joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140009e60
Capabilities:
Terminate process

Disassembly:
jmp 0x140009e60
push rdi
sub rsp, 0x30
mov eax, dword [0x140025390]
movsxd rdi, edx
test ecx, ecx
js 0x140009f9f
cmp ecx, eax
jg 0x140009f9f
movsxd rax, ecx
mov qword [rsp + 0x40], rbx
lea rcx, [rax + rax*2]
mov rax, qword [0x1400294a0]
lea rbx, [rax + rcx*8]
mov eax, dword [0x140025380]
cmp edi, eax
jle 0x140009eed
mov r9, qword [str.label]
lea rdx, str.HINT_ERROR:_Reference__d_to__s_out_of_range__0____d_
mov rcx, qword [0x140028110]
mov r8d, edi
mov dword [rsp + 0x20], eax
call fcn.1400015b4
mov rcx, qword [0x140028110]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
mov rcx, qword [0x140028110]
lea rdx, [0x14001cec4]
call fcn.1400015b4
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov word [rbx + 0x10], di
mov edx, 1
mov dword [rbx + 0xc], r8d
mov eax, dword [0x140028118]
sub eax, dword [0x140028120]
sub eax, r9d
mov dword [rbx + 8], eax
mov eax, r9d
add rax, qword [0x140028120]
mov qword [0x140028118], rax
movsxd rcx, dword [rbx + 8]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov qword [rbx], rax
test rax, rax
jne 0x140009f6e
mov rcx, qword [0x140028110]
lea rdx, str.HINT_ERROR:_Out_of_memory_for_t__t
call fcn.1400015b4
mov rcx, qword [0x140028110]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
mov rcx, qword [0x140028110]
lea rdx, [0x14001cec4]
call fcn.1400015b4
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
movsxd r8, dword [rbx + 8]
mov rcx, rax
mov rdx, qword [0x140028118]
call sub.VCRUNTIME140.dll_memmove
mov rax, qword [0x1400294a8]
lea rcx, [rdi + rdi*2]
mov rbx, qword [rsp + 0x40]
mov dword [rax + rcx*8 + 8], 1
add rsp, 0x30
pop rdi
ret
mov r8d, ecx
mov dword [rsp + 0x20], eax
mov rcx, qword [0x140028110]
lea rdx, str.HINT_ERROR:_Outline__d_out_of_range___d____d_
xor r9d, r9d
call fcn.1400015b4
mov rcx, qword [0x140028110]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
mov rcx, qword [0x140028110]
lea rdx, [0x14001cec4]
call fcn.1400015b4
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x14000a0a0
Capabilities:
Terminate process

Disassembly:
jmp 0x14000a0a0
sub rsp, 0x38
lea eax, [rcx - 3]
cmp eax, 0xfffd
ja 0x14000a13f
lea eax, [rcx - 1]
mov edx, 0x30
mov ecx, ecx
mov word [0x1400294c0], ax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov qword [0x140028130], rax
test rax, rax
jne 0x14000a114
mov rcx, qword [0x140028110]
lea rdx, str.HINT_ERROR:_Out_of_memory_for_dir
call fcn.1400015b4
mov rcx, qword [0x140028110]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
mov rcx, qword [0x140028110]
lea rdx, [0x14001cec4]
call fcn.1400015b4
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
xor ecx, ecx
mov word [rax + 0x10], cx
mov ecx, 1
mov rax, qword [0x140028130]
mov word [rax + 0x40], cx
mov ecx, 2
mov rax, qword [0x140028130]
mov word [rax + 0x70], cx
add rsp, 0x38
ret
mov r8d, ecx
mov dword [rsp + 0x20], 0x10000
mov rcx, qword [0x140028110]
lea rdx, str.HINT_ERROR:_Directory_entries__d_out_of_range___d____d_
mov r9d, 3
call fcn.1400015b4
mov rcx, qword [0x140028110]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
mov rcx, qword [0x140028110]
lea rdx, [0x14001cec4]
call fcn.1400015b4
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x14000a1d0
Capabilities:
Terminate process

