joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140274c20
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Encrypt data using salsa20 or chacha

Disassembly:
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x3f]
mov eax, 0xb0
call fcn.1403122f0
sub rsp, rax
mov rax, qword [0x140495598]
xor rax, rsp
mov qword [rbp + 0x2f], rax
mov eax, dword [r9]
mov rdi, rcx
mov rcx, qword [rbp + 0x7f]
mov r14, r8
mov dword [rbp - 1], eax
mov rsi, rdx
mov eax, dword [r9 + 4]
mov dword [rbp + 3], eax
mov eax, dword [r9 + 8]
mov dword [rbp + 7], eax
mov eax, dword [r9 + 0xc]
mov dword [rbp + 0xb], eax
mov eax, dword [r9 + 0x10]
mov dword [rbp + 0xf], eax
mov eax, dword [r9 + 0x14]
mov dword [rbp + 0x13], eax
mov eax, dword [r9 + 0x18]
mov dword [rbp + 0x17], eax
mov eax, dword [r9 + 0x1c]
mov dword [rbp + 0x1b], eax
mov eax, dword [rcx]
mov dword [rbp + 0x1f], eax
mov eax, dword [rcx + 4]
mov dword [rbp + 0x23], eax
mov eax, dword [rcx + 8]
mov dword [rbp + 0x27], eax
mov eax, dword [rcx + 0xc]
mov dword [rbp + 0x2b], eax
mov dword [rbp - 0x11], 0x61707865
mov dword [rbp - 0xd], 0x3320646e
mov dword [rbp - 9], 0x79622d32
mov dword [rbp - 5], 0x6b206574
test r8, r8
je 0x140274e34
mov qword [rsp + 0xd8], rbx
nop dword [rax]
nop word [rax + rax]
mov ebx, 0x40
lea rdx, [rbp - 0x11]
cmp r14, rbx
lea rcx, [rbp - 0x51]
cmovb rbx, r14
call fcn.140274e60
xor eax, eax
test rbx, rbx
je 0x140274e1a
cmp rbx, 0x40
jb 0x140274de7
lea rdx, [rdi - 1]
add rdx, rbx
lea rcx, [rbp + rbx - 0x52]
cmp rdi, rcx
ja 0x140274d2c
lea rcx, [rbp - 0x51]
cmp rdx, rcx
jae 0x140274de7
lea rcx, [rsi - 1]
add rcx, rbx
cmp rdi, rcx
ja 0x140274d41
cmp rdx, rsi
jae 0x140274de7
mov r9, rbx
and r9, 0xffffffffffffffc0
lea rcx, [rbp - 0x51]
mov rdx, rsi
sub rdx, rcx
mov r8, rdi
lea rcx, [rbp - 0x51]
sub r8, rcx
nop dword [rax]
movdqu xmm0, xmmword [rbp + rax - 0x51]
lea rcx, [rbp - 0x41]
movdqu xmm1, xmmword [rsi + rax]
add rcx, rdx
pxor xmm1, xmm0
movdqu xmm0, xmmword [rbp + rax - 0x41]
movdqu xmmword [rdi + rax], xmm1
movdqu xmm1, xmmword [rcx + rax]
lea rcx, [rbp - 0x41]
add rcx, r8
pxor xmm1, xmm0
movdqu xmm0, xmmword [rbp + rax - 0x31]
movdqu xmmword [rcx + rax], xmm1
lea rcx, [rbp - 0x31]
add rcx, rdx
movdqu xmm1, xmmword [rcx + rax]
lea rcx, [rbp - 0x31]
add rcx, r8
pxor xmm1, xmm0
movdqu xmm0, xmmword [rbp + rax - 0x21]
movdqu xmmword [rcx + rax], xmm1
lea rcx, [rbp - 0x21]
add rcx, rdx
movdqu xmm1, xmmword [rcx + rax]
lea rcx, [rbp - 0x21]
add rcx, r8
pxor xmm1, xmm0
movdqu xmmword [rcx + rax], xmm1
add rax, 0x40
cmp rax, r9
jb 0x140274d60
cmp rax, rbx
jae 0x140274e1a
lea rcx, [rbp - 0x51]
mov r8, rsi
sub r8, rcx
mov r9, rdi
lea rcx, [rbp - 0x51]
sub r9, rcx
lea rdx, [rbp - 0x51]
add rdx, rax
inc rax
movzx ecx, byte [r8 + rdx]
xor cl, byte [rdx]
mov byte [r9 + rdx], cl
cmp rax, rbx
jb 0x140274e00
inc dword [rbp + 0x1f]
add rdi, rbx
add rsi, rbx
sub r14, rbx
jne 0x140274ce0
mov rbx, qword [rsp + 0xd8]
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.1403115a0
mov rsi, qword [rsp + 0xe0]
add rsp, 0xb0
pop r14
pop rdi
pop rbp
ret
Function at 0x140278130
Capabilities:
Encode data using xor

