joyce8/EMBER2024-capa huggingface dataset:
Function at 0x463f60
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4033cf
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
mov rax, rdx
nop
call fcn.00409b20
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00461ec0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x4033a0
cmp byte [0x00738fdf], 0
je 0x463f75
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp 0x460fc0
jmp 0x4033a0

Function at 0x463f80
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x007393c0]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d124b
mul rcx
nop
nop
xor rax, rdx
ret
cmp byte [0x00738fdf], 0
je 0x463fb5
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x00739740]
aesenc xmm0, xmmword [0x00739750]
aesenc xmm0, xmmword [0x00739760]
movq rax, xmm0
ret
jmp 0x409d20

Function at 0x463fc0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, qword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x007393c0]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
nop
nop
xor rax, rdx
ret
cmp byte [0x00738fdf], 0
je 0x463ff6
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x00739740]
aesenc xmm0, xmmword [0x00739750]
aesenc xmm0, xmmword [0x00739760]
movq rax, xmm0
ret
jmp 0x409d80

Function at 0x465a00
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x30
mov rcx, 0xfffffffffffffff4
mov qword [rsp], rcx
mov rax, qword [sym.imp.kernel32.dll_GetStdHandle]
call rax
mov rcx, rax
mov qword [rsp], rcx
lea rdx, [0x007396c0]
mov qword [rsp + 8], rdx
lea r8d, [0x00738ffc]
mov qword [rsp + 0x10], r8
lea r9, [rsp + 0x28]
mov qword [r9], 0
mov qword [rsp + 0x18], r9
mov qword [rsp + 0x20], 0
mov rax, qword [sym.imp.kernel32.dll_WriteFile]
call rax
call fcn.00463ea0
add rsp, 0x30
ret

Function at 0x465f40
Capabilities:
Allocate thread local storage

Disassembly:
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x465f6c
call fcn.00463ea0
shl rcx, 3
add rcx, 0x1480
mov qword [0x00739208], rcx
ret
Function at 0x47e940
Capabilities:
Hash data using fnv

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47eb8b
add rsp, 0xffffffffffffff80
mov qword [rsp + 0x78], rbp
lea rbp, [rsp + 0x78]
mov ebx, dword [rax + 0x2c]
nop dword [rax + rax]
test ebx, ebx
jne 0x47e9ec
mov qword [rsp + 0x88], rax
lea rbx, [0x00583ec0]
mov rcx, rax
lea rax, [0x006e5560]
call fcn.00474c20
test cl, cl
jne 0x47e9d1
mov rax, qword [rsp + 0x88]
call fcn.0047e140
mov ecx, 1
mov rdi, rax
mov rsi, rbx
lea rax, [rsp + 0x30]
lea rbx, [0x005e1958]
call fcn.0044db00
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x28], rbx
nop dword [rax]
call fcn.0047ebc0
mov rcx, qword [rsp + 0x88]
xor edx, edx
jmp 0x47ea0d
lea rdx, [0x00583c00]
cmp rax, rdx
jne 0x47e9fb
test byte [rbx], al
mov rax, rbx
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
call fcn.0045f8c0
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
mov rbx, rdx
lea rcx, [0x0055dd80]
call fcn.0040a8c0
inc rdx
cmp rbx, rdx
jle 0x47ea58
mov rsi, qword [rax + rdx*8]
cmp qword [rsi + 0x30], rcx
jne 0x47ea0a
lea rax, [0x006e5560]
lea rbx, [0x00583ec0]
lea rdi, [0x00583c00]
call fcn.00474de0
lea rdx, [0x00583c00]
nop dword [rax]
