joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402c69
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rbp + 0x10], rcx
mov eax, 0
mov byte [rbp - 1], al
movzx eax, byte [rbp - 1]
cmp eax, 4
jge 0x402d0d
jmp 0x402c93
movzx eax, byte [rbp - 1]
add eax, 1
mov byte [rbp - 1], al
jmp 0x402c75
mov eax, 0
mov byte [rbp - 2], al
movzx eax, byte [rbp - 2]
cmp eax, 4
jge 0x402d08
jmp 0x402cb9
movzx eax, byte [rbp - 2]
add eax, 1
mov byte [rbp - 2], al
jmp 0x402c9b
mov rax, qword [rbp + 0x10]
movzx ecx, byte [rbp - 2]
movsxd rcx, ecx
shl rcx, 2
add rax, rcx
movzx ecx, byte [rbp - 1]
movsxd rcx, ecx
add rax, rcx
mov rcx, qword [rbp + 0x10]
movzx edx, byte [rbp - 2]
movsxd rdx, edx
shl rdx, 2
add rcx, rdx
movzx edx, byte [rbp - 1]
movsxd rdx, edx
add rcx, rdx
movzx edx, byte [rcx]
movsxd rdx, edx
lea rcx, str.cw
add rcx, rdx
movzx edx, byte [rcx]
mov byte [rax], dl
jmp 0x402cad
jmp 0x402c87
leave
ret

Function at 0x403fdc
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rbp + 0x10], rcx
mov eax, 0
mov byte [rbp - 1], al
movzx eax, byte [rbp - 1]
cmp eax, 4
jge 0x40408b
jmp 0x404011
movzx eax, byte [rbp - 1]
add eax, 1
mov byte [rbp - 1], al
jmp 0x403ff3
mov eax, 0
mov byte [rbp - 2], al
movzx eax, byte [rbp - 2]
cmp eax, 4
jge 0x404086
jmp 0x404037
movzx eax, byte [rbp - 2]
add eax, 1
mov byte [rbp - 2], al
jmp 0x404019
mov rax, qword [rbp + 0x10]
movzx ecx, byte [rbp - 2]
movsxd rcx, ecx
shl rcx, 2
add rax, rcx
movzx ecx, byte [rbp - 1]
movsxd rcx, ecx
add rax, rcx
mov rcx, qword [rbp + 0x10]
movzx edx, byte [rbp - 2]
movsxd rdx, edx
shl rdx, 2
add rcx, rdx
movzx edx, byte [rbp - 1]
movsxd rdx, edx
add rcx, rdx
movzx edx, byte [rcx]
movsxd rdx, edx
lea rcx, [0x00414852]
add rcx, rdx
movzx edx, byte [rcx]
mov byte [rax], dl
jmp 0x40402b
jmp 0x404005
leave
ret