Disassembly:
mov eax, gethostname
call fcn.1403122f0
sub rsp, rax
cmp dword [rsp + 0x68], 0
je 0x140278159
lea rax, [0x1402767a0]
mov qword [rsp + 0x68], rax
add rsp, 0x38
jmp fcn.14026e1d0
lea rax, [0x140275960]
mov qword [rsp + 0x68], rax
add rsp, 0x38
jmp fcn.14026df20

Function at 0x140292300
Capabilities:
Encode data using xor

Disassembly:
mov eax, gethostname
call fcn.1403122f0
sub rsp, rax
mov r10, rdx
mov dword [rsp + 0x40], reloc.WS2_32.dll_recv
add rdx, 0xf
lea rax, [r8 + 0xf]
mov r11, rcx
cmp r10, rax
ja 0x140292330
xor r9d, r9d
cmp rdx, r8
jae 0x140292349
movdqu xmm1, xmmword [r10]
movdqu xmm0, xmmword [r8]
pxor xmm1, xmm0
movdqu xmmword [r10], xmm1
mov r9d, reloc.WS2_32.dll_recv
cmp r9, 0x10
jae 0x140292371
sub r8, r10
lea rax, [r9 + r10]
mov edx, reloc.WS2_32.dll_recv
sub rdx, r9
nop
movzx ecx, byte [r8 + rax]
xor byte [rax], cl
lea rax, [rax + 1]
sub rdx, 1
jne 0x140292360
mov rcx, qword [r11 + 8]
lea r8, [rsp + 0x40]
mov r9, r10
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
mov rdx, r10
call fcn.140223de0
test eax, eax
je 0x1402923a2
cmp dword [rsp + 0x40], 0x10
jne 0x1402923a2
mov eax, 1
add rsp, 0x38
ret
xor eax, eax
add rsp, 0x38
ret

Function at 0x140292550
Capabilities:
Encode data using xor

Disassembly:
mov r10, rcx
test rdx, rdx
je 0x1402925d8
test r8, r8
je 0x1402925d8
mov rax, qword [rcx + 0x18]
cmp r8, rax
mov r9, rax
cmovb r9, r8
test r9, r9
je 0x140292596
add rcx, 0x20
mov r11, rdx
sub r11, r10
nop
movzx eax, byte [r11 + rcx - 0x20]
xor byte [rcx], al
lea rcx, [rcx + 1]
sub r9, 1
jne 0x140292580
mov rax, qword [r10 + 0x18]
cmp r8, rax
jbe 0x1402925d8
sub r8, rax
mov eax, reloc.WS2_32.dll_recv
cmp r8, rax
cmova r8, rax
xor ecx, ecx
test r8, r8
je 0x1402925d8
nop dword [rax]
nop word [rax + rax]
mov rax, qword [r10 + 0x18]
add rax, rcx
movzx eax, byte [rax + rdx]
xor byte [r10 + rcx + 0x40], al
inc rcx
cmp rcx, r8
jb 0x1402925c0
ret
Function at 0x1402d7800
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
mov eax, 0x20
call fcn.1403122f0
sub rsp, rax
mov rsi, r9
mov rbp, r9
shr rsi, 3
mov rdi, r8
mov rbx, rdx
mov r14, rcx
cmp r8, r9
jb 0x1402d78c0
nop
xor edx, edx
test rsi, rsi
je 0x1402d78b0
nop word [rax + rax]
movzx eax, byte [rbx + 6]
movzx ecx, byte [rbx + 7]
shl rcx, 8
or rcx, rax
movzx eax, byte [rbx + 5]
shl rcx, 8
or rcx, rax
movzx eax, byte [rbx + 4]
shl rcx, 8
or rcx, rax
movzx eax, byte [rbx + 3]
shl rcx, 8
or rcx, rax
movzx eax, byte [rbx + 2]
shl rcx, 8
or rcx, rax
movzx eax, byte [rbx + 1]
shl rcx, 8
or rcx, rax
movzx eax, byte [rbx]
shl rcx, 8
add rbx, 8
or rcx, rax
xor qword [r14 + rdx*8], rcx
inc rdx
cmp rdx, rsi
jb 0x1402d7850
mov rcx, r14
call fcn.1402d7030
sub rdi, rbp
cmp rdi, rbp
jae 0x1402d7840
mov rbx, qword [rsp + 0x30]
mov rax, rdi
mov rdi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x1402d7b59
Capabilities:
Encode data using xor

Disassembly:
test r8, r8
je 0x1402d7d4a
push rbx
mov eax, 0xd0
call fcn.1403122f0
sub rsp, rax
mov rax, qword [0x140495598]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xe8], rbp
mov rbx, rdx
mov qword [rsp + 0xf0], rsi
lea rbp, [r8 - 1]
mov qword [rsp + 0xf8], rdi
mov qword [rsp + 0xc8], r14
lea r14, [rcx + 0xc]
shr rbp, 3
mov qword [rsp + 0xc0], r15
inc rbp
lea r15, [rcx + 0x14]
nop word [rax + rax]
movzx eax, byte [rbx + 1]
mov rcx, r14
movzx edi, byte [rbx]
movzx esi, byte [rbx + 4]
lea rbx, [rbx + 8]
shl eax, 8
or edi, eax
movzx eax, byte [rbx - 6]
shl eax, 0x10
or edi, eax
movzx eax, byte [rbx - 5]
shl eax, 0x18
or edi, eax
movzx eax, byte [rbx - 3]
shl eax, 8
or esi, eax
mov dword [rsp + 0x20], edi
movzx eax, byte [rbx - 2]
shl eax, 0x10
or esi, eax
mov dword [rsp + 0x28], edi
movzx eax, byte [rbx - 1]
and byte [r14], 0xdf
and byte [r15], 0xbf
or byte [r14], 0x40
or byte [r15], 0x20
shl eax, 0x18
or esi, eax
mov dword [rsp + 0x24], esi
mov dword [rsp + 0x2c], esi
call fcn.140267de0
lea rdx, [rsp + 0x30]
mov rcx, r14
call fcn.140267780
mov r8d, 1
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x28]
call fcn.1402644c0
mov rcx, r15
call fcn.140267de0
lea rdx, [rsp + 0x30]
mov rcx, r15
call fcn.140267780
mov r8d, 1
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
call fcn.1402644c0
mov r8d, dword [rsp + 0x20]
mov edx, dword [rsp + 0x24]
xor r8d, edi
xor edi, dword [rsp + 0x28]
xor edx, esi
xor esi, dword [rsp + 0x2c]
mov eax, edi
mov byte [r14], dil
shr eax, 8
mov byte [r14 + 1], al
mov eax, edi
shr eax, 0x10
mov byte [r14 + 2], al
mov eax, edx
shr eax, 8
shr edi, 0x18
mov byte [r14 + 3], dil
mov byte [r14 + 4], dl
mov byte [r14 + 5], al
mov eax, edx
shr eax, 0x10
mov byte [r14 + 6], al
mov eax, r8d
shr eax, 8
shr edx, 0x18
mov byte [r14 + 7], dl
mov byte [r15], r8b
mov byte [r15 + 1], al
mov eax, r8d
shr eax, 0x10
mov byte [r15 + 2], al
shr r8d, 0x18
mov byte [r15 + 3], r8b
mov byte [r15 + 4], sil
mov eax, esi
shr eax, 8
mov byte [r15 + 5], al
mov eax, esi
shr eax, 0x10
shr esi, 0x18
mov byte [r15 + 6], al
mov byte [r15 + 7], sil
sub rbp, 1
jne 0x1402d7bc0
mov r15, qword [rsp + 0xc0]
mov r14, qword [rsp + 0xc8]
mov rdi, qword [rsp + 0xf8]
mov rsi, qword [rsp + 0xf0]
mov rbp, qword [rsp + 0xe8]
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.1403115a0
add rsp, 0xd0
pop rbx
ret
Function at 0x1403016e0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
sub rsp, 0x60
mov rax, qword [0x140495598]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rsi, rcx
lea rcx, str.HWLOC_PCI_LOCALITY
call fcn.140337e60
mov rbx, rax
test rax, rax
je 0x1403017e4
xor edx, edx
mov qword [rsp + 0x78], rdi
mov rcx, rax
mov dword [rsi + 0x350], 1
call fcn.140345b7c
mov edi, eax
test eax, eax
js 0x1403017d4
lea rdx, [rsp + 0x20]
mov ecx, eax
call fcn.14033c734
test eax, eax
jne 0x1403017cb
mov eax, dword [rsp + 0x34]
cmp eax, 0x10000
jg 0x1403017a0
inc eax
movsxd rcx, eax
call fcn.140337e70
mov rbx, rax
test rax, rax
je 0x14030178f
mov r8d, dword [rsp + 0x34]
mov rdx, rax
mov ecx, edi
call fcn.140342f4c
movsxd rcx, dword [rsp + 0x34]
cmp eax, ecx
jne 0x14030178f
mov byte [rcx + rbx], 0
mov rdx, rbx
mov rcx, rsi
call fcn.140301800
mov rcx, rbx
call fcn.1403379d4
mov ecx, edi
call fcn.140343588
jmp 0x1403017df
call fcn.1402f1640
cmp eax, 2
jge 0x1403017cb
mov ecx, 2
call fcn.140333cd0
mov r9d, dword [rsp + 0x34]
lea rdx, str.hwloc_pci:_Ignoring_HWLOC_PCI_LOCALITY_file___s_too_large___lu_bytes__n
mov rcx, rax
mov r8, rbx
call fcn.140003d90
mov ecx, edi
call fcn.140343588
jmp 0x1403017df
mov rdx, rbx
mov rcx, rsi
call fcn.140301800
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1403115a0
mov rbx, qword [rsp + 0x80]
add rsp, 0x60
pop rsi
ret

Function at 0x140305d00
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x58
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [0x140495450]
cmp eax, 1
jbe 0x140305d49
mov rdx, qword [0x14049da80]
test rdx, rdx
je 0x140305d41
lea ecx, [rax - 1]
call rdx
movzx ecx, ax
mov eax, dword [0x140495450]
shl eax, 6
add eax, 0xffffffc0
add eax, ecx
add rsp, 0x58
ret
shl eax, 6
add rsp, 0x58
ret
mov eax, dword [rsp + 0x40]
add rsp, 0x58
ret
Function at 0x14030aac0
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push r12
push r13
sub rsp, 0x78
mov rax, qword [0x140495598]
xor rax, rsp
mov qword [rsp + 0x50], rax
movzx eax, byte [rcx]
mov r13, r8
cmp al, byte [0x14039eb5c]
mov r12, rdx
jne 0x14030aafb
movzx eax, byte [rcx + 1]
cmp al, byte [0x14039eb5d]
jne 0x14030aafb
xor eax, eax
jmp 0x14030ab00
sbb eax, eax
or eax, 1
mov qword [rsp + 0xb8], rsi
lea rbx, str._dev_stdin
test eax, eax
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x68], r14
lea rdx, [0x14044d6e8]
cmovne rbx, rcx
mov qword [rsp + 0x60], r15
mov rcx, rbx
call fcn.14033b044
mov rbp, rax
test rax, rax
je 0x14030ac09
lea rdx, [rsp + 0x20]
mov rcx, rbx
mov edi, 0x1000
call fcn.14033c828
test eax, eax
jne 0x14030ab6a
mov eax, 0x8000
test word [rsp + 0x26], ax
je 0x14030ab6a
mov eax, dword [rsp + 0x34]
inc eax
movsxd rdi, eax
lea rcx, [rdi + 1]
call fcn.140337e70
mov rsi, rax
test rax, rax
je 0x14030ac01
mov r9, rbp
mov r8, rdi
mov edx, 1
mov rcx, rax
call fcn.14033a704
mov r15, rax
mov byte [rax + rsi], 0
cmp rax, rdi
jne 0x14030abe1
nop
add rdi, rdi
mov rcx, rsi
lea rdx, [rdi + 1]
call fcn.140337c64
mov r14, rax
test rax, rax
je 0x14030abf9
mov rbx, rdi
lea rcx, [rax + r15]
shr rbx, 1
mov r9, rbp
mov r8, rbx
mov edx, 1
mov rsi, rax
call fcn.14033a704
add r15, rax
mov byte [rsi + r15], 0
cmp rax, rbx
je 0x14030aba0
mov rcx, rbp
call fcn.140339f04
lea rax, [r15 + 1]
mov qword [r12], rsi
mov qword [r13], rax
xor eax, eax
jmp 0x14030ac0e
mov rcx, rsi
call fcn.1403379d4
mov rcx, rbp
call fcn.140339f04
mov eax, 0xffffffff
mov r15, qword [rsp + 0x60]
mov r14, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov rsi, qword [rsp + 0xb8]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1403115a0
add rsp, 0x78
pop r13
pop r12
pop rbp
pop rbx
ret