Disassembly:
jmp 0x14000a1d0
sub rsp, 0x28
mov rax, qword [0x140028130]
mov edx, 1
mov dword [rax + 0x88], 0x400
mov rax, qword [0x140028130]
mov dword [rax + 0x58], 0x400
mov rax, qword [0x140028130]
mov dword [rax + 0x28], 0x400
mov rax, qword [0x140028130]
mov ecx, dword [rax + 0x28]
add ecx, 0x20
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov rdx, qword [0x140028130]
mov qword [rdx + 0x20], rax
mov rax, qword [0x140028130]
cmp qword [rax + 0x20], 0
jne 0x14000a271
mov rcx, qword [0x140028110]
lea rdx, str.HINT_ERROR:_Out_of_memory_for_dir_0_.buffer
call fcn.1400015b4
mov rcx, qword [0x140028110]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
mov rcx, qword [0x140028110]
lea rdx, [0x14001cec4]
call fcn.1400015b4
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov ecx, dword [rax + 0x58]
mov edx, 1
add ecx, 0x20
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov rcx, qword [0x140028130]
mov qword [rcx + 0x50], rax
mov rax, qword [0x140028130]
cmp qword [rax + 0x50], 0
jne 0x14000a2da
mov rcx, qword [0x140028110]
lea rdx, str.HINT_ERROR:_Out_of_memory_for_dir_1_.buffer
call fcn.1400015b4
mov rcx, qword [0x140028110]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
mov rcx, qword [0x140028110]
lea rdx, [0x14001cec4]
call fcn.1400015b4
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov ecx, dword [rax + 0x88]
mov edx, 1
add ecx, 0x20
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov rcx, qword [0x140028130]
mov qword [rcx + 0x80], rax
mov rax, qword [0x140028130]
cmp qword [rax + 0x80], 0
jne 0x14000a34c
mov rcx, qword [0x140028110]
lea rdx, str.HINT_ERROR:_Out_of_memory_for_dir_2_.buffer
call fcn.1400015b4
mov rcx, qword [0x140028110]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
mov rcx, qword [0x140028110]
lea rdx, [0x14001cec4]
call fcn.1400015b4
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
add rsp, 0x28
ret
Function at 0x14000cc00
Capabilities:
Terminate process

Disassembly:
jmp 0x14000cc00
push rdi
sub rsp, 0x30
movzx eax, byte [rcx]
xor r11d, r11d
mov qword [rsp + 0x50], rsi
mov r8, rcx
mov r9d, r11d
cmp al, 0x2d
jne 0x14000cc22
mov edi, 0x800
jmp 0x14000cc29
mov rdi, r11
cmp al, 0x2b
jne 0x14000cc2c
inc r8
movzx edx, byte [r8 + 2]
add r8, 2
mov r10d, r11d
cmp dl, 0x30
jne 0x14000cc4d
nop dword [rax]
movzx edx, byte [r8 + 1]
inc r8
cmp dl, 0x30
je 0x14000cc40
mov rsi, 0xffffffffffffffc9
cmp dl, 0x2e
je 0x14000cc8c
nop dword [rax]
cmp dl, 0x41
movsx rax, dl
movzx edx, byte [r8 + 1]
mov rcx, 0xffffffffffffffd0
cmovge rcx, rsi
shl r9, 4
inc r8
add r9, rcx
add r9, rax
inc r10d
cmp dl, 0x2e
jne 0x14000cc60
movzx edx, byte [r8 + 1]
inc r8
mov qword [rsp + 0x48], rbx
test dl, dl
je 0x14000ccd4
nop dword [rax]
movsx rbx, dl
cmp dl, 0x78
je 0x14000ccd4
movzx edx, byte [r8 + 1]
inc r8
sub r11d, 4
inc r10d
cmp bl, 0x41
mov rcx, 0xffffffffffffffd0
cmovge rcx, rsi
shl r9, 4
add r9, rcx
add r9, rbx
test dl, dl
jne 0x14000cca0
mov rsi, qword [rsp + 0x50]
test r9, r9
jne 0x14000ccec
xorps xmm0, xmm0
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
lea eax, [r10 - 0xd]
cmp eax, 1
jle 0x14000cd01
lea ecx, [rax*4 - 4]
shr r9, cl
jmp 0x14000cd14
jge 0x14000cd14
lea eax, [rax*4]
mov ecx, 4
sub ecx, eax
shl r9, cl
mov rax, r9
lea ecx, [r10 - 1]
shr rax, 0x34
lea ecx, [r11 + rcx*4]
cmp rax, 1
jbe 0x14000cd42
nop dword [rax]
shr r9, 1
inc ecx
mov rax, r9
shr rax, 0x34
cmp rax, 1
ja 0x14000cd30
movabs rax, 0xffefffffffffffff
and r9, rax
cmp byte [r8], 0x78
jne 0x14000cdba
movzx r10d, byte [r8 + 1]
inc r8
cmp r10b, 0x2d
jne 0x14000cd6b
mov r11d, 0xffffffff
jmp 0x14000cd77
mov r11d, 1
cmp r10b, 0x2b
jne 0x14000cd7f
movzx r10d, byte [r8 + 1]
inc r8
test r10b, r10b
je 0x14000cdba
mov ebx, 0xffffff40
nop dword [rax]
mov edx, ecx
lea r8, [r8 + 1]
movsx ecx, r10b
mov eax, 0xffffff24
shl ecx, 2
cmp r10b, 0x41
movzx r10d, byte [r8]
cmovl eax, ebx
add ecx, eax
imul ecx, r11d
add ecx, edx
test r10b, r10b
jne 0x14000cd90
lea eax, [rcx + 0x3ff]
cmp eax, 0x7fe
ja 0x14000cde9
mov rbx, qword [rsp + 0x48]
cdqe
or rax, rdi
shl rax, 0x34
or rax, r9
mov qword [rsp + 0x40], rax
movsd xmm0, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov r8d, ecx
mov dword [rsp + 0x20], 0x3ff
mov rcx, qword [0x140028110]
lea rdx, str.HINT_ERROR:_Floating_point_exponent__d_out_of_range___d____d_
mov r9d, 0xfffffc01
call fcn.1400015b4
mov rcx, qword [0x140028110]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
mov rcx, qword [0x140028110]
lea rdx, [0x14001cec4]
call fcn.1400015b4
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3

Function at 0x14000cfc0
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8, rbx
lea rdx, [0x14001e608]
mov rcx, rax
call fcn.1400015b4
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x14000f5a0
Capabilities:
Terminate process

Disassembly:
jmp 0x14000f5a0
sub rsp, 0x28
movsxd rdx, dword [rcx]
cmp edx, 0x1f
je 0x14000f602
lea eax, [rdx - 6]
cmp eax, 1
jbe 0x14000f602
mov rcx, qword [0x140028110]
lea r9, [0x140000000]
mov r8, qword [r9 + rdx*8 + 0x25110]
lea rdx, str.HINT_ERROR:_Kind__s_not_allowed_in_parameter_list
call fcn.1400015b4
mov rcx, qword [0x140028110]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
mov rcx, qword [0x140028110]
lea rdx, [0x14001cec4]
call fcn.1400015b4
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov r8d, dword [rcx + 4]
lea r9, [0x140000000]
cmp r8d, dword [r9 + rdx*4 + 0x25210]
jle 0x14000f621
cmp dword [r9 + rdx*4 + 0x25290], r8d
jge 0x14000f668
mov r9, qword [r9 + rdx*8 + 0x25110]
lea rdx, str.HINT_ERROR:_Parameter__d_for__s_not_allowed_in_parameter_list
mov rcx, qword [0x140028110]
call fcn.1400015b4
mov rcx, qword [0x140028110]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
mov rcx, qword [0x140028110]
lea rdx, [0x14001cec4]
call fcn.1400015b4
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
add rsp, 0x28
ret

