joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401705e0
Capabilities:
Encode data using xor

Disassembly:
mov eax, gethostname
call fcn.1401e5760
sub rsp, rax
cmp dword [rsp + 0x68], 0
je 0x140170609
lea rax, [0x14016ec50]
mov qword [rsp + 0x68], rax
add rsp, 0x38
jmp fcn.140166680
lea rax, [0x14016de10]
mov qword [rsp + 0x68], rax
add rsp, 0x38
jmp fcn.1401663d0

Function at 0x140193af0
Capabilities:
Encode data using xor

Disassembly:
mov eax, gethostname
call fcn.1401e5760
sub rsp, rax
mov r10, rdx
mov dword [rsp + 0x40], reloc.WS2_32.dll_recv
add rdx, 0xf
lea rax, [r8 + 0xf]
mov r11, rcx
cmp r10, rax
ja 0x140193b20
xor r9d, r9d
cmp rdx, r8
jae 0x140193b39
movdqu xmm1, xmmword [r10]
movdqu xmm0, xmmword [r8]
pxor xmm1, xmm0
movdqu xmmword [r10], xmm1
mov r9d, reloc.WS2_32.dll_recv
cmp r9, 0x10
jae 0x140193b61
sub r8, r10
lea rax, [r9 + r10]
mov edx, reloc.WS2_32.dll_recv
sub rdx, r9
nop
movzx ecx, byte [r8 + rax]
xor byte [rax], cl
lea rax, [rax + 1]
sub rdx, 1
jne 0x140193b50
mov rcx, qword [r11 + 8]
lea r8, [rsp + 0x40]
mov r9, r10
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
mov rdx, r10
call fcn.140107e90
test eax, eax
je 0x140193b92
cmp dword [rsp + 0x40], 0x10
jne 0x140193b92
mov eax, 1
add rsp, 0x38
ret
xor eax, eax
add rsp, 0x38
ret

Function at 0x140193d40
Capabilities:
Encode data using xor

Disassembly:
mov r10, rcx
test rdx, rdx
je 0x140193dc8
test r8, r8
je 0x140193dc8
mov rax, qword [rcx + 0x18]
cmp r8, rax
mov r9, rax
cmovb r9, r8
test r9, r9
je 0x140193d86
add rcx, 0x20
mov r11, rdx
sub r11, r10
nop
movzx eax, byte [r11 + rcx - 0x20]
xor byte [rcx], al
lea rcx, [rcx + 1]
sub r9, 1
jne 0x140193d70
mov rax, qword [r10 + 0x18]
cmp r8, rax
jbe 0x140193dc8
sub r8, rax
mov eax, reloc.WS2_32.dll_recv
cmp r8, rax
cmova r8, rax
xor ecx, ecx
test r8, r8
je 0x140193dc8
nop dword [rax]
nop word [rax + rax]
mov rax, qword [r10 + 0x18]
add rax, rcx
movzx eax, byte [rax + rdx]
xor byte [r10 + rcx + 0x40], al
inc rcx
cmp rcx, r8
jb 0x140193db0
ret
Function at 0x1401cd820
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
mov eax, 0x20
call fcn.1401e5760
sub rsp, rax
mov rsi, r9
mov rbp, r9
shr rsi, 3
mov rdi, r8
mov rbx, rdx
mov r14, rcx
cmp r8, r9
jb 0x1401cd8e0
nop
xor edx, edx
test rsi, rsi
je 0x1401cd8d0
nop word [rax + rax]
movzx eax, byte [rbx + 6]
movzx ecx, byte [rbx + 7]
shl rcx, 8
or rcx, rax
movzx eax, byte [rbx + 5]
shl rcx, 8
or rcx, rax
movzx eax, byte [rbx + 4]
shl rcx, 8
or rcx, rax
movzx eax, byte [rbx + 3]
shl rcx, 8
or rcx, rax
movzx eax, byte [rbx + 2]
shl rcx, 8
or rcx, rax
movzx eax, byte [rbx + 1]
shl rcx, 8
or rcx, rax
movzx eax, byte [rbx]
shl rcx, 8
add rbx, 8
or rcx, rax
xor qword [r14 + rdx*8], rcx
inc rdx
cmp rdx, rsi
jb 0x1401cd870
mov rcx, r14
call fcn.1401cd050
sub rdi, rbp
cmp rdi, rbp
jae 0x1401cd860
mov rbx, qword [rsp + 0x30]
mov rax, rdi
mov rdi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x1401cdb79
Capabilities:
Encode data using xor

Disassembly:
test r8, r8
je 0x1401cdd6a
push rbx
mov eax, 0xd0
call fcn.1401e5760
sub rsp, rax
mov rax, qword [0x1402c94a0]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xe8], rbp
mov rbx, rdx
mov qword [rsp + 0xf0], rsi
lea rbp, [r8 - 1]
mov qword [rsp + 0xf8], rdi
mov qword [rsp + 0xc8], r14
lea r14, [rcx + 0xc]
shr rbp, 3
mov qword [rsp + 0xc0], r15
inc rbp
lea r15, [rcx + 0x14]
nop word [rax + rax]
movzx eax, byte [rbx + 1]
mov rcx, r14
movzx edi, byte [rbx]
movzx esi, byte [rbx + 4]
lea rbx, [rbx + 8]
shl eax, 8
or edi, eax
movzx eax, byte [rbx - 6]
shl eax, 0x10
or edi, eax
movzx eax, byte [rbx - 5]
shl eax, 0x18
or edi, eax
movzx eax, byte [rbx - 3]
shl eax, 8
or esi, eax
mov dword [rsp + 0x20], edi
movzx eax, byte [rbx - 2]
shl eax, 0x10
or esi, eax
mov dword [rsp + 0x28], edi
movzx eax, byte [rbx - 1]
and byte [r14], 0xdf
and byte [r15], 0xbf
or byte [r14], 0x40
or byte [r15], 0x20
shl eax, 0x18
or esi, eax
mov dword [rsp + 0x24], esi
mov dword [rsp + 0x2c], esi
call fcn.140160500
lea rdx, [rsp + 0x30]
mov rcx, r14
call fcn.14015fea0
mov r8d, 1
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x28]
call fcn.14015cbe0
mov rcx, r15
call fcn.140160500
lea rdx, [rsp + 0x30]
mov rcx, r15
call fcn.14015fea0
mov r8d, 1
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
call fcn.14015cbe0
mov r8d, dword [rsp + 0x20]
mov edx, dword [rsp + 0x24]
xor r8d, edi
xor edi, dword [rsp + 0x28]
xor edx, esi
xor esi, dword [rsp + 0x2c]
mov eax, edi
mov byte [r14], dil
shr eax, 8
mov byte [r14 + 1], al
mov eax, edi
shr eax, 0x10
mov byte [r14 + 2], al
mov eax, edx
shr eax, 8
shr edi, 0x18
mov byte [r14 + 3], dil
mov byte [r14 + 4], dl
mov byte [r14 + 5], al
mov eax, edx
shr eax, 0x10
mov byte [r14 + 6], al
mov eax, r8d
shr eax, 8
shr edx, 0x18
mov byte [r14 + 7], dl
mov byte [r15], r8b
mov byte [r15 + 1], al
mov eax, r8d
shr eax, 0x10
mov byte [r15 + 2], al
shr r8d, 0x18
mov byte [r15 + 3], r8b
mov byte [r15 + 4], sil
mov eax, esi
shr eax, 8
mov byte [r15 + 5], al
mov eax, esi
shr eax, 0x10
shr esi, 0x18
mov byte [r15 + 6], al
mov byte [r15 + 7], sil
sub rbp, 1
jne 0x1401cdbe0
mov r15, qword [rsp + 0xc0]
mov r14, qword [rsp + 0xc8]
mov rdi, qword [rsp + 0xf8]
mov rsi, qword [rsp + 0xf0]
mov rbp, qword [rsp + 0xe8]
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.1401e4940
add rsp, 0xd0
pop rbx
ret
Function at 0x1401df060
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x90
mov rax, qword [0x1402c94a0]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov edi, dword [rcx]
mov ecx, dword [0x1402d3010]
mov rax, qword gs:[0x58]
mov esi, gethostname
mov r14d, 0x30
add rsi, qword [rax + rcx*8]
add r14, qword [rax + rcx*8]
movups xmm1, xmmword [rsi]
mov ebx, dword [r14]
movups xmm0, xmmword [rsi + 0x10]
movd ecx, xmm1
movups xmmword [rsp + 0x60], xmm1
movups xmmword [rsp + 0x70], xmm0
cmp ecx, edi
je 0x1401df173
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x20]
call fcn.1401df800
movups xmm0, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm0
cmp dword [rax], edi
jne 0x1401df100
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
lea eax, [rbx + 1]
movups xmmword [rsi], xmm0
mov dword [r14], eax
movups xmmword [rsi + 0x10], xmm1
jmp 0x1401df175
xor eax, eax
mov qword [rsp + 0x20], rax
xor ebx, ebx
mov qword [rsp + 0x28], rax
movups xmm0, xmmword [rsp + 0x20]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
movups xmm1, xmmword [rsp + 0x30]
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm1
nop dword [rax]
movd eax, xmm0
cmp eax, edi
je 0x1401df169
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x40]
call fcn.1401df800
inc ebx
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x60], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x70], xmm1
cmp ebx, 0x7530
jl 0x1401df130
mov eax, 0xffffffff
jmp 0x1401df175
movups xmmword [rsi], xmm0
mov dword [r14], ebx
movups xmmword [rsi + 0x10], xmm1
mov eax, ebx
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1401e4940
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop r14
ret
Function at 0x1401df5f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push r15
sub rsp, 0x110
mov rax, qword [0x1402c94a0]
xor rax, rsp
mov qword [rsp + 0x100], rax
mov rsi, r8
mov qword [rsp + 0x20], 0
mov rbx, rdx
lea r15, [rsp + 0x20]
mov r14, rcx
xor edx, edx
mov r8d, 0xc8
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memset
cmp rsi, 0x88
jb 0x1401df730
movabs rax, 0xf0f0f0f0f0f0f0f1
mul rsi
mov rdi, rdx
shr rdi, 7
nop dword [rax]
xor ecx, ecx
lea rax, [rbx + 0x80]
lea rdx, [rsp + 0x30]
cmp rdx, rax
ja 0x1401df690
lea rax, [rsp + 0xb0]
cmp rax, rbx
jae 0x1401df700
movdqu xmm0, xmmword [rsp + rcx*8 + 0x30]
movdqu xmm1, xmmword [rbx]
pxor xmm1, xmm0
movdqu xmmword [rsp + rcx*8 + 0x30], xmm1
movdqu xmm0, xmmword [rsp + rcx*8 + 0x40]
movdqu xmm1, xmmword [rbx + 0x10]
pxor xmm1, xmm0
movdqu xmmword [rsp + rcx*8 + 0x40], xmm1
movdqu xmm0, xmmword [rsp + rcx*8 + 0x50]
movdqu xmm1, xmmword [rbx + 0x20]
pxor xmm1, xmm0
movdqu xmmword [rsp + rcx*8 + 0x50], xmm1
movdqu xmm0, xmmword [rsp + rcx*8 + 0x60]
movdqu xmm1, xmmword [rbx + 0x30]
add rbx, 0x40
pxor xmm1, xmm0
movdqu xmmword [rsp + rcx*8 + 0x60], xmm1
add rcx, 8
cmp rcx, 0x10
jb 0x1401df690
cmp rcx, 0x11
jae 0x1401df715
nop word [rax + rax]
mov rax, qword [rbx]
add rbx, 8
xor qword [rsp + rcx*8 + 0x30], rax
inc rcx
cmp rcx, 0x11
jb 0x1401df700
lea rcx, [rsp + 0x30]
call fcn.1401dfba0
sub rsi, 0x88
sub rdi, 1
jne 0x1401df670
lea rdi, [rsp + 0x30]
cmp rsi, 8
jb 0x1401df764
mov rcx, rsi
shr rcx, 3
imul rax, rcx, 0xfffffffffffffff8
add rsi, rax
nop dword [rax]
mov rax, qword [rbx]
add rbx, 8
xor qword [rdi], rax
add rdi, 8
sub rcx, 1
jne 0x1401df750
test rsi, rsi
je 0x1401df781
mov r8, rsi
lea rcx, [rsp + 0x20]
mov rdx, rbx
call sub.VCRUNTIME140.dll_memcpy
lea r15, [rsp + 0x20]
add r15, rsi
mov byte [r15], 1
lea rcx, [rsp + 0x30]
mov rax, qword [rsp + 0x20]
xor qword [rdi], rax
movabs rax, 0x8000000000000000
xor qword [rsp + 0xb0], rax
call fcn.1401dfba0
mov rax, qword [rsp + 0x30]
mov qword [r14], rax
mov rax, qword [rsp + 0x38]
mov qword [r14 + 8], rax
mov rax, qword [rsp + 0x40]
mov qword [r14 + 0x10], rax
mov rax, qword [rsp + 0x48]
mov qword [r14 + 0x18], rax
mov rax, r14
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.1401e4940
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret
Function at 0x1401df800
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x110
mov rax, qword [0x1402c94a0]
xor rax, rsp
mov qword [rsp + 0x100], rax
mov rbx, rdx
mov qword [rsp + 0x20], 0
mov rdi, rcx
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0xc8
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x30]
mov edx, 4
nop word [rax + rax]
mov r8, qword [rbx]
lea rbx, [rbx + 8]
xor qword [rax], r8
lea rax, [rax + 8]
sub rdx, 1
jne 0x1401df850
mov byte [rsp + 0x20], 1
mov rcx, qword [rsp + 0x20]
xor qword [rax], rcx
movabs rax, 0x8000000000000000
xor qword [rsp + 0xb0], rax
lea rcx, [rsp + 0x30]
call fcn.1401dfba0
mov rax, qword [rsp + 0x30]
mov qword [rdi], rax
mov rax, qword [rsp + 0x38]
mov qword [rdi + 8], rax
mov rax, qword [rsp + 0x40]
mov qword [rdi + 0x10], rax
mov rax, qword [rsp + 0x48]
mov qword [rdi + 0x18], rax
mov rax, rdi
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.1401e4940
mov rbx, qword [rsp + 0x120]
add rsp, 0x110
pop rdi
ret
Function at 0x1401df8e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x10]
sub rsp, 0x110
mov rax, qword [0x1402c94a0]
xor rax, rsp
mov qword [rbp], rax
mov rsi, r8
mov qword [rsp + 0x20], 0
mov rbx, rdx
lea r15, [rsp + 0x20]
mov r14, rcx
xor edx, edx
mov r8d, 0xc8
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memset
cmp rsi, 0x48
jb 0x1401df9b9
movabs rax, 0xe38e38e38e38e38f
mul rsi
mov rdi, rdx
shr rdi, 6
mov rax, qword [rbx]
lea rcx, [rsp + 0x30]
xor qword [rsp + 0x30], rax
mov rax, qword [rbx + 8]
xor qword [rsp + 0x38], rax
mov rax, qword [rbx + 0x10]
xor qword [rsp + 0x40], rax
mov rax, qword [rbx + 0x18]
xor qword [rsp + 0x48], rax
mov rax, qword [rbx + 0x20]
xor qword [rsp + 0x50], rax
mov rax, qword [rbx + 0x28]
xor qword [rsp + 0x58], rax
mov rax, qword [rbx + 0x30]
xor qword [rsp + 0x60], rax
mov rax, qword [rbx + 0x38]
xor qword [rsp + 0x68], rax
mov rax, qword [rbx + 0x40]
add rbx, 0x48
xor qword [rsp + 0x70], rax
call fcn.1401dfba0
sub rsi, 0x48
sub rdi, 1
jne 0x1401df951
lea rdi, [rsp + 0x30]
cmp rsi, 8
jb 0x1401df9e6
mov rcx, rsi
shr rcx, 3
imul rax, rcx, 0xfffffffffffffff8
add rsi, rax
mov rax, qword [rbx]
add rbx, 8
xor qword [rdi], rax
add rdi, 8
sub rcx, 1
jne 0x1401df9d2
test rsi, rsi
je 0x1401dfa03
mov r8, rsi
lea rcx, [rsp + 0x20]
mov rdx, rbx
call sub.VCRUNTIME140.dll_memcpy
lea r15, [rsp + 0x20]
add r15, rsi
mov byte [r15], 1
lea rcx, [rsp + 0x30]
mov rax, qword [rsp + 0x20]
xor qword [rdi], rax
movabs rax, 0x8000000000000000
xor qword [rsp + 0x70], rax
call fcn.1401dfba0
mov rax, qword [rsp + 0x30]
mov qword [r14], rax
mov rax, qword [rsp + 0x38]
mov qword [r14 + 8], rax
mov rax, qword [rsp + 0x40]
mov qword [r14 + 0x10], rax
mov rax, qword [rsp + 0x48]
mov qword [r14 + 0x18], rax
mov rax, qword [rsp + 0x50]
mov qword [r14 + 0x20], rax
mov rax, qword [rsp + 0x58]
mov qword [r14 + 0x28], rax
mov rax, qword [rsp + 0x60]
mov qword [r14 + 0x30], rax
mov rax, qword [rsp + 0x68]
mov qword [r14 + 0x38], rax
mov rax, r14
mov rcx, qword [rbp]
xor rcx, rsp
call fcn.1401e4940
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x1401dfaa0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x110
mov rax, qword [0x1402c94a0]
xor rax, rsp
mov qword [rsp + 0x100], rax
mov rbx, rdx
mov qword [rsp + 0x20], 0
mov rdi, rcx
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0xc8
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x30]
mov edx, 8
nop word [rax + rax]
mov r8, qword [rbx]
lea rbx, [rbx + 8]
xor qword [rax], r8
lea rax, [rax + 8]
sub rdx, 1
jne 0x1401dfaf0
mov byte [rsp + 0x20], 1
mov rcx, qword [rsp + 0x20]
xor qword [rax], rcx
movabs rax, 0x8000000000000000
xor qword [rsp + 0x70], rax
lea rcx, [rsp + 0x30]
call fcn.1401dfba0
mov rax, qword [rsp + 0x30]
mov qword [rdi], rax
mov rax, qword [rsp + 0x38]
mov qword [rdi + 8], rax
mov rax, qword [rsp + 0x40]
mov qword [rdi + 0x10], rax
mov rax, qword [rsp + 0x48]
mov qword [rdi + 0x18], rax
mov rax, qword [rsp + 0x50]
mov qword [rdi + 0x20], rax
mov rax, qword [rsp + 0x58]
mov qword [rdi + 0x28], rax
mov rax, qword [rsp + 0x60]
mov qword [rdi + 0x30], rax
mov rax, qword [rsp + 0x68]
mov qword [rdi + 0x38], rax
mov rax, rdi
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.1401e4940
mov rbx, qword [rsp + 0x120]
add rsp, 0x110
pop rdi
ret
Function at 0x1401e2430
