joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402e60
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx r8d, word [rcx + 6]
movzx eax, word [rcx + 0x14]
test r8w, r8w
lea rax, [rcx + rax + 0x18]
je 0x402ead
lea ecx, [r8 - 1]
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
cmp rdx, r8
mov rcx, r8
jb 0x402ea4
add ecx, dword [rax + 8]
cmp rdx, rcx
jb 0x402eaf
add rax, 0x28
cmp rax, r9
jne 0x402e90
xor eax, eax
ret

Function at 0x402eb0
Capabilities:
Parse pe header

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rsi, rcx
call sym.strlen
cmp rax, 8
ja 0x402f40
mov rdx, qword [0x00405450]
xor ebx, ebx
cmp word [rdx], 0x5a4d
jne 0x402f2e
movsxd rax, dword [rdx + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
jne 0x402f2e
cmp word [rax + 0x18], 0x20b
jne 0x402f2e
movzx edx, word [rax + 0x14]
lea rbx, [rax + rdx + 0x18]
movzx edx, word [rax + 6]
test dx, dx
je 0x402f40
lea eax, [rdx - 1]
lea rax, [rax + rax*4]
lea rdi, [rbx + rax*8 + 0x28]
jmp 0x402f19
add rbx, 0x28
cmp rbx, rdi
je 0x402f40
mov r8d, 8
mov rdx, rsi
mov rcx, rbx
call sym.strncmp
test eax, eax
jne 0x402f10
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
xor ebx, ebx
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret

Function at 0x402f50
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x00405450]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x402f70
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x402f78
ret
cmp word [r8 + 0x18], 0x20b
jne 0x402f70
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x402fcd
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x402fc4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x402f70
add rax, 0x28
cmp rax, r9
jne 0x402fb0
xor eax, eax
ret

Function at 0x402fd0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x00405450]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x402fef
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x402ff8
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x402fef
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x403010
Capabilities:
Parse pe header

Disassembly:
mov r8, qword [0x00405450]
xor eax, eax
cmp word [r8], 0x5a4d
jne 0x403030
movsxd rdx, dword [r8 + 0x3c]
add rdx, r8
cmp dword [rdx], 0x4550
je 0x403038
ret
cmp word [rdx + 0x18], 0x20b
jne 0x403030
movzx r8d, word [rdx + 6]
movzx eax, word [rdx + 0x14]
test r8w, r8w
lea rax, [rdx + rax + 0x18]
je 0x403080
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea rdx, [rax + rdx*8 + 0x28]
nop dword [rax]
test byte [rax + 0x27], 0x20
je 0x403077
test rcx, rcx
je 0x403030
sub rcx, 1
add rax, 0x28
cmp rdx, rax
jne 0x403068
xor eax, eax
ret

Function at 0x403090
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x00405450]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x4030af
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x4030b8
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret
Function at 0x4030d0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x00405450]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x4030f0
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x4030f8
ret
cmp word [r8 + 0x18], 0x20b
jne 0x4030f0
movzx r9d, word [r8 + 6]
sub rcx, rdx
movzx edx, word [r8 + 0x14]
test r9w, r9w
lea rdx, [r8 + rdx + 0x18]
je 0x4030f0
lea eax, [r9 - 1]
lea rax, [rax + rax*4]
lea r9, [rdx + rax*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rdx + 0xc]
cmp rcx, r8
mov rax, r8
jb 0x403144
add eax, dword [rdx + 8]
cmp rcx, rax
jb 0x403150
add rdx, 0x28
cmp r9, rdx
jne 0x403130
xor eax, eax
ret
mov eax, dword [rdx + 0x24]
not eax
shr eax, 0x1f
ret

Function at 0x403160
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov r11, qword [0x00405450]
xor r9d, r9d
cmp word [r11], 0x5a4d
jne 0x403182
movsxd r8, dword [r11 + 0x3c]
add r8, r11
cmp dword [r8], 0x4550
je 0x403190
mov rax, r9
ret
cmp word [r8 + 0x18], 0x20b
jne 0x403182
mov eax, dword [r8 + 0x90]
test eax, eax
je 0x403182
movzx r10d, word [r8 + 6]
movzx edx, word [r8 + 0x14]
test r10w, r10w
lea rdx, [r8 + rdx + 0x18]
je 0x403182
lea r8d, [r10 - 1]
lea r8, [r8 + r8*4]
lea r10, [rdx + r8*8 + 0x28]
nop word cs:[rax + rax]
mov r9d, dword [rdx + 0xc]
cmp rax, r9
mov r8, r9
jb 0x4031e5
add r8d, dword [rdx + 8]
cmp rax, r8
jb 0x4031f8
add rdx, 0x28
cmp r10, rdx
jne 0x4031d0
xor r9d, r9d
mov rax, r9
ret
add rax, r11
jmp 0x403207
sub ecx, 1
add rax, 0x14
mov r8d, dword [rax + 4]
test r8d, r8d
jne 0x403217
mov edx, dword [rax + 0xc]
test edx, edx
je 0x4031ee
test ecx, ecx
jg 0x403200
mov r9d, dword [rax + 0xc]
add r9, r11
mov rax, r9
ret

Function at 0x403480
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Initialize winsock library

Disassembly:
sub rsp, 0x28
call sym.__main
mov rax, qword [0x004054f0]
xor edx, edx
mov rcx, qword [rax]
mov rax, qword [0x00405510]
mov r9d, dword [rax]
mov rax, qword [0x00405500]
mov r8, qword [rax]
add rsp, 0x28
jmp sym.WinMain
Function at 0x417b80
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x60
mov r13d, edx
xor edx, edx
mov rbp, r8
mov r14, rcx
lea r8d, [rdx + 0x40]
lea rcx, [rsp + 0x20]
mov rsi, r9
call fcn.0044e0f0
xor ebx, ebx
test rbp, rbp
je 0x417c4d
mov rdi, qword [rsp + 0xc8]
mov r12, qword [rsp + 0xc0]
test rdi, rdi
je 0x417bdc
test bl, bl
jne 0x417bdc
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x10]
test eax, eax
jne 0x417c4f
mov rax, qword [r12]
mov rcx, r12
call qword [rax + 0x18]
mov r11, qword [r12]
mov r8d, r13d
mov rdx, r14
mov rcx, r12
call qword [r11 + 0x20]
mov r11, qword [r12]
lea rdx, [rsp + 0x20]
mov rcx, r12
call qword [r11 + 0x28]
mov r11, qword [r12]
mov rcx, r12
call qword [r11 + 0x30]
cmp eax, 0x40
ja 0x417c5e
xor ecx, ecx
test eax, eax
je 0x417c38
lea r8d, [rax - 1]
lea rdx, [rsp + 0x20]
shr r8d, 2
inc r8d
xor ecx, dword [rdx]
add rdx, 4
dec r8
jne 0x417c2d
test rsi, rsi
je 0x417c41
cmp ecx, dword [rsi]
jne 0x417c5e
inc rbx
cmp rbx, rbp
jb 0x417bc6
xor eax, eax
add rsp, 0x60
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov eax, 1
jmp 0x417c4f

Function at 0x417c68
Capabilities:
Encode data using xor

Disassembly:
test edx, edx
je 0x417dfb
mov eax, edx
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
dec rax
jne 0x417c72
mov eax, ecx
ret
Function at 0x417e90
Capabilities:
Encode data using xor

Disassembly:
xor r10d, r10d
mov r11, rcx
cmp rdx, r10
jbe 0x417ed8
mov r9d, dword [r8]
mov ecx, dword [r8 + 4]
movzx eax, r9w
shr r9d, 0x10
imul eax, eax, 0x9069
add eax, r9d
mov dword [r8], eax
movzx eax, cx
shr ecx, 0x10
imul eax, eax, 0x4650
add eax, ecx
mov dword [r8 + 4], eax
xor al, byte [r8 + 8]
mov byte [r10 + r11], al
inc r10
cmp r10, rdx
jb 0x417e9b
mov rcx, r11
jmp fcn.00417e50

