joyce8/EMBER2024-capa huggingface dataset:
Function at 0x418d00
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x418f2a
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.004384e0
xorps xmm15, xmm15
mov r14, qword [0x007e5710]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x418d79
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x418da0
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov rax, rcx
call fcn.00454580
mov rbx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
sub rbx, rcx
mov rcx, rax
mov rax, qword [rsp + 0x68]
test rbx, rbx
jbe 0x418dc5
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x418dd9
cmp rbx, 0x1000
jae 0x418d83
nop dword [rax]
jmp 0x418e54
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop
cmp rbx, 0x1000
jae 0x418ded
xor esi, esi
jmp 0x418e4a
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.004384e0
xorps xmm15, xmm15
mov r14, qword [0x007e5710]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x418dcf
jmp 0x418db4
call fcn.0046aa80
xorps xmm15, xmm15
mov r14, qword [0x007e5710]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x418ecc
call fcn.0043cd20
lea rax, [0x005e3b83]
mov ebx, 0x19
call fcn.0043d620
mov rax, qword [rsp + 0x68]
call fcn.0043d320
lea rax, [0x005e3705]
mov ebx, 0x19
call fcn.0043d620
mov eax, dword [rsp + 0x34]
call fcn.0043d320
call fcn.0043cf80
call fcn.0043cda0
lea rax, [0x005e0154]
mov ebx, 0xd
call fcn.0043b500
cmp eax, 0x5af
je 0x418e77
call fcn.0043cd20
lea rax, [0x005e3b83]
mov ebx, 0x19
call fcn.0043d620
mov rax, qword [rsp + 0x38]
call fcn.0043d320
lea rax, [0x005e3705]
mov ebx, 0x19
nop
call fcn.0043d620
mov eax, dword [rsp + 0x34]
call fcn.0043d320
call fcn.0043cf80
call fcn.0043cda0
lea rax, [0x005e5654]
mov ebx, 0x1f
call fcn.0043b500
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00466e80
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00418d00
Function at 0x424180
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x42427e
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rbx
mov qword [rsp + 8], 0
jmp 0x4241c0
mov rax, qword [rsp + 0x50]
mov rcx, rdx
mov rbx, qword [rsp + 0x58]
nop
cmp qword [rsp + 8], rbx
jae 0x42426f
test byte [rax], al
lea rcx, [rax + 0x100b8]
mov rax, rcx
call fcn.00424ce0
nop dword [rax]
test rax, rax
je 0x42426f
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x30], xmm15
lea rcx, [0x004242c0]
mov qword [rsp + 0x10], rcx
lea rdx, [rsp + 8]
mov qword [rsp + 0x18], rdx
mov rdx, qword [rsp + 0x50]
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rbx
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x38], rax
lea rbx, [rsp + 0x10]
mov qword [rsp], rbx
call fcn.00466d40
xorps xmm15, xmm15
mov r14, qword [0x007e5710]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x60]
test rdx, rdx
jne 0x42425d
xor eax, eax
jmp 0x424267
mov rax, qword [rdx]
call rax
mov rdx, qword [rsp + 0x60]
test al, al
je 0x4241b2
mov rax, qword [rsp + 8]
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.00466e80
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.00424180

Function at 0x45efa0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45f059
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov qword [rsp + 0x70], rbx
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rdx, [0x0045f0a0]
mov qword [rsp + 0x10], rdx
lea rdx, [rsp + 8]
mov qword [rsp + 0x18], rdx
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x20], rdx
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x28], rdx
mov rdx, r14
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.00466d40
xorps xmm15, xmm15
mov r14, qword [0x007e5710]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00466e80
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.0045efa0
Function at 0x468f20
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x40308f
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
mov rax, rdx
nop
call fcn.00409cc0
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00466e80
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x403060
cmp byte [0x007e5535], 0
je 0x468f35
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp 0x465f80
jmp 0x403060

Function at 0x468f40
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x40a12f
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov qword [rsp + 0x28], rbx
call fcn.0040a220
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
mov rbx, qword [rsp + 0x28]
xor rbx, rax
xor rbx, qword [0x007e59a0]
movabs rdx, 0xa0761d6478bd642f
xor rbx, rdx
mov rax, rcx
call fcn.0040a200
mov rbx, rax
movabs rax, 0x1d8e4e27c47d124b
nop dword [rax]
call fcn.0040a200
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00466e80
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x40a0c0
cmp byte [0x007e5535], 0
je 0x468f75
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x007e5d20]
aesenc xmm0, xmmword [0x007e5d30]
aesenc xmm0, xmmword [0x007e5d40]
movq rax, xmm0
ret
jmp 0x40a0c0

Function at 0x468f80
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x40a1cf
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov qword [rsp + 0x28], rbx
call fcn.0040a260
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
mov rbx, qword [rsp + 0x28]
xor rbx, rax
xor rbx, qword [0x007e59a0]
movabs rdx, 0xa0761d6478bd642f
xor rbx, rdx
mov rax, rcx
call fcn.0040a200
mov rbx, rax
movabs rax, 0x1d8e4e27c47d1247
nop dword [rax]
call fcn.0040a200
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00466e80
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x40a160
cmp byte [0x007e5535], 0
je 0x468fb6
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x007e5d20]
aesenc xmm0, xmmword [0x007e5d30]
aesenc xmm0, xmmword [0x007e5d40]
movq rax, xmm0
ret
jmp 0x40a160

Function at 0x46aa00
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x30
mov rcx, 0xfffffffffffffff4
mov qword [rsp], rcx
mov rax, qword [sym.imp.kernel32.dll_GetStdHandle]
call rax
mov rcx, rax
mov qword [rsp], rcx
lea rdx, [0x007e5ca0]
mov qword [rsp + 8], rdx
lea r8d, [0x007e554c]
mov qword [rsp + 0x10], r8
lea r9, [rsp + 0x28]
mov qword [r9], 0
mov qword [rsp + 0x18], r9
mov qword [rsp + 0x20], 0
mov rax, qword [sym.imp.kernel32.dll_WriteFile]
call rax
call fcn.00468e60
add rsp, 0x30
ret
Function at 0x46af40
Capabilities:
Allocate thread local storage

Disassembly:
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x46af6c
call fcn.00468e60
shl rcx, 3
add rcx, 0x1480
mov qword [0x007e5710], rcx
ret
Function at 0x4995a0
Capabilities:
Access peb ldr_data

Disassembly:
lea r12, [rsp - 0x30]
cmp r12, qword [r14 + 0x10]
jbe 0x499796
sub rsp, 0xb0
mov qword [rsp + 0xa8], rbp
lea rbp, [rsp + 0xa8]
mov qword [rsp + 0xb8], rax
mov qword [rsp + 0xc0], rbx
mov qword [rsp + 0x60], 0
movups xmmword [rsp + 0x68], xmm15
movups xmmword [rsp + 0x40], xmm15
mov rax, qword [rsp + 0xb8]
mov rcx, qword [rsp + 0xc0]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov byte [rsp + 0x10], 0
call fcn.00402f20
xorps xmm15, xmm15
mov r14, qword [0x007e5710]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0x38], rax
cmp rax, 0xffffffffffffffff
jne 0x499632
jmp 0x49967d
mov qword [rsp + 0x60], 0
movups xmmword [rsp + 0x68], xmm15
lea rdx, [0x006cc100]
mov qword [rsp + 0x40], rdx
lea rsi, [0x006cb508]
mov qword [rsp + 0x48], rsi
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x70]
mov rax, qword [rsp + 0x60]
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
mov rcx, qword [rsp + 0xc0]
mov qword [rsp + 0x38], rcx
inc rcx
mov qword [rsp + 0x30], rcx
lea rax, [0x005bc940]
mov rbx, rcx
nop dword [rax]
call fcn.0044f400
mov rdx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x30]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], rdx
mov qword [rsp + 0x88], rsi
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x98], rdx
mov qword [rsp + 0xa0], rsi
mov rdx, qword [rsp + 0xc0]
mov rsi, qword [rsp + 0xb8]
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rdx
mov rsi, qword [rsp + 0x98]
mov qword [rsp + 0x28], rsi
cmp rsi, rdx
jg 0x49970a
jmp 0x499711
mov qword [rsp + 0x28], rdx
jmp 0x499713
jmp 0x499713
mov rdx, qword [rsp + 0x90]
nop dword [rax + rax]
cmp qword [rsp + 0x50], rdx
jne 0x499729
jmp 0x499747
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x20], rcx
mov rax, qword [rsp + 0x90]
mov rbx, qword [rsp + 0x50]
call fcn.00469ec0
jmp 0x499749
jmp 0x499749
mov rdx, qword [rsp + 0x78]
mov r8, qword [rsp + 0x80]
mov r9, qword [rsp + 0x88]
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x68], r8
mov qword [rsp + 0x70], r9
movups xmmword [rsp + 0x40], xmm15
mov rbx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x70]
mov rax, qword [rsp + 0x60]
xor edi, edi
xor esi, esi
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00466e80
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004995a0
Function at 0x499960
Capabilities:
Access peb ldr_data

Disassembly:
lea r12, [rsp - 0x30]
cmp r12, qword [r14 + 0x10]
jbe 0x499bba
sub rsp, 0xb0
mov qword [rsp + 0xa8], rbp
lea rbp, [rsp + 0xa8]
mov qword [rsp + 0xb8], rax
mov qword [rsp + 0xc0], rbx
mov qword [rsp + 0x60], 0
movups xmmword [rsp + 0x68], xmm15
movups xmmword [rsp + 0x40], xmm15
mov rax, qword [rsp + 0xb8]
mov rcx, qword [rsp + 0xc0]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov byte [rsp + 0x10], 0
call fcn.00402f20
xorps xmm15, xmm15
mov r14, qword [0x007e5710]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0x38], rax
cmp rax, 0xffffffffffffffff
jne 0x4999f2
jmp 0x499a3d
mov qword [rsp + 0x60], 0
movups xmmword [rsp + 0x68], xmm15
lea rdx, [0x006cc100]
mov qword [rsp + 0x40], rdx
lea rsi, [0x006cb508]
mov qword [rsp + 0x48], rsi
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x70]
mov rax, qword [rsp + 0x60]
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
mov rdx, qword [rsp + 0xc0]
mov qword [rsp + 0x38], rdx
lea rsi, [rdx + 1]
lea rcx, [rdx + rsi]
lea rax, [0x005bc880]
xor ebx, ebx
nop dword [rax + rax]
call fcn.0044f400
mov rdx, qword [rsp + 0x38]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 0
lea rsi, [rdx + 1]
add rdx, rsi
mov qword [rsp + 0x88], rdx
mov rdx, qword [rsp + 0xb8]
mov rsi, qword [rsp + 0xc0]
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x30], 0
jmp 0x499aaf
mov rdx, qword [rsp + 0x30]
cmp qword [rsp + 0x58], rdx
jg 0x499ac5
nop dword [rax + rax]
jmp 0x499b4e
mov rdx, qword [rsp + 0x30]
mov qword [rsp + 0x28], rdx
mov rdx, qword [rsp + 0x50]
add rdx, qword [rsp + 0x30]
movzx edx, byte [rdx]
mov dword [rsp + 0x24], edx
cmp edx, 0x80
jl 0x499aea
jmp 0x499af1
inc qword [rsp + 0x30]
jmp 0x499b10
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
call fcn.00462400
mov dword [rsp + 0x24], eax
mov qword [rsp + 0x30], rbx
jmp 0x499b10
mov edi, dword [rsp + 0x24]
mov dword [rsp + 0x20], edi
mov rax, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x88]
call fcn.004978a0
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x88], rcx
jmp 0x499b49
jmp 0x499aaf
mov rax, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x88]
xor edi, edi
call fcn.004978a0
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x98], rbx
mov qword [rsp + 0xa0], rcx
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rcx
movups xmmword [rsp + 0x40], xmm15
mov rbx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x70]
mov rax, qword [rsp + 0x60]
xor edi, edi
xor esi, esi
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00466e80
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00499960
Function at 0x4d5de0
Capabilities:
Access peb ldr_data

Disassembly:
lea r12, [rsp - 0x18]
cmp r12, qword [r14 + 0x10]
jbe 0x4d6046
sub rsp, 0x98
mov qword [rsp + 0x90], rbp
lea rbp, [rsp + 0x90]
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xa8], rbx
mov qword [rsp + 0xb0], rcx
mov qword [rsp + 0xb8], rdi
mov qword [rsp + 0xc0], rsi
mov qword [rsp + 0xc8], r8
mov qword [rsp + 0xd0], r9
mov rdx, qword [rsp + 0xb0]
mov rax, qword [rsp + 0xa0]
cmp r9, rdx
jbe 0x4d5e58
jmp 0x4d603b
jmp 0x4d5e5a
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], r9
mov qword [rsp + 0x88], rdx
mov rcx, qword [rsp + 0xa0]
mov rbx, qword [rsp + 0xa8]
mov rsi, qword [rsp + 0xb0]
mov rdi, qword [rsp + 0xb8]
mov r8, qword [rsp + 0xc0]
mov r10, qword [rsp + 0xc8]
mov qword [rsp], rax
mov qword [rsp + 8], r9
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x40], r10
call fcn.004e5ce0
xorps xmm15, xmm15
mov r14, qword [0x007e5710]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
test rax, rax
jne 0x4d5ef6
jmp 0x4d601a
mov rcx, qword [rsp + 0xd0]
sar rcx, 1
add rcx, qword [rsp + 0xd0]
mov qword [rsp + 0x58], rcx
mov rax, qword [rsp + 0xd0]
mov rdx, qword [rsp + 0xb0]
mov rbx, qword [rsp + 0xa0]
cmp rdx, rcx
jae 0x4d5f30
jmp 0x4d6036
cmp rax, rcx
jbe 0x4d5f3a
jmp 0x4d6031
sub rdx, rax
mov rsi, rdx
neg rdx
mov rdi, rax
shl rax, 3
sar rdx, 0x3f
and rax, rdx
lea rdx, [rbx + rax]
mov qword [rsp + 0x78], rdx
sub rcx, rdi
mov qword [rsp + 0x80], rcx
mov qword [rsp + 0x88], rsi
mov rax, qword [rsp + 0xd0]
mov rcx, qword [rsp + 0xa8]
mov rdx, qword [rsp + 0xa0]
mov rbx, qword [rsp + 0xb0]
jmp 0x4d5f8f
cmp rax, rcx
jbe 0x4d5f99
jmp 0x4d602c
sub rbx, rax
mov rsi, rbx
neg rbx
mov rdi, rax
shl rax, 3
sar rbx, 0x3f
and rax, rbx
add rax, rdx
mov qword [rsp + 0x60], rax
sub rcx, rdi
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], rsi
mov rdx, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x80]
mov r8, qword [rsp + 0x88]
mov qword [rsp], rbx
mov qword [rsp + 8], rdi
mov qword [rsp + 0x10], r8
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], rdx
call fcn.004e5e20
xorps xmm15, xmm15
mov r14, qword [0x007e5710]
mov r14, qword gs:[r14]
mov r14, qword [r14]
jmp 0x4d601c
jmp 0x4d601c
mov rbp, qword [rsp + 0x90]
add rsp, 0x98
ret
call fcn.004695a0
call fcn.004695a0
call fcn.00469560
mov rcx, r9
nop
call fcn.00469560
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
call fcn.00466e80
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
jmp fcn.004d5de0
Function at 0x4d60a0
Capabilities:
Access peb ldr_data

Disassembly:
lea r12, [rsp - 0x18]
cmp r12, qword [r14 + 0x10]
jbe 0x4d6306
sub rsp, 0x98
mov qword [rsp + 0x90], rbp
lea rbp, [rsp + 0x90]
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xa8], rbx
mov qword [rsp + 0xb0], rcx
mov qword [rsp + 0xb8], rdi
mov qword [rsp + 0xc0], rsi
mov qword [rsp + 0xc8], r8
mov qword [rsp + 0xd0], r9
mov rdx, qword [rsp + 0xb0]
mov rax, qword [rsp + 0xa0]
cmp r9, rdx
jbe 0x4d6118
jmp 0x4d62fb
jmp 0x4d611a
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], r9
mov qword [rsp + 0x88], rdx
mov rcx, qword [rsp + 0xa0]
mov rbx, qword [rsp + 0xa8]
mov rsi, qword [rsp + 0xb0]
mov rdi, qword [rsp + 0xb8]
mov r8, qword [rsp + 0xc0]
mov r10, qword [rsp + 0xc8]
mov qword [rsp], rax
mov qword [rsp + 8], r9
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x40], r10
call fcn.004e5d80
xorps xmm15, xmm15
mov r14, qword [0x007e5710]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
test rax, rax
jne 0x4d61b6
jmp 0x4d62da
mov rcx, qword [rsp + 0xd0]
sar rcx, 1
add rcx, qword [rsp + 0xd0]
mov qword [rsp + 0x58], rcx
mov rax, qword [rsp + 0xd0]
mov rdx, qword [rsp + 0xb0]
mov rbx, qword [rsp + 0xa0]
cmp rdx, rcx
jae 0x4d61f0
jmp 0x4d62f6
cmp rax, rcx
jbe 0x4d61fa
jmp 0x4d62f1
sub rdx, rax
mov rsi, rdx
neg rdx
mov rdi, rax
shl rax, 3
sar rdx, 0x3f
and rax, rdx
lea rdx, [rbx + rax]
mov qword [rsp + 0x78], rdx
sub rcx, rdi
mov qword [rsp + 0x80], rcx
mov qword [rsp + 0x88], rsi
mov rax, qword [rsp + 0xd0]
mov rcx, qword [rsp + 0xa8]
mov rdx, qword [rsp + 0xa0]
mov rbx, qword [rsp + 0xb0]
jmp 0x4d624f
cmp rax, rcx
jbe 0x4d6259
jmp 0x4d62ec
sub rbx, rax
mov rsi, rbx
neg rbx
mov rdi, rax
shl rax, 3
sar rbx, 0x3f
and rax, rbx
add rax, rdx
mov qword [rsp + 0x60], rax
sub rcx, rdi
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], rsi
mov rdx, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x80]
mov r8, qword [rsp + 0x88]
mov qword [rsp], rbx
mov qword [rsp + 8], rdi
mov qword [rsp + 0x10], r8
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], rdx
call fcn.004e5ec0
xorps xmm15, xmm15
mov r14, qword [0x007e5710]
mov r14, qword gs:[r14]
mov r14, qword [r14]
jmp 0x4d62dc
jmp 0x4d62dc
mov rbp, qword [rsp + 0x90]
add rsp, 0x98
ret
call fcn.004695a0
call fcn.004695a0
call fcn.00469560
mov rcx, r9
nop
call fcn.00469560
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
call fcn.00466e80
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
jmp fcn.004d60a0
Function at 0x4e6b40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4e6c4b
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x70], r8
mov qword [rsp + 0x18], 0
mov rdx, qword [rsp + 0x50]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rsi
cmp rsi, rdx
jne 0x4e6b95
jmp 0x4e6baa
mov qword [rsp + 0x18], 0
xor eax, eax
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov byte [rsp + 0x17], 0
mov qword [rsp + 0x20], 0
jmp 0x4e6bba
mov rdx, qword [rsp + 0x50]
mov qword [rsp + 0x28], rdx
cmp qword [rsp + 0x20], rdx
jl 0x4e6bcd
jmp 0x4e6c1e
movzx edx, byte [rsp + 0x17]
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x48]
cmp rax, rcx
jb 0x4e6be8
jmp 0x4e6c45
add rsi, rax
movzx esi, byte [rsi]
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x60]
nop dword [rax]
cmp rax, rcx
jb 0x4e6c07
jmp 0x4e6c40
add rdi, rax
movzx edi, byte [rdi]
xor esi, edi
or edx, esi
mov byte [rsp + 0x17], dl
jmp 0x4e6c17
inc qword [rsp + 0x20]
jmp 0x4e6bba
movzx eax, byte [rsp + 0x17]
xor ebx, ebx
call fcn.004e6ca0
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x18], rax
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
call fcn.004694e0
call fcn.004694e0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
call fcn.00466e80
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
jmp fcn.004e6b40
Function at 0x550f80
Capabilities:
Access peb ldr_data

Disassembly:
lea r12, [rsp - 0x20]
cmp r12, qword [r14 + 0x10]
jbe 0x5510a5
sub rsp, 0xa0
mov qword [rsp + 0x98], rbp
lea rbp, [rsp + 0x98]
mov qword [rsp + 0xa8], rax
mov qword [rsp + 0xb0], rbx
movups xmmword [rsp + 0x78], xmm15
movups xmmword [rsp + 0x40], xmm15
movups xmmword [rsp + 0x50], xmm15
lea rax, [rsp + 0x40]
mov qword [rsp + 0x70], rax
mov rbx, qword [rsp + 0xa8]
call fcn.00550d20
mov qword [rsp + 0x60], rax
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x30], xmm15
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x68], rcx
mov rdx, qword [rsp + 0xb0]
mov qword [rsp], rcx
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], 1
call fcn.0055d6c0
xorps xmm15, xmm15
mov r14, qword [0x007e5710]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rbx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x68]
call fcn.00552920
mov qword [rsp + 0x18], rax
nop
cmp rax, 1
jne 0x551048
jmp 0x55108b
lea rax, [0x005e2e09]
mov ebx, 0x17
call fcn.0046fae0
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], rbx
mov rax, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x98]
add rsp, 0xa0
ret
movups xmmword [rsp + 0x78], xmm15
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x98]
add rsp, 0xa0
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00466e80
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.00550f80