joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1404d3818
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
cmp r10b, r12b
mov qword [rax + 0x10], rbp
jmp 0x1404d3832
mov qword [rax + 0x18], rsi
stc
test dl, 0x7a
mov qword [rax + 0x20], rdi
cmc
push r14
cmp rsp, rsp
cmp r13b, 0x6f
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
sub r14d, r14d
jmp 0x1404d3860
mov rbx, rax
test rax, rax
jmp 0x1404d386b
je 0x1404d39e3
mov rsi, rax
cmp ax, r15w
cmp word [rax], r14w
jmp 0x1404d3881
je 0x1404d38c1
or rax, 0xffffffffffffffff
jmp 0x1404d3890
inc rax
jmp 0x1404d389c
cmp word [rsi + rax*2], r14w
jmp 0x1404d38a6
jne 0x1404d3890
lea rsi, [rsi + rax*2]
add rsi, 2
cmp spl, bl
cmp word [rsi], r14w
jne 0x1404d3887
mov qword [rsp + 0x38], r14
mov r8, 0x5c677289
sub rsi, rbx
bt r9w, r11w
sar r9w, 0xaf
mov qword [rsp + 0x30], r14
add rsi, 2
sar rsi, 1
movzx r8, r9w
rcr r9b, 0x45
and r8b, cl
mov r8, rbx
and r9, rax
add r9w, bp
mov r9d, esi
cmp r14b, 0x5f
clc
stc
mov dword [rsp + 0x28], r14d
test r14b, r14b
jmp 0x1404d3911
xor edx, edx
cmp r13b, sil
cmc
mov qword [rsp + 0x20], r14
cmc
cmp r11b, 0x89
xor ecx, ecx
jmp 0x1404d3928
call fcn.1404c3e30
movsxd rbp, eax
jmp 0x1404d3935
test eax, eax
jmp 0x1404d393c
je 0x1404d39e3
mov rcx, rbp
call fcn.1404c3d68
mov rdi, rax
test rax, rax
jmp 0x1404d3955
je 0x1404d39c8
mov qword [rsp + 0x38], r14
mov r9d, esi
setb r8b
cmp bl, r13b
mov qword [rsp + 0x30], r14
jmp 0x1404d3979
mov r8, rbx
cmc
cmp r8d, 0x4b0d0847
mov dword [rsp + 0x28], ebp
cmp bpl, r12b
cmc
stc
xor edx, edx
cmp r14b, 0x37
xor ecx, ecx
jmp 0x1404d399a
mov qword [rsp + 0x20], rax
call fcn.1404c3e30
test eax, eax
je 0x1404d39c8
mov rsi, rdi
jmp 0x1404d39bb
mov rdi, r14
jmp 0x1404d39c3
jmp 0x1404d39d1
mov rsi, r14
cmovg ecx, ebp
bswap cx
mov rcx, rdi
jmp 0x1404d39d9
call fcn.1404c3cef
jmp 0x1404d39ec
mov rsi, r14
test r8w, 0x253c
test rbx, rbx
jmp 0x1404d39f4
je 0x1404d3a03
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rbx, qword [rsp + 0x50]
cmc
bts ax, r13w
rcr r14b, 0xc1
mov rax, rsi
cmp bx, bp
not r14w
mov rsi, qword [rsp + 0x60]
add r14w, bx
xchg r14b, bpl
mov rbp, qword [rsp + 0x58]
movzx rdi, dx
mov rdi, qword [rsp + 0x68]
test r14b, 0x85
adc r14, 0x538f7400
add rsp, 0x40
setl r14b
not r14w
pop r14
jmp 0x1404d3a54
ret
Function at 0x1404d3a55
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
jmp 0x1404d3a6f
mov qword [rsp + 0x10], rbp
cmp ax, 0x422e
mov qword [rsp + 0x18], rsi
clc
push rdi
cmc
stc
sub rsp, 0x20
jmp 0x1404d3a8a
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
sub esi, esi
cmovae bx, sp
mov rbx, rax
cmc
test rax, rax
je 0x1404d3b63
mov rbp, rax
stc
test r8b, 0x39
cmp word [rax], si
je 0x1404d3ae6
or rax, 0xffffffffffffffff
inc rax
test r13b, bpl
cmp word [rbp + rax*2], si
jmp 0x1404d3ac8
jne 0x1404d3ab8
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jmp 0x1404d3ae0
