joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180142f60
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x88
lea rbp, [rsp + 0xc0]
xor eax, eax
mov qword [rbp - 0x48], rax
mov qword [rbp + 0x10], rcx
mov rsi, rdx
mov rdi, r8
mov rbx, r9
xor edx, edx
mov dword [rbp - 0x40], edx
lea rdx, [rbp - 0x40]
cmp dword [rcx], ecx
call fcn.18011ce80
mov rcx, qword [rbp + 0x10]
mov rdx, qword [rcx + 8]
test rsi, rsi
je 0x180142fb1
add rsi, 0xc
jmp 0x180142fb3
xor esi, esi
mov qword [rbp - 0x48], rsi
mov r14, qword [rbp + 0x30]
mov qword [rsp + 0x20], r14
mov r14, qword [rbp + 0x38]
mov qword [rsp + 0x28], r14
mov rcx, rdx
mov qword [rbp - 0x50], rcx
mov rdx, rsi
mov qword [rbp - 0x58], rdx
mov r8, rdi
mov qword [rbp - 0x60], r8
mov r9, rbx
mov qword [rbp - 0x68], r9
lea rcx, [rbp - 0x90]
call fcn.180004c30
mov rcx, qword [rbp - 0x50]
mov rdx, qword [rbp - 0x58]
mov r8, qword [rbp - 0x60]
mov r9, qword [rbp - 0x68]
call sub.ADVAPI32.dll_RegQueryValueExW
mov esi, eax
lea rcx, [rbp - 0x90]
call fcn.180004c80
nop
xor ecx, ecx
mov qword [rbp - 0x48], rcx
cmp byte [rbp - 0x40], 0
je 0x18014302c
mov rcx, qword [rbp + 0x10]
xor edx, edx
call fcn.18011cf10
mov eax, esi
add rsp, 0x88
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret

Function at 0x180146310
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rcx + 8]
mov rdx, qword [rcx + 0x10]
mov r8, qword [rcx + 0x18]
mov r9, qword [rcx + 0x20]
lea r10, [rdx + rdx*4]
rol r10, 7
lea r10, [r10 + r10*8]
mov r11, rdx
shl r11, 0x11
xor r8, rax
xor r9, rdx
xor rdx, r8
xor rax, r9
xor r8, r11
rol r9, 0x2d
mov qword [rcx + 8], rax
mov qword [rcx + 0x10], rdx
mov qword [rcx + 0x18], r8
mov qword [rcx + 0x20], r9
mov rax, r10
shr rax, 0x21
cmp rax, 0x7fffffff
je fcn.180146310
ret

Function at 0x180154930
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x88
lea rbp, [rsp + 0xc0]
xor eax, eax
mov qword [rbp - 0x48], rax
mov qword [rbp + 0x10], rcx
mov rsi, rdx
mov rdi, r8
mov rbx, r9
xor edx, edx
mov dword [rbp - 0x40], edx
lea rdx, [rbp - 0x40]
cmp dword [rcx], ecx
call fcn.18011ce80
mov rcx, qword [rbp + 0x10]
mov rdx, qword [rcx + 8]
test rsi, rsi
je 0x180154981
add rsi, 0xc
jmp 0x180154983
xor esi, esi
mov qword [rbp - 0x48], rsi
mov r14, qword [rbp + 0x30]
mov qword [rsp + 0x20], r14
mov r14, qword [rbp + 0x38]
mov qword [rsp + 0x28], r14
mov rcx, rdx
mov qword [rbp - 0x50], rcx
mov rdx, rsi
mov qword [rbp - 0x58], rdx
mov r8, rdi
mov qword [rbp - 0x60], r8
mov r9, rbx
mov qword [rbp - 0x68], r9
lea rcx, [rbp - 0x90]
call fcn.180004c30
mov rcx, qword [rbp - 0x50]
mov rdx, qword [rbp - 0x58]
mov r8, qword [rbp - 0x60]
mov r9, qword [rbp - 0x68]
call sub.ADVAPI32.dll_RegQueryValueExW
mov esi, eax
lea rcx, [rbp - 0x90]
call fcn.180004c80
nop
xor ecx, ecx
mov qword [rbp - 0x48], rcx
cmp byte [rbp - 0x40], 0
je 0x1801549fc
mov rcx, qword [rbp + 0x10]
xor edx, edx
call fcn.18011cf10
mov eax, esi
add rsp, 0x88
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x18017d600
Capabilities:
Hash data using murmur3