Function at 0x418ca8
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, qword [rcx + 8]
mov r13, qword [rcx]
xor r9d, r9d
test rbp, rbp
lea r12d, [r9 + 1]
mov r14d, r8d
mov r15d, edx
mov ebx, 0x159a55e5
mov edi, 0x1f123bb5
mov r10d, r12d
mov r11d, r12d
je 0x418e58
movzx ecx, bx
shr ebx, 0x10
imul ecx, ecx, 0x9069
add ebx, ecx
movzx ecx, di
shr edi, 0x10
mov edx, ebx
shl edx, 0x10
imul ecx, ecx, 0x4650
add edi, ecx
add edx, edi
xor edx, r14d
mov eax, edx
shr edx, 1
and eax, r12d
je 0x418e45
cmp r9d, 0x400
jb 0x418e45
mov ecx, edx
shr edx, 2
mov r8d, r12d
and ecx, 3
inc ecx
shl r8d, cl
sub r8d, r12d
and r8d, edx
shr edx, cl
mov eax, edx
inc r8d
shr edx, 3
and eax, 7
je 0x418e11
mov ecx, edx
shr edx, 2
mov eax, r12d
and ecx, 3
inc ecx
shl eax, cl
sub eax, r12d
and eax, edx
shr edx, cl
add r8d, eax
jmp 0x418d69
add r11d, r12d
mov ecx, r11d
mov eax, r12d
shl eax, cl
cmp eax, r9d
jb 0x418d66
cmp r15d, r11d
mov ecx, 5
mov esi, r15d
cmova esi, r11d
lea eax, [rcx - 1]
cmp esi, 0x15
cmovbe ecx, eax
mov eax, r12d
shl eax, cl
movzx ecx, bx
shr ebx, 0x10
lea r10d, [rax - 1]
and r10d, edx
movzx edx, di
shr edi, 0x10
imul ecx, ecx, 0x9069
add ebx, ecx
add r10d, 6
imul edx, edx, 0x4650
add edi, edx
mov edx, ebx
shl edx, 0x10
add edx, edi
xor edx, r14d
cmp r10d, esi
ja 0x418d93
mov ecx, r10d
mov r10d, 1
shl r10d, cl
dec r10d
and r10d, edx
cmp r10d, r9d
jb 0x418e08
movzx ecx, bx
shr ebx, 0x10
imul ecx, ecx, 0x9069
add ebx, ecx
movzx ecx, di
shr edi, 0x10
mov edx, ebx
imul ecx, ecx, 0x4650
add edi, ecx
shl edx, 0x10
add edx, edi
xor edx, r14d
jmp 0x418d93
mov r12d, 1
add r10d, r12d
mov eax, ebp
mov ecx, r9d
sub eax, r9d
cmp r8d, eax
cmova r8d, eax
add rcx, r13
mov eax, r10d
mov rdx, rcx
add r9d, r8d
sub rdx, rax
test r8d, r8d
je 0x418e4c
mov al, byte [rdx]
add rdx, r12
mov byte [rcx], al
add rcx, r12
sub r8, r12
jne 0x418e34
jmp 0x418e4c
mov byte [r9 + r13], dl
add r9d, r12d
mov eax, r9d
cmp rax, rbp
jb 0x418ce2
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x418f64
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x48
mov qword [rsp + 0x20], 0xfffffffffffffffe
xor edi, edi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x30], rdi
xor edx, edx
lea rcx, [0x00457a70]
call qword [0x00457a78]
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov edx, 0x500
lea rcx, [0x00457a70]
call qword [0x00457a70]
mov rbp, rax
cmp rax, rdi
jne 0x418fbe
jmp 0x41909e
mov rax, rdi
mov r10d, 0x100
mov byte [rax + rbp], al
inc rax
cmp rax, r10
jb 0x418fc7
mov r8d, 0xffffffff
mov r9, rdi
mov cl, byte [r9 + rbp]
xor cl, r8b
movzx edx, cl
lea rcx, [0x0046cca0]
mov eax, r8d
shr eax, 8
mov r8d, dword [rcx + rdx*4]
xor r8d, eax
inc r9
cmp r9, r10
jb 0x418fdb
not r8d
cmp r8d, 0x29058c73
je 0x419012
jmp 0x41909e
mov r9d, 0x159a55e5
mov r8d, 0x1f123bb5
mov rdx, rdi
movzx ecx, r9w
imul ecx, ecx, 0x9069
shr r9d, 0x10
add r9d, ecx
movzx ecx, r8w
imul ecx, ecx, 0x4650
shr r8d, 0x10
add r8d, ecx
mov dword [rsp + 0x2c], r8d
mov al, r8b
mov byte [rdx + rbp + 0x100], r8b
inc rdx
cmp rdx, 0x400
jb 0x419021
mov rsi, rdi
mov r12d, edi
lea r13, [rsi + rbp]
mov edx, r12d
mov rcx, r13
call fcn.00417e50
mov ebx, eax
mov rcx, r13
call fcn.0044da00
cmp ebx, eax
jne 0x419099
inc r12d
cmp r12d, 0x20
jb 0x419069
inc rsi
cmp rsi, 0x4e0
jb 0x419062
jmp 0x41909b
jmp 0x41909e
mov dil, 1
mov rdx, rbp
lea rcx, [0x00457a70]
call qword [0x00457a78]
mov al, dil
add rsp, 0x48
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x44e120
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rdi
cmp word [0x00400000], 0x5a4d
je 0x44e141
xor ebx, ebx
mov dword [rsp + 0x60], ebx
jmp 0x44e1bd
movsxd rax, dword [0x0040003c]
lea rcx, [0x00400000]
add rax, rcx
cmp dword [rax], 0x4550
je 0x44e162
xor ebx, ebx
mov dword [rsp + 0x60], ebx
jmp 0x44e1bd
movzx ecx, word [rax + 0x18]
cmp ecx, 0x10b
je 0x44e1a0
cmp ecx, 0x20b
je 0x44e17e
xor ebx, ebx
mov dword [rsp + 0x60], ebx
jmp 0x44e1bd
cmp dword [rax + 0x84], 0xe
ja 0x44e18f
xor ebx, ebx
mov dword [rsp + 0x60], ebx
jmp 0x44e1bd
xor ebx, ebx
cmp dword [rax + 0xf8], ebx
setne bl
mov dword [rsp + 0x60], ebx
jmp 0x44e1bd
cmp dword [rax + 0x74], 0xe
ja 0x44e1ae
xor ebx, ebx
mov dword [rsp + 0x60], ebx
jmp 0x44e1bd
xor ebx, ebx
cmp dword [rax + 0xe8], ebx
setne bl
mov dword [rsp + 0x60], ebx
mov ecx, 1
call qword [0x0044f410]
mov qword [0x0046eca8], 0xffffffffffffffff
mov qword [0x0046ecb0], 0xffffffffffffffff
mov rcx, qword [0x0044f408]
mov eax, dword [0x0046cc8c]
mov dword [rcx], eax
mov rcx, qword [0x0044f400]
mov eax, dword [0x0046cc88]
mov dword [rcx], eax
call fcn.0044cf50
cmp dword [0x0046c6b0], 0
jne 0x44e217
lea rcx, [fcn.0044cf50]
call qword [0x0044f3f8]
lea rdx, [0x0044f488]
lea rcx, [0x0044f480]
call 0x5fa000
mov r11d, dword [0x0046cc84]
mov dword [rsp + 0x68], r11d
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, dword [0x0046cc80]
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x30]
call qword [0x0044f3e8]
lea rdx, [0x0044f478]
lea rcx, [0x0044f420]
call fcn.0044e314
mov r11, qword [rsp + 0x38]
mov rax, qword [0x0044f3d8]
mov qword [rax], r11
mov r8, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x40]
mov ecx, dword [rsp + 0x30]
call fcn.0044aadc
mov edi, eax
mov dword [rsp + 0x34], eax
test ebx, ebx
jne 0x44e2a3
mov ecx, eax
call qword [0x0044f3e0]
call qword [0x0044f360]
jmp 0x44e2c4
mov eax, edi
mov rbx, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x58
ret
Function at 0x140787288
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.14078740f
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1407872b9
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14078729f
add dl, dl
jne 0x1407872c6
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140787326
xor eax, eax
add dl, dl
jne 0x1407872d5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1407873dd
add dl, dl
jne 0x1407872e6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407872f3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140787300
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14078730d
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x14078731a
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1407872ae
mov eax, 1
add dl, dl
jne 0x140787336
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140787343
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14078732b
sub eax, ebx
mov ebx, 1
jne 0x14078737c
mov ecx, 1
add dl, dl
jne 0x14078735e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14078736b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140787353
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1407872ae
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140787398
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1407873a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14078738d
cmp eax, 0x7d00
jae 0x1407873cb
cmp eax, 0x500
jb 0x1407873c6
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1407872ae
cmp eax, 0x7f
ja 0x1407873ce
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1407872ae
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140787402
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1407872ae
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x141bb8058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.141bb81df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x141bb8089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x141bb806f
add dl, dl
jne 0x141bb8096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x141bb80f6
xor eax, eax
add dl, dl
jne 0x141bb80a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x141bb81ad
add dl, dl
jne 0x141bb80b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141bb80c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141bb80d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141bb80dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x141bb80ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x141bb807e
mov eax, 1
add dl, dl
jne 0x141bb8106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141bb8113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141bb80fb
sub eax, ebx
mov ebx, 1
jne 0x141bb814c
mov ecx, 1
add dl, dl
jne 0x141bb812e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x141bb813b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141bb8123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x141bb807e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x141bb8168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x141bb8175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141bb815d
cmp eax, 0x7d00
jae 0x141bb819b
cmp eax, 0x500
jb 0x141bb8196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x141bb807e
cmp eax, 0x7f
ja 0x141bb819e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x141bb807e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x141bb81d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x141bb807e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x18000b8fc
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
movsxd rbp, r9d
mov r14, r8
test r8, r8
je 0x18000b923
and qword [r8], 0
call fcn.18000b9c8
mov rbx, rax
test rax, rax
je 0x18000b9ab
mov rcx, rax
call fcn.18000b888
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x18000b9a3
lea rcx, [rax + rbp]
call fcn.18000dbdc
mov rsi, rax
test rax, rax
je 0x18000b9a3
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call fcn.180051a20
cmp rax, rdi
je 0x18000b97c
mov rcx, rbx
call fcn.18005132c
mov rcx, rsi
call fcn.18000dc2c
jmp 0x18000b9ab
test ebp, ebp
jle 0x18000b98e
lea rcx, [rsi + rdi]
mov r8, rbp
xor edx, edx
call fcn.180074cd0
mov rcx, rbx
call fcn.18005132c
test r14, r14
je 0x18000b99e
mov qword [r14], rdi
mov rax, rsi
jmp 0x18000b9ad
mov rcx, rbx
call fcn.18005132c
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret

Function at 0x18000bd08
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov r9, rcx
not r8d
test rdx, rdx
je 0x18000bd36
movzx eax, byte [r9]
inc r9
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
lea rax, [0x1800786f0]
xor r8d, dword [rax + rcx*4]
sub rdx, 1
jne 0x18000bd13
not r8d
mov eax, r8d
ret

Function at 0x18000bd40
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
not r8d
mov r10, rcx
mov r9d, r8d
test rdx, rdx
je 0x18000bd9a
mov r11b, 0x23
lea rbx, [0x1800786f0]
movzx edi, byte [r10]
dec rdx
inc r10
cmp dil, r11b
jne 0x18000bd84
cmp rdx, 2
jb 0x18000bd84
cmp byte [r10], r11b
jne 0x18000bd84
cmp byte [r10 + 1], r11b
cmove r9d, r8d
movzx ecx, r9b
xor rcx, rdi
shr r9d, 8
xor r9d, dword [rbx + rcx*4]
test rdx, rdx
jne 0x18000bd62
jmp 0x18000bddb
mov dl, byte [rcx]
inc r10
test dl, dl
je 0x18000bddb
mov r11b, 0x23
lea rbx, [0x1800786f0]
cmp dl, r11b
jne 0x18000bdbf
cmp byte [r10], r11b
jne 0x18000bdbf
cmp byte [r10 + 1], r11b
cmove r9d, r8d
movzx ecx, r9b
movzx eax, dl
mov dl, byte [r10]
xor rcx, rax
shr r9d, 8
inc r10
xor r9d, dword [rbx + rcx*4]
test dl, dl
jne 0x18000bdad
mov rbx, qword [rsp + 8]
not r9d
mov rdi, qword [rsp + 0x10]
mov eax, r9d
ret
Function at 0x18002a660
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
call fcn.18000ae60
mov ecx, 0x11
mov rdi, rax
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov bl, 1
and al, bl
mov edx, 0x1000
mov r8b, al
mov rcx, rdi
call fcn.180004078
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov edx, 0x2000
and al, bl
mov rcx, rdi
mov r8b, al
call fcn.180004078
mov ecx, 0x12
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov edx, 0x4000
and al, bl
mov rcx, rdi
mov r8b, al
call fcn.180004078
mov ecx, 0x5b
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test bl, al
jne 0x18002a6fa
mov ecx, 0x5c
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test bl, al
jne 0x18002a6fa
xor ebx, ebx
mov r8b, bl
mov edx, 0x8000
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.180004078

Function at 0x18002a714
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
push rbx
sub rsp, 0x20
call fcn.18000ac84
test rax, rax
je 0x18002a732
call fcn.18000ae60
mov rbx, qword [rax + 0x90]
jmp 0x18002a734
xor ebx, ebx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
shr rax, 0x10
mov r9d, 4
movzx ecx, ax
lea r8, [rbx + 0x2c]
mov edx, 0x20001004
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x18002a75f
and dword [rbx + 0x2c], eax
add rsp, 0x20
pop rbx
ret
Function at 0x180042a68
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x270
mov rax, qword [0x180099380]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rsi, rcx
xor ebx, ebx
xor edx, edx
lea ecx, [rbx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x180042aff
xor edx, edx
lea rcx, [rsp + 0x24]
mov r8d, 0x234
call fcn.180074cd0
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x238
mov rcx, rdi
call sub.KERNEL32.dll_Process32FirstW
jmp 0x180042aeb
lea rdx, [rsp + 0x4c]
mov rcx, rsi
call fcn.18005cff8
test eax, eax
je 0x180042af2
lea rdx, [rsp + 0x20]
mov rcx, rdi
call sub.KERNEL32.dll_Process32NextW
cmp eax, 1
je 0x180042acd
jmp 0x180042af6
mov ebx, dword [rsp + 0x28]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.18004b080
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret