joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18002c3d0
Capabilities:
Reference absolute stream path on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x30
mov eax, dword [rcx + 0xc]
xor edi, edi
inc eax
mov r14, rdx
movsxd rbp, eax
mov rbx, rcx
movabs rax, 0x1fffffffffffffff
cmp rbp, rax
jbe 0x18002c436
mov qword [rsp + 0x28], 8
lea r9, str.d:_buildob_bora_15653658cayman_glibglib_srcglibgmem.c:333
lea r8, str._s:_overflow_allocating__I64u_I64u_bytes
mov qword [rsp + 0x20], rbp
lea edx, [rdi + 4]
lea rcx, [0x18009cbc8]
call sym.glib_2.0.dll_g_log
jmp 0x18002c434
lea rbp, [rbp*8]
test rbp, rbp
je 0x18002c478
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
jne 0x18002c47a
lea r9, str.d:_buildob_bora_15653658cayman_glibglib_srcglibgmem.c:105
mov qword [rsp + 0x20], rbp
lea r8, str._s:_failed_to_allocate__I64u_bytes
lea edx, [rax + 4]
lea rcx, [0x18009cbc8]
call sym.glib_2.0.dll_g_log
jmp 0x18002c476
xor esi, esi
xor edx, edx
cmp dword [rbx], edx
jbe 0x18002c49e
mov rax, qword [rbx + 0x20]
cmp dword [rax + rdx*4], 2
jb 0x18002c498
mov rax, qword [rbx + 0x18]
mov rax, qword [rax + rdx*8]
mov qword [rsi + rdi*8], rax
inc edi
inc edx
cmp edx, dword [rbx]
jb 0x18002c480
movsxd rax, dword [rbx + 0xc]
mov ebp, edi
cmp rbp, rax
je 0x18002c518
xorps xmm0, xmm0
lea r9, [0x1800ef510]
xorps xmm1, xmm1
lea rdx, str.j__hash_table__nnodes
cvtsi2sd xmm0, rax
lea rcx, str.assertion_failed___s_:___I64i__s__I64i_
cvtsi2sd xmm1, rbp
cvttsd2si rax, xmm0
cvttsd2si r8, xmm1
mov qword [rsp + 0x20], rax
call sym.glib_2.0.dll_g_strdup_printf
lea r9, [0x1800ef530]
mov qword [rsp + 0x20], rax
mov r8d, 0x701
lea rdx, str.d:_buildob_bora_
lea rcx, [0x18009cbc8]
mov rbx, rax
call sym.glib_2.0.dll_g_assertion_message
test rbx, rbx
je 0x18002c518
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rsi + rdi*8], 0
mov rax, rsi
test r14, r14
je 0x18002c52b
mov dword [r14], edi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret

Function at 0x18002c670
Capabilities:
Hash data using djb2

Disassembly:
movzx edx, byte [rcx]
mov eax, 0x1505
test dl, dl
je 0x18002c693
nop dword [rax]
imul eax, eax, 0x21
lea rcx, [rcx + 1]
movsx edx, dl
add eax, edx
movzx edx, byte [rcx]
test dl, dl
jne 0x18002c680
ret
Function at 0x180035100
Capabilities:
Reference absolute stream path on windows