Function at 0x14000f6a0
Capabilities:
Terminate process

Disassembly:
jmp 0x14000f6a0
push rbx
sub rsp, 0x30
movsxd rax, ecx
lea r11, [0x140000000]
mov ebx, 0xffff
mov r8d, 0xff
lea r9, [rax*4]
mov r10d, dword [r9 + r11 + 0x25210]
inc r10d
cmp edx, r10d
jl 0x14000f6f8
cmp ecx, 0x1c
mov eax, r8d
cmove eax, ebx
cmp edx, eax
jg 0x14000f6f8
cmp edx, dword [r9 + r11 + 0x25310]
jle 0x14000f6f2
mov dword [r9 + r11 + 0x25310], edx
add rsp, 0x30
pop rbx
ret
cmp ecx, 0x1c
mov r9d, r10d
mov rcx, qword [0x140028110]
cmove r8d, ebx
mov dword [rsp + 0x20], r8d
mov r8d, edx
lea rdx, str.HINT_ERROR:_Maximum__d_out_of_range___d____d_
call fcn.1400015b4
mov rcx, qword [0x140028110]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
mov rcx, qword [0x140028110]
lea rdx, [0x14001cec4]
call fcn.1400015b4
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x140016a44
Capabilities:
Parse pe header

Disassembly:
jmp 0x140016a44
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140016a8e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140016a8e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140016a8e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140016a8e
cmp dword [rcx + 0x84], 0xe
jbe 0x140016a8e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140016a90
xor al, al
add rsp, 0x28
ret
Function at 0x140004568
Capabilities:
Hash data using djb2

Disassembly:
mov eax, dword [rdx + 8]
mov r8d, 0x1505
mov r10, qword [rdx]
add eax, eax
xor edx, edx
movsxd r9, eax
test eax, eax
jle 0x140004593
movzx ecx, byte [rdx + r10]
inc rdx
imul r8d, r8d, 0x21
add r8d, ecx
cmp rdx, r9
jl 0x14000457f
mov eax, r8d
ret

Function at 0x1400067d8
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x20
and qword [rsp + 0x30], 0
mov r10, r9
cmp byte [rcx + 0x20], 0
mov r11, r8
mov rbx, rdx
jne 0x14004ca6c
mov r9, qword [rsp + 0x50]
mov r8, r10
mov rdx, r11
mov rcx, rbx
call fcn.140034c5c
add rsp, 0x20
pop rbx
ret
mov rcx, qword [rcx + 0x18]
lea r9, [rsp + 0x30]
imul r10d, r11d
mov rax, qword [rcx]
mov r8d, r10d
call qword [rax + 0x18]
mov rax, qword [rsp + 0x30]
jmp 0x14000680a
Function at 0x140023ea0
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
mov r14b, byte [0x1400f03b7]
mov rdi, rdx
mov rsi, rcx
call fcn.14003279c
mov ecx, eax
mov edx, 0x8000
call fcn.1400325c4
cmp dword [rdi + 0x10], 0xb
mov ebp, eax
je 0x14006a574
lea rcx, [rsp + 0x20]
call fcn.14000a368
mov rcx, rdi
call fcn.14000d4cc
mov rcx, qword [rdi + 8]
lea rdx, [rsp + 0x20]
call fcn.140024120
mov r8, qword [rsp + 0x20]
lea rdx, [0x1400b6b28]
mov rcx, rsi
call fcn.140023f70
movsxd rbx, eax
test r14b, r14b
jne 0x14006a5a2
lea rcx, [rsp + 0x20]
call fcn.14000a07c
mov rcx, rsi
call fcn.140032c3c
mov rcx, rsi
call fcn.14003279c
mov ecx, 0x4000
cmp ebp, 0xffffffff
cmove ebp, ecx
mov ecx, eax
mov edx, ebp
call fcn.1400325c4
mov rbp, qword [rsp + 0x58]
mov rax, rbx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
mov rcx, rdi
call fcn.1400818bc
mov rcx, rdi
movsxd rbx, eax
call fcn.140081864
mov rcx, rax
mov r9, rsi
mov r8, rbx
mov edx, 1
call fcn.140032a04
mov rbx, rax
jmp 0x140023f2d
mov rcx, rdi
call fcn.14000d4cc
mov rcx, qword [rdi + 8]
mov rcx, qword [rcx]
call qword [0x1400b5470]
nop
jmp 0x140023f23

Function at 0x140029248
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140028fac
Function at 0x1400411cc
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
mov rbp, rsp
sub rsp, 0x20
test rcx, rcx
jne 0x14004106c
call fcn.1400355d4
mov dword [rax], 0x16
call fcn.14003b164
or eax, 0xffffffff
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop rbp
ret
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x140041054
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 0xc
test cl, 1
jne 0x140041054
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
mov rax, qword [rbp + 0x10]
shr ecx, 1
test cl, 1
je 0x14004109e
lock or dword [rax + 0x14], 0x10
jmp 0x140041054
lock or dword [rax + 0x14], 1
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
test ecx, 0x4c0
jne 0x1400410bb
mov rcx, qword [rbp + 0x10]
call fcn.14004674c
mov rax, qword [rbp + 0x10]
mov rcx, qword [rax + 8]
mov qword [rax], rcx
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.14003279c
mov rdx, qword [rbp + 0x10]
mov ecx, eax
mov r8d, dword [rdx + 0x20]
mov rdx, qword [rdx + 8]
call fcn.140040aa4
mov dword [rbx + 0x10], eax
mov rax, qword [rbp + 0x10]
mov edx, dword [rax + 0x10]
lea ecx, [rdx + 1]
cmp ecx, 1
ja 0x140041112
neg edx
sbb ecx, ecx
and ecx, 8
add ecx, 8
lock or dword [rax + 0x14], ecx
mov rax, qword [rbp + 0x10]
and dword [rax + 0x10], 0
jmp 0x140041054
mov ecx, dword [rax + 0x14]
test cl, 6
jne 0x14004117e
mov rcx, qword [rbp + 0x10]
call fcn.14003279c
cmp eax, 0xffffffff
je 0x140041165
mov rcx, qword [rbp + 0x10]
call fcn.14003279c
cmp eax, 0xfffffffe
je 0x140041165
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.14003279c
movsxd rdi, eax
lea rsi, [0x1400ef880]
mov rcx, rbx
sar rdi, 6
call fcn.14003279c
and eax, 0x3f
shl rax, 6
add rax, qword [rsi + rdi*8]
jmp 0x14004116c
lea rax, [0x1400ea300]
mov al, byte [rax + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x14004117e
mov rax, qword [rbp + 0x10]
lock or dword [rax + 0x14], 0x20
mov rax, qword [rbp + 0x10]
cmp dword [rax + 0x20], 0x200
jne 0x1400411b4
mov ecx, dword [rax + 0x14]
shr ecx, 6
test cl, 1
je 0x1400411b0
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 8
test cl, 1
jne 0x1400411b0
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x20], 0x1000
mov rax, qword [rbp + 0x10]
dec dword [rax + 0x10]
mov rcx, qword [rax]
movzx edx, byte [rcx]
inc rcx
mov qword [rax], rcx
mov eax, edx
jmp 0x140041057
jmp 0x140041024
Function at 0x140077400
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov rcx, qword [r8]
mov rdi, rdx
mov rsi, r8
mov r14d, dword [rcx + rdx]
lea rax, [rcx + 4]
mov qword [r8], rax
mov eax, 2
movsxd rcx, r14d
inc rcx
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.140024c68
mov rdx, qword [rsi]
lea ecx, [r14 + r14]
movsxd rbx, ecx
add rdx, rdi
mov r8, rbx
mov rcx, rax
mov r15, rax
call fcn.140025d00
add qword [rsi], rbx
xor eax, eax
movsxd rcx, r14d
mov word [r15 + rcx*2], ax
test r14d, r14d
jle 0x14007748f
mov rax, r15
mov ecx, r14d
xor word [rax], r14w
lea rax, [rax + 2]
sub rcx, 1
jne 0x140077481
mov rbx, qword [rsp + 0x30]
mov rax, r15
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret

Function at 0x140081e88
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov edi, dword [rcx + 0x18]
mov rbx, rcx
cmp dword [rcx + 0x458], edi
jae 0x140081fb0
mov r14d, 0x1ffff
mov edx, 1
mov rcx, rbx
call fcn.140081bd0
mov rcx, rbx
cmp eax, 1
jne 0x140081eee
lea edx, [rax + 7]
call fcn.140081bd0
mov edx, dword [rbx + 0x458]
mov rcx, qword [rbx + 0x450]
and rdx, r14
mov byte [rdx + rcx], al
inc dword [rbx + 0x458]
inc dword [rbx + 0x45c]
jmp 0x140081f49
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x38]
call fcn.140081c9c
mov r8d, dword [rbx + 0x458]
sub r8d, dword [rsp + 0x38]
mov r9d, dword [rsp + 0x30]
test r9d, r9d
je 0x140081f49
mov ecx, dword [rbx + 0x458]
mov eax, r8d
mov rdx, qword [rbx + 0x450]
and rax, r14
and rcx, r14
inc r8d
mov al, byte [rax + rdx]
mov byte [rcx + rdx], al
inc dword [rbx + 0x458]
inc dword [rbx + 0x45c]
add r9d, 0xffffffff
jne 0x140081f13
mov dword [rsp + 0x30], r9d
mov rcx, rbx
call fcn.1400820cc
mov eax, dword [0x1400f3080]
cmp eax, 0x1000
jbe 0x140081f93
and dword [0x1400f3080], 0
mov r9, qword [rbx + 0x470]
test r9, r9
je 0x140081f9b
imul eax, dword [rbx + 0x10], 0x64
xor edx, edx
mov ecx, dword [rbx + 0x14]
div dword [rbx + 0x18]
mov edx, dword [rbx + 0x10]
mov r8d, eax
call r9
test eax, eax
jne 0x140081f9b
mov byte [rbx + 0x464], 1
jmp 0x140081f9b
inc eax
mov dword [0x1400f3080], eax
cmp byte [rbx + 0x464], 0
jne 0x140081fed
cmp dword [rbx + 0x458], edi
jb 0x140081eb0
movsxd rax, dword [rbx + 0x488]
test eax, eax
je 0x140081fda
mov r9, qword [rbx + 0x30]
mov r8, rax
mov rcx, qword [rbx + 0x478]
mov edx, 1
call fcn.140032a04
and dword [rbx + 0x488], 0
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov eax, 4
jmp 0x140081fdc
Function at 0x140082038
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rbx, rcx
mov edx, 1
lea r8d, [rdx + 7]
cmp dword [rcx + 0x1c], edx
jne 0x140082069
mov edx, dword [rcx + 0x14]
add rdx, qword [rcx + 8]
lea rcx, [rsp + 0x30]
call fcn.140025d00
jmp 0x140082077
mov r9, qword [rcx + 0x28]
lea rcx, [rsp + 0x30]
call fcn.140034c5c
movzx ecx, byte [rsp + 0x34]
lea rdx, str.EA06
movzx eax, byte [rsp + 0x35]
add dword [rbx + 0x14], 8
xor ebx, ebx
shl ecx, 8
or ecx, eax
mov byte [rsp + 0x34], bl
movzx eax, byte [rsp + 0x36]
shl ecx, 8
or ecx, eax
movzx eax, byte [rsp + 0x37]
shl ecx, 8
or ecx, eax
mov dword [rdi], ecx
lea rcx, [rsp + 0x30]
call fcn.140034d40
test eax, eax
setne bl
mov eax, ebx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x1400820cc
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov eax, dword [rcx + 0x460]
mov rbx, rcx
cmp eax, dword [rcx + 0x458]
jae 0x14008219b
cmp dword [rcx + 0x20], 1
jne 0x140082128
mov r8d, dword [rbx + 0x460]
mov rax, qword [rbx + 0x450]
and r8d, 0x1ffff
mov edx, dword [rbx + 0x10]
mov rcx, qword [rbx]
mov al, byte [r8 + rax]
mov byte [rdx + rcx], al
inc dword [rbx + 0x460]
inc dword [rbx + 0x10]
mov eax, dword [rbx + 0x460]
cmp eax, dword [rbx + 0x458]
jb 0x1400820ed
jmp 0x14008219b
movsxd rdx, dword [rbx + 0x488]
mov r8d, eax
mov rax, qword [rbx + 0x450]
and r8d, 0x1ffff
mov rcx, qword [rbx + 0x478]
mov al, byte [r8 + rax]
mov byte [rdx + rcx], al
inc dword [rbx + 0x488]
cmp dword [rbx + 0x488], 0x10000
jne 0x140082182
mov r9, qword [rbx + 0x30]
mov edx, 1
mov rcx, qword [rbx + 0x478]
mov r8d, 0x10000
call fcn.140032a04
and dword [rbx + 0x488], 0
mov eax, dword [rbx + 0x460]
inc dword [rbx + 0x10]
inc eax
mov dword [rbx + 0x460], eax
cmp eax, dword [rbx + 0x458]
jb 0x140082128
and dword [rbx + 0x45c], 0
add rsp, 0x20
pop rbx
ret

