joyce8/EMBER2024-capa huggingface dataset:
Function at 0x417820
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4179ab
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [0x006ee5d8]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00435fa0
xorps xmm15, xmm15
mov r14, qword [0x00791100]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x417885
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x417894
add rsp, 0x48
pop rbp
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x4178b3
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x4178c3
cmp rbx, 0x1000
jae 0x41788b
jmp 0x41792d
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x4178d5
xor edx, edx
jmp 0x417924
mov rcx, qword [0x006ee5d8]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00435fa0
xorps xmm15, xmm15
mov r14, qword [0x00791100]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x4178b9
jmp 0x4178a8
call fcn.0046c540
xorps xmm15, xmm15
mov r14, qword [0x00791100]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.0043a440
lea rax, [0x005b37b9]
mov ebx, 0x18
nop dword [rax]
call fcn.0043acc0
mov rax, qword [rsp + 0x38]
call fcn.0043aa00
lea rax, [0x005b3df5]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.0043acc0
mov rax, qword [rsp + 0x30]
call fcn.0043aa00
call fcn.0043a680
call fcn.0043a4a0
lea rax, [0x005b71c4]
mov ebx, 0x21
call fcn.004389a0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00468e00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00417820
Function at 0x4179e0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x417c06
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [0x006ee5e0]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.00436020
xorps xmm15, xmm15
mov r14, qword [0x00791100]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x417a53
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x417a62
add rsp, 0x50
pop rbp
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x417a85
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x417a95
cmp rbx, 0x1000
jae 0x417a59
nop
jmp 0x417b18
add rsp, 0x50
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop word [rax + rax]
cmp rbx, 0x1000
jae 0x417aad
xor esi, esi
jmp 0x417b0a
mov rax, qword [0x006ee5e0]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.00436020
xorps xmm15, xmm15
mov r14, qword [0x00791100]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x417a8b
jmp 0x417a76
call fcn.0046c540
xorps xmm15, xmm15
mov r14, qword [0x00791100]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x417ba0
nop dword [rax + rax]
call fcn.0043a440
lea rax, [0x005b3e0e]
mov ebx, 0x19
call fcn.0043acc0
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
call fcn.0043aa00
lea rax, [0x005b3df5]
mov ebx, 0x19
call fcn.0043acc0
mov eax, dword [rsp + 0x34]
call fcn.0043aa00
nop
call fcn.0043a680
call fcn.0043a4a0
lea rax, [0x005ae842]
mov ebx, 0xd
call fcn.004389a0
nop dword [rax + rax]
cmp eax, 0x5af
je 0x417b40
call fcn.0043a440
lea rax, [0x005b3e0e]
mov ebx, 0x19
call fcn.0043acc0
mov rax, qword [rsp + 0x38]
call fcn.0043aa00
lea rax, [0x005b3df5]
mov ebx, 0x19
call fcn.0043acc0
mov eax, dword [rsp + 0x34]
nop dword [rax]
call fcn.0043aa00
call fcn.0043a680
call fcn.0043a4a0
lea rax, [0x005b6792]
mov ebx, 0x1f
nop dword [rax + rax]
call fcn.004389a0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00468e00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.004179e0
Function at 0x4219e0
Capabilities:
Hash data using murmur3

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
cmp byte [0x00790636], 0
jne 0x421ad0
sub rbx, qword [rax + 0x18]
mov rdx, qword [rax + 0x48]
test byte [rdx], al
mov ecx, dword [rax + 0x5c]
imul rcx, rbx
mov rbx, rcx
shr rbx, 0x20
shr rcx, 0x23
and ebx, 7
mov rsi, rcx
mov rcx, rbx
mov edi, 1
shl edi, cl
add rdx, rsi
nop
nop
nop
nop
lock or byte [rdx], dil
mov rcx, qword [rax + 0x18]
movabs rdx, 0x800000000000
add rdx, rcx
mov rbx, rdx
shr rdx, 0x2a
nop
nop
nop
cmp rdx, 0x40
jae 0x421ac3
lea rsi, [0x00722738]
mov rdx, qword [rsi + rdx*8]
test byte [rdx], al
mov rsi, rcx
shr rsi, 0x10
and esi, 0x3f
shr rcx, 0xd
and ecx, 7
mov edi, 1
shl edi, cl
shr rbx, 0x16
and ebx, 0xfffff
mov rdx, qword [rdx + rbx*8]
test byte [rdx], al
movzx ebx, byte [rdx + rsi + 0x1040]
lea rdx, [rdx + rsi]
lea rdx, [rdx + 0x1040]
test dil, bl
jne 0x421a9e
lock or byte [rdx], dil
mov rcx, qword [r14 + 0x30]
mov rcx, qword [rcx + 0xa0]
test byte [rcx], al
mov rdx, qword [rcx + 0x1270]
add rdx, qword [rax + 0x68]
mov qword [rcx + 0x1270], rdx
add rsp, 0x10
pop rbp
ret
mov rax, rdx
mov ecx, 0x40
call fcn.0046b100
lea rax, [0x005ba2a1]
mov ebx, 0x2c
nop dword [rax]
call fcn.004389a0
nop
int3

Function at 0x423f20
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x424026
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov byte [rsp + 0x70], dil
mov qword [rsp + 0x10], 0
jmp 0x423f63
mov rax, qword [rsp + 0x58]
mov rcx, rdx
mov rbx, qword [rsp + 0x60]
movzx edi, byte [rsp + 0x70]
cmp qword [rsp + 0x10], rbx
jae 0x42401b
test byte [rax], al
lea rcx, [rax + 0x100b8]
mov ebx, edi
mov rax, rcx
nop dword [rax]
call fcn.00424d00
test rax, rax
je 0x42401b
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
lea rcx, [0x00424060]
mov qword [rsp + 0x18], rcx
lea rdx, [rsp + 0x10]
mov qword [rsp + 0x20], rdx
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x40], rax
lea rbx, [rsp + 0x18]
mov qword [rsp], rbx
nop dword [rax]
call fcn.00468ce0
xorps xmm15, xmm15
mov r14, qword [0x00791100]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x68]
nop dword [rax]
test rdx, rdx
jne 0x424009
xor eax, eax
jmp 0x424013
mov rax, qword [rdx]
call rax
mov rdx, qword [rsp + 0x68]
test al, al
je 0x423f51
mov rax, qword [rsp + 0x10]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov byte [rsp + 0x20], dil
call fcn.00468e00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movzx edi, byte [rsp + 0x20]
jmp fcn.00423f20
Function at 0x430ac0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x430bb9
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rax + 0x108], 0
mov ecx, dword [0x007915b0]
test ecx, ecx
je 0x430b92
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x10], 0
lea rcx, [rsp + 0x60]
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x30], xmm15
movups xmmword [rsp + 0x40], xmm15
lea rdx, [0x00430be0]
mov qword [rsp + 0x18], rdx
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], rcx
mov rcx, r14
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x10]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], 3
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x18]
mov qword [rsp], rcx
call fcn.00468ce0
xorps xmm15, xmm15
mov r14, qword [0x00791100]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x10]
cmp rax, 0x20
jge 0x430b8c
jae 0x430bae
mov rcx, qword [rsp + 0x60]
mov qword [rcx + rax*8 + 8], 0
add rsp, 0x50
pop rbp
ret
lea rcx, [fcn.00445b40]
inc rcx
mov qword [rax + 8], rcx
mov qword [rax + 0x10], 0
add rsp, 0x50
pop rbp
ret
mov ecx, 0x20
call fcn.0046b0e0
nop
mov qword [rsp + 8], rax
nop
call fcn.00468e00
mov rax, qword [rsp + 8]
jmp fcn.00430ac0
Function at 0x432e00
Capabilities:
Hash data using murmur3

Disassembly:
cmp rsp, qword [r14 + 0x18]
jbe 0x433086
push rbp
mov rbp, rsp
sub rsp, 0x38
test byte [rax], al
lea rsi, [rax + 0x1298]
mov rcx, qword [rax + 0x1288]
sub rcx, rsi
shr rcx, 3
cmp rcx, 0x200
ja 0x43307a
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x30], rcx
mov qword [rax + 0x1288], 0
cmp byte [0x00790636], 0
jne 0x432e5a
xor edx, edx
xor ebx, ebx
jmp 0x432ea0
xor edx, edx
jmp 0x432e85
mov qword [rsp + 0x28], rdx
mov rcx, qword [rax + rdx*8 + 0x1298]
mov rax, rcx
call fcn.00421240
mov rdx, qword [rsp + 0x28]
inc rdx
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
cmp rdx, rcx
jl 0x432e5e
add rax, 0x1288
call fcn.00432d80
add rsp, 0x38
pop rbp
ret
inc rdx
nop
cmp rdx, rcx
jge 0x433014
mov rsi, qword [rax + rdx*8 + 0x1298]
cmp rsi, 0x1000
jb 0x432e9b
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rbx
mov rax, rsi
xor ebx, ebx
mov rcx, rbx
call fcn.00414b00
test rax, rax
jne 0x432eec
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
jmp 0x432e9b
mov rsi, qword [rbx + 0x48]
test byte [rsi], al
mov r8, rcx
shr r8, 3
movzx r9d, byte [rsi + r8]
and ecx, 7
mov r10d, 1
shl r10d, cl
nop
add rsi, r8
test r10b, r9b
je 0x432f2c
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
jmp 0x432e9b
nop
lock or byte [rsi], r10b
mov rcx, qword [rbx + 0x18]
movabs rsi, 0x800000000000
lea r8, [rsi + rcx]
mov r9, r8
shr r8, 0x2a
nop
nop
nop
cmp r8, 0x40
jae 0x43306d
lea r10, [0x00722738]
mov r8, qword [r10 + r8*8]
test byte [r8], al
mov r10, rcx
shr r10, 0x10
and r10d, 0x3f
shr rcx, 0xd
and ecx, 7
mov r11d, 1
shl r11d, cl
shr r9, 0x16
and r9d, 0xfffff
mov r8, qword [r8 + r9*8]
test byte [r8], al
movzx r9d, byte [r8 + r10 + 0x1040]
lea r8, [r8 + r10]
lea r8, [r8 + 0x1040]
test r11b, r9b
jne 0x432faf
lock or byte [r8], r11b
movzx r8d, byte [rbx + 0x62]
test r8b, 1
je 0x432fe5
mov rax, qword [rsp + 0x48]
mov r8, qword [rax + 0x1270]
add r8, qword [rbx + 0x68]
mov qword [rax + 0x1270], r8
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
jmp 0x432e9b
mov r8, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
cmp r8, rcx
jae 0x433065
mov rbx, qword [rsp + 0x48]
mov qword [rbx + r8*8 + 0x1298], rax
inc r8
mov rax, rbx
mov rdx, qword [rsp + 0x28]
mov rbx, r8
jmp 0x432e9b
cmp rbx, 0x200
ja 0x433054
lea rdx, [rax + 0x1298]
lea rsi, [rax + 0x1260]
mov rcx, rbx
mov edi, 0x200
mov rbx, rdx
mov rax, rsi
call fcn.00427d20
mov rax, qword [rsp + 0x48]
add rax, 0x1288
call fcn.00432d80
add rsp, 0x38
pop rbp
ret
mov rcx, rbx
mov edx, 0x200
nop dword [rax]
call fcn.0046b160
mov rax, r8
call fcn.0046b0e0
mov rax, r8
mov ecx, 0x40
call fcn.0046b100
mov edx, 0x200
nop
call fcn.0046b140
nop
mov qword [rsp + 8], rax
call fcn.0046f9c0
mov rax, qword [rsp + 8]
jmp fcn.00432e00
Function at 0x448a40
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x448ba7
push rbp
mov rbp, rsp
sub rsp, 0x18
mov ecx, dword [rax + 0x190]
mov edx, dword [rax + 0x194]
mov rsi, qword [rax + 0x998]
mov edi, dword [rax + 0x194]
cmp edi, edx
jne 0x448a52
cmp edx, ecx
jne 0x448b95
nop word [rax + rax]
test rsi, rsi
jne 0x448b95
mov qword [rsp + 0x28], rax
test rbx, rbx
jne 0x448ab4
nop
call fcn.0046ca00
xorps xmm15, xmm15
mov r14, qword [0x00791100]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rbx, qword [rsp]
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x10], rbx
call fcn.00448960
mov rcx, qword [rsp + 0x28]
mov edx, dword [rcx]
mov ebx, edx
sar edx, 0x1f
shr edx, 0x1b
add edx, ebx
mov esi, edx
and edx, 0xffffffe0
sub ebx, edx
test ebx, ebx
jl 0x448b90
mov rdx, qword [0x0070ac98]
sar esi, 5
mov rax, rcx
mov ecx, ebx
mov edi, 1
shl edi, cl
movsxd rsi, esi
cmp ecx, 0x20
sbb r8d, r8d
and edi, r8d
cmp rdx, rsi
jbe 0x448b85
mov rcx, qword [0x0070ac90]
lea rcx, [rcx + rsi*4]
lock or dword [rcx], edi
mov rcx, qword [0x0070cc30]
mov qword [rax + 8], rcx
mov rcx, rax
nop
mov qword [0x0070cc30], rax
nop
mov edx, 1
lea rsi, [0x0070cc38]
lock xadd dword [rsi], edx
mov rdx, qword [rcx + 0x1248]
shr rdx, 0x3d
test dl, dl
jne 0x448b73
mov rax, qword [rsp + 0x10]
movabs rdx, 0x1fffffffffffffff
and rdx, rax
bts rdx, 0x3f
nop
nop
xchg qword [rcx + 0x1248], rdx
add rsp, 0x18
pop rbp
ret
lea rax, [0x005b95b7]
mov ebx, 0x28
nop
call fcn.004389a0
mov rax, rsi
mov rcx, rdx
call fcn.0046b0e0
call fcn.00437220
lea rax, [0x005b7c6d]
mov ebx, 0x23
call fcn.004389a0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00468e00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00448a40
Function at 0x456100
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
test rbx, rbx
jbe 0x456277
movzx edx, byte [rax]
test edx, edx
jne 0x456134
nop dword [rax]
test r8b, r8b
jne 0x456134
xor eax, eax
xor ebx, ebx
mov rcx, rbx
xor edi, edi
add rsp, 0x10
pop rbp
ret
bt edx, 7
jae 0x456147
xor edx, edx
xor r8d, r8d
xor r9d, r9d
jmp 0x456237
mov r8d, 1
mov r9d, edx
and edx, 1
neg edx
shr r9d, 1
xor edx, r9d
add dword [rsi], edx
nop dword [rax]
cmp rbx, r8
jb 0x456225
sub rbx, r8
sub rcx, r8
mov rdx, rcx
neg rdx
sar rdx, 0x3f
and r8, rdx
lea rdx, [rax + r8]
test rbx, rbx
jbe 0x456217
movzx esi, byte [rax + r8]
bt esi, 7
jae 0x45619d
xor eax, eax
xor esi, esi
xor r8d, r8d
jmp 0x4561e0
mov eax, 1
cmp rax, rbx
ja 0x4561cb
add qword [rdi], rsi
sub rcx, rax
sub rbx, rax
mov rsi, rcx
neg rsi
sar rsi, 0x3f
and rax, rsi
add rax, rdx
mov edi, 1
add rsp, 0x10
pop rbp
ret
mov rcx, rbx
call fcn.0046b1a0
lea r8d, [rcx + 7]
mov rcx, r11
mov eax, r12d
nop dword [rax]
cmp rax, rbx
jae 0x45620f
movzx r9d, byte [rax + rdx]
mov r10d, r9d
and r9d, 0x7f
mov r11, rcx
mov ecx, r8d
shl r9d, cl
lea r12d, [rax + 1]
or esi, r9d
test r10b, 0x80
jne 0x4561d3
mov rcx, r11
mov eax, r12d
jmp 0x4561a2
mov rcx, rbx
call fcn.0046b0e0
xor eax, eax
mov rcx, rax
nop dword [rax]
call fcn.0046b0e0
mov eax, r8d
mov rcx, rbx
call fcn.0046b1a0
lea r9d, [rcx + 7]
mov rcx, r12
cmp rbx, rdx
jbe 0x45626d
movzx r10d, byte [rdx + rax]
mov r11d, r10d
and r10d, 0x7f
mov r12, rcx
mov ecx, r9d
shl r10d, cl
inc edx
or r8d, r10d
test r11b, 0x80
jne 0x456230
mov rcx, r12
mov r9d, edx
mov edx, r8d
mov r8d, r9d
jmp 0x45614d
mov eax, edx
mov rcx, rbx
call fcn.0046b0e0
xor eax, eax
mov rcx, rax
nop dword [rax]
call fcn.0046b0e0
nop
int3

Function at 0x45c280
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45c335
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], rdi
test byte [rax], al
lea rdx, [rax + 0x10]
mov rsi, qword [rsp + 0x68]
mov rcx, rdi
mov rax, rdx
mov rbx, rsi
call fcn.00459f00
nop
test bl, bl
je 0x45c32f
mov qword [rsp + 0x18], rax
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
lea rcx, [0x0045c380]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x40], rcx
lea rcx, [rsp + 0x20]
mov qword [rsp], rcx
call fcn.00468ce0
xorps xmm15, xmm15
mov r14, qword [0x00791100]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x18]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00468e00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.0045c280
Function at 0x45f2a0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45f34f
push rbp
mov rbp, rsp
sub rsp, 0x58
mov qword [rsp + 0x70], rbx
lea rdx, [rsp + 0x68]
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rsi, [0x0045f3a0]
mov qword [rsp + 0x10], rsi
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdx
mov rdx, r14
mov qword [rsp + 0x28], rdx
lea rdx, [rsp + 8]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.00468ce0
xorps xmm15, xmm15
mov r14, qword [0x00791100]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
add rsp, 0x58
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00468e00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp fcn.0045f2a0
Function at 0x140004000
Capabilities:
Encode data using xor

Disassembly:
xchg edx, eax
sahf
stc
lahf
cdq
lahf
stc
xchg edx, eax
xchg edx, eax
nop
cld
cdq
sahf
clc
xchg edx, eax
xchg ecx, eax
clc
sahf
std
cdq
cld
cwde
cld
std
wait
sahf
xchg ecx, eax
wait
wait
cld
xchg ecx, eax
cdq
xchg ebx, eax
wait
wait
sahf
nop
xchg edx, eax
lahf
wait
lahf
cwde
std
stc
wait
cwde
lahf
stc
cdq
xchg edx, eax
lahf
cwde
wait
stc
xchg ecx, eax
xchg ecx, eax
lahf
wait
cdq
sahf
stc
cwde
clc
clc
clc
xchg ecx, eax
cdq
stc
xchg ebx, eax
clc
cld
clc
xchg ecx, eax
xchg ebx, eax
xchg ecx, eax
clc
lahf
xchg ebx, eax
sahf
sahf
stc
xchg ecx, eax
nop
nop
std
cwde
lahf
xchg ecx, eax
wait
cdq
xchg ebx, eax
xchg ebx, eax
sahf
cdq
nop
stc
stc
lahf
wait
nop
std
xchg ebx, eax
clc
clc
std
cdq
clc
std
stc
xchg ecx, eax
wait
clc
xchg ecx, eax
xchg edx, eax
stc
xchg ecx, eax
cdq
nop
std
wait
cdq
clc
lahf
cwde
cld
std
xchg ebx, eax
cld
cld
wait
lahf
stc
lahf
std
stc
clc
wait
xchg ebx, eax
cld
stc
cld
clc
xchg ecx, eax
stc
lahf
cdq
lahf
lahf
cwde
sahf
xchg ecx, eax
std
sahf
cld
cwde
stc
nop
cld
xchg ecx, eax
stc
xchg edx, eax
cwde
stc
clc
xchg ebx, eax
std
xchg ebx, eax
wait
clc
clc
nop
xchg ebx, eax
cld
nop
std
xchg edx, eax
sahf
nop
stc
nop
std
clc
xchg edx, eax
nop
wait
clc
xchg ebx, eax
sahf
nop
stc
sahf
xchg ebx, eax
nop
stc
nop
cld
xchg edx, eax
lahf
clc
stc
movabs rbx, 0xa51ceb6953362703
fcmovu st(0), st(6)
xor r14, r14
push rsp
pop rdx
and dx, 0xf370
mov r14b, 0x7c
fxsave64 [rdx]
add rdx, 8
mov r8, qword [rdx]
dec r14
xor qword [r8 + r14*8 + 0x27], rbx
test r14, r14
jne 0x1400040ec
push rdi
outsd dx, dword [rsi]
mov byte [rbp + 0x59], ah
invalid
Function at 0x140003b70
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x40
mov qword [rsp + 0x58], rdx
mov rbx, r8
xor edx, edx
test rcx, rcx
je 0x140003ba4
cmp word [rcx], 0x5a4d
jne 0x140003ba4
movsxd rax, dword [rcx + 0x3c]
cmp eax, 0x400
jg 0x140003ba4
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140003ba4
mov edx, dword [rcx + 0x28]
add rdx, qword [rsp + 0x58]
mov rcx, rbx
call fcn.140003ab0
test eax, eax
jne 0x140003bc0
xor eax, eax
add rsp, 0x40
pop rbx
ret
mov rcx, rbx
call fcn.140003b20
test rax, rax
je 0x140003bb5
lea rdx, [rax + 0x10]
lea rax, [rsp + 0x38]
mov rcx, qword [rbx]
mov r9d, 8
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x58]
mov qword [rsp + 0x38], 0
call fcn.140004369
not eax
shr eax, 0x1f
add rsp, 0x40
pop rbx
ret

Function at 0x140004270
Capabilities:
Execute syscall

Disassembly:
pop rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov rcx, r10
call fcn.140004210
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x140004e20
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x140004e43
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
jne 0x140004e43
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret

Function at 0x140004ef1
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r9, qword [0x14055b650]
mov r8, rcx
mov rcx, r9
call fcn.140004e20
test eax, eax
je 0x140004f1d
mov rdx, r8
mov rcx, r9
sub rdx, r9
add rsp, 0x28
jmp fcn.140004e44
xor eax, eax
add rsp, 0x28
ret
Function at 0x14002518c
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
movsxd r8, dword [0x14000003c]
lea rsi, [0x140000000]
add r8, rsi
mov rbx, rdx
mov rdi, rcx
cmp dword [r8 + 0x84], 0xd
jbe 0x140025204
mov r10d, dword [r8 + 0xf0]
xor r9d, r9d
test r10d, r10d
je 0x140025204
movzx ecx, word [r8 + 0x14]
movzx r11d, word [r8 + 6]
add rcx, 0x18
mov r10d, dword [r10 + rsi + 0xc]
add rcx, r8
test r11d, r11d
je 0x140025204
mov eax, dword [rcx + 0xc]
cmp r10d, eax
jb 0x1400251f8
mov edx, dword [rcx + 8]
add eax, edx
cmp r10d, eax
jb 0x140025216
inc r9d
add rcx, 0x28
cmp r9d, r11d
jb 0x1400251e6
xor eax, eax
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
mov dword [rdi], edx
mov eax, dword [rcx + 0x24]
mov dword [rbx], eax
mov eax, dword [rcx + 0xc]
add rax, rsi
jmp 0x140025206

Function at 0x140026a90
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140026ada
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140026ada
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140026ada
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140026ada
cmp dword [rcx + 0x84], 0xe
jbe 0x140026ada
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140026adc
xor al, al
add rsp, 0x28
ret

Function at 0x14002f534
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14002f298

Function at 0x140039480
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400394a8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1400394a8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x100403a20
Capabilities:
Encode data using xor

Disassembly:
xor al, 0x6c
xor al, 0x64
xor al, 0x67
xor al, 0x41
xor al, 0x3e
xor al, 0x7d
xor al, 0xa2
xor al, 0x9a
xor al, 0xa3
xor al, 0x88
xor al, 0x9d
xor al, 0xa4
xor al, 0x71
xor al, 0x74
xor al, 0x59
xor al, 0x87
xchg dword [rbp*4 - 0x57cb58cc], esi
xor al, 0x99
xor al, 0xa1
xor al, 0x86
xor al, 0xa3
xor al, 0xa3
movabs dword [0xa73490345934a834], eax
xor al, 0xad
xor al, 0xa7
xor al, 0xa8
xor al, 0x99
cdq
xor al, 0xa1
xor al, 0x67
xor al, 0x66
xor al, 0x90
xor al, 0xa7
xor al, 0x9c
xor al, 0x99
xor al, 0xa0
xor al, 0xa0
xor al, 0x67
xor al, 0x66
xor al, 0x62