8
mov rcx, rbp
mov ecx, dword [rcx + 0x3c]
add rcx, 0x108
add rcx, rbp
mov rax, 0xb
mov rdx, 0x28
mul rdx
add rcx, rax
mov eax, dword [rcx + 0xc]
add rax, rbp
push rax
push rax
movabs rax, 0x2e44d0
movabs rcx, 0xf7f99d
add rcx, rbp
movabs rdx, 0x25f51187
call fcn.141263f55
jmp 0x141263f6b
pop rax
pop rdx
push rdx
push rax
movabs rax, 0x2e44d0
movabs rcx, 0xf7f99d
add rcx, rbp
call fcn.141263f90
jmp 0x14126421d
pop rdi
pop rsi
jmp 0x141264228
mov rax, 0x1263e70
add rax, rbp
add rax, 0x3ea
mov rcx, 0x2a5
mov rdx, 0xffffffffa1505109
xor byte [rax], dl
inc rax
dec rcx
jne 0x141264247
jmp 0x14126425e
pop rdi
xor r15b, 0x56
invalid

Function at 0x141263f55
Capabilities:
Encode data using xor

Disassembly:
shr eax, 2
xor dword [rcx], edx
add rcx, 4
dec rax
jne 0x141263f58
ret
Function at 0x141264013
Capabilities:
Decompress data using aplib

Disassembly:
push rsi
push rdi
push rbp
push rdx
mov rdi, rdx
mov rsi, rcx
cld
mov dl, 0x80
mov al, byte [rsi]
add rsi, 1
mov byte [rdi], al
add rdi, 1
mov rbx, 2
add dl, dl
jne 0x141264048
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x141264020
add dl, dl
jne 0x14126405d
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1412640e2
xor rax, rax
add dl, dl
jne 0x141264075
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1412641e1
add dl, dl
jne 0x14126408a
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc rax, rax
add dl, dl
jne 0x14126409c
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc rax, rax
add dl, dl
jne 0x1412640ae
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc rax, rax
add dl, dl
jne 0x1412640c0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc rax, rax
je 0x1412640d1
mov rbx, rdi
sub rbx, rax
mov al, byte [rbx]
mov byte [rdi], al
inc rdi
mov rbx, 2
jmp 0x141264039
mov rax, 1
add dl, dl
jne 0x1412640f8
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc rax, rax
add dl, dl
jne 0x14126410a
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1412640e9
sub rax, rbx
mov rbx, 1
jne 0x14126415d
mov rcx, 1
add dl, dl
jne 0x141264136
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc rcx, rcx
add dl, dl
jne 0x141264148
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141264127
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x141264039
dec rax
shl rax, 8
mov al, byte [rsi]
inc rsi
mov rbp, rax
mov rcx, 1
add dl, dl
jne 0x141264182
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc rcx, rcx
add dl, dl
jne 0x141264194
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141264173
cmp rax, 0x7d00
sbb rcx, 0xffffffffffffffff
cmp rax, 0x500
sbb rcx, 0xffffffffffffffff
cmp rax, 0x80
adc rcx, 0
cmp rax, 0x80
adc rcx, 0
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x141264039
mov al, byte [rsi]
inc rsi
xor rcx, rcx
shr al, 1
je 0x141264212
adc rcx, 2
mov rbp, rax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov rbx, 1
jmp 0x141264039
pop rdx
sub rdi, rdx
mov rax, rdi
pop rbp
pop rdi
pop rsi
ret