Function at 0x1403150c8
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x48
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x1403150db
add rsp, 0x48
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edx, ax
lea rcx, [rsp + 0x20]
or edx, 0x80070000
test eax, eax
cmovle edx, eax
call fcn.1403156e8
lea rdx, [0x14048c3b8]
lea rcx, [rsp + 0x20]
call fcn.140330ac0
int3

Function at 0x14031f928
Capabilities:
Set thread local storage value

Disassembly:
mov ecx, dword [0x14049eb08]
xor edx, edx
jmp fcn.1403150c8

Function at 0x1403202a4
Capabilities:
Set thread local storage value

Disassembly:
mov rdx, rcx
mov ecx, dword [0x14049eb08]
jmp fcn.1403150c8

Function at 0x14032beb8
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rcx + 0x98], rdx
mov r8, rcx
mov r9, qword [rdx + 0x1a8]
add rcx, 0x40
lea rdx, [0x14032bf74]
mov r9, qword [r9 + 8]
jmp fcn.14031d2e0

Function at 0x14032bf4c
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rcx + 0x98], rdx
mov r8, rcx
mov r9, qword [rdx + 0x1a8]
add rcx, 0x40
lea rdx, [0x14032bf84]
mov r9, qword [r9 + 8]
jmp fcn.14031d2e0
Function at 0x140339e74
Capabilities:
Parse pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov esi, r8d
mov ebx, edx
mov r14d, ecx
test r8d, r8d
jne 0x140339c48
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140339c48
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140339c48
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140339c48
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140339c48
cmp dword [rcx + 0x84], 0xe
jbe 0x140339c48
cmp dword [rcx + 0xf8], esi
je 0x140339c48
mov ecx, r14d
call fcn.140339d90
mov ecx, 2
call fcn.1403460d0
nop
cmp byte [0x14049ee00], 0
jne 0x140339d12
mov r15d, 1
mov eax, r15d
xchg dword [0x14049edf0], eax
test ebx, ebx
jne 0x140339cbb
mov rdi, qword [0x140495598]
mov edx, edi
and edx, 0x3f
lea ecx, [rbx + 0x40]
sub ecx, edx
xor eax, eax
ror rax, cl
xor rax, rdi
mov rcx, qword [0x14049edf8]
cmp rcx, rax
je 0x140339cb2
xor rdi, rcx
mov ecx, edx
ror rdi, cl
mov rcx, rdi
call qword [fcn.1400140f0]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rdi
lea rcx, [0x14049f178]
jmp 0x140339cc7
cmp ebx, r15d
jne 0x140339ccd
lea rcx, [0x14049f190]
call fcn.14034a1bc
nop
test ebx, ebx
jne 0x140339ce4
lea rdx, [0x140363d68]
lea rcx, [0x140363d40]
call fcn.14034a484
lea rdx, [0x140363d78]
lea rcx, [0x140363d70]
call fcn.14034a484
movzx eax, byte [0x14049ee00]
test esi, esi
cmove eax, r15d
mov byte [0x14049ee00], al
jmp 0x140339d12
mov ecx, 2
call fcn.140346124
test esi, esi
jne 0x140339d29
mov ecx, r14d
call fcn.140339d44
int3
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
xor r8d, r8d
xor edx, edx
jmp 0x140339bd8

