joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140008188
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], r12
push r13
sub rsp, 0xb0
xor ebx, ebx
mov dword [rsp + 0x20], ebx
lea rcx, [rax - 0x78]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rdi, qword [rax + 8]
mov r12d, ebx
xor eax, eax
lock cmpxchg qword [0x14000d868], rdi
je 0x1400081e8
cmp rax, rdi
jne 0x1400081db
mov r12d, 1
jmp 0x1400081e8
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400081c1
mov eax, dword [0x14000d860]
cmp eax, 1
jne 0x1400081fd
lea ecx, [rax + 0x1e]
call sub.msvcrt.dll__amsg_exit
jmp 0x140008264
mov eax, dword [0x14000d860]
cmp eax, ebx
jne 0x14000825a
mov dword [0x14000d860], 1
lea r13, [0x140001548]
lea rdi, [0x140001530]
mov qword [rsp + 0x30], rdi
mov eax, ebx
mov dword [rsp + 0x24], ebx
cmp rdi, r13
jae 0x14000824c
cmp eax, ebx
jne 0x14000824c
mov rcx, qword [rdi]
cmp rcx, rbx
je 0x140008241
call rcx
mov dword [rsp + 0x24], eax
add rdi, 8
mov qword [rsp + 0x30], rdi
jmp 0x14000822a
cmp eax, ebx
je 0x140008264
mov eax, 0xff
jmp 0x1400083ac
mov dword [0x14000b554], 1
mov eax, dword [0x14000d860]
cmp eax, 1
jne 0x14000828c
lea rdx, [0x140001528]
lea rcx, [0x1400014b8]
call sub.msvcrt.dll__initterm
mov dword [0x14000d860], 2
cmp r12d, ebx
jne 0x14000829b
mov rax, rbx
xchg qword [0x14000d868], rax
cmp qword [0x14000d870], rbx
je 0x1400082c3
lea rcx, [0x14000d870]
call fcn.14000862c
cmp eax, ebx
je 0x1400082c3
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
call qword [0x14000d870]
mov rcx, qword [sym.imp.msvcrt.dll__wcmdln]
cmp qword [rcx], rbx
jne 0x1400082d9
mov eax, 0xff
jmp 0x1400083ac
mov rcx, qword [rcx]
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
cmp word [rcx], 0x20
ja 0x14000835e
cmp word [rcx], bx
je 0x1400082f4
cmp edx, ebx
jne 0x14000835e
cmp word [rcx], bx
je 0x14000830a
cmp word [rcx], 0x20
ja 0x14000830a
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x1400082f4
test byte [rsp + 0x7c], 1
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rcx
xor edx, edx
lea rcx, [0x140000000]
call fcn.140003b3c
mov dword [0x14000b550], eax
cmp dword [0x14000b534], ebx
jne 0x140008348
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x14000b554], ebx
jne 0x14000835c
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x14000b550]
jmp 0x1400083ac
cmp word [rcx], 0x22
jne 0x140008371
mov eax, ebx
cmp edx, ebx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x1400082e5
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov r12, qword [r11 + 0x20]
mov rsp, r11
pop r13
ret
sub rsp, 0x28
call 0x140194000
add rsp, 0x28
jmp 0x140008188
Function at 0x4173bd
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
aeskeygenassist xmm0, xmmword [rdx], 2
movdqa xmmword [rcx], xmm0
ret

Function at 0x419adf
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
test rdx, rdx
je 0x419c13
add rdx, rcx
lea r8, [0x00615cf8]
mov rax, rdx
movzx r9d, byte [rdx - 1]
test r9b, r9b
js 0x419b06
lea rdx, [rax - 1]
jmp 0x419b68
movzx r10d, byte [rax - 2]
cmp r10b, 0xc0
jge 0x419b33
movzx r11d, byte [rax - 3]
cmp r11b, 0xc0
jge 0x419b3d
lea rdx, [rax - 4]
movzx esi, byte [rax - 4]
and esi, 7
shl esi, 6
and r11d, 0x3f
or r11d, esi
jmp 0x419b45
lea rdx, [rax - 2]
and r10d, 0x1f
jmp 0x419b50
lea rdx, [rax - 3]
and r11d, 0xf
shl r11d, 6
and r10d, 0x3f
or r10d, r11d
shl r10d, 6
and r9d, 0x3f
or r9d, r10d
cmp r9d, 0x110000
je 0x419c13
lea r10d, [r9 - 9]
cmp r10d, 5
jae 0x419b80
cmp rdx, rcx
jne 0x419af3
jmp 0x419c13
cmp r9d, 0x20
je 0x419b72
cmp r9d, 0x110000
je 0x419c13
cmp r9d, 0x80
jb 0x419bff
mov r10d, r9d
shr r10d, 8
cmp r10d, 0x1f
jg 0x419bbf
test r10d, r10d
je 0x419bd6
cmp r10d, 0x16
jne 0x419bff
cmp r9d, 0x1680
je 0x419b72
jmp 0x419bff
cmp r10d, 0x20
je 0x419bf0
cmp r10d, 0x30
jne 0x419bff
cmp r9d, 0x3000
je 0x419b72
jmp 0x419bff
movzx r9d, r9b
mov r9b, byte [r9 + r8]
mov r10d, r9d
xor r10b, 0xfe
or r9b, 1
test r9b, r10b
jne 0x419b72
jmp 0x419bff
movzx r9d, r9b
test byte [r9 + r8], 2
jne 0x419b72
mov r8, rcx
not r8
and r8, rdx
or rcx, rdx
sub rax, rcx
add rax, r8
jmp 0x419c15
xor eax, eax
pop rsi
ret
Function at 0x429070
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rax, rdx
mov rsi, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x80]
mov ebx, ecx
shr ebx, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov r15, rax
movzx r14d, byte [rax + 1]
add rax, 2
lea r10, [r11 + r14]
cmp byte [r15], bl
jne 0x429100
cmp r10, r11
jb 0x429176
cmp r10, rdx
ja 0x42918a
add r11, r9
xor r15d, r15d
nop word cs:[rax + rax]
cmp r14, r15
je 0x429102
lea r12, [r15 + 1]
cmp byte [r11 + r15], cl
mov r15, r12
jne 0x4290e0
jmp 0x429164
ja 0x42910a
mov r11, r10
cmp rax, r8
jne 0x4290a4
add rsi, rdi
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r8, [rdi + 1]
movzx edx, byte [rdi]
test dl, dl
js 0x429140
mov rdi, r8
sub ecx, edx
jns 0x42915b
jmp 0x429166
cmp r8, rsi
je 0x42919b
movzx r8d, byte [rdi + 1]
add rdi, 2
and edx, 0x7f
shl edx, 8
or edx, r8d
sub ecx, edx
js 0x429166
xor al, 1
cmp rdi, rsi
jne 0x429120
jmp 0x429166
xor eax, eax
and al, 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea r8, str.library_core_src_unicode_printable.rs
mov rcx, r11
mov rdx, r10
call fcn.00429a20
ud2
lea r8, str.library_core_src_unicode_printable.rs
mov rcx, r10
call fcn.004292f0
ud2
lea rcx, str.called__Option::unwrap____on_a__None__valuecalled__Result::unwrap____on_an__Err__value
lea r8, str.library_core_src_unicode_printable.rs
mov edx, 0x2b
call fcn.00426370
ud2
Function at 0x42b708
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov eax, dword [0x005b7028]
test eax, eax
je 0x42b7c6
mov ecx, eax
or ecx, 0xfffffffe
and eax, 0xfffffffe
add ecx, eax
inc ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jbe 0x42b742
mov rdi, rax
cmp qword [rax], 0
je 0x42b742
add rdi, 8
jmp 0x42b769
mov eax, dword [0x005b7028]
test eax, eax
je 0x42b7d9
mov ecx, eax
or ecx, 0xfffffffe
and eax, 0xfffffffe
add ecx, eax
inc ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jne 0x42b773
xor edi, edi
mov rax, rdi
add rsp, 0x38
pop rdi
pop rsi
ret
mov rsi, rax
test rax, rax
jne 0x42b800
mov ecx, 0x18
mov edx, 8
call fcn.00414fe0
test rax, rax
je 0x42b829
mov rsi, rax
mov qword [rax], 0
lea rax, [0x005b7010]
mov qword [rsi + 0x10], rax
mov eax, dword [0x005b7028]
test eax, eax
jne 0x42b7ec
lea rcx, [0x005b7010]
call fcn.0053fad0
mov ecx, eax
jmp 0x42b7f8
lea rcx, [0x005b7010]
call fcn.0053fad0
mov ecx, eax
jmp 0x42b728
lea rcx, [0x005b7010]
call fcn.0053fad0
mov ecx, eax
jmp 0x42b75c
mov ecx, eax
or ecx, 0xfffffffe
and eax, 0xfffffffe
add ecx, eax
inc ecx
mov rdx, rsi
call sub.KERNEL32.dll_TlsSetValue
call fcn.0042b4cc
movups xmm0, xmmword [rsi]
lea rdi, [rsi + 8]
lea rcx, [rsp + 0x28]
movups xmmword [rcx], xmm0
mov qword [rsi], 1
mov qword [rsi + 8], rax
call fcn.0042b547
jmp 0x42b769
mov ecx, 0x18
mov edx, 8
call fcn.00417bf0
ud2

Function at 0x42c421
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov ecx, dword [0x005b7068]
test ecx, ecx
je 0x42c4f7
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jbe 0x42c454
mov rdi, rax
cmp qword [rax], 0
je 0x42c454
add rdi, 8
jmp 0x42c4ed
mov ecx, dword [0x005b7068]
test ecx, ecx
je 0x42c50a
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x42c4eb
mov rsi, rax
test rax, rax
jne 0x42c4b8
mov ecx, 0x18
mov edx, 8
call fcn.00414fe0
test rax, rax
je 0x42c537
mov rsi, rax
mov qword [rax], 0
lea rax, [0x005b7050]
mov qword [rsi + 0x10], rax
mov ecx, dword [0x005b7068]
test ecx, ecx
je 0x42c524
dec ecx
mov rdx, rsi
call sub.KERNEL32.dll_TlsSetValue
mov rax, qword [0x00675080]
cmp rax, 3
jne 0x42c51d
call fcn.0042b894
movups xmm0, xmmword [rsi]
lea rdi, [rsi + 8]
lea rcx, [rsp + 0x28]
movups xmmword [rcx], xmm0
mov qword [rsi], 1
mov qword [rsi + 8], rax
call fcn.0042b9ef
jmp 0x42c4ed
xor edi, edi
mov rax, rdi
add rsp, 0x38
pop rdi
pop rsi
ret
lea rcx, [0x005b7050]
call fcn.0053fad0
mov ecx, eax
jmp 0x42c437
lea rcx, [0x005b7050]
call fcn.0053fad0
mov ecx, eax
jmp 0x42c464
call fcn.0042b83a
jmp 0x42c4c5
lea rcx, [0x005b7050]
call fcn.0053fad0
mov ecx, eax
jmp 0x42c4b0
mov ecx, 0x18
mov edx, 8
call fcn.00417bf0
ud2
Function at 0x42f019
Capabilities:
Generate random numbers via rtlgenrandom
Generate random numbers via winapi

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov rsi, rdx
mov rdi, rcx
mov r14d, 0xffffffff
cmp rsi, r14
mov ebx, 0xffffffff
cmovb rbx, rsi
xor ecx, ecx
mov rdx, rdi
mov r8d, ebx
mov r9d, 2
call sub.bcrypt.dll_BCryptGenRandom
cmp eax, 0xbfffffff
jbe 0x42f065
mov ebp, eax
mov rcx, rdi
mov edx, ebx
call sub.advapi32.dll_SystemFunction036
test al, al
je 0x42f071
add rdi, rbx
sub rsi, rbx
jne 0x42f02f
xor ebp, ebp
jmp 0x42f077
add ebp, 0x80000000
mov eax, ebp
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
Function at 0x4482db
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
mov rax, rcx
add qword [rcx + 0x30], r8
mov r11, qword [rcx + 0x40]
test r11, r11
je 0x448313
mov r10d, 8
sub r10, r11
cmp r8, r10
mov rdi, r10
cmovb rdi, r8
cmp rdi, 3
jbe 0x44831b
mov esi, dword [rdx]
mov r9d, 4
jmp 0x448320
xor r10d, r10d
jmp 0x4483da
xor r9d, r9d
xor esi, esi
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jae 0x448343
movzx ebx, word [rdx + r9]
lea ecx, [r9*8]
shl rbx, cl
or rsi, rbx
or r9, 2
cmp r9, rdi
jae 0x44835a
movzx edi, byte [rdx + r9]
shl r9d, 3
mov ecx, r9d
shl rdi, cl
or rsi, rdi
lea ecx, [r11*8]
shl rsi, cl
or rsi, qword [rax + 0x38]
mov qword [rax + 0x38], rsi
cmp r10, r8
jbe 0x44837a
add r11, r8
jmp 0x4484da
mov r11, qword [rax + 0x18]
mov r9, qword [rax + 0x10]
mov rcx, qword [rax]
add rcx, r9
rol r9, 0xd
xor r11, rsi
xor r9, rcx
rol rcx, 0x20
mov rdi, qword [rax + 8]
add rdi, r11
rol r11, 0x10
xor r11, rdi
add rcx, r11
rol r11, 0x15
mov rbx, rcx
and rbx, r11
add r11, rcx
add rbx, rbx
sub r11, rbx
add rdi, r9
rol r9, 0x11
mov qword [rax + 0x18], r11
xor r9, rdi
rol rdi, 0x20
mov qword [rax + 0x10], r9
mov qword [rax + 8], rdi
xor rcx, rsi
mov qword [rax], rcx
sub r8, r10
mov rcx, r8
xor rcx, 0xfffffffffffffff8
mov r11, r8
or r11, 7
and r11, rcx
mov rcx, r11
not rcx
and rcx, r8
not r8
and r8, r11
sub rcx, r8
cmp r10, rcx
jae 0x44847e
mov r8, qword [rax]
mov r9, qword [rax + 8]
mov rdi, qword [rax + 0x18]
mov rsi, qword [rax + 0x10]
mov rbx, qword [rdx + r10]
xor rdi, rbx
add r8, rsi
rol rsi, 0xd
xor rsi, r8
rol r8, 0x20
add r9, rdi
rol rdi, 0x10
xor rdi, r9
add r8, rdi
rol rdi, 0x15
mov r14, r8
and r14, rdi
add rdi, r8
add r9, rsi
rol rsi, 0x11
add r14, r14
xor rsi, r9
rol r9, 0x20
sub rdi, r14
mov r14, r8
and r14, rbx
add r8, rbx
add r14, r14
sub r8, r14
add r10, 8
cmp r10, rcx
jb 0x448414
mov qword [rax + 0x18], rdi
mov qword [rax + 0x10], rsi
mov qword [rax + 8], r9
mov qword [rax], r8
cmp r11, 3
jbe 0x448490
mov r9d, dword [rdx + r10]
mov r8d, 4
jmp 0x448496
xor r8d, r8d
xor r9d, r9d
mov rcx, r8
or rcx, 1
cmp rcx, r11
jae 0x4484bc
lea rcx, [r8 + r10]
movzx esi, word [rdx + rcx]
lea ecx, [r8*8]
shl rsi, cl
or r9, rsi
or r8, 2
cmp r8, r11
jae 0x4484d6
add r10, r8
movzx edx, byte [rdx + r10]
shl r8d, 3
mov ecx, r8d
shl rdx, cl
or r9, rdx
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r11
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x4552e0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rbx, r9
mov rsi, rcx
mov rcx, rdx
mov rdx, r8
call fcn.00427ad0
movabs r14, 0xffffffffff
mov r15, rax
and r15, r14
mov rdi, r15
shr rdi, 8
test al, 1
jne 0x4553bb
mov rdx, qword [rsp + 0xb0]
shr r15, 0x10
mov byte [rsp + 0x20], dil
mov word [rsp + 0x21], r15w
mov eax, r15d
shr eax, 0x10
mov byte [rsp + 0x23], al
mov rcx, rbx
call fcn.00427ad0
and r14, rax
mov rcx, r14
shr rcx, 8
test al, 1
jne 0x4553bf
shr r14, 0x10
mov byte [rsp + 0x28], cl
mov word [rsp + 0x29], r14w
mov eax, r14d
shr eax, 0x10
mov byte [rsp + 0x2b], al
mov eax, dword [rsp + 0x20]
mov edx, dword [rsp + 0x28]
bswap eax
bswap edx
xor r8d, r8d
cmp eax, edx
seta r8b
sbb r8d, 0
test r8d, r8d
jg 0x4553c9
shl r15d, 8
mov eax, 0xff
and edi, eax
or edi, r15d
bswap edi
shl r14d, 8
and ecx, eax
or ecx, r14d
bswap ecx
mov dword [rsi + 4], edi
mov dword [rsi + 8], ecx
mov dword [rsi], 0
add rsp, 0x60
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov ecx, edi
jmp 0x4553bf
call fcn.004570c5
jmp 0x455459
lea rax, [0x005d0d75]
lea rdi, [rsp + 0x30]
mov qword [rdi], rax
mov rcx, qword [rdi]
movabs rax, 0x1b951b1539602459
mov qword [rdi], rax
mov rdx, qword [rdi]
call fcn.004570ec
xorps xmm0, xmm0
movaps xmmword [rdi], xmm0
mov qword [rdi + 0x10], 0
mov rcx, 0xfffffffffffffff8
lea rdx, [0x005dbcd4]
mov r8, qword [rcx + rdx + 8]
xor r8, qword [rax + rcx + 8]
mov qword [rsp + rcx + 0x38], r8
add rcx, 8
cmp rcx, 0x10
jb 0x45540c
mov ecx, 0x18
call fcn.005162fd
lea rcx, [rsp + 0x48]
mov qword [rcx], rax
mov qword [rcx + 8], rdx
movaps xmm0, xmmword [rsp + 0x30]
movups xmmword [rdx], xmm0
mov rax, qword [rsp + 0x40]
mov qword [rdx + 0x10], rax
mov qword [rcx + 0x10], 0x18
call fcn.004554b3
mov qword [rsi + 8], rax
mov dword [rsi], 1
jmp 0x4553af
Function at 0x457db6
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov r14, qword [rdx + 0x10]
test r14, r14
je 0x457ed0
mov rdi, rdx
mov eax, dword [0x005b7048]
test eax, eax
je 0x457f4b
mov ecx, eax
or ecx, 0xfffffffe
and eax, 0xfffffffe
add ecx, eax
inc ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jbe 0x457e05
mov r15, qword [rax]
test r15, r15
jne 0x457e9f
mov eax, dword [0x005b7048]
test eax, eax
je 0x457f5e
mov ecx, eax
or ecx, 0xfffffffe
and eax, 0xfffffffe
add ecx, eax
inc ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x457f1e
mov rbx, rax
test rax, rax
jne 0x457e85
mov ecx, 0x10
mov edx, 8
call fcn.00414fe0
test rax, rax
je 0x457f84
mov rbx, rax
mov qword [rax], 0
lea rax, [0x005b7030]
mov qword [rbx + 8], rax
mov eax, dword [0x005b7048]
test eax, eax
je 0x457f71
mov ecx, eax
or ecx, 0xfffffffe
and eax, 0xfffffffe
add ecx, eax
inc ecx
mov rdx, rbx
call sub.KERNEL32.dll_TlsSetValue
call fcn.00551100
mov r15, qword [rax + 0x20]
lock dec qword [rax]
jne 0x457e9c
mov rcx, rax
call fcn.0042c548
mov qword [rbx], r15
mov rcx, qword [rdi + 8]
lea rax, [r14 + r14*2]
lea rdx, [rcx + rax*8]
xor ebx, ebx
mov r8, qword [rcx + 0x10]
cmp qword [r8 + 0x28], r15
je 0x457ec4
mov r9, qword [rcx]
xor eax, eax
lock cmpxchg qword [r8 + 0x10], r9
je 0x457ee4
add rcx, 0x18
inc rbx
cmp rcx, rdx
jne 0x457ead
mov qword [rsi + 0x10], 0
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov rax, qword [rcx + 8]
test rax, rax
je 0x457ef1
mov qword [r8 + 0x18], rax
mov rcx, qword [r8 + 0x20]
add rcx, 0x28
call fcn.0054fb50
lea r9, [0x005d8510]
mov rcx, rsi
mov rdx, rdi
mov r8, rbx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp fcn.0045853b
call fcn.00551100
mov r15, qword [rax + 0x20]
lock dec qword [rax]
jne 0x457f35
mov rcx, rax
call fcn.0042c548
mov rax, qword [rdi + 0x10]
test rax, rax
je 0x457ed0
mov rcx, qword [rdi + 8]
lea rax, [rax + rax*2]
jmp 0x457ea7
lea rcx, [0x005b7030]
call fcn.0053fad0
mov ecx, eax
jmp 0x457dee
lea rcx, [0x005b7030]
call fcn.0053fad0
mov ecx, eax
jmp 0x457e1f
lea rcx, [0x005b7030]
call fcn.0053fad0
mov ecx, eax
jmp 0x457e7d
mov ecx, 0x10
mov edx, 8
call fcn.00417bf0
ud2
Function at 0x46066f
Capabilities:
Encode data using base64
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
push rax
mov edx, dword [rcx + 0x1f]
movzx eax, byte [rcx + 0x23]
mov byte [rcx + 0x1f], 0
test dl, dl
je 0x46076e
shl rax, 0x20
or rdx, rax
shr rdx, 8
mov r11, qword [rcx + 8]
mov rsi, qword [rcx + 0x10]
lea rcx, [r11 + 3]
and rcx, 0xfffffffffffffffc
sub rcx, r11
mov rax, rsi
sub rax, rcx
jae 0x4606be
lea r8, str.combase.dll
xor r10d, r10d
mov rax, r8
xor r9d, r9d
jmp 0x460702
lea r8, [r11 + rcx]
mov r9, rax
shr r9, 2
mov esi, r9d
not esi
mov r10, r9
and r10, 0xfffffffffffffffe
and esi, 1
imul rsi, r10
or r9, 1
mov r10, rax
shl r10, 0x3d
sar r10, 0x3f
and r10, r9
add r10, rsi
mov r9d, eax
and r9d, 3
and rax, 0xfffffffffffffffc
add rax, r8
mov rsi, rcx
mov dword [rsp], edx
test rsi, rsi
je 0x460724
xor ecx, ecx
mov edi, ecx
and edi, 3
mov bl, byte [rsp + rdi]
xor byte [r11 + rcx], bl
lea rdi, [rcx + 1]
mov rcx, rdi
cmp rsi, rdi
jne 0x46070c
mov ecx, esi
shl ecx, 3
mov r11d, edx
ror r11d, cl
test sil, 3
cmove r11d, edx
test r10, r10
je 0x46074f
shl r10, 2
xor ecx, ecx
xor dword [r8 + rcx], r11d
add rcx, 4
cmp r10, rcx
jne 0x460742
mov dword [rsp + 4], r11d
test r9, r9
je 0x46076e
xor ecx, ecx
mov dl, byte [rsp + rcx + 4]
xor byte [rax + rcx], dl
lea rdx, [rcx + 1]
mov rcx, rdx
cmp r9, rdx
jne 0x46075b
add rsp, 8
pop rbx
pop rdi
pop rsi
ret
Function at 0x46bed0
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0xf8
mov rdi, rdx
mov rsi, rcx
movabs rax, 0x7ffffffffffffffb
mov byte [rsp + 0x7e], 0
mov word [rsp + 0x7c], 0
mov rcx, qword [r8]
mov qword [rsp + 0x70], rcx
mov edx, dword [r8 + 8]
mov dword [rsp + 0x78], edx
mov qword [rsp + 0x60], rcx
mov rcx, qword [rsp + 0x77]
mov qword [rsp + 0x67], rcx
mov byte [rsp + 0x6f], 1
xorps xmm0, xmm0
movaps xmmword [rsp + 0x70], xmm0
xor ecx, ecx
mov edx, ecx
and edx, 4
mov r8, rcx
or r8, 4
imul r8, rdx
xor rdx, 4
mov r9, rcx
and r9, rax
imul r9, rdx
add r8, r9
mov edx, dword [rsp + r8 + 0x60]
cmp rcx, 3
mov r8d, edx
bswap r8d
cmovne r8d, edx
mov dword [rsp + rcx*4 + 0x70], r8d
lea rdx, [rcx + 1]
mov rcx, rdx
cmp rdx, 4
jne 0x46bf26
movaps xmm0, xmmword [rsp + 0x70]
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x38], 0
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
mov cl, byte [0x005b7070]
cmp cl, 1
jne 0x46bfad
lea rdx, [rsp + 0x28]
lea r8, [rsp + 0x40]
mov rcx, rdi
call fcn.0046d2f0
jmp 0x46c04a
movaps xmmword [rsp + 0x50], xmm0
mov ecx, dword [rsp + 0x34]
bswap ecx
xor edx, edx
lea r8, [rdx + 1]
mov r9d, ecx
cmp rdx, 3
je 0x46bfcc
mov r9d, dword [rsp + rdx*4 + 0x28]
mov r10d, edx
and r10d, 4
mov r11, rdx
or rdx, 4
imul rdx, r10
xor r10, 4
and r11, rax
imul r11, r10
add rdx, r11
mov dword [rsp + rdx + 0x50], r9d
mov rdx, r8
cmp r8, 4
jne 0x46bfba
mov dword [rsp + 0x38], 1
xorps xmm0, xmm0
lea rbx, [rsp + 0xb0]
movaps xmmword [rbx + 0x30], xmm0
movaps xmmword [rbx + 0x20], xmm0
movaps xmmword [rbx + 0x10], xmm0
movaps xmmword [rbx], xmm0
lea rdx, [rsp + 0x60]
lea r8, [rsp + 0x50]
mov rcx, rbx
call fcn.0044e7d9
lea r14, [rsp + 0x70]
mov rcx, r14
mov rdx, rdi
mov r8, rbx
call fcn.00416336
movups xmm0, xmmword [r14]
movaps xmmword [rsp + 0x40], xmm0
movups xmm0, xmmword [rsp + 0x20]
movups xmm1, xmmword [rsp + 0x30]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
movaps xmm0, xmmword [rsp + 0x40]
movups xmmword [rsi + 0x20], xmm0
add rsp, 0xf8
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x46c071
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rbx, r9
mov rsi, r8
mov rdi, rcx
mov r12, qword [rsp + 0xc0]
mov al, byte [0x005b70c8]
movaps xmm0, xmmword [rdx + 0x3c0]
movaps xmm1, xmmword [rdx + 0x3d0]
lea rcx, [rsp + 0x40]
movaps xmmword [rcx], xmm0
movaps xmmword [rcx + 0x10], xmm1
mov al, byte [0x005b70c8]
mov r8, r12
shr r8, 4
mov rdx, r9
call fcn.0046cfc2
mov r14, r12
and r14, 0xf
je 0x46c117
mov rax, r12
and rax, 0xfffffffffffffff0
add rbx, rax
mov r8d, 0x10
sub r8, r14
lea rcx, [rsp + r14]
add rcx, 0x28
xor edx, edx
call sub.msvcrt.dll_memset
lea r15, [rsp + 0x28]
mov rcx, r15
mov rdx, rbx
mov r8, r14
call sub.msvcrt.dll_memcpy
lea rcx, [rsp + 0x40]
mov r8d, 1
mov rdx, r15
call fcn.0046cfc2
mov rax, r12
or rax, 8
mov ecx, r12d
and ecx, 8
imul rax, rcx
xor rcx, 8
and r12, 0xfffffffffffffff7
imul r12, rcx
add r12, rax
bswap r12
movabs r15, 0x7ffffffffffffff7
lea rbx, [rsp + 0x28]
mov qword [rbx], 0
mov qword [rbx + 8], r12
lea r14, [rsp + 0x40]
mov r8d, 1
mov rcx, r14
mov rdx, rbx
call fcn.0046cfc2
movaps xmm0, xmmword [r14 + 0x10]
mov al, byte [0x005b70c8]
cmp al, 1
jne 0x46c181
movups xmmword [rdi], xmm0
jmp 0x46c235
xorps xmm1, xmm1
movups xmmword [rdi], xmm1
lea rax, [rsp + 0x38]
movups xmmword [rax - 0x10], xmm0
mov rcx, rbx
not rcx
and rcx, rax
not rax
and rax, rbx
sub rcx, rax
shr rcx, 3
cmp rcx, 2
mov r14d, 2
cmovb r14, rcx
test r14, r14
je 0x46c235
xor r12d, r12d
mov r13d, 8
lea rbx, [rsp + 0x38]
mov rax, qword [rsp + r12*8 + 0x28]
mov qword [rsp + 0x38], rax
cmp r12, 2
je 0x46c288
mov eax, r12d
and eax, 8
mov rcx, r12
or rcx, 8
imul rcx, rax
xor rax, 8
mov rdx, r12
and rdx, r15
imul rdx, rax
add rcx, rdx
mov eax, 0x10
sub rax, rcx
cmp rax, 8
cmovae rax, r13
add rcx, rdi
inc r12
mov edx, eax
or edx, 1
mov r8d, eax
and r8d, 1
neg r8d
and r8d, edx
add r8, rax
mov rdx, rbx
call sub.msvcrt.dll_memcpy
cmp r14, r12
jne 0x46c1c7
xor eax, eax
inc r15
mov rcx, rax
xor rcx, 7
mov rdx, rax
and rdx, r15
sub rcx, rdx
mov dl, byte [rdi + rax]
mov r8b, byte [rdi + rcx + 8]
mov byte [rdi + rax], r8b
mov byte [rdi + rcx + 8], dl
inc rax
cmp rax, 8
jne 0x46c23a
xor eax, eax
mov cl, byte [rsi + rax]
xor byte [rdi + rax], cl
lea rcx, [rax + 1]
mov rax, rcx
cmp rcx, 0x10
jne 0x46c265
add rsp, 0x60
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea r8, str.registry_src_octopus.retort.com_8754fae0eb2f08f1_volcano_0.6.2_src_backend_soft64.rs
mov edx, 8
xor ecx, ecx
call fcn.00423d00
ud2
Function at 0x46d2f0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x18
xorps xmm0, xmm0
movaps xmmword [rsp], xmm0
mov eax, dword [rdx + 0x10]
mov r9d, dword [rdx + 0xc]
add r9d, eax
bswap r9d
xor r11d, r11d
movabs r10, 0x7ffffffffffffffb
lea rsi, [r11 + 1]
mov edi, r9d
cmp r11, 3
je 0x46d32b
mov edi, dword [rdx + r11*4]
mov ebx, r11d
and ebx, 4
mov r14, r11
or r11, 4
imul r11, rbx
xor rbx, 4
and r14, r10
imul r14, rbx
add r11, r14
mov dword [rsp + r11], edi
mov r11, rsi
cmp rsi, 4
jne 0x46d31a
movdqa xmm0, xmmword [rcx]
pxor xmm0, xmmword [rsp]
aesenc xmm0, xmmword [rcx + 0x10]
aesenc xmm0, xmmword [rcx + 0x20]
aesenc xmm0, xmmword [rcx + 0x30]
aesenc xmm0, xmmword [rcx + 0x40]
aesenc xmm0, xmmword [rcx + 0x50]
aesenc xmm0, xmmword [rcx + 0x60]
aesenc xmm0, xmmword [rcx + 0x70]
aesenc xmm0, xmmword [rcx + 0x80]
aesenc xmm0, xmmword [rcx + 0x90]
aesenc xmm0, xmmword [rcx + 0xa0]
aesenc xmm0, xmmword [rcx + 0xb0]
inc eax
aesenc xmm0, xmmword [rcx + 0xc0]
mov dword [rdx + 0x10], eax
aesenc xmm0, xmmword [rcx + 0xd0]
aesenclast xmm0, xmmword [rcx + 0xe0]
movdqu xmmword [r8], xmm0
add rsp, 0x18
pop rbx
pop rdi
pop rsi
pop r14
ret