cmp rax, rdx
jne 0x47eb7b
test byte [rbx], al
mov rax, rbx
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
lea rcx, [0x00556220]
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], 0
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x58], rcx
lea rax, [0x0056b6c0]
nop
call fcn.0040d620
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x58]
test byte [rcx], al
cmp dword [0x00739330], 0
jne 0x47eaba
mov rdx, qword [rcx]
mov qword [rax], rdx
movups xmm0, xmmword [rcx + 8]
movups xmmword [rax + 8], xmm0
movups xmm0, xmmword [rcx + 0x18]
movups xmmword [rax + 0x18], xmm0
movups xmm0, xmmword [rcx + 0x28]
movups xmmword [rax + 0x28], xmm0
jmp 0x47eac9
mov rbx, rax
lea rax, [0x0056b6c0]
call fcn.00413340
mov rax, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x28]
xor ecx, ecx
xor edi, edi
xor esi, esi
mov r8d, esi
nop dword [rax]
call fcn.0047dc00
call fcn.0045f980
mov rsi, qword [rsp + 0x60]
mov dword [rsi + 0x28], eax
mov dword [rsi + 0x2c], 0
mov rcx, qword [rsp + 0x88]
mov edx, dword [rcx + 0x10]
xor eax, eax
jmp 0x47eb16
imul edx, edx, 0x1000193
xor edx, 0x2a
mov eax, 1
cmp rax, 1
jl 0x47eb08
mov dword [rsi + 0x10], edx
cmp dword [0x00739330], 0
jne 0x47eb2e
mov qword [rsi + 0x30], rcx
jmp 0x47eb37
lea rdi, [rsi + 0x30]
call fcn.00464180
lea rax, [0x006e5560]
lea rbx, [0x00583ec0]
lea rdi, [0x00583c00]
call fcn.00474de0
lea rdx, [0x00583c00]
cmp rax, rdx
jne 0x47eb6c
test byte [rbx], al
mov rax, rbx
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
mov rbx, rdx
lea rcx, [0x0055dd80]
call fcn.0040a8c0
mov rbx, rdx
lea rcx, [0x0055dd80]
call fcn.0040a8c0
nop
mov qword [rsp + 8], rax
call fcn.00461ec0
mov rax, qword [rsp + 8]
jmp fcn.0047e940
Function at 0x4caa80
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4cabdb
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
movups xmmword [rsp + 0x40], xmm15
mov qword [rsp + 0x30], 0
mov rax, qword [0x006e3898]
call fcn.004bdfe0
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x28], rbx
movups xmmword [rsp + 0x50], xmm15
mov qword [rsp + 0x60], 0
lea rcx, [0x004cac00]
mov qword [rsp + 0x50], rcx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x58], rcx
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x60], rcx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x2b
call fcn.00403200
xorps xmm15, xmm15
mov r14, qword [0x00739208]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rcx, qword [rsp + 0x18]
cmp rcx, 0xffffffffffffffff
je 0x4cab9b
mov rdx, qword [rsp + 0x28]
cmp rdx, rcx
jb 0x4cabd5
mov qword [rsp + 0x20], rcx
mov rsi, qword [rsp + 0x50]
mov rax, qword [rsp + 0x38]
mov rbx, rcx
lea rdx, [rsp + 0x50]
call rsi
mov rax, qword [rsp + 0x20]
lea rcx, [rax + 1]
mov rbx, qword [rsp + 0x28]
cmp rbx, rcx
jb 0x4cabca
mov rsi, qword [rsp + 0x50]
sub rbx, rax
dec rbx
mov rdi, rbx
neg rbx
sar rbx, 0x3f
and rcx, rbx
mov r8, qword [rsp + 0x38]
lea rax, [r8 + rcx]
mov rbx, rdi
lea rdx, [rsp + 0x50]
nop
call rsi
mov rcx, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x28]
lea rdx, [rsp + 0x50]
call rcx
mov rcx, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov rax, rcx
mov rcx, rbx
call fcn.004645e0
call fcn.00464560
nop
nop dword [rax + rax]
call fcn.00461ec0
jmp fcn.004caa80
Function at 0x4e6b80
Capabilities:
Access peb ldr_data

Disassembly:
lea r12, [rsp - 0x30]
cmp r12, qword [r14 + 0x10]
jbe 0x4e6de1
sub rsp, 0xb0
mov qword [rsp + 0xa8], rbp
lea rbp, [rsp + 0xa8]
test rax, rax
je 0x4e6dc5
mov qword [rsp + 0xb8], rax
mov rbx, qword [rax + 8]
mov rdx, qword [rax]
mov rcx, qword [rax + 0x10]
test rbx, rbx
jne 0x4e6bcd
xor ebx, ebx
xor ecx, ecx
jmp 0x4e6be0
mov rax, rdx
call fcn.004d79a0
mov rcx, rax
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x88], rcx
mov qword [rsp + 0x48], rbx
cmp qword [rax + 0x28], 0
je 0x4e6cf8
mov rcx, qword [rax + 0x18]
mov rax, rcx
nop
call fcn.0047bb80
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x58], rbx
mov rcx, qword [rsp + 0xb8]
mov r8, qword [rcx + 0x20]
mov r9, qword [rcx + 0x28]
mov rcx, qword [rsp + 0x48]
lea rdi, [0x005e1908]
mov esi, 1
lea rax, [rsp + 0x68]
mov rbx, qword [rsp + 0x88]
call fcn.0044dba0
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x3a
call fcn.00403200
xorps xmm15, xmm15
mov r14, qword [0x00739208]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x4e6cbb
xor eax, eax
lea rbx, [0x005e1a90]
mov ecx, 1
mov rdi, qword [rsp + 0xa0]
mov rsi, qword [rsp + 0x60]
lea r8, [0x00588cf0]
mov r9d, 2
mov r10, qword [rsp + 0x98]
mov r11, qword [rsp + 0x58]
call fcn.0044dc80
jmp 0x4e6ce8
xor eax, eax
mov rbx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x60]
lea rdi, [0x005e19a0]
mov esi, 1
mov r8, qword [rsp + 0x98]
mov r9, qword [rsp + 0x58]
call fcn.0044dba0
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
mov rax, qword [rax + 0x18]
nop dword [rax]
call fcn.0047bb80
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x50], rbx
mov rcx, qword [rsp + 0x88]
mov qword [rsp], rcx
mov rdx, qword [rsp + 0x48]
mov qword [rsp + 8], rdx
mov byte [rsp + 0x10], 0x3a
call fcn.00403200
xorps xmm15, xmm15
mov r14, qword [0x00739208]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x4e6d88
xor eax, eax
lea rbx, [0x005e1a90]
mov ecx, 1
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x48]
lea r8, [0x00588cf0]
mov r9d, 2
mov r10, qword [rsp + 0x90]
mov r11, qword [rsp + 0x50]
call fcn.0044dc80
jmp 0x4e6db5
xor eax, eax
mov rbx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x48]
lea rdi, [0x005e19a0]
mov esi, 1
mov r8, qword [rsp + 0x90]
mov r9, qword [rsp + 0x50]
call fcn.0044dba0
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
lea rax, [0x00589120]
mov ebx, 5
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
mov qword [rsp + 8], rax
call fcn.00461ec0
mov rax, qword [rsp + 8]
jmp fcn.004e6b80
Function at 0x511ca0
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x511de6
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
mov qword [rsp + 0x80], rbx
mov rcx, qword [rax]
mov qword [rsp + 0x18], rcx
movups xmm0, xmmword [rax + 8]
movups xmmword [rsp + 0x20], xmm0
movups xmm0, xmmword [rax + 0x18]
movups xmmword [rsp + 0x30], xmm0
lea rax, [rsp + 0x18]
nop
call fcn.00511940
movups xmmword [rsp + 0x40], xmm15
movups xmmword [rsp + 0x48], xmm15
movups xmmword [rsp + 0x58], xmm15
mov rcx, qword [rsp + 0x18]
mov qword [rsp + 0x40], rcx
mov rcx, qword [rsp + 0x20]
mov qword [rsp + 0x48], rcx
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x50], rcx
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x58], rcx
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x60], rcx
mov rcx, qword [rsp + 0x80]
xor eax, eax
jmp 0x511d40
inc rax
mov rcx, rbx
nop dword [rax + rax]
cmp rax, 5
jge 0x511d83
imul rdx, rax, 0x33
mov rsi, rdx
sar rdx, 0x3f
shr rdx, 0x3d
add rdx, rsi
mov rdi, rdx
and rdx, 0xfffffffffffffff8
sub rsi, rdx
cmp rsi, 0x40
sbb rdx, rdx
mov r8, qword [rsp + rax*8 + 0x40]
mov rbx, rcx
mov rcx, rsi
shl r8, cl
and r8, rdx
mov qword [rsp + 0x10], r8
xor ecx, ecx
jmp 0x511dac
test byte [rcx], al
mov rax, rcx
mov ebx, 0x20
mov rcx, rbx
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
movzx r8d, byte [rbx + rdi]
or r8d, edx
mov byte [rbx + rdi], r8b
inc rcx
mov rdi, rsi
cmp rcx, 8
jge 0x511d35
movzx edx, byte [rsp + rcx + 0x10]
mov rsi, rdi
sar rdi, 3
add rdi, rcx
cmp rdi, 0x20
jge 0x511d35
test byte [rbx], al
cmp rdi, 0x20
jb 0x511d9a
mov rax, rdi
mov ecx, 0x20
nop dword [rax + rax]
call fcn.00464520
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00461ec0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.00511ca0
Function at 0x513240
Capabilities:
Hash data using sha384
Hash data using sha512

Disassembly:
mov rcx, qword [rax + 0xd0]
cmp rcx, 6
jne 0x5132c5
movabs rcx, 0xcbbb9d5dc1059ed8
mov qword [rax], rcx
movabs rcx, 0x629a292a367cd507
mov qword [rax + 8], rcx
movabs rcx, 0x9159015a3070dd17
mov qword [rax + 0x10], rcx
movabs rcx, 0x152fecd8f70e5939
mov qword [rax + 0x18], rcx
movabs rcx, 0x67332667ffc00b31
mov qword [rax + 0x20], rcx
movabs rcx, 0x8eb44a8768581511
mov qword [rax + 0x28], rcx
movabs rcx, 0xdb0c2e0d64f98fa7
mov qword [rax + 0x30], rcx
movabs rcx, 0x47b5481dbefa4fa4
mov qword [rax + 0x38], rcx
nop dword [rax]
jmp 0x513426
cmp rcx, 0xe
jne 0x513340
movabs rcx, 0x8c3d37c819544da2
mov qword [rax], rcx
movabs rcx, 0x73e1996689dcd4d6
mov qword [rax + 8], rcx
movabs rcx, 0x1dfab7ae32ff9c82
mov qword [rax + 0x10], rcx
movabs rcx, 0x679dd514582f9fcf
mov qword [rax + 0x18], rcx
movabs rcx, 0xf6d2b697bd44da8
mov qword [rax + 0x20], rcx
movabs rcx, 0x77e36f7304c48942
mov qword [rax + 0x28], rcx
movabs rcx, 0x3f9d85a86a1d36c8
mov qword [rax + 0x30], rcx
movabs rcx, 0x1112e6ad91d692a1
mov qword [rax + 0x38], rcx
jmp 0x513426
cmp rcx, 0xf
jne 0x5133b7
movabs rcx, 0x22312194fc2bf72c
mov qword [rax], rcx
movabs rcx, 0x9f555fa3c84c64c2
mov qword [rax + 8], rcx
movabs rcx, 0x2393b86b6f53b151
mov qword [rax + 0x10], rcx
movabs rcx, 0x963877195940eabd
mov qword [rax + 0x18], rcx
movabs rcx, 0x96283ee2a88effe3
mov qword [rax + 0x20], rcx
movabs rcx, 0xbe5e1e2553863992
mov qword [rax + 0x28], rcx
movabs rcx, 0x2b0199fc2c85b8aa
mov qword [rax + 0x30], rcx
movabs rcx, 0xeb72ddc81c52ca2
mov qword [rax + 0x38], rcx
jmp 0x513426
movabs rcx, 0x6a09e667f3bcc908
mov qword [rax], rcx
movabs rcx, 0xbb67ae8584caa73b
mov qword [rax + 8], rcx
movabs rcx, 0x3c6ef372fe94f82b
mov qword [rax + 0x10], rcx
movabs rcx, 0xa54ff53a5f1d36f1
mov qword [rax + 0x18], rcx
movabs rcx, 0x510e527fade682d1
mov qword [rax + 0x20], rcx
