joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1005c38
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
mov dword [rax + 0x18], r8d
push r12
sub rsp, 0x30
mov edi, r8d
mov ebx, edx
mov r12d, ecx
mov ecx, 8
call fcn.01007600
nop
cmp dword [0x0100e79c], 1
je 0x1005be3
mov dword [0x0100e798], 1
mov byte [0x0100e754], dil
test ebx, ebx
jne 0x1005bcf
mov rcx, qword [0x01010750]
call sub.KERNEL32.dll_DecodePointer
mov rsi, rax
mov rcx, qword [0x01010748]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
mov qword [rsp + 0x20], rax
test rsi, rsi
je 0x1005bbc
sub rbx, 8
mov qword [rsp + 0x20], rbx
cmp rbx, rsi
jb 0x1005bbc
mov rcx, qword [rbx]
test rcx, rcx
je 0x1005bba
call rcx
jmp 0x1005ba2
lea rdx, [0x010032f8]
lea rcx, [0x010032e0]
call fcn.01005980
lea rdx, [0x01003308]
lea rcx, [0x01003300]
call fcn.01005980
nop
test edi, edi
je 0x1005bf1
mov ecx, 8
call fcn.010074f0
test edi, edi
jne 0x1005c19
mov dword [0x0100e79c], 1
lea ecx, [rdi + 8]
call fcn.010074f0
mov ecx, r12d
call fcn.01005924
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r12
ret
xor r8d, r8d
xor edx, edx
jmp 0x1005b30

Function at 0x1005c48
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
lea edx, [r8 + 1]
jmp 0x1005b30
Function at 0x1005ce8
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rdi
push r13
sub rsp, 0x30
lea r13, [0x0100d120]
mov ebx, ecx
xor edi, edi
mov rax, r13
cmp ecx, dword [rax]
je 0x1005d1a
inc edi
add rax, 0x10
cmp edi, 0x17
jb 0x1005d0b
cmp edi, 0x17
jae 0x1005ec8
mov ebp, 3
mov ecx, ebp
call fcn.01007f78
cmp eax, 1
je 0x1005e80
mov ecx, ebp
call fcn.01007f78
test eax, eax
jne 0x1005d50
cmp dword [0x0100d100], 1
je 0x1005e80
cmp ebx, 0xfc
je 0x1005ec8
lea rbx, [0x0100e7a0]
mov ebp, 0x314
lea r8, [0x01003920]
mov rcx, rbx
mov rdx, rbp
call fcn.01007f00
test eax, eax
je 0x1005d93
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.010071c8
lea rdx, [0x0100e7b9]
mov r8d, 0x104
xor ecx, ecx
mov byte [0x0100e8bd], 0
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x1005de4
lea r8, [0x01003908]
lea rcx, [0x0100e7b9]
mov edx, 0x2fb
call fcn.01007f00
test eax, eax
je 0x1005de4
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.010071c8
lea r8, [0x0100e7b9]
mov rdx, rbp
mov rcx, rbx
call fcn.01007e70
test eax, eax
je 0x1005e0f
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.010071c8
lea r8, [0x01003900]
mov rdx, rbp
mov rcx, rbx
call fcn.01007e70
test eax, eax
je 0x1005e3a
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.010071c8
movsxd r8, edi
mov rdx, rbp
mov rcx, rbx
add r8, r8
mov r8, qword [r13 + r8*8 + 8]
call fcn.01007e70
test eax, eax
je 0x1005e69
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.010071c8
lea rdx, [0x010038d8]
mov r8d, 0x12010
mov rcx, rbx
call fcn.01007c38
jmp 0x1005ec8
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov r11, rax
test rax, rax
je 0x1005ec8
or rcx, 0xffffffffffffffff
cmp rax, rcx
je 0x1005ec8
movsxd rdx, edi
xor eax, eax
lea r9, [rsp + 0x48]
and qword [rsp + 0x20], rax
add rdx, rdx
mov rdx, qword [r13 + rdx*8 + 8]
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
mov rcx, r11
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r13
ret
Function at 0x100668c
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor r12d, r12d
mov rdi, rax
cmp rax, r12
je 0x1006765
mov rbx, rax
cmp word [rax], r12w
je 0x10066d7
add rbx, 2
cmp word [rbx], r12w
jne 0x10066c3
add rbx, 2
cmp word [rbx], r12w
jne 0x10066c3
mov qword [rsp + 0x38], r12
sub rbx, rax
mov qword [rsp + 0x30], r12
sar rbx, 1
mov r8, rax
xor edx, edx
lea r9d, [rbx + 1]
xor ecx, ecx
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movsxd rbp, eax
cmp ebp, r12d
je 0x100675c
mov rcx, rbp
call fcn.01008ab0
mov rsi, rax
cmp rax, r12
je 0x100675c
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
lea r9d, [rbx + 1]
mov r8, rdi
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp eax, r12d
jne 0x100674e
mov rcx, rsi
call fcn.01008964
mov rsi, r12
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
jmp 0x1006767
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r12
ret

Function at 0x1006e64
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
cmp rcx, rdx
je 0x1006eb1
cmp rcx, 0xffffffffffffffff
je 0x1006eb1
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1006ea9
cmp dword [rcx + 0x3c], edx
jl 0x1006ea9
cmp dword [rcx + 0x3c], 0x10000000
jae 0x1006ea9
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x1006eb1
mov rax, rdx
add rsp, 0x18
ret

Function at 0x10071c8
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x530
lea rcx, [rsp + 0x60]
call qword [sym.imp.ntdll.dll_RtlCaptureContext]
mov rbx, qword [rsp + 0x158]
lea rdx, [rsp + 0x40]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.ntdll.dll_RtlLookupFunctionEntry]
test rax, rax
je 0x1007233
and qword [rsp + 0x38], 0
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x50]
mov r9, rax
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x60]
mov r8, rbx
mov qword [rsp + 0x20], rcx
xor ecx, ecx
call qword [sym.imp.ntdll.dll_RtlVirtualUnwind]
jmp 0x1007253
mov rax, qword [rsp + 0x538]
mov qword [rsp + 0x158], rax
lea rax, [rsp + 0x538]
mov qword [rsp + 0xf8], rax
lea rcx, [0x010039b0]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add rsp, 0x530
pop rbx
ret
Function at 0x1007c38
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x50
mov ebx, r8d
mov r12, rdx
mov r13, rcx
call fcn.01006a5c
xor ebp, ebp
and dword [rsp + 0x88], ebp
and dword [rsp + 0x30], ebp
mov rdi, rax
cmp qword [0x0100f3b8], rbp
jne 0x1007d70
lea rcx, [0x01003a58]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rsi, rax
test rax, rax
jne 0x1007c9c
xor eax, eax
jmp 0x1007e50
lea rdx, [0x01003a48]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1007c95
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, [0x01003a38]
mov rcx, rsi
mov qword [0x0100f3b8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, [0x01003a20]
mov rcx, rsi
mov qword [0x0100f3c0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rcx, [rsp + 0x88]
mov qword [0x0100f3c8], rax
call fcn.010059bc
test eax, eax
je 0x1007d23
and qword [rsp + 0x20], rbp
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.010071c8
cmp dword [rsp + 0x88], 2
jne 0x1007d70
lea rdx, [0x01003a00]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov qword [0x0100f3d8], rax
test rax, rax
je 0x1007d70
lea rdx, [0x010039e8]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov qword [0x0100f3d0], rax
mov rcx, qword [0x0100f3d0]
cmp rcx, rdi
je 0x1007e02
cmp qword [0x0100f3d8], rdi
je 0x1007e02
call sub.KERNEL32.dll_DecodePointer
call rax
mov rsi, rax
test rax, rax
je 0x1007dcd
mov rcx, qword [0x0100f3d8]
call sub.KERNEL32.dll_DecodePointer
lea rcx, [rsp + 0x34]
mov r9d, 0xc
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
lea r8, [rsp + 0x38]
mov rcx, rsi
call rax
test eax, eax
je 0x1007dcd
test byte [rsp + 0x40], 1
jne 0x1007e02
lea rcx, [rsp + 0x30]
call fcn.01005a08
test eax, eax
je 0x1007def
and qword [rsp + 0x20], rbp
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.010071c8
cmp dword [rsp + 0x30], 4
jb 0x1007dfc
bts ebx, 0x15
jmp 0x1007e36
bts ebx, 0x12
jmp 0x1007e36
mov rcx, qword [0x0100f3c0]
cmp rcx, rdi
je 0x1007e36
call sub.KERNEL32.dll_DecodePointer
call rax
mov rbp, rax
test rax, rax
je 0x1007e36
mov rcx, qword [0x0100f3c8]
cmp rcx, rdi
je 0x1007e36
call sub.KERNEL32.dll_DecodePointer
mov rcx, rbp
call rax
mov rbp, rax
mov rcx, qword [0x0100f3b8]
call sub.KERNEL32.dll_DecodePointer
mov r9d, ebx
mov r8, r12
mov rdx, r13
mov rcx, rbp
call rax
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
Function at 0x100b5a0
Capabilities:
Get system information on windows

Disassembly:
push rbp
push r12
push r13
sub rsp, 0x90
lea rbp, [rsp + 0x20]
mov qword [rbp + 0x90], rbx
mov qword [rbp + 0x98], rsi
mov qword [rbp + 0xa0], rdi
mov rax, qword [0x0100d380]
xor rax, rbp
mov qword [rbp + 0x68], rax
mov eax, dword [rsp]
sub rsp, 0x10
lea r12, [rsp + 0x20]
mov eax, dword [r12]
lea rdx, [rbp + 8]
mov r8d, 0x30
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x100b6a6
mov r13, qword [rbp + 0x10]
lea rcx, [rbp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edi, dword [rbp + 0x3c]
lea rcx, [rbp]
xor ebx, ebx
and dword [rbp], ebx
call qword [sym.imp.KERNEL32.dll_SetThreadStackGuarantee]
cmp eax, 1
jne 0x100b62e
mov eax, dword [rbp]
test eax, eax
cmovne ebx, eax
lea edx, [rdi - 1]
lea ecx, [rdx + rbx]
cmp ecx, ebx
jb 0x100b6a6
mov eax, edx
not eax
and ecx, eax
je 0x100b649
lea eax, [rcx + rdi]
cmp eax, ecx
jb 0x100b6a6
mov ecx, eax
lea eax, [rdi + rdi*2]
mov ebx, edx
cmp ecx, eax
not rbx
cmovb ecx, eax
and rbx, r12
lea rax, [r13 + rdi]
mov esi, ecx
sub rbx, rsi
cmp rbx, rax
jb 0x100b6a6
mov r9d, 4
mov r8d, 0x1000
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
je 0x100b6a6
lea r9, [rbp + 4]
mov r8d, 0x104
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x100b6a6
mov eax, 1
jmp 0x100b6a8
xor eax, eax
mov rcx, qword [rbp + 0x68]
xor rcx, rbp
call fcn.010057f0
mov rbx, qword [rbp + 0x90]
mov rsi, qword [rbp + 0x98]
mov rdi, qword [rbp + 0xa0]
lea rsp, [rbp + 0x70]
pop r13
pop r12
pop rbp
ret
Function at 0x1400012e0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push rbx
sub rsp, 0x190
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x180], rax
lea rax, [rsp + 0x60]
mov rbx, rcx
mov qword [rsp + 0x40], rax
lea r9, [0x140013294]
lea rax, [rsp + 0x58]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov rcx, 0xffffffff80000000
xor eax, eax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], eax
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1400013b8
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x64]
lea rax, [rsp + 0x70]
mov dword [rsp + 0x50], 0x104
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1400013bc
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rsp + 0x58]
mov r9d, 1
xor r8d, r8d
xor edx, edx
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x50], eax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x1400013bc
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x1400013cc
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.140001ec0
add rsp, 0x190
pop rbx
ret

Function at 0x1400013f0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push rsi
push rdi
sub rsp, 0x278
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rdi, rdx
mov rsi, rcx
test rdx, rdx
je 0x1400014f4
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x1400014f4
lea rax, [rsp + 0x48]
mov r9d, 0x10008
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400014f9
mov qword [rsp + 0x2a0], rbx
mov qword [rsp + 0x270], rbp
xor ebp, ebp
nop word [rax + rax]
mov rcx, qword [rsp + 0x48]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x38], rbp
lea r8, [rsp + 0x50]
mov qword [rsp + 0x30], rbp
xor edx, edx
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rbp
mov dword [rsp + 0x40], 0x104
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov ebx, eax
cmp eax, 0x103
je 0x1400014c7
test eax, eax
jne 0x1400014d5
mov rcx, qword [rsp + 0x48]
lea rdx, [rsp + 0x50]
call fcn.1400013f0
mov ebx, eax
test eax, eax
je 0x140001470
jmp 0x1400014d5
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ebx, eax
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbp, qword [rsp + 0x270]
mov eax, ebx
mov rbx, qword [rsp + 0x2a0]
jmp 0x1400014f9
mov eax, 0x3f2
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140001ec0
add rsp, 0x278
pop rdi
pop rsi
ret
Function at 0x140004198
Capabilities:
Parse pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov esi, r8d
mov ebx, edx
mov r14d, ecx
test r8d, r8d
jne 0x140003f6c
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140003f6c
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140003f6c
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140003f6c
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140003f6c
cmp dword [rcx + 0x84], 0xe
jbe 0x140003f6c
cmp dword [rcx + 0xf8], esi
je 0x140003f6c
mov ecx, r14d
call fcn.1400040b4
mov ecx, 2
call fcn.1400065e4
nop
cmp byte [0x1400161c8], 0
jne 0x140004036
mov r15d, 1
mov eax, r15d
xchg dword [0x1400161bc], eax
test ebx, ebx
jne 0x140003fdf
mov rdi, qword [section..data]
mov edx, edi
and edx, 0x3f
lea ecx, [rbx + 0x40]
sub ecx, edx
xor eax, eax
ror rax, cl
xor rax, rdi
mov rcx, qword [0x1400161c0]
cmp rcx, rax
je 0x140003fd6
xor rdi, rcx
mov ecx, edx
ror rdi, cl
mov rcx, rdi
call qword [fcn.140002760]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rdi
lea rcx, [0x1400161d8]
jmp 0x140003feb
cmp ebx, r15d
jne 0x140003ff1
lea rcx, [0x1400161f0]
call fcn.1400046a8
nop
test ebx, ebx
jne 0x140004008
lea rdx, [0x14000c390]
lea rcx, [0x14000c370]
call fcn.140003e2c
lea rdx, [0x14000c3a0]
lea rcx, [0x14000c398]
call fcn.140003e2c
movzx eax, byte [0x1400161c8]
test esi, esi
cmove eax, r15d
mov byte [0x1400161c8], al
jmp 0x140004036
mov ecx, 2
call fcn.140006638
test esi, esi
jne 0x14000404d
mov ecx, r14d
call fcn.140004068
int3
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
xor r8d, r8d
xor edx, edx
jmp 0x140003efc
Function at 0x1811a9928
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1811a9932
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x1811a995b
pop rbp
sub rbp, 0x33
sub rbp, 0x11a9928
cmp edx, 1
je 0x1811a999e
ldmxcsr dword [rsp]
add rsp, 8
popfq
pop r15
pop r14
pop r13
pop r12
pop r11
pop r10
pop r9
pop r8
pop rdi
pop rsi
pop rbp
pop rbx
pop rdx
pop rcx
pop rax
xor rax, rax
ret
sub rsp, 0x20
jmp 0x1811a99ae
mov rax, 0x11a9928
add rax, rbp
add rax, 0xb8
mov rcx, 0x60b
mov rdx, 0xffffffffa70d1f25
xor byte [rax], dl
inc rax
dec rcx
jne 0x1811a99cd
jmp 0x1811a99e4
insd dword [rdi], dx
lodsb al, byte [rsi]
int3
Function at 0x140c5b058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.140c5b1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140c5b089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140c5b06f
add dl, dl
jne 0x140c5b096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140c5b0f6
xor eax, eax
add dl, dl
jne 0x140c5b0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140c5b1ad
add dl, dl
jne 0x140c5b0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140c5b0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140c5b0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140c5b0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140c5b0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140c5b07e
mov eax, 1
add dl, dl
jne 0x140c5b106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140c5b113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140c5b0fb
sub eax, ebx
mov ebx, 1
jne 0x140c5b14c
mov ecx, 1
add dl, dl
jne 0x140c5b12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140c5b13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140c5b123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140c5b07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140c5b168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140c5b175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140c5b15d
cmp eax, 0x7d00
jae 0x140c5b19b
cmp eax, 0x500
jb 0x140c5b196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140c5b07e
cmp eax, 0x7f
ja 0x140c5b19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140c5b07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140c5b1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140c5b07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140811058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1408111df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140811089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14081106f
add dl, dl
jne 0x140811096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1408110f6
xor eax, eax
add dl, dl
jne 0x1408110a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1408111ad
add dl, dl
jne 0x1408110b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1408110c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1408110d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1408110dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1408110ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14081107e
mov eax, 1
add dl, dl
jne 0x140811106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140811113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1408110fb
sub eax, ebx
mov ebx, 1
jne 0x14081114c
mov ecx, 1
add dl, dl
jne 0x14081112e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14081113b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140811123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14081107e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140811168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140811175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14081115d
cmp eax, 0x7d00
jae 0x14081119b
cmp eax, 0x500
jb 0x140811196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14081107e
cmp eax, 0x7f
ja 0x14081119e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14081107e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1408111d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14081107e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1400198b0
Capabilities:
Encode data using xor

Disassembly:
imul ecx, dword [rdi], 0xffffff9e
sahf
xchg esp, eax
xor dh, al
push rbp
xor dword [rcx], 0x73
cli
lodsd eax, dword [rsi]
pop rdi
loope 0x1400198b2
lodsd eax, dword [rsi]
imul eax, dword [rsi - 0x48], 0xffffffff
insd dword [rdi], dx
invalid

Function at 0x140c4b058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x140c4b1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140c4b089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140c4b06f
add dl, dl
jne 0x140c4b096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140c4b0f6
xor eax, eax
add dl, dl
jne 0x140c4b0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140c4b1ad
add dl, dl
jne 0x140c4b0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140c4b0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140c4b0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140c4b0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140c4b0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140c4b07e
mov eax, 1
add dl, dl
jne 0x140c4b106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140c4b113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140c4b0fb
sub eax, ebx
mov ebx, 1
jne 0x140c4b14c
mov ecx, 1
add dl, dl
jne 0x140c4b12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140c4b13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140c4b123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140c4b07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140c4b168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140c4b175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140c4b15d
cmp eax, 0x7d00
jae 0x140c4b19b
cmp eax, 0x500
jb 0x140c4b196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140c4b07e
cmp eax, 0x7f
ja 0x140c4b19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140c4b07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140c4b1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140c4b07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20