joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140202d72
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x1402451c8]
test eax, eax
je 0x140202e0a
lea rax, [0x1402451a0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x1402451d0]
mov qword [rbp - 8], rax
jmp 0x140202dee
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x140202de2
cmp qword [rbp - 0x10], 0
je 0x140202de2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x140202da8
lea rax, [0x1402451a0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x140202e0b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x140202f10
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x140202f38
mov eax, 0
jmp 0x140202f86
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x140202f61
mov eax, 0
jmp 0x140202f86
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x140202f81
mov eax, 0
jmp 0x140202f86
mov eax, 1
add rsp, 0x20
pop rbp
ret

Function at 0x140202f8c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x14020300a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x140203001
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x140203001
mov rax, qword [rbp - 8]
jmp 0x14020301f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x140202fd4
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x14006d060
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x14006d06d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14006d07d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x14006d065
lea eax, [rcx + 1]
jmp 0x14006d08b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x14006d09e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x14006d084
sub eax, 3
jb 0x14006d0be
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x14006d10d
sar eax, 1
movsxd rbp, eax
jb 0x14006d0f4
jmp 0x14006d0cc
add ebx, ebx
jne 0x14006d0ca
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x14006d0f4
inc ecx
add ebx, ebx
jne 0x14006d0da
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x14006d0f4
call r11
adc ecx, ecx
add ebx, ebx
jne 0x14006d0ed
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x14006d0dc
add ecx, 2
jmp 0x14006d0f9
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.14006d022
jmp 0x14006d06d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x1b400
mov dl, 9
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x14006d159
cmp rsi, rcx
jae 0x14006d161
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x14006d140
cmp al, 0x8f
ja 0x14006d140
cmp byte [rsi - 2], 0xf
je 0x14006d146
sub al, 0xe8
cmp al, 1
ja 0x14006d12a
cmp rsi, rcx
jae 0x14006d161
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x14006d130
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x14006d161
lodsb al, byte [rsi]
jmp 0x14006d140
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x6a000]
mov eax, dword [rdi]
or eax, eax
je 0x14006d1ca
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x8d110]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x14006d16e
jns 0x14006d1a3
movzx rdx, word [rdi]
add rdi, 2
jmp 0x14006d1ad
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x14006d1c4
mov qword [rbx], rax
add rbx, 8
jmp 0x14006d18e
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x18f]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x14006d222
sub rsp, 0xffffffffffffff80
jmp 0x14001bce0
Function at 0x180011299
Capabilities:
Create process on windows
Terminate process

Disassembly:
jmp 0x180014c40
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x218
lea rbp, [rsp + 0x50]
lea rdi, [rsp + 0x50]
mov ecx, 0x42
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x238]
mov rax, qword [0x180024040]
xor rax, rbp
mov qword [rbp + 0x1b8], rax
lea rcx, [0x18002a001]
call fcn.180011514
nop
mov eax, dword [rbp + 0x1e8]
mov dword [rbp + 0x1b4], eax
cmp dword [rbp + 0x1b4], 1
je 0x180014cad
jmp 0x180014dbd
mov r8d, 0x68
xor edx, edx
lea rcx, [rbp + 0x10]
call fcn.1800113f2
nop
mov dword [rbp + 0x10], 0x68
mov r8d, 0x18
xor edx, edx
lea rcx, [rbp + 0x98]
call fcn.1800113f2
nop
lea rdx, str.powershell.exe__Command__
lea rcx, [rbp + 0xc8]
call fcn.18001123f
nop
mov rdx, qword [section..data]
lea rcx, [rbp + 0xc8]
call fcn.180011064
nop
lea rdx, [0x180020518]
lea rcx, [rbp + 0xc8]
call fcn.180011064
nop
lea rcx, [rbp + 0xc8]
call fcn.18001107d
lea rcx, [rbp + 0x98]
mov qword [rsp + 0x48], rcx
lea rcx, [rbp + 0x10]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x180014d9e
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x98]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
nop
mov rcx, qword [rbp + 0x98]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rcx, qword [rbp + 0xa0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
lea rcx, [rbp + 0xc8]
call fcn.1800110eb
nop
mov eax, 1
mov edi, eax
lea rcx, [rbp - 0x50]
lea rdx, [0x18001fff0]
call fcn.180011447
mov eax, edi
mov rcx, qword [rbp + 0x1b8]
xor rcx, rbp
call fcn.180011280
lea rsp, [rbp + 0x1c8]
pop rdi
pop rbp
ret

Function at 0x1800112e4
Capabilities:
Terminate process

Disassembly:
jmp 0x180016ac0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret
Function at 0x140011258
Capabilities:
Terminate process

Disassembly:
jmp 0x140013a00
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret

Function at 0x1400112f3
Capabilities:
Parse pe header

Disassembly:
jmp 0x140014d50
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140014d70
xor al, al
jmp 0x140014df1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140014d83
xor al, al
jmp 0x140014df1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140014dad
xor al, al
jmp 0x140014df1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140014dc1
xor al, al
jmp 0x140014df1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140014dd3
xor al, al
jmp 0x140014df1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140014def
xor al, al
jmp 0x140014df1
mov al, 1
add rsp, 0x38
ret
Function at 0x140012c30
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x68
mov ecx, 1
call fcn.140011429
movzx eax, al
test eax, eax
jne 0x140012c50
mov ecx, 7
call fcn.14001139d
nop
mov byte [rsp + 0x20], 0
call fcn.1400113b1
mov byte [rsp + 0x21], al
cmp dword [0x14001d868], 1
jne 0x140012c74
mov ecx, 7
call fcn.14001139d
nop
jmp 0x140012ccc
cmp dword [0x14001d868], 0
jne 0x140012cc7
mov dword [0x14001d868], 1
lea rdx, [0x14001a660]
lea rcx, [0x14001a330]
call fcn.1400111fe
test eax, eax
je 0x140012ca8
mov eax, 0xff
jmp 0x140012dd1
lea rdx, [0x14001a220]
lea rcx, [section..rdata]
call fcn.1400113a7
mov dword [0x14001d868], 2
jmp 0x140012ccc
mov byte [rsp + 0x20], 1
movzx ecx, byte [rsp + 0x21]
call fcn.140011389
call fcn.14001131b
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x140012d29
mov rcx, qword [rsp + 0x30]
call fcn.1400111a9
movzx eax, al
test eax, eax
je 0x140012d29
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov edx, 2
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call qword [0x140024020]
nop
call fcn.14001134d
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x140012d5d
mov rcx, qword [rsp + 0x38]
call fcn.1400111a9
movzx eax, al
test eax, eax
je 0x140012d5d
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call fcn.1400113e8
nop
call fcn.140012e80
mov dword [rsp + 0x28], eax
call fcn.1400112f3
movzx eax, al
test eax, eax
jne 0x140012d7c
mov ecx, dword [rsp + 0x28]
call fcn.140011069
nop
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x140012d8b
call fcn.1400113f2
nop
xor edx, edx
mov cl, 1
call fcn.140011195
mov eax, dword [rsp + 0x28]
jmp 0x140012dd1
add rsp, 0x68
ret
Function at 0x420dc0
Capabilities:
Hash data using murmur3

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
cmp byte [0x005d96f3], 0
jne 0x420f25
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
sub rdx, qword [rbx + 0x18]
nop
test rdx, rdx
jne 0x420ece
xor eax, eax
nop
nop
nop
mov rcx, rax
shr rax, 3
and rcx, 7
mov edx, 1
shl edx, cl
nop
add rax, qword [rbx + 0x50]
lock or byte [rax], dl
nop
nop
mov rcx, qword [rbx + 0x18]
nop
movabs rdx, 0x800000000000
lea rax, [rdx + rcx]
mov rdx, rax
shr rax, 0x2a
cmp rax, 0x40
jae 0x420f1a
lea rbx, [0x005d0cc0]
mov rax, qword [rbx + rax*8]
shr rdx, 0x16
and rdx, 0xfffff
mov rdx, qword [rax + rdx*8]
test byte [rdx], al
test byte [rax], al
mov rax, rcx
shr rcx, 0x10
and rcx, 0x3f
movzx ebx, byte [rdx + rcx + 0x21040]
lea rdx, [rdx + rcx]
lea rdx, [rdx + 0x21040]
shr rax, 0xd
and rax, 7
mov rcx, rax
mov esi, 1
shl esi, cl
test sil, bl
jne 0x420e8f
lock or byte [rdx], sil
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov rax, qword [rax + 0x30]
mov rax, qword [rax + 0xa0]
test byte [rax], al
mov rcx, qword [rsp + 0x30]
add qword [rax + 0x16a8], rcx
mov rcx, qword [rsp + 0x38]
add qword [rax + 0x16b0], rcx
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
cmp word [rbx + 0x5e], 0
je 0x420eea
movzx ecx, byte [rbx + 0x65]
cmp cl, 0x40
sbb rax, rax
shr rdx, cl
and rax, rdx
jmp 0x420df5
movzx ecx, byte [rbx + 0x65]
cmp cl, 0x40
sbb rax, rax
movzx esi, byte [rbx + 0x66]
cmp sil, 0x40
sbb rdi, rdi
shr rdx, cl
and rax, rdx
movzx edx, word [rbx + 0x5c]
imul rax, rdx
mov ecx, esi
shr rax, cl
and rax, rdi
jmp 0x420df5
mov ecx, 0x40
nop
call fcn.00467400
lea rax, [0x004fa999]
mov qword [rsp], rax
mov qword [rsp + 8], 0x2c
call fcn.00436a00
nop
int3
Function at 0x4286c0
Capabilities:
Access peb ldr_data

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x42892e
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
nop
lea rax, [0x005d9670]
mov qword [rsp], rax
call fcn.0040b780
lea rax, [0x005d95e0]
mov qword [rsp], rax
call fcn.00419040
mov rax, qword [rsp + 8]
mov qword [rsp + 0x48], rax
nop
nop
lea rcx, [0x005d9670]
mov qword [rsp], rcx
call fcn.0040b9e0
mov rax, qword [rsp + 0x48]
mov byte [rax + 0xa], 1
lea rdi, [rax + 0x10]
cmp dword [0x005d9940], 0
jne 0x42891f
mov rcx, qword [rsp + 0x68]
mov qword [rax + 0x10], rcx
mov qword [rsp + 0x40], rdi
mov rcx, qword [rsp + 0x70]
mov qword [rax + 0x18], rcx
cmp dword [0x005d9940], 0
nop dword [rax]
jne 0x4288f8
mov rcx, qword [rsp + 0x78]
mov qword [rax + 0x20], rcx
mov rcx, qword [rsp + 0x80]
mov qword [rax + 0x28], rcx
mov rcx, qword [rsp + 0x60]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
call fcn.00428220
cmp byte [rsp + 0x10], 0
je 0x428896
cmp dword [0x005d9728], 0
jne 0x4287b4
mov byte [rsp + 0x88], 1
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov rax, qword [rsp + 0x60]
mov qword [rsp], rax
xorps xmm0, xmm0
movups xmmword [rsp + 8], xmm0
call fcn.004140a0
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov rcx, qword [rax + 0x30]
mov rdx, qword [rsp + 0x18]
nop
inc dword [rcx + 0xd8]
mov rcx, qword [rax + 0x30]
mov qword [rsp + 0x30], rcx
mov rbx, qword [rcx + 0xa0]
test byte [rbx], al
test byte [rax], al
mov qword [rsp], rdx
lea rax, [rbx + 0x1698]
mov qword [rsp + 0x38], rax
mov qword [rsp + 8], rax
call fcn.0041fbe0
mov rax, qword [rsp + 0x40]
mov qword [rsp], rax
mov qword [rsp + 8], 8
lea rax, [0x00590181]
mov qword [rsp + 0x10], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x20], 0
call fcn.0041fa40
nop
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x30]
mov edx, dword [rcx + 0xd8]
lea ebx, [rdx - 1]
mov dword [rcx + 0xd8], ebx
cmp edx, 1
jne 0x4287a2
cmp byte [rax + 0xb1], 0
je 0x4287a2
mov qword [rax + 0x10], 0xfffffffffffffade
jmp 0x4287a2
nop
nop
lea rax, [0x005d9670]
mov qword [rsp], rax
call fcn.0040b780
nop
mov rax, qword [0x005d9610]
sub rax, qword [0x005d95e0]
mov qword [0x005d9610], rax
mov rax, qword [0x005d95f8]
mov rcx, qword [rsp + 0x48]
mov qword [rcx], rax
mov qword [0x005d95f8], rcx
nop
nop
lea rax, [0x005d9670]
mov qword [rsp], rax
call fcn.0040b9e0
mov byte [rsp + 0x88], 0
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
lea rcx, [rax + 0x20]
mov rdi, rcx
mov rbx, qword [rsp + 0x78]
call fcn.00467080
lea rdi, [rax + 0x28]
mov rcx, qword [rsp + 0x80]
call fcn.00467040
jmp 0x42877b
mov rcx, qword [rsp + 0x68]
call fcn.00467040
jmp 0x428748
call fcn.004652e0
jmp fcn.004286c0
Function at 0x459220
Capabilities:
Access peb ldr_data

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x459301
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov qword [rsp + 8], 0
mov qword [rsp + 0x10], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x18], xmm0
movups xmmword [rsp + 0x28], xmm0
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
lea rcx, [0x00461060]
mov qword [rsp + 0x10], rcx
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x18], rcx
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 8]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.00465180
mov rax, qword [rsp + 8]
mov qword [rsp + 0x88], rax
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
nop
ret
call fcn.004652e0
jmp fcn.00459220
Function at 0x466de0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x402e40
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
mov rax, qword [rax + 8]
mov qword [rsp], rcx
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rax
call fcn.00409c80
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0x40], rax
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
call fcn.004652e0
jmp 0x402de0
cmp byte [0x005d96f2], 0
je 0x466dff
mov rax, qword [rsp + 8]
mov rcx, qword [rax + 8]
mov rax, qword [rax]
lea rdx, [rsp + 0x18]
jmp 0x464300
jmp 0x402de0

Function at 0x466e20
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, qword [0x005d99a0]
nop
mov rcx, qword [rsp + 8]
mov ecx, dword [rcx]
mov rdx, qword [rsp + 0x10]
lea rax, [rdx + rax*4]
xor rax, rcx
shl rcx, 0x20
xor rcx, rax
movabs rax, 0xea38ec9079f01541
imul rax, rcx
rol rax, 0x1f
movabs rcx, 0x2723a30d96da1399
imul rcx, rax
mov rax, rcx
shr rcx, 0x1d
xor rax, rcx
movabs rcx, 0x83cf8eadf876d2d7
imul rcx, rax
mov rax, rcx
shr rcx, 0x20
xor rcx, rax
mov qword [rsp + 0x18], rcx
ret
cmp byte [0x005d96f2], 0
je 0x466e5c
mov rax, qword [rsp + 8]
movq xmm0, qword [rsp + 0x10]
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x005d9c00]
aesenc xmm0, xmmword [0x005d9c10]
aesenc xmm0, xmmword [0x005d9c20]
movq qword [rsp + 0x18], xmm0
ret
jmp 0x409f00

Function at 0x466e80
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, qword [0x005d99a0]
mov rcx, qword [rsp + 8]
mov rcx, qword [rcx]
mov rdx, qword [rsp + 0x10]
lea rax, [rdx + rax*8]
xor rcx, rax
movabs rax, 0xea38ec9079f01541
imul rax, rcx
rol rax, 0x1f
movabs rcx, 0x2723a30d96da1399
imul rcx, rax
mov rax, rcx
shr rcx, 0x1d
xor rax, rcx
movabs rcx, 0x83cf8eadf876d2d7
imul rcx, rax
mov rax, rcx
shr rcx, 0x20
xor rax, rcx
mov qword [rsp + 0x18], rax
ret
cmp byte [0x005d96f2], 0
je 0x466ebd
mov rax, qword [rsp + 8]
movq xmm0, qword [rsp + 0x10]
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x005d9c00]
aesenc xmm0, xmmword [0x005d9c10]
aesenc xmm0, xmmword [0x005d9c20]
movq qword [rsp + 0x18], xmm0
ret
jmp 0x409f80

Function at 0x468720
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x30
mov rcx, 0xfffffffffffffff4
mov qword [rsp], rcx
mov rax, qword [sym.imp.kernel32.dll_GetStdHandle]
call rax
mov rcx, rax
mov qword [rsp], rcx
lea rdx, [0x005d9b80]
mov qword [rsp + 8], rdx
lea r8d, [0x005d9704]
mov qword [rsp + 0x10], r8
lea r9, [rsp + 0x28]
mov qword [r9], 0
mov qword [rsp + 0x18], r9
mov qword [rsp + 0x20], 0
mov rax, qword [sym.imp.kernel32.dll_WriteFile]
call rax
add rsp, 0x30
ret
Function at 0x470ce0
Capabilities:
Encode data using base64

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov rdx, qword [rsp + 0x20]
mov rbx, qword [rdx + 8]
lea rsi, [rbx + 0x2e]
imul rsi, rsi, 0xffffffffffffffe4
movabs rax, 0x5816058160581606
mov rcx, rdx
imul rsi
sar rdx, 5
sar rsi, 0x3f
sub rdx, rsi
lea rsi, [rdx + 0x15c]
sar rsi, 0x3f
shr rsi, 0x3d
lea rdx, [rsi + rdx]
lea rdx, [rdx + 0x15c]
sar rdx, 3
cmp rdx, 0x57
jae 0x470db9
lea rsi, [rdx + rdx*2]
lea rdi, [0x0059d040]
mov r8, qword [rdi + rsi*8 + 8]
lea r9, [r8 + rbx]
lea r9, [r9 + 0x40]
cmp r9, 0xffffffffffffffc4
jge 0x470d62
inc rdx
nop
jmp 0x470d38
cmp r9, 0xffffffffffffffe0
jle 0x470d6d
dec rdx
jmp 0x470d38
mov rbx, qword [rdi + rsi*8]
mov rax, qword [rcx]
mov rsi, rdx
mul rbx
shr rax, 0x3f
add rdx, rax
mov qword [rcx], rdx
mov rdx, qword [rcx + 8]
lea rdx, [rdx + r8]
lea rdx, [rdx + 0x40]
mov qword [rcx + 8], rdx
mov rcx, rsi
shl rsi, 3
lea rdx, [rsi - 0x15c]
neg rdx
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rcx
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov rax, rdx
mov ecx, 0x57
call fcn.004673e0
nop
int3
Function at 0x483540
Capabilities:
Hash data using fnv

Disassembly:
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov edx, dword [rsp + 8]
xor ebx, ebx
jmp 0x483561
movzx esi, byte [rax + rbx]
inc rbx
imul edx, edx, 0x1000193
xor edx, esi
cmp rbx, rcx
jl 0x483552
mov dword [rsp + 0x28], edx
ret
Function at 0x1400020d0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000211a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000211a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000211a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000211a
cmp dword [rcx + 0x84], 0xe
jbe 0x14000211a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000211c
xor al, al
add rsp, 0x28
ret
Function at 0x1400170e0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x14001726b
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [str.xF__]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.140034960
xorps xmm15, xmm15
mov r14, qword [0x14059bd20]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x140017145
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x140017154
add rsp, 0x48
pop rbp
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x140017173
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x140017183
cmp rbx, 0x1000
jae 0x14001714b
jmp 0x1400171ed
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x140017195
xor edx, edx
jmp 0x1400171e4
mov rcx, qword [str.xF__]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.140034960
xorps xmm15, xmm15
mov r14, qword [0x14059bd20]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x140017179
jmp 0x140017168
call fcn.140068200
xorps xmm15, xmm15
mov r14, qword [0x14059bd20]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.140039020
lea rax, [0x1402bd702]
mov ebx, 0x18
nop dword [rax]
call fcn.1400398a0
mov rax, qword [rsp + 0x38]
call fcn.1400395e0
lea rax, [0x1402bdf4c]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.1400398a0
mov rax, qword [rsp + 0x30]
call fcn.1400395e0
call fcn.140039260
call fcn.140039080
lea rax, [0x1402c1b1c]
mov ebx, 0x21
call fcn.140037680
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.140064ae0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.1400170e0