joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e5200
Capabilities:
Encode data using xor

Disassembly:
xor r10, r10
xor r11, r11
xor r12, r12
cmp r9, 0xd
jne 0x4e52a7
mov r10, qword [rcx]
mov r11, qword [rcx + 5]
shr r11, 0x18
mov r12, 1
mov rax, qword [rbp]
mov r15, rax
mul r10
mov r13, rax
mov r14, rdx
mov rax, qword [rbp]
mul r11
imul r15, r12
add r14, rax
adc r15, rdx
mov rax, qword [rbp + 8]
mov r8, rax
mul r10
add r14, rax
adc rdx, 0
mov r10, rdx
mov rax, qword [rbp + 8]
mul r11
add r15, rax
adc rdx, 0
imul r8, r12
add r15, r10
adc r8, rdx
mov r10, r13
mov r11, r14
mov r12, r15
and r12, 3
mov r13, r15
and r13, 0xfffffffffffffffc
mov r14, r8
shrd r15, r8, 2
shr r8, 2
add r10, r13
adc r11, r14
adc r12, 0
add r10, r15
adc r11, r8
adc r12, 0
ret
cmp r9, 0x10
jb 0x4e534a
add r10, qword [rcx]
adc r11, qword [rcx + 8]
adc r12, 1
lea rcx, [rcx + 0x10]
sub r9, 0x10
mov rax, qword [rbp]
mov r15, rax
mul r10
mov r13, rax
mov r14, rdx
mov rax, qword [rbp]
mul r11
imul r15, r12
add r14, rax
adc r15, rdx
mov rax, qword [rbp + 8]
mov r8, rax
mul r10
add r14, rax
adc rdx, 0
mov r10, rdx
mov rax, qword [rbp + 8]
mul r11
add r15, rax
adc rdx, 0
imul r8, r12
add r15, r10
adc r8, rdx
mov r10, r13
mov r11, r14
mov r12, r15
and r12, 3
mov r13, r15
and r13, 0xfffffffffffffffc
mov r14, r8
shrd r15, r8, 2
shr r8, 2
add r10, r13
adc r11, r14
adc r12, 0
add r10, r15
adc r11, r8
adc r12, 0
jmp 0x4e52a7
cmp r9, 0
je 0x4e5403
xor r13, r13
xor r14, r14
xor r15, r15
add rcx, r9
shld r14, r13, 8
shl r13, 8
mov r15b, byte [rcx - 1]
xor r13, r15
dec rcx
dec r9
jne 0x4e5360
add r10, r13
adc r11, r14
adc r12, 1
mov rax, qword [rbp]
mov r15, rax
mul r10
mov r13, rax
mov r14, rdx
mov rax, qword [rbp]
mul r11
imul r15, r12
add r14, rax
adc r15, rdx
mov rax, qword [rbp + 8]
mov r8, rax
mul r10
add r14, rax
adc rdx, 0
mov r10, rdx
mov rax, qword [rbp + 8]
mul r11
add r15, rax
adc rdx, 0
imul r8, r12
add r15, r10
adc r8, rdx
mov r10, r13
mov r11, r14
mov r12, r15
and r12, 3
mov r13, r15
and r13, 0xfffffffffffffffc
mov r14, r8
shrd r15, r8, 2
shr r8, 2
add r10, r13
adc r11, r14
adc r12, 0
add r10, r15
adc r11, r8
adc r12, 0
ret
Function at 0x4ef6a0
Capabilities:
Hash data using sha512

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ef7f4
push rbp
mov rbp, rsp
sub rsp, 0x28
mov qword [rsp + 0x40], rbx
lea rdx, [rax - 1]
nop dword [rax + rax]
cmp rdx, 0x3f
ja 0x4ef7de
cmp rcx, 0x40
jg 0x4ef7c8
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x38], rax
lea rax, [0x0052eae0]
call fcn.0040d180
mov rcx, qword [rsp + 0x38]
mov qword [rax + 0x50], rcx
mov rcx, qword [rsp + 0x48]
mov qword [rax + 0x160], rcx
lea rsi, [rax + 0xe0]
mov rbx, qword [rsp + 0x40]
cmp rbx, rsi
je 0x4ef731
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x20], rsi
mov rax, rsi
call fcn.004660c0
mov rax, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
movups xmm0, xmmword [0x0061daa0]
nop
movups xmmword [rax], xmm0
movups xmm0, xmmword [0x0061dab0]
movups xmmword [rax + 0x10], xmm0
movups xmm0, xmmword [0x0061dac0]
movups xmmword [rax + 0x20], xmm0
movups xmm0, xmmword [0x0061dad0]
movups xmmword [rax + 0x30], xmm0
mov rdx, qword [rax + 0x160]
shl rdx, 8
or rdx, qword [rax + 0x50]
or rdx, 0x1010000
xor qword [rax], rdx
mov qword [rax + 0xd8], 0
movups xmmword [rax + 0x40], xmm15
cmp qword [rax + 0x160], 0
jle 0x4ef7be
lea rdi, [rax + 0x58]
nop word [rax + rax]
nop dword [rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00465d30
mov rbp, qword [rbp]
mov qword [rax + 0xd8], pe_nt_image_headers64
xor ebx, ebx
xor ecx, ecx
add rsp, 0x28
pop rbp
ret
mov rbx, qword [0x00623750]
mov rcx, qword [0x00623758]
xor eax, eax
add rsp, 0x28
pop rbp
ret
mov rbx, qword [0x00623760]
mov rcx, qword [0x00623768]
xor eax, eax
add rsp, 0x28
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.004ef6a0
Function at 0x4ef840
Capabilities:
Encode data using base64
Hash data using sha512

Disassembly:
lea r12, [rsp - 0xa0]
cmp r12, qword [r14 + 0x10]
jbe 0x4efad1
push rbp
mov rbp, rsp
sub rsp, 0x118
mov qword [rsp + 0x138], rcx
mov qword [rsp + 0x128], rax
mov qword [rsp + 0x130], rbx
movups xmm0, xmmword [0x0061daa0]
movups xmmword [rsp + 0x58], xmm0
movups xmm0, xmmword [0x0061dab0]
movups xmmword [rsp + 0x68], xmm0
movups xmm0, xmmword [0x0061dac0]
movups xmmword [rsp + 0x78], xmm0
movups xmm0, xmmword [0x0061dad0]
movups xmmword [rsp + 0x88], xmm0
mov r9, rbx
or rbx, 0x1010000
xor qword [rsp + 0x58], rbx
movups xmmword [rsp + 0x48], xmm15
nop dword [rax]
cmp rdi, 0x80
jle 0x4ef969
mov r10, rdi
and rdi, 0xffffffffffffff80
lea r11, [rdi - 0x80]
cmp r10, rdi
cmove rdi, r11
nop
cmp rsi, rdi
jb 0x4efac5
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x148], rsi
mov qword [rsp + 0x40], r10
mov qword [rsp + 0x138], rcx
lea rax, [rsp + 0x58]
lea rbx, [rsp + 0x48]
mov r8, rsi
mov rsi, rdi
mov rdi, rcx
xor ecx, ecx
call fcn.004efe20
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x38]
cmp rcx, rax
jb 0x4efabd
mov rdx, qword [rsp + 0x148]
mov r9, rax
sub rax, rdx
sar rax, 0x3f
and rax, r9
sub rcx, r9
mov rdx, qword [rsp + 0x138]
add rdx, rax
mov rax, qword [rsp + 0x128]
mov r9, qword [rsp + 0x130]
mov rdi, rcx
mov rcx, rdx
mov rdx, rdi
lea rdi, [rsp + 0x98]
nop word [rax + rax]
nop dword [rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.004659e2
mov rbp, qword [rbp]
cmp rdx, 0x80
mov r8d, pe_nt_image_headers64
cmovl r8, rdx
lea rdi, [rsp + 0x98]
cmp rcx, rdi
je 0x4ef9e2
mov qword [rsp + 0x30], r8
mov rax, rdi
mov rbx, rcx
mov rcx, r8
nop
call fcn.004660c0
mov rax, qword [rsp + 0x128]
lea rdi, [rsp + 0x98]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x130]
lea rdx, [r8 - 0x80]
neg rdx
cmp qword [rsp + 0x48], rdx
jae 0x4ef9f5
dec qword [rsp + 0x50]
mov rdx, qword [rsp + 0x48]
lea rdx, [r8 + rdx]
lea rdx, [rdx - 0x80]
mov qword [rsp + 0x48], rdx
lea rax, [rsp + 0x58]
lea rbx, [rsp + 0x48]
mov rcx, 0xffffffffffffffff
mov esi, pe_nt_image_headers64
mov r8, rsi
call fcn.004efe20
mov rdx, qword [rsp + 0x130]
lea r9, [rdx + 7]
sar r9, 0x3f
shr r9, 0x3d
lea rcx, [r9 + rdx]
lea rcx, [rcx + 7]
sar rcx, 3
cmp rcx, 8
ja 0x4efab3
mov rdx, qword [rsp + 0x128]
xor eax, eax
jmp 0x4efa63
mov rsi, qword [rsp + rax*8 + 0x58]
mov qword [rdx + rbx], rsi
inc rax
cmp rax, rcx
jge 0x4efa90
test byte [rdx], al
mov rbx, rax
shl rbx, 3
cmp rbx, 0x40
ja 0x4efaa6
lea rsi, [rbx - 0x40]
mov rdi, rsi
neg rsi
sar rdi, 0x3f
and rbx, rdi
cmp rsi, 7
ja 0x4efa57
jmp 0x4efa99
add rsp, 0x118
pop rbp
ret
mov eax, 7
mov rcx, rsi
call fcn.004656e0
mov rax, rbx
mov ecx, 0x40
call fcn.004657a0
mov edx, 8
call fcn.00465720
nop dword [rax]
call fcn.004657a0
mov rcx, rdi
mov rdx, rsi
call fcn.00465760
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
jmp fcn.004ef840
Function at 0x4f8bc0
Capabilities:
Access peb ldr_data

Disassembly:
lea r12, [rsp - 0x10]
cmp r12, qword [r14 + 0x10]
jbe 0x4f8da5
push rbp
mov rbp, rsp
sub rsp, 0x88
mov qword [rsp + 0x98], rax
mov rbx, qword [rax + 0x18]
test rbx, rbx
je 0x4f8cda
mov rdx, qword [rax + 0x10]
mov rcx, qword [rax + 0x20]
mov rax, rdx
call fcn.004cd3a0
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x60], rbx
mov rdx, qword [rsp + 0x98]
mov rdx, qword [rdx + 0x28]
mov rax, rdx
mov ebx, 0xa
call fcn.00473780
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x50], rbx
mov rdx, qword [rsp + 0x80]
mov qword [rsp], rdx
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 8], rsi
mov byte [rsp + 0x10], 0x3a
call fcn.00403900
xorps xmm15, xmm15
mov r14, qword [0x0067e250]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x4f8ca7
xor eax, eax
lea rbx, [0x00539c9b]
mov ecx, 1
mov rdi, qword [rsp + 0x80]
mov rsi, qword [rsp + 0x60]
lea r8, [0x00539cb0]
mov r9d, 2
mov r10, qword [rsp + 0x70]
mov r11, qword [rsp + 0x50]
nop dword [rax + rax]
call fcn.0044ee00
jmp 0x4f8cd1
xor eax, eax
mov rbx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x60]
lea rdi, [0x005682f0]
mov esi, 1
mov r8, qword [rsp + 0x70]
mov r9, qword [rsp + 0x50]
call fcn.0044ed40
add rsp, 0x88
pop rbp
ret
mov rcx, qword [rax + 0x28]
mov ebx, 0xa
mov rax, rcx
call fcn.00473780
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x48], rbx
mov rcx, qword [rsp + 0x98]
mov rdx, qword [rcx]
mov qword [rsp + 0x78], rdx
mov rcx, qword [rcx + 8]
mov qword [rsp + 0x58], rcx
mov qword [rsp], rdx
mov qword [rsp + 8], rcx
mov byte [rsp + 0x10], 0x3a
nop dword [rax]
call fcn.00403900
xorps xmm15, xmm15
mov r14, qword [0x0067e250]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x4f8d75
xor eax, eax
lea rbx, [0x00539c9b]
mov ecx, 1
mov rdi, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x58]
lea r8, [0x00539cb0]
mov r9d, 2
mov r10, qword [rsp + 0x68]
mov r11, qword [rsp + 0x48]
call fcn.0044ee00
jmp 0x4f8d9c
xor eax, eax
mov rbx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
lea rdi, [0x005682f0]
mov esi, 1
mov r8, qword [rsp + 0x68]
mov r9, qword [rsp + 0x48]
call fcn.0044ed40
add rsp, 0x88
pop rbp
ret
mov qword [rsp + 8], rax
call fcn.00463440
mov rax, qword [rsp + 8]
jmp fcn.004f8bc0
Function at 0x140004000
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
cld
and rsp, 0xfffffffffffffff0
call fcn.1400040d6
push r9
push r8
push rdx
xor rdx, rdx
push rcx
mov rdx, qword gs:[rdx + 0x60]
mov rdx, qword [rdx + 0x18]
mov rdx, qword [rdx + 0x20]
push rsi
mov rsi, qword [rdx + 0x50]
xor r9, r9
movzx rcx, word [rdx + 0x4a]
xor rax, rax
lodsb al, byte [rsi]
cmp al, 0x61
jl 0x140004037
sub al, 0x20
ror r9d, 0xd
add r9d, eax
loop 0x14000402d
push rdx
push r9
mov rdx, qword [rdx + 0x20]
mov eax, dword [rdx + 0x3c]
add rax, rdx
cmp word [rax + 0x18], 0x20b
jne 0x1400040cb
mov eax, dword [rax + 0x88]
test rax, rax
je 0x1400040cb
add rax, rdx
mov ecx, dword [rax + 0x18]
push rax
mov r8d, dword [rax + 0x20]
add r8, rdx
jrcxz 0x1400040ca
xor r9, r9
dec rcx
mov esi, dword [r8 + rcx*4]
add rsi, rdx
xor rax, rax
lodsb al, byte [rsi]
ror r9d, 0xd
add r9d, eax
cmp al, ah
jne 0x140004081
add r9, qword [rsp + 8]
cmp r9d, r10d
jne 0x140004072
pop rax
mov r8d, dword [rax + 0x24]
add r8, rdx
mov cx, word [r8 + rcx*2]
mov r8d, dword [rax + 0x1c]
add r8, rdx
mov eax, dword [r8 + rcx*4]
add rax, rdx
pop r8
pop r8
pop rsi
pop rcx
pop rdx
pop r8
pop r9
pop r10
sub rsp, 0x20
push r10
jmp rax
pop rax
pop r9
pop rdx
mov rdx, qword [rdx]
jmp 0x140004021
Function at 0x419fe0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41a186
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00439900
xorps xmm15, xmm15
mov r14, qword [0x007aa458]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x41a04b
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x41a067
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
call fcn.00454200
mov rbx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x38]
sub rbx, rcx
test rbx, rbx
jbe 0x41a08b
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x41a09f
cmp rbx, 0x1000
jae 0x41a055
jmp 0x41a109
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x41a0b1
xor edx, edx
jmp 0x41a100
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00439900
xorps xmm15, xmm15
mov r14, qword [0x007aa458]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x41a095
jmp 0x41a080
call fcn.0046aca0
xorps xmm15, xmm15
mov r14, qword [0x007aa458]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.0043e140
lea rax, [0x005a543d]
mov ebx, 0x18
call fcn.0043ea40
mov rax, qword [rsp + 0x38]
call fcn.0043e740
lea rax, [0x005a552d]
mov ebx, 0x19
call fcn.0043ea40
mov rax, qword [rsp + 0x30]
nop
call fcn.0043e740
call fcn.0043e3a0
call fcn.0043e1c0
lea rax, [0x005a80da]
mov ebx, 0x21
nop dword [rax + rax]
call fcn.0043c920
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004670c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.00419fe0
Function at 0x41a1c0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41a3ea
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.004399a0
xorps xmm15, xmm15
mov r14, qword [0x007aa458]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x41a239
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x41a260
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov rax, rcx
call fcn.00454200
mov rbx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
sub rbx, rcx
mov rcx, rax
mov rax, qword [rsp + 0x68]
test rbx, rbx
jbe 0x41a285
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x41a299
cmp rbx, 0x1000
jae 0x41a243
nop dword [rax]
jmp 0x41a314
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop
cmp rbx, 0x1000
jae 0x41a2ad
xor esi, esi
jmp 0x41a30a
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.004399a0
xorps xmm15, xmm15
mov r14, qword [0x007aa458]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x41a28f
jmp 0x41a274
call fcn.0046aca0
xorps xmm15, xmm15
mov r14, qword [0x007aa458]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x41a38c
call fcn.0043e140
lea rax, [0x005a5a0f]
mov ebx, 0x19
call fcn.0043ea40
mov rax, qword [rsp + 0x68]
call fcn.0043e740
lea rax, [0x005a552d]
mov ebx, 0x19
call fcn.0043ea40
mov eax, dword [rsp + 0x34]
call fcn.0043e740
call fcn.0043e3a0
call fcn.0043e1c0
lea rax, [0x005a1848]
mov ebx, 0xd
call fcn.0043c920
cmp eax, 0x5af
je 0x41a337
call fcn.0043e140
lea rax, [0x005a5a0f]
mov ebx, 0x19
call fcn.0043ea40
mov rax, qword [rsp + 0x38]
call fcn.0043e740
lea rax, [0x005a552d]
mov ebx, 0x19
nop
call fcn.0043ea40
mov eax, dword [rsp + 0x34]
call fcn.0043e740
call fcn.0043e3a0
call fcn.0043e1c0
lea rax, [0x005a7769]
mov ebx, 0x1f
call fcn.0043c920
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004670c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0041a1c0
Function at 0x425640
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x42573e