jne 0x1404d3ab4
sub rbp, rbx
shl cl, 0x72
bt cx, di
sub ch, 0xce
add rbp, 2
and rcx, r13
adc ch, 0x2c
movzx rcx, bx
sar rbp, 1
btc cx, r14w
add rbp, rbp
mov rcx, rbp
jmp 0x1404d3b14
call fcn.1404c3d68
mov rdi, rax
test rax, rax
jmp 0x1404d3b24
je 0x1404d3b49
mov r8, rbp
cwd
not dx
mov rdx, rbx
movsxd rcx, r11d
mov rcx, rax
call fcn.14049decb
mov rsi, rdi
jmp 0x1404d3b49
sub ecx, ecx
jmp 0x1404d3b50
call fcn.1404c3cef
mov rcx, rbx
jmp 0x1404d3b5d
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rbx, qword [rsp + 0x30]
mov rax, rsi
not dil
rcl edi, cl
mov rsi, qword [rsp + 0x40]
shr dil, 0xd6
mov rbp, qword [rsp + 0x38]
cmc
setle dil
neg edi
add rsp, 0x20
pop rdi
jmp 0x1404d3b8f
ret
Function at 0x1404d6ae5
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
movsx rax, ax
mov qword [rsp + 0x18], rbp
cmovge eax, r11d
movsxd rax, r8d
push rsi
push rdi
movzx eax, r13w
not rax
cwde
push r14
mov al, 0xb9
cbw
mov eax, 0x1450
call fcn.140443149
sub rsp, rax
sub dil, dl
bts r10w, ax
mov rax, qword [0x1400b7288]
sub r10b, r15b
shr dil, cl
cmovbe r10w, ax
xor rax, rsp
bts r10, r15
rcl bpl, 0xce
mov qword [rsp + 0x1440], rax
movsxd r10, edx
setbe dil
cbw
bsr rdx, rcx
mov rdi, rcx
mov rax, r10
adc sil, dil
and r14b, r13b
mov cx, ax
mov ebp, r9d
bsf cx, r8w
or r14d, 0x51d731f6
setle cl
sar rax, 6
sub sil, dil
lea rcx, [0x1400ba940]
bts r14, r14
shrd r14d, edx, 0x43
and r10d, 0x3f
shl si, cl
lea rbp, [rbp + r8]
mov rsi, r8
bsr dx, ax
or dl, 0xca
mov rax, qword [rcx + rax*8]
lea rdx, [r10 + r10*8]
mov r14, qword [rax + rdx*8 + 0x28]
xor eax, eax
cmp sil, dil
clc
jmp 0x1404d6bb7
mov qword [rdi], rax
test dh, 0x46
mov dword [rdi + 8], eax
jmp 0x1404d6bc7
cmp r8, rbp
jae 0x1404d6cd5
lea rbx, [rsp + 0x40]
cmp r13, 0x3d0a3487
cmp rsi, rbp
jmp 0x1404d6be4
jae 0x1404d6c40
mov al, byte [rsi]
jmp 0x1404d6bf1
inc rsi
cmp al, 0xa
jmp 0x1404d6bfb
jne 0x1404d6c14
inc dword [rdi + 8]
jmp 0x1404d6c09
mov byte [rbx], 0xd
inc rbx
jmp 0x1404d6c14
mov byte [rbx], al
inc rbx
bts ax, si
cbw
lea rax, [rsp + 0x143f]
test r10d, 0x2d842804
test si, di
clc
cmp rbx, rax
jmp 0x1404d6c3a
jb 0x1404d6bdc
and qword [rsp + 0x20], 0
shr r8d, 0xef
xadd r9w, dx
seta al
lea rax, [rsp + 0x40]
sal r8w, 0xd4
mov r9b, 0x19
bts r9w, bp
sub ebx, eax
lea r9, [rsp + 0x30]
mov r8d, ebx
mov cx, 0x64d7
not dx
movsx rdx, r14w
lea rdx, [rsp + 0x40]
mov rcx, r14
jmp 0x1404d6c86
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jmp 0x1404d6c93
je 0x1404d6cc9
mov eax, dword [rsp + 0x30]
jmp 0x1404d6ca5
add dword [rdi + 4], eax
cmc
cmp eax, ebx
jmp 0x1404d6cb0
jb 0x1404d6cd5
cmp rsi, rbp
jmp 0x1404d6cbe
jb 0x1404d6bd0
jmp 0x1404d6cd5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
btc eax, 0x99
mov rax, rdi
shl cx, cl
mov rcx, qword [rsp + 0x1440]
cmp r11b, 0x82
xor rcx, rsp
call fcn.14049a18d
lea r11, [rsp + 0x1450]
movsx si, r15b
movzx r14w, r13b
movzx esi, r12w
mov rbx, qword [r11 + 0x20]
movzx ebp, r13w
bswap r14d
mov rbp, qword [r11 + 0x30]
movsx di, r12b
mov edi, 0x3b5207b2
movzx esi, r13w
mov rsp, r11
movzx edi, dx
mov si, sp
pop r14
pop rdi
mov esi, edi
pop rsi
jmp 0x1404d6d36
ret
Function at 0x1404d6d37
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
movzx rax, ax
movzx eax, cx
lahf
mov qword [rsp + 0x18], rbp
jmp 0x1404d6d6b
push rsi
jmp 0x1404d6d73
push rdi
cmovae ax, cx
movzx ax, r15b
cbw
push r14
seta al
movsx rax, cx
xchg ah, ah
mov eax, 0x1450
jmp 0x1404d6d94
call fcn.140443149
sub rsp, rax
sar r14b, cl
shrd r10w, si, 0xbb
mov edi, r12d
mov rax, qword [0x1400b7288]
test cx, 0x9fd
and bpl, 0x7e
btc rbp, rcx
xor rax, rsp
mov qword [rsp + 0x1440], rax
movsxd r10, edx
mov rdi, rcx
test bl, bl
mov rax, r10
mov ebp, r9d
shrd rdx, r11, 0x39
not dl
sal edx, 0x75
sar rax, 6
not cl
btc rsi, rdx
shr ch, cl
lea rcx, [0x1400ba940]
and r10d, 0x3f
sal esi, 0xf5
stc
bswap rdx
add rbp, r8
rol dl, 0x27
mov si, r13w
shr si, 0x9d
mov rsi, r8
cwd
mov rax, qword [rcx + rax*8]
lea rdx, [r10 + r10*8]
not r14b
mov r14, qword [rax + rdx*8 + 0x28]
test bp, r15w
sub eax, eax
jmp 0x1404d6e2b
mov qword [rdi], rax
mov dword [rdi + 8], eax
clc
cmp r8, rbp
jmp 0x1404d6e3a
jae 0x1404d6f43
lea rbx, [rsp + 0x40]
cmp rsi, rbp
jmp 0x1404d6e4d
jae 0x1404d6eb6
movzx eax, word [rsi]
cmp spl, r9b
add rsi, 2
cmp bpl, r9b
test r12w, dx
cmc
cmp ax, 0xa
jmp 0x1404d6e6e
jne 0x1404d6e92
add dword [rdi + 8], 2
stc
shrd ecx, r8d, 0x66
mov ecx, 0xd
clc
mov word [rbx], cx
test r10, 0x45aa062a
add rbx, 2
mov word [rbx], ax
movzx eax, dx
movsxd rax, r10d
add rbx, 2
lea rax, [rsp + 0x143e]
clc
cmp rbx, rax
jmp 0x1404d6eb0
jb 0x1404d6e45
and qword [rsp + 0x20], 0
lahf
lea rax, [rsp + 0x40]
and r8d, 0x197a78e1
neg r8w
sub rbx, rax
shl r8w, cl
rcr r8w, cl
lea r9, [rsp + 0x30]
jmp 0x1404d6ee8
sar rbx, 1
lea rdx, [rsp + 0x40]
rcl cx, 0xd6
add ebx, ebx
mov rcx, r14
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jmp 0x1404d6f09
je 0x1404d6f3b
mov eax, dword [rsp + 0x30]
stc
cmc
add dword [rdi + 4], eax
stc
test ebx, edx
cmp eax, ebx
jmp 0x1404d6f22
jb 0x1404d6f43
cmp rsi, rbp
jmp 0x1404d6f30
jb 0x1404d6e40
jmp 0x1404d6f43
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
mov rax, rdi
cmc
sub ch, 0xcf
shld cx, r10w, 0xe1
mov rcx, qword [rsp + 0x1440]
test r11w, bx
test r13, 0x6951102f
xor rcx, rsp
jmp 0x1404d6f6b
call fcn.14049a18d
lea r11, [rsp + 0x1450]
setno bh
movzx di, r8b
mov rbx, qword [r11 + 0x20]
jmp 0x1404d6f90
mov rbp, qword [r11 + 0x30]
movsx esi, bp
mov r14b, r9b
mov edi, 0x1a7d192c
mov rsp, r11
pop r14
not rsi
movzx rdi, dx
pop rdi
movzx si, r12b
mov esi, edi
pop rsi
ret
Function at 0x1404d6fb5
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
movsxd rax, edx
mov qword [rsp + 0x18], rbp
cbw
push rsi
push rdi
push r12
push r14
not al
push r15
not ax
sets al
mov eax, 0x1470
jmp 0x1404d6fe6
call fcn.140443149
sub rsp, rax
shrd r10, r14, 0x98
cmp r11w, 0x23c8
mov rax, qword [0x1400b7288]
bt r14d, r13d
shr di, 0xe
xor rax, rsp
shld r10, rdx, 0x21
mov qword [rsp + 0x1460], rax
movsxd r10, edx
mov rbx, rcx
bsf rdi, rdx
mov rax, r10
mov r14d, r9d
shl r12, 0x64
bt r12d, 0x99
sar rax, 6
xadd rdi, r15
mov cx, 0x7566
lea rcx, [0x1400ba940]
and r10d, 0x3f
btr edx, r13d
adc r15, 0x533850be
lea r14, [r14 + r8]
movzx edi, bp
mov r15, r8
movzx r12w, dl
mov rdi, r8
shld r12d, r13d, 0xaa
mov rax, qword [rcx + rax*8]
shl rdx, 0xf6
add r12b, 0x16
xor dl, spl
lea rdx, [r10 + r10*8]
cmovbe r12d, r15d
and r12w, 0x6755
xor r12b, 0x46
mov r12, qword [rax + rdx*8 + 0x28]
cmc
test r12, r11
sub eax, eax
cmc
mov qword [rbx], rax
cmp r8, r14
jmp 0x1404d70a2
mov dword [rbx + 8], eax
jae 0x1404d726f
lea rax, [rsp + 0x50]
cmc
cmp rdi, r14
jmp 0x1404d70b9
jae 0x1404d7121
movzx ecx, word [rdi]
cmp r9b, cl
jmp 0x1404d70ca
add rdi, 2
stc
test r15, 0x57ea1285
cmp cx, 0xa
jmp 0x1404d70df
jne 0x1404d70fd
mov edx, 0xd
test r8d, esp
cmp esi, r15d
mov word [rax], dx
add rax, 2
cmp r11w, 0x51d
mov word [rax], cx
add rax, 2
shld cx, ax, 0x93
dec ecx
lea rcx, [rsp + 0x6f8]
cmp rax, rcx
jmp 0x1404d711b
jb 0x1404d70b1
and qword [rsp + 0x38], 0
xor r8w, 0x2212
lea rcx, [rsp + 0x50]
sub r8d, edx
ror r9b, 0xe2
and qword [rsp + 0x30], 0
btc r8w, 0xd1
btr r9, rbp
sar r8w, cl
lea r8, [rsp + 0x50]
btr r9w, 0xa3
movsx r9w, spl
sub rax, rcx
ror r9, cl
btr r9, 0x33
bsr r9w, cx
mov dword [rsp + 0x28], 0xd55
lea rcx, [rsp + 0x700]
setbe r9b
sar rax, 1
neg r9b
shl r9d, 0x85
rcr r9b, 0xb8
mov qword [rsp + 0x20], rcx
xor r9w, 0x5b6f
mov r9d, eax
not rcx
sar ch, 0x60
mov ch, 0xfc
mov ecx, 0xfde9
xor edx, edx
jmp 0x1404d71b2
call fcn.1404c3e30
mov ebp, eax
test eax, eax
je 0x1404d7263
sub esi, esi
test eax, eax
jmp 0x1404d71ca
je 0x1404d7242
and qword [rsp + 0x20], 0
xchg rdx, rcx
lea rdx, [rsp + 0x700]
test al, r8b
rol r9b, 0x87
clc
mov ecx, esi
btc r9w, r14w
movsx r9, dx
lea r9, [rsp + 0x40]
mov r8d, ebp
lea rdx, [rdx + rcx]
rcl cl, 0xc2
sal ecx, cl
setne ch
mov rcx, r12
jmp 0x1404d7211
sub r8d, esi
jmp 0x1404d7219
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jmp 0x1404d7226
je 0x1404d7263
add esi, dword [rsp + 0x40]
clc
cmp r10w, r13w
cmp esi, ebp
jmp 0x1404d723c
jb 0x1404d71d0
mov eax, edi
test al, r12b
cmp edx, r11d
sub eax, r15d
mov dword [rbx + 4], eax
cmp al, r15b
test r10b, r14b
cmp rdi, r14
jmp 0x1404d725e
jmp 0x1404d70a5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx], eax
sal ax, 0x1a
mov rax, rbx
adc ch, 0xda
mov rcx, qword [rsp + 0x1460]
stc
test r9, 0x31b721c4
xor rcx, rsp
call fcn.14049a18d
lea r11, [rsp + 0x1470]
mov r12, rbx
mov rbx, qword [r11 + 0x30]
movzx r15w, r11b
mov sil, r8b
mov rbp, qword [r11 + 0x40]
movsx rdi, r13w
mov r15b, r15b
