joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180066048
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.18005b4b4
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.18005b4b4
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x180066198
cmp rax, 0xffffffffffffffff
je 0x180066198
xor edi, edi
test rbp, rbp
jle 0x180066143
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.180056284
mov rbx, rax
test rax, rax
jne 0x1800660d0
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x180066139
mov edx, 0x8000
mov ecx, r14d
call fcn.180065ecc
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.180056ddc
cmp eax, 0xffffffff
je 0x180066119
cdqe
sub rbp, rax
test rbp, rbp
jg 0x1800660e0
mov edx, r15d
mov ecx, r14d
call fcn.180065ecc
jmp 0x180066139
cmp byte [rsi + 0x38], dil
je 0x180066130
cmp dword [rsi + 0x34], 5
jne 0x180066130
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x180066139
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.1800570e4
jmp 0x1800661ac
jns 0x1800661ac
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.18005b4b4
cmp rax, 0xffffffffffffffff
jne 0x180066164
cmp byte [rsi + 0x30], dil
je 0x1800661ac
mov edi, dword [rsi + 0x2c]
jmp 0x1800661ac
mov ecx, r14d
call fcn.18005ef68
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1800661ac
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x1800661ac
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x1800661a5
mov eax, dword [rsi + 0x2c]
jmp 0x1800661aa
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.18005b4b4
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x1800669d0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1800669f8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1800669f8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x415660
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4157f0
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00435fa0
xorps xmm15, xmm15
mov r14, qword [0x007a71a0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x4156c5
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x4156e0
add rsp, 0x48
pop rbp
ret
call fcn.0046b140
mov rbx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x38]
sub rbx, rcx
nop dword [rax]
test rbx, rbx
jbe 0x4156ff
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x41570f
cmp rbx, 0x1000
jae 0x4156cb
jmp 0x41577a
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x415722
xor edx, edx
nop
jmp 0x415771
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00435fa0
xorps xmm15, xmm15
mov r14, qword [0x007a71a0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x415705
jmp 0x4156f4
call fcn.00471ca0
xorps xmm15, xmm15
mov r14, qword [0x007a71a0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.0043a0e0
lea rax, [0x0057f247]
mov ebx, 0x18
call fcn.0043a920
mov rax, qword [rsp + 0x38]
call fcn.0043a680
lea rax, [0x0057f94c]
mov ebx, 0x19
call fcn.0043a920
mov rax, qword [rsp + 0x30]
call fcn.0043a680
call fcn.0043a300
call fcn.0043a140
lea rax, [0x005823d6]
mov ebx, 0x21
call fcn.00469840
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0046e7c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00415660
Function at 0x415820
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x415a4a
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.00436040
xorps xmm15, xmm15
mov r14, qword [0x007a71a0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x415893
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x4158ba
add rsp, 0x50
pop rbp
ret
mov rax, rcx
nop dword [rax]
call fcn.0046b140
mov rbx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
sub rbx, rcx
mov rcx, rax
mov rax, qword [rsp + 0x68]
test rbx, rbx
jbe 0x4158dc
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x4158ec
cmp rbx, 0x1000
jae 0x415899
jmp 0x41596e
add rsp, 0x50
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x4158fe
xor esi, esi
jmp 0x415960
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.00436040
xorps xmm15, xmm15
mov r14, qword [0x007a71a0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
test sil, sil
jne 0x4158e2
jmp 0x4158ce
call fcn.00471ca0
xorps xmm15, xmm15
mov r14, qword [0x007a71a0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x4159e9
call fcn.0043a0e0
lea rax, [0x0057f965]
mov ebx, 0x19
call fcn.0043a920
mov rax, qword [rsp + 0x68]
call fcn.0043a680
lea rax, [0x0057f94c]
mov ebx, 0x19
nop dword [rax]
call fcn.0043a920
mov eax, dword [rsp + 0x34]
call fcn.0043a680
call fcn.0043a300
call fcn.0043a140
lea rax, [0x0057b48b]
mov ebx, 0xd
call fcn.00469840
cmp eax, 0x5af
je 0x415991
call fcn.0043a0e0
lea rax, [0x0057f965]
mov ebx, 0x19
call fcn.0043a920
mov rax, qword [rsp + 0x38]
call fcn.0043a680
lea rax, [0x0057f94c]
mov ebx, 0x19
nop dword [rax]
call fcn.0043a920
mov eax, dword [rsp + 0x34]
call fcn.0043a680
call fcn.0043a300
call fcn.0043a140
lea rax, [0x00581a0e]
mov ebx, 0x1f
call fcn.00469840
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0046e7c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00415820
Function at 0x421ea0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x421fa6
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov byte [rsp + 0x70], dil
mov qword [rsp + 0x10], 0
jmp 0x421ee3
mov rax, qword [rsp + 0x58]
mov rcx, rdx
mov rbx, qword [rsp + 0x60]
movzx edi, byte [rsp + 0x70]
cmp qword [rsp + 0x10], rbx
jae 0x421f9b
test byte [rax], al
lea rcx, [rax + 0x100b8]
mov ebx, edi
mov rax, rcx
nop dword [rax]
call fcn.00422ba0
test rax, rax
je 0x421f9b
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
lea rcx, [0x00421fe0]
mov qword [rsp + 0x18], rcx
lea rdx, [rsp + 0x10]
mov qword [rsp + 0x20], rdx
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x40], rax
lea rbx, [rsp + 0x18]
mov qword [rsp], rbx
nop dword [rax]
call fcn.0046e6a0
xorps xmm15, xmm15
mov r14, qword [0x007a71a0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x68]
nop dword [rax]
test rdx, rdx
jne 0x421f89
xor eax, eax
jmp 0x421f93
mov rax, qword [rdx]
call rax
mov rdx, qword [rsp + 0x68]
test al, al
je 0x421ed1
mov rax, qword [rsp + 0x10]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov byte [rsp + 0x20], dil
call fcn.0046e7c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movzx edi, byte [rsp + 0x20]
jmp fcn.00421ea0
Function at 0x42ee20
Capabilities:
Check for peb beingdebugged flag

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x42ef89
push rbp
mov rbp, rsp
sub rsp, 0x78
mov rdx, qword [rax + 0x280]
nop dword [rax]
test rdx, rdx
je 0x42ef83
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0x98], rcx
mov rdi, qword [rax + 0x290]
movsxd rcx, dword [0x007a769c]
mov rbx, rdx
mov eax, 4
call fcn.0046d160
mov qword [rsp + 0x38], rax
lea rax, [0x007a6f74]
call fcn.0042e520
lea edx, [rax + 2]
mov esi, 0xaaaaaaab
imul rsi, rdx
shr rsi, 0x21
lea edx, [rsi + rsi*2]
sub eax, edx
lea edx, [rax + 2]
mov dword [rsp + 0x34], edx
mov rsi, qword [rsp + 0x88]
mov rcx, qword [rsi + 0x280]
mov rsi, qword [rsi + 0x290]
mov eax, 1
mov rbx, qword [rsp + 0x98]
mov rdi, qword [rsp + 0x38]
mov r8d, 1
call fcn.0042e820
mov qword [rsp + 0x40], rax
call fcn.0042e760
mov qword [rsp + 0x50], rax
test byte [rax], al
mov edx, dword [rsp + 0x34]
mov esi, edx
shl rdx, 5
mov qword [rsp + 0x48], rdx
lea r8, [0x007a7300]
lea rsi, [r8 + rsi*8]
mov qword [rsp + 0x58], rsi
mov rax, rsi
call fcn.0040c220
mov rdx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
inc qword [rsi + rdx + 0x20]
mov r8, qword [rsp + 0x98]
add qword [rsi + rdx + 0x30], r8
mov rax, qword [rsp + 0x58]
call fcn.0040c460
lea rdx, [0x0042efc0]
mov qword [rsp + 0x60], rdx
mov rdx, qword [rsp + 0x90]
mov qword [rsp + 0x68], rdx
mov rdx, qword [rsp + 0x40]
mov qword [rsp + 0x70], rdx
lea rdx, [rsp + 0x60]
mov qword [rsp], rdx
call fcn.0046e6a0
xorps xmm15, xmm15
mov r14, qword [0x007a71a0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
add rsp, 0x78
pop rbp
ret
add rsp, 0x78
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.0046e7c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0042ee20
Function at 0x443f40
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x444102
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rsp + 0x30], rax
lea rax, [0x00761818]
nop
call fcn.0040cce0
call fcn.0040cd40
jmp 0x443f8a
dec edx
mov dword [rcx + 0x18c], edx
movzx edx, dl
mov rax, qword [rcx + rdx*8 + 0x190]
nop
call fcn.00449c40
call fcn.004464e0
mov rcx, qword [rsp + 0x30]
mov edx, dword [rcx + 0x18c]
cmp dword [rcx + 0x188], edx
jne 0x443f6c
mov rax, qword [rcx + 0x990]
test rax, rax
je 0x443fc3
call fcn.00449c40
call fcn.004464e0
mov rcx, qword [rsp + 0x30]
mov qword [rcx + 0x990], 0
mov rcx, qword [r14 + 0x30]
mov rax, qword [rcx + 0xa0]
call fcn.00449ce0
test byte [rax], al
add rax, 0x2288
mov rbx, qword [rsp + 0x30]
lea rcx, [rbx + 0x2288]
mov rbx, rcx
call fcn.00455060
cmp dword [0x007a6f68], 0
je 0x444019
mov rax, qword [rsp + 0x30]
nop dword [rax]
call fcn.00432480
mov rax, qword [rsp + 0x30]
lea rcx, [rax + 0x1248]
mov rax, rcx
call fcn.004260c0
mov rax, qword [rsp + 0x30]
lea rcx, [rax + 0x9c0]
mov ebx, 0x400
mov rax, rcx
call fcn.004684e0
mov rax, qword [rsp + 0x30]
mov qword [rax + 0x9b0], 0
mov qword [rax + 0x9b8], 0x80
lea rcx, [rax + 0x9c0]
mov qword [rax + 0x9a8], rcx
mov qword [rax + 0x11c8], 0
lea rcx, [rax + 0x78]
mov ebx, 0x100
mov rax, rcx
call fcn.004684e0
mov rcx, qword [rsp + 0x30]
mov qword [rcx + 0x68], 0
mov qword [rcx + 0x70], 0x20
lea rdx, [rcx + 0x78]
mov qword [rcx + 0x60], rdx
lea rdx, [0x00444120]
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], rcx
lea rdx, [rsp + 0x10]
mov qword [rsp], rdx
call fcn.0046e6a0
xorps xmm15, xmm15
mov r14, qword [0x007a71a0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx + 0x38]
call fcn.004141a0
mov rax, qword [rsp + 0x30]
mov qword [rax + 0x38], 0
call fcn.00443a40
mov rcx, qword [rsp + 0x30]
mov qword [rcx + 0x1220], 0
mov dword [rcx + 4], 4
add rsp, 0x20
pop rbp
ret
mov qword [rsp + 8], rax
call fcn.0046e7c0
mov rax, qword [rsp + 8]
jmp fcn.00443f40
Function at 0x44c5a0
Capabilities:
Access peb ldr_data

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x78
mov rcx, r14
test rcx, rcx
je 0x44c5eb
mov rcx, qword [rcx + 0x30]
mov rcx, qword [rcx + 0x90]
nop dword [rax + rax]
test rcx, rcx
je 0x44c5eb
mov qword [rsp + 0x70], rcx
mov rax, rdi
call fcn.00408860
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x50], 0
jmp 0x44c5fb
mov eax, 1
add rsp, 0x78
pop rbp
ret
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
call fcn.00408220
mov rcx, qword [sym.imp.kernel32.dll_RtlLookupFunctionEntry]
lea rdx, [rsp + 0x60]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], 0
call fcn.00435fa0
xorps xmm15, xmm15
mov r14, qword [0x007a71a0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x44c6df
mov qword [rsp + 0x58], rcx
mov rax, qword [rsp + 0x68]
call fcn.00408220
mov rcx, qword [rsp + 0x60]
mov rdx, qword [sym.imp.kernel32.dll_RtlVirtualUnwind]
mov rbx, qword [rsp + 0x68]
lea rdi, [rsp + 0x50]
mov qword [rsp], rdx
mov qword [rsp + 8], 0
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rax
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x40], 0
call fcn.004362c0
xorps xmm15, xmm15
mov r14, qword [0x007a71a0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x70]
cmp qword [rdx], rcx
ja 0x44c6df
cmp qword [rdx + 8], rcx
ja 0x44c5f6
mov eax, 1
add rsp, 0x78
pop rbp
ret

Function at 0x45c460
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45c4d7
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rsp + 0x50], rax
mov byte [rsp + 0x27], dil
test rcx, rcx
jne 0x45c484
mov edx, 1
jmp 0x45c4b7
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rax
mov rax, rcx
mov rbx, rsi
call fcn.0045b6e0
xor eax, 1
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x30]
movzx edi, byte [rsp + 0x27]
mov edx, eax
mov rax, qword [rsp + 0x38]
test dl, dl
je 0x45c4cf
mov byte [rsp + 0x26], dl
nop
call fcn.0045b320
movzx edx, byte [rsp + 0x26]
movzx edi, byte [rsp + 0x27]
mov esi, edx
add rsp, 0x40
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov byte [rsp + 0x20], dil
mov qword [rsp + 0x28], rsi
call fcn.0046e7c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movzx edi, byte [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
jmp fcn.0045c460
Function at 0x45fe40
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45fef0
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], rdi
lea rax, [rsp + 0x68]
call fcn.00451140
mov rcx, qword [rsp + 0x58]
test byte [rcx], al
lea rdx, [rcx + 0x10]
mov rbx, qword [rax]
mov rsi, qword [rax + 8]
mov rax, rdx
mov rcx, rsi
call fcn.0045c520
test bl, bl
je 0x45feea
mov qword [rsp + 0x18], rax
lea rcx, [0x0045ff40]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x40], rcx
lea rcx, [rsp + 0x20]
mov qword [rsp], rcx
call fcn.0046e6a0
xorps xmm15, xmm15
mov r14, qword [0x007a71a0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x18]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.0046e7c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp fcn.0045fe40

Function at 0x46d160
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46d20f
push rbp
mov rbp, rsp
sub rsp, 0x58
mov qword [rsp + 0x70], rbx
lea rdx, [rsp + 0x68]
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rsi, [0x00459ee0]
mov qword [rsp + 0x10], rsi
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdx
mov rdx, r14
mov qword [rsp + 0x28], rdx
lea rdx, [rsp + 8]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.0046e6a0
xorps xmm15, xmm15
mov r14, qword [0x007a71a0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
add rsp, 0x58
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.0046e7c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp fcn.0046d160
Function at 0x4705c0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x404d63
push rbp
mov rbp, rsp
sub rsp, 0x18
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
mov rax, rdx
call fcn.0040a2e0
add rsp, 0x18
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0046e7c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x404d40
cmp byte [0x007a6f37], 0
je 0x4705d5
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp 0x46d8e0
jmp 0x404d40

Function at 0x4705e0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x40a711
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x28], rbx
call fcn.0040a7e0
mov rcx, qword [0x007a7328]
xor rcx, rax
mov rbx, qword [rsp + 0x28]
xor rbx, rax
xor rbx, qword [0x007a7320]
mov rax, rcx
call fcn.0040a7c0
mov rbx, rax
movabs rax, 0x1d8e4e27c47d124b
call fcn.0040a7c0
add rsp, 0x10
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
nop dword [rax + rax]
call fcn.0046e7c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x40a6c0
cmp byte [0x007a6f37], 0
je 0x470615
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x007a76c0]
aesenc xmm0, xmmword [0x007a76d0]
aesenc xmm0, xmmword [0x007a76e0]
movq rax, xmm0
ret
jmp 0x40a6c0

Function at 0x470620
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x40a791
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x28], rbx
call fcn.0040a820
mov rcx, qword [0x007a7328]
xor rcx, rax
mov rbx, qword [rsp + 0x28]
xor rbx, rax
xor rbx, qword [0x007a7320]
mov rax, rcx
call fcn.0040a7c0
mov rbx, rax
movabs rax, 0x1d8e4e27c47d1247
call fcn.0040a7c0
add rsp, 0x10
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
nop dword [rax + rax]
call fcn.0046e7c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x40a740
cmp byte [0x007a6f37], 0
je 0x470656
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x007a76c0]
aesenc xmm0, xmmword [0x007a76d0]
aesenc xmm0, xmmword [0x007a76e0]
movq rax, xmm0
ret
jmp 0x40a740

Function at 0x4721a0
Capabilities:
Allocate thread local storage

Disassembly:
push rbp
mov rbp, rsp
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x4721d4
mov rcx, 0x28
jmp 0x4721df
shl rcx, 3
add rcx, 0x1480
mov qword [0x007a71a0], rcx
pop rbp
ret
Function at 0x47ee50
Capabilities:
Encode data using xor

Disassembly:
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdx, qword [rsp + 0x20]
test rdx, 0xf
jne 0x47eeca
mov rax, 0
nop word [rax + rax]
nop dword [rax]
movdqu xmm0, xmmword [rsi + rax]
movdqu xmm1, xmmword [rcx + rax]
pxor xmm0, xmm1
movdqu xmmword [rbx + rax], xmm0
add rax, 0x10
cmp rdx, rax
jne 0x47ee80
ret
sub rdx, 1
mov dil, byte [rsi + rdx]
mov al, byte [rcx + rdx]
xor dil, al
mov byte [rbx + rdx], dil
test rdx, 7
jne 0x47eea0
cmp rdx, 0
je 0x47eeec
test rdx, 0xf
je 0x47ee6d
test rdx, 7
jne 0x47eea0
sub rdx, 8
mov rdi, qword [rsi + rdx]
mov rax, qword [rcx + rdx]
xor rdi, rax
mov qword [rbx + rdx], rdi
cmp rdx, 0x10
jge 0x47ee6d
ret
Function at 0x4868a0
Capabilities:
Hash data using fnv

Disassembly:
movzx ecx, bl
xor rax, rcx
movabs rcx, 0x100000001b3
imul rax, rcx
ret

Function at 0x4868c0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
xor edx, edx
jmp 0x4868e1
movzx esi, byte [rbx + rdx]
xor rax, rsi
movabs rsi, 0x100000001b3
imul rax, rsi
inc rdx
cmp rcx, rdx
jg 0x4868c9
ret

Function at 0x486900
Capabilities:
Hash data using fnv

Disassembly:
xor ecx, ecx
jmp 0x486920
movzx edx, bl
xor rax, rdx
inc rcx
shr rbx, 8
movabs rdx, 0x100000001b3
imul rax, rdx
nop
cmp rcx, 8
jl 0x486904
ret

Function at 0x486940
Capabilities:
Hash data using fnv

Disassembly:
xor ecx, ecx
jmp 0x486960
movzx edx, bl
xor rax, rdx
shr ebx, 8
movabs rdx, 0x100000001b3
imul rax, rdx
inc rcx
nop
cmp rcx, 4
jl 0x486944
ret

Function at 0x48bd40
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48be0a
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call fcn.004041e0
xorps xmm15, xmm15
mov r14, qword [0x007a71a0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x48bdef
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x0053eca0]
xor ebx, ebx
mov rcx, rdx
call fcn.0046aa60
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call fcn.0048da60
inc rbx
cmp rcx, rbx
jae 0x48bdde
mov edi, 1
lea rsi, [0x0053eca0]
call fcn.0046ab20
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x0060f0e0]
lea rsi, [0x0060df98]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0046e7c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0048bd40