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rbx
mov qword [rsp + 8], 0
jmp 0x425680
mov rax, qword [rsp + 0x50]
mov rcx, rdx
mov rbx, qword [rsp + 0x58]
nop
cmp qword [rsp + 8], rbx
jae 0x42572f
test byte [rax], al
lea rcx, [rax + 0x100b8]
mov rax, rcx
call fcn.004261a0
nop dword [rax]
test rax, rax
je 0x42572f
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x30], xmm15
lea rcx, [0x00425780]
mov qword [rsp + 0x10], rcx
lea rdx, [rsp + 8]
mov qword [rsp + 0x18], rdx
mov rdx, qword [rsp + 0x50]
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rbx
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x38], rax
lea rbx, [rsp + 0x10]
mov qword [rsp], rbx
call fcn.00466f80
xorps xmm15, xmm15
mov r14, qword [0x007aa458]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x60]
test rdx, rdx
jne 0x42571d
xor eax, eax
jmp 0x425727
mov rax, qword [rdx]
call rax
mov rdx, qword [rsp + 0x60]
test al, al
je 0x425672
mov rax, qword [rsp + 8]
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.004670c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.00425640

Function at 0x45ef20
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45efd9
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov qword [rsp + 0x70], rbx
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rdx, [0x0045f020]
mov qword [rsp + 0x10], rdx
lea rdx, [rsp + 8]
mov qword [rsp + 0x18], rdx
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x20], rdx
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x28], rdx
mov rdx, r14
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.00466f80
xorps xmm15, xmm15
mov r14, qword [0x007aa458]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.004670c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.0045ef20
Function at 0x469160
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x403cef
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
mov rax, rdx
nop
call fcn.0040a9e0
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004670c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x403cc0
cmp byte [0x007aa275], 0
je 0x469175
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp 0x4661c0
jmp 0x403cc0

Function at 0x469180
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x40ae4f
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov qword [rsp + 0x28], rbx
call fcn.0040af40
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
mov rbx, qword [rsp + 0x28]
xor rbx, rax
xor rbx, qword [0x007aa600]
movabs rdx, 0xa0761d6478bd642f
xor rbx, rdx
mov rax, rcx
call fcn.0040af20
mov rbx, rax
movabs rax, 0x1d8e4e27c47d124b
nop dword [rax]
call fcn.0040af20
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004670c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x40ade0
cmp byte [0x007aa275], 0
je 0x4691b5
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x007aa980]
aesenc xmm0, xmmword [0x007aa990]
aesenc xmm0, xmmword [0x007aa9a0]
movq rax, xmm0
ret
jmp 0x40ade0

Function at 0x4691c0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x40aeef
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov qword [rsp + 0x28], rbx
call fcn.0040af80
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
mov rbx, qword [rsp + 0x28]
xor rbx, rax
xor rbx, qword [0x007aa600]
movabs rdx, 0xa0761d6478bd642f
xor rbx, rdx
mov rax, rcx
call fcn.0040af20
mov rbx, rax
movabs rax, 0x1d8e4e27c47d1247
nop dword [rax]
call fcn.0040af20
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004670c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x40ae80
cmp byte [0x007aa275], 0
je 0x4691f6
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x007aa980]
aesenc xmm0, xmmword [0x007aa990]
aesenc xmm0, xmmword [0x007aa9a0]
movq rax, xmm0
ret
jmp 0x40ae80

Function at 0x46ac20
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x30
mov rcx, 0xfffffffffffffff4
mov qword [rsp], rcx
mov rax, qword [sym.imp.kernel32.dll_GetStdHandle]
call rax
mov rcx, rax
mov qword [rsp], rcx
lea rdx, [0x007aa900]
mov qword [rsp + 8], rdx
lea r8d, [0x007aa290]
mov qword [rsp + 0x10], r8
lea r9, [rsp + 0x28]
mov qword [r9], 0
mov qword [rsp + 0x18], r9
mov qword [rsp + 0x20], 0
mov rax, qword [sym.imp.kernel32.dll_WriteFile]
call rax
call fcn.004690a0
add rsp, 0x30
ret
Function at 0x46b160
Capabilities:
Allocate thread local storage

Disassembly:
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x46b18c
call fcn.004690a0
shl rcx, 3
add rcx, 0x1480
mov qword [0x007aa458], rcx
ret
Function at 0x4a0740
Capabilities:
Access peb ldr_data

Disassembly:
lea r12, [rsp - 0x30]
cmp r12, qword [r14 + 0x10]
jbe 0x4a0936
sub rsp, 0xb0
mov qword [rsp + 0xa8], rbp
lea rbp, [rsp + 0xa8]
mov qword [rsp + 0xb8], rax
mov qword [rsp + 0xc0], rbx
mov qword [rsp + 0x60], 0
movups xmmword [rsp + 0x68], xmm15
movups xmmword [rsp + 0x40], xmm15
mov rax, qword [rsp + 0xb8]
mov rcx, qword [rsp + 0xc0]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov byte [rsp + 0x10], 0
call fcn.00403ae0
xorps xmm15, xmm15
mov r14, qword [0x007aa458]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0x38], rax
cmp rax, 0xffffffffffffffff
jne 0x4a07d2
jmp 0x4a081d
mov qword [rsp + 0x60], 0
movups xmmword [rsp + 0x68], xmm15
lea rdx, [0x0068fba0]
mov qword [rsp + 0x40], rdx
lea rsi, [0x0068ef18]
mov qword [rsp + 0x48], rsi
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x70]
mov rax, qword [rsp + 0x60]
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
mov rcx, qword [rsp + 0xc0]
mov qword [rsp + 0x38], rcx
inc rcx
mov qword [rsp + 0x30], rcx
lea rax, [0x0057b800]
mov rbx, rcx
nop dword [rax]
call fcn.0044f080
mov rdx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x30]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], rdx
mov qword [rsp + 0x88], rsi
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x98], rdx
mov qword [rsp + 0xa0], rsi
mov rdx, qword [rsp + 0xc0]
mov rsi, qword [rsp + 0xb8]
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rdx
mov rsi, qword [rsp + 0x98]
mov qword [rsp + 0x28], rsi
cmp rsi, rdx
jg 0x4a08aa
jmp 0x4a08b1
mov qword [rsp + 0x28], rdx
jmp 0x4a08b3
jmp 0x4a08b3
mov rdx, qword [rsp + 0x90]
nop dword [rax + rax]
cmp qword [rsp + 0x50], rdx
jne 0x4a08c9
jmp 0x4a08e7
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x20], rcx
mov rax, qword [rsp + 0x90]
mov rbx, qword [rsp + 0x50]
call fcn.0046a0e0
jmp 0x4a08e9
jmp 0x4a08e9
mov rdx, qword [rsp + 0x78]
mov r8, qword [rsp + 0x80]
mov r9, qword [rsp + 0x88]
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x68], r8
mov qword [rsp + 0x70], r9
movups xmmword [rsp + 0x40], xmm15
mov rbx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x70]
mov rax, qword [rsp + 0x60]
xor edi, edi
xor esi, esi
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004670c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004a0740