Disassembly:
mov qword [rsp + 0x20], rbp
push rdi
push r14
push r15
sub rsp, 0x30
mov rbp, r9
mov r15, r8
mov rdi, rdx
test rcx, rcx
je 0x180035334
test rdx, rdx
je 0x1800352f8
mov qword [rsp + 0x58], rbx
mov rbx, qword [rcx + 8]
mov qword [rsp + 0x60], rsi
test rbx, rbx
je 0x18003528c
lea r8, [rsp + 0x50]
mov rcx, rbx
call fcn.18002ac40
mov esi, eax
mov rax, qword [rbx + 0x20]
cmp dword [rax + rsi*4], 2
jb 0x1800352a6
mov rax, qword [rbx + 0x28]
mov rsi, qword [rax + rsi*8]
test rsi, rsi
je 0x1800352a6
mov rdx, qword [rsi + 0x10]
xor edi, edi
test rdx, rdx
je 0x18003519b
nop dword [rax]
mov rax, qword [rdx]
lea rcx, [rdi + 1]
mov rdx, qword [rdx + 8]
cmp qword [rax], 0
cmove rcx, rdi
mov rdi, rcx
test rdx, rdx
jne 0x180035180
lea rax, [rdi + 1]
movabs rcx, 0x1fffffffffffffff
cmp rax, rcx
jbe 0x1800351e2
mov qword [rsp + 0x28], 8
lea r9, str.d:_buildob_bora_15653658cayman_glibglib_srcglibgmem.c:333
lea r8, str._s:_overflow_allocating__I64u_I64u_bytes
mov qword [rsp + 0x20], rax
mov edx, 4
lea rcx, [0x18009cbc8]
call sym.glib_2.0.dll_g_log
nop dword [rax + rax]
jmp 0x1800351e0
lea rbx, [rax*8]
test rbx, rbx
je 0x180035224
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r14, rax
test rax, rax
jne 0x180035227
lea r9, str.d:_buildob_bora_15653658cayman_glibglib_srcglibgmem.c:105
mov qword [rsp + 0x20], rbx
lea r8, str._s:_failed_to_allocate__I64u_bytes
lea edx, [rax + 4]
lea rcx, [0x18009cbc8]
call sym.glib_2.0.dll_g_log
jmp 0x180035222
xor r14d, r14d
mov rbx, qword [rsi + 0x10]
test rbx, rbx
je 0x180035260
lea rsi, [rdi - 1]
lea rsi, [r14 + rsi*8]
nop dword [rax + rax]
mov rax, qword [rbx]
mov rcx, qword [rax]
test rcx, rcx
je 0x180035257
call sym.glib_2.0.dll_g_strdup
mov qword [rsi], rax
sub rsi, 8
mov rbx, qword [rbx + 8]
test rbx, rbx
jne 0x180035240
mov qword [r14 + rdi*8], 0
test r15, r15
je 0x180035270
mov qword [r15], rdi
mov rax, r14
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
lea r8, [0x1800ef200]
lea rdx, [0x1800ef350]
lea rcx, [0x18009cbc8]
call sym.glib_2.0.dll_g_return_if_fail_warning
call fcn.18002a6c0
call fcn.18002aa30
test eax, eax
jne 0x1800352bd
lea rbx, str.Key_file_does_not_have_group__s
jmp 0x1800352d4
lea rdx, str.Key_file_does_not_have_group__s
lea rcx, str.glib20
call qword [sym.imp.intl.dll_libintl_dgettext]
mov rbx, rax
call sym.glib_2.0.dll_g_key_file_error_quark
mov edx, eax
mov qword [rsp + 0x20], rdi
mov r9, rbx
mov r8d, 4
mov rcx, rbp
call sym.glib_2.0.dll_g_set_error
xor eax, eax
jmp 0x180035273
lea rax, str.group_name___NULL
lea r9, [0x1800f0d08]
mov qword [rsp + 0x20], rax
lea r8, str._s:_assertion__s_failed
mov edx, 8
lea rcx, [0x18009cbc8]
call sym.glib_2.0.dll_g_log
mov rbp, qword [rsp + 0x68]
xor eax, eax
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
lea rax, str.key_file___NULL
jmp 0x1800352ff
Function at 0x1800575a0
Capabilities:
Reference absolute stream path on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
mov rax, qword [rcx + 0x20]
mov rsi, r8
mov dword [rsp + 0x30], edx
mov rbp, rcx
test byte [rax + 0x20], 1
jne 0x1800576de
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [r8 + rbx], 0
jne 0x1800575d3
xor edi, edi
add rbx, 1
je 0x18005761a
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdx, rax
test rax, rax
jne 0x18005761d
lea r9, str.d:_buildob_bora_15653658cayman_glibglib_srcglibgmem.c:105
mov qword [rsp + 0x20], rbx
lea r8, str._s:_failed_to_allocate__I64u_bytes
lea edx, [rdi + 4]
lea rcx, [0x18009cbc8]
call sym.glib_2.0.dll_g_log
jmp 0x180057618
mov rdx, rdi
movzx ecx, byte [rsi]
mov qword [rsp + 0x38], rdx
test cl, cl
je 0x18005767e
nop dword [rax]
lea eax, [rcx - 0x41]
mov r9d, 0x20
cmp al, 0x19
lea r8d, [rcx + 0x28]
lea eax, [rcx + 0x40]
mov r10d, 0x20
cmova r9d, edi
cmp al, 0x16
cmova r10d, edi
cmp r8b, 6
ja 0x18005765b
movzx ecx, byte [rsi]
cmp r8b, 6
mov eax, 0x20
cmova eax, edi
inc rsi
or al, r9b
or al, cl
or al, r10b
mov byte [rdx], al
inc rdx
movzx ecx, byte [rsi]
test cl, cl
jne 0x180057630
mov byte [rdx], dil
mov rbx, qword [rbp + 0x58]
test rbx, rbx
je 0x1800576b2
lea r8, [rsp + 0x68]
mov rcx, rbx
lea rdx, [rsp + 0x30]
call fcn.18002ac40
mov ecx, eax
mov rax, qword [rbx + 0x20]
cmp dword [rax + rcx*4], 2
jb 0x1800576cc
mov rax, qword [rbx + 0x28]
mov rdi, qword [rax + rcx*8]
jmp 0x1800576cc
lea r8, [0x1800ef200]
lea rdx, [0x1800ef350]
lea rcx, [0x18009cbc8]
call sym.glib_2.0.dll_g_return_if_fail_warning
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x180057730
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x180057730
mov rbx, qword [rcx + 0x58]
mov qword [rsp + 0x38], rsi
test rbx, rbx
je 0x180057714
lea r8, [rsp + 0x68]
mov rcx, rbx
lea rdx, [rsp + 0x30]
call fcn.18002ac40
mov ecx, eax
mov rax, qword [rbx + 0x20]
cmp dword [rax + rcx*4], 2
jb 0x18005772e
mov rax, qword [rbx + 0x28]
mov rax, qword [rax + rcx*8]
jmp 0x180057733
lea r8, [0x1800ef200]
lea rdx, [0x1800ef350]
lea rcx, [0x18009cbc8]
call sym.glib_2.0.dll_g_return_if_fail_warning
xor edi, edi
mov rax, rdi
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x180097160
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rdi
sub rsp, 0x38
mov r8, rdx
lea r9, [rsp + 0x60]
lea rdx, [rsp + 0x20]
mov rbx, rcx
call fcn.180097600
mov rdi, rax
test rax, rax
jne 0x18009719c
lea eax, [rdi - 1]
add rsp, 0x38
pop rdi
pop rbx
ret
mov r8, qword [rsp + 0x20]
mov r9, rbx
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov eax, ebx
add rsp, 0x38
pop rdi
pop rbx
ret

Function at 0x180097260
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rbx, rdx
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r9, rbx
lea rdx, [rsp + 0x40]
mov r8, rdi
mov rsi, rax
call fcn.180097600
mov rdi, rax
test rax, rax
jne 0x1800972ae
lea eax, [rdi - 1]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov r8, qword [rsp + 0x40]
mov r9, rsi
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rsi, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x4047a0
Capabilities:
Access peb ldr_data

Disassembly:
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov qword [rsp + 0x60], rax
mov rcx, qword [rax + 0x30]
cmp qword [rcx + 0x90], rax
jne 0x404944
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
mov rcx, qword [rcx + 0x30]
nop
inc dword [rcx + 0x244]
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
mov rdx, qword [rcx + 0x30]
nop
mov rbx, rcx
mov qword [rdx + 0x138], rcx
mov rcx, qword [rbx + 0x30]
mov qword [rbx + 0xd8], rcx
mov rcx, qword [rax + 0x30]
movups xmm0, xmmword [rcx + 0x2d8]
movups xmmword [rsp + 0x20], xmm0
movups xmm0, xmmword [rcx + 0x2e8]
movups xmmword [rsp + 0x30], xmm0
movups xmm0, xmmword [rcx + 0x2f8]
movups xmmword [rsp + 0x40], xmm0
mov rcx, qword [rax + 0x70]
mov qword [rsp + 0x50], rcx
mov rdx, qword [rax + 0x78]
mov qword [rsp + 0x18], rdx
call fcn.00466e60
mov rax, qword [rsp + 0x60]
mov rcx, qword [rax + 0x30]
mov byte [rcx + 0xe8], 0
mov rcx, qword [rax + 0x30]
xor edx, edx
xchg dword [rcx + 0x348], edx
mov rcx, qword [rsp + 0x78]
mov qword [rsp], rcx
mov rcx, qword [rsp + 0x80]
mov qword [rsp + 8], rcx
mov rcx, qword [rsp + 0x88]
mov qword [rsp + 0x10], rcx
call fcn.004049a0
mov rax, qword [rsp + 0x60]
mov rcx, qword [rax + 0x30]
mov qword [rsp + 0x58], rcx
jmp 0x4048cf
nop
mov rax, qword [0x0084bbf8]
mov qword [rsp], rax
mov dword [rsp + 8], 0
call fcn.0046dd40
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
mov rdx, rax
xor eax, eax
mov ebx, 1
lock cmpxchg dword [rcx + 0x348], ebx
sete sil
test sil, sil
je 0x4048ac
mov rax, qword [rdx + 0x30]
mov byte [rax + 0xe8], 1
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x18]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
call fcn.00443860
mov rax, qword [rsp + 0x60]
mov rax, qword [rax + 0x30]
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rax + 0x2d8], xmm0
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rax + 0x2e8], xmm0
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rax + 0x2f8], xmm0
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
call fcn.0043a980
lea rax, [0x006aa9ce]
mov qword [rsp], rax
mov qword [rsp + 8], 0x1e
nop dword [rax]
call fcn.0043b400
call fcn.0043aa20
mov dword [rsp], 2
call fcn.00434880
mov rax, qword [rsp + 0x60]
nop dword [rax + rax]
jmp 0x4047d4
Function at 0x423020
Capabilities:
Hash data using murmur3

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
cmp byte [0x008916c5], 0
jne 0x423185
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
sub rdx, qword [rbx + 0x18]
nop
test rdx, rdx
jne 0x42312e
xor eax, eax
nop
nop
nop
mov rcx, rax
shr rax, 3
and rcx, 7
mov edx, 1
shl edx, cl
nop
add rax, qword [rbx + 0x50]
lock or byte [rax], dl
nop
nop
mov rcx, qword [rbx + 0x18]
nop
movabs rdx, 0x800000000000
lea rax, [rdx + rcx]
mov rdx, rax
shr rax, 0x2a
cmp rax, 0x40
jae 0x42317a
lea rbx, [0x00873558]
mov rax, qword [rbx + rax*8]
shr rdx, 0x16
and rdx, 0xfffff
mov rdx, qword [rax + rdx*8]
test byte [rdx], al
test byte [rax], al
mov rax, rcx
shr rcx, 0x10
and rcx, 0x3f
movzx ebx, byte [rdx + rcx + 0x21040]
lea rdx, [rdx + rcx]
lea rdx, [rdx + 0x21040]
shr rax, 0xd
and rax, 7
mov rcx, rax
mov esi, 1
shl esi, cl
test sil, bl
jne 0x4230ef
lock or byte [rdx], sil
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov rax, qword [rax + 0x30]
mov rax, qword [rax + 0xa0]
test byte [rax], al
mov rcx, qword [rsp + 0x30]
add qword [rax + 0x16a8], rcx
mov rcx, qword [rsp + 0x38]
add qword [rax + 0x16b0], rcx
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
cmp word [rbx + 0x5e], 0
je 0x42314a
movzx ecx, byte [rbx + 0x65]
cmp cl, 0x40
sbb rax, rax
shr rdx, cl
and rax, rdx
jmp 0x423055
movzx ecx, byte [rbx + 0x65]
cmp cl, 0x40
sbb rax, rax
movzx esi, byte [rbx + 0x66]
cmp sil, 0x40
sbb rdi, rdi
shr rdx, cl
and rax, rdx
movzx edx, word [rbx + 0x5c]
imul rax, rdx
mov ecx, esi
shr rax, cl
and rax, rdi
jmp 0x423055
mov ecx, 0x40
nop
call fcn.0046c700
lea rax, [0x006af337]
mov qword [rsp], rax
mov qword [rsp + 8], 0x2c
call fcn.004391a0
nop
int3
Function at 0x42a560
Capabilities:
Access peb ldr_data

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x42a7ce
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
nop
lea rax, [0x00879f10]
mov qword [rsp], rax
call fcn.0040c0a0
lea rax, [0x00879e80]
mov qword [rsp], rax
call fcn.0041b360
mov rax, qword [rsp + 8]
mov qword [rsp + 0x48], rax
nop
nop
lea rcx, [0x00879f10]
mov qword [rsp], rcx
call fcn.0040c300
mov rax, qword [rsp + 0x48]
mov byte [rax + 0xa], 1
lea rdi, [rax + 0x10]
cmp dword [0x00891a60], 0
jne 0x42a7bf
mov rcx, qword [rsp + 0x68]
mov qword [rax + 0x10], rcx
mov qword [rsp + 0x40], rdi
mov rcx, qword [rsp + 0x70]
mov qword [rax + 0x18], rcx
cmp dword [0x00891a60], 0
nop dword [rax]
jne 0x42a798
mov rcx, qword [rsp + 0x78]
mov qword [rax + 0x20], rcx
mov rcx, qword [rsp + 0x80]
mov qword [rax + 0x28], rcx
mov rcx, qword [rsp + 0x60]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
call fcn.0042a0c0
cmp byte [rsp + 0x10], 0
je 0x42a736
cmp dword [0x0089170c], 0
jne 0x42a654
mov byte [rsp + 0x88], 1
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov rax, qword [rsp + 0x60]
mov qword [rsp], rax
xorps xmm0, xmm0
movups xmmword [rsp + 8], xmm0
call fcn.00415d20
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov rcx, qword [rax + 0x30]
mov rdx, qword [rsp + 0x18]
nop
inc dword [rcx + 0xd8]
mov rcx, qword [rax + 0x30]
mov qword [rsp + 0x30], rcx
mov rbx, qword [rcx + 0xa0]
test byte [rbx], al
test byte [rax], al
mov qword [rsp], rdx
lea rax, [rbx + 0x1698]
mov qword [rsp + 0x38], rax
mov qword [rsp + 8], rax
call fcn.004220c0
mov rax, qword [rsp + 0x40]
mov qword [rsp], rax
mov qword [rsp + 8], 8
lea rax, [0x00813161]
mov qword [rsp + 0x10], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x20], 0
call fcn.00421f20
nop
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x30]
mov edx, dword [rcx + 0xd8]
lea ebx, [rdx - 1]
mov dword [rcx + 0xd8], ebx
cmp edx, 1
jne 0x42a642
cmp byte [rax + 0xb1], 0
je 0x42a642
mov qword [rax + 0x10], 0xfffffffffffffade
jmp 0x42a642
nop
nop
lea rax, [0x00879f10]
mov qword [rsp], rax
call fcn.0040c0a0
nop
mov rax, qword [0x00879eb0]
sub rax, qword [0x00879e80]
mov qword [0x00879eb0], rax
mov rax, qword [0x00879e98]
mov rcx, qword [rsp + 0x48]
mov qword [rcx], rax
mov qword [0x00879e98], rcx
nop
nop
lea rax, [0x00879f10]
mov qword [rsp], rax
call fcn.0040c300
mov byte [rsp + 0x88], 0
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
lea rcx, [rax + 0x20]
mov rdi, rcx
mov rbx, qword [rsp + 0x78]
call fcn.0046c380
lea rdi, [rax + 0x28]
mov rcx, qword [rsp + 0x80]
call fcn.0046c340
jmp 0x42a61b
mov rcx, qword [rsp + 0x68]
call fcn.0046c340
jmp 0x42a5e8
call fcn.0046a500
jmp fcn.0042a560
Function at 0x455b20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov rcx, qword [rsp + 0x28]
test rcx, rcx
jbe 0x455cd9
mov rdx, qword [rsp + 0x20]
movzx ebx, byte [rdx]
test ebx, ebx
jne 0x455b56
movzx esi, byte [rsp + 0x48]
test sil, sil
je 0x455c87
bt ebx, 7
nop word [rax + rax]
jae 0x455c79
xor eax, eax
xor ebx, ebx
xor esi, esi
jmp 0x455b80
lea esi, [rcx + 7]
mov rcx, rax
mov eax, r8d
nop word [rax + rax]
cmp rcx, rax
jbe 0x455cd4
movzx edi, byte [rax + rdx]
lea r8d, [rax + 1]
mov r9d, edi
and edi, 0x7f
mov rax, rcx
mov ecx, esi
shl edi, cl
or ebx, edi
test r9b, 0x80
jne 0x455b6e
mov esi, ebx
and ebx, 1
neg ebx
shr esi, 1
xor ebx, esi
mov rsi, qword [rsp + 0x40]
add dword [rsi], ebx
nop dword [rax + rax]
cmp rax, r8
jb 0x455cc9
sub rax, r8
mov rbx, qword [rsp + 0x30]
sub rbx, r8
mov rsi, rbx
neg rbx
sar rbx, 0x3f
and r8, rbx
lea rbx, [rdx + r8]
test rax, rax
jbe 0x455cbf
movzx edx, byte [rdx + r8]
bt edx, 7
jae 0x455c71
xor ecx, ecx
xor edx, edx
xor edi, edi
nop
jmp 0x455c08
lea edi, [rcx + 7]
mov ecx, r9d
cmp rax, rcx
jbe 0x455cb2
movzx r8d, byte [rcx + rbx]
lea r9d, [rcx + 1]
mov r10d, r8d
and r8d, 0x7f
mov ecx, edi
shl r8d, cl
or edx, r8d
test r10b, 0x80
jne 0x455c02
cmp rax, r9
jb 0x455ca7
mov rcx, qword [rsp + 0x38]
add qword [rcx], rdx
sub rsi, r9
mov rcx, rsi
neg rsi
sar rsi, 0x3f
and rsi, r9
lea rdx, [rbx + rsi]
mov qword [rsp + 0x50], rdx
sub rax, r9
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rcx
mov byte [rsp + 0x68], 1
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov r9d, 1
jmp 0x455c2f
mov rax, rcx
mov r8d, 1
jmp 0x455ba6
mov qword [rsp + 0x50], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov byte [rsp + 0x68], 0
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov rcx, rax
mov eax, r9d
call fcn.0046c7a0
mov rdx, rax
mov eax, ecx
mov rcx, rdx
call fcn.0046c6e0
mov rcx, rax
xor eax, eax
call fcn.0046c6e0
mov rcx, rax
mov eax, r8d
call fcn.0046c7a0
call fcn.0046c6e0
xor eax, eax
nop dword [rax + rax]
call fcn.0046c6e0
nop
int3

