joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14004f418
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rdi
push r15
lea rbp, [rsp - 0x1040]
mov eax, 0x1140
call fcn.140026960
sub rsp, rax
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rsp + 0x1178], rbx
mov rax, qword [0x14007a0b8]
xor rax, rsp
mov qword [rbp + 0x1030], rax
movsxd rdi, r8d
mov rbx, rcx
mov qword [rbp + 0x418], rcx
movdqa xmm0, xmmword [0x1400560d0]
movdqu xmmword [rsp + 0x60], xmm0
mov byte [rsp + 0x50], 0
lea rcx, [rsp + 0x50]
call fcn.1400205e8
nop
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x30]
call fcn.14001656c
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x14004f4cc
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004f4c7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004f6e7
call fcn.140025f60
movdqa xmm0, xmmword [0x1400560d0]
movdqu xmmword [rsp + 0x60], xmm0
mov byte [rsp + 0x50], 0
mov r15d, 0x400
mov r8d, r15d
xor edx, edx
lea rcx, [rbp + 0x430]
call fcn.140027800
xor r9d, r9d
mov r8, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x30]
sub r8, rdx
je 0x14004f52c
lea rcx, [rbp + 0x430]
lea rax, [rbp + 0x430]
sub rdx, rax
mov al, byte [rdx + rcx]
mov byte [rcx], al
inc r9d
inc rcx
movsxd rax, r9d
cmp rax, r8
jb 0x14004f519
mov r8, r15
xor edx, edx
lea rcx, [rbp + 0xc30]
call fcn.140027800
xor eax, eax
mov qword [rbp + 0x418], rax
mov qword [rbp + 0x420], rax
mov r8, r15
xor edx, edx
lea rcx, [rbp + 0x830]
call fcn.140027800
mov word [rbp + 0x40e], 0x3939
mov dword [rbp + 0x3f0], 0x37383843
mov dword [rbp + 0x3ff], 0x42324436
mov dword [rbp + 0x3f5], 0x44433234
mov word [rbp + 0x408], 0x4342
mov dword [rbp + 0x403], 0x42413436
mov word [rbp + 0x3fc], 0x3945
mov word [rbp + 0x3f9], 0x4132
mov byte [rbp + 0x410], 0
mov byte [rbp + 0x3fb], 0x37
mov byte [rbp + 0x3f4], 0x44
mov word [rbp + 0x40b], 0x3836
mov byte [rbp + 0x40a], 0x46
mov byte [rbp + 0x407], 0x43
mov byte [rbp + 0x3fe], 0x46
mov byte [rbp + 0x40d], 0x46
lea r8, [rbp + 0x3f0]
mov rdx, r15
lea rcx, [rbp + 0x830]
call fcn.14002d1c8
lea rcx, [rsp + 0x70]
call fcn.14004fde8
nop
mov dword [rsp + 0x20], 0x10
mov r9d, 0x20
lea r8, [rbp + 0x418]
lea rdx, [rbp + 0x830]
lea rcx, [rsp + 0x70]
call fcn.140004698
mov r9, qword [rsp + 0x38]
sub r9, qword [rsp + 0x30]
mov dword [rsp + 0x20], 1
lea r8, [rbp + 0xc30]
lea rdx, [rbp + 0x430]
lea rcx, [rsp + 0x70]
call fcn.14000b89c
and qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
lea rdx, [rbp + 0xc30]
add rdx, rdi
mov rcx, rbx
call fcn.1400205e8
nop
lea rcx, [rsp + 0x70]
call fcn.140004684
nop
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14004f6bb
mov rdx, qword [rsp + 0x40]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004f6b6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004f6e1
call fcn.140025f60
mov rax, rbx
mov rcx, qword [rbp + 0x1030]
xor rcx, rsp
call fcn.140026000
mov rbx, qword [rsp + 0x1178]
add rsp, 0x1140
pop r15
pop rdi
pop rbp
ret
call fcn.14002a434
nop
call fcn.14002a434
nop
int3
Function at 0x14004fe00
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x40
xor ebx, ebx
mov r15, r9
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
cmp byte [rcx + 8], bl
je 0x14004fff0
test r9, r9
je 0x14004ffcd
movsxd r9, dword [rcx + 0x3d0]
xor edx, edx
mov rax, r15
div r9
test rdx, rdx
jne 0x14004ffcd
cmp dword [rsp + 0x80], 1
jne 0x14004feff
mov r12d, ebx
test rax, rax
je 0x14004fee0
lea r14, [rcx + 0x3f8]
mov rcx, r14
cmp byte [rdi + 8], bl
je 0x140050013
mov r8d, ebx
test r9d, r9d
jle 0x14004fea0
mov rdx, rbp
sub rdx, r14
mov al, byte [rdx + rcx]
inc r8d
xor byte [rcx], al
inc rcx
cmp r8d, dword [rdi + 0x3d0]
jl 0x14004fe8c
mov r8, rsi
mov rdx, r14
mov rcx, rdi
call fcn.14000b554
movsxd r8, dword [rdi + 0x3d0]
mov rdx, rsi
mov rcx, r14
call fcn.1400273a0
movsxd r9, dword [rdi + 0x3d0]
xor edx, edx
mov rax, r15
inc r12d
div r9
add rbp, r9
movsxd rcx, r12d
add rsi, r9
cmp rcx, rax
jb 0x14004fe72
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r12
ret
cmp dword [rsp + 0x80], 2
jne 0x14004ff92
mov r12d, ebx
test rax, rax
je 0x14004fee0
lea r14, [rcx + 0x3f8]
mov r8, rsi
mov rdx, r14
mov rcx, rdi
call fcn.14000b554
mov rcx, rsi
cmp byte [rdi + 8], bl
je 0x140050036
mov eax, dword [rdi + 0x3d0]
mov r8d, ebx
test eax, eax
jle 0x14004ff5f
mov rdx, rbp
sub rdx, rsi
mov al, byte [rdx + rcx]
inc r8d
xor byte [rcx], al
inc rcx
mov eax, dword [rdi + 0x3d0]
cmp r8d, eax
jl 0x14004ff49
movsxd r8, eax
mov rdx, rsi
mov rcx, r14
call fcn.1400273a0
movsxd rcx, dword [rdi + 0x3d0]
xor edx, edx
mov rax, r15
inc r12d
div rcx
add rbp, rcx
add rsi, rcx
movsxd rcx, r12d
cmp rcx, rax
jb 0x14004ff1c
jmp 0x14004fee0
test rax, rax
je 0x14004fee0
mov r8, rsi
mov rdx, rbp
mov rcx, rdi
call fcn.14000b554
movsxd rcx, dword [rdi + 0x3d0]
xor edx, edx
mov rax, r15
inc ebx
div rcx
add rbp, rcx
add rsi, rcx
movsxd rcx, ebx
cmp rcx, rax
jb 0x14004ff9b
jmp 0x14004fee0
mov rdx, qword [0x14007b190]
lea rcx, [rsp + 0x20]
call fcn.14002153c
lea rdx, [0x140078610]
lea rcx, [rsp + 0x20]
call fcn.140027b9c
int3
mov rdx, qword [0x14007b188]
lea rcx, [rsp + 0x20]
call fcn.14002153c
lea rdx, [0x140078610]
lea rcx, [rsp + 0x20]
call fcn.140027b9c
int3
mov rdx, qword [0x14007b188]
lea rcx, [rsp + 0x20]
call fcn.14002153c
lea rdx, [0x140078610]
lea rcx, [rsp + 0x20]
call fcn.140027b9c
int3
mov rdx, qword [0x14007b188]
lea rcx, [rsp + 0x20]
call fcn.14002153c
lea rdx, [0x140078610]
lea rcx, [rsp + 0x20]
call fcn.140027b9c
int3
Function at 0xe28058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00e281df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, pe_nt_image_headers64
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0xe28089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0xe2806f
add dl, dl
jne 0xe28096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0xe280f6
xor eax, eax
add dl, dl
jne 0xe280a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0xe281ad
add dl, dl
jne 0xe280b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xe280c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xe280d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xe280dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0xe280ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0xe2807e
mov eax, 1
add dl, dl
jne 0xe28106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xe28113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0xe280fb
sub eax, ebx
mov ebx, 1
jne 0xe2814c
mov ecx, 1
add dl, dl
jne 0xe2812e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xe2813b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0xe28123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0xe2807e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xe28168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xe28175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0xe2815d
cmp eax, 0x7d00
jae 0xe2819b
cmp eax, 0x500
jb 0xe28196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0xe2807e
cmp eax, 0x7f
ja 0xe2819e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0xe2807e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0xe281d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0xe2807e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1401ad9b4
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
movsxd r8, dword [0x14000003c]
lea rsi, [0x140000000]
add r8, rsi
mov rbx, rdx
mov rdi, rcx
cmp dword [r8 + 0x84], 0xd
jbe 0x1401ada2c
mov r10d, dword [r8 + 0xf0]
xor r9d, r9d
test r10d, r10d
je 0x1401ada2c
movzx ecx, word [r8 + 0x14]
movzx r11d, word [r8 + 6]
add rcx, 0x18
mov r10d, dword [r10 + rsi + 0xc]
add rcx, r8
test r11d, r11d
je 0x1401ada2c
mov eax, dword [rcx + 0xc]
cmp r10d, eax
jb 0x1401ada20
mov edx, dword [rcx + 8]
add eax, edx
cmp r10d, eax
jb 0x1401ada3e
inc r9d
add rcx, 0x28
cmp r9d, r11d
jb 0x1401ada0e
xor eax, eax
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
mov dword [rdi], edx
mov eax, dword [rcx + 0x24]
mov dword [rbx], eax
mov eax, dword [rcx + 0xc]
add rax, rsi
jmp 0x1401ada2e

Function at 0x1401b0110
Capabilities:
Access peb ldr_data

Disassembly:
push rdi
push r9
push rax
sub rdi, rdi
add rdi, 0x60
mov r9, qword gs:[rdi]
push rdx
mov rdx, qword [r9 + 0x10]

Function at 0x1401b0494
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1401b04de
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1401b04de
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1401b04de
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1401b04de
cmp dword [rcx + 0x84], 0xe
jbe 0x1401b04de
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1401b04e0
xor al, al
add rsp, 0x28
ret

Function at 0x1401bcc30
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
xor edi, edi
mov esi, edx
mov rbp, rcx
test r8, r8
jne 0x1401bcc67
call fcn.1401bf98c
mov dword [rax], 0x16
call fcn.1401b6524
xor eax, eax
jmp 0x1401bccf5
mov rdx, r9
mov rcx, r8
call fcn.1401bcb04
mov rbx, rax
test rax, rax
je 0x1401bccf2
lea rax, [rsp + 0x50]
mov rdx, rsi
mov qword [rsp + 0x28], rax
lea r8, [0x1401bc9c0]
mov eax, dword [rsp + 0x60]
mov r9, rbx
mov rcx, rbp
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdx, rax
test rax, rax
jne 0x1401bccdf
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1401bf900
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x1401bccc6
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x1401bccd5
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, rbx
call fcn.1401c3da0
jmp 0x1401bccf2
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1401bccef
mov eax, dword [rsp + 0x50]
mov dword [rcx], eax
mov rdi, rdx
mov rax, rdi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x1401c2038
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1401c1e34

Function at 0x1401c5864
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x1401c587a
mov al, 1
jmp 0x1401c58da
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x1401c588b
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x1401c58d8
mov ecx, dword [rcx + 0x18]
nop
call fcn.1401c6b90
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1401c58d8
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x1401c58d8
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1401c58d8
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x1401c58da
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x1401c6ca0
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.1401bde94
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.1401bde94
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x1401c6df0
cmp rax, 0xffffffffffffffff
je 0x1401c6df0
xor edi, edi
test rbp, rbp
jle 0x1401c6d9b
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.1401c5ee8
mov rbx, rax
test rax, rax
jne 0x1401c6d28
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x1401c6d91
mov edx, 0x8000
mov ecx, r14d
call fcn.1401bfb1c
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.1401bf2f0
cmp eax, 0xffffffff
je 0x1401c6d71
cdqe
sub rbp, rax
test rbp, rbp
jg 0x1401c6d38
mov edx, r15d
mov ecx, r14d
call fcn.1401bfb1c
jmp 0x1401c6d91
cmp byte [rsi + 0x38], dil
je 0x1401c6d88
cmp dword [rsi + 0x34], 5
jne 0x1401c6d88
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x1401c6d91
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.1401c3da0
jmp 0x1401c6e04
jns 0x1401c6e04
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.1401bde94
cmp rax, 0xffffffffffffffff
jne 0x1401c6dbc
cmp byte [rsi + 0x30], dil
je 0x1401c6e04
mov edi, dword [rsi + 0x2c]
jmp 0x1401c6e04
mov ecx, r14d
call fcn.1401c6b90
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1401c6e04
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x1401c6e04
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x1401c6dfd
mov eax, dword [rsi + 0x2c]
jmp 0x1401c6e02
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.1401bde94
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x1413a2058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1413a21df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1413a2089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1413a206f
add dl, dl
jne 0x1413a2096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1413a20f6
xor eax, eax
add dl, dl
jne 0x1413a20a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1413a21ad
add dl, dl
jne 0x1413a20b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1413a20c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1413a20d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1413a20dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1413a20ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1413a207e
mov eax, 1
add dl, dl
jne 0x1413a2106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1413a2113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1413a20fb
sub eax, ebx
mov ebx, 1
jne 0x1413a214c
mov ecx, 1
add dl, dl
jne 0x1413a212e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1413a213b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1413a2123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1413a207e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1413a2168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1413a2175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1413a215d
cmp eax, 0x7d00
jae 0x1413a219b
cmp eax, 0x500
jb 0x1413a2196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1413a207e
cmp eax, 0x7f
ja 0x1413a219e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1413a207e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1413a21d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1413a207e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1806d3058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1806d31df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1806d3089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1806d306f
add dl, dl
jne 0x1806d3096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1806d30f6
xor eax, eax
add dl, dl
jne 0x1806d30a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1806d31ad
add dl, dl
jne 0x1806d30b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1806d30c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1806d30d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1806d30dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1806d30ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1806d307e
mov eax, 1
add dl, dl
jne 0x1806d3106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1806d3113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1806d30fb
sub eax, ebx
mov ebx, 1
jne 0x1806d314c
mov ecx, 1
add dl, dl
jne 0x1806d312e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1806d313b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1806d3123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1806d307e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1806d3168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1806d3175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1806d315d
cmp eax, 0x7d00
jae 0x1806d319b
cmp eax, 0x500
jb 0x1806d3196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1806d307e
cmp eax, 0x7f
ja 0x1806d319e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1806d307e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1806d31d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1806d307e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x180672058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1806721df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x180672089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x18067206f
add dl, dl
jne 0x180672096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1806720f6
xor eax, eax
add dl, dl
jne 0x1806720a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1806721ad
add dl, dl
jne 0x1806720b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1806720c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1806720d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1806720dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1806720ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x18067207e
mov eax, 1
add dl, dl
jne 0x180672106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x180672113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1806720fb
sub eax, ebx
mov ebx, 1
jne 0x18067214c
mov ecx, 1
add dl, dl
jne 0x18067212e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x18067213b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x180672123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18067207e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x180672168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x180672175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x18067215d
cmp eax, 0x7d00
jae 0x18067219b
cmp eax, 0x500
jb 0x180672196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18067207e
cmp eax, 0x7f
ja 0x18067219e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18067207e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1806721d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x18067207e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140002300
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov dword [rsp + 0x20], 0xf0000000
mov r9d, 0x18
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x140002352
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_in_CryptAcquireContextW___u__n
call fcn.140004710
jmp 0x140002464
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x800c
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x14000238f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_in_CryptCreateHash___u__n
call fcn.140004710
jmp 0x140002464
xor r9d, r9d
mov r8d, dword [rsp + 0x78]
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x1400023c4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_in_CryptHashData___u__n
call fcn.140004710
jmp 0x140002464
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8, qword [rsp + 0x38]
mov edx, 0x6610
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
jne 0x140002400
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_in_CryptDeriveKey___u__n
call fcn.140004710
jmp 0x140002464
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
jne 0x140002441
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_in_CryptDecrypt___u__n
call fcn.140004710
jmp 0x140002464
xor edx, edx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
add rsp, 0x58
ret