joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d39e0
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d3b9c
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x50], rdi
lea r9, [rsi + 7]
sar r9, 0x3f
shr r9, 0x3d
lea rbx, [r9 + rsi]
lea rbx, [rbx + 7]
sar rbx, 3
cmp rcx, rbx
jl 0x4d3a27
nop
jae 0x4d3a9e
jmp 0x4d3b90
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x50], rdi
cmp rbx, 1
jne 0x4d3a6b
lea rax, [0x0050fb00]
mov ebx, 1
mov rcx, rbx
call fcn.00447c80
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x50]
mov r8, qword [rsp + 0x60]
mov ebx, 1
mov ecx, 1
jmp 0x4d3a9e
mov qword [rsp + 0x20], rbx
lea rcx, [rbx + 4]
mov qword [rsp + 0x18], rcx
lea rax, [0x0050fb00]
call fcn.00447c80
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x50]
mov r8, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x18]
mov rdx, rsi
xor r9d, r9d
jmp 0x4d3ab3
bswap r8
mov qword [rax + r9*8], r8
inc r9
mov r8, r10
cmp rsi, 8
jl 0x4d3ae5
mov r10, r8
sub r8, rsi
add r8, 8
neg r8
sar r8, 0x3f
add rsi, 0xfffffffffffffff8
and r8, rsi
nop
mov r8, qword [rdi + r8]
cmp r9, rbx
jb 0x4d3aa6
nop dword [rax + rax]
jmp 0x4d3b85
test rsi, rsi
jle 0x4d3af2
xor r8d, r8d
xor r9d, r9d
jmp 0x4d3b4e
jmp 0x4d3af7
dec rbx
test rbx, rbx
jle 0x4d3b06
mov rsi, qword [rax + rbx*8 - 8]
test rsi, rsi
je 0x4d3af4
cmp rbx, rcx
ja 0x4d3b15
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov rdx, rcx
mov rcx, rbx
nop dword [rax + rax]
call fcn.00460dc0
cmp r8, 0x40
sbb r11, r11
lea r12, [r8 + 8]
movzx r13d, byte [rsi + rdi - 1]
mov rsi, rcx
mov rcx, r8
shl r13, cl
and r13, r11
or r9, r13
mov rcx, rsi
mov rsi, r10
mov r8, r12
test rsi, rsi
jle 0x4d3b5e
lea r10, [rsi - 1]
cmp rdx, r10
ja 0x4d3b25
jmp 0x4d3b79
lea rsi, [rbx - 1]
cmp rbx, rsi
jbe 0x4d3b6e
mov qword [rax + rbx*8 - 8], r9
jmp 0x4d3af2
mov rax, rsi
mov rcx, rbx
call fcn.00460d40
mov rax, r10
mov rcx, rdx
nop
call fcn.00460d40
mov rax, r9
mov rcx, rbx
call fcn.00460d40
mov rdx, rcx
mov rcx, rbx
call fcn.00460dc0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
call fcn.0045e640
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
nop dword [rax]
jmp fcn.004d39e0
Function at 0x4e3ec0
Capabilities:
Encode data using xor

Disassembly:
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdx, qword [rsp + 0x20]
test rdx, 0xf
jne 0x4e3f2b
mov rax, 0
movdqu xmm0, xmmword [rsi + rax]
movdqu xmm1, xmmword [rcx + rax]
pxor xmm0, xmm1
movdqu xmmword [rbx + rax], xmm0
add rax, 0x10
cmp rdx, rax
jne 0x4e3ee4
ret
sub rdx, 1
mov dil, byte [rsi + rdx]
mov al, byte [rcx + rdx]
xor dil, al
mov byte [rbx + rdx], dil
test rdx, 7
jne 0x4e3f01
cmp rdx, 0
je 0x4e3f4d
test rdx, 0xf
je 0x4e3edd
test rdx, 7
jne 0x4e3f01
sub rdx, 8
mov rdi, qword [rsi + rdx]
mov rax, qword [rcx + rdx]
xor rdi, rax
mov qword [rbx + rdx], rdi
cmp rdx, 0x10
jge 0x4e3edd
ret
Function at 0x4e51c0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [rsp + 8]
mov rax, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x18]
mov rdx, qword [rsp + 0x20]
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
add rbx, 0x10
pxor xmm4, xmm4
cmp ecx, 0xc
je 0x4e5290
jb 0x4e52ef
movups xmm2, xmmword [rax + 0x10]
movups xmmword [rbx], xmm2
add rbx, 0x10
aeskeygenassist xmm1, xmm2, 1
call fcn.004e50a0
aeskeygenassist xmm1, xmm0, 1
call fcn.004e50c0
aeskeygenassist xmm1, xmm2, 2
call fcn.004e50a0
aeskeygenassist xmm1, xmm0, 2
call fcn.004e50c0
aeskeygenassist xmm1, xmm2, 4
call fcn.004e50a0
aeskeygenassist xmm1, xmm0, 4
call fcn.004e50c0
aeskeygenassist xmm1, xmm2, 8
call fcn.004e50a0
aeskeygenassist xmm1, xmm0, 8
call fcn.004e50c0
aeskeygenassist xmm1, xmm2, 0x10
call fcn.004e50a0
aeskeygenassist xmm1, xmm0, 0x10
call fcn.004e50c0
aeskeygenassist xmm1, xmm2, 0x20
call fcn.004e50a0
aeskeygenassist xmm1, xmm0, 0x20
call fcn.004e50c0
aeskeygenassist xmm1, xmm2, 0x40
call fcn.004e50a0
jmp 0x4e535d
movq xmm2, qword [rax + 0x10]
aeskeygenassist xmm1, xmm2, 1
call fcn.004e5000
aeskeygenassist xmm1, xmm2, 2
call fcn.004e5060
aeskeygenassist xmm1, xmm2, 4
call fcn.004e5000
aeskeygenassist xmm1, xmm2, 8
call fcn.004e5060
aeskeygenassist xmm1, xmm2, 0x10
call fcn.004e5000
aeskeygenassist xmm1, xmm2, 0x20
call fcn.004e5060
aeskeygenassist xmm1, xmm2, 0x40
call fcn.004e5000
aeskeygenassist xmm1, xmm2, 0x80
call fcn.004e5060
jmp 0x4e535d
aeskeygenassist xmm1, xmm0, 1
call fcn.004e4fc0
aeskeygenassist xmm1, xmm0, 2
call fcn.004e4fc0
aeskeygenassist xmm1, xmm0, 4
call fcn.004e4fc0
aeskeygenassist xmm1, xmm0, 8
call fcn.004e4fc0
aeskeygenassist xmm1, xmm0, 0x10
call fcn.004e4fc0
aeskeygenassist xmm1, xmm0, 0x20
call fcn.004e4fc0
aeskeygenassist xmm1, xmm0, 0x40
call fcn.004e4fc0
aeskeygenassist xmm1, xmm0, 0x80
call fcn.004e4fc0
aeskeygenassist xmm1, xmm0, 0x1b
call fcn.004e4fc0
aeskeygenassist xmm1, xmm0, 0x36
call fcn.004e4fc0
sub rbx, 0x10
movups xmm1, xmmword [rbx]
movups xmmword [rdx], xmm1
dec rcx
movups xmm1, xmmword [rbx - 0x10]
aesimc xmm0, xmm1
movups xmmword [rdx + 0x10], xmm0
sub rbx, 0x10
add rdx, 0x10
dec rcx
jne 0x4e536a
movups xmm0, xmmword [rbx - 0x10]
movups xmmword [rdx + 0x10], xmm0
ret
Function at 0x4e5cc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4e5ea0
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x80], r8
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x88], r9
mov qword [rsp + 0x90], r10
lea rax, [0x00510fc0]
call fcn.0040d040
mov qword [rsp + 0x40], rax
xor ecx, ecx
xor edx, edx
xor ebx, ebx
jmp 0x4e5d2b
mov rax, rdx
mov rcx, r10
mov rdx, qword [rsp + 0x30]
mov rbx, r8
mov rsi, qword [rsp + 0x60]
cmp rsi, rcx
jle 0x4e5e59
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rdx
mov rdx, qword [rsp + 0x70]
mov rsi, qword [rdx + 0x38]
mov rax, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x90]
call rsi
mov rdx, qword [rsp + 0x70]
mov rsi, qword [rdx + 0x38]
mov rax, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x40]
mov ecx, 4
mov rdi, rcx
call rsi
mov rdx, qword [rsp + 0x70]
mov rsi, qword [rdx + 0x30]
mov rax, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x38]
xor ecx, ecx
mov rdi, qword [rsp + 0x30]
call rsi
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x30], rcx
mov rdx, qword [rsp + 0x70]
mov rsi, qword [rdx + 0x20]
mov rax, qword [rsp + 0x78]
call rsi
mov rdx, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x58]
mov r8, qword [rsp + 0x38]
mov r9, qword [rsp + 0x60]
mov r10, qword [rsp + 0x20]
xor eax, eax
jmp 0x4e5e80
mov rdx, qword [rsp + 0x40]
movzx r11d, byte [rdx + 3]
lea r12d, [r11 + 1]
mov byte [rdx + 3], r12b
nop word [rax + rax]
cmp r11b, 0xff
jne 0x4e5d1d
movzx r11d, byte [rdx + 2]
lea r12d, [r11 + 1]
mov byte [rdx + 2], r12b
nop word [rax + rax]
cmp r11b, 0xff
jne 0x4e5d1d
movzx r11d, byte [rdx + 1]
lea r12d, [r11 + 1]
mov byte [rdx + 1], r12b
nop word [rax + rax]
cmp r11b, 0xff
jne 0x4e5d1d
movzx r11d, byte [rdx]
inc r11d
mov byte [rdx], r11b
jmp 0x4e5d1d
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
movzx r11d, byte [r10 + rsi]
movzx r12d, byte [r8 + rax]
xor r11d, r12d
mov byte [rsi + r10], r11b
inc rax
inc r10
nop word [rax + rax]
cmp rdx, rax
jle 0x4e5de8
cmp r9, r10
jle 0x4e5de8
ja 0x4e5e63
mov rax, r10
mov rcx, r9
call fcn.00460d40
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x40], r10
call fcn.0045e640
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
mov r10, qword [rsp + 0x40]
jmp fcn.004e5cc0
Function at 0x4e6e20
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4e7073
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x58], rax
add qword [rax + 0x68], rcx
mov rsi, qword [rax + 0x60]
test rsi, rsi
jle 0x4e6f50
nop dword [rax + rax]
cmp rsi, 0x40
ja 0x4e7065
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x60], rbx
lea r8, [rsi - 0x40]
mov r9, r8
neg r8
cmp rcx, r8
cmovl r8, rcx
mov qword [rsp + 0x28], r8
sar r9, 0x3f
and r9, rsi
lea rsi, [rax + r9]
lea rsi, [rsi + 0x20]
cmp rbx, rsi
je 0x4e6ec2
mov rax, rsi
mov rcx, r8
call fcn.004616a0
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x70]
mov r8, qword [rsp + 0x28]
mov rsi, qword [rax + 0x60]
add rsi, r8
mov qword [rax + 0x60], rsi
cmp rsi, 0x40
jne 0x4e6f2c
mov qword [rsp], rax
lea rcx, [rax + 0x20]
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], 0x40
mov qword [rsp + 0x18], 0x40
call fcn.004e74c0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov qword [rax + 0x60], 0
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x70]
mov r8, qword [rsp + 0x28]
cmp rcx, r8
jb 0x4e705c
sub rdi, r8
mov rsi, rcx
sub rcx, r8
mov r9, rdi
neg rdi
sar rdi, 0x3f
and r8, rdi
add rbx, r8
jmp 0x4e6f60
mov rsi, rcx
mov r9, rdi
nop word [rax + rax]
nop
cmp rcx, 0x40
jl 0x4e7000
mov rdi, rcx
and rcx, 0xffffffffffffffc0
cmp r9, rcx
jb 0x4e7054
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x20], rcx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], r9
call fcn.004e74c0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x20]
cmp rcx, rax
jb 0x4e704f
mov rdx, qword [rsp + 0x38]
mov rsi, rax
sub rax, rdx
mov rdx, rcx
sub rcx, rsi
sar rax, 0x3f
and rax, rdx
and rax, 0xffffffffffffffc0
mov rdx, qword [rsp + 0x40]
lea rbx, [rdx + rax]
mov rax, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x68]
nop dword [rax]
test rcx, rcx
jle 0x4e703e
cmp rcx, 0x40
mov edx, 0x40
cmovl rdx, rcx
lea rdi, [rax + 0x20]
cmp rbx, rdi
je 0x4e703a
mov qword [rsp + 0x38], rdx
mov rax, rdi
mov rcx, rdx
call fcn.004616a0
mov rax, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x68]
mov qword [rax + 0x60], rdx
mov rax, rsi
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
call fcn.00460e00
mov rdx, r9
call fcn.00460dc0
mov rax, r8
nop
call fcn.00460e00
mov rax, rsi
mov ecx, 0x40
call fcn.00460e00
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.0045e640
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.004e6e20
Function at 0x4ed380
Capabilities:
Hash data using sha384
Hash data using sha512

Disassembly:
mov rcx, qword [rax + 0xd0]
cmp rcx, 6
jne 0x4ed405
movabs rcx, 0xcbbb9d5dc1059ed8
mov qword [rax], rcx
movabs rcx, 0x629a292a367cd507
mov qword [rax + 8], rcx
movabs rcx, 0x9159015a3070dd17
mov qword [rax + 0x10], rcx
movabs rcx, 0x152fecd8f70e5939
mov qword [rax + 0x18], rcx
movabs rcx, 0x67332667ffc00b31
mov qword [rax + 0x20], rcx
movabs rcx, 0x8eb44a8768581511
mov qword [rax + 0x28], rcx
movabs rcx, 0xdb0c2e0d64f98fa7
mov qword [rax + 0x30], rcx
movabs rcx, 0x47b5481dbefa4fa4
mov qword [rax + 0x38], rcx
nop dword [rax]
jmp 0x4ed566
cmp rcx, 0xe
jne 0x4ed480
movabs rcx, 0x8c3d37c819544da2
mov qword [rax], rcx
movabs rcx, 0x73e1996689dcd4d6
mov qword [rax + 8], rcx
movabs rcx, 0x1dfab7ae32ff9c82
mov qword [rax + 0x10], rcx
movabs rcx, 0x679dd514582f9fcf
mov qword [rax + 0x18], rcx
movabs rcx, 0xf6d2b697bd44da8
mov qword [rax + 0x20], rcx
movabs rcx, 0x77e36f7304c48942
mov qword [rax + 0x28], rcx
movabs rcx, 0x3f9d85a86a1d36c8
mov qword [rax + 0x30], rcx
movabs rcx, 0x1112e6ad91d692a1
mov qword [rax + 0x38], rcx
jmp 0x4ed566
cmp rcx, 0xf
jne 0x4ed4f7
movabs rcx, 0x22312194fc2bf72c
mov qword [rax], rcx
movabs rcx, 0x9f555fa3c84c64c2
mov qword [rax + 8], rcx
movabs rcx, 0x2393b86b6f53b151
mov qword [rax + 0x10], rcx
movabs rcx, 0x963877195940eabd
mov qword [rax + 0x18], rcx
movabs rcx, 0x96283ee2a88effe3
mov qword [rax + 0x20], rcx
movabs rcx, 0xbe5e1e2553863992
mov qword [rax + 0x28], rcx
movabs rcx, 0x2b0199fc2c85b8aa
mov qword [rax + 0x30], rcx
movabs rcx, 0xeb72ddc81c52ca2
mov qword [rax + 0x38], rcx
jmp 0x4ed566
movabs rcx, 0x6a09e667f3bcc908
mov qword [rax], rcx
movabs rcx, 0xbb67ae8584caa73b
mov qword [rax + 8], rcx
movabs rcx, 0x3c6ef372fe94f82b
mov qword [rax + 0x10], rcx
movabs rcx, 0xa54ff53a5f1d36f1
mov qword [rax + 0x18], rcx
movabs rcx, 0x510e527fade682d1
mov qword [rax + 0x20], rcx
movabs rcx, 0x9b05688c2b3e6c1f
mov qword [rax + 0x28], rcx
movabs rcx, 0x1f83d9abfb41bd6b
mov qword [rax + 0x30], rcx
movabs rcx, 0x5be0cd19137e2179
mov qword [rax + 0x38], rcx
movups xmmword [rax + 0xc0], xmm15
ret
Function at 0x4f8b60
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f8cc0
sub rsp, 0x78
mov qword [rsp + 0x70], rbp
lea rbp, [rsp + 0x70]
mov qword [rsp + 0x88], rbx
mov rcx, qword [rax]
mov qword [rsp + 0x20], rcx
movups xmm0, xmmword [rax + 8]
movups xmmword [rsp + 0x28], xmm0
movups xmm0, xmmword [rax + 0x18]
movups xmmword [rsp + 0x38], xmm0
lea rax, [rsp + 0x20]
nop
call fcn.004f8820
mov qword [rsp + 0x10], 0
mov qword [rsp + 0x48], 0
lea rcx, [rsp + 0x50]
movups xmmword [rcx], xmm15
lea rcx, [rsp + 0x60]
movups xmmword [rcx], xmm15
mov rcx, qword [rsp + 0x20]
mov qword [rsp + 0x48], rcx
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x50], rcx
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x58], rcx
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x60], rcx
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x68], rcx
mov rcx, qword [rsp + 0x88]
xor eax, eax
jmp 0x4f8c0d
inc rax
mov rcx, rbx
cmp rax, 5
jge 0x4f8c5e
imul rdx, rax, 0x33
mov rsi, rdx
sar rdx, 0x3f
shr rdx, 0x3d
add rdx, rsi
sar rdx, 3
mov rdi, rdx
shl rdx, 3
sub rsi, rdx
cmp rsi, 0x40
sbb rdx, rdx
mov r8, qword [rsp + rax*8 + 0x48]
mov rbx, rcx
mov rcx, rsi
shl r8, cl
and r8, rdx
mov qword [rsp + 0x10], r8
mov rdx, qword [rsp + 0x10]
mov qword [rsp + 0x18], rdx
xor ecx, ecx
jmp 0x4f8c84
test byte [rcx], al
mov rax, rcx
mov ebx, 0x20
mov rcx, rbx
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
movzx r8d, byte [rbx + rsi]
or r8d, edx
mov byte [rbx + rsi], r8b
inc rcx
cmp rcx, 8
jge 0x4f8c07
movzx edx, byte [rsp + rcx + 0x18]
lea rsi, [rdi + rcx]
nop word [rax + rax]
cmp rsi, 0x20
jge 0x4f8c07
test byte [rbx], al
cmp rsi, 0x20
jb 0x4f8c75
mov rax, rsi
mov ecx, 0x20
call fcn.00460d40
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045e640
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004f8b60
Function at 0x4fa9c0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4fac13
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x58], rax
add qword [rax + 0x58], rcx
mov rsi, qword [rax + 0x50]
test rsi, rsi
jle 0x4faaf0
nop dword [rax + rax]
cmp rsi, 0x40
ja 0x4fac05
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x60], rbx
lea r8, [rsi - 0x40]
mov r9, r8
neg r8
cmp rcx, r8
cmovl r8, rcx
mov qword [rsp + 0x28], r8
sar r9, 0x3f
and r9, rsi
lea rsi, [rax + r9]
lea rsi, [rsi + 0x10]
cmp rbx, rsi
je 0x4faa62
mov rax, rsi
mov rcx, r8
call fcn.004616a0
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x70]
mov r8, qword [rsp + 0x28]
mov rsi, qword [rax + 0x50]
add rsi, r8
mov qword [rax + 0x50], rsi
cmp rsi, 0x40
jne 0x4faacc
mov qword [rsp], rax
lea rcx, [rax + 0x10]
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], 0x40
mov qword [rsp + 0x18], 0x40
call fcn.004faf00
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov qword [rax + 0x50], 0
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x70]
mov r8, qword [rsp + 0x28]
cmp rcx, r8
jb 0x4fabfc
sub rdi, r8
mov rsi, rcx
sub rcx, r8
mov r9, rdi
neg rdi
sar rdi, 0x3f
and r8, rdi
add rbx, r8
jmp 0x4fab00
mov rsi, rcx
mov r9, rdi
nop word [rax + rax]
nop
cmp rcx, 0x40
jl 0x4faba0
mov rdi, rcx
and rcx, 0xffffffffffffffc0
cmp r9, rcx
jb 0x4fabf4
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x20], rcx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], r9
call fcn.004faf00
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x20]
cmp rcx, rax
jb 0x4fabef
mov rdx, qword [rsp + 0x38]
mov rsi, rax
sub rax, rdx
mov rdx, rcx
sub rcx, rsi
sar rax, 0x3f
and rax, rdx
and rax, 0xffffffffffffffc0
mov rdx, qword [rsp + 0x40]
lea rbx, [rdx + rax]
mov rax, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x68]
nop dword [rax]
test rcx, rcx
jle 0x4fabde
cmp rcx, 0x40
mov edx, 0x40
cmovl rdx, rcx
lea rdi, [rax + 0x10]
cmp rbx, rdi
je 0x4fabda
mov qword [rsp + 0x38], rdx
mov rax, rdi
mov rcx, rdx
call fcn.004616a0
mov rax, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x68]
mov qword [rax + 0x50], rdx
mov rax, rsi
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
call fcn.00460e00
mov rdx, r9
call fcn.00460dc0
mov rax, r8
nop
call fcn.00460e00
mov rax, rsi
mov ecx, 0x40
call fcn.00460e00
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.0045e640
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.004fa9c0
Function at 0x140abc058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.140abc1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140abc089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140abc06f
add dl, dl
jne 0x140abc096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140abc0f6
xor eax, eax
add dl, dl
jne 0x140abc0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140abc1ad
add dl, dl
jne 0x140abc0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140abc0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140abc0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140abc0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140abc0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140abc07e
mov eax, 1
add dl, dl
jne 0x140abc106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140abc113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140abc0fb
sub eax, ebx
mov ebx, 1
jne 0x140abc14c
mov ecx, 1
add dl, dl
jne 0x140abc12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140abc13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140abc123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140abc07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140abc168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140abc175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140abc15d
cmp eax, 0x7d00
jae 0x140abc19b
cmp eax, 0x500
jb 0x140abc196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140abc07e
cmp eax, 0x7f
ja 0x140abc19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140abc07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140abc1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140abc07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x14000bc70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x20
mov eax, dword [rcx + 0x10]
mov rbx, rcx
mov r9d, eax
and r9d, 7
je 0x14000bce2
cmp eax, r9d
jge 0x14000bcd8
nop word [rax + rax]
mov ecx, dword [rbx + 0x10]
mov eax, 1
mov r8d, dword [rbx + 0x14]
shl eax, cl
cmp r8d, eax
jae 0x14000bcd1
mov rax, qword [rbx]
cmp rax, qword [rbx + 8]
jb 0x14000bcb0
xor edx, edx
jmp 0x14000bcb9
movzx edx, byte [rax]
inc rax
mov qword [rbx], rax
movzx eax, dl
shl eax, cl
or eax, r8d
mov dword [rbx + 0x14], eax
lea eax, [rcx + 8]
mov dword [rbx + 0x10], eax
cmp eax, 0x18
jle 0x14000bc90
jmp 0x14000bcd8
mov rax, qword [rbx + 8]
mov qword [rbx], rax
mov ecx, r9d
shr dword [rbx + 0x14], cl
sub dword [rbx + 0x10], r9d
mov ecx, dword [rbx + 0x10]
xor r9d, r9d
test ecx, ecx
jle 0x14000bd1e
mov edx, dword [rbx + 0x14]
lea r8, [rsp + 0x30]
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rbx + 0x14]
inc r9d
shr edx, 8
sub ecx, 8
mov byte [r8], al
lea r8, [r8 + 1]
mov dword [rbx + 0x14], edx
test ecx, ecx
jg 0x14000bd00
mov dword [rbx + 0x10], ecx
cmp dword [rbx + 0x10], 0
jge 0x14000bd48
mov rax, qword gs:[0x58]
mov edx, 0x20
mov rcx, qword [rax]
lea rax, str.zlib_corrupt
mov qword [rdx + rcx], rax
xor eax, eax
add rsp, 0x20
pop rbx
ret
movsxd rcx, r9d
cmp rcx, 4
jge 0x14000bd77
mov r8, qword [rbx + 8]
mov rax, qword [rbx]
cmp rax, r8
jb 0x14000bd61
xor edx, edx
jmp 0x14000bd6a
movzx edx, byte [rax]
inc rax
mov qword [rbx], rax
mov byte [rsp + rcx + 0x30], dl
inc rcx
cmp rcx, 4
jl 0x14000bd58
movzx eax, byte [rsp + 0x30]
movzx r8d, byte [rsp + 0x31]
movzx ecx, byte [rsp + 0x33]
shl r8d, 8
add r8d, eax
shl ecx, 8
movzx eax, byte [rsp + 0x32]
add ecx, eax
mov eax, r8d
xor eax, 0xffff
cmp ecx, eax
jne 0x14000bd24
mov rcx, qword [rbx]
mov qword [rsp + 0x38], rdi
mov edi, r8d
add rcx, rdi
cmp rcx, qword [rbx + 8]
jbe 0x14000bde1
mov rax, qword gs:[0x58]
mov edx, 0x20
mov rcx, qword [rax]
lea rax, str.read_past_buffer
mov qword [rdx + rcx], rax
xor eax, eax
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret
mov rdx, qword [rbx + 0x18]
lea rax, [r8 + rdx]
cmp rax, qword [rbx + 0x28]
jbe 0x14000bdfb
mov rcx, rbx
call fcn.14000b260
test eax, eax
je 0x14000bdd4
mov rdx, qword [rbx]
mov r8, rdi
mov rcx, qword [rbx + 0x18]
call fcn.14002cd50
add qword [rbx], rdi
mov eax, 1
add qword [rbx + 0x18], rdi
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret