joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4155a0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41572b
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00432e00
xorps xmm15, xmm15
mov r14, qword [0x005f8e78]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x415605
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x415614
add rsp, 0x48
pop rbp
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x415633
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x415643
cmp rbx, 0x1000
jae 0x41560b
jmp 0x4156ad
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x415655
xor edx, edx
jmp 0x4156a4
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00432e00
xorps xmm15, xmm15
mov r14, qword [0x005f8e78]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x415639
jmp 0x415628
call fcn.00465320
xorps xmm15, xmm15
mov r14, qword [0x005f8e78]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.004373e0
lea rax, [0x004d65f5]
mov ebx, 0x18
nop dword [rax]
call fcn.00437c60
mov rax, qword [rsp + 0x38]
call fcn.004379a0
lea rax, [0x004d6a7c]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.00437c60
mov rax, qword [rsp + 0x30]
call fcn.004379a0
call fcn.00437620
call fcn.00437440
lea rax, [0x004d8d74]
mov ebx, 0x21
call fcn.00435a40
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00461c40
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004155a0
Function at 0x415760
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x415986
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.00432e80
xorps xmm15, xmm15
mov r14, qword [0x005f8e78]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x4157d3
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x4157e2
add rsp, 0x50
pop rbp
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x415805
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x415815
cmp rbx, 0x1000
jae 0x4157d9
nop
jmp 0x415898
add rsp, 0x50
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop word [rax + rax]
cmp rbx, 0x1000
jae 0x41582d
xor esi, esi
jmp 0x41588a
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.00432e80
xorps xmm15, xmm15
mov r14, qword [0x005f8e78]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x41580b
jmp 0x4157f6
call fcn.00465320
xorps xmm15, xmm15
mov r14, qword [0x005f8e78]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x415920
nop dword [rax + rax]
call fcn.004373e0
lea rax, [0x004d6a95]
mov ebx, 0x19
call fcn.00437c60
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
call fcn.004379a0
lea rax, [0x004d6a7c]
mov ebx, 0x19
call fcn.00437c60
mov eax, dword [rsp + 0x34]
call fcn.004379a0
nop
call fcn.00437620
call fcn.00437440
lea rax, [0x004d3640]
mov ebx, 0xd
call fcn.00435a40
nop dword [rax + rax]
cmp eax, 0x5af
je 0x4158c0
call fcn.004373e0
lea rax, [0x004d6a95]
mov ebx, 0x19
call fcn.00437c60
mov rax, qword [rsp + 0x38]
call fcn.004379a0
lea rax, [0x004d6a7c]
mov ebx, 0x19
call fcn.00437c60
mov eax, dword [rsp + 0x34]
nop dword [rax]
call fcn.004379a0
call fcn.00437620
call fcn.00437440
lea rax, [0x004d85d8]
mov ebx, 0x1f
nop dword [rax + rax]
call fcn.00435a40
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00461c40
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.00415760
Function at 0x41ee60
Capabilities:
Hash data using murmur3

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
cmp byte [0x005f8c52], 0
jne 0x41ef47
sub rbx, qword [rax + 0x18]
mov rdx, qword [rax + 0x50]
test byte [rdx], al
mov esi, dword [rax + 0x64]
imul rbx, rsi
mov rsi, rbx
shr rbx, 0x20
shr rsi, 0x23
and ebx, 7
mov rdi, rcx
mov rcx, rbx
mov r8d, 1
shl r8d, cl
add rdx, rsi
nop
nop
nop
nop
lock or byte [rdx], r8b
mov rcx, qword [rax + 0x18]
movabs rdx, 0x800000000000
lea rax, [rdx + rcx]
mov rdx, rax
shr rdx, 0x2a
nop
nop
nop
cmp rdx, 0x40
jae 0x41ef3a
lea rbx, [0x005cb038]
mov rdx, qword [rbx + rdx*8]
test byte [rdx], al
mov rbx, rcx
shr rbx, 0x10
and ebx, 0x3f
shr rcx, 0xd
and ecx, 7
mov esi, 1
shl esi, cl
shr rax, 0x16
and eax, 0xfffff
mov rax, qword [rdx + rax*8]
test byte [rax], al
movzx edx, byte [rax + rbx + 0x11440]
lea rax, [rax + rbx]
lea rax, [rax + 0x11440]
test sil, dl
jne 0x41ef20
lock or byte [rax], sil
mov rax, qword [r14 + 0x30]
mov rax, qword [rax + 0xa0]
test byte [rax], al
add qword [rax + 0x1250], rdi
add rsp, 0x10
pop rbp
ret
mov rax, rdx
mov ecx, 0x40
call fcn.00463ee0
lea rax, [0x004dace5]
mov ebx, 0x2c
call fcn.00435a40
nop
int3

Function at 0x421220
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x421326
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x70], rcx
mov byte [rsp + 0x17], dil
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x18], 0
jmp 0x421263
mov rax, qword [rsp + 0x60]
mov rcx, rdx
mov rbx, qword [rsp + 0x68]
movzx edi, byte [rsp + 0x17]
cmp qword [rsp + 0x18], rbx
jae 0x42131b
test byte [rax], al
lea rcx, [rax + 0x100b8]
mov ebx, edi
mov rax, rcx
nop dword [rax]
call fcn.00422000
test rax, rax
je 0x42131b
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x30], xmm15
movups xmmword [rsp + 0x40], xmm15
lea rcx, [0x00421360]
mov qword [rsp + 0x20], rcx
lea rdx, [rsp + 0x18]
mov qword [rsp + 0x28], rdx
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x48], rax
lea rbx, [rsp + 0x20]
mov qword [rsp], rbx
nop dword [rax]
call fcn.00461b00
xorps xmm15, xmm15
mov r14, qword [0x005f8e78]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x70]
nop dword [rax]
test rdx, rdx
jne 0x421309
xor eax, eax
jmp 0x421313
mov rax, qword [rdx]
call rax
mov rdx, qword [rsp + 0x70]
test al, al
je 0x421251
mov rax, qword [rsp + 0x18]
add rsp, 0x50
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov byte [rsp + 0x20], dil
call fcn.00461c40
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movzx edi, byte [rsp + 0x20]
jmp fcn.00421220
Function at 0x42dae0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x42dbf0
push rbp
mov rbp, rsp
sub rsp, 0x58
mov qword [rsp + 0x68], rax
mov byte [rsp + 0x80], dil
nop
test dil, dil
je 0x42db35
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x78], rcx
mov eax, 6
call fcn.0043a820
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
movzx edi, byte [rsp + 0x80]
mov qword [rsp + 8], 0
nop
test rbx, rbx
jne 0x42db4d
test dil, dil
jmp 0x42dbdb
lea rdx, [rsp + 0x68]
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rsi, [0x0042dc40]
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x18], rax
mov rax, r14
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rdx
mov byte [rsp + 0x48], dil
lea rax, [rsp + 8]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.00461b00
xorps xmm15, xmm15
mov r14, qword [0x005f8e78]
mov r14, qword gs:[r14]
mov r14, qword [r14]
movzx eax, byte [rsp + 0x80]
test al, al
je 0x42dbe5
nop dword [rax]
call fcn.0043a9a0
mov rax, qword [rsp + 8]
add rsp, 0x58
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov byte [rsp + 0x20], dil
call fcn.00461c40
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movzx edi, byte [rsp + 0x20]
nop dword [rax]
jmp fcn.0042dae0
Function at 0x42f580
Capabilities:
Hash data using murmur3

Disassembly:
cmp rsp, qword [r14 + 0x18]
jbe 0x42f806
push rbp
mov rbp, rsp
sub rsp, 0x38
test byte [rax], al
mov rcx, qword [rax + 0x1268]
lea rsi, [rax + 0x1278]
sub rcx, rsi
shr rcx, 3
cmp rcx, 0x200
ja 0x42f7fa
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x30], rcx
mov qword [rax + 0x1268], 0
cmp byte [0x005f8c52], 0
jne 0x42f5da
xor edx, edx
xor ebx, ebx
jmp 0x42f620
xor edx, edx
jmp 0x42f605
mov qword [rsp + 0x28], rdx
mov rcx, qword [rax + rdx*8 + 0x1278]
mov rax, rcx
call fcn.0041e6c0
mov rdx, qword [rsp + 0x28]
inc rdx
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
cmp rdx, rcx
jl 0x42f5de
add rax, 0x1268
call fcn.0042f500
add rsp, 0x38
pop rbp
ret
inc rdx
nop
cmp rdx, rcx
jge 0x42f794
mov rsi, qword [rax + rdx*8 + 0x1278]
cmp rsi, 0x1000
jb 0x42f61b
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rbx
mov rax, rsi
xor ebx, ebx
mov rcx, rbx
call fcn.004128c0
test rax, rax
jne 0x42f66c
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
jmp 0x42f61b
mov rsi, qword [rbx + 0x50]
test byte [rsi], al
mov r8, rcx
shr r8, 3
movzx r9d, byte [rsi + r8]
and ecx, 7
mov r10d, 1
shl r10d, cl
nop
add rsi, r8
test r10b, r9b
je 0x42f6ac
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
jmp 0x42f61b
nop
lock or byte [rsi], r10b
mov rcx, qword [rbx + 0x18]
movabs rsi, 0x800000000000
lea r8, [rsi + rcx]
mov r9, r8
shr r8, 0x2a
nop
nop
nop
cmp r8, 0x40
jae 0x42f7ed
lea r10, [0x005cb038]
mov r8, qword [r10 + r8*8]
test byte [r8], al
mov r10, rcx
shr r10, 0x10
and r10d, 0x3f
shr rcx, 0xd
and ecx, 7
mov r11d, 1
shl r11d, cl
shr r9, 0x16
and r9d, 0xfffff
mov r8, qword [r8 + r9*8]
test byte [r8], al
movzx r9d, byte [r8 + r10 + 0x11440]
lea r8, [r8 + r10]
lea r8, [r8 + 0x11440]
test r11b, r9b
jne 0x42f72f
lock or byte [r8], r11b
movzx r8d, byte [rbx + 0x6a]
test r8b, 1
je 0x42f765
mov rax, qword [rsp + 0x48]
mov r8, qword [rax + 0x1250]
add r8, qword [rbx + 0x70]
mov qword [rax + 0x1250], r8
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
jmp 0x42f61b
mov r8, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
cmp r8, rcx
jae 0x42f7e5
mov rbx, qword [rsp + 0x48]
mov qword [rbx + r8*8 + 0x1278], rax
inc r8
mov rax, rbx
mov rdx, qword [rsp + 0x28]
mov rbx, r8
jmp 0x42f61b
cmp rbx, 0x200
ja 0x42f7d4
lea rdx, [rax + 0x1278]
lea rsi, [rax + 0x1240]
mov rcx, rbx
mov edi, 0x200
mov rbx, rdx
mov rax, rsi
call fcn.00424ee0
mov rax, qword [rsp + 0x48]
add rax, 0x1268
call fcn.0042f500
add rsp, 0x38
pop rbp
ret
mov rcx, rbx
mov edx, 0x200
nop dword [rax]
call fcn.00463f40
mov rax, r8
call fcn.00463ec0
mov rax, r8
mov ecx, 0x40
call fcn.00463ee0
mov edx, 0x200
nop
call fcn.00463f20
nop
mov qword [rsp + 8], rax
call fcn.004687a0
mov rax, qword [rsp + 8]
jmp fcn.0042f580
Function at 0x4445e0
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x444747
push rbp
mov rbp, rsp
sub rsp, 0x18
mov ecx, dword [rax + 0x190]
mov edx, dword [rax + 0x194]
mov rsi, qword [rax + 0x998]
mov edi, dword [rax + 0x194]
cmp edi, edx
jne 0x4445f2
cmp edx, ecx
jne 0x444735
nop word [rax + rax]
test rsi, rsi
jne 0x444735
mov qword [rsp + 0x28], rax
test rbx, rbx
jne 0x444654
nop
call fcn.00465740
xorps xmm15, xmm15
mov r14, qword [0x005f8e78]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rbx, qword [rsp]
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x10], rbx
call fcn.00444500
mov rcx, qword [rsp + 0x28]
mov edx, dword [rcx]
mov ebx, edx
sar edx, 0x1f
shr edx, 0x1b
add edx, ebx
mov esi, edx
and edx, 0xffffffe0
sub ebx, edx
test ebx, ebx
jl 0x444730
mov rdx, qword [0x005a5ce8]
sar esi, 5
mov rax, rcx
mov ecx, ebx
mov edi, 1
shl edi, cl
movsxd rsi, esi
cmp ecx, 0x20
sbb r8d, r8d
and edi, r8d
cmp rdx, rsi
jbe 0x444725
mov rcx, qword [0x005a5ce0]
lea rcx, [rcx + rsi*4]
lock or dword [rcx], edi
mov rcx, qword [0x005a68d0]
mov qword [rax + 8], rcx
mov rcx, rax
nop
mov qword [0x005a68d0], rax
nop
mov edx, 1
lea rsi, [0x005a68d8]
lock xadd dword [rsi], edx
mov rdx, qword [rcx + 0x1228]
shr rdx, 0x3d
test dl, dl
jne 0x444713
mov rax, qword [rsp + 0x10]
movabs rdx, 0x1fffffffffffffff
and rdx, rax
bts rdx, 0x3f
nop
nop
xchg qword [rcx + 0x1228], rdx
add rsp, 0x18
pop rbp
ret
lea rax, [0x004da3d5]
mov ebx, 0x28
nop
call fcn.00435a40
mov rax, rsi
mov rcx, rdx
call fcn.00463ec0
call fcn.00433fa0
lea rax, [0x004d94b8]
mov ebx, 0x23
call fcn.00435a40
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00461c40
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004445e0
Function at 0x451580
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
test rbx, rbx
jbe 0x4516f7
movzx edx, byte [rax]
test edx, edx
jne 0x4515b4
nop dword [rax]
test r8b, r8b
jne 0x4515b4
xor eax, eax
xor ebx, ebx
mov rcx, rbx
xor edi, edi
add rsp, 0x10
pop rbp
ret
bt edx, 7
jae 0x4515c7
xor edx, edx
xor r8d, r8d
xor r9d, r9d
jmp 0x4516b7
mov r8d, 1
mov r9d, edx
and edx, 1
neg edx
shr r9d, 1
xor edx, r9d
add dword [rsi], edx
nop dword [rax]
cmp rbx, r8
jb 0x4516a5
sub rbx, r8
sub rcx, r8
mov rdx, rcx
neg rdx
sar rdx, 0x3f
and r8, rdx
lea rdx, [rax + r8]
test rbx, rbx
jbe 0x451697
movzx esi, byte [rax + r8]
bt esi, 7
jae 0x45161d
xor eax, eax
xor esi, esi
xor r8d, r8d
jmp 0x451660
mov eax, 1
cmp rax, rbx
ja 0x45164b
add qword [rdi], rsi
sub rcx, rax
sub rbx, rax
mov rsi, rcx
neg rsi
sar rsi, 0x3f
and rax, rsi
add rax, rdx
mov edi, 1
add rsp, 0x10
pop rbp
ret
mov rcx, rbx
call fcn.00463f80
lea r8d, [rcx + 7]
mov rcx, r11
mov eax, r12d
nop dword [rax]
cmp rax, rbx
jae 0x45168f
movzx r9d, byte [rax + rdx]
mov r10d, r9d
and r9d, 0x7f
mov r11, rcx
mov ecx, r8d
shl r9d, cl
lea r12d, [rax + 1]
or esi, r9d
test r10b, 0x80
jne 0x451653
mov rcx, r11
mov eax, r12d
jmp 0x451622
mov rcx, rbx
call fcn.00463ec0
xor eax, eax
mov rcx, rax
nop dword [rax]
call fcn.00463ec0
mov eax, r8d
mov rcx, rbx
call fcn.00463f80
lea r9d, [rcx + 7]
mov rcx, r12
cmp rbx, rdx
jbe 0x4516ed
movzx r10d, byte [rdx + rax]
mov r11d, r10d
and r10d, 0x7f
mov r12, rcx
mov ecx, r9d
shl r10d, cl
inc edx
or r8d, r10d
test r11b, 0x80
jne 0x4516b0
mov rcx, r12
mov r9d, edx
mov edx, r8d
mov r8d, r9d
jmp 0x4515cd
mov eax, edx
mov rcx, rbx
call fcn.00463ec0
xor eax, eax
mov rcx, rax
nop dword [rax]
call fcn.00463ec0
nop
int3
Function at 0x458f60
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45900f
push rbp
mov rbp, rsp
sub rsp, 0x58
mov qword [rsp + 0x70], rbx
lea rdx, [rsp + 0x68]
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rsi, [0x00459060]
mov qword [rsp + 0x10], rsi
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdx
mov rdx, r14
mov qword [rsp + 0x28], rdx
lea rdx, [rsp + 8]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.00461b00
xorps xmm15, xmm15
mov r14, qword [0x005f8e78]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
add rsp, 0x58
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00461c40
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp fcn.00458f60
Function at 0x463a20
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x403bc3
push rbp
mov rbp, rsp
sub rsp, 0x18
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
mov rax, rdx
call fcn.004096c0
add rsp, 0x18
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00461c40
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x403ba0
cmp byte [0x005f8c4b], 0
je 0x463a35
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp 0x460c80
jmp 0x403ba0

Function at 0x463a40
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
nop
mov eax, dword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x005f8f20]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d124b
mul rcx
xor rax, rdx
nop
nop
ret
cmp byte [0x005f8c4b], 0
je 0x463a75
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x005f91e0]
aesenc xmm0, xmmword [0x005f91f0]
aesenc xmm0, xmmword [0x005f9200]
movq rax, xmm0
ret
jmp 0x4098e0

Function at 0x463a80
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
nop
mov rax, qword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x005f8f20]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
xor rax, rdx
nop
nop
ret
cmp byte [0x005f8c4b], 0
je 0x463ab6
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x005f91e0]
aesenc xmm0, xmmword [0x005f91f0]
aesenc xmm0, xmmword [0x005f9200]
movq rax, xmm0
ret
jmp 0x409940

Function at 0x4657a0
Capabilities:
Allocate thread local storage

Disassembly:
push rbp
mov rbp, rsp
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x4657d4
mov rcx, 0x28
jmp 0x4657df
shl rcx, 3
add rcx, 0x1480
mov qword [0x005f8e78], rcx
pop rbp
ret
Function at 0x47db20
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47dbea
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rax
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call fcn.00403b00
xorps xmm15, xmm15
mov r14, qword [0x005f8e78]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x47dbcf
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x004b8680]
xor ebx, ebx
mov rcx, rdx
call fcn.00449f80
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call fcn.0047e8c0
inc rbx
cmp rcx, rbx
jae 0x47dbbe
mov edi, 1
lea rsi, [0x004b8680]
call fcn.0044a060
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x004f8c98]
lea rsi, [0x004f8508]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00461c40
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0047db20
Function at 0x4a31e0
Capabilities:
Hash data using fnv

Disassembly:
test byte [rax], al
mov rcx, rbx
and ebx, 0x7f
shl rbx, 5
lea rdx, [rax + rbx]
xor eax, eax
jmp 0x4a31f7
inc rax
cmp rax, 4
jge 0x4a320f
lea rbx, [rdx + rax*8]
mov rbx, qword [rbx]
cmp rbx, rcx
jne 0x4a31f4
mov eax, 1
ret
xor eax, eax
movabs rbx, 0xcbf29ce484222325
jmp 0x4a3220
inc rax
cmp rax, 4
jge 0x4a322e
mov rsi, qword [rdx + rax*8]
xor edi, edi
jmp 0x4a3257
and ebx, 3
lea rdx, [rdx + rbx*8]
xchg qword [rdx], rcx
xor eax, eax
ret
movzx r8d, sil
xor rbx, r8
inc rdi
shr rsi, 8
movabs r8, 0x100000001b3
imul rbx, r8
cmp rdi, 8
jl 0x4a323b
jmp 0x4a321d
Function at 0x14006718c
Capabilities:
Get hostname

Disassembly:
mov qword [rsp + 0x10], rbx
mov dword [rsp + 8], ecx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x40
mov rbx, rdx
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x20], xmm0
xor esi, esi
mov qword [rbp - 0x10], rsi
mov dword [rbp + 0x30], esi
lea r8, [rbp + 0x30]
xor edx, edx
lea ecx, [rsi + 3]
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
nop dword [rax + rax]
test eax, eax
je 0x1400671d4
lea edi, [rsi + 0xd]
jmp 0x14006728f
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov edi, eax
cmp eax, 0xea
jne 0x14006728f
mov word [rbp + 0x20], si
mov edx, dword [rbp + 0x30]
mov r8, qword [rbp - 0x18]
mov rcx, r8
mov rdi, qword [rbp - 0x20]
sub rcx, rdi
sar rcx, 1
cmp rdx, rcx
jae 0x140067214
lea rax, [rdi + rdx*2]
mov qword [rbp - 0x18], rax
jmp 0x140067255
jbe 0x140067255
mov rax, qword [rbp - 0x10]
sub rax, rdi
sar rax, 1
cmp rdx, rax
jbe 0x140067238
lea r8, [rbp + 0x20]
lea rcx, [rbp - 0x20]
call fcn.140043124
mov rdi, qword [rbp - 0x20]
jmp 0x140067255
sub rdx, rcx
je 0x140067251
movzx eax, si
mov rdi, r8
mov rcx, rdx
rep stosw word [rdi], ax
lea r8, [r8 + rdx*2]
mov rdi, qword [rbp - 0x20]
mov qword [rbp - 0x18], r8
lea r8, [rbp + 0x30]
mov rdx, rdi
mov ecx, 3
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
nop dword [rax + rax]
test eax, eax
jne 0x140067281
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov edi, eax
jmp 0x14006728f
mov rdx, qword [rbp - 0x20]
mov rcx, rbx
call fcn.140004374
mov edi, esi
lea rcx, [rbp - 0x20]
call fcn.140020b54
mov eax, edi
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x140067cf0
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov ecx, 1
mov dword [0x1400b4480], eax
call fcn.140068190
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x1400b4480], 0
jne case.default.0x140067d46
mov ecx, 1
call fcn.140068190
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
fdivr qword [rsi]
rol dword [rax - 0x54], 1
out dx, al
invalid
xchg edi, eax
invalid
ret 0xfb43
mov eax, 0x24945b98
xor dword [rcx - 0x11087036], 0x4121319a
clc
scasb al, byte [rdi]
push 0xffffffffc7e3102a
jae 0x140122071
out dx, al
invalid
loop 0x14012213a
lodsb al, byte [rsi]
jg 0x14012207c
jl 0x1401220d8
ja 0x1401220a7
jp 0x140122125
fbld tbyte [rdi + 0x6a]
jae 0x140122130
mov esp, 0xdcd7716a
fnstcw word [rbx + 0x42]
jg 0x140122136
jnp 0x140122163
cmp eax, 0xaf043b9a
and edx, dword [rax + 2]
jne 0x1401220e8
pop r13
xchg esi, eax
sub byte [rax*4 - 0x1ec2dcd6], cl
mov ebx, edi
mov edi, 0x17e90a3b
in eax, dx
sub al, 0x76
invalid
invalid
push rbp
mov dl, 0x32
cmp ebp, dword [rdi]
sub al, 0xc6
test eax, 0x5aaa1e11
movabs eax, dword [0xc0dcbe020b06af7e]
xchg edi, eax
or edi, ebp
pop rsi
sbb esp, esi
popfq
xlatb
pop rdi
call qword [rsi]
jno 0x1401221b0
invalid
invalid
neg byte [rbp + 6]
or al, 0xf
mov ebx, 0x1b346e31
fisub word [rbp + 0xcf0b09d]
loop 0x1401221bc
invalid
cwde
invalid
sub byte [rbx], al
mov ah, 0x6a
invalid