Function at 0x403fe7
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rbp + 0x10], rcx
mov eax, 0
mov byte [rbp - 1], al
movzx eax, byte [rbp - 1]
cmp eax, 4
jge 0x40408b
jmp 0x404011
movzx eax, byte [rbp - 1]
add eax, 1
mov byte [rbp - 1], al
jmp 0x403ff3
mov eax, 0
mov byte [rbp - 2], al
movzx eax, byte [rbp - 2]
cmp eax, 4
jge 0x404086
jmp 0x404037
movzx eax, byte [rbp - 2]
add eax, 1
mov byte [rbp - 2], al
jmp 0x404019
mov rax, qword [rbp + 0x10]
movzx ecx, byte [rbp - 2]
movsxd rcx, ecx
shl rcx, 2
add rax, rcx
movzx ecx, byte [rbp - 1]
movsxd rcx, ecx
add rax, rcx
mov rcx, qword [rbp + 0x10]
movzx edx, byte [rbp - 2]
movsxd rdx, edx
shl rdx, 2
add rcx, rdx
movzx edx, byte [rbp - 1]
movsxd rdx, edx
add rcx, rdx
movzx edx, byte [rcx]
movsxd rdx, edx
lea rcx, [0x00414852]
add rcx, rdx
movzx edx, byte [rcx]
mov byte [rax], dl
jmp 0x40402b
jmp 0x404005
leave
ret
Function at 0x4043eb
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov eax, 0
mov byte [rbp - 1], al
movzx eax, byte [rbp - 1]
cmp eax, 0x20
jge 0x404454
jmp 0x404424
movzx eax, byte [rbp - 1]
add eax, 1
mov byte [rbp - 1], al
jmp 0x404406
movzx eax, byte [rbp - 1]
movsxd rax, eax
mov rcx, qword [rbp + 0x10]
add rcx, rax
movzx eax, byte [rbp - 1]
movsxd rax, eax
mov rdx, qword [rbp + 0x18]
add rdx, rax
movzx eax, byte [rcx]
mov qword [rbp - 0x10], rcx
movzx ecx, byte [rdx]
xor eax, ecx
mov rcx, qword [rbp - 0x10]
mov byte [rcx], al
jmp 0x404418
leave
ret

Function at 0x4043f6
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov eax, 0
mov byte [rbp - 1], al
movzx eax, byte [rbp - 1]
cmp eax, 0x20
jge 0x404454
jmp 0x404424
movzx eax, byte [rbp - 1]
add eax, 1
mov byte [rbp - 1], al
jmp 0x404406
movzx eax, byte [rbp - 1]
movsxd rax, eax
mov rcx, qword [rbp + 0x10]
add rcx, rax
movzx eax, byte [rbp - 1]
movsxd rax, eax
mov rdx, qword [rbp + 0x18]
add rdx, rax
movzx eax, byte [rcx]
mov qword [rbp - 0x10], rcx
movzx ecx, byte [rdx]
xor eax, ecx
mov rcx, qword [rbp - 0x10]
mov byte [rcx], al
jmp 0x404418
leave
ret
Function at 0x140c6245e
Capabilities:
Encode data using xor

Disassembly:
je 0x140c624b8
insb byte [rdi], dx
insb byte [rdi], dx
add byte [rbx + 0x2d4ffcbc], bh
jmp 0x140c624c9
jne 0x1417762a1
sub al, 0xa9
jrcxz 0x140c62451
mov ebp, 0xc0a67306
invalid
pop rdi
xor byte [rsi], 0x38
invalid
jg 0x140c624cf
jb 0x140c624ce
outsb dx, byte [rsi]
cmp bl, byte [rsi]
lea esp, [rdx + 0x37e1214d]
lea ecx, [rdx - 0x53a2cfad]
pop rsp
invalid
invalid
push qword [rsp + 0x28]
popfq
lea rsp, [rsp + 0x30]
call fcn.14198717f
jno 0x1417762b8
sub eax, 0xa081e31
int 0x4f
int 0x4f
jns 0x1417762e3
ror dh, cl
test dword [rbx + 0x3e32da2a], ebp
mov eax, 0x1c312505
fidivr dword [rdx - 0x734d32dd]
cmpsd dword [rsi], dword [rdi]
int 0xce
or cl, byte [rax + rcx*4 - 0x3b]
xor bl, byte [rdi]
adc dword [rbx], eax
cmp ch, cl
pop rcx
mov esp, cs
invalid
test al, 0xcb
xor dl, byte [rdi + 0x3139d539]
jbe 0x1417762e5
xchg edi, eax
xor cl, ch
mov edi, 0xcec6baa1
pop rbp
and esi, dword [rdi + 0x68b632ce]
cwde
xor dword [rcx], esi
int3

Function at 0x401000
Capabilities:
Enumerate processes

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x160
mov qword [rbp + 0x10], rcx
mov eax, 0
mov byte [rbp - 1], al
mov eax, 0
mov r11, rax
mov eax, 2
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_CreateToolhelp32Snapshot
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
cmp rax, 0xffffffffffffffff
je 0x4010da
mov eax, 0x130
mov dword [rbp - 0x140], eax
lea rax, [rbp - 0x140]
mov r11, rax
mov rax, qword [rbp - 0x10]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_Process32First
cmp eax, 0
je 0x4010cb
mov rax, qword [rbp + 0x10]
mov r11, rax
lea rax, [rbp - 0x114]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_strcmp
cmp eax, 0
jne 0x4010a6
mov eax, 1
mov byte [rbp - 1], al
jmp 0x4010cb
lea rax, [rbp - 0x140]
mov r11, rax
mov rax, qword [rbp - 0x10]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_Process32Next
cmp eax, 0
jne 0x401074
mov rax, qword [rbp - 0x10]
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_CloseHandle
movsx eax, byte [rbp - 1]
leave
ret

Function at 0x40100b
Capabilities:
Enumerate processes

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x160
mov qword [rbp + 0x10], rcx
mov eax, 0
mov byte [rbp - 1], al
mov eax, 0
mov r11, rax
mov eax, 2
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_CreateToolhelp32Snapshot
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
cmp rax, 0xffffffffffffffff
je 0x4010da
mov eax, 0x130
mov dword [rbp - 0x140], eax
lea rax, [rbp - 0x140]
mov r11, rax
mov rax, qword [rbp - 0x10]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_Process32First
cmp eax, 0
je 0x4010cb
mov rax, qword [rbp + 0x10]
mov r11, rax
lea rax, [rbp - 0x114]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_strcmp
cmp eax, 0
jne 0x4010a6
mov eax, 1
mov byte [rbp - 1], al
jmp 0x4010cb
lea rax, [rbp - 0x140]
mov r11, rax
mov rax, qword [rbp - 0x10]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_Process32Next
cmp eax, 0
jne 0x401074
mov rax, qword [rbp - 0x10]
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_CloseHandle
movsx eax, byte [rbp - 1]
leave
ret
Function at 0x40132a
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rax, 0
mov qword [rbp - 8], rax
lea rax, [0x00414619]
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_GetModuleHandleA
lea rcx, str.VirtualAllocExNuma
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_GetProcAddress
mov qword [rbp - 0x10], rax
call sub.kernel32.dll_GetCurrentProcess
mov ecx, 0
mov qword [rsp + 0x28], rcx
mov ecx, 0x40
mov qword [rsp + 0x20], rcx
mov ecx, 0x3000
mov r9, rcx
movabs rcx, 0x3e8
mov r8, rcx
movabs rcx, 0
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
mov r11, qword [rbp - 0x10]
call r11
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
cmp rax, 0
mov eax, 0
sete al
leave
ret

Function at 0x401335
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rax, 0
mov qword [rbp - 8], rax
lea rax, [0x00414619]
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_GetModuleHandleA
lea rcx, str.VirtualAllocExNuma
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_GetProcAddress
mov qword [rbp - 0x10], rax
call sub.kernel32.dll_GetCurrentProcess
mov ecx, 0
mov qword [rsp + 0x28], rcx
mov ecx, 0x40
mov qword [rsp + 0x20], rcx
mov ecx, 0x3000
mov r9, rcx
movabs rcx, 0x3e8
mov r8, rcx
movabs rcx, 0
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
mov r11, qword [rbp - 0x10]
call r11
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
cmp rax, 0
mov eax, 0
sete al
leave
ret

Function at 0x4013d2
Capabilities:
Get system information on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0xb0
lea rax, [0x00414639]
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_GetModuleHandleA
mov qword [rbp - 0x80], rax
lea rax, str.GlobalMemoryStatusEx
mov r11, rax
mov rax, qword [rbp - 0x80]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_GetProcAddress
mov qword [rbp - 0x88], rax
mov rax, qword [rbp - 0x88]
cmp rax, 0
je 0x40142c
jmp 0x401448
lea rax, str.Could_not_find_GlobalMemoryStatusEx_n
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_printf
mov eax, 0
jmp 0x4014e7
lea rax, [rbp - 0x30]
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [rbp - 0x10]
mov dword [rbp - 0x74], eax
mov eax, dword [rbp - 0x74]
cmp eax, 2
jae 0x401473
mov eax, 0
jmp 0x4014e7
mov eax, 0x40
mov dword [rbp - 0x70], eax
lea rax, [rbp - 0x70]
mov r10, rax
mov rcx, r10
mov r11, qword [rbp - 0x88]
call r11
cmp eax, 0
je 0x40149d
jmp 0x4014b9
lea rax, str.GlobalMemoryStatusEx_failed_n
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_printf
mov eax, 0
jmp 0x4014e7
mov rax, qword [rbp - 0x68]
shr rax, 0xa
shr rax, 0xa
shr rax, 0xa
mov dword [rbp - 0x78], eax
mov eax, dword [rbp - 0x78]
cmp eax, 2
jae 0x4014e2
mov eax, 0
jmp 0x4014e7
mov eax, 1
leave
ret
Function at 0x4013dd
Capabilities:
Get system information on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0xb0
lea rax, [0x00414639]
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_GetModuleHandleA
mov qword [rbp - 0x80], rax
lea rax, str.GlobalMemoryStatusEx
mov r11, rax
mov rax, qword [rbp - 0x80]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_GetProcAddress
mov qword [rbp - 0x88], rax
mov rax, qword [rbp - 0x88]
cmp rax, 0
je 0x40142c
jmp 0x401448
lea rax, str.Could_not_find_GlobalMemoryStatusEx_n
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_printf
mov eax, 0
jmp 0x4014e7
lea rax, [rbp - 0x30]
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [rbp - 0x10]
mov dword [rbp - 0x74], eax
mov eax, dword [rbp - 0x74]
cmp eax, 2
jae 0x401473
mov eax, 0
jmp 0x4014e7
mov eax, 0x40
mov dword [rbp - 0x70], eax
lea rax, [rbp - 0x70]
mov r10, rax
mov rcx, r10
mov r11, qword [rbp - 0x88]
call r11
cmp eax, 0
je 0x40149d
jmp 0x4014b9
lea rax, str.GlobalMemoryStatusEx_failed_n
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_printf
mov eax, 0
jmp 0x4014e7
mov rax, qword [rbp - 0x68]
shr rax, 0xa
shr rax, 0xa
shr rax, 0xa
mov dword [rbp - 0x78], eax
mov eax, dword [rbp - 0x78]
cmp eax, 2
jae 0x4014e2
mov eax, 0
jmp 0x4014e7
mov eax, 1
leave
ret
Function at 0x402669
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov eax, 0
mov byte [rbp - 1], al
movzx eax, byte [rbp - 1]
cmp eax, 4
jge 0x402723
jmp 0x4026a6
movzx eax, byte [rbp - 1]
add eax, 1
mov byte [rbp - 1], al
jmp 0x402688
mov eax, 0
mov byte [rbp - 2], al
movzx eax, byte [rbp - 2]
cmp eax, 4
jge 0x40271e
jmp 0x4026cc
movzx eax, byte [rbp - 2]
add eax, 1
mov byte [rbp - 2], al
jmp 0x4026ae
mov rax, qword [rbp + 0x18]
movzx ecx, byte [rbp - 1]
movsxd rcx, ecx
shl rcx, 2
add rax, rcx
movzx ecx, byte [rbp - 2]
movsxd rcx, ecx
add rax, rcx
mov ecx, dword [rbp + 0x10]
shl ecx, 2
shl ecx, 2
movzx edx, byte [rbp - 1]
shl edx, 2
add ecx, edx
movzx edx, byte [rbp - 2]
add ecx, edx
movsxd rcx, ecx
mov rdx, qword [rbp + 0x20]
add rdx, rcx
movzx ecx, byte [rax]
mov qword [rbp - 0x10], rax
movzx eax, byte [rdx]
xor ecx, eax
mov rax, qword [rbp - 0x10]
mov byte [rax], cl
jmp 0x4026c0
jmp 0x40269a
leave
ret

Function at 0x402674
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov eax, 0
mov byte [rbp - 1], al
movzx eax, byte [rbp - 1]
cmp eax, 4
jge 0x402723
jmp 0x4026a6
movzx eax, byte [rbp - 1]
add eax, 1
mov byte [rbp - 1], al
jmp 0x402688
mov eax, 0
mov byte [rbp - 2], al
movzx eax, byte [rbp - 2]
cmp eax, 4
jge 0x40271e
jmp 0x4026cc
movzx eax, byte [rbp - 2]
add eax, 1
mov byte [rbp - 2], al
jmp 0x4026ae
mov rax, qword [rbp + 0x18]
movzx ecx, byte [rbp - 1]
movsxd rcx, ecx
shl rcx, 2
add rax, rcx
movzx ecx, byte [rbp - 2]
movsxd rcx, ecx
add rax, rcx
mov ecx, dword [rbp + 0x10]
shl ecx, 2
shl ecx, 2
movzx edx, byte [rbp - 1]
shl edx, 2
add ecx, edx
movzx edx, byte [rbp - 2]
add ecx, edx
movsxd rcx, ecx
mov rdx, qword [rbp + 0x20]
add rdx, rcx
movzx ecx, byte [rax]
mov qword [rbp - 0x10], rax
movzx eax, byte [rdx]
xor ecx, eax
mov rax, qword [rbp - 0x10]
mov byte [rax], cl
jmp 0x4026c0
jmp 0x40269a
leave
ret

Function at 0x402725
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rbp + 0x10], rcx
mov eax, 0
mov byte [rbp - 1], al
movzx eax, byte [rbp - 1]
cmp eax, 4
jge 0x4027d4
jmp 0x40275a
movzx eax, byte [rbp - 1]
add eax, 1
mov byte [rbp - 1], al
jmp 0x40273c
mov eax, 0
mov byte [rbp - 2], al
movzx eax, byte [rbp - 2]
cmp eax, 4
jge 0x4027cf
jmp 0x402780
movzx eax, byte [rbp - 2]
add eax, 1
mov byte [rbp - 2], al
jmp 0x402762
mov rax, qword [rbp + 0x10]
movzx ecx, byte [rbp - 2]
movsxd rcx, ecx
shl rcx, 2
add rax, rcx
movzx ecx, byte [rbp - 1]
movsxd rcx, ecx
add rax, rcx
mov rcx, qword [rbp + 0x10]
movzx edx, byte [rbp - 2]
movsxd rdx, edx
shl rdx, 2
add rcx, rdx
movzx edx, byte [rbp - 1]
movsxd rdx, edx
add rcx, rdx
movzx edx, byte [rcx]
movsxd rdx, edx
lea rcx, str.cw
add rcx, rdx
movzx edx, byte [rcx]
mov byte [rax], dl
jmp 0x402774
jmp 0x40274e
leave
ret
Function at 0x402730
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rbp + 0x10], rcx
mov eax, 0
mov byte [rbp - 1], al
movzx eax, byte [rbp - 1]
cmp eax, 4
jge 0x4027d4
jmp 0x40275a
movzx eax, byte [rbp - 1]
add eax, 1
mov byte [rbp - 1], al
jmp 0x40273c
mov eax, 0
mov byte [rbp - 2], al
movzx eax, byte [rbp - 2]
cmp eax, 4
jge 0x4027cf
jmp 0x402780
movzx eax, byte [rbp - 2]
add eax, 1
mov byte [rbp - 2], al
jmp 0x402762
mov rax, qword [rbp + 0x10]
movzx ecx, byte [rbp - 2]
movsxd rcx, ecx
shl rcx, 2
add rax, rcx
movzx ecx, byte [rbp - 1]
movsxd rcx, ecx
add rax, rcx
mov rcx, qword [rbp + 0x10]
movzx edx, byte [rbp - 2]
movsxd rdx, edx
shl rdx, 2
add rcx, rdx
movzx edx, byte [rbp - 1]
movsxd rdx, edx
add rcx, rdx
movzx edx, byte [rcx]
movsxd rdx, edx
lea rcx, str.cw
add rcx, rdx
movzx edx, byte [rcx]
mov byte [rax], dl
jmp 0x402774
jmp 0x40274e
leave
ret

Function at 0x403aa3
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rbp + 0x10], rcx
mov eax, 0
mov byte [rbp - 1], al
movzx eax, byte [rbp - 1]
cmp eax, 4
jge 0x403b52
jmp 0x403ad8
movzx eax, byte [rbp - 1]
add eax, 1
mov byte [rbp - 1], al
jmp 0x403aba
mov eax, 0
mov byte [rbp - 2], al
movzx eax, byte [rbp - 2]
cmp eax, 4
jge 0x403b4d
jmp 0x403afe
movzx eax, byte [rbp - 2]
add eax, 1
mov byte [rbp - 2], al
jmp 0x403ae0
mov rax, qword [rbp + 0x10]
movzx ecx, byte [rbp - 2]
movsxd rcx, ecx
shl rcx, 2
add rax, rcx
movzx ecx, byte [rbp - 1]
movsxd rcx, ecx
add rax, rcx
mov rcx, qword [rbp + 0x10]
movzx edx, byte [rbp - 2]
movsxd rdx, edx
shl rdx, 2
add rcx, rdx
movzx edx, byte [rbp - 1]
movsxd rdx, edx
add rcx, rdx
movzx edx, byte [rcx]
movsxd rdx, edx
lea rcx, [0x004147c2]
add rcx, rdx
movzx edx, byte [rcx]
mov byte [rax], dl
jmp 0x403af2
jmp 0x403acc
leave
ret

Function at 0x403aae
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rbp + 0x10], rcx
mov eax, 0
mov byte [rbp - 1], al
movzx eax, byte [rbp - 1]
cmp eax, 4
jge 0x403b52
jmp 0x403ad8
movzx eax, byte [rbp - 1]
add eax, 1
mov byte [rbp - 1], al
jmp 0x403aba
mov eax, 0
mov byte [rbp - 2], al
movzx eax, byte [rbp - 2]
cmp eax, 4
jge 0x403b4d
jmp 0x403afe
movzx eax, byte [rbp - 2]
add eax, 1
mov byte [rbp - 2], al
jmp 0x403ae0
mov rax, qword [rbp + 0x10]
movzx ecx, byte [rbp - 2]
movsxd rcx, ecx
shl rcx, 2
add rax, rcx
movzx ecx, byte [rbp - 1]
movsxd rcx, ecx
add rax, rcx
mov rcx, qword [rbp + 0x10]
movzx edx, byte [rbp - 2]
movsxd rdx, edx
shl rdx, 2
add rcx, rdx
movzx edx, byte [rbp - 1]
movsxd rdx, edx
add rcx, rdx
movzx edx, byte [rcx]
movsxd rdx, edx
lea rcx, [0x004147c2]
add rcx, rdx
movzx edx, byte [rcx]
mov byte [rax], dl
jmp 0x403af2
jmp 0x403acc
leave
ret
Function at 0x403eb2
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov eax, 0
mov byte [rbp - 1], al
movzx eax, byte [rbp - 1]
cmp eax, 0x20
jge 0x403f1b
jmp 0x403eeb
movzx eax, byte [rbp - 1]
add eax, 1
mov byte [rbp - 1], al
jmp 0x403ecd
movzx eax, byte [rbp - 1]
movsxd rax, eax
mov rcx, qword [rbp + 0x10]
add rcx, rax
movzx eax, byte [rbp - 1]
movsxd rax, eax
mov rdx, qword [rbp + 0x18]
add rdx, rax
movzx eax, byte [rcx]
mov qword [rbp - 0x10], rcx
movzx ecx, byte [rdx]
xor eax, ecx
mov rcx, qword [rbp - 0x10]
mov byte [rcx], al
jmp 0x403edf
leave
ret

