joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f5a60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f5b18
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xf9039c0769adaf10
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x707040402010705
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x2060001
xor eax, eax
jmp 0x4f5ab9
movzx r9d, byte [rsp + rsi + 0x1c]
sub r9d, edx
lea edx, [r9 + 0x6c]
mov byte [rsp + rdi + 0x1c], dl
lea edx, [r8 + 0x6c]
mov byte [rsp + rsi + 0x1c], dl
add rax, 2
cmp rax, 0xc
jge 0x4f5ae8
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x4f5b0b
movzx r8d, byte [rsp + rdi + 0x1c]
sub r8d, edx
nop
cmp rsi, 8
jb 0x4f5a9c
jmp 0x4f5aff
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 8
call fcn.00441380
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 8
call fcn.004518a0
mov eax, edi
mov ecx, 8
call fcn.004518a0
nop
call fcn.0044f620
nop dword [rax]
jmp fcn.004f5a60
Function at 0x4f8240
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f834c
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x8cc49da1beb78ab4
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x5da88daa207c984d
mov qword [rsp + 0x26], rdx
movabs rdx, 0xbaa464ca5da88daa
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x646568976949b889
mov qword [rsp + 0x32], rdx
movabs rdx, 0x90c100600181215
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x406050e08030110
mov qword [rsp + 0x42], rdx
movabs rdx, 0x16130f0212080406
mov qword [rsp + 0x48], rdx
movabs rdx, 0xa0714050d0f1618
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x4f82e8
movzx r9d, byte [rsp + rsi + 0x1e]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x42]
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
cmp rax, 0x1e
jge 0x4f831c
movzx edx, byte [rsp + rax + 0x3a]
movzx esi, byte [rsp + rax + 0x3b]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x1c
jae 0x4f833f
movzx r8d, byte [rsp + rdi + 0x1e]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x42]
cmp rsi, 0x1c
jb 0x4f82ce
jmp 0x4f8333
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x1c
call fcn.00441380
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x1c
call fcn.004518a0
mov eax, edi
mov ecx, 0x1c
call fcn.004518a0
nop
call fcn.0044f620
jmp fcn.004f8240

Function at 0x4f9020
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x28]
cmp r12, qword [r14 + 0x10]
jbe 0x4f91ca
push rbp
mov rbp, rsp
sub rsp, 0xa0
movabs rdx, 0x404a7557207a706e
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x3f75023564693940
mov qword [rsp + 0x26], rdx
movabs rdx, 0x4f391ff478595320
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x61206b105fe74c65
mov qword [rsp + 0x36], rdx
movabs rdx, 0x7365706f20646c69
mov qword [rsp + 0x3e], rdx
movabs rdx, 0xfc582b6989272f99
mov qword [rsp + 0x46], rdx
movabs rdx, 0x44276e5050421d46
mov qword [rsp + 0x4e], rdx
movabs rdx, 0xe19082e301b1535
mov qword [rsp + 0x56], rdx
movabs rdx, 0x8110428301e0714
mov qword [rsp + 0x5e], rdx
movabs rdx, 0xc1808110428301e
mov qword [rsp + 0x60], rdx
movabs rdx, 0x15083113070b2934
mov qword [rsp + 0x68], rdx
movabs rdx, 0x31001a0126060131
mov qword [rsp + 0x70], rdx
movabs rdx, 0x282f10110e2e311e
mov qword [rsp + 0x78], rdx
movabs rdx, 0x2c2d152a10060716
mov qword [rsp + 0x80], rdx
movabs rdx, 0x291b2f1c18041905
mov qword [rsp + 0x88], rdx
movabs rdx, 0x2710302d21260d19
mov qword [rsp + 0x90], rdx
movabs rdx, 0x11040b0412300235
mov qword [rsp + 0x98], rdx
xor eax, eax
jmp 0x4f9166
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 + 0x4d]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 + 0x4d]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
cmp rax, 0x4a
jge 0x4f9197
movzx edx, byte [rsp + rax + 0x56]
movzx esi, byte [rsp + rax + 0x57]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax]
cmp rdi, 0x37
jae 0x4f91bd
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
cmp rsi, 0x37
jb 0x4f9149
jmp 0x4f91b1
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x37
call fcn.00441380
add rsp, 0xa0
pop rbp
ret
mov eax, esi
mov ecx, 0x37
call fcn.004518a0
mov eax, edi
mov ecx, 0x37
call fcn.004518a0
nop
call fcn.0044f620
jmp fcn.004f9020
Function at 0x507300
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5073ec
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x6667ed619932a2fe
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x386667ed619932a2
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xb9665f5e5dca616c
mov qword [rsp + 0x24], rdx
movabs rdx, 0xe00030b000b0509
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xc0101100e00030b
mov qword [rsp + 0x30], rdx
movabs rdx, 0x6070d0404090b03
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x50738a
movzx r9d, byte [rsp + rsi + 0x1b]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x43]
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
cmp rax, 0x14
jge 0x5073bc
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x5073df
movzx r8d, byte [rsp + rdi + 0x1b]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x43]
cmp rsi, 0x11
jb 0x507370
jmp 0x5073d3
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x11
call fcn.00441380
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.004518a0
mov eax, edi
mov ecx, 0x11
call fcn.004518a0
nop
call fcn.0044f620
jmp fcn.00507300
Function at 0x50bbc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50bc8c
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x3cbf63d590657375
mov qword [rsp + 0x18], rdx
mov word [rsp + 0x20], 0x6cbe
movabs rdx, 0x804050606070604
mov qword [rsp + 0x22], rdx
movabs rdx, 0x307070508040804
mov qword [rsp + 0x28], rdx
xor eax, eax
jmp 0x50bc24
movzx r9d, byte [rsp + rsi + 0x18]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x3c]
mov byte [rsp + rdi + 0x18], dl
mov byte [rsp + rsi + 0x18], r8b
add rax, 2
cmp rax, 0xe
jge 0x50bc5c
movzx edx, byte [rsp + rax + 0x22]
movzx esi, byte [rsp + rax + 0x23]
mov edi, edx
xor edx, esi
add edx, eax
nop word [rax + rax]
cmp rdi, 0xa
jae 0x50bc7f
movzx r8d, byte [rsp + rdi + 0x18]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x3c]
cmp rsi, 0xa
jb 0x50bc0a
jmp 0x50bc73
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0xa
call fcn.00441380
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xa
call fcn.004518a0
mov eax, edi
mov ecx, 0xa
call fcn.004518a0
nop
call fcn.0044f620
jmp fcn.0050bbc0

Function at 0x50bca0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50bd78
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x79718a723f797c37
mov qword [rsp + 0x1a], rdx
mov dword [rsp + 0x22], 0x6c6c3a71
movabs rdx, 0x809030201040501
mov qword [rsp + 0x26], rdx
movabs rdx, 0x207080903020104
mov qword [rsp + 0x28], rdx
movabs rdx, 0x604040003060807
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x50bd14
movzx r9d, byte [rsp + rsi + 0x1a]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x14]
mov byte [rsp + rdi + 0x1a], dl
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
cmp rax, 0x12
jge 0x50bd48
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xc
jae 0x50bd6b
movzx r8d, byte [rsp + rdi + 0x1a]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x14]
nop
cmp rsi, 0xc
jb 0x50bcfa
jmp 0x50bd5f
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0xc
call fcn.00441380
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xc
call fcn.004518a0
mov eax, edi
mov ecx, 0xc
call fcn.004518a0
nop
call fcn.0044f620
nop dword [rax]
jmp fcn.0050bca0
Function at 0x50d000
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50d0cc
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x730c2d4d020635dc
mov qword [rsp + 0x1c], rdx
mov dword [rsp + 0x24], 0x224767fc
movabs rdx, 0x8010b000a02030b
mov qword [rsp + 0x28], rdx
movabs rdx, 0x3010a0503060b01
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x50d065
movzx r9d, byte [rsp + rsi + 0x1c]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x1d]
mov byte [rsp + rdi + 0x1c], dl
mov byte [rsp + rsi + 0x1c], r8b
add rax, 2
cmp rax, 0x10
jge 0x50d09c
movzx edx, byte [rsp + rax + 0x28]
movzx esi, byte [rsp + rax + 0x29]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax + rax]
cmp rdi, 0xc
jae 0x50d0bf
movzx r8d, byte [rsp + rdi + 0x1c]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x1d]
cmp rsi, 0xc
jb 0x50d04b
jmp 0x50d0b3
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0xc
call fcn.00441380
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xc
call fcn.004518a0
mov eax, edi
mov ecx, 0xc
call fcn.004518a0
nop
call fcn.0044f620
jmp fcn.0050d000

Function at 0x50d0e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50d1c6
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x1ae11b57030f68b9
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x630b7923211f491a
mov qword [rsp + 0x26], rdx
movabs rdx, 0x7020505080a0300
mov qword [rsp + 0x2e], rdx
movabs rdx, 0xb0907020505080a
mov qword [rsp + 0x30], rdx
movabs rdx, 0xd03060d00060a06
mov qword [rsp + 0x38], rdx
xor eax, eax
nop
jmp 0x50d160
movzx r9d, byte [rsp + rsi + 0x1f]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x4a]
mov byte [rsp + rdi + 0x1f], dl
mov byte [rsp + rsi + 0x1f], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x12
jge 0x50d192
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xf
jae 0x50d1b7
movzx r8d, byte [rsp + rdi + 0x1f]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x4a]
cmp rsi, 0xf
jb 0x50d142
jmp 0x50d1ab
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0xf
nop
call fcn.00441380
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0xf
call fcn.004518a0
mov eax, edi
mov ecx, 0xf
nop
call fcn.004518a0
nop
call fcn.0044f620
jmp fcn.0050d0e0

Function at 0x50d1e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50d298
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x311a105b0910d53
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x607060306020405
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x401
xor eax, eax
jmp 0x50d238
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 + 0x69]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 + 0x69]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
cmp rax, 0xa
jge 0x50d268
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x50d28b
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
nop dword [rax]
cmp rsi, 8
jb 0x50d21b
jmp 0x50d27f
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 8
call fcn.00441380
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 8
call fcn.004518a0
mov eax, edi
mov ecx, 8
call fcn.004518a0
nop
call fcn.0044f620
nop dword [rax]
jmp fcn.0050d1e0
Function at 0x50d840
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50d90c
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x31532fb068e96547
mov qword [rsp + 0x19], rdx
movabs rdx, 0x65186131532fb068
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x505040905020302
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x7050309
xor eax, eax
jmp 0x50d8a5
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x3c]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0xc
jge 0x50d8dc
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax + rax]
cmp rdi, 0xb
jae 0x50d8ff
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x3c]
cmp rsi, 0xb
jb 0x50d88b
jmp 0x50d8f3
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0xb
call fcn.00441380
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.004518a0
mov eax, edi
mov ecx, 0xb
call fcn.004518a0
nop
call fcn.0044f620
jmp fcn.0050d840
Function at 0x14000ee58
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov rax, qword [0x14001b008]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rsi, qword [rsp + 0xa0]
lea r10, [0x14001cc20]
xor r11d, r11d
lea rdi, [0x140011bb2]
test r9, r9
mov rax, rdx
mov r12, rdx
cmovne r10, r9
test rdx, rdx
lea ebp, [r11 + 1]
cmovne rdi, rdx
mov r15d, ebp
cmovne r15, r8
neg rax
sbb r14, r14
and r14, rcx
test r15, r15
jne 0x14000eec8
mov rax, 0xfffffffffffffffe
jmp 0x14000f015
cmp word [r10 + 6], r11w
jne 0x14000ef37
movzx r9d, byte [rdi]
inc rdi
test r9b, r9b
js 0x14000eef2
test r14, r14
je 0x14000eee3
mov dword [r14], r9d
test r9b, r9b
setne r11b
mov rax, r11
jmp 0x14000f015
mov al, r9b
and al, 0xe0
cmp al, 0xc0
jne 0x14000ef00
mov r8b, 2
jmp 0x14000ef1e
mov al, r9b
and al, 0xf0
cmp al, 0xe0
jne 0x14000ef0e
mov r8b, 3
jmp 0x14000ef1e
mov al, r9b
and al, 0xf8
cmp al, 0xf0
jne 0x14000f00a
mov r8b, 4
movzx eax, r8b
mov ecx, 7
sub ecx, eax
mov edx, ebp
shl edx, cl
mov bl, r8b
sub edx, ebp
and edx, r9d
jmp 0x14000ef60
mov r8b, byte [r10 + 4]
mov edx, dword [r10]
mov bl, byte [r10 + 6]
lea eax, [r8 - 2]
cmp al, 2
ja 0x14000f00a
cmp bl, bpl
jb 0x14000f00a
cmp bl, r8b
jae 0x14000f00a
movzx ebp, bl
cmp rbp, r15
mov r9d, ebp
cmovae r9, r15
jmp 0x14000ef8d
movzx ecx, byte [rdi]
inc rdi
mov al, cl
and al, 0xc0
cmp al, 0x80
jne 0x14000f00a
mov eax, edx
and ecx, 0x3f
shl eax, 6
mov edx, ecx
or edx, eax
mov rax, rdi
sub rax, r12
cmp rax, r9
jb 0x14000ef6f
cmp r9, rbp
jae 0x14000efb9
movzx eax, r8b
sub bl, r9b
mov word [r10 + 4], ax
movzx eax, bl
mov word [r10 + 6], ax
mov dword [r10], edx
jmp 0x14000eebc
lea eax, [rdx - 0xd800]
cmp eax, 0x7ff
jbe 0x14000f00a
cmp edx, 0x110000
jae 0x14000f00a
movzx eax, r8b
mov dword [rsp + 0x20], 0x80
mov dword [rsp + 0x24], 0x800
mov dword [rsp + 0x28], 0x10000
cmp edx, dword [rsp + rax*4 + 0x18]
jb 0x14000f00a
test r14, r14
je 0x14000eff8
mov dword [r14], edx
neg edx
mov rdx, r10
sbb rcx, rcx
and rcx, rbp
call fcn.14000ee3c
jmp 0x14000f015
mov rdx, rsi
mov rcx, r10
call fcn.14000ee44
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140001a60
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14002fa30
Capabilities:
Encode data using xor

Disassembly:
mov esp, 0x389902e3
fsub dword [r9 - 0x736318b2]
push rdi
xchg edi, eax
xchg esi, eax
je 0x14002faa9
jmp 0x14002fa90
cdq
fisub word [rdx]
invalid
add cl, al
cmp qword [r15 - 0x57], rcx
pop rcx
rcl eax, 1
insd dword [rdi], dx
xor ah, al
pushfq
xor byte [rdx - 0x1b], cl
or al, 0xec
stc
pop rsi
xchg eax, edx
movabs al, byte [0x22f78d9031fb2ed5]
or sil, al
sti
xor dword [rax + 0x4822f78d], edx
or dh, al
rol dword [rdx], 1
ja 0x14002fa63
adc dword [rbx + rbx], 0xffffff9a
jle 0x14002faef
mov eax, 0xf1409b40
xchg dword [rsp], esi
in al, 0x5c
out 0x34, eax
invalid
jns 0x14002fb58
jmp 0x16e524992
loop 0x14002fb8d
push rdi
sbb ebx, ebp
push 0xffffffffffffff8e
or eax, 0x80675470
insd dword [rdi], dx
cmp dword [rdi - 0x4842e770], edi
fstp xword [rsi + rbx*4 + 2]
xchg esi, eax
mov ebp, 0xad2e2c17
neg ch
shl byte [rdx], 1
mov cl, dh
invalid
movabs al, byte [0x523183ee7070952e]
xchg esp, eax
or eax, 0xb03cd84
invalid
Function at 0x140919058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1409191df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140919089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14091906f
add dl, dl
jne 0x140919096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1409190f6
xor eax, eax
add dl, dl
jne 0x1409190a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1409191ad
add dl, dl
jne 0x1409190b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1409190c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1409190d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1409190dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1409190ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14091907e
mov eax, 1
add dl, dl
jne 0x140919106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140919113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1409190fb
sub eax, ebx
mov ebx, 1
jne 0x14091914c
mov ecx, 1
add dl, dl
jne 0x14091912e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14091913b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140919123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14091907e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140919168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140919175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14091915d
cmp eax, 0x7d00
jae 0x14091919b
cmp eax, 0x500
jb 0x140919196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14091907e
cmp eax, 0x7f
ja 0x14091919e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14091907e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1409191d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14091907e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140001e90
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0x3f
syscall
ret

Function at 0x140002914
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000295e
mov ecx, _crt_atexit
cmp word [rax], cx
jne 0x14000295e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000295e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000295e
cmp dword [rcx + 0x84], 0xe
jbe 0x14000295e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140002960
xor al, al
add rsp, 0x28
ret

Function at 0x14068f0b0
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.14068f237
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x14068f0e1
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14068f0c7
add dl, dl
jne 0x14068f0ee
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14068f14e
xor eax, eax
add dl, dl
jne 0x14068f0fd
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14068f205
add dl, dl
jne 0x14068f10e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14068f11b
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14068f128
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14068f135
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x14068f142
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14068f0d6
mov eax, 1
add dl, dl
jne 0x14068f15e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14068f16b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14068f153
sub eax, ebx
mov ebx, 1
jne 0x14068f1a4
mov ecx, 1
add dl, dl
jne 0x14068f186
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14068f193
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14068f17b
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14068f0d6
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x14068f1c0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14068f1cd
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14068f1b5
cmp eax, 0x7d00
jae 0x14068f1f3
cmp eax, 0x500
jb 0x14068f1ee
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14068f0d6
cmp eax, 0x7f
ja 0x14068f1f6
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14068f0d6
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x14068f22a
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14068f0d6
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x4230a0
Capabilities:
Hash data using murmur3

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
cmp byte [0x0088a625], 0
jne 0x423205
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
sub rdx, qword [rbx + 0x18]
nop
test rdx, rdx
jne 0x4231ae
xor eax, eax
nop
nop
nop
mov rcx, rax
shr rax, 3
and rcx, 7
mov edx, 1
shl edx, cl
nop
add rax, qword [rbx + 0x50]
lock or byte [rax], dl
nop
nop
mov rcx, qword [rbx + 0x18]
nop
movabs rdx, 0x800000000000
lea rax, [rdx + rcx]
mov rdx, rax
shr rax, 0x2a
cmp rax, 0x40
jae 0x4231fa
lea rbx, [0x0086c4b8]
mov rax, qword [rbx + rax*8]
shr rdx, 0x16
and rdx, 0xfffff
mov rdx, qword [rax + rdx*8]
test byte [rdx], al
test byte [rax], al
mov rax, rcx
shr rcx, 0x10
and rcx, 0x3f
movzx ebx, byte [rdx + rcx + 0x21040]
lea rdx, [rdx + rcx]
lea rdx, [rdx + 0x21040]
shr rax, 0xd
and rax, 7
mov rcx, rax
mov esi, 1
shl esi, cl
test sil, bl
jne 0x42316f
lock or byte [rdx], sil
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov rax, qword [rax + 0x30]
mov rax, qword [rax + 0xa0]
test byte [rax], al
mov rcx, qword [rsp + 0x30]
add qword [rax + 0x16a8], rcx
mov rcx, qword [rsp + 0x38]
add qword [rax + 0x16b0], rcx
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
cmp word [rbx + 0x5e], 0
je 0x4231ca
movzx ecx, byte [rbx + 0x65]
cmp cl, 0x40
sbb rax, rax
shr rdx, cl
and rax, rdx
jmp 0x4230d5
movzx ecx, byte [rbx + 0x65]
cmp cl, 0x40
sbb rax, rax
movzx esi, byte [rbx + 0x66]
cmp sil, 0x40
sbb rdi, rdi
shr rdx, cl
and rax, rdx
movzx edx, word [rbx + 0x5c]
imul rax, rdx
mov ecx, esi
shr rax, cl
and rax, rdi
jmp 0x4230d5
mov ecx, 0x40
nop
call fcn.0046cc00
lea rax, [0x006abc66]
mov qword [rsp], rax
mov qword [rsp + 8], 0x2c
call fcn.00439220
nop
int3