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x80
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov rax, qword [0x1402c94a0]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov r14, r8
mov rdi, rdx
mov rsi, rcx
mov rcx, rdx
cmp qword [rdx + 0x18], 8
jb 0x1401e2470
mov rcx, qword [rdx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebp, eax
cmp eax, 0xffffffff
jne 0x1401e2490
mov r8, r14
mov rdx, rdi
mov rcx, rsi
call fcn.1401e22a0
jmp 0x1401e259f
xor r12d, r12d
lea r15d, [r12 + 3]
bt ebp, 0xa
jae 0x1401e2572
mov rdx, rdi
cmp qword [rdi + 0x18], 8
jb 0x1401e24af
mov rdx, qword [rdi]
movdqa xmm0, xmmword [0x140282f60]
movdqu xmmword [rsp + 0x60], xmm0
mov word [rsp + 0x50], r12w
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rdx + r8*2], r12w
jne 0x1401e24d0
lea rcx, [rsp + 0x50]
call fcn.14004d5e0
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rcx, qword [rsp + 0x50]
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x2000000
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 7]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x50]
call fcn.14004d3f0
cmp rbx, 0xffffffffffffffff
jne 0x1401e253f
mov r8, r14
mov rdx, rdi
mov rcx, rsi
call fcn.1401e22a0
nop
jmp 0x1401e259f
mov rcx, rdi
call fcn.1401e20c0
test al, al
jne 0x1401e2569
mov edx, ebp
mov rcx, rdi
call fcn.1401e21b0
mov dword [rsi], 9
mov dword [rsi + 4], eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1401e259f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r14, r14
je 0x1401e2583
mov dword [r14], r12d
call fcn.1400a9490
mov qword [r14 + 8], rax
mov edx, ebp
mov rcx, rdi
call fcn.1401e21b0
test bpl, 0x10
jne 0x1401e2599
mov r15d, 2
mov dword [rsi], r15d
mov dword [rsi + 4], eax
mov rax, rsi
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1401e4940
add rsp, 0x80
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140c5e0b0
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.140c5e237
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140c5e0e1
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140c5e0c7
add dl, dl
jne 0x140c5e0ee
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140c5e14e
xor eax, eax
add dl, dl
jne 0x140c5e0fd
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140c5e205
add dl, dl
jne 0x140c5e10e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140c5e11b
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140c5e128
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140c5e135
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140c5e142
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140c5e0d6
mov eax, 1
add dl, dl
jne 0x140c5e15e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140c5e16b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140c5e153
sub eax, ebx
mov ebx, 1
jne 0x140c5e1a4
mov ecx, 1
add dl, dl
jne 0x140c5e186
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140c5e193
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140c5e17b
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140c5e0d6
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140c5e1c0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140c5e1cd
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140c5e1b5
cmp eax, 0x7d00
jae 0x140c5e1f3
cmp eax, 0x500
jb 0x140c5e1ee
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140c5e0d6
cmp eax, 0x7f
ja 0x140c5e1f6
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140c5e0d6
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140c5e22a
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140c5e0d6
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1400049e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x60
xor r12d, r12d
lea r15, [0x140143778]
mov esi, r12d
lea r14, [0x140142530]
cmp byte [r15], r12b
je 0x140004ab4
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], reloc.WSOCK32.dll_gethostbyname
mov ecx, esi
mov dword [rsp + 0x24], 0x80
call qword [sym.imp.WINMM.dll_joyGetPosEx]
test eax, eax
jne 0x140004ab4
mov eax, dword [rsp + 0x40]
mov ebp, dword [r14]
xor ebp, eax
mov dword [r14], eax
and ebp, eax
je 0x140004ab4
movzx edx, word [0x1401437ac]
mov ebx, r12d
cmp r12w, dx
jae 0x140004ab4
mov rdi, r12
nop
mov rax, qword [0x140143798]
mov rax, qword [rdi + rax]
cmp byte [rax + 0x12], 4
jne 0x140004aa7
movzx ecx, byte [rax + 0x10]
cmp ecx, esi
jne 0x140004aa7
movzx ecx, word [rax + 8]
sub ecx, 0xc
movzx eax, cl
bt ebp, eax
jae 0x140004aa7
mov rcx, qword [0x140142770]
xor r9d, r9d
movsxd r8, ebx
mov edx, 0x312
call qword [sym.imp.USER32.dll_PostMessageW]
movzx edx, word [0x1401437ac]
inc ebx
movzx eax, dx
add rdi, 8
cmp ebx, eax
jl 0x140004a60
inc esi
inc r15
add r14, 4
cmp esi, 0x10
jl 0x140004a12
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
Function at 0x140004fa0
Capabilities:
Set current directory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, qword [0x14013dbf0]
movzx edi, r9b
mov r9d, ecx
movzx esi, dl
test r8b, r8b
je 0x140004fd9
inc dword [0x1401425dc]
add rbx, 0x150
mov qword [0x14013dbf0], rbx
mov rax, rbx
lea rcx, [0x1401425e0]
mov edx, 2
nop dword [rax + rax]
movups xmm0, xmmword [rcx]
lea rcx, [rcx + 0x80]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rcx - 0x70]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rcx - 0x60]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [rcx - 0x50]
movups xmmword [rax + 0x30], xmm1
movups xmm0, xmmword [rcx - 0x40]
movups xmmword [rax + 0x40], xmm0
movups xmm1, xmmword [rcx - 0x30]
movups xmmword [rax + 0x50], xmm1
movups xmm0, xmmword [rcx - 0x20]
movups xmmword [rax + 0x60], xmm0
sub rax, 0xffffffffffffff80
movups xmm1, xmmword [rcx - 0x10]
movups xmmword [rax - 0x10], xmm1
sub rdx, 1
jne 0x140004ff0
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rax + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rax + 0x40], xmm0
mov dword [rbx + 0x3c], r9d
test r8b, r8b
je 0x14000507a
lea rcx, [0x140145cd0]
call fcn.140035340
cmp dword [0x14014276c], 0
mov qword [0x1401468c0], 0
je 0x1400050b1
mov rax, qword [0x140140400]
lea rcx, [0x140103574]
test rax, rax
je 0x1400050ab
mov rax, qword [rax]
test rax, rax
cmovne rcx, rax
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test sil, sil
jne 0x14000513e
movzx eax, byte [rbx + 0x12e]
test al, al
jne 0x1400050e2
cmp dil, 0x65
sete al
mov byte [rbx + 0x12e], al
jne 0x1400050e2
mov qword [rbx], 0xffffffffffffffff
mov dword [rbx + 0x34], 0xffffffff
cmp dword [0x1401468cc], 0
je 0x1400050f4
cmp dword [0x1401468c8], 0
jne 0x1400050f8
test al, al
je 0x14000513e
mov byte [rbx + 0x12c], 0
test al, al
jne 0x14000513e
cmp dword [0x1401468cc], 0
jge 0x140005126
mov dword [rbx + 0x120], 0xffffffff
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rbx + 0x11c], eax
mov eax, dword [0x1401468cc]
mov dword [rbx + 0x120], eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret