joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400ef4e0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov r9, qword [rcx]
mov rbx, rdx
mov edx, 1
mov rdi, rcx
lea r8d, [rdx + 0x1f]
mov rcx, rbx
call fcn.1401c1e14
test rax, rax
jne 0x1400ef519
mov eax, 4
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rcx, rdi
call fcn.140066b20
mov rcx, rdi
mov dword [rbx + 0x20], eax
call fcn.140066b20
mov rcx, rdi
mov dword [rbx + 0x24], eax
call fcn.140066b20
mov rcx, rdi
mov dword [rbx + 0x28], eax
call fcn.140066b20
mov rcx, rdi
mov dword [rbx + 0x2c], eax
call fcn.140066b20
mov rcx, rdi
mov dword [rbx + 0x30], eax
call fcn.140066b20
mov edx, 1
mov dword [rbx + 0x34], eax
mov r9, qword [rdi]
lea rcx, [rbx + 0x38]
lea r8d, [rdx + 0x1f]
call fcn.1401c1e14
test rax, rax
je 0x1400ef509
mov rcx, rdi
call fcn.140066b20
mov rcx, rdi
mov dword [rbx + 0x58], eax
call fcn.140066b20
mov rcx, rdi
mov dword [rbx + 0x5c], eax
call fcn.140066b20
mov dword [rbx + 0x60], eax
mov rbx, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rdi
ret
Function at 0x1400f0310
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
sub rsp, 0x250
mov rax, qword [0x1402a83b0]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbp, r8
xor bl, bl
movsxd rsi, edx
or r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rcx + r8], 0
jne 0x1400f0340
lea rdx, [rsp + 0x40]
inc r8d
sub rdx, rcx
nop word [rax + rax]
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
mov byte [rdx + rcx - 1], al
test al, al
jne 0x1400f0360
lea rcx, [rsp + 0x40]
movsxd rax, r8d
add rcx, rax
nop word [rax + rax]
lea rcx, [rcx - 1]
dec r8d
cmp byte [rcx], 0x2e
jne 0x1400f0380
movsxd rax, r8d
cmp rax, 0x200
jae 0x1400f04e9
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x288], rdi
mov byte [rsp + rax + 0x40], 0
dec rcx
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x1400f03b0
mov eax, dword [str..kcf]
lea rdx, [rsp + 0x40]
mov dword [rcx], eax
movzx eax, byte [0x140220fc4]
mov byte [rcx + 4], al
lea rcx, [rsp + 0x28]
call fcn.140066470
lea rcx, [rsp + 0x28]
mov edx, 0x11
call fcn.140066480
mov rdi, rax
test rax, rax
je 0x1400f04c3
mov r9, qword [rax]
mov edx, 4
lea rcx, [rsp + 0x24]
lea r8d, [rdx - 3]
call fcn.1401c1e14
test rax, rax
je 0x1400f04bb
mov ecx, dword [rsp + 0x24]
cmp ecx, dword [str.KiSS]
jne 0x1400f04bb
mov rcx, qword [rdi]
call fcn.1401c3f28
mov rcx, qword [rdi]
call fcn.1401c3f28
mov rcx, qword [rdi]
mov edx, 0x1a
lea r8d, [rdx - 0x19]
mov ebx, eax
call fcn.1401c1f88
cmp ebx, 0xc
jne 0x1400f04a5
test rsi, rsi
jle 0x1400f04b9
lea rbx, [rbp + 2]
nop word [rax + rax]
mov r9, qword [rdi]
mov edx, 2
lea rcx, [rsp + 0x20]
lea r8d, [rdx - 1]
call fcn.1401c1e14
movzx eax, word [rsp + 0x20]
add rbx, 3
movzx ecx, al
and al, 0xf
and cl, 0xf0
shl al, 4
mov byte [rbx - 5], cl
movzx ecx, byte [rsp + 0x21]
mov byte [rbx - 3], al
and cl, 0xf
shl cl, 4
mov byte [rbx - 4], cl
dec rsi
jne 0x1400f0460
jmp 0x1400f04b9
mov r9, qword [rdi]
mov rdx, rsi
mov r8d, 3
mov rcx, rbp
call fcn.1401c1e14
mov bl, 1
mov rcx, rdi
call fcn.140066370
movzx eax, bl
mov rdi, qword [rsp + 0x288]
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1401bd600
add rsp, 0x250
pop rsi
pop rbp
pop rbx
ret
call fcn.1401be39c
int3
Function at 0x1400f17d0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
push rdi
sub rsp, 0x30
mov rdi, rcx
mov qword [rsp + 0x40], rbx
mov rbp, r8
lea rcx, str.embed
mov qword [rsp + 0x48], rsi
mov r10, rdx
xor eax, eax
nop word [rax + rax]
movzx r9d, byte [rdx + rax]
inc rax
cmp r9b, byte [rcx + rax - 1]
jne 0x1400f18a8
cmp rax, 6
jne 0x1400f1800
mov eax, dword [rdi + 0x3f8]
test eax, eax
je 0x1400f188a
mov ecx, eax
call fcn.1401bee78
lea r8, str.apply_profile__
mov rcx, rdi
mov rdx, rax
mov rbx, rax
call fcn.140106a20
mov edx, dword [rdi + 0x3ec]
mov rcx, qword [rdi + 0x55ba0]
xor r8d, r8d
call fcn.1401c1f88
mov r8d, dword [rdi + 0x3f8]
mov r9, qword [rdi + 0x55ba0]
mov edx, 1
mov rcx, rbx
call fcn.1401c1e14
mov edx, dword [rdi + 0x3f8]
mov rcx, rbx
call fcn.14013e5d0
mov rcx, rbx
mov rsi, rax
call fcn.1401be23c
jmp 0x1400f18ba
call fcn.1401be514
mov r8, qword [rdi + 8]
lea rdx, str._s_has_no_embedded_profile._n
lea rcx, [rax + 0x60]
call fcn.1401be844
jmp 0x1400f1a43
lea rdx, [0x14020e664]
mov rcx, r10
call fcn.14013e530
mov rsi, rax
test rsi, rsi
je 0x1400f1a43
test rbp, rbp
jne 0x1400f1966
call fcn.140141bb0
mov rbp, rax
test rax, rax
je 0x1400f1a3b
cmp dword [rdi + 0x24668], 0
je 0x1400f18fb
call fcn.1401be514
lea rdx, str.Applying_color_profile..._n
lea rcx, [rax + 0x60]
call fcn.1401be844
mov r9d, 0x4009a
mov r8, rbp
mov rcx, rsi
mov edx, r9d
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call fcn.1401433a0
movzx ecx, word [rdi + 0x44f4]
movzx r9d, word [rdi + 0x44f6]
imul r9d, ecx
mov rdx, qword [rdi + 0x4510]
mov rcx, rax
mov rbx, rax
mov r8, rdx
call fcn.1401434f0
mov rcx, rbx
mov dword [rdi + 0x4448], 1
call fcn.140143460
mov rcx, rbp
call fcn.14013dde0
jmp 0x1400f1a3b
lea rdx, [0x140264ea4]
mov rcx, rbp
call fcn.1401be7e4
mov rbx, rax
test rax, rax
je 0x1400f1a23
mov edx, 4
lea rcx, [rsp + 0x58]
mov r9, rax
lea r8d, [rdx - 3]
call fcn.1401c1e14
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call fcn.1401c1f88
mov ecx, dword [rsp + 0x58]
call fcn.140065f60
mov ecx, eax
mov dword [rsp + 0x58], eax
call fcn.1401bee78
lea r8, str.apply_profile__
mov rcx, rdi
mov rdx, rax
mov qword [rdi + 0x400], rax
call fcn.140106a20
mov r8d, dword [rsp + 0x58]
mov rcx, qword [rdi + 0x400]
mov r9, rbx
mov edx, 1
call fcn.1401c1e14
mov rcx, rbx
call fcn.1401be6a4
mov edx, dword [rsp + 0x58]
mov rcx, qword [rdi + 0x400]
call fcn.14013e5d0
mov rbp, rax
test rax, rax
jne 0x1400f18dd
mov rcx, qword [rdi + 0x400]
call fcn.1401be23c
mov qword [rdi + 0x400], rbp
jmp 0x1400f1a3b
call fcn.1401be514
lea rdx, str.Cannot_open_file__s__n
mov r8, rbp
lea rcx, [rax + 0x60]
call fcn.1401be844
mov rcx, rsi
call fcn.14013dde0
mov rsi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x1400f3b40
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
mov eax, 0x4030
call fcn.1401c2680
sub rsp, rax
mov rax, qword [0x1402a83b0]
xor rax, rsp
mov qword [rsp + 0x4020], rax
mov rbx, rcx
mov rcx, qword [rcx + 0x55ba0]
xor r8d, r8d
xor edx, edx
mov edi, 1
call fcn.1401c1f88
mov r9, qword [rbx + 0x55ba0]
lea rcx, [rsp + 0x20]
mov edx, edi
mov r8d, 0x4000
call fcn.1401c1e14
mov edx, 0x21c
lea rax, [rsp + 0x23d]
cmp byte [rax - 1], 0xff
jne 0x1400f3bb1
cmp byte [rax], 0
jne 0x1400f3be5
xor edi, edi
inc edx
inc rax
movsxd rcx, edx
cmp rcx, 0x3fff
jb 0x1400f3ba4
mov eax, edi
mov rcx, qword [rsp + 0x4020]
xor rcx, rsp
call fcn.1401bd600
mov rbx, qword [rsp + 0x4048]
add rsp, 0x4030
pop rdi
ret
mov eax, 1
jmp 0x1400f3bc4
Function at 0x1400f6fa0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, qword [rcx + 0x28]
mov edx, 1
mov r8d, 0x1000
mov r9, qword [rsi + 0x38]
lea rdi, [rsi + 0x40]
mov r9, qword [r9 + 0x55ba0]
mov rcx, rdi
call fcn.1401c1e14
mov rdx, rdi
mov rcx, rdi
mov r8d, eax
mov rbx, rax
call fcn.1401eba4c
mov qword [rsi + 8], rbx
mov rbx, qword [rsp + 0x30]
mov qword [rsi], rdi
mov rsi, qword [rsp + 0x38]
mov al, 1
add rsp, 0x20
pop rdi
ret
Function at 0x1400f7de0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov eax, 8
mov r14, rdx
mov rsi, rcx
mov word [rdx], ax
xor edi, edi
nop word [rax + rax]
mov rcx, qword [rsi + 0x55ba0]
call fcn.1401c3f28
mov rcx, qword [rsi + 0x55ba0]
mov ebx, eax
call fcn.1401c3f28
mov ecx, ebx
mov edx, 0x100
sar rdx, cl
test rdx, rdx
jle 0x1400f7e5c
cdqe
shl bx, 8
lea rax, [r14 + rax*2]
or bx, di
nop word [rax + rax]
lea rax, [rax + 2]
mov word [rax], bx
dec rdx
jne 0x1400f7e50
inc edi
cmp edi, 0xd
jl 0x1400f7e10
mov rcx, rsi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
jmp fcn.1400fbbe0
Function at 0x1400faa40
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push rbx
push rdi
push r12
push r13
push r14
sub rsp, 0x260
mov rax, qword [0x1402a83b0]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov edx, dword [rcx + 0x3e8]
mov r14, rcx
mov rcx, qword [rcx + 0x55ba0]
xor r8d, r8d
mov dword [rsp + 0x30], 0x2000200
mov dword [rsp + 0x34], 0x2000200
call fcn.1401c1f88
mov rcx, r14
call fcn.1400fbc20
mov rcx, r14
mov edi, eax
call fcn.1400fbc20
mov rcx, r14
call fcn.1400fbc20
mov rcx, r14
call fcn.1400fbc20
mov rcx, r14
mov r12d, eax
call fcn.1400fbc20
mov ebx, eax
cmp edi, 2
jne 0x1400fab4d
mov r8d, dword [r14 + 0x3f4]
mov r9, qword [r14 + 0x55ba0]
mov rcx, qword [r14 + 0x10]
lea edx, [rdi - 1]
call fcn.1401c1e14
xor r13d, r13d
cmp dword [r14 + 0x3f4], r13d
jbe 0x1400facd8
nop dword [rax]
imul ebx, ebx, 0x63d
mov eax, 0x11f9f253
add ebx, 0xca25
mul ebx
mov eax, ebx
sub eax, edx
shr eax, 1
add eax, edx
mov edx, r13d
inc r13d
add rdx, qword [r14 + 0x10]
shr eax, 0x11
imul eax, eax, 0x3bcd0
sub ebx, eax
mov eax, ebx
imul r8, rax, 0x11f9f253
mov eax, ebx
shl eax, 8
sar r8, 0x18
sub eax, r8d
shr eax, 1
add eax, r8d
shr eax, 0x11
xor byte [rdx], al
cmp r13d, dword [r14 + 0x3f4]
jb 0x1400faaf0
jmp 0x1400facd8
cmp edi, 4
jne 0x1400facbc
mov rcx, qword [r14 + 0x10]
call fcn.1401be23c
mov eax, ebx
imul eax, r12d
lea ecx, [rax + rax*2]
shr ecx, 1
mov dword [r14 + 0x3f4], ecx
call fcn.1401bee78
lea r8, str.foveon_load_camf__
mov rdx, rax
mov rcx, r14
mov qword [r14 + 0x10], rax
call fcn.140106a20
lea rdx, [rsp + 0x40]
mov rcx, r14
call fcn.1400f7de0
mov rcx, r14
call fcn.1400fbc20
xor r8d, r8d
or edx, 0xffffffff
mov rcx, r14
call fcn.1400fc150
xor r13d, r13d
mov edi, r13d
test ebx, ebx
je 0x1400facd8
mov qword [rsp + 0x298], rbp
mov qword [rsp + 0x2a0], rsi
mov qword [rsp + 0x2a8], r15
mov r15d, r13d
mov rax, rbx
mov qword [rsp + 0x28], rbx
mov ebx, r13d
test r12d, r12d
je 0x1400fac91
mov rsi, r13
mov rbp, r13
lea rdx, [rsp + 0x40]
mov rcx, r14
call fcn.140104050
mov r8d, eax
cmp ebx, 2
jae 0x1400fac2b
mov rcx, r15
lea rdx, [rsp + 0x30]
and ecx, 1
lea rcx, [rsi + rcx*2]
movzx eax, word [rdx + rcx*2]
lea rdx, [rdx + rcx*2]
add eax, r8d
mov word [rdx], ax
mov word [rsp + rsi*2 + 0x20], ax
jmp 0x1400fac37
mov rax, rbp
and eax, 1
add word [rsp + rax*2 + 0x20], r8w
test bl, 1
je 0x1400fac7b
mov eax, dword [rsp + 0x20]
mov rcx, qword [r14 + 0x10]
mov edx, edi
movzx r8d, ax
shl al, 4
inc edi
shr r8w, 4
mov byte [rdx + rcx], r8b
movzx r8d, word [rsp + 0x22]
movzx edx, r8w
shr dx, 8
or dl, al
mov rax, qword [r14 + 0x10]
mov byte [rdi + rax], dl
mov rax, qword [r14 + 0x10]
inc edi
mov byte [rdi + rax], r8b
inc edi
inc ebx
inc rbp
inc rsi
cmp ebx, r12d
jb 0x1400fabf2
mov rax, qword [rsp + 0x28]
inc r15
dec rax
mov qword [rsp + 0x28], rax
jne 0x1400fabe0
mov r15, qword [rsp + 0x2a8]
mov rsi, qword [rsp + 0x2a0]
mov rbp, qword [rsp + 0x298]
jmp 0x1400facd8
call fcn.1401be514
mov r8, qword [r14 + 8]
lea rdx, str._s_has_unknown_CAMF_type__d._n
lea rcx, [rax + 0x60]
mov r9d, edi
call fcn.1401be844
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1401bd600
add rsp, 0x260
pop r14
pop r13
pop r12
pop rdi
pop rbx
ret
Function at 0x1400fbbe0
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov r9, qword [rcx + 0x55ba0]
mov edx, 1
mov rbx, rcx
lea rcx, [rsp + 0x30]
lea r8d, [rdx + 1]
mov word [rsp + 0x30], 0xffff
call fcn.1401c1e14
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.140116fd0
add rsp, 0x20
pop rbx
ret

Function at 0x1400fbc20
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov r9, qword [rcx + 0x55ba0]
mov edx, 1
mov rbx, rcx
lea rcx, [rsp + 0x30]
lea r8d, [rdx + 3]
mov dword [rsp + 0x30], 0xffffffff
call fcn.1401c1e14
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.140117000
add rsp, 0x20
pop rbx
ret

Function at 0x1400fc010
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x90
mov rax, qword [0x1402a83b0]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov qword [rsp + 0xa8], rbx
mov rdi, rcx
mov byte [rbp + 0x42], 0
test edx, edx
je 0x1400fc06a
mov ebx, 0x13
nop dword [rax + rax]
mov rcx, qword [rdi + 0x55ba0]
dec rbx
call fcn.1401c3f28
mov byte [rbp + rbx + 0x2f], al
test rbx, rbx
jne 0x1400fc050
jmp 0x1400fc083
mov r9, qword [rcx + 0x55ba0]
mov edx, 0x13
lea rcx, [rbp + 0x2f]
lea r8d, [rdx - 0x12]
call fcn.1401c1e14
xor eax, eax
lea r9, [rbp + 0x17]
lea r8, [rbp + 0x1b]
mov qword [rbp + 7], rax
mov qword [rbp + 0xf], rax
mov qword [rbp + 0x17], rax
mov qword [rbp + 0x1f], rax
mov dword [rbp + 0x27], eax
lea rax, [rbp + 7]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0xb]
lea rdx, str._d:_d:_d__d:_d:_d
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0xf]
lea rcx, [rbp + 0x2f]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x13]
mov qword [rsp + 0x20], rax
call fcn.1401be96c
mov rbx, qword [rsp + 0xa8]
cmp eax, 6
jne 0x1400fc132
sub dword [rbp + 0x1b], 0x76c
dec dword [rbp + 0x17]
lea rcx, [rbp + 7]
mov dword [rbp + 0x27], 0xffffffff
call fcn.1401c3304
test rax, rax
jle 0x1400fc110
lea rcx, [rbp + 7]
call fcn.1401c3304
mov qword [rdi + 0x3c0], rax
lea rcx, [rbp + 0x2f]
lea rax, [rbp + 0x2f]
sub rdi, rcx
nop dword [rax + rax]
movzx ecx, byte [rax]
lea rax, [rax + 1]
mov byte [rdi + rax + 0x4986f], cl
test cl, cl
jne 0x1400fc120
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1401bd600
mov rdi, qword [rsp + 0xb0]
add rsp, 0x90
pop rbp
ret

Function at 0x1400fc2a0
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
cmp edx, 3
jne 0x1400fc2b6
call fcn.1400fbbe0
movzx eax, ax
add rsp, 0x28
ret
add rsp, 0x28
jmp fcn.1400fbc20
Function at 0x1400fc490
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x60
movaps xmmword [rsp + 0x50], xmm6
movaps xmmword [rsp + 0x40], xmm7
mov rax, qword [0x1402a83b0]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov r9, qword [rcx + 0x55ba0]
mov esi, edx
mov r14, rcx
xorps xmm0, xmm0
mov ebp, 2
lea rcx, [rsp + 0x30]
movups xmmword [rsp + 0x20], xmm0
mov edx, ebp
mov r8d, edx
call fcn.1401c1e14
movsd xmm6, qword [rsp + 0x28]
movsd xmm7, qword [rsp + 0x20]
sub esi, ebp
je 0x1400fc5a5
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0x90], rdi
nop
mov r9, qword [r14 + 0x55ba0]
mov edx, 2
movsxd rdi, ebp
lea rbx, [rdi + rdi]
lea rcx, [rsp + 0x30]
lea r8d, [rdx - 1]
add rcx, rbx
call fcn.1401c1e14
movzx r8d, byte [rsp + rbx + 0x30]
movzx edx, byte [rsp + rbx + 0x31]
xor rdi, 2
mov eax, r8d
movzx r9d, byte [rsp + rdi*2 + 0x30]
movzx ecx, byte [rsp + rdi*2 + 0x31]
shl eax, 8
or edx, eax
mov eax, r9d
shl eax, 8
or ecx, eax
movzx eax, byte [rsp + rdi*2 + 0x31]
sub ecx, edx
shl eax, 8
or eax, r9d
movd xmm0, ecx
movzx ecx, byte [rsp + rbx + 0x31]
shl ecx, 8
or ecx, r8d
sub eax, ecx
inc ebp
and ebp, 3
cvtdq2pd xmm0, xmm0
mulsd xmm0, xmm0
addsd xmm7, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
mulsd xmm0, xmm0
addsd xmm6, xmm0
dec esi
jne 0x1400fc500
mov rdi, qword [rsp + 0x90]
mov rbx, qword [rsp + 0x88]
comisd xmm6, xmm7
mov eax, 0x4949
mov ecx, 0x4d4d
cmova eax, ecx
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1401bd600
movaps xmm6, xmmword [rsp + 0x50]
movaps xmm7, xmmword [rsp + 0x40]
add rsp, 0x60
pop r14
pop rsi
pop rbp
ret
Function at 0x140101d50
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x340
mov rax, qword [0x1402a83b0]
xor rax, rsp
mov qword [rsp + 0x330], rax
mov r15, rcx
mov rcx, qword [rcx + 0x55ba0]
mov ebp, r8d
mov r12, rdx
xor edi, edi
xor esi, esi
call fcn.1401c2310
add ebp, 3
xor ebx, ebx
and ebp, 0xfffffffc
mov r14d, eax
movsxd r13, ebp
test ebp, ebp
jle 0x140101ddd
mov rcx, qword [r15 + 0x55ba0]
call fcn.1401c3f28
movzx ecx, al
mov eax, ecx
and eax, 0xf
mov byte [rsp + rbx + 0x30], al
cmp al, 0xc
ja 0x140101eca
shr ecx, 4
mov byte [rsp + rbx + 0x31], cl
cmp cl, 0xc
ja 0x140101eca
add rbx, 2
cmp rbx, r13
jl 0x140101da4
and bpl, 7
cmp bpl, 4
jne 0x140101e10
mov rcx, qword [r15 + 0x55ba0]
call fcn.1401c3f28
mov rcx, qword [r15 + 0x55ba0]
shl eax, 8
movsxd rdi, eax
call fcn.1401c3f28
mov esi, 0x10
movsxd rcx, eax
add rdi, rcx
xor r14d, r14d
test r13, r13
jle 0x140101e9d
nop dword [rax]
movzx ebp, byte [rsp + r14 + 0x30]
cmp esi, ebp
jge 0x140101e57
xor ebx, ebx
nop dword [rax]
mov rcx, qword [r15 + 0x55ba0]
call fcn.1401c3f28
mov ecx, ebx
add ebx, 8
xor ecx, 8
movsxd rdx, eax
add ecx, esi
shl rdx, cl
add rdi, rdx
cmp ebx, 0x20
jl 0x140101e30
add esi, 0x20
mov ecx, 0x10
mov r8d, 0xffff
sub esi, ebp
sub ecx, ebp
sar r8d, cl
mov ecx, ebp
and r8d, edi
sar rdi, cl
lea ecx, [rbp - 1]
movzx eax, cl
bt r8d, eax
jb 0x140101e90
mov ecx, ebp
mov edx, 1
mov eax, 1
shl edx, cl
sub eax, edx
add r8d, eax
mov word [r12 + r14*2], r8w
inc r14
cmp r14, r13
jl 0x140101e20
xor eax, eax
mov rcx, qword [rsp + 0x330]
xor rcx, rsp
call fcn.1401bd600
mov rbx, qword [rsp + 0x390]
add rsp, 0x340
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov rcx, qword [r15 + 0x55ba0]
xor r8d, r8d
mov edx, r14d
call fcn.1401c1f88
dec r13
lea rdi, [r12 + 4]
shr r13, 3
mov ebp, 0xffffff00
mov esi, 0xfff
inc r13
nop word [rax + rax]
lea rdx, [rsp + 0x20]
mov r8d, 6
mov rcx, r15
call fcn.1401144b0
movzx r10d, word [rsp + 0x20]
movzx r11d, word [rsp + 0x24]
movzx ebx, word [rsp + 0x28]
movzx edx, word [rsp + 0x22]
movzx r8d, word [rsp + 0x26]
movzx r9d, word [rsp + 0x2a]
movzx ecx, r10w
movzx eax, r11w
shr cx, 4
shr ax, 8
and r10w, si
and ax, 0xfff0
and cx, bp
and r11w, si
or cx, ax
movzx eax, bx
and bx, si
shr ax, 0xc
lea rdi, [rdi + 0x10]
or cx, ax
movzx eax, r8w
and r8w, si
mov word [rdi - 0x14], cx
shr ax, 8
movzx ecx, dx
shr cx, 4
and ax, 0xfff0
and dx, si
and cx, bp
or cx, ax
movzx eax, r9w
and r9w, si
shr ax, 0xc
or cx, ax
mov word [rdi - 0x12], cx
mov word [rdi - 0x10], r10w
mov word [rdi - 0xe], dx
mov word [rdi - 0xc], r11w
mov word [rdi - 0xa], r8w
mov word [rdi - 8], bx
mov word [rdi - 6], r9w
dec r13
jne 0x140101f00
lea eax, [r13 + 1]
jmp 0x140101e9f
Function at 0x140106c80
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x1e0
mov rax, qword [0x1402a83b0]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
mov rbx, rcx
mov rcx, qword [rcx + 0x55ba0]
mov edx, 0xfffffe58
mov r8d, 2
call fcn.1401c1f88
mov r9, qword [rbx + 0x55ba0]
lea rcx, [rsp + 0x20]
mov edx, 1
mov r8d, 0x1a8
call fcn.1401c1e14
xor eax, eax
lea rcx, [rsp + 0x20]
mov r8d, eax
mov r9d, eax
nop
cmp byte [rcx], al
je 0x140106ce7
inc r9d
inc r8d
inc rcx
movsxd rdx, r8d
cmp rdx, 0x1a8
jb 0x140106ce0
cmp r9d, 0x14
setg al
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.1401bd600
add rsp, 0x1e0
pop rbx
ret

Function at 0x140106eb0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x1402a83b0]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, rcx
mov rcx, qword [rcx + 0x55ba0]
xor r8d, r8d
mov edx, 0xc00
call fcn.1401c1f88
mov r9, qword [rbx + 0x55ba0]
mov edx, 1
lea r8d, [rdx + 0x17]
lea rcx, [rsp + 0x20]
call fcn.1401c1e14
movzx r11d, byte [rsp + 0x28]
movzx eax, byte [rsp + 0x34]
and r11d, 3
and eax, 3
lea rdi, [0x1402216d0]
shl r11d, 4
mov r10, rdi
or r11d, eax
xor r9d, r9d
mov edx, r9d
cmp r11d, dword [r10]
jne 0x140106f72
shl rdx, 5
lea rcx, [rdi + 4]
mov r8, rbx
add rcx, rdx
sub r8, rcx
nop dword [rax]
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
mov byte [r8 + rcx + 0x21c], al
test al, al
jne 0x140106f40
lea rax, [rdi + 0x10]
add rax, rdx
mov rdx, rbx
sub rdx, rax
movzx ecx, byte [rax]
lea rax, [rax + 1]
mov byte [rdx + rax + 0x25c], cl
test cl, cl
jne 0x140106f60
inc r9d
add r10, 0x20
movsxd rdx, r9d
cmp rdx, 4
jb 0x140106f23
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1401bd600
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret

Function at 0x140106fa0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x1402a83b0]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rdi, rcx
mov rcx, qword [rcx + 0x55ba0]
xor r8d, r8d
xor edx, edx
call fcn.1401c1f88
xor ebx, ebx
nop
mov r9, qword [rdi + 0x55ba0]
mov edx, 1
lea rcx, [rsp + 0x20]
lea r8d, [rdx + 0xb]
call fcn.1401c1e14
movzx ecx, byte [rsp + 0x22]
movzx eax, byte [rsp + 0x24]
shr cl, 4
shr al, 4
and cl, al
movzx eax, byte [rsp + 0x27]
shr al, 4
and cl, al
movzx eax, byte [rsp + 0x29]
shr al, 4
and cl, al
and cl, byte [rsp + 0x21]
and cl, byte [rsp + 0x26]
and cl, byte [rsp + 0x28]
and cl, byte [rsp + 0x2b]
and cl, 3
cmp cl, 3
jne 0x140107039
inc ebx
cmp ebx, 0x400
jl 0x140106fd0
mov eax, 1
jmp 0x14010703b
xor eax, eax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1401bd600
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x140108360
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov edi, edx
mov rbx, rcx
test edx, edx
jne 0x140108386
mov dword [rcx + 0x44858], edx
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
cmp dword [rcx + 0x44858], 0
jne 0x1401083d8
mov ecx, dword [rcx + 0x44ec]
mov r9, qword [rbx + 0x55ba0]
mov r8d, 0x4000
sub r8d, ecx
add rcx, 0x45860
mov edx, 1
add rcx, rbx
call fcn.1401c1e14
mov r8d, dword [rbx + 0x44ec]
mov r9, qword [rbx + 0x55ba0]
lea rcx, [rbx + 0x45860]
mov edx, 1
call fcn.1401c1e14
mov ecx, dword [rbx + 0x44858]
or edx, 0xffffffff
sub ecx, edi
and ecx, 0x1ffff
mov dword [rbx + 0x44858], ecx
mov eax, ecx
and ecx, 7
xor eax, 0x1ff80
sar eax, 3
cdqe
movzx r8d, byte [rax + rbx + 0x45861]
movzx eax, byte [rax + rbx + 0x45860]
mov rbx, qword [rsp + 0x30]
shl r8d, 8
or eax, r8d
sar eax, cl
mov ecx, edi
shl edx, cl
not edx
and eax, edx
add rsp, 0x20
pop rdi
ret
Function at 0x14010aa20
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
sub rsp, 0x38
mov rbx, rcx
mov rcx, qword [rcx + 0x55ba0]
xor r8d, r8d
call fcn.1401c1f88
mov rcx, rbx
call fcn.1400fbc20
mov ebp, eax
cmp eax, 0xff
ja 0x14010ac69
test eax, eax
je 0x14010ac55
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x30], r13
mov esi, 0x10bc
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r15
mov r13d, 0x4949
lea r12d, [rsi + 3]
mov rcx, rbx
dec ebp
call fcn.1400fbbe0
mov rcx, rbx
movzx edi, ax
call fcn.1400fbbe0
mov rcx, qword [rbx + 0x55ba0]
movzx r14d, ax
call fcn.1401c2310
mov r15d, eax
cmp edi, 0x100
jne 0x14010aad6
mov rcx, rbx
call fcn.1400fbbe0
mov rcx, rbx
mov word [rbx + 0x44f0], ax
call fcn.1400fbbe0
mov word [rbx + 0x44f2], ax
jmp 0x14010ac1c
cmp edi, 0x121
jne 0x14010ab12
mov rcx, rbx
call fcn.1400fbbe0
mov rcx, rbx
mov word [rbx + 0x44f4], ax
call fcn.1400fbbe0
mov word [rbx + 0x44f6], ax
cmp ax, si
jne 0x14010ac1c
mov word [rbx + 0x44f6], r12w
jmp 0x14010ac1c
cmp edi, 0x130
jne 0x14010ab51
mov rcx, qword [rbx + 0x55ba0]
call fcn.1401c3f28
mov rcx, qword [rbx + 0x55ba0]
sar eax, 7
mov dword [rbx + 0x408], eax
call fcn.1401c3f28
shr eax, 3
not ax
and ax, 1
mov word [rbx + 0x4502], ax
jmp 0x14010ac1c
cmp edi, 0x131
jne 0x14010ab98
mov dword [rbx + 0x3d0], 9
xor edi, edi
nop word [rax + rax]
mov rcx, qword [rbx + 0x55ba0]
call fcn.1401c3f28
mov ecx, 0x23
sub ecx, edi
and al, 3
inc edi
mov byte [rcx + rbx + 0x381], al
cmp edi, 0x24
jb 0x14010ab70
jmp 0x14010ac1c
cmp edi, 0x2ff0
jne 0x14010abd6
xor edi, edi
lea esi, [rdi + 4]
mov rcx, rbx
call fcn.1400fbbe0
movzx eax, ax
movd xmm0, eax
mov rax, rdi
inc rdi
xor rax, 1
cvtdq2ps xmm0, xmm0
movss dword [rbx + rax*4 + 0x2469c], xmm0
dec rsi
jne 0x14010aba5
mov esi, 0x10bc
jmp 0x14010ac1c
cmp edi, 0xc000
jne 0x14010ac1c
cmp r14d, 0x4e20
jbe 0x14010ac1c
movsx edi, word [rbx]
mov word [rbx], r13w
nop
mov rcx, rbx
call fcn.1400fbc20
movzx ecx, word [rbx + 0x44f2]
cmp eax, ecx
ja 0x14010abf0
mov rcx, rbx
mov word [rbx + 0x44f6], ax
call fcn.1400fbc20
mov word [rbx], di
mov word [rbx + 0x44f4], ax
mov rcx, qword [rbx + 0x55ba0]
lea edx, [r15 + r14]
xor r8d, r8d
call fcn.1401c1f88
test ebp, ebp
jne 0x14010aa83
mov r15, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
mov r13, qword [rsp + 0x30]
mov r12, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x50]
mov ecx, dword [rbx + 0x408]
shl word [rbx + 0x44f4], cl
shr word [rbx + 0x44f6], cl
add rsp, 0x38
pop rbp
pop rbx
ret