joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800e3444
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, r8
mov rdi, rdx
mov rsi, rcx
mov qword [rcx + 0xe0], rdx
test rdx, 0xffffffffffff0000
jne 0x1800e3483
cmp dword [rcx + 0xd8], 0
jne 0x1800e3483
movzx eax, dx
mov dword [rcx + 0xd8], eax
call fcn.18000a794
mov r8d, 5
mov rdx, rdi
mov rbx, qword [rax + 0x18]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rcx, rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r9, rbx
mov r8, rbp
mov rdx, rax
mov rcx, rsi
mov rdi, rax
call fcn.1800e33e8
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1800f025c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x20
xor ebx, ebx
mov rdi, r8
mov rsi, rdx
mov r13, rcx
test r8, r8
jne 0x1800f028d
call fcn.18000a794
mov rdi, qword [rax + 0x18]
mov r8, qword [0x180380290]
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbp, rax
test rax, rax
jne 0x1800f02ac
xor eax, eax
jmp 0x1800f02f8
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
test rax, rax
je 0x1800f02a8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r12, rax
test rax, rax
je 0x1800f02ed
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rdx, r12
mov rcx, r13
mov r8d, eax
call fcn.1800f0120
mov ebx, eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r13
pop r12
pop rdi
ret
Function at 0x18010e174
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0xd0
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rax, qword [0x180377128]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov edi, r8d
mov r13, rdx
mov r12, rcx
xor r14d, r14d
mov eax, r14d
test r8d, r8d
setne al
test eax, eax
jne 0x18010e1c0
call fcn.18000d53c
int3
call fcn.18000a794
mov rbx, qword [rax + 0x18]
movzx edx, di
mov r8d, 0xf1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
jne 0x18010e1e7
xor eax, eax
jmp 0x18010e286
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbx, rax
test rax, rax
je 0x18010e1e0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
test rax, rax
jne 0x18010e217
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeResource]
jmp 0x18010e1e0
mov ebp, r14d
cmp r14w, word [rax + 6]
jae 0x18010e278
lea rsi, [rax + 8]
movzx edx, word [rsi]
test edx, edx
je 0x18010e26a
cmp edx, 0xffffffff
je 0x18010e26a
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
xor r9d, r9d
or r8d, 0xffffffff
lea rcx, [rsp + 0x40]
call fcn.1800f613c
nop
or r9d, 0xffffffff
mov r8, rax
mov rdx, r13
mov rcx, r12
call fcn.18010dc58
nop
lea rcx, [rsp + 0x40]
call fcn.1800f461c
inc ebp
add rsi, 2
movzx ecx, word [rdi + 6]
cmp ebp, ecx
jl 0x18010e225
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, 1
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.1802250f0
add rsp, 0xd0
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x180115c7c
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
cmp dword [rcx + 0x28], ebx
je 0x180115c8d
xor eax, eax
jmp 0x180115cbb
mov rcx, qword [rcx + 8]
lea rax, [rsp + 0x40]
mov r9d, 4
mov dword [rsp + 0x40], r8d
mov dword [rsp + 0x28], r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
sete bl
mov eax, ebx
add rsp, 0x30
pop rbx
ret

Function at 0x180115e50
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
cmp dword [rcx + 0x28], ebx
je 0x180115e61
xor eax, eax
jmp 0x180115e85
mov rcx, qword [rcx + 8]
mov dword [rsp + 0x28], r9d
mov qword [rsp + 0x20], r8
mov r9d, 3
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
sete bl
mov eax, ebx
add rsp, 0x30
pop rbx
ret

Function at 0x180115e8c
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
sub rsp, 0x38
mov rcx, qword [rcx + 8]
lea rax, [r11 + 8]
lea r9, [r11 + 0x20]
mov qword [r11 - 0x10], rax
mov qword [r11 - 0x18], r8
xor r8d, r8d
mov dword [rsp + 0x40], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor edx, edx
test eax, eax
jne 0x180115ece
mov ecx, dword [rsp + 0x58]
sub ecx, 4
neg ecx
sbb eax, eax
and eax, 0xd
test eax, eax
sete dl
mov eax, edx
add rsp, 0x38
ret
Function at 0x180115fe0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rdi, r9
mov rbx, r8
mov rsi, rdx
mov rbp, rcx
test rdx, rdx
jne 0x18011600b
call fcn.18000d53c
int3
test rbx, rbx
jne 0x180116016
call fcn.18000d53c
int3
test r9, r9
jne 0x180116021
call fcn.18000d53c
int3
and qword [r8], 0
and dword [r9], 0
mov rcx, qword [rcx + 8]
mov qword [rsp + 0x28], r9
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x48]
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1801160a4
cmp dword [rsp + 0x48], 3
jne 0x1801160a4
test eax, eax
jne 0x1801160a4
cmp dword [rdi], eax
je 0x1801160a4
mov ecx, dword [rdi]
call fcn.180005518
lea r9, [rsp + 0x48]
xor r8d, r8d
mov qword [rbx], rax
mov rcx, qword [rbp + 8]
mov rdx, rsi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x180116098
cmp dword [rsp + 0x48], 3
jne 0x180116098
test eax, eax
jne 0x180116098
mov eax, 1
jmp 0x1801160a6
mov rcx, qword [rbx]
call fcn.18000555c
and qword [rbx], 0
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret

Function at 0x1801161b0
Capabilities:
Delete registry value

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx + 8]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
xor ecx, ecx
test eax, eax
sete cl
mov eax, ecx
add rsp, 0x28
ret

Function at 0x1801a4bbc
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
test byte [rdx + 4], 1
mov esi, r8d
mov rbx, rdx
mov rbp, rcx
je 0x1801a4be5
mov rdi, qword [rdx + 0x10]
jmp 0x1801a4c36
mov rdx, qword [rdx + 0x10]
mov rcx, qword [rbx + 8]
mov r8d, 5
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdi, rax
test rax, rax
jne 0x1801a4c06
call fcn.180010278
mov rcx, qword [rbx + 8]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rdi, rax
test rax, rax
jne 0x1801a4c20
call fcn.180010278
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
test rax, rax
jne 0x1801a4c36
call fcn.180010278
call fcn.18000a794
cmp qword [rax + 0x68], 0
je 0x1801a4c50
mov rdx, rdi
mov rcx, rbp
call fcn.1801a2e90
mov rdi, rax
mov edx, esi
mov rcx, rdi
call fcn.1801a49fc
mov rcx, qword [rbp + 0xe8]
mov rsi, rax
test rcx, rcx
je 0x1801a4c77
call qword [sym.imp.KERNEL32.dll_GlobalFree]
and qword [rbp + 0xe8], 0
test rsi, rsi
je 0x1801a4c86
mov rdi, rsi
mov qword [rbp + 0xe8], rsi
or dword [rbx + 4], 1
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov qword [rbx + 0x10], rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1801c3328
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
test rdx, rdx
jne 0x1801c3351
xor eax, eax
jmp 0x1801c33d1
test rbx, rbx
je 0x1801c334a
test r9, r9
jne 0x1801c3369
call fcn.18000a794
mov r9, qword [rax + 0x18]
test r9, r9
je 0x1801c334a
mov r8, rbx
mov rdx, rsi
mov rcx, r9
mov qword [rdi + 0x10], r9
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
je 0x1801c334a
mov rcx, qword [rdi + 0x10]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebp, eax
test eax, eax
je 0x1801c334a
mov rcx, qword [rdi + 0x10]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
test rax, rax
je 0x1801c334a
mov rbx, qword [rdi]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r8d, ebp
mov rcx, rdi
mov rdx, rax
call qword [rbx + reloc.OLEAUT32.dll_VariantClear]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x18023045f
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x180377128]
jne 0x18022510a
rol rcx, 0x10
test cx, 0xffff
jne 0x180225106
repz ret
ror rcx, 0x10
jmp 0x1802303b8
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x180383d50]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x180383e48]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x18023043d
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x180383d50]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x18023045f
mov rax, qword [rsp + 0x88]
mov qword [0x180383e48], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x180383de8], rax
mov rax, qword [0x180383e48]
mov qword [0x180383cc0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x180383dd0], rax
mov dword [0x180383cb0], 0xc0000409
mov dword [0x180383cb4], 1
mov rax, qword [0x180377128]
mov qword [rsp + 0x68], rax
mov rax, qword [0x180377130]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x180383d48], eax
mov ecx, 1
call fcn.18024948c
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x1802eefd0]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x180383d48], 0
jne 0x1802304e6
mov ecx, 1
call fcn.18024948c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x1802475e8
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [0x180377128]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.18022c980
xor ebx, ebx
cmp qword [0x180384768], rbx
mov rdi, rax
jne 0x1802476fb
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x1802477d2
lea rdx, [0x1802f01f0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1802477d2
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, [0x1802f01e0]
mov rcx, rsi
mov qword [0x180384768], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, [0x1802f01c8]
mov rcx, rsi
mov qword [0x180384770], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetUserObjectInformationW
mov rcx, rsi
mov qword [0x180384778], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov r11, rax
mov qword [0x180384788], rax
test rax, rax
je 0x1802476f2
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x180384780], rax
jmp 0x180247702
mov rax, qword [0x180384780]
jmp 0x180247709
mov rax, qword [0x180384780]
mov r11, qword [0x180384788]
cmp rax, rdi
je 0x180247770
cmp r11, rdi
je 0x180247770