mov rsp, r11
mov r15w, 0x6421
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x1404da766
Capabilities:
Allocate thread local storage

Disassembly:
push rbx
bt r9d, ecx
sub rsp, 0x20
btc r8d, r14d
mov rbx, rcx
sbb dx, 0x1375
lea r9, [0x1400c8e90]
test r13b, 0x9f
btc dx, r9w
sub ecx, ecx
cdq
lea r8, [0x1400c8e88]
cdq
movsx rdx, di
lea rdx, [0x1400cfb70]
call fcn.1404daa6a
test rax, rax
jmp 0x1404da7af
je 0x1404da7d3
mov rcx, rbx
bt bx, 0xb1
add bx, 0x42bf
add rsp, 0x20
pop rbx
jmp 0x1404da7cc
push qword [0x1400b8d90]
ret
add rsp, 0x20
not bx
xchg ebx, ebx
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TlsAlloc]

Function at 0x1404da871
Capabilities:
Get thread local storage value

Disassembly:
push rbx
not bx
sub rsp, 0x20
cmovb bx, dx
movsx r8, bp
mov ebx, ecx
lea r9, [0x1400c8ea0]
setb cl
cwd
mov ecx, 2
mov edx, 0x5286373e
lea r8, [0x1400c8e98]
movsxd rdx, ebx
lea rdx, [0x1400cf758]
jmp 0x1404da8b0
call fcn.1404daa6a
mov ecx, ebx
test sil, sil
test rax, rax
jmp 0x1404da8c2
je 0x1404da8e4
add rsp, 0x20
xchg rbx, rbx
movzx ebx, r15w
movsx ebx, r9w
pop rbx
jmp 0x1404da8dd
push qword [0x1400b8d90]
ret
add rsp, 0x20
movsxd rbx, r10d
bswap bx
movzx ebx, r13w
pop rbx
jmp 0x1404da8f8
jmp qword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1404da8ff
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
bsf ebx, esi
cmp r8b, cl
ror bl, cl
push rdi
btr r9w, r15w
sub rsp, 0x20
movsx edi, r12w
mov rbx, rdx
jmp 0x1404da928
lea r9, [0x1400c8ea8]
movzx r8d, di
mov edi, ecx
jmp 0x1404da93f
lea rdx, [0x1400cf748]
bswap cx
mov cx, 0x5f76
jmp 0x1404da952
mov ecx, 3
lea r8, [0x1400c8ea0]
call fcn.1404daa6a
mov rdx, rbx
mov ecx, edi
test rax, rax
je 0x1404da97c
call qword [case.0x1404430d4.0]
jmp 0x1404da982
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
btc di, r10w
clc
not edi
add rsp, 0x20
movsx di, r10b
not di
pop rdi
jmp 0x1404da9a1
ret
Function at 0x1404de9a9
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
bt r10d, r9d
mov r10b, r14b
rol r10b, cl
sub rsp, 0x30
sub eax, eax
rcl r10b, 0x80
rcr r10w, 9
mov r10d, ecx
test bpl, 0xd7
test rdx, rdx
jmp 0x1404de9d3
jne 0x1404dea04
call fcn.1404afe81
mov ebx, 0x16
jmp 0x1404de9e8
mov dword [rax], ebx
jmp 0x1404de9ef
call fcn.1404b0b68
mov eax, ebx
mov bl, r14b
add rsp, 0x30
pop rbx
jmp 0x1404dea03
ret
test r8, r8
je 0x1404de9d9
movzx ecx, byte [rsp + 0x60]
jmp 0x1404dea17
mov word [rdx], ax
rcl al, cl
lea rax, [rcx + 1]
clc
cmp bpl, 0x98
cmp r8, rax
jmp 0x1404dea2d
ja 0x1404dea47
call fcn.1404afe81
mov ebx, 0x22
jmp 0x1404dea42
jmp 0x1404de9e8
lea eax, [r9 - 2]
test r14w, 0x4f2d
bsf bx, r15w
movsx rbx, si
mov ebx, 0x22
cmp dx, 0x72a7
test r9w, 0x7b67
cmp eax, ebx
jmp 0x1404dea71
ja 0x1404de9d9
mov byte [rsp + 0x60], cl
movsx ebx, di
bswap rbx
movzx bx, r8b
mov ecx, r10d
add rsp, 0x30
mov bh, 0xc8
movzx ebx, r14w
not rbx
pop rbx