Disassembly:
push rdi
push rsi
sub rsp, 0x28
mov esi, ecx
cmp edx, 0xffffffff
jne 0x18017d614
mov edi, 0xd5313557
jmp 0x18017d63b
mov ecx, edx
call fcn.18017d530
mov rdx, rax
lea rcx, [0x180377b48]
lea r8, [0x18037ac48]
call fcn.180091930
mov rcx, rax
call fcn.18017d4c0
mov edi, eax
mov eax, edi
rol eax, 0xd
add eax, edi
mov edi, eax
xor edi, esi
mov eax, edi
rol eax, 0xf
add eax, edi
add rsp, 0x28
pop rsi
pop rdi
ret

Function at 0x1801c3660
Capabilities:
Hash data using murmur3

Disassembly:
xor eax, eax
mov r8d, dword [rdx + 8]
test r8d, r8d
jle 0x1801c369e
mov r9d, eax
lea r9, [rdx + r9*8 + 0x10]
mov r9, qword [r9]
mov r10, r9
test r10, r10
jne 0x1801c3683
xor r10d, r10d
jmp 0x1801c3687
mov r10d, dword [r9 + 0x14]
mov r9d, ecx
rol r9d, 0xd
add r9d, ecx
mov ecx, r9d
xor ecx, r10d
inc eax
cmp r8d, eax
jg 0x1801c366b
mov eax, ecx
rol eax, 0xf
add eax, ecx
ret

Function at 0x1801c6560
Capabilities:
Hash data using murmur3

Disassembly:
push rdi
push rsi
sub rsp, 0x28
mov esi, ecx
mov edi, edx
call fcn.1800010db
mov eax, dword [rax]
add eax, 0x165667b1
add eax, 8
imul edx, esi, 0xc2b2ae3d
add edx, eax
rol edx, 0x11
imul eax, edx, 0x27d4eb2f
imul edx, edi, 0xc2b2ae3d
add edx, eax
rol edx, 0x11
imul eax, edx, 0x27d4eb2f
mov edx, eax
shr edx, 0xf
xor eax, edx
imul eax, eax, 0x85ebca77
mov edx, eax
shr edx, 0xd
xor eax, edx
imul eax, eax, 0xc2b2ae3d
mov edx, eax
shr edx, 0x10
xor eax, edx
add rsp, 0x28
pop rsi
pop rdi
ret

Function at 0x1801c65d0
Capabilities:
Hash data using murmur3

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov esi, ecx
mov edi, edx
mov ebx, r8d
call fcn.1800010db
mov eax, dword [rax]
add eax, 0x165667b1
add eax, 0xc
imul edx, esi, 0xc2b2ae3d
add edx, eax
rol edx, 0x11
imul eax, edx, 0x27d4eb2f
imul edx, edi, 0xc2b2ae3d
add edx, eax
rol edx, 0x11
imul eax, edx, 0x27d4eb2f
imul edx, ebx, 0xc2b2ae3d
add edx, eax
rol edx, 0x11
imul eax, edx, 0x27d4eb2f
mov edx, eax
shr edx, 0xf
xor eax, edx
imul eax, eax, 0x85ebca77
mov edx, eax
shr edx, 0xd
xor eax, edx
imul eax, eax, 0xc2b2ae3d
mov edx, eax
shr edx, 0x10
xor eax, edx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret

Function at 0x1801ca460
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push rdi
push rsi
push rbp
push rbx
sub rsp, 0x28
mov rsi, r8
mov edi, edx
xor ebx, ebx
mov ebp, dword [rsi + 8]
test ebp, ebp
jle 0x1801ca494
mov ecx, ebx
mov rcx, qword [rsi + rcx*8 + 0x10]
mov rax, qword [rcx]
call qword [rax + 0x28]
mov edx, edi
rol edx, 0xd
add edx, edi
mov edi, eax
xor edi, edx
inc ebx
cmp ebp, ebx
jg 0x1801ca476
mov eax, edi
rol eax, 0xf
add eax, edi
add rsp, 0x28
pop rbx
pop rbp
pop rsi
pop rdi
ret
Function at 0x1801ca4b0
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push rdi
push rsi
push rbp
push rbx
sub rsp, 0x28
mov rsi, r8
mov edi, edx
xor ebx, ebx
mov ebp, dword [rsi + 8]
test ebp, ebp
jle 0x1801ca4e4
mov ecx, ebx
mov rcx, qword [rsi + rcx*8 + 0x10]
mov rax, qword [rcx]
call qword [rax + 0x28]
mov edx, edi
rol edx, 0xd
add edx, edi
mov edi, eax
xor edi, edx
inc ebx
cmp ebp, ebx
jg 0x1801ca4c6
mov eax, edi
rol eax, 0xf
add eax, edi
add rsp, 0x28
pop rbx
pop rbp
pop rsi
pop rdi
ret
Function at 0x18001fdbd
Capabilities:
Packed with generic packer

Disassembly:
lea rbx, [rbx + 0x58911880]
mov qword [rsp + 0x30], rsi
shl r14, 0x38
add qword [rsp + 8], 0x7feb0937
or r14, rsi
setge r14b
shl si, 0xa4
not si
xchg qword [rsp + 0x38], rbx
mov rsi, qword [rsp + 0x18]
shr r14w, 0xb0
je 0x1800800c2
shr r14w, 0x4a
or qword [rsp + 0x30], 0x550dd30e
jns 0x18010e6cb
mov r14, qword [rsp + 0x28]
jne 0x1801b1ffb
invalid
js 0x180221294
shr dword [rsp + 0x30], 0x9c
call fcn.1800c881a
sbb ecx, dword [rbx - 0x588f43e6]
invalid
Function at 0x180032260
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x180032358
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x1800323c7
xor ecx, ecx
push rbx
call fcn.1801b7593
test rax, rax
je 0x1800323c7
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1800323c7
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1800323c7
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1800323c7
cmp dword [rcx + 0x84], 0xe
jbe 0x1800323c7
cmp dword [rcx + 0xf8], 0
je 0x1800323c7
mov ecx, ebx
call fcn.180032290
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.1800324ec
nop
cmp dword [rbp + 0x20], 0
je 0x180032415
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.180032324
int3

Function at 0x180032358
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x180032358
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x1800323c7
xor ecx, ecx
push rbx
call fcn.1801b7593
test rax, rax
je 0x1800323c7
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1800323c7
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1800323c7
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1800323c7
cmp dword [rcx + 0x84], 0xe
jbe 0x1800323c7
cmp dword [rcx + 0xf8], 0
je 0x1800323c7
mov ecx, ebx
call fcn.180032290
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.1800324ec
nop
cmp dword [rbp + 0x20], 0
je 0x180032415
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.180032324
int3

Function at 0x180033050
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x180033078
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x180033078
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x180065b55
Capabilities:
Encode data using xor

Disassembly:
mov rcx, qword [rsp + r13 + 0x18]
mov ecx, dword [rsp + rbp + 0x18]
sbb byte [rax], al
add byte [rax], al
add qword [rsp + r13 + 0x58], r13
or dword [rsp + r13*4 + 0x58], 0xf7293728
shl dword [rsp + r13 + 0x58], 0xc
xor r13b, r13b
mov r13b, byte [rsp + r13*8 + 0x5e]
mov r13, qword [rsp + r13*4 + 0x38]
add byte [rsp + 0x58], 0x1a
setbe byte [rsp + 0x58]
sbb cl, byte [rdi]
xchg esi, eax
and al, 0x58
call fcn.18017ff51
sbb cl, bl
pop rdx
insd dword [rdi], dx
xor dword [rsi + 0x6ed9a552], ebp
jb 0x180065b91
xchg r9b, sil
lodsd eax, dword [rsi]
adc ch, byte [rsi]
jns 0x180065b56
jp 0x180065b59
fld st(5)
jmp 0x1fd4769cc

Function at 0x180097df2
Capabilities:
Encode data using xor

Disassembly:
neg dl
mov rdx, qword [rsp + 0x18]
sub r9w, r9w
not qword [rsp + 0x10]
push rsp
and al, 0x10
shr word [rsp + 0x38], 0x70
or byte [rsp + 0x10], r9b
jo 0x180097e4d
or byte [rsp + 0x10], cl
xor r9, 0xffffffff858d17aa
xor r9d, dword [rsp + 0x39]
mov r9d, 0x23be4606
add word [rsp + r9 - 0x23be45ce], 0x44be
mov r9, qword [rsp + r9*2 - 0x477c8be4]
neg byte [rsp + 0x38]
add qword [rsp + 0x48], 0x7fdf6daf
call fcn.18020db75
rcr dword [rcx + 0x7515deb0], 0xb4
jbe 0x180097e07
mov ecx, 0x917860a9
cmp edi, dword [rsp + rbp + 0x6468dbbd]
mov cl, 0x17
test eax, 0x3b917860
mov esp, 0x68dbbd2c
mov cl, 0x17
in al, 0x94
and eax, 0x391c40eb
mov r12b, 0xc8
or eax, 0xec669293
leave
cmc
jno 0x180097e6e
add byte [rax], al
fmul st(0)
mov ah, 0xb1
pop rdx
stosb byte [rdi], al
fmul qword [rbp + 0x67b2ab32]
jp 0x180097dff
stosb byte [rdi], al
jge 0x180097e8d
fidiv dword [rbp - 0x55]
lea edi, [rax + 0x65]
scasb al, byte [rdi]
stosb byte [rdi], al
punpckhwd mm7, qword [rdi + 0x177ab20]
stosd dword [rdi], eax
ja 0x180097e91
insd dword [rdi], dx
insd dword [rdi], dx
jne 0x180097ea5
add byte [rax], al
add byte [rdx], dl
mov ah, 0x85
xor eax, 0xa77d9d65
xchg dword [rsi + riz*4 + 0x7d79795b], edx
jns 0x180097f24
or esp, dword [rax - 0x55]
cmp esi, dword [rdx + 0x58]
invalid
sbb al, 0x22
invalid

Function at 0x1800d06e6
Capabilities:
Encode data using xor

Disassembly:
push r11
movabs r11, 0xa021b01f1112583
not r14b
not r11d
setge r11b
lea rdi, [rdi + r14 - 0x2be7bfe7]
ja 0x18010ee4d
mov esi, 0x1b1cdb1d
xor edx, dword [rbx]
pop rbp
insd dword [rdi], dx
invalid
Function at 0x1800f017c
Capabilities:
Encode data using base64

Disassembly:
add word [rsp + rsi - 0x4f9770e2], 0xfc24
jle 0x1801ad9a1
pop rcx
invalid
push rdi
push r12
movabs rdi, 0x99bff6b6a7b042bf
lea rbp, [rbp + 0x1410eb9c]
setb dil
neg esi
mov r11, qword [rsp + 0x20]
jno 0x18006f964
neg cl
not byte [rsp + 0x48]
push rsp
and al, 0x48
mov r11, qword [rsp + 0x50]
shr dword [rsp + 0x60], cl
setne byte [rsp + 0x60]
call fcn.1800e9689
int 0xf1
add al, 0xf8
movsb byte [rdi], byte [rsi]
ja 0x18014e0b7
sbb bh, byte [rcx]
invalid
xchg qword [rsp + rsi - 0x4f9770c2], rbp
mov rsi, qword [rsp + 0x28]
mov r12, qword [rsp + 0x20]
not dword [rsp + 0x20]
lea r12, [r12*2 - 0x79e8bbd5]
jns 0x1802284f3
add qword [rsp + 0x10], 0x7fdb9bc3
and dil, 0x3f
and r11d, edi
lea r12, [r11 + r12*8 + 0x1882591c]
mov r11, qword [rsp + 0x18]
neg r12b
pop r12
jle 0x18014e0b4
not qword [rsp + 0x28]
shl dword [rsp + 0x18], 0xf8
mov rdi, qword [rsp]
or dword [rsp + 0x28], 0xfc86e907
not word [rsp + 0x28]
call fcn.1800c74ff
jp 0x1801ada43
enter 0xffffffffffffc3b7, 0xc
mov dl, 0x32
or byte [rax], ch
xchg r9d, eax
or eax, 0xd4e03fc4
cmp eax, dword [rbp + 0x2ac7a7ad]
sub r15b, bl
adc byte [rdi + 3], al
invalid
invalid
push r11
movabs r11, 0xa6113710f7335292
mov rax, qword [rsp + 0x10]
mov rax, qword [rax]
setg byte [rsp + 0x28]
and r11w, r10w
call fcn.18020a1be

Function at 0x18015e690
Capabilities:
Packed with generic packer

Disassembly:
and r10w, si
or esi, 0x6f11e3a0
mov qword [rsp + rsi - 0x6fffef7f], rax
or si, 0xcabf
ja 0x1801f93e4
jb 0x1801207de
add r10b, 0xa3
and r10, 0xffffffff9517d28e
add qword [rsp], 0xfffffffffffa046b
call fcn.1801da452
loopne 0x1801f946f
cmc
cmp dword [rdx], edx
invalid
xchg ebx, eax
or rax, 0x2c02c3be
wait
in al, 0x18
mov ebx, 0xe78bb48a
pushfq
pop rbx
js 0x1801f9489
stosb byte [rdi], al
mov r13b, 0xa0
invalid
invalid

Function at 0x180170abc
Capabilities:
Encode data using xor

Disassembly:
mov r10, qword [rsp + 0x58]
jne 0x1801fe212
push rdx
movabs rdx, 0xaf08c715fb066982
push rcx
call fcn.1800a15fb
adc al, dh
sbb eax, 0x9cfeb6a9
sbb eax, 0x120541e6
mov esp, 0x9d7d815c
cmp al, 0x14
pushfq
clc
cmc
mov cl, 0x2d
sub al, 0xe7
add ah, 0xc3
insd dword [rdi], dx
insd dword [rdi], dx
push rdi
invalid
js 0x1801381d6
shr byte [rsp + 0x40], 0xd7
mov rbx, qword [rsp + r15 + 0x28]
cmp byte [rsp + 0x28], 0x8c
setbe byte [rsp + 0x28]

Function at 0x18018e5d0
Capabilities:
Encode data using xor

Disassembly:
push 0xffffffffb6abeda5
shr qword [rsp], 0xe2
xor r14d, dword [rsp + 3]
loop 0x18018e620
xor esi, dword [rsp + 3]
add qword [rsp + 0x20], 0x46ef4
mov rax, r14
call fcn.1801242fb
outsb dx, byte [rsi]
test byte [rdi], bl
jae 0x18018e5da
sub byte [rcx + 0x57bcf00f], dh
sub esi, dword [rax + rbx*2]
xor dword [rdi + 0xb671448], ebx
mov word [rax + 0x71], ss
invalid
invalid
Function at 0x1801b2001
Capabilities:
Encode data using xor

