joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401740
Capabilities:
Create thread

Disassembly:
mov r11, rsp
sub rsp, 0x338
mov rax, qword [0x00414030]
xor rax, rsp
mov qword [rsp + 0x300], rax
mov qword [r11 - 8], rbx
mov qword [r11 - 0x10], rbp
xor edx, edx
mov qword [r11 - 0x18], rsi
mov qword [r11 - 0x20], rdi
mov qword [0x00415580], rcx
mov rdi, rcx
lea r8d, [rdx + 0x4c]
lea rcx, [rsp + 0x74]
call fcn.00402c20
xor ebp, ebp
lea rax, [0x004016c0]
mov edx, 0x7f00
xor ecx, ecx
mov dword [rsp + 0x70], 0x50
mov qword [rsp + 0x78], rax
mov dword [rsp + 0x74], 3
mov dword [rsp + 0x80], ebp
mov dword [rsp + 0x84], ebp
mov qword [rsp + 0x88], rdi
mov qword [rsp + 0x90], rbp
call qword [sym.imp.USER32.dll_LoadCursorA]
lea ecx, [rbp + 0xf]
mov qword [rsp + 0x98], rax
call qword [sym.imp.USER32.dll_GetSysColorBrush]
lea rsi, str.msi2exestub_wnd_class
lea rcx, [rsp + 0x70]
mov qword [rsp + 0xb0], rsi
mov qword [rsp + 0xa8], rbp
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xb8], rbp
call qword [sym.imp.USER32.dll_RegisterClassExA]
lea ecx, [rbp + 0x10]
call qword [sym.imp.USER32.dll_GetSystemMetrics]
lea ecx, [rbp + 0x11]
mov ebx, eax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x40], rbp
mov dword [rsp + 0x38], 0x50
sub eax, 0x50
mov dword [rsp + 0x30], 0x12c
shr eax, 1
add ebx, 0xfffffed4
lea r8, [0x0040f3f6]
mov dword [rsp + 0x28], eax
lea ecx, [rbp + 8]
shr ebx, 1
mov r9d, 0x80400000
mov rdx, rsi
mov dword [rsp + 0x20], ebx
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov rsi, qword [rsp + 0x320]
mov rbx, qword [rsp + 0x330]
test rax, rax
mov qword [0x00415588], rax
je 0x4019ab
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x00415588]
call qword [sym.imp.USER32.dll_UpdateWindow]
lea r11, [rsp + 0x60]
lea r8, [0x004011f0]
mov qword [rsp + 0x28], r11
mov r9, rdi
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], ebp
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x40193f
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0xc0]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x401936
nop
nop
lea rcx, [rsp + 0xc0]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0xc0]
call qword [sym.imp.USER32.dll_DispatchMessageA]
lea rcx, [rsp + 0xc0]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
jne 0x401900
mov eax, dword [rsp + 0xd0]
jmp 0x4019ad
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r9, str.Main::CreateThread___failure.
lea r8, str._s__code:_0x_08X_
lea rcx, [rsp + 0xf0]
mov edx, 0x208
mov dword [rsp + 0x20], eax
call fcn.00401000
mov r11, qword [0x004155c0]
mov edx, 0x5c
mov rcx, qword [r11]
call fcn.004019e0
test rax, rax
jne 0x40198e
mov rax, qword [0x004155c0]
mov rax, qword [rax]
jmp 0x401992
add rax, 1
lea rdx, [rsp + 0xf0]
mov r9d, 0x10
mov r8, rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
mov rdi, qword [rsp + 0x318]
mov rbp, qword [rsp + 0x328]
mov rcx, qword [rsp + 0x300]
xor rcx, rsp
call fcn.00401e70
add rsp, 0x338
ret
Function at 0x4046e7
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x00414030]
jne 0x401e8a
rol rcx, 0x10
test cx, 0xffff
jne 0x401e86
repz ret
ror rcx, 0x10
jmp 0x404640
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x004156d0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x004157c8]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x4046c5
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x004156d0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x4046e7
mov rax, qword [rsp + 0x88]
mov qword [0x004157c8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x00415768], rax
mov rax, qword [0x004157c8]
mov qword [0x00415640], rax
mov rax, qword [rsp + 0x90]
mov qword [0x00415750], rax
mov dword [0x00415630], 0xc0000409
mov dword [0x00415634], 1
mov rax, qword [0x00414030]
mov qword [rsp + 0x68], rax
mov rax, qword [0x00414038]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x004156c8], eax
mov ecx, 1
call fcn.00409b20
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x0040f7b0]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x004156c8], 0
jne 0x40476e
mov ecx, 1
call fcn.00409b20
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x40b7d0
Capabilities:
Link many functions at runtime