Function at 0x1400821a8
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x48c]
mov rbx, rcx
mov r8d, 0x10000
test edx, edx
je 0x1400821c6
cmp edx, r8d
jne 0x1400821e4
mov r9, qword [rcx + 0x28]
mov edx, 1
mov rcx, qword [rcx + 0x480]
call fcn.140034c5c
and dword [rbx + 0x48c], 0
xor edx, edx
mov rax, qword [rbx + 0x480]
movsxd rcx, edx
mov al, byte [rcx + rax]
lea ecx, [rdx + 1]
mov dword [rbx + 0x48c], ecx
add rsp, 0x20
pop rbx
ret

Function at 0x14008240c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x100
mov rdi, rcx
mov esi, edx
lea rcx, [rsp + 0x20]
mov ebx, r8d
call fcn.140082200
mov edx, ebx
lea rcx, [rsp + 0x20]
call fcn.14008225c
test esi, esi
je 0x140082457
mov ebx, esi
lea rcx, [rsp + 0x20]
call fcn.1400823d4
xor byte [rdi], al
inc rdi
sub rbx, 1
jne 0x140082442
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x140665058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1406651df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, pe_nt_image_headers64
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140665089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14066506f
add dl, dl
jne 0x140665096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406650f6
xor eax, eax
add dl, dl
jne 0x1406650a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406651ad
add dl, dl
jne 0x1406650b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406650c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406650d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406650dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1406650ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14066507e
mov eax, 1
add dl, dl
jne 0x140665106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140665113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406650fb
sub eax, ebx
mov ebx, 1
jne 0x14066514c
mov ecx, 1
add dl, dl
jne 0x14066512e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14066513b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140665123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14066507e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140665168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140665175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14066515d
cmp eax, 0x7d00
jae 0x14066519b
cmp eax, 0x500
jb 0x140665196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14066507e
cmp eax, 0x7f
ja 0x14066519e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14066507e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1406651d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14066507e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20