joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140012f70
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
lea rcx, str.Entering_StopMonitors__
mov dil, 1
call fcn.140001140
mov ecx, 3
call fcn.140012ad0
lea rcx, str.Stopping_the_hyper_V_monitor
call fcn.140001140
lea rcx, [0x140028560]
call fcn.1400021f0
test al, al
jne 0x140012fc8
lea rcx, str.ERROR:__Unable_to_stop_the_hyper_v_monitor
call fcn.140001140
xor dil, dil
mov ecx, 3
call fcn.140012ad0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebp, 1
mov r11d, eax
mov eax, 0x10624dd3
mul r11d
mov esi, edx
shr esi, 6
nop dword [rax]
lea rcx, [0x140028560]
xor bl, bl
call fcn.140001450
movzx ebx, bl
mov ecx, 3
test al, al
cmovne ebx, ebp
call fcn.140012ad0
test bl, bl
je 0x140013049
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r11d, eax
mov eax, 0x10624dd3
mul r11d
shr edx, 6
sub edx, esi
cmp edx, 0x1e
jbe 0x140012ff0
lea rcx, str.ERROR:__Maximum_timeout_exceeded_in_waiting_for_monitors_to_stop
call fcn.140001140
xor dil, dil
lea rcx, str.Exiting_StopMonitor_____bSuccess_d
movzx edx, dil
call fcn.140001140
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
movzx eax, dil
add rsp, 0x20
pop rdi
ret
Function at 0x1400130f0
Capabilities:
Query service status
Start service
Stop service

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x70
mov rax, qword [0x1400273a8]
xor rax, rsp
mov qword [rsp + 0x60], rax
movzx r12d, dl
mov rsi, rcx
lea rcx, str.Entering_WaitOnStatus___bStartService_d
mov edx, r12d
call fcn.140001140
or ebx, 0xffffffff
xor bpl, bpl
mov dword [rsp + 0x30], 0
lea edi, [rbx + 2]
lea r13d, [rbx + 4]
test r12b, r12b
je 0x140012bd6
lea edi, [rbx + 5]
lea r13d, [rbx + 3]
test rsi, rsi
jne 0x140012bf0
lea rcx, str.EEROR:__handle_to_the_service_is_NULL_
call fcn.140001140
jmp 0x140012cda
mov eax, ebx
inc ebx
test eax, eax
je 0x140012cda
lea rax, [rsp + 0x30]
lea r8, [rsp + 0x38]
mov r9d, 0x24
xor edx, edx
mov rcx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x140012cc6
mov edx, dword [rsp + 0x3c]
cmp edx, r13d
jne 0x140012c3b
lea rcx, str.New_status_is_pending.__Current_State_d
call fcn.140001140
jmp 0x140012c7f
cmp edx, edi
je 0x140012cb5
mov rcx, rsi
test r12b, r12b
je 0x140012c65
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x140012c79
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ERROR:__Unable_to_send_StartService_command___error_d
jmp 0x140012cd3
lea r8, [rsp + 0x38]
mov edx, 1
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x140012ca6
cmp dword [rsp + 0x3c], edi
je 0x140012c95
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp ebx, 0xa
jl 0x140012bf0
jmp 0x140012cda
lea rcx, str.Successfully_changed_the_status
call fcn.140001140
mov bpl, 1
jmp 0x140012cda
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ERROR:__Unable_to_send_SERVICE_CONTROL_STOP_command____error_d
jmp 0x140012cd3
lea rcx, str.New_status_is_updated.__Current_state_d
call fcn.140001140
mov bpl, 1
jmp 0x140012cda
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ERROR:__Unable_to_get_the_current_status_of_the_service____error_d
mov edx, eax
call fcn.140001140
lea rcx, str.Exiting_WaitOnStatus___bServiceChanged_d
movzx edx, bpl
call fcn.140001140
movzx eax, bpl
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140013da0
mov rbx, qword [rsp + 0xb0]
add rsp, 0x70
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
xor edx, edx
jmp 0x140012b80
Function at 0x140013230
Capabilities:
Delete service

Disassembly:
push rbx
sub rsp, 0x20
lea rcx, str.Entering_MarkServiceForDelete
call fcn.140001140
xor bl, bl
call fcn.140012f70
test al, al
jne 0x140013259
lea rcx, str.ERROR:__Unable_to_stop_the_monitors_
call fcn.140001140
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x38]
call fcn.140012d10
test al, al
jne 0x14001327a
lea rcx, str.ERROR:__Unable_to_retrieve_service_handle_
call fcn.140001140
jmp 0x1400132c9
mov rcx, qword [rsp + 0x30]
call fcn.1400130f0
test al, al
jne 0x140013296
lea rcx, str.ERROR:__Unable_to_stop_the_service_in_the_wait_time_provided
call fcn.140001140
jmp 0x1400132c9
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x1400132bb
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ERROR:__Unable_to_delete_the_service____error_d
mov edx, eax
call fcn.140001140
jmp 0x1400132c9
lea rcx, str.Succesfully_deleted_the_service.
call fcn.140001140
mov bl, 1
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x38]
call fcn.140012de0
test al, al
jne 0x1400132ea
lea rcx, str.ERROR:__Unable_to_close_the_service_handle
call fcn.140001140
xor bl, bl
lea rcx, str.Exiting_MarkServiceForDelete___Success_d
movzx edx, bl
call fcn.140001140
movzx eax, bl
add rsp, 0x20
pop rbx
ret
Function at 0x140014327
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x1400273a8]
jne 0x140013dba
rol rcx, 0x10
test cx, 0xffff
jne 0x140013db6
repz ret
ror rcx, 0x10
jmp 0x140014280
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x1400286d0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x1400287c8]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x140014305
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x1400286d0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x140014327
mov rax, qword [rsp + 0x88]
mov qword [0x1400287c8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x140028768], rax
mov rax, qword [0x1400287c8]
mov qword [0x140028640], rax
mov rax, qword [rsp + 0x90]
mov qword [0x140028750], rax
mov dword [0x140028630], 0xc0000409
mov dword [0x140028634], 1
mov rax, qword [0x1400273a8]
mov qword [rsp + 0x68], rax
mov rax, qword [0x1400273b0]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x1400286c8], eax
mov ecx, 1
call sub.MSVCR100.dll___crt_debugger_hook
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x14001c6e8]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x1400286c8], 0
jne 0x1400143ae
mov ecx, 1
call sub.MSVCR100.dll___crt_debugger_hook
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x404300
Capabilities:
Access peb ldr_data

Disassembly:
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov qword [rsp + 0x60], rax
mov rcx, qword [rax + 0x30]
cmp qword [rcx + 0x90], rax
jne 0x4044a4
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
mov rcx, qword [rcx + 0x30]
nop
inc dword [rcx + 0x244]
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
mov rdx, qword [rcx + 0x30]
nop
mov rbx, rcx
mov qword [rdx + 0x138], rcx
mov rcx, qword [rbx + 0x30]
mov qword [rbx + 0xd8], rcx
mov rcx, qword [rax + 0x30]
movups xmm0, xmmword [rcx + 0x2d8]
movups xmmword [rsp + 0x20], xmm0
movups xmm0, xmmword [rcx + 0x2e8]
movups xmmword [rsp + 0x30], xmm0
movups xmm0, xmmword [rcx + 0x2f8]
movups xmmword [rsp + 0x40], xmm0
mov rcx, qword [rax + 0x70]
mov qword [rsp + 0x50], rcx
mov rdx, qword [rax + 0x78]
mov qword [rsp + 0x18], rdx
call fcn.00461580
mov rax, qword [rsp + 0x60]
mov rcx, qword [rax + 0x30]
mov byte [rcx + 0xe8], 0
mov rcx, qword [rax + 0x30]
xor edx, edx
xchg dword [rcx + 0x348], edx
mov rcx, qword [rsp + 0x78]
mov qword [rsp], rcx
mov rcx, qword [rsp + 0x80]
mov qword [rsp + 8], rcx
mov rcx, qword [rsp + 0x88]
mov qword [rsp + 0x10], rcx
call fcn.00404500
mov rax, qword [rsp + 0x60]
mov rcx, qword [rax + 0x30]
mov qword [rsp + 0x58], rcx
jmp 0x40442f
nop
mov rax, qword [0x00578c50]
mov qword [rsp], rax
mov dword [rsp + 8], 0
call fcn.00468220
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
mov rdx, rax
xor eax, eax
mov ebx, 1
lock cmpxchg dword [rcx + 0x348], ebx
sete sil
test sil, sil
je 0x40440c
mov rax, qword [rdx + 0x30]
mov byte [rax + 0xe8], 1
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x18]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
call fcn.00440cc0
mov rax, qword [rsp + 0x60]
mov rax, qword [rax + 0x30]
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rax + 0x2d8], xmm0
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rax + 0x2e8], xmm0
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rax + 0x2f8], xmm0
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
call fcn.00437de0
lea rax, [0x004db83f]
mov qword [rsp], rax
mov qword [rsp + 8], 0x1e
nop dword [rax]
call fcn.00438860
call fcn.00437e80
mov dword [rsp], 2
call fcn.00431f80
mov rax, qword [rsp + 0x60]
nop dword [rax + rax]
jmp 0x404334
Function at 0x420d40
Capabilities:
Hash data using murmur3

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
cmp byte [0x005bc1d5], 0
jne 0x420ea5
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
sub rdx, qword [rbx + 0x18]
nop
test rdx, rdx
jne 0x420e4e
xor eax, eax
nop
nop
nop
mov rcx, rax
shr rax, 3
and rcx, 7
mov edx, 1
shl edx, cl
nop
add rax, qword [rbx + 0x50]
lock or byte [rax], dl
nop
nop
mov rcx, qword [rbx + 0x18]
nop
movabs rdx, 0x800000000000
lea rax, [rdx + rcx]
mov rdx, rax
shr rax, 0x2a
cmp rax, 0x40
jae 0x420e9a
lea rbx, [0x0059e078]
mov rax, qword [rbx + rax*8]
shr rdx, 0x16
and rdx, 0xfffff
mov rdx, qword [rax + rdx*8]
test byte [rdx], al
test byte [rax], al
mov rax, rcx
shr rcx, 0x10
and rcx, 0x3f
movzx ebx, byte [rdx + rcx + 0x21040]
lea rdx, [rdx + rcx]
lea rdx, [rdx + 0x21040]
shr rax, 0xd
and rax, 7
mov rcx, rax
mov esi, 1
shl esi, cl
test sil, bl
jne 0x420e0f
lock or byte [rdx], sil
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov rax, qword [rax + 0x30]
mov rax, qword [rax + 0xa0]
test byte [rax], al
mov rcx, qword [rsp + 0x30]
add qword [rax + 0x16a8], rcx
mov rcx, qword [rsp + 0x38]
add qword [rax + 0x16b0], rcx
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
cmp word [rbx + 0x5e], 0
je 0x420e6a
movzx ecx, byte [rbx + 0x65]
cmp cl, 0x40
sbb rax, rax
shr rdx, cl
and rax, rdx
jmp 0x420d75
movzx ecx, byte [rbx + 0x65]
cmp cl, 0x40
sbb rax, rax
movzx esi, byte [rbx + 0x66]
cmp sil, 0x40
sbb rdi, rdi
shr rdx, cl
and rax, rdx
movzx edx, word [rbx + 0x5c]
imul rax, rdx
mov ecx, esi
shr rax, cl
and rax, rdi
jmp 0x420d75
mov ecx, 0x40
nop
call fcn.00466c00
lea rax, [0x004ddd2f]
mov qword [rsp], rax
mov qword [rsp + 8], 0x2c
call fcn.00436600
nop
int3
Function at 0x428280
Capabilities:
Access peb ldr_data

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4284ee
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
nop
lea rax, [0x005a4a30]
mov qword [rsp], rax
call fcn.0040b840
lea rax, [0x005a49a0]
mov qword [rsp], rax
call fcn.00419080
mov rax, qword [rsp + 8]
mov qword [rsp + 0x48], rax
nop
nop
lea rcx, [0x005a4a30]
mov qword [rsp], rcx
call fcn.0040baa0
mov rax, qword [rsp + 0x48]
mov byte [rax + 0xa], 1
lea rdi, [rax + 0x10]
cmp dword [0x005bc430], 0
jne 0x4284df
mov rcx, qword [rsp + 0x68]
mov qword [rax + 0x10], rcx
mov qword [rsp + 0x40], rdi
mov rcx, qword [rsp + 0x70]
mov qword [rax + 0x18], rcx
cmp dword [0x005bc430], 0
nop dword [rax]
jne 0x4284b8
mov rcx, qword [rsp + 0x78]
mov qword [rax + 0x20], rcx
mov rcx, qword [rsp + 0x80]
mov qword [rax + 0x28], rcx
mov rcx, qword [rsp + 0x60]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
call fcn.00427de0
cmp byte [rsp + 0x10], 0
je 0x428456
cmp dword [0x005bc214], 0
jne 0x428374
mov byte [rsp + 0x88], 1
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov rax, qword [rsp + 0x60]
mov qword [rsp], rax
xorps xmm0, xmm0
movups xmmword [rsp + 8], xmm0
call fcn.00413a40
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov rcx, qword [rax + 0x30]
mov rdx, qword [rsp + 0x18]
nop
inc dword [rcx + 0xd8]
mov rcx, qword [rax + 0x30]
mov qword [rsp + 0x30], rcx
mov rbx, qword [rcx + 0xa0]
test byte [rbx], al
test byte [rax], al
mov qword [rsp], rdx
lea rax, [rbx + 0x1698]
mov qword [rsp + 0x38], rax
mov qword [rsp + 8], rax
call fcn.0041fde0
mov rax, qword [rsp + 0x40]
mov qword [rsp], rax
mov qword [rsp + 8], 8
lea rax, [0x00561160]
mov qword [rsp + 0x10], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x20], 0
call fcn.0041fc40
nop
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x30]
mov edx, dword [rcx + 0xd8]
lea ebx, [rdx - 1]
mov dword [rcx + 0xd8], ebx
cmp edx, 1
jne 0x428362
cmp byte [rax + 0xb1], 0
je 0x428362
mov qword [rax + 0x10], 0xfffffffffffffade
jmp 0x428362
nop
nop
lea rax, [0x005a4a30]
mov qword [rsp], rax
call fcn.0040b840
nop
mov rax, qword [0x005a49d0]
sub rax, qword [0x005a49a0]
mov qword [0x005a49d0], rax
mov rax, qword [0x005a49b8]
mov rcx, qword [rsp + 0x48]
mov qword [rcx], rax
mov qword [0x005a49b8], rcx
nop
nop
lea rax, [0x005a4a30]
mov qword [rsp], rax
call fcn.0040baa0
mov byte [rsp + 0x88], 0
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
lea rcx, [rax + 0x20]
mov rdi, rcx
mov rbx, qword [rsp + 0x78]
call fcn.00466880
lea rdi, [rax + 0x28]
mov rcx, qword [rsp + 0x80]
call fcn.00466840
jmp 0x42833b
mov rcx, qword [rsp + 0x68]
call fcn.00466840
jmp 0x428308
call fcn.00464a00
jmp fcn.00428280
Function at 0x451340
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov rcx, qword [rsp + 0x28]
test rcx, rcx
jbe 0x4514f9
mov rdx, qword [rsp + 0x20]
movzx ebx, byte [rdx]
test ebx, ebx
jne 0x451376
movzx esi, byte [rsp + 0x48]
test sil, sil
je 0x4514a7
bt ebx, 7
nop word [rax + rax]
jae 0x451499
xor eax, eax
xor ebx, ebx
xor esi, esi
jmp 0x4513a0
lea esi, [rcx + 7]
mov rcx, rax
mov eax, r8d
nop word [rax + rax]
cmp rcx, rax
jbe 0x4514f4
movzx edi, byte [rax + rdx]
lea r8d, [rax + 1]
mov r9d, edi
and edi, 0x7f
mov rax, rcx
mov ecx, esi
shl edi, cl
or ebx, edi
test r9b, 0x80
jne 0x45138e
mov esi, ebx
and ebx, 1
neg ebx
shr esi, 1
xor ebx, esi
mov rsi, qword [rsp + 0x40]
add dword [rsi], ebx
nop dword [rax + rax]
cmp rax, r8
jb 0x4514e9
sub rax, r8
mov rbx, qword [rsp + 0x30]
sub rbx, r8
mov rsi, rbx
neg rbx
sar rbx, 0x3f
and r8, rbx
lea rbx, [rdx + r8]
test rax, rax
jbe 0x4514df
movzx edx, byte [rdx + r8]
bt edx, 7
jae 0x451491
xor ecx, ecx
xor edx, edx
xor edi, edi
nop
jmp 0x451428
lea edi, [rcx + 7]
mov ecx, r9d
cmp rax, rcx
jbe 0x4514d2
movzx r8d, byte [rcx + rbx]
lea r9d, [rcx + 1]
mov r10d, r8d
and r8d, 0x7f
mov ecx, edi
shl r8d, cl
or edx, r8d
test r10b, 0x80
jne 0x451422
cmp rax, r9
jb 0x4514c7
mov rcx, qword [rsp + 0x38]
add qword [rcx], rdx
sub rsi, r9
mov rcx, rsi
neg rsi
sar rsi, 0x3f
and rsi, r9
lea rdx, [rbx + rsi]
mov qword [rsp + 0x50], rdx
sub rax, r9
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rcx
mov byte [rsp + 0x68], 1
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov r9d, 1
jmp 0x45144f
mov rax, rcx
mov r8d, 1
jmp 0x4513c6
mov qword [rsp + 0x50], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov byte [rsp + 0x68], 0
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov rcx, rax
mov eax, r9d
call fcn.00466ca0
mov rdx, rax
mov eax, ecx
mov rcx, rdx
call fcn.00466be0
mov rcx, rax
xor eax, eax
call fcn.00466be0
mov rcx, rax
mov eax, r8d
call fcn.00466ca0
call fcn.00466be0
xor eax, eax
nop dword [rax + rax]
call fcn.00466be0
nop
int3

Function at 0x458720
Capabilities:
Access peb ldr_data

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x458801
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov qword [rsp + 8], 0
mov qword [rsp + 0x10], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x18], xmm0
movups xmmword [rsp + 0x28], xmm0
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
lea rcx, [0x004605e0]
mov qword [rsp + 0x10], rcx
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x18], rcx
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 8]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.004648a0
mov rax, qword [rsp + 8]
mov qword [rsp + 0x88], rax
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
nop
ret
call fcn.00464a00
jmp fcn.00458720
Function at 0x4665e0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x402d60
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
mov rax, qword [rax + 8]
mov qword [rsp], rcx
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rax
call fcn.00409e20
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0x40], rax
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
call fcn.00464a00
jmp 0x402d00
cmp byte [0x005bc1d4], 0
je 0x4665ff
mov rax, qword [rsp + 8]
mov rcx, qword [rax + 8]
mov rax, qword [rax]
lea rdx, [rsp + 0x18]
jmp 0x463a20
jmp 0x402d00

Function at 0x466620
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, qword [0x005bc460]
nop
mov rcx, qword [rsp + 8]
mov ecx, dword [rcx]
mov rdx, qword [rsp + 0x10]
lea rax, [rdx + rax*4]
xor rax, rcx
shl rcx, 0x20
xor rcx, rax
movabs rax, 0xea38ec9079f01541
imul rax, rcx
rol rax, 0x1f
movabs rcx, 0x2723a30d96da1399
imul rcx, rax
mov rax, rcx
shr rcx, 0x1d
xor rcx, rax
movabs rax, 0x83cf8eadf876d2d7
imul rax, rcx
mov rcx, rax
shr rax, 0x20
xor rax, rcx
mov qword [rsp + 0x18], rax
ret
cmp byte [0x005bc1d4], 0
je 0x46665c
mov rax, qword [rsp + 8]
movq xmm0, qword [rsp + 0x10]
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x005bc6e0]
aesenc xmm0, xmmword [0x005bc6f0]
aesenc xmm0, xmmword [0x005bc700]
movq qword [rsp + 0x18], xmm0
ret
jmp 0x40a0a0

Function at 0x466680
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, qword [0x005bc460]
mov rcx, qword [rsp + 8]
mov rcx, qword [rcx]
mov rdx, qword [rsp + 0x10]
lea rax, [rdx + rax*8]
xor rcx, rax
movabs rax, 0xea38ec9079f01541
imul rax, rcx
rol rax, 0x1f
movabs rcx, 0x2723a30d96da1399
imul rcx, rax
mov rax, rcx
shr rcx, 0x1d
xor rax, rcx
movabs rcx, 0x83cf8eadf876d2d7
imul rcx, rax
mov rax, rcx
shr rcx, 0x20
xor rax, rcx
mov qword [rsp + 0x18], rax
ret
cmp byte [0x005bc1d4], 0
je 0x4666bd
mov rax, qword [rsp + 8]
movq xmm0, qword [rsp + 0x10]
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x005bc6e0]
aesenc xmm0, xmmword [0x005bc6f0]
aesenc xmm0, xmmword [0x005bc700]
movq qword [rsp + 0x18], xmm0
ret
jmp 0x40a120

Function at 0x467f00
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x30
mov rcx, 0xfffffffffffffff4
mov qword [rsp], rcx
mov rax, qword [sym.imp.kernel32.dll_GetStdHandle]
call rax
mov rcx, rax
mov qword [rsp], rcx
lea rdx, [0x005bc660]
mov qword [rsp + 8], rdx
lea r8d, [0x005bc1ec]
mov qword [rsp + 0x10], r8
lea r9, [rsp + 0x28]
mov qword [r9], 0
mov qword [rsp + 0x18], r9
mov qword [rsp + 0x20], 0
mov rax, qword [sym.imp.kernel32.dll_WriteFile]
call rax
add rsp, 0x30
ret
Function at 0x473260
Capabilities:
Encode data using base64

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov rdx, qword [rsp + 0x20]
mov rbx, qword [rdx + 8]
lea rsi, [rbx + 0x2e]
imul rsi, rsi, 0xffffffffffffffe4
movabs rax, 0x5816058160581606
mov rcx, rdx
imul rsi
sar rdx, 5
sar rsi, 0x3f
sub rdx, rsi
lea rsi, [rdx + 0x15c]
sar rsi, 0x3f
shr rsi, 0x3d
lea rdx, [rsi + rdx]
lea rdx, [rdx + 0x15c]
sar rdx, 3
cmp rdx, 0x57
jae 0x473339
lea rsi, [rdx + rdx*2]
lea rdi, [0x0056f560]
mov r8, qword [rdi + rsi*8 + 8]
lea r9, [r8 + rbx]
lea r9, [r9 + 0x40]
cmp r9, 0xffffffffffffffc4
jge 0x4732e2
inc rdx
nop
jmp 0x4732b8
cmp r9, 0xffffffffffffffe0
jle 0x4732ed
dec rdx
jmp 0x4732b8
mov rbx, qword [rdi + rsi*8]
mov rax, qword [rcx]
mov rsi, rdx
mul rbx
shr rax, 0x3f
add rdx, rax
mov qword [rcx], rdx
mov rdx, qword [rcx + 8]
lea rdx, [rdx + r8]
lea rdx, [rdx + 0x40]
mov qword [rcx + 8], rdx
mov rcx, rsi
shl rsi, 3
lea rdx, [rsi - 0x15c]
neg rdx
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rcx
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov rax, rdx
mov ecx, 0x57
call fcn.00466be0
nop
int3
Function at 0x482b40
Capabilities:
Hash data using fnv

Disassembly:
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov edx, dword [rsp + 8]
xor ebx, ebx
jmp 0x482b61
movzx esi, byte [rax + rbx]
inc rbx
imul edx, edx, 0x1000193
xor edx, esi
cmp rcx, rbx
jg 0x482b52
mov dword [rsp + 0x28], edx
ret

Function at 0x4ac1a0
Capabilities:
Encode data using xor

Disassembly:
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdx, qword [rsp + 0x20]
test rdx, 0xf
jne 0x4ac20b
mov rax, 0
movdqu xmm0, xmmword [rsi + rax]
movdqu xmm1, xmmword [rcx + rax]
pxor xmm0, xmm1
movdqu xmmword [rbx + rax], xmm0
add rax, 0x10
cmp rdx, rax
jne 0x4ac1c4
ret
sub rdx, 1
mov dil, byte [rsi + rdx]
mov al, byte [rcx + rdx]
xor dil, al
mov byte [rbx + rdx], dil
test rdx, 7
jne 0x4ac1e1
cmp rdx, 0
je 0x4ac22d
test rdx, 0xf
je 0x4ac1bd
test rdx, 7
jne 0x4ac1e1
sub rdx, 8
mov rdi, qword [rsi + rdx]
mov rax, qword [rcx + rdx]
xor rdi, rax
mov qword [rbx + rdx], rdi
cmp rdx, 0x10
jge 0x4ac1bd
ret
Function at 0x4adca0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [rsp + 8]
mov rax, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x20]
movups xmm1, xmmword [rax]
movups xmm0, xmmword [rbx]
add rax, 0x10
pxor xmm0, xmm1
sub rcx, 0xc
je 0x4adcdf
jb 0x4adcf4
movups xmm1, xmmword [rax]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesenc xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesenc xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x20]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x30]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x40]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x50]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x60]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x70]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x80]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x90]
aesenclast xmm0, xmm1
movups xmmword [rdx], xmm0
ret

Function at 0x4add60
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [rsp + 8]
mov rax, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x20]
movups xmm1, xmmword [rax]
movups xmm0, xmmword [rbx]
add rax, 0x10
pxor xmm0, xmm1
sub rcx, 0xc
je 0x4add9f
jb 0x4addb4
movups xmm1, xmmword [rax]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesdec xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesdec xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x20]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x30]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x40]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x50]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x60]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x70]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x80]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x90]
aesdeclast xmm0, xmm1
movups xmmword [rdx], xmm0
ret