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rcx, qword [0x180384788]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov r12, rax
test rsi, rsi
je 0x180247770
test rax, rax
je 0x180247770
call rsi
test rax, rax
je 0x18024776a
lea rcx, [rsp + 0x30]
mov r9d, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x18024776a
test byte [rsp + 0x40], 1
jne 0x180247770
bts ebp, 0x15
jmp 0x1802477b0
mov rcx, qword [0x180384770]
cmp rcx, rdi
je 0x1802477b0
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x1802477b0
call rax
mov rbx, rax
test rax, rax
je 0x1802477b0
mov rcx, qword [0x180384778]
cmp rcx, rdi
je 0x1802477b0
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x1802477b0
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x180384768]
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x1802477d2
mov r9d, ebp
mov r8, r14
mov rdx, r13
mov rcx, rbx
call rax
jmp 0x1802477d4
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1802250f0
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x447860
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4479e6
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov rax, qword [rsp + 0x58]
test rax, rax
je 0x4479b2
mov ecx, dword [rax + 0x18]
mov dword [rsp + 0x10], ecx
mov qword [rsp], rax
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 8], rcx
mov rdx, qword [rsp + 0x68]
mov qword [rsp + 0x18], rdx
mov qword [rsp + 0x20], 0
movzx ebx, byte [rsp + 0x70]
mov byte [rsp + 0x28], bl
call fcn.004470d0
movsxd rax, dword [rsp + 0x30]
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x58]
mov edx, dword [rcx + 0x1c]
mov dword [rsp + 0x10], edx
mov qword [rsp], rcx
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 8], rcx
mov rdx, qword [rsp + 0x68]
mov qword [rsp + 0x18], rdx
mov qword [rsp + 0x20], 0
movzx edx, byte [rsp + 0x70]
mov byte [rsp + 0x28], dl
call fcn.004470d0
mov eax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x40]
cmp rcx, 0xffffffffffffffff
jne 0x44794d
lea rax, [0x0084147a]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 1
mov dword [rsp + 0x88], 0
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
cmp eax, 0xffffffff
je 0x447920
mov rdx, qword [rsp + 0x60]
mov rbx, qword [rdx + 0x38]
mov rsi, qword [rdx + 0x30]
cmp rcx, rbx
jge 0x447920
mov rbx, qword [rdx + 8]
mov rdx, qword [rdx]
jae 0x4479df
mov ecx, dword [rsi + rcx*4]
cmp rcx, rbx
jae 0x4479df
mov dword [rsp + 0x3c], eax
lea rax, [rdx + rcx]
mov qword [rsp], rax
call fcn.004452a0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 8]
mov qword [rsp + 0x78], rcx
mov qword [rsp + 0x80], rax
mov eax, dword [rsp + 0x3c]
mov dword [rsp + 0x88], eax
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
lea rax, [0x0084147a]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 1
mov dword [rsp + 0x88], 0
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
call fcn.0042bed0
ud2
call fcn.004559e0
jmp fcn.00447860
Function at 0x447a70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x447bd2
sub rsp, 0x68
mov qword [rsp + 0x60], rbp
lea rbp, [rsp + 0x60]
mov rax, qword [rsp + 0x70]
mov ecx, dword [rax + 0x14]
mov dword [rsp + 0x10], ecx
mov qword [rsp], rax
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 8], rcx
mov rdx, qword [rsp + 0x80]
mov qword [rsp + 0x18], rdx
mov rbx, qword [rsp + 0x88]
mov qword [rsp + 0x20], rbx
mov byte [rsp + 0x28], 1
call fcn.004470d0
mov eax, dword [rsp + 0x30]
test eax, 7
jne 0x447af2
mov dword [rsp + 0x90], eax
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov dword [rsp + 0x3c], eax
mov rax, qword [rsp + 0x70]
mov qword [rsp], rax
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 8], rcx
call fcn.00447670
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x10]
mov qword [rsp + 0x58], rcx
mov rdx, qword [rsp + 0x70]
mov rbx, qword [rdx]
mov qword [rsp + 0x50], rbx
movsxd rdx, dword [rdx + 0x14]
mov qword [rsp + 0x48], rdx
call fcn.0042e040
lea rax, [0x0084ace1]
mov qword [rsp], rax
mov qword [rsp + 8], 0x10
call fcn.0042e9e0
mov rax, qword [rsp + 0x58]
mov qword [rsp], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 8], rax
call fcn.0042e9e0
call fcn.0042e290
mov rax, qword [rsp + 0x50]
mov qword [rsp], rax
call fcn.0042e880
call fcn.0042e290
mov rax, qword [rsp + 0x80]
mov qword [rsp], rax
call fcn.0042e880
call fcn.0042e290
mov rax, qword [rsp + 0x48]
mov qword [rsp], rax
call fcn.0042e880
call fcn.0042e290
mov eax, dword [rsp + 0x3c]
movsxd rcx, eax
mov qword [rsp], rcx
call fcn.0042e810
call fcn.0042e2e0
call fcn.0042e0d0
mov eax, dword [rsp + 0x3c]
jmp 0x447ae1
call fcn.004559e0
jmp fcn.00447a70

Function at 0x4483c0
Capabilities:
Access peb ldr_data

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x68], 0
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov rax, qword [rax + 0x30]
inc dword [rax + 0x23c]
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov rcx, qword [rax + 0x30]
lea rdx, [rcx + 0x130]
test byte [rdx], al
mov rdx, rax
mov qword [rcx + 0x130], rax
lea rax, [rdx + 0xd8]
test byte [rax], al
mov rax, qword [rdx + 0x30]
mov qword [rdx + 0xd8], rax
mov dword [rsp], 0
lea rax, fcn.004379d0
mov qword [rsp + 8], rax
call fcn.0042c340
test eax, eax
jne 0x4484f2
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov rax, qword [rax + 0x30]
mov qword [rsp + 0x18], rax
lea rcx, [rax + 0x2c8]
test byte [rcx], al
mov rdx, qword [rsp + 0x30]
mov qword [rax + 0x2c8], rdx
mov rdx, qword [rsp + 0x38]
mov qword [rax + 0x2d0], rdx
lea rdx, [rsp + 0x40]
mov qword [rax + 0x2d8], rdx
mov rdx, qword [0x00b8e5d0]
mov qword [rsp], rdx
mov qword [rsp + 8], rcx
call fcn.00403d20
mov rax, qword [rsp + 0x18]
mov rcx, qword [rax + 0x2e0]
mov rdx, qword [rax + 0x2e8]
mov rax, qword [rax + 0x2f0]
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x68], rax
nop
call fcn.0042cc00
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
nop
call fcn.0042cc00
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
Function at 0x44ed90
Capabilities:
Access peb ldr_data

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x44ee70
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov qword [rsp + 8], 0
mov qword [rsp + 0x10], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x18], xmm0
movups xmmword [rsp + 0x28], xmm0
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
lea rcx, [0x00455330]
mov qword [rsp + 0x10], rcx
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x18], rcx
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 8]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.00455890
mov rax, qword [rsp + 8]
mov qword [rsp + 0x88], rax
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
call fcn.004559e0
jmp fcn.0044ed90
Function at 0x463f40
Capabilities:
Encode data using base64

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x46404a
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rcx + 8]
lea rbx, [rdx + 0x2e]
neg rbx
imul rbx, rbx, 0x1c
movabs rax, 0x5816058160581606
mov rsi, rdx
imul rbx
sar rbx, 0x3f
sar rdx, 5
sub rdx, rbx
lea rbx, [rdx + 0x15c]
sar rbx, 0x3f
shr rbx, 0x3d
lea rdx, [rbx + rdx + 0x15c]
sar rdx, 3
jmp 0x463fb7
mov rdx, rax
cmp rdx, 0x57
jae 0x464043
lea rax, [rdx + rdx*2]
lea rbx, [0x00b64ce0]
mov rdi, qword [rbx + rax*8 + 8]
lea r8, [rsi + rdi + 0x40]
cmp r8, 0xffffffffffffffc4
jge 0x463fe2
lea rax, [rdx + 1]
jmp 0x463fb4
cmp r8, 0xffffffffffffffe0
jle 0x463fee
lea rax, [rdx - 1]
jmp 0x463fb4
mov qword [rsp + 0x20], rdx
mov rdx, rax
shl rax, 3
mov rdx, qword [rbx + rdx*8]
movzx eax, byte [rbx + rax + 0x10]
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], rdi
mov byte [rsp + 0x18], al
mov qword [rsp], rcx
call fcn.00463b60
mov rax, qword [rsp + 0x20]
mov rcx, rax
shl rax, 3
add rax, 0xfffffffffffffea4
neg rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rcx
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
call fcn.0042bed0
ud2
call fcn.004559e0
jmp fcn.00463f40
Function at 0x4b90e0
Capabilities:
Hash data using fnv

Disassembly:
mov rax, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x10]
mov edx, dword [rsp + 8]
xor ebx, ebx
jmp 0x4b9105
lea rsi, [rbx + 1]
imul edx, edx, 0x1000193
movzx edi, byte [rcx + rbx]
xor edx, edi
mov rbx, rsi
cmp rbx, rax
jl 0x4b90f2
mov dword [rsp + 0x28], edx
ret

Function at 0x4e7990
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4e7bf1
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov rax, qword [rsp + 0x80]
mov qword [rsp], rax
mov rcx, qword [rsp + 0x88]
mov qword [rsp + 8], rcx
mov rdx, qword [rsp + 0x90]
mov qword [rsp + 0x10], rdx
call fcn.004e7c00
mov eax, dword [rsp + 0x18]
mov ecx, dword [rsp + 0x1c]
mov rdx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x88]
xor edi, edi
xor r8d, r8d
jmp 0x4e7a1b
lea r9, [rdi + 1]
imul r10d, r8d, 0x1000193
movzx r11d, byte [rdx + rdi]
lea r8d, [r11 + r10]
mov rdi, r9
cmp rdi, rsi
jge 0x4e7a2a
cmp rdi, rbx
jb 0x4e7a04
jmp 0x4e7bea
mov dword [rsp + 0x3c], eax
mov dword [rsp + 0x38], ecx
cmp r8d, eax
je 0x4e7b4c
mov rdi, rsi
cmp rsi, rbx
jge 0x4e7b36
imul r8d, r8d, 0x1000193
movzx r9d, byte [rdx + rsi]
add r8d, r9d
mov r9, rsi
sub rsi, rdi
cmp rsi, rbx
jae 0x4e7bdc
movzx esi, byte [rdx + rsi]
imul esi, ecx
sub r8d, esi
lea rsi, [r9 + 1]
cmp r8d, eax
jne 0x4e7a3e
mov r9, rsi
sub rsi, rdi
test r9, r9
jl 0x4e7bd5
cmp rsi, r9
ja 0x4e7bd5
mov dword [rsp + 0x40], r8d
mov qword [rsp + 0x50], r9
mov qword [rsp + 0x48], rsi
mov rax, qword [rsp + 0x78]
sub rax, rsi
mov rbx, rax
neg rax
sar rax, 0x3f
and rax, rsi
add rax, rdx
mov qword [rsp], rax
sub r9, rsi
mov qword [rsp + 8], r9
mov qword [rsp + 0x10], rbx
mov rbx, qword [rsp + 0x80]
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
mov r8, qword [rsp + 0x90]
mov qword [rsp + 0x28], r8
call fcn.00402470
lea rax, [rsp + 0x30]
cmp byte [rax], 0
jne 0x4e7b1f
mov eax, dword [rsp + 0x3c]
mov ecx, dword [rsp + 0x38]
mov rdx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x88]
mov r8d, dword [rsp + 0x40]
jmp 0x4e7a3e
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x98], rax
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov qword [rsp + 0x98], 0xffffffffffffffff
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov rdi, qword [rsp + 0x78]
cmp rsi, rdi
ja 0x4e7be3
mov dword [rsp + 0x44], r8d
mov qword [rsp], rdx
mov qword [rsp + 8], rsi
mov qword [rsp + 0x10], rdi
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x20], rsi
mov rcx, qword [rsp + 0x90]
mov qword [rsp + 0x28], rcx
call fcn.00402470
lea rax, [rsp + 0x30]
cmp byte [rax], 0
jne 0x4e7bbf
mov eax, dword [rsp + 0x3c]
mov ecx, dword [rsp + 0x38]
mov rdx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x88]
mov r8d, dword [rsp + 0x44]
jmp 0x4e7a3b
mov qword [rsp + 0x98], 0
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
call fcn.0042c000
ud2
call fcn.0042bed0
ud2
call fcn.0042c000
ud2
call fcn.0042bed0
ud2
call fcn.004559e0
jmp fcn.004e7990