joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400a5cb0
Capabilities:
Encode data using xor
Execute command

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x1400cea28]
mov rbx, rcx
test rax, rax
je 0x1400a5f1f
mov ecx, 1
mov dword [rsp + 0x20], 2
mov word [rbx + 2], cx
mov r9d, edx
mov rcx, rbx
xor edx, edx
mov r8d, 0xbadc0de
call rax
test rax, rax
jne 0x1400a5ec5
cmp word [rbx + 2], 1
jne 0x1400a5ec5
cmp byte [0x1400bc26f], 0
mov rax, qword [str.sF]
mov qword [rsp + 0x60], rax
je 0x1400a5e6d
xor ecx, ecx
cmp dword [0x1400c7018], 2
jl 0x1400a5e38
movdqa xmm2, xmmword [0x1400bc590]
mov eax, 4
movdqa xmm4, xmmword [0x1400bcb50]
movdqa xmm1, xmm2
movdqa xmm3, xmmword [0x1400bc5a0]
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
movaps xmmword [rsp + 0x30], xmm6
movd xmm6, eax
mov eax, 0x1f
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movd xmm5, eax
movdqa xmm0, xmm1
psrld xmm0, xmm5
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1400bc5c0]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, dword [rsp + 0x60]
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
pand xmm2, xmmword [0x1400bc5d0]
packuswb xmm2, xmm2
paddb xmm2, xmmword [str.00000000000000004444444444444444]
pxor xmm2, xmm0
punpckldq xmm1, xmm3
movd dword [rsp + 0x60], xmm2
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movaps xmm6, xmmword [rsp + 0x30]
movdqa xmm0, xmm1
psrld xmm0, xmm5
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1400bc5c0]
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, dword [rsp + 0x64]
pshufd xmm2, xmm1, 0xd8
pand xmm2, xmmword [0x1400bc5d0]
packuswb xmm2, xmm2
paddb xmm2, xmmword [str.00000000000000004444444444444444]
pxor xmm2, xmm0
movd dword [rsp + 0x64], xmm2
jmp 0x1400a5e6d
lea r8, [rsp + 0x60]
nop dword [rax]
mov eax, 0x4ec4ec4f
lea r8, [r8 + 1]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x34
movzx eax, cl
inc ecx
sub al, dl
add al, 0x30
xor byte [r8 - 1], al
cmp ecx, 8
jl 0x1400a5e40
lea rcx, [rsp + 0x60]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.____________Driver_Loading_n
call fcn.140050af0
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.___________Mapping_Driver_n
call fcn.140050af0
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.___________Driver_Loaded_n
call fcn.140050af0
xor al, al
add rsp, 0x40
pop rbx
ret
cmp byte [rbx], 0
movzx eax, word [rbx + 2]
je 0x1400a5eda
test ax, ax
sete al
add rsp, 0x40
pop rbx
ret
mov ecx, eax
sub ecx, 2
je 0x1400a5f13
sub ecx, 1
je 0x1400a5eff
cmp ecx, 1
jne 0x1400a5f1f
lea rcx, str.____Invalid_funciton_operation_sent_to_driver._n
call fcn.140050af0
xor al, al
add rsp, 0x40
pop rbx
ret
lea rcx, str.____Security_check_failure._n
call fcn.140050af0
xor al, al
add rsp, 0x40
pop rbx
ret
lea rcx, str.____Invalid_process._n
call fcn.140050af0
xor al, al
add rsp, 0x40
pop rbx
ret
Function at 0x1400a6c78
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400a6cc2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400a6cc2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400a6cc2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400a6cc2
cmp dword [rcx + 0x84], 0xe
jbe 0x1400a6cc2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400a6cc4
xor al, al
add rsp, 0x28
ret
Function at 0x1400dea20
Capabilities:
Enumerate gui resources
Enumerate processes
Log keystrokes via polling

Disassembly:
jmp 0x1400e9dc0
push 0xffffffff997327fc
call fcn.1402a2698
xchg edi, eax
and al, 0x8c
cmp esi, dword [rbx]
movabs byte [0xc738e9242c874804], al
clc
dec dword [rax - 0x79]
adc al, 0x24
jmp fcn.1400a45e1

Function at 0x1400e17e9
Capabilities:
Create thread
Log keystrokes via polling

Disassembly:
lea rdi, [rdi + 0xc120a3d]
xchg qword [rsp], rdi
jmp fcn.1400a47d9
mov qword [rsp + 8], rdi
movzx di, cl
movsx edi, r9w
not dil
lea rdi, [0x14025e9f9]
jmp 0x1400e237e
push rdi
xchg di, di
movsx di, r8b
jmp 0x14024d173
mov rdi, qword [rdi]
jmp 0x1400d8961
mov rdi, qword [rsp + 8]
jmp 0x14028ea4b
lea rdi, [rdi + 1]
jmp 0x1400df864

Function at 0x1400e920c
Capabilities:
Enumerate gui resources
Enumerate processes
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rax
cdqe
movsx ax, sil
lea rax, [0x1402258ea]
jmp 0x14023f95b
push rax
mov rax, qword [rsp + 8]
lea rax, [rax + 1]
jmp 0x1400d6680
lea rax, [rax - 0x36cb73f9]
jmp 0x14024312a
mov rax, qword [rax]
jmp 0x14021eccf
xchg qword [rsp], rax
jmp fcn.1400a455f

Function at 0x1400e9dc0
Capabilities:
Enumerate gui resources
Enumerate processes
Log keystrokes via polling

Disassembly:
jmp 0x1400e9dc0
push 0xffffffff997327fc
call fcn.1402a2698
xchg edi, eax
and al, 0x8c
cmp esi, dword [rbx]
movabs byte [0xc738e9242c874804], al
clc
dec dword [rax - 0x79]
adc al, 0x24
jmp fcn.1400a45e1
Function at 0x180001000
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push r12
push r14
push r15
sub rsp, 0x20
mov ebp, r8d
mov r12, r9
mov rbx, rdx
mov r15, rcx
mov r14, r9
test r8b, 0xf
jne 0x1800010ff
mov qword [rsp + 0x40], rsi
mov esi, ebp
cmp dword [rsp + 0x60], ebp
jae 0x180001044
mov ecx, ebp
call fcn.180003d68
mov r14, rax
mov r8, rsi
mov rdx, rbx
mov rcx, r14
call fcn.180002b70
mov rbx, r14
test ebp, ebp
je 0x1800010c6
mov qword [rsp + 0x48], rdi
mov rdi, r15
sub rdi, r14
add rdi, 0xb0
dec rsi
shr rsi, 4
inc rsi
nop word [rax + rax]
movups xmm0, xmmword [rbx]
mov rdx, r15
mov rcx, rbx
call fcn.180001140
mov ecx, 0x10
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rdi + rbx]
xor byte [rbx], al
inc rbx
sub rcx, 1
jne 0x1800010a0
sub rdi, 0x10
movups xmmword [r15 + 0xb0], xmm0
sub rsi, 1
jne 0x180001080
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
lea eax, [rbp - 1]
movzx eax, byte [rax + r14]
mov ebx, ebp
sub ebx, eax
cmp ebx, ebp
jae 0x1800010ff
lea eax, [rbp - 0x10]
cmp ebx, eax
jb 0x1800010ff
cmp dword [rsp + 0x60], ebx
jb 0x1800010ff
cmp r14, r12
je 0x1800010fb
mov r8d, ebx
mov rdx, r14
mov rcx, r12
call fcn.180002b70
mov eax, ebx
jmp 0x180001104
mov eax, 0xfffffff2
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x180001140
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov rsi, rdx
mov rbx, rcx
sub rsi, rcx
mov r9d, 4
nop dword [rax]
mov r8d, 4
nop word [rax + rax]
movzx eax, byte [rsi + rcx + 0xa0]
xor byte [rcx], al
inc rcx
sub r8, 1
jne 0x180001180
sub r9, 1
jne 0x180001170
mov bpl, 9
lea rdi, [rsi + 0x90]
lea r14, [0x18000d410]
nop word [rax + rax]
movzx eax, byte [rbx + 9]
mov r8, rbx
movzx ecx, byte [rbx + 0xd]
mov r9d, 4
mov byte [rbx + 0xd], al
movzx eax, byte [rbx + 5]
mov byte [rbx + 9], al
movzx eax, byte [rbx + 1]
mov byte [rbx + 5], al
movzx eax, byte [rbx + 0xa]
mov byte [rbx + 1], cl
movzx ecx, byte [rbx + 2]
mov byte [rbx + 2], al
movzx eax, byte [rbx + 0xe]
mov byte [rbx + 0xa], cl
movzx ecx, byte [rbx + 6]
mov byte [rbx + 6], al
movzx eax, byte [rbx + 7]
mov byte [rbx + 0xe], cl
movzx ecx, byte [rbx + 3]
mov byte [rbx + 3], al
movzx eax, byte [rbx + 0xb]
mov byte [rbx + 7], al
movzx eax, byte [rbx + 0xf]
mov byte [rbx + 0xb], al
mov byte [rbx + 0xf], cl
nop dword [rax]
mov rcx, r8
mov edx, 4
nop dword [rax + rax]
movzx eax, byte [rcx]
lea rcx, [rcx + 4]
movzx eax, byte [rax + r14]
mov byte [rcx - 4], al
sub rdx, 1
jne 0x180001220
inc r8
sub r9, 1
jne 0x180001210
mov rax, rbx
lea r8d, [rdx + 4]
nop word [rax + rax]
mov edx, 4
nop word [rax + rax]
movzx ecx, byte [rdi + rax]
xor byte [rax], cl
inc rax
sub rdx, 1
jne 0x180001260
sub r8, 1
jne 0x180001250
mov rcx, rbx
call fcn.180001360
sub rdi, 0x10
add bpl, 0xff
jne 0x1800011b0
movzx eax, byte [rbx + 9]
mov r8, rbx
movzx ecx, byte [rbx + 0xd]
mov r9d, 4
mov byte [rbx + 0xd], al
movzx eax, byte [rbx + 5]
mov byte [rbx + 9], al
movzx eax, byte [rbx + 1]
mov byte [rbx + 5], al
movzx eax, byte [rbx + 0xa]
mov byte [rbx + 1], cl
movzx ecx, byte [rbx + 2]
mov byte [rbx + 2], al
movzx eax, byte [rbx + 0xe]
mov byte [rbx + 0xa], cl
movzx ecx, byte [rbx + 6]
mov byte [rbx + 6], al
movzx eax, byte [rbx + 7]
mov byte [rbx + 0xe], cl
movzx ecx, byte [rbx + 3]
mov byte [rbx + 3], al
movzx eax, byte [rbx + 0xb]
mov byte [rbx + 7], al
movzx eax, byte [rbx + 0xf]
mov byte [rbx + 0xb], al
mov byte [rbx + 0xf], cl
nop dword [rax + rax]
mov rcx, r8
mov edx, 4
nop dword [rax + rax]
movzx eax, byte [rcx]
lea rcx, [rcx + 4]
movzx eax, byte [rax + r14]
mov byte [rcx - 4], al
sub rdx, 1
jne 0x180001300
inc r8
sub r9, 1
jne 0x1800012f0
lea edx, [r9 + 4]
mov ecx, 4
nop word [rax + rax]
movzx eax, byte [rbx + rsi]
xor byte [rbx], al
inc rbx
sub rcx, 1
jne 0x180001330
sub rdx, 1
jne 0x180001322
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x180001360
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
lea rbp, [rcx + 2]
mov qword [rsp + 0x20], 4
mov qword [rsp + 0x18], rbp
nop word [rax + rax]
movzx r9d, byte [rbp - 1]
movzx edx, byte [rbp - 2]
movzx ebx, r9b
movzx r8d, byte [rbp]
movzx eax, dl
shr al, 7
add bl, bl
movzx ecx, byte [rbp + 1]
movzx eax, al
imul eax, eax, 0x1b
mov byte [rsp + 0x78], r9b
mov byte [rsp + 0x88], dl
add dl, dl
mov byte [rsp + 0x80], r8b
xor dl, al
mov dword [rsp + 8], eax
movzx eax, dl
movzx esi, dl
shr al, 7
add sil, sil
movzx eax, al
imul eax, eax, 0x1b
xor sil, al
mov dword [rsp + 4], eax
movzx eax, r9b
movzx r9d, r8b
shr al, 7
add r9b, r9b
movzx eax, al
imul r15d, eax, 0x1b
xor bl, r15b
movzx eax, bl
movzx r10d, bl
shr al, 7
add r10b, r10b
movzx eax, al
imul eax, eax, 0x1b
xor r10b, al
mov dword [rsp + 0x10], eax
movzx eax, r8b
shr al, 7
movzx eax, al
imul r12d, eax, 0x1b
xor r9b, r12b
mov dword [rsp + 0xc], r12d
movzx eax, r9b
movzx r8d, r9b
shr al, 7
xor r9b, dl
movzx eax, al
add r8b, r8b
imul ebp, eax, 0x1b
movzx eax, cl
shr al, 7
add cl, cl
movzx eax, al
imul eax, eax, 0x1b
xor r8b, bpl
xor cl, al
mov dword [rsp + 0x14], eax
movzx eax, cl
movzx r13d, cl
shr al, 7
add r13b, r13b
movzx eax, al
imul r14d, eax, 0x1b
xor r13b, r14b
xor r9b, r13b
movzx eax, r13b
shr al, 7
xor r9b, r8b
movzx eax, al
xor r9b, r10b
imul edi, eax, 0x1b
xor r9b, sil
movzx eax, r8b
mov byte [rsp], r9b
shr al, 7
movzx eax, al
imul r11d, eax, 0x1b
movzx eax, r10b
shr al, 7
xor r13b, cl
movzx eax, al
xor r13b, r8b
imul r9d, eax, 0x1b
xor r13b, r10b
mov r12, qword [rsp + 0x18]
xor r13b, bl
movzx ebx, byte [rsp + 0x80]
xor r13b, sil
mov rcx, qword [rsp + 0x18]
movzx eax, sil
shr al, 7
movzx esi, byte [rsp + 0x78]
mov r8d, dword [rsp + 0x10]
movzx r10d, byte [rcx + 1]
movzx eax, al
imul edx, eax, 0x1b
movzx eax, byte [rsp]
xor al, byte [rsp + 0x78]
xor al, byte [rsp + 0x88]
add al, al
xor al, dl
xor al, r9b
xor al, r11b
xor al, dil
xor al, bpl
xor al, r15b
xor al, byte [rsp + 4]
xor al, byte [rsp + 8]
xor al, byte [r12 + 1]
xor al, byte [rsp + 0x80]
xor al, byte [rsp + 0x78]
mov byte [r12 - 2], al
movzx eax, r13b
mov r12d, dword [rsp + 0xc]
xor al, bl
xor al, sil
xor r13b, r10b
add al, al
xor al, dl
xor al, r9b
xor al, r11b
xor al, dil
xor al, r14b
xor al, r12b
xor al, r8b
xor al, r15b
movzx r15d, byte [rsp + 0x88]
xor r13b, r15b
xor al, r10b
add r13b, r13b
xor al, bl
xor r13b, dl
xor al, r15b
mov byte [rcx - 1], al
xor r13b, r9b
mov eax, dword [rsp + 0x14]
xor r13b, r11b
movzx ecx, byte [rsp]
xor r13b, dil
xor cl, r10b
xor r13b, r14b
xor cl, bl
xor r13b, al
add cl, cl
xor r13b, r8b
xor cl, dl
xor cl, r9b
xor cl, r11b
xor cl, dil
xor cl, al
xor cl, bpl
mov rbp, qword [rsp + 0x18]
xor cl, r12b
xor cl, byte [rsp + 4]
xor cl, r10b
xor cl, sil
xor cl, r15b
xor r13b, byte [rsp + 8]
mov byte [rbp], cl
xor r13b, bl
xor r13b, sil
xor r13b, r15b
mov byte [rbp + 1], r13b
add rbp, 4
sub qword [rsp + 0x20], 1
mov qword [rsp + 0x18], rbp
jne 0x180001390
mov rbx, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x180001a80
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
lea rdx, [0x180001a20]
lea rcx, [0x18000d51b]
call qword [sym.imp.ADVAPI32.dll_RegisterServiceCtrlHandlerA]
mov qword [0x180017c38], rax
test rax, rax
je 0x180001bdd
mov qword [rsp + 0x30], rbx
lea rdx, [0x180017c18]
xor ebx, ebx
mov dword [0x180017c18], 0x20
mov rcx, rax
mov qword [0x180017c2c], rbx
mov qword [0x180017c24], rbx
mov dword [0x180017c20], 1
mov dword [0x180017c1c], 2
call qword [sym.imp.ADVAPI32.dll_SetServiceStatus]
xor r9d, r9d
lea edx, [rbx + 1]
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [section..data], rax
test rax, rax
jne 0x180001b2e
mov qword [0x180017c1c], 1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x180017c24], eax
mov dword [0x180017c2c], 1
jmp 0x180001bba
mov rcx, qword [0x180017c38]
lea rdx, [0x180017c18]
mov dword [0x180017c20], 1
mov dword [0x180017c1c], 4
mov dword [0x180017c24], ebx
mov dword [0x180017c2c], ebx
call qword [sym.imp.ADVAPI32.dll_SetServiceStatus]
xor r9d, r9d
mov qword [rsp + 0x28], rbx
lea r8, [0x180001bf0]
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x180001b92
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [section..data]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x180017c1c], 1
mov dword [0x180017c24], ebx
mov dword [0x180017c2c], 3
mov rcx, qword [0x180017c38]
lea rdx, [0x180017c18]
mov rbx, qword [rsp + 0x30]
add rsp, 0x38
jmp qword [sym.imp.ADVAPI32.dll_SetServiceStatus]
add rsp, 0x38
ret

Function at 0x1800020f0
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
Function at 0x1400499a0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x1400499ad
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x1400499bd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x1400499a5
lea eax, [rcx + 1]
jmp 0x1400499cb
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x1400499de
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x1400499c4
sub eax, 3
jb 0x1400499fe
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x140049a4d
sar eax, 1
movsxd rbp, eax
jb 0x140049a34
jmp 0x140049a0c
add ebx, ebx
jne 0x140049a0a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140049a34
inc ecx
add ebx, ebx
jne 0x140049a1a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140049a34
call r11
adc ecx, ecx
add ebx, ebx
jne 0x140049a2d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x140049a1c
add ecx, 2
jmp 0x140049a39
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.140049962
jmp 0x1400499ad
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x2a800
mov dl, 0xe
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x140049a99
cmp rsi, rcx
jae 0x140049aa1
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x140049a80
cmp al, 0x8f
ja 0x140049a80
cmp byte [rsi - 2], 0xf
je 0x140049a86
sub al, 0xe8
cmp al, 1
ja 0x140049a6a
cmp rsi, rcx
jae 0x140049aa1
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x140049a70
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x140049aa1
lodsb al, byte [rsi]
jmp 0x140049a80
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x47000]
mov eax, dword [rdi]
or eax, eax
je 0x140049afe
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x491dc]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x140049aae
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x140049af8
mov qword [rbx], rax
add rbx, 8
jmp 0x140049ace
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x140049b38
cmp al, 0xef
ja 0x140049b2a
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x140049b0a
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x140049b19
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x237]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x140049b8c
sub rsp, 0xffffffffffffff80
jmp 0x140008100
Function at 0x1409ad5d8
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1409ad75f
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1409ad609
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1409ad5ef
add dl, dl
jne 0x1409ad616
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1409ad676
xor eax, eax
add dl, dl
jne 0x1409ad625
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1409ad72d
add dl, dl
jne 0x1409ad636
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1409ad643
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1409ad650
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1409ad65d
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1409ad66a
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1409ad5fe
mov eax, 1
add dl, dl
jne 0x1409ad686
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1409ad693
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1409ad67b
sub eax, ebx
mov ebx, 1
jne 0x1409ad6cc
mov ecx, 1
add dl, dl
jne 0x1409ad6ae
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1409ad6bb
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1409ad6a3
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1409ad5fe
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1409ad6e8
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1409ad6f5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1409ad6dd
cmp eax, 0x7d00
jae 0x1409ad71b
cmp eax, 0x500
jb 0x1409ad716
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1409ad5fe
cmp eax, 0x7f
ja 0x1409ad71e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1409ad5fe
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1409ad752
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1409ad5fe
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x180001000
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
sub rsp, 0xa8
mov eax, dword [rsp + 0xb0]
add eax, 0x14
mov dword [rsp + 0x5c], eax
mov eax, dword [rsp + 0xd0]
sub eax, 0x1b16
mov dword [rsp + 0x6c], eax
mov eax, dword [rsp + 0xb8]
sub eax, 0x19a5
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0xb8]
add eax, 0x1d1
mov dword [rsp + 0x70], eax
mov eax, dword [rsp + 0xc0]
sub eax, 0x28d2
mov dword [rsp + 0x68], eax
mov eax, dword [rsp + 0xe0]
xor eax, 0x21d2
mov dword [rsp + 0x58], eax
mov eax, dword [rsp + 0xc0]
sub eax, 0xf21
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0xe0]
xor eax, 0x3863
mov dword [rsp + 0x94], eax
mov eax, dword [rsp + 0xe0]
add eax, 0xb41
mov dword [rsp + 0x64], eax
mov eax, dword [rsp + 0x50]
add eax, 0x2ae
cmp dword [rsp + 0x70], eax
jg 0x1800010ec
mov rax, qword [rsp + 0xc8]
mov eax, dword [rax + 0xec]
add eax, 0xe8366
mov rcx, qword [rsp + 0xc8]
mov dword [rcx + 0xec], eax
mov eax, dword [rsp + 0x50]
add eax, 0x165
mov dword [rsp + 0x50], eax
jmp 0x18000127f
mov rax, qword [rsp + 0xc8]
mov eax, dword [rax + 0x44]
mov dword [rsp + 0x54], eax
jmp 0x180001108
mov eax, dword [rsp + 0x54]
add eax, 3
mov dword [rsp + 0x54], eax
mov eax, 4
imul rax, rax, 0
mov rcx, qword [rsp + 0xc8]
mov eax, dword [rcx + rax + 0x3c]
xor eax, 0x2d13
imul eax, dword [rsp + 0x60]
cmp dword [rsp + 0x54], eax
jbe 0x18000127f
imul eax, dword [rsp + 0x6c], 0x2ddb
imul eax, dword [rsp + 0x5c]
mov dword [rsp + 0x90], eax
mov eax, dword [rsp + 0x5c]
add eax, 0x192e
mov ecx, 4
imul rcx, rcx, 0
mov rdx, qword [rsp + 0xc8]
or eax, dword [rdx + rcx + 8]
mov dword [rsp + 0x8c], eax
mov eax, dword [rsp + 0x64]
sub eax, 0x2d13
imul eax, eax, 0x1f55
mov dword [rsp + 0x88], eax
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0x98], rax
mov eax, dword [rsp + 0x58]
mov ecx, dword [rsp + 0x68]
or ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xc8]
sub eax, dword [rcx + 0xec]
mov dword [rsp + 0x84], eax
mov eax, dword [rsp + 0x58]
mov ecx, dword [rsp + 0x58]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x80], eax
mov rax, qword [rsp + 0xc8]
mov eax, dword [rax + 0xc0]
sub eax, 0x21d2
mov ecx, 4
imul rcx, rcx, 3
mov rdx, qword [rsp + 0xc8]
imul eax, dword [rdx + rcx + 8]
mov dword [rsp + 0x7c], eax
mov eax, dword [rsp + 0x60]
and eax, 0x297d
and eax, dword [rsp + 0x64]
mov dword [rsp + 0x78], eax
mov eax, 4
imul rax, rax, 1
mov rcx, qword [rsp + 0xc8]
mov edx, dword [rsp + 0x5c]
mov eax, dword [rcx + rax + 0x3c]
xor eax, edx
add eax, dword [rsp + 0x50]
mov dword [rsp + 0x74], eax
mov eax, dword [rsp + 0x74]
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x7c]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x80]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x84]
mov dword [rsp + 0x20], eax
mov r9, qword [rsp + 0x98]
mov r8d, dword [rsp + 0x88]
mov edx, dword [rsp + 0x8c]
mov ecx, dword [rsp + 0x90]
call fcn.180021240
mov dword [rsp + 0x68], eax
jmp 0x1800010fd
mov eax, dword [rsp + 0x6c]
xor eax, 0x2ddb
add rsp, 0xa8
ret