Disassembly:
mov rax, rsp
sub rsp, 0x68
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax - 8], r12
mov qword [rax - 0x10], r13
mov r13, rcx
mov edi, r8d
mov r12, rdx
call fcn.00404a80
xor ebx, ebx
cmp qword [0x004162e8], rbx
mov rsi, rax
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x34], ebx
jne 0x40b901
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
mov rbp, rax
jne 0x40b833
xor eax, eax
jmp 0x40b9e1
lea rdx, [0x0040ff58]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x40b82c
mov rcx, rax
call fcn.00404a10
lea rdx, str.GetActiveWindow
mov rcx, rbp
mov qword [0x004162e8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.00404a10
lea rdx, str.GetLastActivePopup
mov rcx, rbp
mov qword [0x004162f0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.00404a10
lea rcx, [rsp + 0x30]
mov qword [0x004162f8], rax
call fcn.00402880
test eax, eax
je 0x40b8b7
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call fcn.00403360
cmp dword [rsp + 0x30], 2
jne 0x40b901
lea rdx, str.GetUserObjectInformationA
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.00404a10
test rax, rax
mov qword [0x00416308], rax
je 0x40b901
lea rdx, str.GetProcessWindowStation
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.00404a10
mov qword [0x00416300], rax
mov rcx, qword [0x00416300]
cmp rcx, rsi
je 0x40b993
cmp qword [0x00416308], rsi
je 0x40b993
call fcn.00404ae0
call rax
test rax, rax
mov rbp, rax
je 0x40b95e
mov rcx, qword [0x00416308]
call fcn.00404ae0
lea rcx, [rsp + 0x38]
mov r9d, 0xc
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
lea r8, [rsp + 0x40]
mov rcx, rbp
call rax
test eax, eax
je 0x40b95e
test byte [rsp + 0x48], 1
jne 0x40b993
lea rcx, [rsp + 0x34]
call fcn.004028d0
test eax, eax
je 0x40b980
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call fcn.00403360
cmp dword [rsp + 0x34], 4
jb 0x40b98d
bts edi, 0x15
jmp 0x40b9c7
bts edi, 0x12
jmp 0x40b9c7
mov rcx, qword [0x004162f0]
cmp rcx, rsi
je 0x40b9c7
call fcn.00404ae0
call rax
test rax, rax
mov rbx, rax
je 0x40b9c7
mov rcx, qword [0x004162f8]
cmp rcx, rsi
je 0x40b9c7
call fcn.00404ae0
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x004162e8]
call fcn.00404ae0
mov r9d, edi
mov r8, r12
mov rdx, r13
mov rcx, rbx
call rax
mov r13, qword [rsp + 0x58]
mov r12, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
add rsp, 0x68
ret
Function at 0x2079513b0
Capabilities:
Access peb ldr_data

Disassembly:
push r12
push rbx
sub rsp, 0x88
mov eax, 0x23ff
mov word [rsp + 0x5e], ax
mov r11, rdx
mov r12, r8
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov qword [rsp + 0xa0], rcx
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x20]
mov rbx, qword [rax]
lea r10, [rbx - 0x10]
nop
mov r8, r10
mov r10, qword [r10]
cmp rbx, r10
je 0x207951463
mov rax, qword [r8 + 0x60]
lea r9, [rax + 2]
movzx eax, word [rax]
test ax, ax
je 0x2079513f0
mov ecx, 0x2108
mov edx, ecx
movzx eax, ax
add r9, 2
shl edx, 6
add eax, edx
add ecx, eax
movzx eax, word [r9 - 2]
test ax, ax
jne 0x207951410
cmp ecx, 0xfcdfbd0e
jne 0x2079513f0
mov edx, dword [r8 + 0x40]
mov rax, qword [r8 + 0x30]
cmp edx, 2
je 0x207951463
sub edx, 3
lea rdx, [rax + rdx + 1]
nop word [rax + rax]
movzx ebx, word [rsp + 0x5e]
cmp word [rax], bx
je 0x207951465
add rax, 1
cmp rax, rdx
jne 0x207951450
xor eax, eax
movq xmm0, rax
lea rax, [rsp + 0x60]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x40], 0
mov rdx, r12
mov rcx, r11
movhps xmm0, qword [rsp + 0xa0]
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x70], 0
movups xmmword [rsp + 0x60], xmm0
call fcn.2079553f0
add rsp, 0x88
pop rbx
pop r12
ret

Function at 0x2079514d0
Capabilities:
Access peb ldr_data

Disassembly:
push r12
push rsi
push rbx
add rsp, 0xffffffffffffff80
mov eax, 0x23ff
mov word [rsp + 0x5a], ax
mov r11, rcx
mov r12, rdx
mov r8d, r8d
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov dword [rsp + 0x5c], 0
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x20]
mov rsi, qword [rax]
lea r10, [rsi - 0x10]
nop
mov rbx, r10
mov r10, qword [r10]
cmp rsi, r10
je 0x207951583
mov rax, qword [rbx + 0x60]
lea r9, [rax + 2]
movzx eax, word [rax]
test ax, ax
je 0x207951510
mov ecx, 0x2108
mov edx, ecx
movzx eax, ax
add r9, 2
shl edx, 6
add eax, edx
add ecx, eax
movzx eax, word [r9 - 2]
test ax, ax
jne 0x207951530
cmp ecx, 0xfcdfbd0e
jne 0x207951510
mov edx, dword [rbx + 0x40]
mov rax, qword [rbx + 0x30]
cmp edx, 2
je 0x207951583
sub edx, 3
lea rdx, [rax + rdx + 1]
nop word cs:[rax + rax]
movzx esi, word [rsp + 0x5a]
cmp word [rax], si
je 0x207951585
add rax, 1
cmp rdx, rax
jne 0x207951570
xor eax, eax
mov qword [rsp + 0x60], rax
lea r9, [rsp + 0x5c]
mov rdx, r12
mov rcx, r11
mov qword [rsp + 0x40], 0
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x70], 0
call fcn.2079553f0
test eax, eax
mov eax, 0
cmovne eax, dword [rsp + 0x5c]
sub rsp, 0xffffffffffffff80
pop rbx
pop rsi
pop r12
ret
Function at 0x2079517d0
Capabilities:
Access peb ldr_data

Disassembly:
push r13
push r12
push rbx
add rsp, 0xffffffffffffff80
mov eax, 0x23ff
mov word [rsp + 0x5e], ax
mov r13, r8
mov r12, rdx
mov r8, r9
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov qword [rsp + 0xa0], rcx
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x20]
mov rbx, qword [rax]
lea r11, [rbx - 0x10]
mov r9, r11
mov r11, qword [r11]
cmp rbx, r11
je 0x207951883
mov rax, qword [r9 + 0x60]
lea r10, [rax + 2]
movzx eax, word [rax]
test ax, ax
je 0x207951810
mov ecx, 0x2108
mov edx, ecx
movzx eax, ax
add r10, 2
shl edx, 6
add eax, edx
add ecx, eax
movzx eax, word [r10 - 2]
test ax, ax
jne 0x207951830
cmp ecx, 0xfcdfbd0e
jne 0x207951810
mov edx, dword [r9 + 0x40]
mov rax, qword [r9 + 0x30]
cmp edx, 2
je 0x207951883
sub edx, 3
lea rdx, [rax + rdx + 1]
nop word [rax + rax]
movzx ebx, word [rsp + 0x5e]
cmp word [rax], bx
je 0x207951885
add rax, 1
cmp rax, rdx
jne 0x207951870
xor eax, eax
movq xmm0, rax
mov rax, qword [rsp + 0xe0]
mov rdx, r13
mov rcx, r12
mov r9, qword [rsp + 0xc0]
movhps xmm0, qword [rsp + 0xa0]
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0xd8]
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
call fcn.2079553f0
sub rsp, 0xffffffffffffff80
pop rbx
pop r12
pop r13
ret
Function at 0x207955db0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor r9d, r9d
xor r8d, r8d
mov edx, 1
mov ecx, 1
jmp fcn.207955840
Function at 0x2079680b0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov eax, ecx
mov r9, rdx
not eax
cmp r8, 3
jbe 0x207968180
lea rdx, [r8 - 4]
lea r10, [0x207a41ba0]
shr rdx, 2
lea rcx, [r9 + rdx*4 + 4]
nop dword [rax]
mov edx, eax
xor al, byte [r9]
add r9, 4
movzx eax, al
shr edx, 8
xor edx, dword [r10 + rax*4]
mov eax, edx
xor dl, byte [r9 - 3]
movzx edx, dl
shr eax, 8
xor eax, dword [r10 + rdx*4]
mov edx, eax
xor al, byte [r9 - 2]
movzx eax, al
shr edx, 8
xor edx, dword [r10 + rax*4]
mov eax, edx
xor dl, byte [r9 - 1]
movzx edx, dl
shr eax, 8
xor eax, dword [r10 + rdx*4]
cmp r9, rcx
jne 0x2079680d8
and r8d, 3
test r8, r8
je 0x207968174
mov r9d, eax
xor al, byte [rcx]
lea rdx, [0x207a41ba0]
movzx eax, al
shr r9d, 8
xor r9d, dword [rdx + rax*4]
mov eax, r9d
sub r8, 1
je 0x207968174
xor al, byte [rcx + 1]
shr r9d, 8
movzx eax, al
xor r9d, dword [rdx + rax*4]
mov eax, r9d
cmp r8, 1
je 0x207968174
xor al, byte [rcx + 2]
mov r8d, r9d
movzx eax, al
shr r8d, 8
xor r8d, dword [rdx + rax*4]
mov eax, r8d
not eax
ret
mov rcx, rdx
jmp 0x207968124
Function at 0x20797b900
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push rdi
push rsi
push rbx
lea rax, [rdx + 0xf]
sub rax, rcx
cmp rax, 0x1e
jbe 0x20797b9e4
movdqu xmm1, xmmword [rdx]
movups xmmword [rcx], xmm1
movdqu xmm0, xmmword [rdx + 0x10]
movups xmmword [rcx + 0x10], xmm0
movzx edi, byte [rcx + 0x1f]
movzx r9d, byte [rcx + 0x1e]
mov r10d, 8
lea r11, [0x207a42e40]
movzx r8d, byte [rcx + 0x1d]
movzx eax, byte [rcx + 0x1c]
lea rbx, [0x207a42d20]
jmp 0x20797b9a9
movzx r8d, r8b
movzx eax, al
movzx edx, byte [r11 + r8]
movzx r8d, r9b
movzx r9d, dil
movzx edi, byte [r11 + rax]
mov eax, r10d
movzx r8d, byte [r11 + r8]
movzx r9d, byte [r11 + r9]
shr eax, 3
xor dl, byte [rbx + rax]
mov eax, edx
xor al, byte [rcx]
xor r8b, byte [rcx + 1]
add r10d, 1
add rcx, 4
xor r9b, byte [rcx - 2]
xor dil, byte [rcx - 1]
mov byte [rcx + 0x1c], al
mov byte [rcx + 0x1d], r8b
mov byte [rcx + 0x1e], r9b
mov byte [rcx + 0x1f], dil
cmp r10d, 0x3c
je 0x20797b9e0
mov edx, r10d
and edx, 7
je 0x20797b950
cmp edx, 4
jne 0x20797b97e
movzx eax, al
movzx r8d, r8b
movzx esi, r9b
movzx edx, dil
movzx eax, byte [r11 + rax]
movzx r8d, byte [r11 + r8]
movzx r9d, byte [r11 + rsi]
movzx edi, byte [r11 + rdx]
jmp 0x20797b97e
pop rbx
pop rsi
pop rdi
ret
movzx eax, byte [rdx]
mov byte [rcx], al
movzx eax, byte [rdx + 1]
mov byte [rcx + 1], al
movzx eax, byte [rdx + 2]
mov byte [rcx + 2], al
movzx eax, byte [rdx + 3]
mov byte [rcx + 3], al
movzx eax, byte [rdx + 4]
mov byte [rcx + 4], al
movzx eax, byte [rdx + 5]
mov byte [rcx + 5], al
movzx eax, byte [rdx + 6]
mov byte [rcx + 6], al
movzx eax, byte [rdx + 7]
mov byte [rcx + 7], al
movzx eax, byte [rdx + 8]
mov byte [rcx + 8], al
movzx eax, byte [rdx + 9]
mov byte [rcx + 9], al
movzx eax, byte [rdx + 0xa]
mov byte [rcx + 0xa], al
movzx eax, byte [rdx + 0xb]
mov byte [rcx + 0xb], al
movzx eax, byte [rdx + 0xc]
mov byte [rcx + 0xc], al
movzx eax, byte [rdx + 0xd]
mov byte [rcx + 0xd], al
movzx eax, byte [rdx + 0xe]
mov byte [rcx + 0xe], al
movzx eax, byte [rdx + 0xf]
mov byte [rcx + 0xf], al
movzx eax, byte [rdx + 0x10]
mov byte [rcx + 0x10], al
movzx eax, byte [rdx + 0x11]
mov byte [rcx + 0x11], al
movzx eax, byte [rdx + 0x12]
mov byte [rcx + 0x12], al
movzx eax, byte [rdx + 0x13]
mov byte [rcx + 0x13], al
movzx eax, byte [rdx + 0x14]
mov byte [rcx + 0x14], al
movzx eax, byte [rdx + 0x15]
mov byte [rcx + 0x15], al
movzx eax, byte [rdx + 0x16]
mov byte [rcx + 0x16], al
movzx eax, byte [rdx + 0x17]
mov byte [rcx + 0x17], al
movzx eax, byte [rdx + 0x18]
mov byte [rcx + 0x18], al
movzx eax, byte [rdx + 0x19]
mov byte [rcx + 0x19], al
movzx eax, byte [rdx + 0x1a]
mov byte [rcx + 0x1a], al
movzx eax, byte [rdx + 0x1b]
mov byte [rcx + 0x1b], al
movzx eax, byte [rdx + 0x1c]
mov byte [rcx + 0x1c], al
movzx eax, byte [rdx + 0x1d]
mov byte [rcx + 0x1d], al
movzx eax, byte [rdx + 0x1e]
mov byte [rcx + 0x1e], al
movzx eax, byte [rdx + 0x1f]
mov byte [rcx + 0x1f], al
jmp 0x20797b924
Function at 0x207980bc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x28
mov r8, rcx
movzx ecx, byte [rcx + 0x1f]
lea r9, [r8 + 0x20]
mov eax, ecx
and ecx, 0x7f
shr al, 7
mov byte [r8 + 0x1f], cl
movzx edx, al
lea eax, [rdx + rdx*8]
lea eax, [rdx + rax*2]
mov rdx, r8
nop word [rax + rax]
movzx ecx, byte [rdx]
add rdx, 1
add eax, ecx
mov byte [rdx - 1], al
shr ax, 8
cmp r9, rdx
jne 0x207980bf0
xor edx, edx
mov eax, 0x13
mov r9, rsp
nop
movzx ecx, byte [r8 + rdx]
add eax, ecx
mov byte [r9 + rdx], al
add rdx, 1
shr ax, 8
cmp rdx, 0x1f
jne 0x207980c10
movzx edx, byte [r8 + 0x1f]
movdqu xmm1, xmmword [r8]
pxor xmm1, xmmword [rsp]
lea eax, [rax + rdx - 0x80]
mov byte [rsp + 0x1f], al
sar ax, 0xf
movd xmm0, eax
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
pshufd xmm0, xmm0, 0
pand xmm1, xmm0
pxor xmm1, xmmword [rsp]
movups xmmword [r8], xmm1
movdqu xmm1, xmmword [r8 + 0x10]
pxor xmm1, xmmword [rsp + 0x10]
pand xmm0, xmm1
pxor xmm0, xmmword [rsp + 0x10]
movups xmmword [r8 + 0x10], xmm0
add rsp, 0x28
ret

Function at 0x2079813e0
Capabilities:
Encrypt data using curve25519
Hash data using sha512

Disassembly:
push r12
push rbx
sub rsp, 0xe8
movdqu xmm0, xmmword [0x207a43380]
movdqu xmm1, xmmword [0x207a43390]
movdqu xmm2, xmmword [0x207a433a0]
movdqu xmm3, xmmword [0x207a433b0]
movdqu xmm4, xmmword [rdx]
movdqu xmm5, xmmword [rdx + 0x10]
lea r8, [rsp + 0x60]
mov rbx, rcx
lea r12, [rsp + 0x20]
mov qword [rsp + 0x80], 0
mov rdx, r8
mov rcx, r12
mov qword [rsp + 0xd8], 0
mov qword [rsp + 0x88], 0
mov qword [rsp + 0x90], 0
mov qword [rsp + 0x98], 0
mov qword [rsp + 0xa0], 0
mov qword [rsp + 0xa8], 0
mov qword [rsp + 0xb0], 0
mov qword [rsp + 0xb8], 0
mov qword [rsp + 0xc0], 0
mov qword [rsp + 0xc8], 0
mov qword [rsp + 0xd0], 0
mov byte [rsp + pe_nt_image_headers64], 0x80
mov byte [rsp + 0xde], 1
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x30], xmm1
movups xmmword [rsp + 0x40], xmm2
movups xmmword [rsp + 0x50], xmm3
movups xmmword [rsp + 0x60], xmm4
movups xmmword [rsp + 0x70], xmm5
call fcn.207980e50
mov r8d, 0x40
mov rdx, rbx
mov rcx, r12
call fcn.2079812f0
movzx eax, byte [rbx + 0x1f]
and byte [rbx], 0xf8
and eax, 0x7f
or eax, 0x40
mov byte [rbx + 0x1f], al
add rsp, 0xe8
pop rbx
pop r12
ret
Function at 0x2079816f0
Capabilities:
Hash data using sha512

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x78
movdqu xmm0, xmmword [0x207a43380]
movdqu xmm1, xmmword [0x207a43390]
movdqu xmm2, xmmword [0x207a433a0]
movdqu xmm3, xmmword [0x207a433b0]
mov rbp, qword [rsp + 0xe0]
mov r14, rcx
mov ecx, r8d
mov r13, rdx
mov r12, r9
lea r15, [rbp + rcx]
movups xmmword [rsp + 0x30], xmm0
add rcx, rdx
movups xmmword [rsp + 0x40], xmm1
movups xmmword [rsp + 0x50], xmm2
movups xmmword [rsp + 0x60], xmm3
cmp rbp, 0x7f
ja 0x207981800
cmp r15, 0x7f
jbe 0x2079818a0
mov edx, pe_nt_image_headers64
lea rdi, [rcx + 8]
mov rsi, r9
sub edx, r8d
mov r8, qword [r9]
and rdi, 0xfffffffffffffff8
mov eax, edx
lea r10, [r9 + rax]
mov qword [rcx], r8
mov r8, qword [r10 - 8]
mov qword [rsp + 0x28], r10
mov qword [rcx + rax - 8], r8
sub rcx, rdi
sub rsi, rcx
add ecx, edx
mov rdx, r13
shr ecx, 3
rep movsq qword [rdi], qword [rsi]
lea rsi, [rsp + 0x30]
mov rcx, rsi
call fcn.207980e50
mov r10, qword [rsp + 0x28]
nop dword [rax]
mov r8, r15
mov rdx, r10
mov rcx, rsi
call fcn.207981160
mov rdx, r13
mov rcx, rsi
mov r8d, 0x40
call fcn.2079812f0
mov r8d, 0x40
mov rdx, r13
mov rcx, r14
call fcn.207981520
nop
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov edx, pe_nt_image_headers64
lea rdi, [rcx + 8]
mov rsi, r12
mov ebx, 0x100
sub edx, r8d
mov dword [rsp + 0xd0], r8d
mov r9, qword [r9]
and rdi, 0xfffffffffffffff8
mov eax, edx
lea r10, [r12 + rax]
mov qword [rcx], r9
mov r9, qword [r10 - 8]
mov qword [rsp + 0x28], r10
mov qword [rcx + rax - 8], r9
sub rcx, rdi
sub rsi, rcx
add ecx, edx
mov rdx, r13
shr ecx, 3
rep movsq qword [rdi], qword [rsi]
lea rsi, [rsp + 0x30]
mov rcx, rsi
call fcn.207980e50
mov r8d, dword [rsp + 0xd0]
mov r10, qword [rsp + 0x28]
sub ebx, r8d
cmp rbp, rbx
jb 0x2079817b8
nop dword [rax]
mov rdx, r10
mov rcx, rsi
call fcn.207980e50
mov rax, rbx
sub rbx, 0xffffffffffffff80
lea r10, [r12 + rax]
cmp rbx, rbp
jbe 0x207981878
jmp 0x2079817b8
mov r8, rbp
mov rdx, r9
lea rsi, [rsp + 0x30]
call sub.msvcrt.dll_memcpy
mov r8, r15
mov rdx, r13
mov rcx, rsi
call fcn.207981160
jmp 0x2079817c6

Function at 0x207983eb0
Capabilities:
Encrypt data using curve25519

Disassembly:
movdqu xmm0, xmmword [r8]
movups xmmword [rcx], xmm0
movdqu xmm1, xmmword [r8 + 0x10]
mov r9, rdx
lea rdx, [r8 + 0x20]
movups xmmword [rcx + 0x10], xmm1
nop dword [rax]
mov rax, r8
add r8, 1
mov byte [rax], 0
cmp r8, rdx
jne 0x207983ed0
movzx eax, byte [rcx + 0x1f]
and byte [rcx], 0xf8
mov r8, rcx
lea rdx, [0x207a430e0]
and eax, 0x7f
or eax, 0x40
mov byte [rcx + 0x1f], al
mov rcx, r9
jmp fcn.2079818d0
Function at 0x207983f10
Capabilities:
Encrypt data using curve25519

Disassembly:
push rbx
sub rsp, 0x40
movdqu xmm1, xmmword [rdx + 0x10]
movdqu xmm0, xmmword [rdx]
movups xmmword [rsp + 0x30], xmm1
movzx eax, byte [rsp + 0x3f]
mov r9, r8
lea rbx, [rsp + 0x20]
mov r8, rbx
mov rdx, r9
movups xmmword [rsp + 0x20], xmm0
and eax, 0x7f
and byte [rsp + 0x20], 0xf8
or eax, 0x40
mov byte [rsp + 0x3f], al
call fcn.2079818d0
mov r8, rbx
nop word [rax + rax]
mov rax, r8
add r8, 1
mov byte [rax], 0
lea rax, [rsp + 0x40]
cmp r8, rax
jne 0x207983f58
add rsp, 0x40
pop rbx
ret

Function at 0x207984ad0
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
mov eax, dword [rdx]
mov dword [rcx + 0x10], eax
mov eax, dword [rdx + 4]
mov dword [rcx + 0x14], eax
mov eax, dword [rdx + 8]
mov dword [rcx + 0x18], eax
mov eax, dword [rdx + 0xc]
mov dword [rcx + 0x1c], eax
lea rax, str.expand_16_byte_k
cmp r8d, 0x100
jne 0x207984b02
add rdx, 0x10
lea rax, str.expand_32_byte_k
mov r8d, dword [rdx]
mov dword [rcx + 0x20], r8d
mov r8d, dword [rdx + 4]
mov dword [rcx + 0x24], r8d
mov r8d, dword [rdx + 8]
mov dword [rcx + 0x28], r8d
mov edx, dword [rdx + 0xc]
mov dword [rcx + 0x2c], edx
movsx edx, byte [rax + 1]
movsx r8d, byte [rax + 2]
shl edx, 8
shl r8d, 0x10
or edx, r8d
movsx r8d, byte [rax]
or edx, r8d
movsx r8d, byte [rax + 3]
shl r8d, 0x18
or edx, r8d
mov dword [rcx], edx
movsx edx, byte [rax + 5]
movsx r8d, byte [rax + 6]
shl edx, 8
shl r8d, 0x10
or edx, r8d
movsx r8d, byte [rax + 4]
or edx, r8d
movsx r8d, byte [rax + 7]
shl r8d, 0x18
or edx, r8d
mov dword [rcx + 4], edx
movsx edx, byte [rax + 9]
movsx r8d, byte [rax + 0xa]
shl edx, 8
shl r8d, 0x10
or edx, r8d
movsx r8d, byte [rax + 8]
or edx, r8d
movsx r8d, byte [rax + 0xb]
shl r8d, 0x18
or edx, r8d
mov dword [rcx + 8], edx
movsx edx, byte [rax + 0xd]
movsx r8d, byte [rax + 0xe]
shl edx, 8
shl r8d, 0x10
or edx, r8d
movsx r8d, byte [rax + 0xc]
movsx eax, byte [rax + 0xf]
or edx, r8d
shl eax, 0x18
or eax, edx
mov dword [rcx + 0xc], eax
ret