Function at 0x45d2c0
Capabilities:
Access peb ldr_data

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x45d3a1
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov qword [rsp + 8], 0
mov qword [rsp + 0x10], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x18], xmm0
movups xmmword [rsp + 0x28], xmm0
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
lea rcx, [0x00465280]
mov qword [rsp + 0x10], rcx
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x18], rcx
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 8]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.0046a3a0
mov rax, qword [rsp + 8]
mov qword [rsp + 0x88], rax
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
nop
ret
call fcn.0046a500
jmp fcn.0045d2c0
Function at 0x46c0e0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x403200
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
mov rax, qword [rax + 8]
mov qword [rsp], rcx
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rax
call fcn.0040a3a0
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0x40], rax
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
call fcn.0046a500
jmp 0x4031a0
cmp byte [0x008916c4], 0
je 0x46c0ff
mov rax, qword [rsp + 8]
mov rcx, qword [rax + 8]
mov rax, qword [rax]
lea rdx, [rsp + 0x18]
jmp 0x469520
jmp 0x4031a0

Function at 0x46c120
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, qword [0x00891ae0]
nop
mov rcx, qword [rsp + 8]
mov ecx, dword [rcx]
mov rdx, qword [rsp + 0x10]
lea rax, [rdx + rax*4]
xor rax, rcx
shl rcx, 0x20
xor rcx, rax
movabs rax, 0xea38ec9079f01541
imul rax, rcx
rol rax, 0x1f
movabs rcx, 0x2723a30d96da1399
imul rcx, rax
mov rax, rcx
shr rcx, 0x1d
xor rcx, rax
movabs rax, 0x83cf8eadf876d2d7
imul rax, rcx
mov rcx, rax
shr rax, 0x20
xor rax, rcx
mov qword [rsp + 0x18], rax
ret
cmp byte [0x008916c4], 0
je 0x46c15c
mov rax, qword [rsp + 8]
movq xmm0, qword [rsp + 0x10]
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x00891da0]
aesenc xmm0, xmmword [0x00891db0]
aesenc xmm0, xmmword [0x00891dc0]
movq qword [rsp + 0x18], xmm0
ret
jmp 0x40a620

Function at 0x46c180
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, qword [0x00891ae0]
mov rcx, qword [rsp + 8]
mov rcx, qword [rcx]
mov rdx, qword [rsp + 0x10]
lea rax, [rdx + rax*8]
xor rcx, rax
movabs rax, 0xea38ec9079f01541
imul rax, rcx
rol rax, 0x1f
movabs rcx, 0x2723a30d96da1399
imul rcx, rax
mov rax, rcx
shr rcx, 0x1d
xor rax, rcx
movabs rcx, 0x83cf8eadf876d2d7
imul rcx, rax
mov rax, rcx
shr rcx, 0x20
xor rax, rcx
mov qword [rsp + 0x18], rax
ret
cmp byte [0x008916c4], 0
je 0x46c1bd
mov rax, qword [rsp + 8]
movq xmm0, qword [rsp + 0x10]
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x00891da0]
aesenc xmm0, xmmword [0x00891db0]
aesenc xmm0, xmmword [0x00891dc0]
movq qword [rsp + 0x18], xmm0
ret
jmp 0x40a6a0

Function at 0x46da20
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x30
mov rcx, 0xfffffffffffffff4
mov qword [rsp], rcx
mov rax, qword [sym.imp.kernel32.dll_GetStdHandle]
call rax
mov rcx, rax
mov qword [rsp], rcx
lea rdx, [0x00891d20]
mov qword [rsp + 8], rdx
lea r8d, [0x008916e4]
mov qword [rsp + 0x10], r8
lea r9, [rsp + 0x28]
mov qword [r9], 0
mov qword [rsp + 0x18], r9
mov qword [rsp + 0x20], 0
mov rax, qword [sym.imp.kernel32.dll_WriteFile]
call rax
add rsp, 0x30
ret
Function at 0x48eea0
Capabilities:
Encode data using base64

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov rdx, qword [rsp + 0x20]
mov rbx, qword [rdx + 8]
lea rsi, [rbx + 0x2e]
imul rsi, rsi, 0xffffffffffffffe4
movabs rax, 0x5816058160581606
mov rcx, rdx
imul rsi
sar rdx, 5
sar rsi, 0x3f
sub rdx, rsi
lea rsi, [rdx + 0x15c]
sar rsi, 0x3f
shr rsi, 0x3d
lea rdx, [rsi + rdx]
lea rdx, [rdx + 0x15c]
sar rdx, 3
cmp rdx, 0x57
jae 0x48ef79
lea rsi, [rdx + rdx*2]
lea rdi, [0x00826380]
mov r8, qword [rdi + rsi*8 + 8]
lea r9, [r8 + rbx]
lea r9, [r9 + 0x40]
cmp r9, 0xffffffffffffffc4
jge 0x48ef22
inc rdx
nop
jmp 0x48eef8
cmp r9, 0xffffffffffffffe0
jle 0x48ef2d
dec rdx
jmp 0x48eef8
mov rbx, qword [rdi + rsi*8]
mov rax, qword [rcx]
mov rsi, rdx
mul rbx
shr rax, 0x3f
add rdx, rax
mov qword [rcx], rdx
mov rdx, qword [rcx + 8]
lea rdx, [rdx + r8]
lea rdx, [rdx + 0x40]
mov qword [rcx + 8], rdx
mov rcx, rsi
shl rsi, 3
lea rdx, [rsi - 0x15c]
neg rdx
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rcx
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov rax, rdx
mov ecx, 0x57
call fcn.0046c6e0
nop
int3
Function at 0x49bf60
Capabilities:
Hash data using fnv

Disassembly:
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov edx, dword [rsp + 8]
xor ebx, ebx
jmp 0x49bf81
movzx esi, byte [rax + rbx]
inc rbx
imul edx, edx, 0x1000193
xor edx, esi
cmp rcx, rbx
jg 0x49bf72
mov dword [rsp + 0x28], edx
ret

Function at 0x4ebde0
Capabilities:
Encode data using xor

Disassembly:
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdx, qword [rsp + 0x20]
test rdx, 0xf
jne 0x4ebe4b
mov rax, 0
movdqu xmm0, xmmword [rsi + rax]
movdqu xmm1, xmmword [rcx + rax]
pxor xmm0, xmm1
movdqu xmmword [rbx + rax], xmm0
add rax, 0x10
cmp rdx, rax
jne 0x4ebe04
ret
sub rdx, 1
mov dil, byte [rsi + rdx]
mov al, byte [rcx + rdx]
xor dil, al
mov byte [rbx + rdx], dil
test rdx, 7
jne 0x4ebe21
cmp rdx, 0
je 0x4ebe6d
test rdx, 0xf
je 0x4ebdfd
test rdx, 7
jne 0x4ebe21
sub rdx, 8
mov rdi, qword [rsi + rdx]
mov rax, qword [rcx + rdx]
xor rdi, rax
mov qword [rbx + rdx], rdi
cmp rdx, 0x10
jge 0x4ebdfd
ret