Function at 0x403ebd
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov eax, 0
mov byte [rbp - 1], al
movzx eax, byte [rbp - 1]
cmp eax, 0x20
jge 0x403f1b
jmp 0x403eeb
movzx eax, byte [rbp - 1]
add eax, 1
mov byte [rbp - 1], al
jmp 0x403ecd
movzx eax, byte [rbp - 1]
movsxd rax, eax
mov rcx, qword [rbp + 0x10]
add rcx, rax
movzx eax, byte [rbp - 1]
movsxd rax, eax
mov rdx, qword [rbp + 0x18]
add rdx, rax
movzx eax, byte [rcx]
mov qword [rbp - 0x10], rcx
movzx ecx, byte [rdx]
xor eax, ecx
mov rcx, qword [rbp - 0x10]
mov byte [rcx], al
jmp 0x403edf
leave
ret
Function at 0x140001480
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [0x14002d170]
mov dword [rax], 1
mov rax, qword [0x14002d180]
mov dword [rax], 1
mov rax, qword [0x14002d190]
mov dword [rax], 1
mov rax, qword [0x14002d160]
mov dword [rax], 1
mov rax, qword [0x14002d010]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400014de
mov eax, 0
jmp 0x14000158b
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x14000150a
mov eax, 0
jmp 0x14000158b
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
movzx eax, ax
cmp eax, 0x10b
je 0x140001530
cmp eax, 0x20b
je 0x140001557
jmp 0x140001586
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x5c]
cmp eax, 0xe
ja 0x140001543
mov eax, 0
jmp 0x14000158b
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x14000158b
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x6c]
cmp eax, 0xe
ja 0x140001572
mov eax, 0
jmp 0x14000158b
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x14000158b
mov eax, 0
add rsp, 0x20
pop rbp
ret

Function at 0x1400048b3
Capabilities:
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp - 8], 0
cmp qword [rbp + 0x18], 0
je 0x1400048e3
mov rax, qword [rbp + 0x18]
mov rcx, rax
call sym.nimCStrLen
mov rdx, rax
jmp 0x1400048e8
mov edx, 0
mov rax, qword [rbp + 0x18]
mov r9, qword [rbp + 0x10]
mov r8, rdx
mov edx, 1
mov rcx, rax
call sym.fwrite
mov qword [rbp - 8], rax
mov dword [rbp - 0xc], 0
mov rcx, qword [rbp + 0x10]
call sym.fflush
mov dword [rbp - 0xc], eax
nop
add rsp, 0x30
pop rbp
ret

Function at 0x14000ea2c
Capabilities:
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov qword [rbp - 8], 0
mov rdx, qword [rbp + 0x20]
mov rax, qword [rbp + 0x18]
mov r9, qword [rbp + 0x10]
mov r8, rdx
mov edx, 1
mov rcx, rax
call sym.fwrite
mov qword [rbp - 8], rax
mov dword [rbp - 0xc], 0
mov rcx, qword [rbp + 0x10]
call sym.fflush
mov dword [rbp - 0xc], eax
nop
add rsp, 0x30
pop rbp
ret

Function at 0x140015d30
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov r8, rbx
mov rdx, qword [rbp + 0x20]
mov rcx, rax
call sym.vfprintf
call sym.abort
nop