joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400960c4
Capabilities:
Check if file exists
Delete file
Get file attributes

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x20
and dword [rax + 0x20], 0
mov rcx, rdx
mov rbp, rdx
call fcn.1400a6884
mov rsi, rax
test rax, rax
jne 0x1400960f7
lea eax, [rsi + 7]
jmp 0x140096199
call fcn.1400ad91c
mov edi, 1
test eax, eax
je 0x140096132
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14009615d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, eax
test eax, eax
jne 0x14009615d
lea rcx, [rsp + 0x48]
call fcn.1400b5a4c
test eax, eax
jne 0x140096105
jmp 0x14009615d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x14009615d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edi, eax
test eax, eax
jne 0x14009615d
lea rcx, [rsp + 0x48]
call fcn.1400b5a4c
test eax, eax
jne 0x140096132
xor ebx, ebx
test edi, edi
sete bl
test ebx, ebx
je 0x140096186
lea rdx, str.winDelete
mov r9d, 0x85f9
mov r8, rbp
mov ecx, 0xa0a
call fcn.1400e474c
mov ebx, eax
jmp 0x14009618f
mov ecx, dword [rsp + 0x48]
call fcn.1400ae3f4
mov rcx, rsi
call fcn.1400ea110
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x14009c518
Capabilities:
Clear file content

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor ebx, ebx
mov rax, rdx
mov rdi, rcx
cmp dword [rcx + 0x38], ebx
jle 0x14009c542
movsxd r8, dword [rcx + 0x38]
dec rax
add rax, r8
cqo
idiv r8
imul rax, r8
mov rdx, rax
call fcn.1400b5ec0
test eax, eax
je 0x14009c55d
mov r9d, 0x802d
lea rdx, str.winTruncate1
jmp 0x14009c581
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x14009c591
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, 0x8030
lea rdx, str.winTruncate2
mov dword [rdi + 0x20], eax
mov r8, qword [rdi + 0x30]
mov ecx, 0x60a
call fcn.1400e474c
mov ebx, eax
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14009c974
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x10]
mov rsi, rdx
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp eax, 0xffffffff
jne 0x14009c9c9
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x14009c9c9
mov r8, qword [rbx + 0x30]
lea rdx, str.winFileSize
mov r9d, 0x808c
mov ecx, 0x70a
mov dword [rbx + 0x20], eax
call fcn.1400e474c
jmp 0x14009c9d9
mov ecx, dword [rsp + 0x30]
shl rcx, 0x20
add rcx, rdi
xor eax, eax
mov qword [rsi], rcx
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400ac7c8
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x250]
sub rsp, 0x350
mov rax, qword [0x140162470]
xor rax, rsp
mov qword [rbp + 0x240], rax
mov r9, qword [0x1401729c8]
mov rbx, rdx
mov esi, ecx
test r9, r9
je 0x1400ac81c
lea r8, [0x14011db84]
lea rdx, [rsp + 0x20]
mov ecx, 0xe6
call fcn.14009ae90
jmp 0x1400ac8a2
call fcn.1400ad91c
mov ecx, 0xe6
test eax, eax
je 0x1400ac86c
lea rdx, [rbp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea rcx, [rbp + 0x30]
call fcn.1400e1160
mov rdi, rax
test rax, rax
jne 0x1400ac881
mov eax, 7
mov rcx, qword [rbp + 0x240]
xor rcx, rsp
call fcn.1400e7da0
mov rbx, qword [rsp + 0x380]
add rsp, 0x350
pop rdi
pop rsi
pop rbp
ret
lea rdx, [rbp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
lea rcx, [rbp + 0x30]
call fcn.1400e0474
jmp 0x1400ac83d
lea r8, [0x14011db84]
lea rdx, [rsp + 0x20]
mov r9, rax
mov ecx, 0xe6
call fcn.14009ae90
mov rcx, rdi
call fcn.1400ea110
mov r8b, byte [rsp + 0x20]
lea rax, [rsp + 0x20]
lea rcx, [rsp + 0x20]
test r8b, r8b
je 0x1400ac8be
inc rcx
cmp byte [rcx], 0
jne 0x1400ac8b6
sub ecx, eax
lea rax, str.etilqs_
mov edi, 0x3fffffff
mov rdx, rax
and ecx, edi
inc rdx
cmp byte [rdx], 0
jne 0x1400ac8d1
sub edx, eax
add ecx, 0x11
and edx, edi
add ecx, edx
cmp ecx, esi
jl 0x1400ac8f0
mov eax, 1
jmp 0x1400ac84a
lea rcx, [rsp + 0x20]
lea rax, [rsp + 0x20]
test r8b, r8b
je 0x1400ac907
inc rax
cmp byte [rax], 0
jne 0x1400ac8ff
sub eax, ecx
and eax, edi
movsxd rcx, eax
je 0x1400ac921
lea rax, [rsp + 0x20]
cmp byte [rax + rcx - 1], 0x5c
jne 0x1400ac921
dec rcx
jne 0x1400ac915
cmp rcx, 0x105
jae 0x1400ac9c4
mov byte [rsp + rcx + 0x20], 0
lea r9, [rsp + 0x20]
lea r8, str._setilqs_
lea ecx, [rsi - 0x11]
mov rdx, rbx
call fcn.14009ae90
mov rax, rbx
test rbx, rbx
je 0x1400ac963
cmp byte [rbx], 0
je 0x1400ac95f
inc rax
cmp byte [rax], 0
jne 0x1400ac957
sub eax, ebx
and eax, edi
movsxd rdi, eax
mov esi, InitCommonControls
lea rdx, [rbx + rdi]
mov ecx, esi
call fcn.14009b198
lea r8, [rdi + rbx]
add rdi, rsi
movzx ecx, byte [r8]
movabs rax, 0x842108421084211
mul rcx
mov eax, ecx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 5
imul rax, rax, 0x3e
sub rcx, rax
lea rax, str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789
mov al, byte [rcx + rax]
mov byte [r8], al
inc r8
dec rsi
jne 0x1400ac97d
mov byte [rbx + rdi], sil
xor eax, eax
jmp 0x1400ac84a
call fcn.1400e8c4c
int3
Function at 0x1400c1adc
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rdx
mov rdi, rcx
test rcx, rcx
je 0x1400c1bf8
test rdx, rdx
je 0x1400c1bf8
mov ecx, 0x800
test word [rdi + 2], cx
jne 0x1400c1b87
movzx eax, word [rdx + 2]
test cx, ax
jne 0x1400c1b87
xor al, byte [rdi + 2]
test al, 0x10
jne 0x1400c1b87
mov al, byte [rdx]
cmp byte [rdi], al
jne 0x1400c1b87
mov rdx, qword [rdx + 0x10]
mov rcx, qword [rdi + 0x10]
call fcn.1400c1adc
test eax, eax
jne 0x1400c1b87
mov rdx, qword [rbx + 0x18]
mov rcx, qword [rdi + 0x18]
call fcn.1400c1adc
test eax, eax
jne 0x1400c1b87
mov rdx, qword [rbx + 0x20]
mov rcx, qword [rdi + 0x20]
call fcn.1400c2434
test eax, eax
jne 0x1400c1b87
mov eax, dword [rbx + 0x30]
cmp dword [rdi + 0x30], eax
jne 0x1400c1b87
movzx eax, word [rbx + 0x34]
cmp word [rdi + 0x34], ax
jne 0x1400c1b87
movzx r8d, word [rdi + 2]
mov ecx, 0x400
test cx, r8w
je 0x1400c1b8e
test word [rbx + 2], cx
je 0x1400c1b87
mov eax, dword [rbx + 8]
cmp dword [rdi + 8], eax
je 0x1400c1bc7
mov eax, 2
jmp 0x1400c1c03
cmp byte [rdi], 0x98
je 0x1400c1bc7
mov rax, qword [rdi + 8]
test rax, rax
je 0x1400c1bc7
test word [rbx + 2], cx
jne 0x1400c1b87
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1400c1b87
sub rcx, rax
movzx edx, byte [rax]
movzx r9d, byte [rax + rcx]
sub edx, r9d
jne 0x1400c1bc3
inc rax
test r9d, r9d
jne 0x1400c1bae
test edx, edx
jne 0x1400c1b87
movzx ecx, word [rbx + 2]
mov edx, 0x100
and cx, dx
and r8w, dx
cmp r8w, cx
je 0x1400c1be4
mov eax, 1
jmp 0x1400c1c03
test r8w, r8w
je 0x1400c1bf4
mov rax, qword [rbx + 0x28]
cmp qword [rdi + 0x28], rax
jne 0x1400c1b87
xor eax, eax
jmp 0x1400c1c03
sub rbx, rcx
neg rbx
sbb eax, eax
and eax, 2
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1400c586c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor ebx, ebx
mov rdi, rdx
mov r10, rcx
cmp qword [rcx + 0x10], rbx
je 0x1400c58bb
mov r9d, r8d
mov r11, rdx
mov eax, ebx
test r8d, r8d
jle 0x1400c58b4
movzx ecx, byte [r11]
lea rdx, [0x14011c810]
dec r9d
movzx edx, byte [rcx + rdx]
mov ecx, eax
inc r11
shl ecx, 3
xor edx, ecx
xor eax, edx
test r9d, r9d
jg 0x1400c5891
xor edx, edx
div dword [r10]
jmp 0x1400c58bd
mov edx, ebx
mov r9d, edx
mov rcx, r10
mov rdx, rdi
call fcn.1400a97ec
test rax, rax
je 0x1400c58d4
mov rbx, qword [rax + 0x10]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400e02f8
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x28
xor edx, edx
lea rcx, [0x140174960]
lea r8d, [rdx + 0x30]
call fcn.1400ea570
lea rcx, [0x140174960]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea rcx, [0x1401620e0]
mov edx, 1
call fcn.1400992c4
xor eax, eax
add rsp, 0x28
ret

Function at 0x1400ea394
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push rbx
sub rsp, 0x30
call fcn.1400eff1c
movzx ebx, ax
mov ecx, 2
call fcn.1400f5a20
call fcn.1400f502c
test eax, eax
jne 0x1400ea3d7
cmp dword [0x1401744e8], 1
jne 0x1400ea3c3
call fcn.1400f5738
mov ecx, 0x1c
call fcn.1400f57ac
mov ecx, 0xff
call fcn.1400eda64
call fcn.1400f1c48
test eax, eax
jne 0x1400ea402
cmp dword [0x1401744e8], 1
jne 0x1400ea3ee
call fcn.1400f5738
mov ecx, InitCommonControls
call fcn.1400f57ac
mov ecx, 0xff
call fcn.1400eda64
call fcn.1400f5b14
nop
call fcn.1400f48d8
test eax, eax
jns 0x1400ea41b
mov ecx, 0x1b
call fcn.1400ea4a4
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov qword [0x140175ae8], rax
call fcn.1400f5b84
mov qword [0x1401737c8], rax
call fcn.1400f533c
test eax, eax
jns 0x1400ea447
mov ecx, 8
call fcn.1400eda7c
call fcn.1400f55f8
test eax, eax
jns 0x1400ea45a
mov ecx, 9
call fcn.1400eda7c
mov ecx, 1
call fcn.1400edaa4
test eax, eax
je 0x1400ea46f
mov ecx, eax
call fcn.1400eda7c
call fcn.1400f5c78
movzx r9d, bx
mov r8, rax
xor edx, edx
lea rcx, [0x140000000]
call fcn.140006b68
mov dword [rsp + 0x20], eax
mov ecx, eax
call fcn.1400edde0
nop
mov ecx, eax
call fcn.1400edb3c
nop
add rsp, 0x30
pop rbx
ret

Function at 0x1400edde0
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.1400edc48
Function at 0x140208050
Capabilities:
Encode data using xor

Disassembly:
mov r12, qword [rsp + 0x10]
jns 0x1401cc79d
push 0x3e8c309b
pushfq
xor dword [rsp + 8], 0x81bf77ad
jns 0x1401d691d
mov qword [rsp + 0x10], 0x20179979
push qword [rsp]
popfq
lea rsp, [rsp + 0x10]
call fcn.14033d398
je 0x1401d690c
push qword [rsp + 8]
popfq
lea rsp, [rsp + 0x20]
call fcn.14033d398
push r11
pushfq
movabs r11, 0x5da5e61f682bbc9b
call fcn.14024b3fb
enter 0x6fd1, 0xffffffffffffffd9
mov bh, 0x4a
je 0x1402080a7
lodsd eax, dword [rsi]
mov ebx, 0x80eb8b7e
rcl byte [rax + 0x5b], cl
invalid
mov bl, 0x97
jns 0x1402080cc
ret 0xc64a
pop qword [rdi - 0x4e681b0e]
sub dword [rdi + 0x618934d8], edi
mov esp, 0x2e1f5db5
retf

Function at 0x14024c991
Capabilities:
Encode data using xor

Disassembly:
call fcn.14021698d
push r12
pushfq
movabs r12, 0x82b6cc91e4128c8b
xor r12b, 0xe
mov qword [rsp + 0x28], 0xfffffffff8d89839
mov r12, qword [rsp + 8]
jb 0x14024c993
jle 0x1401f9d20
call fcn.1401c5a88

Function at 0x1402d99d7
Capabilities:
Packed with generic packer

Disassembly:
lahf
test al, 0x30
invalid
call fcn.1401ab2e3
mov ebp, 0xcc75adeb
lea edi, [rbp + rcx*2 + 0x71]
push rax
jbe 0x14002c467
sub byte [rax], al
movabs dword [0xbe6fdc4000dd7e67], eax
fld qword [rax]
cld
sub ebx, dword [rdi]
fmul dword [rdx]
scasd eax, dword [rdi]
int 0x97
push 0xffffffffffffffd2
shrd dword [rbx + 0x23125fd8], ebx, cl
invalid
jle 0x14002c4c1
test byte [rax + 0x6f], al
invalid
push rdx
pushfq
movabs rdx, 0x140cef183003f728
sub dl, 0x36
mov qword [rsp + 0x18], 0xffffffffcc3598b9
mov rdx, qword [rsp + 8]
jl 0x14020f892

Function at 0x14033a4e0
Capabilities:
Parse pe header

Disassembly:
add r10, rax
bswap edx
movsx eax, r11b
mov sil, byte [rbp + r9 + 0x4549c8db]
call fcn.14038e7af
push 0xffffffffdc296c13
mov r11d, 0x4eb9959c
jmp 0x14035e6dd
mov dword [r8 + rcx - 0x41ccede], edx
pop rbx
push rcx
mov ebx, esi
adc ebp, dword [r9 + rcx*2 - 0x8399dba]
shr qword [rsp + rcx*4 - 0x10733b67], cl
jae 0x140354bd9
lea r9, [r9 + rcx - 0x41cced8]
pop rax
adc eax, esi
xor ebp, edi
xor ebp, 0x7f1936bf
jmp 0x140370f45
lea rbp, [rcx + 0x48338832]
movzx ebx, bpl
not cl
xor eax, 0x7f1936bf
movzx r11d, bp
dec eax
shl rbx, 0x38
movzx edx, bpl
xor eax, 0x4252b2b
bt rbx, r11
not cx
neg eax
lea rbx, [rbp + rbp + 0x5e10bc2d]
movzx esi, cl
push rdi
mov edi, 0x2ca3a383
btc edx, r11d
xor dword [rsp + rbp - 0x56cdb8b4], eax
bswap ecx
pop rdi
lea rbp, [rdx*2 - 0x4569ca43]
neg dl
movsxd rax, eax
push rbx
jno 0x140338b35
Function at 0x140347579
Capabilities:
Manually build aes constants

Disassembly:
mov qword [rsp + rsi - 0xcd], rbp
xor ecx, 0x6d8acb22
cbw
mov qword [rsp + rsi*2 - 0x192], rdx
ror ecx, 2
xor ecx, 0x9315afb5
neg qword [rsp + rsi*4 - 0x320]
not ecx
mul ebp
neg ecx
rol byte [rsp + rsi - 0xc4], 0x83
mov qword [rsp + rsi - 0xb5], rdi
xor dword [rsp + rsi - 0xb5], ecx
mov rdi, qword [rsp + rsi*2 - 0x182]
ror dx, 0x41
xor rdx, rbp
movsxd rcx, ecx
xchg dx, si
jo 0x140383cd3
inc sil
adc r10, rcx
sar bp, 0x83
lea r11, [rax*8 - 0x264ec761]
mov qword [rsp + rsi - 0xa5d4], r10
ret 0x18

Function at 0x14037c2e8
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
mov esi, 0xb3f5920
rol eax, 3
ror byte [rsp + rsi - 0xb3f591d], 0xc3
adc qword [rsp + rsi*2 - 0x167eb240], rsi
mov qword [rsp + rsi - 0xb3f5920], rdi
jp 0x14038ea84
movsx edi, bl
xor dword [rsp + rsi - 0xb3f5920], eax
lea rcx, [rbx*8 + 0x51b9672b]
pop rdi
movzx ebp, bx
or rbp, rsi
movsxd rax, eax
sete bpl
movzx r11d, bp
or r11, 0xffffffffbb910123
adc r10, rax
bt r11w, r11w
bswap ebx
setb bl
mov ax, word [r8 + rsi - 0xb3f5920]
rol sil, 0x83
xor rbp, r11
movzx esi, byte [r9 + rbx - 0x36770dfc]
mov edx, ecx
adc edx, 0x3e068680
xor sil, dil
xadd bx, dx
call fcn.1403354bd
mov edx, 0x92866a7
lea rbx, [rdx + rdx - 0x72cc85f5]
mov r11d, dword [rdx + r9 - 0x92866a7]
mov eax, edx
lea rcx, [rdx + rdx - 0x6d4451e6]
xor r11d, edi
bt ax, ax
jb 0x14038148e
mov ebp, dword [r9 + r11*2 - 0x44]
movzx edx, r11w
lea r9, [r9 + r11*2 - 0x40]
lea rsi, [rdx + 0x7224a606]
xor ebp, edi
lea rbx, [rsi*2 + 0x6f96623d]
shl si, 0xe4
bswap ebp
and si, si
lea rdx, [rsi + rdx*8 - 0x71c7db4d]
not ebp
shr sil, 0x64
dec r11d
mov ecx, edx
ror ebp, 1
mov eax, edx
lea ebp, [rbp + r11*8 + 0x55286b99]
ror eax, 0x76
sar cx, 0xe4
and rbx, rax
push rdi
xchg bx, ax
add si, ax
call fcn.14036ba04
sub eax, 0x429ee3a6
mov qword [rsp], 0xffffffffc0972012
not eax
jmp 0x14036c7ba
lea r11d, [r11 + rdx + 0x496369e7]
bts rcx, 0x86
neg r11d
rol r11d, 1
bswap r11d
and bx, bx
call fcn.14036336b
mov r11d, 0x1aac7f09
mov esi, r11d
mov rax, qword [r8 + r11 - 0x1aac7f09]
lea rbp, [rsi + r11*2 + 0x64976fa3]
shl r11d, 0x21
jae 0x140354cf5
Function at 0x14038712f
Capabilities:
Manually build aes constants

Disassembly:
lea rdx, [rbx*8 - 0x3a5a29c5]
movzx r11d, dx
xor ecx, 0x4252b2b
sal rdx, 0xcb
neg ecx
push rdi
xor dword [rsp + r11*2 - 0x18d6], ecx
push rbx
mov edi, 0x8bbd6484
mov rdi, qword [rsp + r11*8 - 0x6350]
shr bx, 0xaf
movsxd rcx, ecx
lea rbp, [r11 + 0x6991aaa5]
add r10, rcx
xor qword [rsp + r11*4 - 0x31ac], 0xffffffffb8966c86
sbb word [rsp + r11*4 - 0x31ac], bx
movzx eax, byte [r11 + r9 - 0xc67]
adc ebx, ebp
mov qword [rsp + rbx - 0x51bfb709], 0x6c94e8a8
call fcn.1403933d3
lea eax, [rbp + rax - 0x1896bb9a]
push rdi
btc esi, 0xba
xor dword [rsp + rbx*2 - 0x2006], eax
add dl, ch
sar r11b, 0xe5
pop rdi
sar dx, 0x42
push r11
shl rsi, cl
movsxd rax, eax
adc cx, si
adc bpl, byte [rsp + rbp + 0x7da31b08]
adc r10, rax
mov qword [rsp + rbx - 0x1003], rbx
mov ax, word [rbp + r8 + 0x7da31b03]
lea r8, [r8 + rbx*4 - 0x4008]
mov cl, byte [rbp + r9 + 0x7da31b05]
lea r9, [r9 + rbp + 0x7da31b06]
jmp 0x140375140
rol esi, 0xa6
xor cl, dil
xor cl, 0x3e
xor byte [rsp + rbp + 0x7da31b05], bpl
rol sil, 2
not r11d
rol cl, 1
dec si
neg dword [rsp + rbx*2 - 0x2002]
sub cl, bpl
xor cl, 0x15
ror rsi, 0xdf
shr byte [rsp + rbp + 0x7da31b02], 0x86
xor dil, cl
pop rbx
sar ebp, 0x85
setns bl
add rcx, rsp
sar r11d, 0xb5
mov byte [rcx + riz], al
mov ecx, r11d
adc bl, bl
jmp r10
mov cl, byte [r8 + riz + 8]
not ebx
mov eax, ebx
sal rbp, cl
lea rcx, [rax*8 - 0x386f6c80]
cqo
mov esi, 0x8ab4a429
mov qword [r8 + rax*2 - 0x5ae4a9a4], rbp
pop rax
movzx r11d, si
mov rcx, qword [rbx + r8 - 0x2d7254d1]
sal dx, 0xea
movzx ebp, r11w
lea r8, [rbx + r8 - 0x2d7254c9]
movsx eax, sil
movzx ebp, byte [r9 + rbx*2 - 0x5ae4a9a6]
xor bpl, dil
cdqe
call fcn.1403944cc
inc edx
mov eax, dword [rsp + 0xc]
movzx r11d, byte [rsp + rax + 0xb]
mov word [rsp + rax*8 + 9], ax
mov qword [rsp + r11*4 - 0x170], rdi
xor dword [rsp + rax + 8], edx
mov rdi, qword [rsp + rax*2 + 8]
mov qword [rsp + rax + 8], r11
movsxd rdx, edx
mov ebx, r11d
xor dword [rsp + rax + 6], 0x22a79f8c
adc r10, rdx
dec qword [rsp + rax + 7]
mov rbx, qword [r8 + rax]
mov r11b, byte [rbx + rax*2]
lea r8, [r8 + rax*2 + 6]
call fcn.140354179
lea r11, [rdx*2 + 0x16831b39]
xor eax, edi
inc bx
mov ecx, edx
lea eax, [rax + rsi*2 - 0x2311f691]
btr r11, rbp
xor eax, 0x1e1d7c25
btc r11w, bp
imul rdx, rbp
dec sil
lea eax, [rax + rbp + 0x55a06e6f]
shr cx, 0x41
bswap rsi
sub r11b, bl
xor eax, 0x2f9196bd
ror bx, 0xa4
jae 0x140371c0a
mov ebx, 0xe82ec6b1
movzx ecx, bl
mov ecx, dword [rcx + r9 - 0xb1]
xor ecx, edi
rol bl, 0xa2
xor ecx, 0x7f1936bf
dec ecx
jmp 0x1403554ca
Function at 0x140396e25
Capabilities:
Authenticate hmac

Disassembly:
lea rdx, [rsi*2 + 0x7303a89]
xor dword [rsp + rsi - 0x6886b01e], r11d
pop rdi
movsxd r11, r11d
shr al, 0x23
add r10, r11
btc rsi, rsi
sbb rbp, 0xffffffffab83d31a
mov rbx, qword [rsi + r8 - 0x2886b01e]
mov rsi, qword [rbx + rsi*2 - 0x510d603c]
jns 0x1403841d0
mov esi, 0x72335e1f
lea rax, [rsi + rsi*2 - 0x764cfde7]
movzx si, byte [rsi + r8 - 0x72335e1f]
mov r11d, eax
movzx ebp, al
jmp 0x1403701c8
shr dx, 0x44
movzx ebx, ax
mov qword [r8 + rcx - 0x57], rsi
bswap ecx
mov r11d, eax
lea rax, [rsp + rax - 0x391a473f]
setbe cl
shl r11w, 0x22
mov esi, dword [rcx + rax - 0x57000000]
lea rcx, [rdx + rcx - 0x67c3c6c]
bts rcx, r11
sub edx, 0xe5ab8a8b
mov dword [r8 + rbx - 0x4813], esi
jb 0x14037a7ee
mov word [r8 + r11*4 - 0x28bc4], ax
pop rbp
pop rbx
jae fcn.14033e445
mov rbx, r8
mov edx, 0x77222e29
lea r11, [rdx*4 + 0x617f10c]
rol r11b, 0x62
mov qword [r8 + rdx - 0x77222e31], rbx
movzx ebx, dl
movzx ecx, byte [rdx + r9 - 0x77222e29]
and r11, 0x7a1af605
xor cl, dil
add cl, 0xb5
mov esi, 0xb830183b
call fcn.140389d5b
movzx eax, dx
ror ecx, 1
movzx ebp, dl
not dx
bswap ecx
neg ecx
inc edx
setne sil
rol ecx, 1
sub ecx, esi
push rdx
push rsi
add rsi, 0x6db500b3
mov qword [rsp + r11 + 8], rdi
xor dword [rsp + r11*2 + 8], ecx
rol byte [rsp + r11 + 2], 0x26
mov rdi, qword [rsp + r11*4 + 8]
and dword [rsp + r11 + 3], r11d
lea rbx, [rdx*8 + 0x3931c41d]
movsxd rcx, ecx
not dl
adc r10, rcx
mov qword [rsp + r11*2 + 8], rbx
ror eax, 6
adc r11, 0x5a8ecfae
adc rax, qword [rsi + r8 - 0x6db500b4]
xchg ebx, r11d
movsx ecx, r11b
lea r8, [r8 + rbp*2 + 8]
rol qword [rsp + r11 - 0x2539c41d], 0xb4
push rsi
movzx ebx, byte [r9 + rbp*2]
sal rbp, cl
shr word [rsp + r11 - 0x2539c40e], 0xc2
lea r9, [r9 + r11*2 - 0x4a738839]
xor bl, dil
sar r11b, 0xa3
xor bl, dl
sal cl, 0xa5
sal r11d, 0x49
inc dx
add si, 0x7914
mov qword [rsp + rbx*2 + 0x20], rdi
xor dword [rsp + rax - 0x7c90b47c], edx
mov rdi, qword [rsp + rax - 0x7c90b47c]
mov qword [rsp + rbx*2], rsi
movsxd rdx, edx
bt r11d, ebx
add r10, rdx
not r11
mov cx, word [r8 + rbx]
not word [rsp + rax - 0x7c90b496]
cbw
call fcn.1403540dd
mov ecx, 0xe3bbcb2e
xor edx, edi
movzx ebp, cx
lea edx, [rdx + rcx - 0xda5a6ae]
not edx
dec ecx
not cl
and ecx, ebp
inc edx
lea rbx, [rbp*2 + 0x3925f29e]
rol edx, cl
dec rcx
bts ebp, ecx
jb 0x140355ae3
ror esi, 2
xor dx, bp
xor esi, 0x569f9706
shl bpl, 0x44
lea rcx, [rbp*8 + 0x2032fd2f]
movsx ebx, bp
bswap esi
btc bp, 0x82
mov qword [rsp + rdx - 0x54dd289b], rbx
and qword [rsp + rbp - 0x47180739], rdx
lea esi, [rsi + rbp - 0x2c83472b]
not esi
neg esi
rol rbp, cl
adc dl, 0xae
not cl
mov qword [rsp + rdx - 0x54dd2841], rdi
sal cx, 0xcc
ror qword [rsp + rdx - 0x54dd284d], 0x61
movsx edi, bpl
xor dword [rsp + rdx - 0x54dd2841], esi
add cx, di
movsx r11d, bx
xchg r11d, ebp
mov rdi, qword [rsp + rbp*2 - 0xe70]
movsxd rsi, esi
call fcn.14034354d
lea r11d, [rcx + r11 - 0x23be4107]
movsx ebp, sil
rol r11d, 1
not r11d
push rax
inc dword [rsp + rsi - 0x6886b01b]
bt rax, rbx
mov qword [rsp + rsi - 0x6886b01e], rdi
movzx edi, cx
jae 0x140362642
Function at 0x7ff792b3a058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x7ff792b3a1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x7ff792b3a089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x7ff792b3a06f
add dl, dl
jne 0x7ff792b3a096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x7ff792b3a0f6
xor eax, eax
add dl, dl
jne 0x7ff792b3a0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x7ff792b3a1ad
add dl, dl
jne 0x7ff792b3a0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7ff792b3a0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7ff792b3a0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7ff792b3a0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x7ff792b3a0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x7ff792b3a07e
mov eax, 1
add dl, dl
jne 0x7ff792b3a106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7ff792b3a113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x7ff792b3a0fb
sub eax, ebx
mov ebx, 1
jne 0x7ff792b3a14c
mov ecx, 1
add dl, dl
jne 0x7ff792b3a12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x7ff792b3a13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x7ff792b3a123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x7ff792b3a07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x7ff792b3a168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x7ff792b3a175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x7ff792b3a15d
cmp eax, 0x7d00
jae 0x7ff792b3a19b
cmp eax, 0x500
jb 0x7ff792b3a196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x7ff792b3a07e
cmp eax, 0x7f
ja 0x7ff792b3a19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x7ff792b3a07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x7ff792b3a1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x7ff792b3a07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1406c5cc0
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1406c5e47
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1406c5cf1
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406c5cd7
add dl, dl
jne 0x1406c5cfe
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406c5d5e
xor eax, eax
add dl, dl
jne 0x1406c5d0d
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406c5e15
add dl, dl
jne 0x1406c5d1e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406c5d2b
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406c5d38
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406c5d45
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1406c5d52
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1406c5ce6
mov eax, 1
add dl, dl
jne 0x1406c5d6e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406c5d7b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406c5d63
sub eax, ebx
mov ebx, 1
jne 0x1406c5db4
mov ecx, 1
add dl, dl
jne 0x1406c5d96
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1406c5da3
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406c5d8b
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1406c5ce6
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1406c5dd0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1406c5ddd
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406c5dc5
cmp eax, 0x7d00
jae 0x1406c5e03
cmp eax, 0x500
jb 0x1406c5dfe
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1406c5ce6
cmp eax, 0x7f
ja 0x1406c5e06
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1406c5ce6
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1406c5e3a
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1406c5ce6
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20