Function at 0x1403429f4
Capabilities:
Delete directory

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x140342a14
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140337930
or eax, 0xffffffff
jmp 0x140342a16
xor eax, eax
add rsp, 0x28
ret
Function at 0x140350e3c
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
mov rbp, rsp
sub rsp, 0x20
test rcx, rcx
jne 0x140350cdc
call fcn.1403379a0
mov dword [rax], reloc.WS2_32.dll_shutdown
call fcn.1403331d4
or eax, 0xffffffff
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop rbp
ret
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x140350cc4
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 0xc
test cl, 1
jne 0x140350cc4
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
mov rax, qword [rbp + 0x10]
shr ecx, 1
test cl, 1
je 0x140350d0e
lock or dword [rax + 0x14], 0x10
jmp 0x140350cc4
lock or dword [rax + 0x14], 1
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
test ecx, 0x4c0
jne 0x140350d2b
mov rcx, qword [rbp + 0x10]
call fcn.140350e44
mov rax, qword [rbp + 0x10]
mov rcx, qword [rax + 8]
mov qword [rax], rcx
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.1403375fc
mov rdx, qword [rbp + 0x10]
mov ecx, eax
mov r8d, dword [rdx + 0x20]
mov rdx, qword [rdx + 8]
call fcn.140342f4c
mov dword [rbx + 0x10], eax
mov rax, qword [rbp + 0x10]
mov edx, dword [rax + 0x10]
lea ecx, [rdx + 1]
cmp ecx, 1
ja 0x140350d82
neg edx
sbb ecx, ecx
and ecx, 8
add ecx, 8
lock or dword [rax + 0x14], ecx
mov rax, qword [rbp + 0x10]
and dword [rax + 0x10], 0
jmp 0x140350cc4
mov ecx, dword [rax + 0x14]
test cl, 6
jne 0x140350dee
mov rcx, qword [rbp + 0x10]
call fcn.1403375fc
cmp eax, 0xffffffff
je 0x140350dd5
mov rcx, qword [rbp + 0x10]
call fcn.1403375fc
cmp eax, 0xfffffffe
je 0x140350dd5
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.1403375fc
movsxd rdi, eax
lea rsi, [0x14049f1d0]
mov rcx, rbx
sar rdi, 6
call fcn.1403375fc
and eax, 0x3f
shl rax, 6
add rax, qword [rsi + rdi*8]
jmp 0x140350ddc
lea rax, [0x1404959f0]
mov al, byte [rax + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x140350dee
mov rax, qword [rbp + 0x10]
lock or dword [rax + 0x14], 0x20
mov rax, qword [rbp + 0x10]
cmp dword [rax + 0x20], 0x200
jne 0x140350e24
mov ecx, dword [rax + 0x14]
shr ecx, 6
test cl, 1
je 0x140350e20
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 8
test cl, 1
jne 0x140350e20
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x20], 0x1000
mov rax, qword [rbp + 0x10]
dec dword [rax + 0x10]
mov rcx, qword [rax]
movzx edx, byte [rcx]
inc rcx
mov qword [rax], rcx
mov eax, edx
jmp 0x140350cc7
jmp 0x140350c94
Function at 0x140005aac
Capabilities:
Encode data using xor

Disassembly:
str word [rax - 0x75]
sbb eax, 0x11fadb
mov r8d, 0x3890
mov rdi, rsp
mov cl, 0xd2
call rbx
add sil, byte [rsi + 0x12e0ff]
lea r14, [rdx + 0x685be3]
mov r15b, 0xa0
add esi, eax
out 0x31, eax
sar bh, cl
sar edi, cl
adc eax, 0xebfaf0
mov qword [0x14012cad0], rax
lea rcx, [0xdb12cad8]
mov dl, 1
out dx, al
cmp ebp, dword [rsi + 3]
add byte [rax - 0x75], cl
xor eax, 0x64fb0c
nop dword [rax + 0x77]
out 0xd, al
leave
outsd dx, dword [rsi]
adc al, byte [rax]
psrld mm0, qword [rcx - 0x48]
add byte [rdi - 0x29bcc5c1], cl
and eax, eax
jne 0x140005ad5
add esi, 0xffffffbc
outsd dx, dword [rsi]
adc cl, byte [rcx - 0x18]
stc
push rbx
mov edi, 0xf7000001
mov esi, 0x428a00
push rdi
invalid

Function at 0x140012700
Capabilities:
Encode data using xor

Disassembly:
push r14
push r13
push r12
push rsi
push rdi
push rbp
test byte [rax - 0x7f], 0xec
push 0x440000cb
mov byte [rsp + 0x43], cl
fcmovnb st(0), st(6)
fcom qword [rdx + 0x48]
mov esi, ecx
mov rax, qword [0x14012b050]
xor rax, rsp
mov qword [rsp + 0x100], rax
mov r15, rdx
shr r15, 0x20
je 0x140012704
rcl qword [rbp - 2], 0xf
sub byte [rdi + 0xd8048], ch
movaps xmmword [rsp + 0x27360090], xmm0
mov ecx, 0x111400
mov edx, 0xea
xor dword [r14 + 2], r9d
test byte [0x11f492768], 0x84
xchg edx, eax
movabs al, byte [0xa824678948800000]
add byte [rax], al
add byte [rcx + 0x1400], bh
sbb byte [rsi], ah
add byte [rax], al
xor r8d, r8d
call 0x140f6d8f0
mov qword [rsp + 0x51], rax
mov qword [rdx + riz*2 + 0x81b8], rax
jb 0x140012796
adc al, 0x91
add byte [rdx + 0xc1cf08], bh
xor r8d, r8d
call fcn.1400434f0
mov qword [rdi + 0x48], rcx
mov dword [rsp + 0x66c0], eax
mov qword [rdx + 0xc824], rax
invalid

Function at 0x140078880
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
mov rsi, rcx
cmp ecx, dword [rbx + 0xb27bd05]
add byte [rax + 0x31], cl
loopne 0x1400788df
or eax, dword [rax]
xor rax, rsp
mov qword [0x140086dc1], rcx
mov dword [0x140086dc1], ecx
add byte [rax - 0x75], cl
jns 0x140078891
test rdi, rdi
jne 0x1400788c4
lea rdi, [rsi*4 + 0x481e0a07]
lea edx, [0x13111baf0]
ret 0xb2b8
mov rax, qword [rdi]
lea rdx, [rsp + 0x20]
test rax, 0x481850ff
mov eax, dword [rdi]
mov rcx, rdi
call rbp
and byte [rax - 0x39], cl
add byte [rcx], bpl
add byte [rcx], ch
add byte [rax - 0x3e], cl
jle 0x14007890f
add byte [rcx + rbx + 0x48], dh
lea esi, [rcx + rbp*8]
invalid
je 0x14007891a
mov rax, qword [rdi]
mov rcx, rdi
not byte [rax + 8]
mov qword [rsi + 0x28], rdi
sbb al, 0x46
and byte [rdi + 0x48281901], bh
invalid
Function at 0x141774058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1417741df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x141774089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14177406f
add dl, dl
jne 0x141774096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1417740f6
xor eax, eax
add dl, dl
jne 0x1417740a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1417741ad
add dl, dl
jne 0x1417740b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1417740c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1417740d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1417740dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1417740ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14177407e
mov eax, 1
add dl, dl
jne 0x141774106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141774113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1417740fb
sub eax, ebx
mov ebx, 1
jne 0x14177414c
mov ecx, 1
add dl, dl
jne 0x14177412e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14177413b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141774123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14177407e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x141774168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x141774175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14177415d
cmp eax, 0x7d00
jae 0x14177419b
cmp eax, 0x500
jb 0x141774196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14177407e
cmp eax, 0x7f
ja 0x14177419e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14177407e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1417741d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14177407e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20