Disassembly:
push r15
mov qword [rsp + 0x18], rbx
movabs r15, 0xc08e122ef9a28d11
lea r15, [r12*2 - 0x6ef9b06c]
mov r15d, 0x9c06b010
push 0xffffffff96216830
and r15d, 0x261d3a3b
xor byte [rsp], 0xaf
or qword [rsp + r15 - 0x4043010], 0xffffffff9e12d506
call fcn.1801ef254
js 0x1801b2011
invalid
add qword [rsp + 8], 0x7ff7361f
movabs rbp, 0xaebcae30110b25a6
or bpl, 0xa6
scasb al, byte [rdi]
mov esp, 0xcd8040ae
cmpsb byte [rsi], byte [rdi]
shr ebp, 0x9b
js 0x1801a4319
lea rdx, [rdx + rbp - 0x19713cf5]
movsx r9d, bpl
mov qword [rsp + r9 + 0x46], r9
sub ebp, ebp
jb 0x1801d81fa
call fcn.1801720e6
jg 0x1801b20a5
sub byte [0x1c1c20340], bh
in al, dx
loop 0x1801b1ff0
in al, dx
xor byte [rcx + rax*2], bh
imul edi, dword [0x1339681ea], 0x67960aae
mov word [rbx + 0x5606b8f7], fs
push rsp
insd dword [rdi], dx
int1
xor bl, bh
in al, 1
jg 0x1801b2048
in al, 0x3f
invalid
and edx, dword [rdi]
invalid
sub r14d, 0x882c950c

Function at 0x1801e6b90
Capabilities:
Encode data using xor

Disassembly:
js 0x1801dc4d2
lea rbx, [rbx - 0x50f0144e]
Function at 0x1801ee39c
Capabilities:
Encode data using xor

Disassembly:
mov esi, dword [rbp]
mov rbx, qword [r15 + rsi*8 + 0x59300]
nop
test rbx, rbx
je 0x180038fa2
cmp rbx, r14
jne 0x180039061
jmp 0x18003900d
mov r15, qword [r15 + rsi*8 + 0x45308]
xor edx, edx
mov rcx, r15
mov r8d, 0x800
push rdi
call fcn.1800ad5fd
mov rbx, rax
test rax, rax
jne 0x180039041
push rdx
call fcn.1800c809a
cmp eax, 0x57
jne 0x180038ffb
lea r8d, [rbx + 7]
mov rcx, r15
lea rdx, str.api_ms_
call fcn.180039120
test eax, eax
je 0x180038ffb
xor r8d, r8d
xor edx, edx
mov rcx, r15
call fcn.1800efbd3
invalid
mov rax, r14
lea r15, sym.sqlite3.dll_Ordinal_258
xchg qword [r15 + rsi*8 + 0x59300], rax
add rbp, 4
cmp rbp, r12
jne 0x180038f86
xchg qword [r15 + rdi*8 + 0x59318], r14
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov rax, rbx
lea r15, sym.sqlite3.dll_Ordinal_258
xchg qword [r15 + rsi*8 + 0x59300], rax
test rax, rax
je 0x180039061
mov rcx, rbx
call qword [0x180053a80]
mov rdx, r13
mov rcx, rbx
call qword [0x180053b18]
test rax, rax
je 0x18003901a
mov rcx, rax
xchg qword [r15 + rdi*8 + 0x59318], rcx
jmp 0x180039024
lea rcx, [rcx + rbp*2 - 0x79092c2e]
add qword [rsp + rbp*4 - 0x68455078], 0xfffffffffffc5d95
push rbp
call fcn.1800a27f1
neg byte [rsi]
mov ecx, 0xf91e01e7
cmp ecx, esp
add dword [rcx + 0x11], edx
sub byte [rcx + 0x61], cl
loope 0x180074d10
outsd dx, dword [rsi]
leave
invalid
lahf
sbb al, 3
invalid
jno 0x1801d0f62
movsd dword [rdi], dword [rsi]
mov word [rdi], ds
invalid
push r14
add qword [rsp + 0x20], 0xfffffffffff2b3f4
mov r14, qword [rsp + 0x30]
add word [rsp + 0x30], r14w
mov qword [rsp + 0x48], rcx
movsx r14d, r14b
ja 0x180038fc4
xor qword [rsp + r14 + 0x2f], r14
jg 0x180074c82
add qword [rsp + r14 + 0xf], 0x7fec41cd
push r15
add qword [rsp + 0x40], 0x949ef
call fcn.18025279d
lea rcx, [rcx + 1]
setne byte [rsp + 0x28]
jge 0x180174b69
mov eax, 0x2ab4abef
jp 0x1801ee412
sbb byte [0x1f7bb3189], al
invalid
fucomi st(6)
sbb dword [rdx], 0xe43a5783
xor dword [rbp - 0x16], ebx
hlt

Function at 0x1801f2870
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rax + r12 - 0x70b1a3af]
lea r10, [r11 + r11*2 + 0x6227b566]
js 0x1801449a3
mov esi, 0x95b2eef1
test eax, 0xf92562be
invalid

Function at 0x18020129f
Capabilities:
Packed with generic packer

Disassembly:
je 0x180208817
and r11d, r8d
mov r11, qword [rsp + r14*8 - 0xa8]
jl 0x18001f9ee
call fcn.18011fc89

Function at 0x1802400c4
Capabilities:
Encode data using xor

Disassembly:
or word [rsp + 0x28], 0x93ad
setbe byte [rsp + 0x18]
push qword [rsp + 0x40]
popfq
lea rsp, [rsp + 0x50]
ret
push qword [rsp + 8]
popfq
lea rsp, [rsp + 0x18]
call fcn.180278b88
js 0x18020530f
cli
xor eax, 0x664e0488
movabs eax, dword [0xb1ac94ae6e4f96be]
mov ch, 0x29
call 0x17f48af47
sub bh, bh
push rcx
loope 0x180205322
ror esi, cl
invalid
jb 0x180116535
and byte [rsp + 0x18], 0x31
add qword [rsp], 0x7ff97646
and qword [rsp + 0x30], 0xffffffffa2177602
jo 0x1800e4284
jg 0x1801779dd
mov qword [rsp + 0x18], 0xffffffff8e963c2d
mov r10, qword [rsp + r10*2 - 0x98b1c34]
jne 0x1802052fd
invalid
Function at 0x18024b28d
Capabilities:
Encode data using xor

Disassembly:
and byte [rsp + 0x40], r11b
and qword [rsp + 0x40], r12
setno r12b
mov r12, qword [rsp + 0x60]
and al, 0x60
mov r15, qword [rsp + 0x18]
test word [rsp + 0x41], r11w
call int.1801ba04b
test esi, eax
stc
in eax, 0xb8
and bl, bh
movabs al, byte [0xe0efd35408cf139c]
pushfq
xor ecx, dword [rdi + 0x78]
push rbx
outsd dx, dword [rsi]
mov eax, 0xb90f1384
mov esp, 0xe28d7186
mov esi, 0x86b8a5b9
loope 0x18024b29e
movsd dword [rdi], dword [rsi]
mov edi, dword [rdx - 0x53]
invalid
Function at 0x1410e4058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1410e41df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1410e4089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1410e406f
add dl, dl
jne 0x1410e4096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1410e40f6
xor eax, eax
add dl, dl
jne 0x1410e40a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1410e41ad
add dl, dl
jne 0x1410e40b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1410e40c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1410e40d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1410e40dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1410e40ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1410e407e
mov eax, 1
add dl, dl
jne 0x1410e4106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1410e4113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1410e40fb
sub eax, ebx
mov ebx, 1
jne 0x1410e414c
mov ecx, 1
add dl, dl
jne 0x1410e412e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1410e413b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1410e4123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1410e407e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1410e4168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1410e4175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1410e415d
cmp eax, 0x7d00
jae 0x1410e419b
cmp eax, 0x500
jb 0x1410e4196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1410e407e
cmp eax, 0x7f
ja 0x1410e419e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1410e407e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1410e41d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1410e407e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140002050
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x1400020ad
lea rbx, [0x14004e400]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x140002094
cmp r10, 2
jb 0x140002094
cmp byte [r9], r8b
jne 0x140002094
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x140002070
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x1400020ef
lea rbx, [0x14004e400]
cmp r8b, 0x23
jne 0x1400020d3
cmp byte [r9], r8b
jne 0x1400020d3
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x1400020c0
mov rbx, qword [rsp + 8]
not eax
ret