joyce8/EMBER2024-capa huggingface dataset:
Function at 0x458e40
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x458eef
push rbp
mov rbp, rsp
sub rsp, 0x58
mov qword [rsp + 0x70], rbx
lea rdx, [rsp + 0x68]
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rsi, [0x00458f40]
mov qword [rsp + 0x10], rsi
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdx
mov rdx, r14
mov qword [rsp + 0x28], rdx
lea rdx, [rsp + 8]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.00461a00
xorps xmm15, xmm15
mov r14, qword [0x005e42e0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
add rsp, 0x58
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00461b40
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp fcn.00458e40
Function at 0x463920
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x403c43
push rbp
mov rbp, rsp
sub rsp, 0x18
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
mov rax, rdx
call fcn.00409720
add rsp, 0x18
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00461b40
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x403c20
cmp byte [0x005e408b], 0
je 0x463935
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp 0x460b80
jmp 0x403c20

Function at 0x463940
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
nop
mov eax, dword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x005e4380]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d124b
mul rcx
xor rax, rdx
nop
nop
ret
cmp byte [0x005e408b], 0
je 0x463975
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x005e4640]
aesenc xmm0, xmmword [0x005e4650]
aesenc xmm0, xmmword [0x005e4660]
movq rax, xmm0
ret
jmp 0x409940

Function at 0x463980
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
nop
mov rax, qword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x005e4380]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
xor rax, rdx
nop
nop
ret
cmp byte [0x005e408b], 0
je 0x4639b6
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x005e4640]
aesenc xmm0, xmmword [0x005e4650]
aesenc xmm0, xmmword [0x005e4660]
movq rax, xmm0
ret
jmp 0x4099a0

Function at 0x4656a0
Capabilities:
Allocate thread local storage

Disassembly:
push rbp
mov rbp, rsp
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x4656d4
mov rcx, 0x28
jmp 0x4656df
shl rcx, 3
add rcx, 0x1480
mov qword [0x005e42e0], rcx
pop rbp
ret

Function at 0x46e6c0
Capabilities:
Encode data using xor

Disassembly:
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdx, qword [rsp + 0x20]
test rdx, 0xf
jne 0x46e72b
mov rax, 0
movdqu xmm0, xmmword [rsi + rax]
movdqu xmm1, xmmword [rcx + rax]
pxor xmm0, xmm1
movdqu xmmword [rbx + rax], xmm0
add rax, 0x10
cmp rdx, rax
jne 0x46e6e4
ret
sub rdx, 1
mov dil, byte [rsi + rdx]
mov al, byte [rcx + rdx]
xor dil, al
mov byte [rbx + rdx], dil
test rdx, 7
jne 0x46e701
cmp rdx, 0
je 0x46e74d
test rdx, 0xf
je 0x46e6dd
test rdx, 7
jne 0x46e701
sub rdx, 8
mov rdi, qword [rsi + rdx]
mov rax, qword [rcx + rdx]
xor rdi, rax
mov qword [rbx + rdx], rdi
cmp rdx, 0x10
jge 0x46e6dd
ret
Function at 0x47be20
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [rsp + 8]
mov rax, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x20]
movups xmm1, xmmword [rax]
movups xmm0, xmmword [rbx]
add rax, 0x10
pxor xmm0, xmm1
sub rcx, 0xc
je 0x47be5f
jb 0x47be74
movups xmm1, xmmword [rax]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesdec xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesdec xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x20]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x30]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x40]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x50]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x60]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x70]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x80]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x90]
aesdeclast xmm0, xmm1
movups xmmword [rdx], xmm0
ret
Function at 0x47bee0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push rbp
mov rbp, rsp
mov rcx, qword [rsp + 0x10]
mov rax, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
add rbx, 0x10
pxor xmm4, xmm4
cmp ecx, 0xc
je 0x47bfb4
jb 0x47c013
movups xmm2, xmmword [rax + 0x10]
movups xmmword [rbx], xmm2
add rbx, 0x10
aeskeygenassist xmm1, xmm2, 1
call fcn.0047bdc0
aeskeygenassist xmm1, xmm0, 1
call fcn.0047bde0
aeskeygenassist xmm1, xmm2, 2
call fcn.0047bdc0
aeskeygenassist xmm1, xmm0, 2
call fcn.0047bde0
aeskeygenassist xmm1, xmm2, 4
call fcn.0047bdc0
aeskeygenassist xmm1, xmm0, 4
call fcn.0047bde0
aeskeygenassist xmm1, xmm2, 8
call fcn.0047bdc0
aeskeygenassist xmm1, xmm0, 8
call fcn.0047bde0
aeskeygenassist xmm1, xmm2, 0x10
call fcn.0047bdc0
aeskeygenassist xmm1, xmm0, 0x10
call fcn.0047bde0
aeskeygenassist xmm1, xmm2, 0x20
call fcn.0047bdc0
aeskeygenassist xmm1, xmm0, 0x20
call fcn.0047bde0
aeskeygenassist xmm1, xmm2, 0x40
call fcn.0047bdc0
jmp 0x47c081
movq xmm2, qword [rax + 0x10]
aeskeygenassist xmm1, xmm2, 1
call fcn.0047bd20
aeskeygenassist xmm1, xmm2, 2
call fcn.0047bd80
aeskeygenassist xmm1, xmm2, 4
call fcn.0047bd20
aeskeygenassist xmm1, xmm2, 8
call fcn.0047bd80
aeskeygenassist xmm1, xmm2, 0x10
call fcn.0047bd20
aeskeygenassist xmm1, xmm2, 0x20
call fcn.0047bd80
aeskeygenassist xmm1, xmm2, 0x40
call fcn.0047bd20
aeskeygenassist xmm1, xmm2, 0x80
call fcn.0047bd80
jmp 0x47c081
aeskeygenassist xmm1, xmm0, 1
call fcn.0047bce0
aeskeygenassist xmm1, xmm0, 2
call fcn.0047bce0
aeskeygenassist xmm1, xmm0, 4
call fcn.0047bce0
aeskeygenassist xmm1, xmm0, 8
call fcn.0047bce0
aeskeygenassist xmm1, xmm0, 0x10
call fcn.0047bce0
aeskeygenassist xmm1, xmm0, 0x20
call fcn.0047bce0
aeskeygenassist xmm1, xmm0, 0x40
call fcn.0047bce0
aeskeygenassist xmm1, xmm0, 0x80
call fcn.0047bce0
aeskeygenassist xmm1, xmm0, 0x1b
call fcn.0047bce0
aeskeygenassist xmm1, xmm0, 0x36
call fcn.0047bce0
sub rbx, 0x10
movups xmm1, xmmword [rbx]
movups xmmword [rdx], xmm1
dec rcx
movups xmm1, xmmword [rbx - 0x10]
aesimc xmm0, xmm1
movups xmmword [rdx + 0x10], xmm0
sub rbx, 0x10
add rdx, 0x10
dec rcx
jne 0x47c08e
movups xmm0, xmmword [rbx - 0x10]
movups xmmword [rdx + 0x10], xmm0
pop rbp
ret
Function at 0x480ea0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x480f6a
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rax
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call fcn.00403b80
xorps xmm15, xmm15
mov r14, qword [0x005e42e0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x480f4f
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x004bc0c0]
xor ebx, ebx
mov rcx, rdx
call fcn.00449fa0
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call fcn.00481c40
inc rbx
cmp rcx, rbx
jae 0x480f3e
mov edi, 1
lea rsi, [0x004bc0c0]
call fcn.0044a080
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x004fdb28]
lea rsi, [0x004fd348]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00461b40
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00480ea0
Function at 0x4a90e0
Capabilities:
Hash data using fnv

Disassembly:
test byte [rax], al
mov rcx, rbx
and ebx, 0x7f
shl rbx, 5
lea rdx, [rax + rbx]
xor eax, eax
jmp 0x4a90f7
inc rax
cmp rax, 4
jge 0x4a910f
lea rbx, [rdx + rax*8]
mov rbx, qword [rbx]
cmp rbx, rcx
jne 0x4a90f4
mov eax, 1
ret
xor eax, eax
movabs rbx, 0xcbf29ce484222325
jmp 0x4a9120
inc rax
cmp rax, 4
jge 0x4a912e
mov rsi, qword [rdx + rax*8]
xor edi, edi
jmp 0x4a9157
and ebx, 3
lea rdx, [rdx + rbx*8]
xchg qword [rdx], rcx
xor eax, eax
ret
movzx r8d, sil
xor rbx, r8
inc rdi
shr rsi, 8
movabs r8, 0x100000001b3
imul rbx, r8
cmp rdi, 8
jl 0x4a913b
jmp 0x4a911d
Function at 0x140001a10
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x24], 0
lea r9, [rsp + 0x24]
mov r8d, dword [rsp + 0x24]
mov rdx, qword [rsp + 0x30]
mov ecx, 0xb
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0xc0000004
jne 0x140001ab3
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, dword [rsp + 0x24]
mov r9d, 4
mov r8d, 0x3000
mov edx, eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x140001a93
xor eax, eax
jmp 0x140001bbb
lea r9, [rsp + 0x24]
mov r8d, dword [rsp + 0x24]
mov rdx, qword [rsp + 0x30]
mov ecx, 0xb
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov dword [rsp + 0x28], eax
jmp 0x140001a48
cmp dword [rsp + 0x28], 0
jge 0x140001ad4
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
jmp 0x140001bbb
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jne 0x140001b00
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
jmp 0x140001bbb
mov dword [rsp + 0x20], 0
jmp 0x140001b14
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x38]
mov eax, dword [rax]
cmp dword [rsp + 0x20], eax
jae 0x140001ba6
mov eax, dword [rsp + 0x20]
imul rax, rax, 0x128
mov rcx, qword [rsp + 0x38]
lea rax, [rcx + rax + 8]
mov ecx, dword [rsp + 0x20]
imul rcx, rcx, 0x128
mov rdx, qword [rsp + 0x38]
movzx ecx, word [rdx + rcx + 0x2e]
lea rax, [rax + rcx + 0x28]
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x140001ba1
mov eax, dword [rsp + 0x20]
imul rax, rax, 0x128
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx + rax + 0x18]
mov qword [rsp + 0x48], rax
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rax, qword [rsp + 0x48]
jmp 0x140001bbb
jmp 0x140001b0a
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
add rsp, 0x58
ret
Function at 0x14000b1f0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x18
mov rax, qword [rsp + 0x20]
mov qword [rsp], rax
mov rax, qword [rsp]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x14000b214
xor eax, eax
jmp 0x14000b242
mov rax, qword [rsp]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 8], rax
mov rax, qword [rsp + 8]
cmp dword [rax], 0x4550
je 0x14000b23d
xor eax, eax
jmp 0x14000b242
mov rax, qword [rsp + 8]
add rsp, 0x18
ret

Function at 0x14000e080
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x68], 0
je 0x14000e0b9
mov r8, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x14000e1a7
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
add byte [rax - 0x77], cl
and al, 0x20

Function at 0x14000e1b0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
cmp qword [rsp + 0x80], 0
jg 0x14000e1d5
xor eax, eax
jmp 0x14000e39b
mov rax, qword [rsp + 0x70]
cmp qword [rax + 0x68], 0
je 0x14000e1fe
mov r8, qword [rsp + 0x80]
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
add cl, ch
popfq
add dword [rax], eax
invalid
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x20], rax
Function at 0x14000f020
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0xa8
mov rax, qword [rsp + 0xb0]
cmp qword [rax + 0x68], 0
je 0x14000f04b
mov rax, qword [rsp + 0xb0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x14000f052
mov al, 1
jmp 0x14000f1ac
mov rax, qword [rsp + 0xb0]
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x50], rax
call fcn.140006cf0
mov dword [rsp + 0x38], eax
mov edx, dword [rsp + 0x38]
mov rcx, qword [rsp + 0xb0]
call qword [rsp + 0x50]
mov dword [rsp + 0x3c], eax
call fcn.140006cf0
mov dword [rsp + 0x40], eax
lea rdx, [rsp + 0x3c]
lea rcx, [rsp + 0x40]
call fcn.140006d00
movzx eax, al
test eax, eax
je 0x14000f0a9
xor al, al
jmp 0x14000f1ac
mov qword [rsp + 0x68], 0x20
mov rax, qword [rsp + 0xb0]
mov rax, qword [rax + 0x68]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x90]
mov rcx, qword [rsp + 0xb0]
add rcx, 0x74
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [rsp + 0x70]
mov rdx, rcx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
je 0x14000f119
cmp dword [rsp + 0x30], 1
je 0x14000f125
cmp dword [rsp + 0x30], 3
je 0x14000f19a
jmp 0x14000f1aa
mov rax, qword [rsp + 0xb0]
mov byte [rax + 0x71], 0
lea rax, [rsp + 0x70]
mov rcx, qword [rsp + 0x60]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
jbe 0x14000f171
mov rax, qword [rsp + 0xb0]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x48]
mov edx, 1
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp qword [rsp + 0x48], rax
je 0x14000f171
xor al, al
jmp 0x14000f1ac
mov rax, qword [rsp + 0xb0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x14000f18b
mov dword [rsp + 0x34], 1
jmp 0x14000f193
mov dword [rsp + 0x34], 0
movzx eax, byte [rsp + 0x34]
jmp 0x14000f1ac
mov rax, qword [rsp + 0xb0]
mov byte [rax + 0x71], 0
mov al, 1
jmp 0x14000f1ac
xor al, al
add rsp, 0xa8
ret
Function at 0x1400eb01a
Capabilities:
Read file on windows

Disassembly:
mov rax, qword [rax]
jmp 0x14016690d
push rax
movzx rax, r9w
lea rax, [0x14002fd47]
jmp 0x14004179b
pop rax
jmp 0x14013c368
xchg qword [rsp], rax
jmp 0x1400e9c51
lea rax, [rax + 0x1e14a9af]
xchg qword [rsp], rax
jmp fcn.14000e1f8

Function at 0x140120e74
Capabilities:
Write file on windows

Disassembly:
lea rax, [rax - 0x49ea8358]
jmp 0x14002e793
lea rax, [rax + 1]
mov qword [rsp + 8], rax
cwde
movzx ax, r14b
lea rax, [0x14001cb09]
jmp 0x140123102
xchg qword [rsp], rax
jmp fcn.14000e14e
push rax
mov rax, qword [rsp + 8]
jmp 0x14002d300
mov rax, qword [rax]
jmp 0x14001fe5b

Function at 0x140189fb6
Capabilities:
Write file on windows

Disassembly:
lea rax, [rax - 0x6979d9fd]
jmp 0x140165aff
xchg qword [rsp], rax
push rax
lea rax, [0x140193bb3]
mov rax, qword [rax]
jmp 0x140134a88
xchg qword [rsp], rax
jmp fcn.14000e0cd
pop rax
jmp 0x140153ee9
Function at 0x41b120
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
sub rsp, 0x18
mov edx, dword [rcx + 4]
lea r8, str.cw
mov ecx, dword [rcx + 0xc]
mov eax, edx
movzx r9d, dl
shr eax, 0x18
movzx r11d, byte [r8 + r9]
movzx r10d, byte [r8 + rax]
mov eax, edx
movzx edx, dh
shr eax, 0x10
movzx r9d, al
movzx eax, byte [r8 + rdx]
movzx edx, cl
shl r10d, 0x18
or r10d, r11d
movzx r11d, byte [r8 + r9]
mov r9d, ecx
shr r9d, 0x18
shl eax, 8
shl r11d, 0x10
or r10d, r11d
movzx r11d, byte [r8 + r9]
mov r9d, ecx
or r10d, eax
movzx eax, byte [r8 + rdx]
shr r9d, 0x10
movzx edx, r9b
movzx ecx, ch
mov r9d, r10d
ror r9d, 8
shl r11d, 0x18
mov dword [rsp + 4], r9d
or r11d, eax
movzx eax, byte [r8 + rdx]
movzx r8d, byte [r8 + rcx]
movd xmm3, dword [rsp + 4]
shl eax, 0x10
shl r8d, 8
or r11d, eax
or r11d, r8d
mov edx, r11d
mov dword [rsp + 0xc], r11d
ror edx, 8
movd xmm1, dword [rsp + 0xc]
mov dword [rsp + 8], edx
movd xmm2, dword [rsp + 8]
mov dword [rsp + 8], r10d
movd xmm0, dword [rsp + 8]
punpckldq xmm1, xmm2
punpckldq xmm0, xmm3
punpcklqdq xmm0, xmm1
add rsp, 0x18
ret
Function at 0x41b800
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, qword [rsp + 0x28]
mov r10, qword [rsp + 0x50]
movdqa xmm3, xmmword [rcx]
mov r11, qword [rsp + 0x58]
movdqa xmm4, xmm3
movdqa xmm2, xmmword [rcx + 0x10]
mov rcx, qword [rsp + 0x38]
pslldq xmm4, 4
movdqa xmm0, xmm4
aeskeygenassist xmm5, xmm2, 1
movaps xmmword [rdx], xmm3
pslldq xmm0, 4
movdqa xmm1, xmm0
mov rdx, qword [rsp + 0x30]
pxor xmm0, xmm4
pslldq xmm1, 4
pshufd xmm5, xmm5, 0xff
movaps xmmword [r8], xmm2
pxor xmm3, xmm0
mov r8, qword [rsp + 0x40]
pxor xmm3, xmm1
pxor xmm5, xmm3
aeskeygenassist xmm3, xmm5, 0
movaps xmmword [r9], xmm5
mov r9, qword [rsp + 0x48]
pshufd xmm4, xmm3, 0xaa
movdqa xmm3, xmm2
pslldq xmm3, 4
movdqa xmm1, xmm3
pslldq xmm1, 4
movdqa xmm0, xmm1
pxor xmm1, xmm3
pslldq xmm0, 4
pxor xmm2, xmm1
movdqa xmm1, xmm5
pxor xmm2, xmm0
pslldq xmm1, 4
movdqa xmm0, xmm1
pxor xmm4, xmm2
pslldq xmm0, 4
pxor xmm1, xmm0
aeskeygenassist xmm2, xmm4, 2
movaps xmmword [rax], xmm4
pshufd xmm3, xmm2, 0xff
movdqa xmm2, xmm0
movdqa xmm0, xmm4
pslldq xmm2, 4
pxor xmm1, xmm2
pslldq xmm0, 4
pxor xmm1, xmm3
movdqa xmm3, xmm1
movdqa xmm1, xmm0
pxor xmm3, xmm5
pslldq xmm1, 4
pxor xmm0, xmm1
aeskeygenassist xmm5, xmm3, 0
movaps xmmword [rdx], xmm3
pshufd xmm2, xmm5, 0xaa
movdqa xmm5, xmm1
movdqa xmm1, xmm3
pslldq xmm5, 4
pxor xmm0, xmm5
pslldq xmm1, 4
pxor xmm0, xmm2
movdqa xmm2, xmm0
movdqa xmm0, xmm1
pxor xmm2, xmm4
pslldq xmm0, 4
pxor xmm1, xmm0
movdqa xmm5, xmm0
aeskeygenassist xmm4, xmm2, 4
pslldq xmm5, 4
pxor xmm1, xmm5
movdqa xmm0, xmm2
movaps xmmword [rcx], xmm2
pshufd xmm4, xmm4, 0xff
pslldq xmm0, 4
pxor xmm1, xmm4
pxor xmm1, xmm3
aeskeygenassist xmm3, xmm1, 0
movaps xmmword [r8], xmm1
pshufd xmm4, xmm3, 0xaa
movdqa xmm3, xmm0
pslldq xmm3, 4
pxor xmm0, xmm3
movdqa xmm5, xmm3
pslldq xmm5, 4
pxor xmm0, xmm5
pxor xmm0, xmm4
movdqa xmm4, xmm1
pxor xmm0, xmm2
pslldq xmm4, 4
aeskeygenassist xmm2, xmm0, 8
movaps xmmword [r9], xmm0
pshufd xmm3, xmm2, 0xff
movdqa xmm2, xmm4
pslldq xmm2, 4
movdqa xmm5, xmm2
pxor xmm2, xmm4
movdqa xmm4, xmm0
pslldq xmm5, 4
pslldq xmm4, 4
pxor xmm2, xmm5
pxor xmm2, xmm3
pxor xmm1, xmm2
movdqa xmm2, xmm4
aeskeygenassist xmm3, xmm1, 0
pslldq xmm2, 4
movdqa xmm5, xmm2
pxor xmm2, xmm4
movaps xmmword [r10], xmm1
pshufd xmm3, xmm3, 0xaa
pslldq xmm5, 4
pxor xmm2, xmm5
pxor xmm2, xmm3
pxor xmm0, xmm2
movaps xmmword [r11], xmm0
ret
Function at 0x44b790
Capabilities:
Check for software breakpoints

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea rdx, [0x0044b440]
mov rbx, rcx
lea rcx, [0x004e5880]
call fcn.00462bd0
xor r8d, r8d
xor edx, edx
mov r9d, 1
mov rcx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
test rax, rax
mov qword [rbx + 0x38], rax
je 0x44b985
mov rcx, rbx
mov qword [rbx + 0x40], 0
lea rbp, [rbx + 0xc8]
call fcn.00463740
lea rax, [rbx + 0xb8]
mov dword [rbx + 8], 0
mov qword [rbx + 0x48], 0
mov qword [rbx + 0x50], 0
mov qword [rbx + 0x58], 0
mov rcx, rbp
mov qword [rbx + 0xb8], rax
mov qword [rbx + 0xc0], rax
lea rax, [rbx + 0x10]
mov qword [rbx + 0x68], 0
mov qword [rbx + 0x60], 0
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x18], rax
lea rax, [rbx + 0x20]
mov qword [rbx + 0x70], 0
mov qword [rbx + 0x78], 0
mov qword [rbx + 0x20], rax
mov qword [rbx + 0x28], rax
mov qword [rbx + 0x80], 0
mov qword [rbx + 0x88], 0
mov qword [rbx + 0x90], 0
mov qword [rbx + 0x98], 0
mov qword [rbx + 0xa0], 0
mov qword [rbx + 0xa8], 0
mov qword [rbx + 0xb0], 0
mov dword [rbx + 0x30], 0
call fcn.00462da0
test eax, eax
mov esi, eax
je 0x44b8e0
mov rcx, qword [rbx + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov qword [rbx + 0x38], 0xffffffffffffffff
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
lea rdx, [rbx + 0xf0]
lea r8, [0x00449110]
mov rcx, rbx
call fcn.0044b220
test eax, eax
mov esi, eax
jne 0x44b9b0
mov eax, dword [rbx + 0x148]
test al, 0x20
je 0x44b933
mov edx, eax
and edx, 0xffffffdf
test al, 1
mov dword [rbx + 0x148], edx
jne 0x44ba24
and eax, 0x40
mov ecx, eax
mov eax, edx
test ecx, ecx
je 0x44b933
mov rdx, qword [rbx + 0xf8]
sub dword [rdx + 8], 1
or al, 0x80
lea rcx, [0x004e5840]
mov dword [rbx + 0x148], eax
call sub.KERNEL32.dll_EnterCriticalSection
mov edi, dword [0x004e586c]
cmp edi, dword [0x004e5868]
je 0x44b9c0
mov rax, qword [0x004e5870]
movsxd rdx, edi
lea rcx, [0x004e5840]
add edi, 1
mov qword [rax + rdx*8], rbx
mov dword [0x004e586c], edi
call fcn.00462e20
mov eax, esi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp fcn.0044c5f0
lea rcx, [0x004e5840]
mov esi, 0xe
call fcn.00462e20
nop dword [rax]
mov rcx, rbp
call sub.KERNEL32.dll_DeleteCriticalSection
jmp 0x44b8ba
lea r12d, [rdi + 8]
mov rcx, qword [0x004e5870]
movsxd rdx, r12d
shl rdx, 3
call fcn.00449780
test rax, rax
je 0x44b99c
mov ecx, dword [0x004e5868]
mov qword [0x004e5870], rax
cmp r12d, ecx
jle 0x44ba12
add edi, 7
movsxd r8, ecx
sub edi, ecx
lea rdx, [rax + r8*8]
add rdi, r8
lea rcx, [rax + rdi*8 + 8]
mov qword [rdx], 0
add rdx, 8
cmp rdx, rcx
jne 0x44ba02
mov dword [0x004e5868], r12d
mov edi, dword [0x004e586c]
jmp 0x44b95c
mov eax, edx
jmp 0x44b933