jmp 0x1404dea9d
mov qword [rsp + 8], rbx
movsx r11, bp
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
setle bh
push r14
push r15
sub rsp, 0x20
bswap di
bts ebp, ecx
xor r15d, r15d
xor dil, r15b
mov ebp, r9d
cmp r9w, 0x640c
sar r10b, 0x45
mov rdi, r8
mov r11, rdx
mov r10, rdx
rcr bl, cl
mov bx, r10w
mov ebx, r15d
test bl, r9b
cmp byte [rsp + 0x60], r15b
jmp 0x1404deaf4
je 0x1404deb14
lea eax, [r15 + 0x2d]
or r8b, dil
neg ecx
mov word [rdx], ax
xchg si, r8w
movzx esi, dx
lea ebx, [rax - 0x2c]
lea r10, [rdx + 2]
mov r8, r10
sar ah, 0xd0
sub edx, edx
ror r14b, cl
lea rsi, [r10 + 2]
add al, spl
mov r9, 0x21a327d9
mov eax, ecx
mov r9, r10
bt r14w, 9
div ebp
movzx r14, ax
bts r14w, r10w
mov ecx, eax
not r14d
sbb ah, 0xb8
cmp edx, 9
movzx ax, r10b
mov eax, 0x57
cmovl r14d, eax
movsx r14, dx
movzx r14d, r9w
lea r14d, [rax - 0x27]
cmovbe ax, r14w
jmp 0x1404deb72
inc rbx
stc
add ax, dx
cmc
clc
mov word [r10], ax
test ebx, r12d
cmc
jmp 0x1404deb88
test ecx, ecx
je 0x1404deba1
mov r10, rsi
cmp rbx, rdi
jmp 0x1404deb9b
jb 0x1404deb1a
cmp rbx, rdi
jmp 0x1404deba9
jb 0x1404debdf
mov word [r11], r15w
jmp 0x1404debb8
call fcn.1404afe81
mov ebx, 0x22
jmp 0x1404debc7
mov dword [rax], ebx
jmp 0x1404debce
call fcn.1404b0b68
mov eax, ebx
jmp 0x1404debda
jmp 0x1404dec2d
mov word [rsi], r15w
sal rcx, 0x67
stc
movzx eax, word [r8]
movzx ecx, word [r9]
stc
mov word [r9], ax
cmc
sub r9, 2
mov word [r8], cx
test r11w, 0x61c4
cmp r9b, 0xab
clc
add r8, 2
jmp 0x1404dec19
cmp r8, r9
jmp 0x1404dec21
jb 0x1404debe8
sub eax, eax
rcl di, 7
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
not dil
xchg dil, dil
jmp 0x1404dec4f
pop rdi
ret
Function at 0x180a44160
Capabilities:
Decompress data using aplib

Disassembly:
call 0x180a442e7
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x180a44191
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x180a44177
add dl, dl
jne 0x180a4419e
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x180a441fe
xor eax, eax
add dl, dl
jne 0x180a441ad
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x180a442b5
add dl, dl
jne 0x180a441be
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x180a441cb
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x180a441d8
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x180a441e5
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x180a441f2
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x180a44186
mov eax, 1
add dl, dl
jne 0x180a4420e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x180a4421b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x180a44203
sub eax, ebx
mov ebx, 1
jne 0x180a44254
mov ecx, 1
add dl, dl
jne 0x180a44236
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x180a44243
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x180a4422b
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x180a44186
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x180a44270
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x180a4427d
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x180a44265
cmp eax, 0x7d00
jae 0x180a442a3
cmp eax, 0x500
jb 0x180a4429e
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x180a44186
cmp eax, 0x7f
ja 0x180a442a6
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x180a44186
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x180a442da
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x180a44186
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x2fc4d83a0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc4d9480
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc4d8da2
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4fb108]
test eax, eax
je 0x2fc4d8e3a
lea rax, [0x2fc4fb0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4fb110]
mov qword [rbp - 8], rax
jmp 0x2fc4d8e1e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4d8e12
cmp qword [rbp - 0x10], 0
je 0x2fc4d8e12
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4d8dd8
lea rax, [0x2fc4fb0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4d8e3b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4d8f40
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4d8f68
mov eax, 0
jmp 0x2fc4d8fb6
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4d8f91
mov eax, 0
jmp 0x2fc4d8fb6
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4d8fb1
mov eax, 0
jmp 0x2fc4d8fb6
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d8fbc
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4d903a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4d9031
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4d9031
mov rax, qword [rbp - 8]
jmp 0x2fc4d904f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4d9004
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x2fc578530
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc579610
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc578f32
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc59b108]
test eax, eax
je 0x2fc578fca
lea rax, [0x2fc59b0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc59b110]
mov qword [rbp - 8], rax
jmp 0x2fc578fae
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc578fa2
cmp qword [rbp - 0x10], 0
je 0x2fc578fa2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc578f68
lea rax, [0x2fc59b0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc578fcb
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc5790d0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc5790f8
mov eax, 0
jmp 0x2fc579146
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc579121
mov eax, 0
jmp 0x2fc579146
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc579141
mov eax, 0
jmp 0x2fc579146
mov eax, 1
add rsp, 0x20
pop rbp
ret