movabs rcx, 0x9b05688c2b3e6c1f
mov qword [rax + 0x28], rcx
movabs rcx, 0x1f83d9abfb41bd6b
mov qword [rax + 0x30], rcx
movabs rcx, 0x5be0cd19137e2179
mov qword [rax + 0x38], rcx
movups xmmword [rax + 0xc0], xmm15
ret
Function at 0x51e220
Capabilities:
Parse credit card information

Disassembly:
lea ecx, [rax - 0x61]
cmp cl, 0x19
jbe 0x51e238
lea ecx, [rax - 0x41]
cmp cl, 0x19
jbe 0x51e238
lea ecx, [rax - 0x30]
cmp cl, 9
ja 0x51e240
xor eax, eax
ret
cmp rbx, 3
je 0x51e24c
cmp rbx, 4
jne 0x51e279
cmp al, 0x2c
ja 0x51e266
lea ecx, [rax - 0x21]
cmp cl, 1
jbe 0x51e276
cmp al, 0x24
je 0x51e276
nop dword [rax]
cmp al, 0x26
jae 0x51e276
jmp 0x51e279
lea ecx, [rax - 0x3a]
cmp cl, 4
jbe 0x51e276
cmp al, 0x5b
je 0x51e276
cmp al, 0x5d
jne 0x51e279
xor eax, eax
ret
cmp al, 0x2f
ja 0x51e2b2
nop dword [rax]
cmp al, 0x26
ja 0x51e291
cmp al, 0x24
je 0x51e2d1
cmp al, 0x26
je 0x51e2d1
jmp 0x51e34b
lea ecx, [rax - 0x2b]
cmp cl, 1
jbe 0x51e2d1
lea ecx, [rax - 0x2d]
nop dword [rax]
cmp cl, 1
jbe 0x51e348
cmp al, 0x2f
je 0x51e2d1
jmp 0x51e34b
cmp al, 0x3d
ja 0x51e2c9
lea ecx, [rax - 0x3a]
cmp cl, 1
jbe 0x51e2d1
nop
cmp al, 0x3d
je 0x51e2d1
jmp 0x51e34b
lea ecx, [rax - 0x3f]
cmp cl, 1
ja 0x51e340
cmp rbx, 2
jg 0x51e307
cmp rbx, 1
je 0x51e301
nop dword [rax]
cmp rbx, 2
jne 0x51e34b
cmp al, 0x2f
je 0x51e2f2
cmp al, 0x3b
je 0x51e2f2
cmp al, 0x2c
jne 0x51e2f9
mov ecx, 1
jmp 0x51e2fe
cmp al, 0x3f
sete cl
mov eax, ecx
ret
cmp al, 0x3f
sete al
ret
cmp rbx, 5
jne 0x51e32a
cmp al, 0x40
je 0x51e319
cmp al, 0x2f
je 0x51e319
cmp al, 0x3f
jne 0x51e322
mov ecx, 1
nop
jmp 0x51e327
cmp al, 0x3a
sete cl
mov eax, ecx
ret
cmp rbx, 6
je 0x51e339
cmp rbx, 7
jne 0x51e34b
xor eax, eax
ret
mov eax, 1
ret
cmp al, 0x5f
je 0x51e348
cmp al, 0x7e
jne 0x51e34b
xor eax, eax
ret
cmp rbx, 7
jne 0x51e361
cmp al, 0x21
je 0x51e35d
lea ecx, [rax - 0x28]
cmp cl, 2
ja 0x51e361
xor eax, eax
nop
ret
mov eax, 1
ret
Function at 0x14108a058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x14108a1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x14108a089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14108a06f
add dl, dl
jne 0x14108a096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14108a0f6
xor eax, eax
add dl, dl
jne 0x14108a0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14108a1ad
add dl, dl
jne 0x14108a0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14108a0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14108a0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14108a0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x14108a0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14108a07e
mov eax, 1
add dl, dl
jne 0x14108a106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14108a113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14108a0fb
sub eax, ebx
mov ebx, 1
jne 0x14108a14c
mov ecx, 1
add dl, dl
jne 0x14108a12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14108a13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14108a123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14108a07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x14108a168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14108a175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14108a15d
cmp eax, 0x7d00
jae 0x14108a19b
cmp eax, 0x500
jb 0x14108a196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14108a07e
cmp eax, 0x7f
ja 0x14108a19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14108a07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x14108a1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14108a07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1400078d0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x140016010]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor edi, edi
mov ebx, ecx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x40], rdi
call fcn.1400012a0
mov rcx, qword [rsp + 0x30]
test eax, eax
jne 0x140007a14
test rcx, rcx
je 0x14000791e
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
js 0x140007a1f
mov rax, qword gs:[0x58]
mov edx, 4
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x140016ef0], eax
jle 0x140007969
lea rcx, [0x140016ef0]
call fcn.14000e748
cmp dword [0x140016ef0], 0xffffffff
jne 0x140007969
lea rcx, [0x140016ef0]
mov dword [0x140016ef4], ebx
call fcn.14000e6e8
mov rdx, qword [0x140016ee8]
lea r8, [0x140010c30]
mov rcx, rdi
nop word [rax + rax]
movzx eax, word [rdx + rcx*2]
inc rcx
cmp ax, word [r8 + rcx*2 - 2]
jne 0x14000799e
cmp rcx, 8
jne 0x140007980
lea r8, [0x140007620]
jmp 0x1400079dd
mov rax, rdi
lea r8, [0x140010c40]
nop dword [rax + rax]
movzx ecx, word [rdx + rax*2]
inc rax
cmp cx, word [r8 + rax*2 - 2]
jne 0x1400079cb
cmp rax, 8
jne 0x1400079b0
cmp cx, word [r8 + rax*2 - 2]
lea r8, [0x140007670]
lea rax, [0x140007650]
cmove r8, rax
cmp dword [0x140016ef4], edi
lea rax, [0x140016ef4]
mov r9, rdi
mov qword [rsp + 0x28], rdi
cmova r9, rax
mov dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x140007a1f
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140007a1f
test rcx, rcx
je 0x140007a1f
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14000e3e0
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x140001360
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x14002b008]
xor rax, rsp
mov qword [rbp - 8], rax
mov rdi, r9
mov esi, r8d
mov rbx, rdx
mov r13, rcx
mov r15, qword [rbp + 0x60]
test r8b, 0xf
jne 0x1400014cb
mov ecx, esi
call fcn.140002e94
mov r12, rax
mov ecx, dword [r13 + 4]
inc ecx
shl ecx, 4
call fcn.140002e94
mov r14, rax
mov r8, rax
mov rdx, rdi
mov rcx, r13
call fcn.1400020a0
movups xmm0, xmmword [r15]
movups xmmword [rbp - 0x20], xmm0
xor r15d, r15d
test esi, esi
je 0x140001499
nop
movzx eax, byte [r15 + rbx]
xor byte [rbp - 0x20], al
movzx eax, byte [r15 + rbx + 1]
xor byte [rbp - 0x1f], al
movzx eax, byte [r15 + rbx + 2]
xor byte [rbp - 0x1e], al
movzx eax, byte [r15 + rbx + 3]
xor byte [rbp - 0x1d], al
movzx eax, byte [r15 + rbx + 4]
xor byte [rbp - 0x1c], al
movzx eax, byte [r15 + rbx + 5]
xor byte [rbp - 0x1b], al
movzx eax, byte [r15 + rbx + 6]
xor byte [rbp - 0x1a], al
movzx eax, byte [r15 + rbx + 7]
xor byte [rbp - 0x19], al
movzx eax, byte [r15 + rbx + 8]
xor byte [rbp - 0x18], al
movzx eax, byte [r15 + rbx + 9]
xor byte [rbp - 0x17], al
movzx eax, byte [r15 + rbx + 0xa]
xor byte [rbp - 0x16], al
movzx eax, byte [r15 + rbx + 0xb]
xor byte [rbp - 0x15], al
movzx eax, byte [r15 + rbx + 0xc]
xor byte [rbp - 0x14], al
movzx eax, byte [r15 + rbx + 0xd]
xor byte [rbp - 0x13], al
movzx eax, byte [r15 + rbx + 0xe]
xor byte [rbp - 0x12], al
movzx eax, byte [r15 + rbx + 0xf]
xor byte [rbp - 0x11], al
lea rdi, [r15 + r12]
mov r9, r14
mov r8, rdi
lea rdx, [rbp - 0x20]
mov rcx, r13
call fcn.140001760
movups xmm1, xmmword [rdi]
movups xmmword [rbp - 0x20], xmm1
add r15d, 0x10
cmp r15d, esi
jb 0x1400013e0
mov rcx, r14
call fcn.140002e50
mov rax, r12
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140002e30
mov rbx, qword [rsp + 0xc8]
add rsp, 0x80
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea rcx, [rbp - 0x60]
call fcn.1400012b0
nop
mov r8, rax
lea rcx, [rbp - 0x40]
call fcn.1400024a0
nop
mov rdx, rax
lea rcx, [rbp - 0x20]
call fcn.140001240
lea rdx, [0x14002a0a0]
lea rcx, [rbp - 0x20]
call fcn.1400090e0
int3
Function at 0x140001500
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x90
mov rax, qword [0x14002b008]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rdi, r9
mov r14d, r8d
mov rbp, rdx
mov qword [rsp + 0x20], rdx
mov r13, rcx
test r8b, 0xf
jne 0x140001699
mov ecx, r14d
call fcn.140002e94
mov rbx, rax
mov ecx, dword [r13 + 4]
inc ecx
shl ecx, 4
call fcn.140002e94
mov r15, rax
mov r8, rax
mov rdx, rdi
mov rcx, r13
call fcn.1400020a0
mov rcx, qword [rsp + 0xf0]
movups xmm0, xmmword [rcx]
movups xmmword [rsp + 0x68], xmm0
xor r12d, r12d
test r14d, r14d
je 0x140001663
nop word [rax + rax]
mov esi, r12d
lea rdi, [r12 + rbx]
add rbp, rsi
mov r9, r15
mov r8, rdi
mov rdx, rbp
mov rcx, r13
call fcn.140001c30
movzx eax, byte [rsp + 0x68]
xor byte [rdi], al
movzx eax, byte [rsp + 0x69]
xor byte [r12 + rbx + 1], al
movzx eax, byte [rsp + 0x6a]
xor byte [r12 + rbx + 2], al
movzx eax, byte [rsp + 0x6b]
xor byte [r12 + rbx + 3], al
movzx eax, byte [rsp + 0x6c]
xor byte [r12 + rbx + 4], al
movzx eax, byte [rsp + 0x6d]
xor byte [r12 + rbx + 5], al
movzx eax, byte [rsp + 0x6e]
xor byte [r12 + rbx + 6], al
movzx eax, byte [rsp + 0x6f]
xor byte [r12 + rbx + 7], al
movzx eax, byte [rsp + 0x70]
xor byte [r12 + rbx + 8], al
movzx eax, byte [rsp + 0x71]
xor byte [r12 + rbx + 9], al
movzx eax, byte [rsp + 0x72]
xor byte [r12 + rbx + 0xa], al
movzx eax, byte [rsp + 0x73]
xor byte [r12 + rbx + 0xb], al
movzx eax, byte [rsp + 0x74]
xor byte [r12 + rbx + 0xc], al
movzx eax, byte [rsp + 0x75]
xor byte [r12 + rbx + 0xd], al
movzx eax, byte [rsp + 0x76]
xor byte [r12 + rbx + 0xe], al
movzx eax, byte [rsp + 0x77]
xor byte [r12 + rbx + 0xf], al
movups xmm0, xmmword [rbp]
movups xmmword [rsp + 0x68], xmm0
add r12d, 0x10
cmp r12d, r14d
mov rbp, qword [rsp + 0x20]
jb 0x140001590
mov rcx, r15
call fcn.140002e50
mov rax, rbx
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140002e30
mov rbx, qword [rsp + 0xe8]
add rsp, 0x90
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea rcx, [rsp + 0x28]
call fcn.1400012b0
nop
mov r8, rax
lea rcx, [rsp + 0x48]
call fcn.1400024a0
nop
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.140001240
lea rdx, [0x14002a0a0]
lea rcx, [rsp + 0x68]
call fcn.1400090e0
int3