joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14004d8d0
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 7
syscall
ret

Function at 0x14004e58c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14004e5d6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14004e5d6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14004e5d6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14004e5d6
cmp dword [rcx + 0x84], 0xe
jbe 0x14004e5d6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14004e5d8
xor al, al
add rsp, 0x28
ret
Function at 0x1400012f0
Capabilities:
Create directory

Disassembly:
mov eax, 0x14d8
call fcn.140019180
sub rsp, rax
mov rax, qword [0x140028040]
xor rax, rsp
mov qword [rsp + 0x14c0], rax
cmp byte [0x14002a030], 0
je 0x14000147c
cmp qword [0x14002a038], 0
jne 0x14000147c
xorps xmm0, xmm0
lea rdx, str.DebugLogs
xorps xmm1, xmm1
lea rcx, [rsp + 0x50]
mov r8d, 9
movups xmmword [rsp + 0x50], xmm0
movdqu xmmword [rsp + 0x60], xmm1
call fcn.1400077c0
cmp qword [rsp + 0x68], 7
lea rcx, [rsp + 0x50]
cmova rcx, qword [rsp + 0x50]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x140001393
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x140001393
cmp eax, 0xb7
je 0x140001393
mov edx, eax
lea rcx, str.Failed_to_create_log_directory
call fcn.140001220
jmp 0x14000143e
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx ecx, word [rsp + 0x4a]
movzx edx, word [rsp + 0x48]
movzx eax, word [rsp + 0x4c]
movzx r10d, word [rsp + 0x46]
movzx r9d, word [rsp + 0x42]
movzx r8d, word [rsp + 0x40]
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], ecx
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x28], edx
lea rdx, str.DebugLogs_04d_02d_02d__02d_02d_02d_upd.txt
mov dword [rsp + 0x20], r10d
call qword [sym.imp.USER32.dll_wsprintfW]
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
lea rcx, [rsp + 0x70]
mov edx, 0x40000000
mov dword [rsp + 0x20], 2
lea r8d, [r9 + 7]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x14002a038], rax
cmp rax, 0xffffffffffffffff
jne 0x14000143e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_to_create_log_file
call fcn.140001220
mov qword [0x14002a038], 0
mov rdx, qword [rsp + 0x68]
cmp rdx, 7
jbe 0x14000147c
mov rcx, qword [rsp + 0x50]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001477
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001494
call fcn.140009910
mov rcx, qword [rsp + 0x14c0]
xor rcx, rsp
call fcn.1400093d0
add rsp, 0x14d8
ret
call fcn.140010394
int3
Function at 0x140001c00
Capabilities:
Delete directory

Disassembly:
sub rsp, 0x98
mov rax, qword [0x140028040]
xor rax, rsp
mov qword [rsp + 0x80], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x70], xmm1
mov r8d, 0xe
lea rdx, str.tupdates_ready
lea rcx, [rsp + 0x60]
call fcn.1400077c0
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
mov r8d, 0xd
lea rdx, str.tupdates_temp
lea rcx, [rsp + 0x40]
call fcn.1400077c0
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
mov r8d, 8
lea rdx, str.tupdates
lea rcx, [rsp + 0x20]
call fcn.1400077c0
nop
lea rcx, [rsp + 0x60]
call fcn.140001930
lea rcx, [rsp + 0x40]
call fcn.140001930
lea rcx, [rsp + 0x20]
cmp qword [rsp + 0x38], 7
cmova rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 7
jbe 0x140001d02
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001cfd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001db2
call fcn.140009910
movdqa xmm0, xmmword [0x140024670]
movdqu xmmword [rsp + 0x30], xmm0
xor eax, eax
mov word [rsp + 0x20], ax
mov rdx, qword [rsp + 0x58]
cmp rdx, 7
jbe 0x140001d56
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001d50
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001db8
call fcn.140009910
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x140001d94
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001d8f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001dac
call fcn.140009910
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1400093d0
add rsp, 0x98
ret
call fcn.140010394
nop
call fcn.140010394
nop
call fcn.140010394
int3
Function at 0x140006a30
Capabilities:
Create directory

Disassembly:
push rbx
mov eax, 0x3d80
call fcn.140019180
sub rsp, rax
mov rax, qword [0x140028040]
xor rax, rsp
mov qword [rsp + 0x3d70], rax
mov rbx, rcx
lea rdx, str._stdata_
mov r8, rcx
lea rcx, [rsp + 0x80]
call qword [sym.imp.USER32.dll_wsprintfW]
xor edx, edx
lea rcx, [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x140006a8d
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x140006ac6
mov r8, rbx
lea rdx, str._sdumps_
lea rcx, [rsp + 0x80]
call qword [sym.imp.USER32.dll_wsprintfW]
xor edx, edx
lea rcx, [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x140006acd
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x140006acd
xor eax, eax
jmp 0x140006bca
lea r8, str.Updater.exe
mov edx, 0xa28
lea rcx, [rsp + 0x14d0]
call fcn.14000ff1c
mov edx, 0x2e
lea rcx, [rsp + 0x14d0]
call fcn.14000b010
test rax, rax
je 0x140006b0d
lea rdx, [0x14002307c]
mov rcx, rax
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
movzx ecx, word [rsp + 0x7c]
movzx edx, word [rsp + 0x7a]
movzx r8d, word [rsp + 0x78]
movzx r9d, word [rsp + 0x76]
movzx r10d, word [rsp + 0x72]
movzx r11d, word [rsp + 0x70]
mov dword [rsp + 0x60], ebx
mov dword [rsp + 0x58], eax
lea rax, str.0.1.0
mov dword [rsp + 0x50], ecx
lea rcx, [rsp + 0x2920]
mov dword [rsp + 0x48], edx
lea rdx, str._s_s__s__04d_02d_02d__02d_02d_02d__ld__ld.dmp
mov dword [rsp + 0x40], r8d
lea r8, [rsp + 0x80]
mov dword [rsp + 0x38], r9d
lea r9, [rsp + 0x14d0]
mov dword [rsp + 0x30], r10d
mov dword [rsp + 0x28], r11d
mov qword [rsp + 0x20], rax
call qword [sym.imp.USER32.dll_wsprintfW]
xor eax, eax
lea rcx, [rsp + 0x2920]
mov qword [rsp + 0x30], rax
xor r9d, r9d
mov dword [rsp + 0x28], eax
mov edx, 0xc0000000
mov dword [rsp + 0x20], 2
lea r8d, [rax + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rcx, qword [rsp + 0x3d70]
xor rcx, rsp
call fcn.1400093d0
add rsp, 0x3d80
pop rbx
ret
Function at 0x140006bf0
Capabilities:
Query environment variable

Disassembly:
push rdi
mov eax, 0x2900
call fcn.140019180
sub rsp, rax
mov rax, qword [0x140028040]
xor rax, rsp
mov qword [rsp + 0x28f0], rax
mov rdi, rcx
mov rcx, qword [0x14002a038]
test rcx, rcx
je 0x140006c31
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x14002a038], 0
lea rcx, str.DBGHELP.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
je 0x140006da5
lea rdx, str.MiniDumpWriteDump
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14002a090], rax
test rax, rax
je 0x140006da5
mov qword [rsp + 0x2920], rsi
xor ecx, ecx
xor esi, esi
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov r8d, 0xa28
lea rdx, [rsp + 0x50]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x140006d9d
mov eax, eax
lea rdx, str.Updater.exe
mov qword [rsp + 0x2918], rbx
lea rbx, [rsp + rax*2 + 0x3a]
mov rcx, rbx
call fcn.14000fdac
test eax, eax
jne 0x140006ce1
lea rdx, [0x14002307c]
mov rcx, rbx
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rsp + 0x50]
call fcn.140006a30
mov rsi, rax
lea rcx, [rax + 1]
test rcx, 0xfffffffffffffffe
jne 0x140006d37
mov r8d, 0xa28
lea rdx, [rsp + 0x14a0]
lea rcx, str.APPDATA
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x140006d32
mov eax, eax
lea rcx, [rsp + 0x14a0]
lea r8, str.Telegram_Desktop
lea rdx, str._s_
lea rcx, [rcx + rax*2]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rsp + 0x14a0]
call fcn.140006a30
mov rsi, rax
test rsi, rsi
je 0x140006d95
cmp rsi, 0xffffffffffffffff
je 0x140006d95
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov qword [rsp + 0x44], rdi
mov rdi, qword [0x14002a090]
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x4c], 1
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov r9d, 1
mov qword [rsp + 0x20], rcx
mov r8, rsi
mov rcx, rax
mov edx, ebx
call rdi
mov rbx, qword [rsp + 0x2918]
mov rsi, qword [rsp + 0x2920]
mov rcx, qword [rsp + 0x28f0]
xor rcx, rsp
call fcn.1400093d0
add rsp, 0x2900
pop rdi
ret
Function at 0x14000a048
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000a092
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000a092
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000a092
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000a092
cmp dword [rcx + 0x84], 0xe
jbe 0x14000a092
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000a094
xor al, al
add rsp, 0x28
ret

Function at 0x14001097c
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14001076c
Function at 0x140013a50
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x140013ad7
mov rsi, rbx
cmp word [rax], bp
je 0x140013a96
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x140013a80
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x140013a7c
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.140012700
mov rdi, rax
test rax, rax
je 0x140013ac4
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.140019750
mov rbp, rdi
xor ecx, ecx
call fcn.140012814
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140018afc
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
movsxd r8, dword [0x14000003c]
lea rsi, [0x140000000]
add r8, rsi
mov rbx, rdx
mov rdi, rcx
cmp dword [r8 + 0x84], 0xd
jbe 0x140018b74
mov r10d, dword [r8 + 0xf0]
xor r9d, r9d
test r10d, r10d
je 0x140018b74
movzx ecx, word [r8 + 0x14]
movzx r11d, word [r8 + 6]
add rcx, 0x18
mov r10d, dword [r10 + rsi + 0xc]
add rcx, r8
test r11d, r11d
je 0x140018b74
mov eax, dword [rcx + 0xc]
cmp r10d, eax
jb 0x140018b68
mov edx, dword [rcx + 8]
add eax, edx
cmp r10d, eax
jb 0x140018b86
inc r9d
add rcx, 0x28
cmp r9d, r11d
jb 0x140018b56
xor eax, eax
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
mov dword [rdi], edx
mov eax, dword [rcx + 0x24]
mov dword [rbx], eax
mov eax, dword [rcx + 0xc]
add rax, rsi
jmp 0x140018b76

Function at 0x1400190b0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400190d8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1400190d8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140003348
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rsp + 0x90]
mov cx, word [rax + 0x48]
mov rax, qword [rsp + 0x90]
mov rax, qword [rax + 0x50]
mov dx, word [rsp + 0xd6]
add dx, 0x5cb1
mov cl, 0x5c
mov r8w, word [rsp + 0xd6]
invalid
test byte [rbx - 4], bh

Function at 0x140004de0
Capabilities:
Encode data using xor

Disassembly:
lea rdx, [0x1400cc6c7]
mov eax, 0x4c5c7f6a
mov cx, 0x8b4a
invalid
invalid
invalid
cmp rbx, rdi
je 0x140004a87
invalid
test cl, bh

Function at 0x1400058e0
Capabilities:
Encode data using xor

Disassembly:
jb 0x14000581b
jmp 0x140005782
Function at 0x426a80
Capabilities:
Hash data using murmur3

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x426d27
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov rdx, qword [rsp + 0x48]
movzx ebx, byte [rdx + 0x63]
cmp bl, 1
jne 0x426bc3
movzx ebx, word [rdx + 0x60]
mov word [rsp + 0x16], bx
test bx, bx
jne 0x426beb
mov rsi, qword [rsp + 0x40]
mov edi, dword [rsi + 0x18]
cmp dword [rdx + 0x58], edi
jne 0x426beb
mov rbx, qword [rsi + 0x98]
sub rbx, qword [rdx + 0x20]
mov qword [rsi + 0x98], rbx
nop
nop
mov rbx, qword [rdx + 0x18]
nop
movabs rdi, 0x800000000000
lea rax, [rbx + rdi]
mov rdi, rax
shr rax, 0x2a
cmp rax, 0x40
jae 0x426be1
lea rcx, [0x00ac8730]
mov rax, qword [rcx + rax*8]
shr rdi, 0x16
and rdi, 0xfffff
mov rcx, qword [rax + rdi*8]
test byte [rcx], al
test byte [rax], al
mov rax, rbx
shr rbx, 0x10
and rbx, 0x3f
movzx edi, byte [rcx + rbx + 0x21000]
shr rax, 0xd
and rax, 7
btr edi, eax
mov byte [rcx + rbx + 0x21000], dil
movzx eax, byte [rsp + 0x50]
test al, al
je 0x426b71
mov rax, qword [rdx + 0x20]
shl rax, 0xd
sub qword [0x00ae4e68], rax
movzx eax, byte [rsp + 0x51]
test al, al
je 0x426b89
mov rax, qword [rdx + 0x20]
shl rax, 0xd
add qword [0x00ae4e60], rax
mov byte [rdx + 0x63], 3
mov qword [rsp], rsi
mov qword [rsp + 8], rdx
call fcn.00424a80
mov rax, qword [rsp + 0x40]
test byte [rax], al
add rax, 8
mov qword [rsp], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 8], rax
call fcn.0041d840
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
cmp bl, 2
jne 0x426d0d
cmp word [rdx + 0x60], 0
jne 0x426cf4
mov rsi, qword [rsp + 0x40]
jmp 0x426b59
mov ecx, 0x40
call fcn.0045b430
mov eax, dword [rdx + 0x58]
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x40]
mov ecx, dword [rcx + 0x18]
mov qword [rsp + 0x20], rcx
mov rbx, qword [rdx + 0x18]
mov qword [rsp + 0x18], rbx
call fcn.00430b80
lea rax, [0x00725560]
mov qword [rsp], rax
mov qword [rsp + 8], 0x1c
call fcn.00431530
mov rax, qword [rsp + 0x48]
mov qword [rsp], rax
call fcn.004314e0
lea rax, [0x00718477]
mov qword [rsp], rax
mov qword [rsp + 8], 5
call fcn.00431530
mov rax, qword [rsp + 0x18]
mov qword [rsp], rax
call fcn.004313c0
lea rax, [0x0071d3e7]
mov qword [rsp], rax
mov qword [rsp + 8], 0xc
call fcn.00431530
movzx eax, word [rsp + 0x16]
mov qword [rsp], rax
call fcn.00431240
lea rax, [0x0071c395]
mov qword [rsp], rax
mov qword [rsp + 8], 0xa
call fcn.00431530
mov rax, qword [rsp + 0x28]
mov qword [rsp], rax
call fcn.00431240
lea rax, [0x007179cd]
mov qword [rsp], rax
mov qword [rsp + 8], 1
call fcn.00431530
mov rax, qword [rsp + 0x20]
mov qword [rsp], rax
call fcn.00431240
call fcn.00430e20
call fcn.00430c10
lea rax, [0x00728119]
mov qword [rsp], rax
mov qword [rsp + 8], 0x23
call fcn.00430170
lea rax, [0x00729f23]
mov qword [rsp], rax
mov qword [rsp + 8], 0x29
call fcn.00430170
lea rax, [0x00729efa]
mov qword [rsp], rax
mov qword [rsp + 8], 0x29
call fcn.00430170
nop
call fcn.00458a70
jmp fcn.00426a80
Function at 0x449e10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x449fde
sub rsp, 0x68
mov qword [rsp + 0x60], rbp
lea rbp, [rsp + 0x60]
mov rax, qword [rsp + 0x70]
test rax, rax
je 0x449f98
mov ecx, dword [rax + 0x18]
mov qword [rsp], rax
mov rdx, qword [rsp + 0x78]
mov qword [rsp + 8], rdx
mov dword [rsp + 0x10], ecx
mov rcx, qword [rsp + 0x80]
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], 0
movzx ebx, byte [rsp + 0x88]
mov byte [rsp + 0x28], bl
call fcn.004496e0
movsxd rax, dword [rsp + 0x30]
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x70]
mov edx, dword [rcx + 0x1c]
mov qword [rsp], rcx
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 8], rcx
mov dword [rsp + 0x10], edx
mov rdx, qword [rsp + 0x80]
mov qword [rsp + 0x18], rdx
mov qword [rsp + 0x20], 0
movzx edx, byte [rsp + 0x88]
mov byte [rsp + 0x28], dl
call fcn.004496e0
mov eax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x40]
cmp rcx, 0xffffffffffffffff
jne 0x449f0c
lea rax, [0x007179d7]
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x98], 1
mov dword [rsp + 0xa0], 0
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
cmp eax, 0xffffffff
je 0x449edc
mov rdx, qword [rsp + 0x78]
mov rbx, qword [rdx + 0x38]
mov rsi, qword [rdx + 0x30]
cmp rcx, rbx
jge 0x449edc
mov rdi, qword [rdx + 8]
mov rdx, qword [rdx]
jae 0x449fd2
mov ebx, dword [rsi + rcx*4]
cmp rbx, rdi
jae 0x449fc8
mov dword [rsp + 0x3c], eax
lea rax, [rdx + rbx]
mov qword [rsp + 0x48], rax
mov qword [rsp], rax
call fcn.00447940
mov rax, qword [rsp + 8]
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], rax
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x90], rcx
mov qword [rsp + 0x98], rax
mov eax, dword [rsp + 0x3c]
mov dword [rsp + 0xa0], eax
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
lea rax, [0x007179d7]
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x98], 1
mov dword [rsp + 0xa0], 0
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov eax, ebx
mov rcx, rdi
call fcn.0045b420
mov rax, rcx
mov rcx, rbx
call fcn.0045b420
nop
call fcn.00458a70
jmp fcn.00449e10
Function at 0x44a070
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x44a1d2
sub rsp, 0x68
mov qword [rsp + 0x60], rbp
lea rbp, [rsp + 0x60]
mov rax, qword [rsp + 0x70]
mov ecx, dword [rax + 0x14]
mov qword [rsp], rax
mov rdx, qword [rsp + 0x78]
mov qword [rsp + 8], rdx
mov dword [rsp + 0x10], ecx
mov rcx, qword [rsp + 0x80]
mov qword [rsp + 0x18], rcx
mov rbx, qword [rsp + 0x88]
mov qword [rsp + 0x20], rbx
mov byte [rsp + 0x28], 1
call fcn.004496e0
mov eax, dword [rsp + 0x30]
test eax, 7
jne 0x44a0f2
mov dword [rsp + 0x90], eax
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov dword [rsp + 0x3c], eax
mov rax, qword [rsp + 0x70]
mov qword [rsp], rax
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 8], rcx
call fcn.00449ca0
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x10]
mov qword [rsp + 0x58], rcx
mov rdx, qword [rsp + 0x70]
mov rbx, qword [rdx]
mov qword [rsp + 0x48], rbx
movsxd rdx, dword [rdx + 0x14]
mov qword [rsp + 0x40], rdx
call fcn.00430b80
lea rax, [0x0071f9e5]
mov qword [rsp], rax
mov qword [rsp + 8], 0x10
call fcn.00431530
mov rax, qword [rsp + 0x58]
mov qword [rsp], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 8], rax
call fcn.00431530
call fcn.00430dd0
mov rax, qword [rsp + 0x48]
mov qword [rsp], rax
call fcn.004313c0
call fcn.00430dd0
mov rax, qword [rsp + 0x80]
mov qword [rsp], rax
call fcn.004313c0
call fcn.00430dd0
mov rax, qword [rsp + 0x40]
mov qword [rsp], rax
call fcn.004313c0
call fcn.00430dd0
mov eax, dword [rsp + 0x3c]
movsxd rcx, eax
mov qword [rsp], rcx
call fcn.00431350
call fcn.00430e20
call fcn.00430c10
mov eax, dword [rsp + 0x3c]
jmp 0x44a0e1
call fcn.00458a70
jmp fcn.0044a070
Function at 0x450ce0
Capabilities:
Access peb ldr_data

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x450dc0
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov qword [rsp + 8], 0
mov qword [rsp + 0x10], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x18], xmm0
movups xmmword [rsp + 0x28], xmm0
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
lea rcx, [0x00458320]
mov qword [rsp + 0x10], rcx
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x18], rcx
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 8]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.00458920
mov rax, qword [rsp + 8]
mov qword [rsp + 0x88], rax
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
call fcn.00458a70
jmp fcn.00450ce0
Function at 0x49bba0
Capabilities:
Encode data using base64

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov rdx, qword [rsp + 0x20]
mov rbx, qword [rdx + 8]
lea rsi, [rbx + 0x2e]
neg rsi
imul rsi, rsi, 0x1c
movabs rax, 0x5816058160581606
mov rcx, rdx
imul rsi
sar rsi, 0x3f
sar rdx, 5
sub rdx, rsi
lea rsi, [rdx + 0x15c]
sar rsi, 0x3f
shr rsi, 0x3d
lea rdx, [rsi + rdx]
lea rdx, [rdx + 0x15c]
sar rdx, 3
cmp rdx, 0x57
jae 0x49bc7b
lea rsi, [rdx + rdx*2]
lea rdi, [0x009c6180]
mov r8, qword [rdi + rsi*8 + 8]
lea r9, [r8 + rbx]
lea r9, [r9 + 0x40]
cmp r9, 0xffffffffffffffc4
jge 0x49bc24
inc rdx
jmp 0x49bbfb
cmp r9, 0xffffffffffffffe0
jle 0x49bc2f
dec rdx
jmp 0x49bbfb
mov rbx, qword [rdi + rsi*8]
mov rax, qword [rcx]
mov rsi, rdx
mul rbx
shr rax, 0x3f
add rdx, rax
mov qword [rcx], rdx
mov rdx, qword [rcx + 8]
lea rdx, [rdx + r8]
lea rdx, [rdx + 0x40]
mov qword [rcx + 8], rdx
mov rcx, rsi
shl rsi, 3
lea rdx, [rsi - 0x15c]
neg rdx
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rcx
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov rax, rdx
mov ecx, 0x57
call fcn.0045b420
nop
int3
Function at 0x6561b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x6562e4
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov rdx, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x68]
mov r8, qword [rsp + 0x60]
xor eax, eax
xor ecx, ecx
jmp 0x6561ff
add rax, 2
lea ecx, [r9 + 1]
cmp rax, rdx
jge 0x656276
lea r9, [rax + 1]
cmp r9, rdx
jae 0x6562d8
mov r9d, dword [rbx + rax*4 + 4]
cmp rax, rdx
jae 0x6562d0
mov r10d, dword [rbx + rax*4]
dec r10d
cmp ecx, r10d
jg 0x6561f7
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x3c], r9d
mov qword [rsp], rsi
mov qword [rsp + 8], r8
mov qword [rsp + 0x10], rdi
mov dword [rsp + 0x18], ecx
mov dword [rsp + 0x1c], r10d
call fcn.00655bb0
mov rsi, qword [rsp + 0x20]
mov r8, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
mov rax, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
mov r9d, dword [rsp + 0x3c]
jmp 0x6561f7
cmp ecx, 0x10ffff
jle 0x6562a0
mov qword [rsp + 0x88], rsi
mov qword [rsp + 0x90], r8
mov qword [rsp + 0x98], rdi
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov qword [rsp], rsi
mov qword [rsp + 8], r8
mov qword [rsp + 0x10], rdi
mov dword [rsp + 0x18], ecx
mov dword [rsp + 0x1c], 0x10ffff
call fcn.00655bb0
mov rsi, qword [rsp + 0x20]
mov r8, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
jmp 0x65627e
mov rcx, rdx
call fcn.0045b420
mov rax, r9
mov rcx, rdx
call fcn.0045b420
nop
call fcn.00458a70
jmp fcn.006561b0