joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1406d5851
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], r9
cmp r10, 0x19bf9281
jmp 0x1406d5869
mov qword [rsp + 0x18], r8
movsx r8, r9w
stc
xchg r8b, r8b
mov dword [rsp + 0x10], edx
test sp, 0xf205
cwd
mov qword [rsp + 8], rcx
sub rsp, 0x78
bswap r8
movsxd r8, ebx
mov dword [rsp + 0x38], 1
mov r8w, 0x4717
mov dword [rsp + 0x3c], 0
cqo
bswap rdx
xorps xmm0, xmm0
cmovb rdx, rbx
movss dword [rsp + 0x40], xmm0
jmp 0x1406d58c3
xorps xmm0, xmm0
cdq
jmp 0x1406d58ce
movss dword [rsp + 0x44], xmm0
movsx cx, sil
not dx
xorps xmm0, xmm0
movss dword [rsp + 0x48], xmm0
xorps xmm0, xmm0
bswap rcx
movzx rdx, si
cwd
movss dword [rsp + 0x4c], xmm0
mov dword [rsp + 0x50], 0
movsx dx, r11b
mov cl, r14b
cqo
mov dword [rsp + 0x54], 0
movsxd rcx, edx
movzx rdx, r10w
mov dword [rsp + 0x58], 0
not r8w
movzx r8, dx
mov dword [rsp + 0x5c], 0
mov qword [rsp + 0x60], 0
mov dword [rsp + 0x68], 0
movzx r8d, si
not ch
setl dh
lea r8, [rsp + 0x38]
cdq
mov edx, dword [rsp + 0x88]
mov rcx, qword [rsp + 0x80]
jmp 0x1406d5964
call fcn.1406d320a
mov dword [rsp + 0x20], eax
cmp r10, 0xffffffffa104788a
cmp qword [rsp + 0x90], 0
jmp 0x1406d5982
je 0x1406d59c4
cmp dword [rsp + 0x20], 0
jmp 0x1406d5992
je 0x1406d59aa
mov eax, dword [rsp + 0x50]
jmp 0x1406d59a1
mov dword [rsp + 0x24], eax
jmp 0x1406d59b2
mov dword [rsp + 0x24], 0
mov rax, qword [rsp + 0x90]
rcr ecx, 0xbf
mov ecx, dword [rsp + 0x24]
stc
mov dword [rax], ecx
cmp qword [rsp + 0x98], 0
jmp 0x1406d59d2
je 0x1406d5a25
cmp dword [rsp + 0x20], 0
jmp 0x1406d59e2
je 0x1406d59ff
mov eax, dword [rsp + 0x58]
jmp 0x1406d59f1
mov dword [rsp + 0x28], eax
jmp 0x1406d59fa
jmp 0x1406d5a0e
mov dword [rsp + 0x28], 0
dec ah
movsx cx, r11b
mov rax, qword [rsp + 0x98]
rcr cl, cl
dec cx
mov ecx, dword [rsp + 0x28]
stc
mov dword [rax], ecx
cmp rdi, r10
cmp qword [rsp + 0xa0], 0
je 0x1406d5a6d
cmp dword [rsp + 0x20], 0
je 0x1406d5a51
mov eax, dword [rsp + 0x54]
jmp 0x1406d5a48
mov dword [rsp + 0x2c], eax
jmp 0x1406d5a59
mov dword [rsp + 0x2c], 0
mov rax, qword [rsp + 0xa0]
xor ecx, 0xd30de086
mov ecx, dword [rsp + 0x2c]
mov dword [rax], ecx
cmp qword [rsp + 0xa8], 0
jmp 0x1406d5a7b
je 0x1406d5ac3
cmp dword [rsp + 0x20], 0
jmp 0x1406d5a8b
je 0x1406d5a9e
mov eax, dword [rsp + 0x5c]
mov dword [rsp + 0x30], eax
jmp 0x1406d5aae
mov dword [rsp + 0x30], 0
movsx cx, bl
rcr rcx, 0x3d
mov rax, qword [rsp + 0xa8]
btr rcx, rcx
mov ecx, dword [rsp + 0x30]
mov dword [rax], ecx
test r13b, al
cmp dword [rsp + 0x20], 0
jmp 0x1406d5acd
je 0x1406d5ae5
mov eax, dword [rsp + 0x68]
jmp 0x1406d5adc
mov dword [rsp + 0x34], eax
jmp 0x1406d5aed
mov dword [rsp + 0x34], 0
mov eax, dword [rsp + 0x34]
stc
cmp r14b, 0xb1
test rdi, 0xffffffff9bbc3112
add rsp, 0x78
ret
Function at 0x1406e6b19
Capabilities:
Resolve function by parsing pe exports

Disassembly:
movss dword [rsp + 0x20], xmm3
clc
cmc
movss dword [rsp + 0x18], xmm2
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
cmc
cmp r12b, 0x81
sub rsp, 0x68
movss xmm0, dword [rsp + 0x80]
jmp 0x1406e6b48
ucomiss xmm0, dword [0x1400c197c]
jne 0x1406e6b88
mov rax, qword [rsp + 0x70]
and cl, 0xae
neg ch
add ecx, ebx
add rax, 0x80
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x78]
mov cl, r14b
mov rcx, qword [rsp + 0x40]
jmp 0x1406e6b7e
call fcn.1406c9646
jmp 0x1406e6d6b
mov rax, qword [rsp + 0x70]
add rax, 0x80
cqo
jmp 0x1406e6b9a
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x70]
movsx rcx, r12w
mov eax, dword [rax + 0x80]
not dh
movsx edx, sp
mov ecx, dword [rsp + 0x98]
movsxd rdx, r8d
lea eax, [rcx + rax + 1]
mov edx, eax
movsxd rcx, edx
movsx cx, r11b
movzx ecx, cx
mov rcx, qword [rsp + 0x48]
jmp 0x1406e6bd8
call fcn.1406c97ee
mov dword [rsp + 0x20], 0
jmp 0x1406e6bea
jmp 0x1406e6c03
mov eax, dword [rsp + 0x20]
jmp 0x1406e6bf8
inc eax
mov dword [rsp + 0x20], eax
bt ax, 0x90
mov eax, dword [rsp + 0x98]
cmp dword [rsp + 0x20], eax
jmp 0x1406e6c13
jg 0x1406e6d6b
cvtsi2ss xmm0, dword [rsp + 0x20]
cvtsi2ss xmm1, dword [rsp + 0x98]
divss xmm0, xmm1
movss xmm1, dword [rsp + 0x90]
subss xmm1, dword [rsp + 0x88]
jmp 0x1406e6c43
mulss xmm0, xmm1
movss xmm1, dword [rsp + 0x88]
movsx eax, r13w
addss xmm1, xmm0
movaps xmm0, xmm1
cmovo ax, dx
movss dword [rsp + 0x24], xmm0
neg ax
mov rax, qword [rsp + 0x70]
cmc
jmp 0x1406e6c73
add rax, 0x80
jmp 0x1406e6c7e
mov qword [rsp + 0x50], rax
jmp 0x1406e6c88
movss xmm0, dword [rsp + 0x24]
jmp 0x1406e6c93
call fcn.1400aeae0
mulss xmm0, dword [rsp + 0x80]
mov rax, qword [rsp + 0x78]
jmp 0x1406e6cab
movss xmm1, dword [rax + 4]
jmp 0x1406e6cb5
addss xmm1, xmm0
jmp 0x1406e6cbe
movaps xmm0, xmm1
movss dword [rsp + 0x30], xmm0
jmp 0x1406e6ccc
movss xmm0, dword [rsp + 0x24]
jmp 0x1406e6cd7
call fcn.1400abdb0
mulss xmm0, dword [rsp + 0x80]
mov rax, qword [rsp + 0x78]
mov dx, bp
jmp 0x1406e6cf7
movss xmm1, dword [rax]
sets dh
movsx rcx, r11w
xchg dh, cl
addss xmm1, xmm0
not cl
cdq
movaps xmm0, xmm1
jmp 0x1406e6d17
movss dword [rsp + 0x28], xmm0
setbe dh
jmp 0x1406e6d26
movss xmm0, dword [rsp + 0x28]
cqo
movss dword [rsp + 0x38], xmm0
xchg dl, dh
movss xmm0, dword [rsp + 0x30]
movzx edx, cx
movss dword [rsp + 0x3c], xmm0
mov ch, 0xbe
lea rdx, [rsp + 0x38]
movzx rcx, di
movsx ecx, dx
xchg cx, cx
mov rcx, qword [rsp + 0x50]
jmp 0x1406e6d61
call fcn.1406c9646
jmp 0x1406e6bef
add rsp, 0x68
jmp 0x1406e6d74
ret
Function at 0x14070aaca
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov qword [rsp + 0x20], r9
sar ax, cl
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
cmp rbx, 0x6a1f393c
sub rsp, 0x88
add rax, 0x432d3938
ror ah, cl
mov eax, dword [rsp + 0x98]
cmc
mov dword [rsp + 0x60], eax
not rax
rol ax, 0x88
mov dword [rsp + 0x64], 0
ror ah, cl
jmp 0x14070ab19
mov qword [rsp + 0x68], 0x1b
bt eax, 0x3f
test ebp, edi
mov rax, qword [rsp + 0x90]
cmp dword [rax + 0x30], 1
jmp 0x14070ab39
jne 0x14070ab48
mov qword [rsp + 0x68], 0x1d
mov qword [rsp + 0x50], 0
movzx r9d, r14w
cdqe
movzx rdx, r10w
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov r8b, 0xa
bswap eax
rdtsc
mov qword [rsp + 0x38], 0
movsxd r8, esi
cdq
mov rax, qword [rsp + 0xa8]
not r8
cmovle ecx, edi
mov qword [rsp + 0x30], rax
cqo
cwd
rdtsc
mov rax, qword [rsp + 0xb0]
movsx r8d, si
cqo
mov r8d, ebx
mov qword [rsp + 0x28], rax
movzx r9d, di
lahf
mov rax, qword [rsp + 0xa0]
movzx cx, sil
mov qword [rsp + 0x20], rax
cmovle edx, r13d
cdq
mov r9, qword [rsp + 0x60]
setg al
cwde
movzx rax, r8w
mov r8, qword [rsp + 0x68]
bswap rdx
mov rax, qword [rsp + 0x90]
mov edx, dword [rax + 8]
jmp 0x14070abf1
mov rax, qword [rsp + 0x90]
mov rcx, qword [rax]
jmp 0x14070ac01
call fcn.140688e62
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x70]
jmp 0x14070ac15
mov qword [rsp + 0x78], rax
btc rax, 0x16
shl al, 0x14
mov eax, dword [rsp + 0x78]
jmp 0x14070ac2b
add rsp, 0x88
jmp 0x14070ac37
ret

Function at 0x14070cc6e
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
sub rsp, 0x18
ror eax, 0x2d
sbb eax, eax
xadd al, r8b
mov r8, rcx
bts ax, r13w
bt ax, 0xbd
cwde
mov eax, 0x5a4d
cmp word [0x140000000], ax
jne 0x14070cdca
movsxd rcx, dword [0x14000003c]
bsr rdx, r13
lea rdx, [0x140000000]
test r10b, r14b
lea rcx, [rcx + rdx]
stc
test r12b, 0x35
test sil, spl
cmp dword [rcx], 0x4550
jmp 0x14070ccc7
jne 0x14070cdca
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jmp 0x14070ccdb
jne 0x14070cdca
sub r8, rdx
btr r9d, 0x82
bswap r9d
bsr eax, r8d
movzx eax, word [rcx + 0x14]
and rdx, r12
lea rdx, [rcx + 0x18]
setne r9b
sbb r9w, 0xd208
lea rdx, [rdx + rax]
cmove r9w, r8w
movzx eax, word [rcx + 6]
lea rcx, [rax + rax*4]
adc r9b, 0x30
bt r9d, ebx
sar r9b, cl
lea r9, [rdx + rcx*8]
cmp r8b, spl
mov qword [rsp], rdx
cmp r11b, sil
cmp r14d, 0x8b06042c
cmp rdx, r9
jmp 0x14070cd3e
je 0x14070cd84
mov ecx, dword [rdx + 0xc]
test r13b, 0x98
stc
cmp r8, rcx
jmp 0x14070cd54
jb 0x14070cd7b
mov eax, dword [rdx + 8]
cmc
add eax, ecx
jmp 0x14070cd6d
cmp r8, rax
jmp 0x14070cd75
jb 0x14070cd8e
add rdx, 0x28
jmp 0x14070cd28
sub edx, edx
test cl, r13b
cmc
cmp r13b, 0x1a
test rdx, rdx
jmp 0x14070cd96
jne 0x14070cda3
sub al, al
jmp 0x14070cdd3
cmp dword [rdx + 0x24], 0
jmp 0x14070cdac
jge 0x14070cdbe
sub al, al
jmp 0x14070cdb9
jmp 0x14070cdd3
mov al, 1
jmp 0x14070cdc5
jmp 0x14070cdd3
sub al, al
jmp 0x14070cdd3
add rsp, 0x18
jmp 0x14070cddc
ret
Function at 0x14070ea95
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
sub bl, spl
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
btc r10w, r13w
bsf si, r11w
push r14
shr bl, 0x37
rol rbp, 0xad
mov bl, byte [rcx]
shl r10b, 0xb5
adc r11b, 0x90
lea r10, [rcx + 1]
movzx r14w, r8b
sbb bpl, r9b
cmp di, di
mov byte [rdx], bl
shl r11w, cl
mov esi, r9d
movzx rdi, r15w
lea r14, [0x140000000]
add r11d, r14d
not edi
mov rbp, r8
bt di, cx
clc
rol r11b, cl
mov r11, rdx
sub rdi, 0x411d213
clc
mov rdi, rcx
stc
test bl, 4
jmp 0x14070eb12
je 0x14070eb76
movzx ecx, byte [r10]
sar rax, cl
bts eax, r9d
xor eax, 0xc83bc280
and ecx, 0xf
rcl al, cl
sbb al, sil
sbb rax, 0xffffffffc2a6c80a
movsx rax, byte [rcx + r14 + 0xb3b18]
jmp 0x14070eb4e
mov cl, byte [rcx + r14 + 0xb3b28]
jmp 0x14070eb5b
sub r10, rax
sbb ah, 0xd
rcl ah, cl
mov eax, dword [r10 - 4]
cmp ecx, 0x583f2921
shr eax, cl
clc
test ebx, r13d
mov dword [rdx + 4], eax
test bl, 8
jmp 0x14070eb7e
je 0x14070eba1
mov eax, dword [r10]
cmp r11b, spl
cmp bpl, 0xa3
add r10, 4
test eax, 0x9239c737
mov dword [rdx + 8], eax
test r13w, 0xa1bb
clc
test bl, 0x10
jmp 0x14070eba9
je 0x14070ebc4
mov eax, dword [r10]
cmc
add r10, 4
not r8w
shld r8w, si, 9
mov dword [rdx + 0xc], eax
movsxd rax, dword [r10]
and r8w, 0x8a93
stc
dec r8
lea r8, [r10 + 4]
sub r9d, r9d
jmp 0x14070ebdd
cmp byte [rsp + 0x30], r9b
jmp 0x14070ebe7
jne 0x14070ec9c
test bl, 2
jmp 0x14070ebf5
je 0x14070ec9c
lea rdx, [rax + rbp]
lahf
btc eax, ecx
movzx ecx, byte [rdx]
sal al, 0x82
shl ah, cl
sbb r10w, sp
and ecx, 0xf
sar r10b, 3
btr r10w, bp
movsx rax, byte [rcx + r14 + 0xb3b18]
mov cl, byte [rcx + r14 + 0xb3b28]
and r10w, 0x5481
cmc
sub rdx, rax
rol r10b, 0x98
mov r10d, dword [rdx - 4]
shr r10d, cl
mov dword [r11 + 0x10], r9d
test r10d, r10d
je 0x14070ec9f
mov eax, dword [rdx]
mov ecx, dword [rdx + 4]
test r8d, 0xf85e69c
lea rdx, [rdx + 8]
cmp dx, 0x3288
cmp eax, esi
jmp 0x14070ec6a
je 0x14070ec8e
inc r9d
test r14, 0xffffffffcd15e7b8
stc
cmp r9d, r10d
jmp 0x14070ec83
jb 0x14070ec4e
jmp 0x14070ec9f
mov dword [r11 + 0x10], ecx
jmp 0x14070ec97
jmp 0x14070ec9f
mov dword [rdx + 0x10], eax
test bl, 1
je 0x14070ecfb
movzx ecx, byte [r8]
and ecx, 0xf
btc ebx, edi
movsx rdx, byte [rcx + r14 + 0xb3b18]
xadd rbx, rax
lahf
mov cl, byte [rcx + r14 + 0xb3b28]
xchg sil, sil
bswap ebp
sub r8, rdx
sub dl, 0xb8
cwde
mov edx, dword [r8 - 4]
mov r14b, 3
btr bp, 0xbc
ror r14, 0x80
shr edx, cl
shr rbx, cl
sbb bx, 0x21a3
mov dword [r11 + 0x14], edx
add bl, r8b
shl sil, cl
sets bh
mov rbx, qword [rsp + 0x10]
cbw
shr sil, 0x34
sub r8, rdi
jmp 0x14070ed11
mov rbp, qword [rsp + 0x18]
mov rax, r8
xchg esi, edi
mov rsi, qword [rsp + 0x20]
movsx r14w, r13b
mov rdi, qword [rsp + 0x28]
movzx r14d, dx
movsx r14w, r11b
cmovne r14, r9
pop r14
ret
Function at 0x41d560
Capabilities:
Hash data using murmur3

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
cmp byte [0x005c7513], 0
jne 0x41d64f
nop
nop
nop
nop
sub rbx, qword [rax + 0x18]
nop
mov edx, dword [rax + 0x5c]
imul rbx, rdx
mov rdx, rbx
shr rbx, 0x20
nop
shr rdx, 0x23
and ebx, 7
mov rsi, rcx
mov rcx, rbx
mov edi, 1
shl edi, cl
nop
add rdx, qword [rax + 0x50]
lock or byte [rdx], dil
nop
nop
mov rcx, qword [rax + 0x18]
nop
movabs rdx, 0x800000000000
lea rax, [rdx + rcx]
mov rdx, rax
shr rax, 0x2a
cmp rax, 0x40
jae 0x41d645
lea rbx, [0x00599970]
mov rax, qword [rbx + rax*8]
shr rdx, 0x16
and edx, 0xfffff
mov rdx, qword [rax + rdx*8]
test byte [rdx], al
test byte [rax], al
mov rax, rcx
shr rcx, 0x10
and ecx, 0x3f
movzx ebx, byte [rdx + rcx + 0x21040]
lea rdx, [rdx + rcx]
lea rdx, [rdx + 0x21040]
shr rax, 0xd
and eax, 7
mov rcx, rax
mov eax, 1
shl eax, cl
nop dword [rax]
test al, bl
jne 0x41d627
lock or byte [rdx], al
mov rax, qword [r14 + 0x30]
mov rax, qword [rax + 0xa0]
test byte [rax], al
add qword [rax + 0x1248], rsi
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov ecx, 0x40
call fcn.0045c840
lea rax, [0x004cc700]
mov ebx, 0x2c
nop dword [rax + rax]
call fcn.004330a0
nop
int3
Function at 0x42c7c0
Capabilities:
Hash data using murmur3

Disassembly:
cmp rsp, qword [r14 + 0x18]
jbe 0x42ca66
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
test byte [rax], al
lea rsi, [rax + 0x1270]
mov rcx, qword [rax + 0x1260]
sub rcx, rsi
shr rcx, 3
cmp rcx, 0x200
ja 0x42ca5a
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x30], rcx
mov qword [rax + 0x1260], 0
cmp byte [0x005c7513], 0
jne 0x42c822
xor edx, edx
xor ebx, ebx
nop
jmp 0x42c86b
xor edx, edx
jmp 0x42c84e
mov qword [rsp + 0x28], rdx
mov rcx, qword [rax + rdx*8 + 0x1270]
mov rax, rcx
call fcn.0041cd80
mov rcx, qword [rsp + 0x28]
lea rdx, [rcx + 1]
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
cmp rdx, rcx
jl 0x42c826
add rax, 0x1260
call fcn.0042c640
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
inc rdx
cmp rdx, rcx
jge 0x42c9f2
mov rsi, qword [rax + rdx*8 + 0x1270]
nop dword [rax]
cmp rsi, 0x1000
jb 0x42c868
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rbx
mov rax, rsi
xor ebx, ebx
mov rcx, rbx
nop dword [rax + rax]
call fcn.00411920
test rax, rax
jne 0x42c8c2
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
nop
jmp 0x42c868
nop
mov rsi, rcx
shr rcx, 3
and esi, 7
mov rdx, rcx
mov rcx, rsi
mov r8d, 1
shl r8d, cl
nop
add rdx, qword [rbx + 0x50]
movzx esi, byte [rdx]
test r8b, sil
je 0x42c905
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
nop dword [rax]
jmp 0x42c868
nop
lock or byte [rdx], r8b
nop
nop
mov rcx, qword [rbx + 0x18]
nop
movabs rsi, 0x800000000000
lea r8, [rsi + rcx]
mov r9, r8
shr r8, 0x2a
cmp r8, 0x40
jae 0x42ca4d
lea r10, [0x00599970]
mov r8, qword [r10 + r8*8]
shr r9, 0x16
and r9d, 0xfffff
mov r9, qword [r8 + r9*8]
test byte [r9], al
test byte [r8], al
mov r8, rcx
shr rcx, 0x10
and ecx, 0x3f
movzx r10d, byte [r9 + rcx + 0x21040]
lea r9, [r9 + rcx]
lea r9, [r9 + 0x21040]
shr r8, 0xd
and r8d, 7
mov rcx, r8
mov r8d, 1
shl r8d, cl
test r8b, r10b
jne 0x42c98b
lock or byte [r9], r8b
movzx r8d, byte [rbx + 0x62]
test r8b, 1
je 0x42c9c5
mov r8, qword [rsp + 0x48]
mov r9, qword [r8 + 0x1248]
add r9, qword [rbx + 0x68]
mov qword [r8 + 0x1248], r9
mov rax, r8
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
nop
jmp 0x42c868
mov r8, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
cmp r8, rcx
jae 0x42ca45
mov r9, qword [rsp + 0x48]
mov qword [r9 + r8*8 + 0x1270], rax
lea rbx, [r8 + 1]
mov rax, r9
mov rdx, qword [rsp + 0x28]
jmp 0x42c868
cmp rbx, 0x200
ja 0x42ca37
lea rdx, [rax + 0x1270]
lea rsi, [rax + 0x1238]
mov rcx, rbx
mov edi, 0x200
mov rbx, rdx
mov rax, rsi
call fcn.004229a0
mov rdx, qword [rsp + 0x48]
lea rax, [rdx + 0x1260]
call fcn.0042c640
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov rcx, rbx
mov edx, 0x200
nop
call fcn.0045c8a0
mov rax, r8
call fcn.0045c820
mov rax, r8
mov ecx, 0x40
call fcn.0045c840
mov edx, 0x200
nop
call fcn.0045c880
nop
mov qword [rsp + 8], rax
call fcn.0045e840
mov rax, qword [rsp + 8]
jmp fcn.0042c7c0
Function at 0x45c260
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x40248f
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
mov rax, rdx
nop
call fcn.00408d80
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045a140
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x402460
cmp byte [0x005c7512], 0
je 0x45c275
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp 0x459240
jmp 0x402460

Function at 0x45c280
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x005c77e0]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d124b
mul rcx
nop
nop
xor rax, rdx
ret
cmp byte [0x005c7512], 0
je 0x45c2b5
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x005c7aa0]
aesenc xmm0, xmmword [0x005c7ab0]
aesenc xmm0, xmmword [0x005c7ac0]
movq rax, xmm0
ret
jmp 0x408f80

Function at 0x45c2c0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, qword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x005c77e0]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
nop
nop
xor rax, rdx
ret
cmp byte [0x005c7512], 0
je 0x45c2f6
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x005c7aa0]
aesenc xmm0, xmmword [0x005c7ab0]
aesenc xmm0, xmmword [0x005c7ac0]
movq rax, xmm0
ret
jmp 0x408fe0

Function at 0x45dc20
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x30
mov rcx, 0xfffffffffffffff4
mov qword [rsp], rcx
mov rax, qword [sym.imp.kernel32.dll_GetStdHandle]
call rax
mov rcx, rax
mov qword [rsp], rcx
lea rdx, [0x005c7a20]
mov qword [rsp + 8], rdx
lea r8d, [0x005c7528]
mov qword [rsp + 0x10], r8
lea r9, [rsp + 0x28]
mov qword [r9], 0
mov qword [rsp + 0x18], r9
mov qword [rsp + 0x20], 0
mov rax, qword [sym.imp.kernel32.dll_WriteFile]
call rax
call fcn.0045c1a0
add rsp, 0x30
ret
Function at 0x477e20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x477f26
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rsi
test r8, r8
je 0x477ea2
cmp rdi, r8
jb 0x477f18
cmp rsi, rbx
je 0x477e85
nop
mov rdx, rbx
lea rdi, [rsi + r8]
lea rdi, [rdi - 1]
cmp rdi, rbx
jb 0x477e82
mov rdi, rsi
lea r9, [rdx + r8]
lea r9, [r9 - 1]
cmp r9, rsi
jae 0x477f05
mov rbx, rdx
mov rsi, rdi
jmp 0x477e85
mov rbx, rdx
movzx edx, byte [rax + 0x400]
movzx edi, byte [rax + 0x401]
lea r9, [r8 - 1]
cmp rcx, r9
jbe 0x477efd
xor ecx, ecx
nop
jmp 0x477ee1
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
movzx r9d, byte [rsi + rcx]
inc edx
movzx r10d, dl
mov r11d, dword [rax + r10*4]
add edi, r11d
movzx r12d, dil
mov r13d, dword [rax + r12*4]
mov dword [rax + r10*4], r13d
mov dword [rax + r12*4], r11d
lea r10d, [r11 + r13]
movzx r10d, r10b
xor r9d, dword [rax + r10*4]
mov byte [rbx + rcx], r9b
inc rcx
cmp r8, rcx
jg 0x477eac
mov byte [rax + 0x400], dl
mov byte [rax + 0x401], dil
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov rax, r9
call fcn.0045c820
lea rax, [0x004af5a0]
lea rbx, [0x004eff40]
call fcn.00432920
mov rcx, r8
mov rdx, rdi
nop
call fcn.0045c8a0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
call fcn.0045a140
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
jmp fcn.00477e20
Function at 0x1406ae058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1406ae1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1406ae089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406ae06f
add dl, dl
jne 0x1406ae096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406ae0f6
xor eax, eax
add dl, dl
jne 0x1406ae0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406ae1ad
add dl, dl
jne 0x1406ae0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406ae0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406ae0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406ae0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1406ae0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1406ae07e
mov eax, 1
add dl, dl
jne 0x1406ae106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406ae113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406ae0fb
sub eax, ebx
mov ebx, 1
jne 0x1406ae14c
mov ecx, 1
add dl, dl
jne 0x1406ae12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1406ae13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406ae123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1406ae07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1406ae168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1406ae175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406ae15d
cmp eax, 0x7d00
jae 0x1406ae19b
cmp eax, 0x500
jb 0x1406ae196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1406ae07e
cmp eax, 0x7f
ja 0x1406ae19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1406ae07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1406ae1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1406ae07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20