joyce8/EMBER2024-capa huggingface dataset:
Function at 0x455e00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov rcx, qword [rsp + 0x28]
test rcx, rcx
jbe 0x455fb9
mov rdx, qword [rsp + 0x20]
movzx ebx, byte [rdx]
test ebx, ebx
jne 0x455e36
movzx esi, byte [rsp + 0x48]
test sil, sil
je 0x455f67
bt ebx, 7
nop word [rax + rax]
jae 0x455f59
xor eax, eax
xor ebx, ebx
xor esi, esi
jmp 0x455e60
lea esi, [rcx + 7]
mov rcx, rax
mov eax, r8d
nop word [rax + rax]
cmp rcx, rax
jbe 0x455fb4
movzx edi, byte [rax + rdx]
lea r8d, [rax + 1]
mov r9d, edi
and edi, 0x7f
mov rax, rcx
mov ecx, esi
shl edi, cl
or ebx, edi
test r9b, 0x80
jne 0x455e4e
mov esi, ebx
and ebx, 1
neg ebx
shr esi, 1
xor ebx, esi
mov rsi, qword [rsp + 0x40]
add dword [rsi], ebx
nop dword [rax + rax]
cmp rax, r8
jb 0x455fa9
sub rax, r8
mov rbx, qword [rsp + 0x30]
sub rbx, r8
mov rsi, rbx
neg rbx
sar rbx, 0x3f
and r8, rbx
lea rbx, [rdx + r8]
test rax, rax
jbe 0x455f9f
movzx edx, byte [rdx + r8]
bt edx, 7
jae 0x455f51
xor ecx, ecx
xor edx, edx
xor edi, edi
nop
jmp 0x455ee8
lea edi, [rcx + 7]
mov ecx, r9d
cmp rax, rcx
jbe 0x455f92
movzx r8d, byte [rcx + rbx]
lea r9d, [rcx + 1]
mov r10d, r8d
and r8d, 0x7f
mov ecx, edi
shl r8d, cl
or edx, r8d
test r10b, 0x80
jne 0x455ee2
cmp rax, r9
jb 0x455f87
mov rcx, qword [rsp + 0x38]
add qword [rcx], rdx
sub rsi, r9
mov rcx, rsi
neg rsi
sar rsi, 0x3f
and rsi, r9
lea rdx, [rbx + rsi]
mov qword [rsp + 0x50], rdx
sub rax, r9
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rcx
mov byte [rsp + 0x68], 1
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov r9d, 1
jmp 0x455f0f
mov rax, rcx
mov r8d, 1
jmp 0x455e86
mov qword [rsp + 0x50], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov byte [rsp + 0x68], 0
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov rcx, rax
mov eax, r9d
call fcn.0046d640
mov rdx, rax
mov eax, ecx
mov rcx, rdx
call fcn.0046d580
mov rcx, rax
xor eax, eax
call fcn.0046d580
mov rcx, rax
mov eax, r8d
call fcn.0046d640
call fcn.0046d580
xor eax, eax
nop dword [rax + rax]
call fcn.0046d580
nop
int3

Function at 0x45d620
Capabilities:
Access peb ldr_data

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x45d701
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov qword [rsp + 8], 0
mov qword [rsp + 0x10], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x18], xmm0
movups xmmword [rsp + 0x28], xmm0
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
lea rcx, [0x004656a0]
mov qword [rsp + 0x10], rcx
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x18], rcx
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 8]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.0046b240
mov rax, qword [rsp + 8]
mov qword [rsp + 0x88], rax
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
nop
ret
call fcn.0046b3a0
jmp fcn.0045d620
Function at 0x46d020
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, qword [0x00d54c80]
mov rcx, qword [rsp + 8]
mov rcx, qword [rcx]
mov rdx, qword [rsp + 0x10]
lea rax, [rdx + rax*8]
xor rcx, rax
movabs rax, 0xea38ec9079f01541
imul rax, rcx
rol rax, 0x1f
movabs rcx, 0x2723a30d96da1399
imul rcx, rax
mov rax, rcx
shr rcx, 0x1d
xor rax, rcx
movabs rcx, 0x83cf8eadf876d2d7
imul rcx, rax
mov rax, rcx
shr rcx, 0x20
xor rax, rcx
mov qword [rsp + 0x18], rax
ret
cmp byte [0x00d546fb], 0
je 0x46d05d
mov rax, qword [rsp + 8]
movq xmm0, qword [rsp + 0x10]
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x00d54fc0]
aesenc xmm0, xmmword [0x00d54fd0]
aesenc xmm0, xmmword [0x00d54fe0]
movq qword [rsp + 0x18], xmm0
ret
jmp 0x40a660

Function at 0x140777238
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1407773bf
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140777269
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14077724f
add dl, dl
jne 0x140777276
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1407772d6
xor eax, eax
add dl, dl
jne 0x140777285
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14077738d
add dl, dl
jne 0x140777296
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407772a3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407772b0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407772bd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1407772ca
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14077725e
mov eax, 1
add dl, dl
jne 0x1407772e6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407772f3
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1407772db
sub eax, ebx
mov ebx, 1
jne 0x14077732c
mov ecx, 1
add dl, dl
jne 0x14077730e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14077731b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140777303
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14077725e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140777348
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140777355
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14077733d
cmp eax, 0x7d00
jae 0x14077737b
cmp eax, 0x500
jb 0x140777376
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14077725e
cmp eax, 0x7f
ja 0x14077737e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14077725e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1407773b2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14077725e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x14000b890
Capabilities:
Manipulate console buffer

Disassembly:
push rdi
sub rsp, 0x50
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rdi, rax
lea rdx, [rsp + 0x30]
xor eax, eax
mov rcx, rdi
mov dword [rsp + 0x60], eax
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
je 0x14000b8f2
movsx ecx, word [rsp + 0x30]
lea rax, [rsp + 0x68]
movsx r8d, word [rsp + 0x32]
mov dl, 0x20
mov r9d, dword [rsp + 0x60]
imul r8d, ecx
mov rcx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_FillConsoleOutputCharacterA]
mov edx, dword [rsp + 0x60]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
add rsp, 0x50
pop rdi
ret
Function at 0x14000d450
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov ebp, ecx
mov rsi, rdx
xor ecx, ecx
mov edx, 0x1000
mov ebx, r8d
mov r8d, edx
lea r9d, [rcx + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
test rax, rax
je 0x14000d4e5
movups xmm0, xmmword [0x14013b390]
mov r8d, ebx
mov rdx, rsi
mov ecx, ebp
movups xmmword [rax], xmm0
movsd xmm1, qword [0x14013b3a0]
movsd qword [rax + 0x10], xmm1
mov eax, dword [0x14013b3a8]
mov dword [rdi + 0x18], eax
movzx eax, word [0x14013b3ac]
mov word [rdi + 0x1c], ax
call rdi
xor edx, edx
mov r8d, 0x1000
mov rcx, rdi
mov ebx, eax
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test ebx, ebx
setg al
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140013f60
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rdi, qword [0x14013b3d0]
xor r15d, r15d
mov ebp, ecx
mov r14d, r15d
mov rsi, qword [rdi + 0x3ea0]
test cl, 0x10
jne 0x1400140ef
mov ebx, dword [rdi + 0x473c]
test ebx, ebx
je 0x140013fd7
cmp dword [rdi + 0x3f00], ebx
jne 0x1400140e8
mov eax, dword [rdi + 0x3f2c]
cmp eax, 0xffffffff
cmove eax, r15d
movsxd r15, eax
cmp byte [r15 + rdi + 0xe04], r14b
je 0x1400140e8
cmp byte [rsi + 0xb3], r14b
jmp 0x140014090
cmp byte [rdi + 0xe04], r14b
je 0x1400140e8
cmp byte [rsi + 0xb3], r14b
jne 0x1400140e8
test byte [rdi + 0x4744], 1
jne 0x140014014
cmp dword [rdi + 0x3f00], r14d
je 0x1400140e8
cmp qword [rdi + 0x3f20], rsi
jne 0x1400140e8
test bpl, 8
je 0x1400140e8
lea rdx, [rdi + 0x4748]
mov rcx, rsi
call fcn.140018fb0
mov ebx, eax
mov dword [rdi + 0x473c], eax
mov rax, qword [0x14013b3d0]
cmp dword [rax + 0x3f00], ebx
jne 0x14001404a
mov dword [rax + 0x3f04], ebx
cmp dword [rax + 0x3f30], ebx
jne 0x140014059
mov byte [rax + 0x3f34], 1
mov edx, ebx
lea rcx, [rdi + 0x4748]
call fcn.14001bdb0
movzx r14d, al
test al, al
je 0x14001408a
cmp byte [rdi + 0x3738], r15b
je 0x14001408a
mov rdx, rsi
mov ecx, ebx
call fcn.1400255f0
mov rcx, rsi
call fcn.1400188f0
cmp dword [rdi + 0x3f00], ebx
jne 0x1400140e8
mov byte [rdi + 0x3f0d], r14b
movsxd rcx, dword [rsi + 0xe8]
mov rax, qword [rsi + 0xf0]
mov r14d, dword [rax + rcx*4 - 4]
mov rax, qword [0x14013b3d0]
movsxd rcx, r15d
cmp byte [rcx + rax + 0xe04], 0
jne 0x1400140c5
xor sil, sil
jmp 0x1400140de
movss xmm1, dword [rax + 0x38]
movss xmm0, dword [rax + rcx*4 + 0x3790]
mulss xmm1, xmm1
comiss xmm0, xmm1
setae sil
call fcn.140025740
test sil, sil
jne 0x140014142
xor al, al
jmp 0x1400141e2
mov r9d, 0xffffffff
lea rdx, [0x1400bb1d1]
mov ebx, r9d
lea r10, [0x1400b9d70]
mov r8b, 0x23
nop dword [rax]
cmp r8b, 0x23
jne 0x140014123
cmp byte [rdx], r8b
jne 0x140014123
cmp byte [rdx + 1], r8b
cmove ebx, r9d
movzx ecx, bl
movzx eax, r8b
movzx r8d, byte [rdx]
xor rcx, rax
shr ebx, 8
inc rdx
xor ebx, dword [r10 + rcx*4]
test r8b, r8b
jne 0x140014110
not ebx
cmp byte [rdi + 0x4a2c], 0
jne 0x140014180
call fcn.1400158a0
mov dword [rdi + 0x4a4c], ebx
mov dword [rdi + 0x4a50], r14d
mov byte [rdi + 0x4a2c], 1
mov dword [rdi + 0x4a30], ebp
mov dword [rdi + 0x4a38], r15d
cmp ebx, dword [rdi + 0x3f00]
jne 0x140014180
mov byte [rdi + 0x3f0e], 1
mov eax, dword [rdi + 0x3e20]
mov dword [rdi + 0x4a34], eax
mov byte [rdi + 0x4a2d], 1
test bpl, 1
jne 0x1400141d3
xor edx, edx
xor ecx, ecx
call fcn.140014560
cmp dword [rdi + 0x4aa0], 0
je 0x1400141d3
test dword [rdi + 0x4a94], 0x1000
je 0x1400141d3
mov rax, qword [rdi + 0x3ea0]
mov byte [rax + 0xb3], 1
mov byte [rax + 0xb5], 1
mov byte [rax + 0xd0], 1
test bpl, 0x12
jne 0x1400141e0
and dword [rdi + 0x4744], 0xfffffffe
mov al, 1
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x140014560
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rbx, qword [0x14013b3d0]
mov edi, edx
mov esi, ecx
cmp byte [rbx + 0x4a2d], 0
jne 0x1400145b9
cmp byte [rbx + 0x4a2e], 0
jne 0x1400145b9
movsx r9d, word [rbx + 0x5b32]
lea r8, str.Tooltip__02d
mov edx, 0x10
lea rcx, [rsp + 0x20]
call fcn.140019de0
test sil, 1
je 0x1400146ea
jmp 0x140014652
movss xmm1, dword [rbx + 0x3898]
lea r8, str.Tooltip__02d
movaps xmm0, xmm1
lea rcx, [rsp + 0x20]
mulss xmm0, dword [0x1400bb3f0]
xor eax, eax
mov edx, 0x10
mulss xmm1, dword [0x140059960]
addss xmm0, dword [rbx + 0xdfc]
addss xmm1, dword [rbx + 0xe00]
or dword [rbx + 0x4778], 1
mov qword [rbx + 0x4790], rax
movss dword [rbx + 0x4788], xmm0
mov dword [rbx + 0x477c], 1
movss dword [rbx + 0x478c], xmm1
movss xmm0, dword [rbx + 0x38f4]
mov rax, qword [0x14013b3d0]
mulss xmm0, dword [0x1400bb3b4]
or dword [rax + 0x4778], 0x40
movss dword [rax + 0x47d8], xmm0
movsx r9d, word [rbx + 0x5b32]
call fcn.140019de0
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x1400146a2
lea r11, [0x1400b9d70]
cmp r9b, 0x23
jne 0x140014685
cmp byte [r8], r9b
jne 0x140014685
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x140014672
not ecx
call fcn.1400186c0
test rax, rax
je 0x1400146ea
cmp byte [rax + 0xae], 0
je 0x1400146ea
mov byte [rax + 0xb5], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xd0], 1
lea rcx, [rsp + 0x20]
inc word [rbx + 0x5b32]
mov edx, 0x10
movsx r9d, word [rbx + 0x5b32]
call fcn.140019de0
or edi, 0x20c0347
lea rcx, [rsp + 0x20]
mov r8d, edi
xor edx, edx
call fcn.140011720
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x140018610
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 8
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10, qword [0x14013b3d0]
mov r11d, 0xffffffff
mov eax, r11d
test r9b, r9b
je 0x140018673
mov qword [rsp], rbx
lea rbx, [0x1400b9d70]
nop dword [rax]
cmp r9b, 0x23
jne 0x140018653
cmp byte [r8], r9b
jne 0x140018653
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rbx + rdx*4]
test r9b, r9b
jne 0x140018640
mov rbx, qword [rsp]
movsxd rcx, dword [r10 + 0x5b90]
xor r8d, r8d
not eax
test ecx, ecx
jle 0x1400186a7
mov r10, qword [r10 + 0x5b98]
mov r9, rcx
mov edx, r8d
lea rcx, [r10 + 8]
cmp dword [rcx], eax
je 0x1400186ae
inc r8d
inc rdx
add rcx, 0x48
cmp rdx, r9
jl 0x140018694
xor eax, eax
add rsp, 8
ret
movsxd rax, r8d
lea rcx, [rax + rax*8]
lea rax, [r10 + rcx*8]
add rsp, 8
ret
Function at 0x140018740
Capabilities:
Hash data with crc32

Disassembly:
mov rax, rcx
mov r10d, 0xffffffff
mov ecx, r10d
movzx r9d, byte [rax]
lea r8, [rax + 1]
test r9b, r9b
je 0x140018790
lea r11, [0x1400b9d70]
cmp r9b, 0x23
jne 0x140018773
cmp byte [r8], r9b
jne 0x140018773
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x140018760
not ecx
jmp fcn.1400186c0

Function at 0x140018e90
Capabilities:
Hash data with crc32

Disassembly:
mov dword [rsp + 0x10], edx
push rbx
sub rsp, 0x20
movsxd r8, dword [rcx + 0xe8]
mov rax, qword [rcx + 0xf0]
mov ebx, dword [rax + r8*4 - 4]
lea r8, [0x1400b9d70]
not ebx
movzx eax, dl
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, byte [rsp + 0x39]
xor ebx, dword [r8 + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, byte [rsp + 0x3a]
xor ebx, dword [r8 + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, byte [rsp + 0x3b]
xor ebx, dword [r8 + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
xor ebx, dword [r8 + rcx*4]
mov rcx, qword [0x14013b3d0]
not ebx
cmp dword [rcx + 0x3ee8], ebx
jne 0x140018f1d
xor r9d, r9d
movsxd r8, edx
mov ecx, ebx
lea edx, [r9 + 4]
call fcn.1400165f0
mov eax, ebx
add rsp, 0x20
pop rbx
ret
Function at 0x140018fb0
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 0x18
mov rax, qword [rcx + 0xf0]
lea r9, [0x1400b9d70]
movss xmm2, dword [rcx + 0x108]
movss xmm3, dword [rcx + 0x10c]
movsxd rcx, dword [rcx + 0xe8]
movss xmm0, dword [rdx]
movss xmm1, dword [rdx + 4]
subss xmm0, xmm2
subss xmm1, xmm3
mov r8d, dword [rax + rcx*4 - 4]
not r8d
movzx ecx, r8b
shr r8d, 8
movss dword [rsp], xmm0
movzx eax, byte [rsp]
xor rcx, rax
movss xmm0, dword [rdx + 8]
movzx eax, byte [rsp + 1]
subss xmm0, xmm2
movss dword [rsp + 4], xmm1
movss xmm1, dword [rdx + 0xc]
xor r8d, dword [r9 + rcx*4]
subss xmm1, xmm3
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 2]
movss dword [rsp + 8], xmm0
movss dword [rsp + 0xc], xmm1
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 3]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 4]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 5]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 6]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 7]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 8]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 9]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xa]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xb]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xc]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xd]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xe]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
xor r8d, dword [r9 + rcx*4]
movzx ecx, byte [rsp + 0xf]
movzx edx, r8b
shr r8d, 8
xor rdx, rcx
xor r8d, dword [r9 + rdx*4]
not r8d
mov eax, r8d
add rsp, 0x18
ret
Function at 0x140019b30
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push r14
sub rsp, 0x20
movsxd rbp, r9d
mov r14, r8
test r8, r8
je 0x140019b4b
mov qword [r8], 0
call fcn.140019c90
mov rbx, rax
test rax, rax
jne 0x140019b61
add rsp, 0x20
pop r14
pop rbp
pop rbx
ret
mov qword [rsp + 0x40], rsi
mov rcx, rbx
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov esi, eax
cmp eax, 0xffffffff
je 0x140019c69
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140019c69
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x140019c69
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140019c69
cmp rdi, 0xffffffffffffffff
je 0x140019c69
mov rax, qword [0x14013b3d0]
test rax, rax
je 0x140019be2
inc dword [rax + 0xf4]
mov rdx, qword [0x14013b3e0]
lea rcx, [rdi + rbp]
call qword [0x14013a3b0]
mov rsi, rax
test rax, rax
je 0x140019c69
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp rax, rdi
je 0x140019c41
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x14013b3d0]
test rax, rax
je 0x140019c2f
dec dword [rax + 0xf4]
mov rdx, qword [0x14013b3e0]
mov rcx, rsi
call qword [0x14013a3b8]
jmp 0x140019c72
test ebp, ebp
jle 0x140019c53
lea rcx, [rsi + rdi]
mov r8, rbp
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test r14, r14
je 0x140019c64
mov qword [r14], rdi
mov rax, rsi
jmp 0x140019c74
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov r15, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rbp
pop rbx
ret

Function at 0x14001a030
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x14001a08d
lea rbx, [0x1400b9d70]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x14001a074
cmp r10, 2
jb 0x14001a074
cmp byte [r9], r8b
jne 0x14001a074
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x14001a050
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x14001a0cf
lea rbx, [0x1400b9d70]
cmp r8b, 0x23
jne 0x14001a0b3
cmp byte [r9], r8b
jne 0x14001a0b3
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x14001a0a0
mov rbx, qword [rsp + 8]
not eax
ret
Function at 0x14001a3a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rdi
push r12
push r13
sub rsp, 0x10
mov qword [rsp + 0x30], rbx
lea r13, [0x140000000]
mov qword [rsp + 0x38], rbp
mov rdi, rdx
mov qword [rsp + 0x40], rsi
mov rax, rcx
mov qword [rsp + 8], r14
xor r12d, r12d
mov qword [rsp], r15
test rdi, rdi
je 0x14001a3e0
cmp rax, rdi
jae 0x14001a558
movzx r8d, byte [rax]
test r8b, r8b
je 0x14001a558
xor ebx, ebx
mov ecx, r8d
shr rcx, 3
mov rdx, rdi
movsx r9, byte [rcx + r13 + 0xba6b8]
test r9d, r9d
sete bl
add ebx, r9d
test rdi, rdi
jne 0x14001a416
movsxd rdx, ebx
add rdx, rax
xor esi, esi
lea rcx, [rax + 1]
cmp rax, rdx
cmovb esi, r8d
cmp rcx, rdx
jae 0x14001a42e
movzx r15d, byte [rcx]
jmp 0x14001a431
xor r15b, r15b
lea rcx, [rax + 2]
cmp rcx, rdx
jae 0x14001a440
movzx r14d, byte [rcx]
jmp 0x14001a443
xor r14b, r14b
lea rcx, [rax + 3]
cmp rcx, rdx
jae 0x14001a451
movzx ebp, byte [rcx]
jmp 0x14001a454
xor bpl, bpl
lea r10, [r9*4]
movzx ecx, sil
mov r9d, dword [r10 + r13 + 0xba6d8]
and r9d, ecx
movzx r8d, r15b
shl r9d, 6
mov ecx, r8d
and ecx, 0x3f
movzx edx, r14b
or r9d, ecx
movzx r11d, bpl
shl r9d, 6
and r8d, 0xc0
mov ecx, edx
and edx, 0xc0
and ecx, 0x3f
or r9d, ecx
mov ecx, r11d
shr r11d, 2
and ecx, 0x3f
or r11d, edx
shl r9d, 6
shr r11d, 2
or r9d, ecx
mov ecx, dword [r10 + r13 + 0xba708]
or r11d, r8d
shr r9d, cl
shr r11d, 2
mov edx, r9d
cmp r9d, dword [r10 + r13 + 0xba6f0]
sbb ecx, ecx
and edx, 0xfffff800
and ecx, 0x40
xor r8d, r8d
or r11d, ecx
mov ecx, 0x80
cmp edx, 0xd800
cmove r8d, ecx
xor edx, edx
or r11d, r8d
mov ecx, 0x100
cmp r9d, 0xffff
cmova edx, ecx
mov ecx, dword [r10 + r13 + 0xba720]
or r11d, edx
xor r11d, 0x2a
sar r11d, cl
test r11d, r11d
je 0x14001a54a
xor edx, edx
test bpl, bpl
setne dl
xor ecx, ecx
test r14b, r14b
setne cl
add edx, ecx
xor ecx, ecx
test r15b, r15b
setne cl
add edx, ecx
xor ecx, ecx
test sil, sil
setne cl
add edx, ecx
cmp ebx, edx
cmovl edx, ebx
mov ebx, edx
movsxd rcx, ebx
add rax, rcx
inc r12d
jmp 0x14001a3d2
mov r15, qword [rsp]
mov eax, r12d
mov r14, qword [rsp + 8]
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x10
pop r13
pop r12
pop rdi
ret