joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140274750
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm1, xmmword [rdx]
aeskeygenassist xmm0, xmm1, 1
pshufd xmm3, xmm0, 0xff
xorps xmm3, xmm1
movups xmmword [rcx], xmm1
pslldq xmm1, 4
xorps xmm3, xmm1
pslldq xmm1, 4
xorps xmm3, xmm1
pslldq xmm1, 4
xorps xmm3, xmm1
aeskeygenassist xmm0, xmm3, 2
pshufd xmm1, xmm0, 0xff
xorps xmm1, xmm3
movdqu xmmword [rcx + 0x10], xmm3
pslldq xmm3, 4
movdqa xmm0, xmm3
pslldq xmm3, 4
xorps xmm0, xmm1
movdqa xmm2, xmm3
xorps xmm2, xmm0
pslldq xmm3, 4
xorps xmm2, xmm3
aeskeygenassist xmm0, xmm2, 4
pshufd xmm1, xmm0, 0xff
xorps xmm1, xmm2
movdqu xmmword [rcx + 0x20], xmm2
pslldq xmm2, 4
movdqa xmm0, xmm2
pslldq xmm2, 4
xorps xmm0, xmm1
movdqa xmm3, xmm2
xorps xmm3, xmm0
pslldq xmm2, 4
xorps xmm3, xmm2
aeskeygenassist xmm0, xmm3, 8
pshufd xmm1, xmm0, 0xff
xorps xmm1, xmm3
movdqu xmmword [rcx + 0x30], xmm3
pslldq xmm3, 4
movdqa xmm0, xmm3
pslldq xmm3, 4
xorps xmm0, xmm1
movdqa xmm2, xmm3
xorps xmm2, xmm0
pslldq xmm3, 4
xorps xmm2, xmm3
aeskeygenassist xmm0, xmm2, 0x10
pshufd xmm1, xmm0, 0xff
xorps xmm1, xmm2
movdqu xmmword [rcx + 0x40], xmm2
pslldq xmm2, 4
movdqa xmm0, xmm2
pslldq xmm2, 4
xorps xmm0, xmm1
movdqa xmm3, xmm2
xorps xmm3, xmm0
pslldq xmm2, 4
xorps xmm3, xmm2
aeskeygenassist xmm0, xmm3, 0x20
pshufd xmm1, xmm0, 0xff
xorps xmm1, xmm3
movdqu xmmword [rcx + 0x50], xmm3
pslldq xmm3, 4
movdqa xmm0, xmm3
pslldq xmm3, 4
xorps xmm0, xmm1
movdqa xmm2, xmm3
xorps xmm2, xmm0
pslldq xmm3, 4
xorps xmm2, xmm3
aeskeygenassist xmm0, xmm2, 0x40
pshufd xmm1, xmm0, 0xff
xorps xmm1, xmm2
movdqu xmmword [rcx + 0x60], xmm2
pslldq xmm2, 4
movdqa xmm0, xmm2
pslldq xmm2, 4
movdqa xmm3, xmm2
xorps xmm0, xmm1
xorps xmm3, xmm0
pslldq xmm2, 4
xorps xmm3, xmm2
aeskeygenassist xmm0, xmm3, 0x80
pshufd xmm1, xmm0, 0xff
xorps xmm1, xmm3
movdqu xmmword [rcx + 0x70], xmm3
pslldq xmm3, 4
movdqa xmm0, xmm3
pslldq xmm3, 4
xorps xmm0, xmm1
movdqa xmm2, xmm3
xorps xmm2, xmm0
pslldq xmm3, 4
xorps xmm2, xmm3
aeskeygenassist xmm0, xmm2, 0x1b
pshufd xmm1, xmm0, 0xff
xorps xmm1, xmm2
movdqu xmmword [rcx + 0x80], xmm2
pslldq xmm2, 4
movdqa xmm0, xmm2
pslldq xmm2, 4
xorps xmm0, xmm1
movdqa xmm3, xmm2
xorps xmm3, xmm0
pslldq xmm2, 4
xorps xmm3, xmm2
aeskeygenassist xmm0, xmm3, 0x36
pshufd xmm1, xmm0, 0xff
xorps xmm1, xmm3
movdqu xmmword [rcx + 0x90], xmm3
pslldq xmm3, 4
movdqa xmm0, xmm3
pslldq xmm3, 4
xorps xmm0, xmm1
movdqa xmm1, xmm3
xorps xmm1, xmm0
pslldq xmm3, 4
xorps xmm1, xmm3
movdqu xmmword [rcx + 0xa0], xmm1
ret
Function at 0x140274f10
Capabilities:
Decrypt data using aes via x86 extensions
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [r8]
mov rax, qword [rcx + 8]
mov r8d, dword [rcx]
lea rax, [rcx + rax*4]
xorps xmm0, xmmword [rax + 0x10]
dec r8d
add rax, 0x20
test edx, edx
jne 0x140274f5b
test r8d, r8d
je 0x140274f4f
nop dword [rax]
nop word [rax + rax]
aesdec xmm0, xmmword [rax]
add rax, 0x10
add r8d, 0xffffffff
jne 0x140274f40
aesdeclast xmm0, xmmword [rax]
movups xmmword [r9], xmm0
xor eax, eax
ret
test r8d, r8d
je 0x140274f6f
aesenc xmm0, xmmword [rax]
add rax, 0x10
add r8d, 0xffffffff
jne 0x140274f60
aesenclast xmm0, xmmword [rax]
movups xmmword [r9], xmm0
xor eax, eax
ret

Function at 0x140275300
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movsxd rax, r8d
shl rax, 4
add rax, rdx
movdqu xmm0, xmmword [rax]
sub rax, 0x10
movdqu xmmword [rcx], xmm0
add rcx, 0x10
cmp rax, rdx
jbe 0x140275336
nop
aesimc xmm0, xmmword [rax]
sub rax, 0x10
movdqu xmmword [rcx], xmm0
lea rcx, [rcx + 0x10]
cmp rax, rdx
ja 0x140275320
movdqu xmm0, xmmword [rax]
movdqu xmmword [rcx], xmm0
ret

Function at 0x140275820
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
mov dword [rcx], 0x61707865
mov dword [rcx + 4], 0x3320646e
mov dword [rcx + 8], 0x79622d32
mov dword [rcx + 0xc], 0x6b206574
mov eax, dword [rdx]
mov dword [rcx + 0x10], eax
mov eax, dword [rdx + 4]
mov dword [rcx + 0x14], eax
mov eax, dword [rdx + 8]
mov dword [rcx + 0x18], eax
mov eax, dword [rdx + 0xc]
mov dword [rcx + 0x1c], eax
mov eax, dword [rdx + 0x10]
mov dword [rcx + 0x20], eax
mov eax, dword [rdx + 0x14]
mov dword [rcx + 0x24], eax
mov eax, dword [rdx + 0x18]
mov dword [rcx + 0x28], eax
mov eax, dword [rdx + 0x1c]
mov dword [rcx + 0x2c], eax
xor eax, eax
ret
Function at 0x140275ea0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x14045d080]
xor rax, rsp
mov qword [rsp + 0x48], rax
xorps xmm0, xmm0
mov qword [rsp + 0x30], 0
lea rax, [rsp + 0x30]
mov r8d, 0x10
lea r9, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x38]
mov rbx, rcx
movups xmmword [rsp + 0x38], xmm0
call fcn.140273ca0
test eax, eax
jne 0x140276026
mov ecx, dword [rsp + 0x3c]
mov qword [rsp + 0x68], rbp
mov ebp, dword [rsp + 0x40]
mov qword [rsp + 0x70], rsi
mov esi, dword [rsp + 0x38]
bswap ecx
mov ecx, ecx
bswap esi
bswap ebp
mov esi, esi
mov ebp, ebp
shl rsi, 0x20
or rsi, rcx
mov qword [rsp + 0x78], rdi
mov ecx, dword [rsp + 0x44]
mov edi, 2
bswap ecx
mov ecx, ecx
shl rbp, 0x20
or rbp, rcx
mov qword [rbx + 0x120], rsi
mov ecx, edi
mov qword [rbx + 0xa0], rbp
call fcn.140275290
test eax, eax
jne 0x140276015
mov qword [rbx + 0xe0], 0
mov qword [rbx + 0x60], 0
mov r8d, 4
nop dword [rax + rax]
mov eax, ebp
mov rcx, rsi
and eax, 1
shl rcx, 0x3f
imul edx, eax, 0xe1000000
mov rax, rbp
shr rax, 1
mov rbp, rcx
or rbp, rax
mov rax, rsi
shr rax, 1
mov qword [rbx + r8*8 + 0x60], rbp
mov ecx, edx
shl rcx, 0x20
mov rsi, rcx
xor rsi, rax
mov qword [rbx + r8*8 + 0xe0], rsi
shr r8d, 1
jne 0x140275f70
mov r8, rdi
nop word [rax + rax]
mov r9, qword [rbx + r8*8 + 0xe0]
mov r10, qword [rbx + r8*8 + 0x60]
cmp r8, 1
jle 0x140276008
lea rax, [rbx + 0x68]
lea rdx, [r8 - 1]
nop dword [rax + rax]
mov rcx, r9
xor rcx, qword [rax + 0x80]
mov qword [rax + r8*8 + 0x80], rcx
lea rax, [rax + 8]
mov rcx, r10
xor rcx, qword [rax - 8]
mov qword [rax + r8*8 - 8], rcx
sub rdx, 1
jne 0x140275fe0
lea eax, [rdi + rdi]
add r8, r8
mov edi, eax
cmp eax, 8
jle 0x140275fc0
mov rdi, qword [rsp + 0x78]
xor eax, eax
mov rsi, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14027c240
add rsp, 0x50
pop rbx
ret

Function at 0x140279d70
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
movzx eax, r9b
mov rdi, r8
movzx r11d, al
mov rbx, rdx
and r11b, 0x1f
shr eax, 5
mov r10, rcx
and eax, 0x80000003
jge 0x140279daa
dec eax
or eax, 0xfffffffc
inc eax
movzx ecx, al
movzx esi, r11b
mov r9d, dword [r8 + rcx*4]
mov ecx, 0x20
sub cl, r11b
movzx edx, cl
xor ecx, ecx
test r11b, r11b
mov r11d, 4
bswap r9d
cmove edx, ecx
sub rbx, r10
movzx ebp, dl
nop word [rax + rax]
inc al
lea r10, [r10 + 4]
and al, 3
movzx ecx, al
mov r8d, dword [rdi + rcx*4]
mov ecx, esi
shl r9d, cl
mov ecx, ebp
bswap r8d
mov edx, r8d
shr edx, cl
or r9d, edx
bswap r9d
xor r9d, dword [r10 + rbx - 4]
mov dword [r10 - 4], r9d
mov r9d, r8d
sub r11, 1
jne 0x140279de0
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret
Function at 0x14027afd4
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, [0x1402b3960]
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x14027b00e
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x14027b013
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x14027b05c
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x1402b3860]
cmp byte [rcx + rax], 0
je 0x14027b05c
dec r8
sub rdx, 1
jne 0x14027b042
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret
Function at 0x14027d11c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14027d166
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14027d166
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14027d166
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14027d166
cmp dword [rcx + 0x84], 0xe
jbe 0x14027d166
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14027d168
xor al, al
add rsp, 0x28
ret

Function at 0x14027d440
Capabilities:
Accept command line arguments

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x70
xor ebx, ebx
mov dword [rsp + 0x90], ebx
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rsp + 0x90]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov qword [rsp + 0xa8], rax
mov rdi, rax
test rax, rax
jne 0x14027d489
mov rax, 0xffffffffffffffff
add rsp, 0x70
pop r15
pop rdi
pop rbx
ret
mov eax, dword [rsp + 0x90]
mov r15, 0xffffffffffffffff
inc eax
mov qword [rsp + 0x60], rsi
movsxd rcx, eax
mov eax, 8
mul rcx
mov qword [rsp + 0x48], r14
cmovb rax, r15
mov rcx, rax
call fcn.14027c918
mov r14, rax
mov qword [rsp + 0xa0], rax
mov eax, dword [rsp + 0x90]
test eax, eax
je 0x14027d57f
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x58], r12
mov r12, r14
mov qword [rsp + 0x50], r13
mov r13, rdi
sub r13, r14
mov r14d, ebx
nop
mov rbp, qword [r12 + r13]
mov r9d, r15d
mov qword [rsp + 0x38], rbx
mov r8, rbp
mov qword [rsp + 0x30], rbx
xor edx, edx
mov dword [rsp + 0x28], ebx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movsxd rdi, eax
mov rcx, rdi
call fcn.14027c918
mov qword [rsp + 0x38], rbx
mov r9d, r15d
mov qword [rsp + 0x30], rbx
mov r8, rbp
mov dword [rsp + 0x28], edi
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov qword [r12], rsi
lea r12, [r12 + 8]
mov eax, dword [rsp + 0x90]
inc r14d
cmp r14d, eax
jne 0x14027d4f0
mov r13, qword [rsp + 0x50]
mov r12, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x68]
mov r14, qword [rsp + 0xa0]
mov rdi, qword [rsp + 0xa8]
cdqe
mov rcx, rdi
mov qword [r14 + rax*8], rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [rsp + 0x90]
mov rdx, r14
call fcn.1401fcae0
mov esi, eax
cmp dword [rsp + 0x90], ebx
je 0x14027d5cc
mov rdi, r14
nop dword [rax + rax]
mov rcx, qword [rdi]
test rcx, rcx
je 0x14027d5cc
call fcn.14027c260
inc ebx
add rdi, 8
cmp ebx, dword [rsp + 0x90]
jne 0x14027d5b0
mov rcx, r14
call fcn.14027c260
mov r14, qword [rsp + 0x48]
mov eax, esi
mov rsi, qword [rsp + 0x60]
add rsp, 0x70
pop r15
pop rdi
pop rbx
ret
jmp 0x14027d440
Function at 0x14027d5f0
Capabilities:
Accept command line arguments

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x70
xor ebx, ebx
mov dword [rsp + 0x90], ebx
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rsp + 0x90]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov qword [rsp + 0xa8], rax
mov rdi, rax
test rax, rax
jne 0x14027d489
mov rax, 0xffffffffffffffff
add rsp, 0x70
pop r15
pop rdi
pop rbx
ret
mov eax, dword [rsp + 0x90]
mov r15, 0xffffffffffffffff
inc eax
mov qword [rsp + 0x60], rsi
movsxd rcx, eax
mov eax, 8
mul rcx
mov qword [rsp + 0x48], r14
cmovb rax, r15
mov rcx, rax
call fcn.14027c918
mov r14, rax
mov qword [rsp + 0xa0], rax
mov eax, dword [rsp + 0x90]
test eax, eax
je 0x14027d57f
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x58], r12
mov r12, r14
mov qword [rsp + 0x50], r13
mov r13, rdi
sub r13, r14
mov r14d, ebx
nop
mov rbp, qword [r12 + r13]
mov r9d, r15d
mov qword [rsp + 0x38], rbx
mov r8, rbp
mov qword [rsp + 0x30], rbx
xor edx, edx
mov dword [rsp + 0x28], ebx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movsxd rdi, eax
mov rcx, rdi
call fcn.14027c918
mov qword [rsp + 0x38], rbx
mov r9d, r15d
mov qword [rsp + 0x30], rbx
mov r8, rbp
mov dword [rsp + 0x28], edi
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov qword [r12], rsi
lea r12, [r12 + 8]
mov eax, dword [rsp + 0x90]
inc r14d
cmp r14d, eax
jne 0x14027d4f0
mov r13, qword [rsp + 0x50]
mov r12, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x68]
mov r14, qword [rsp + 0xa0]
mov rdi, qword [rsp + 0xa8]
cdqe
mov rcx, rdi
mov qword [r14 + rax*8], rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [rsp + 0x90]
mov rdx, r14
call fcn.1401fcae0
mov esi, eax
cmp dword [rsp + 0x90], ebx
je 0x14027d5cc
mov rdi, r14
nop dword [rax + rax]
mov rcx, qword [rdi]
test rcx, rcx
je 0x14027d5cc
call fcn.14027c260
inc ebx
add rdi, 8
cmp ebx, dword [rsp + 0x90]
jne 0x14027d5b0
mov rcx, r14
call fcn.14027c260
mov r14, qword [rsp + 0x48]
mov eax, esi
mov rsi, qword [rsp + 0x60]
add rsp, 0x70
pop r15
pop rdi
pop rbx
ret
jmp 0x14027d440
Function at 0x4047a0
Capabilities:
Access peb ldr_data

Disassembly:
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov qword [rsp + 0x60], rax
mov rcx, qword [rax + 0x30]
cmp qword [rcx + 0x90], rax
jne 0x404944
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
mov rcx, qword [rcx + 0x30]
nop
inc dword [rcx + 0x244]
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
mov rdx, qword [rcx + 0x30]
nop
mov rbx, rcx
mov qword [rdx + 0x138], rcx
mov rcx, qword [rbx + 0x30]
mov qword [rbx + 0xd8], rcx
mov rcx, qword [rax + 0x30]
movups xmm0, xmmword [rcx + 0x2e0]
movups xmmword [rsp + 0x20], xmm0
movups xmm0, xmmword [rcx + 0x2f0]
movups xmmword [rsp + 0x30], xmm0
movups xmm0, xmmword [rcx + 0x300]
movups xmmword [rsp + 0x40], xmm0
mov rcx, qword [rax + 0x70]
mov qword [rsp + 0x50], rcx
mov rdx, qword [rax + 0x78]
mov qword [rsp + 0x18], rdx
call fcn.004670c0
mov rax, qword [rsp + 0x60]
mov rcx, qword [rax + 0x30]
mov byte [rcx + 0xe8], 0
mov rcx, qword [rax + 0x30]
xor edx, edx
xchg dword [rcx + 0x350], edx
mov rcx, qword [rsp + 0x78]
mov qword [rsp], rcx
mov rcx, qword [rsp + 0x80]
mov qword [rsp + 8], rcx
mov rcx, qword [rsp + 0x88]
mov qword [rsp + 0x10], rcx
call fcn.004049a0
mov rax, qword [rsp + 0x60]
mov rcx, qword [rax + 0x30]
mov qword [rsp + 0x58], rcx
jmp 0x4048cf
nop
mov rax, qword [0x008f5298]
mov qword [rsp], rax
mov dword [rsp + 8], 0
call fcn.0046e460
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
mov rdx, rax
xor eax, eax
mov ebx, 1
lock cmpxchg dword [rcx + 0x350], ebx
sete sil
test sil, sil
je 0x4048ac
mov rax, qword [rdx + 0x30]
mov byte [rax + 0xe8], 1
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x18]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
call fcn.004439e0
mov rax, qword [rsp + 0x60]
mov rax, qword [rax + 0x30]
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rax + 0x2e0], xmm0
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rax + 0x2f0], xmm0
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rax + 0x300], xmm0
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
call fcn.0043aa80
lea rax, [0x00716c91]
mov qword [rsp], rax
mov qword [rsp + 8], 0x1e
nop dword [rax]
call fcn.0043b500
call fcn.0043ab20
mov dword [rsp], 2
call fcn.004348c0
mov rax, qword [rsp + 0x60]
nop dword [rax + rax]
jmp 0x4047d4
Function at 0x423060
Capabilities:
Hash data using murmur3

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
cmp byte [0x0093b365], 0
jne 0x4231c5
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
sub rdx, qword [rbx + 0x18]
nop
test rdx, rdx
jne 0x42316e
xor eax, eax
nop
nop
nop
mov rcx, rax
shr rax, 3
and rcx, 7
mov edx, 1
shl edx, cl
nop
add rax, qword [rbx + 0x50]
lock or byte [rax], dl
nop
nop
mov rcx, qword [rbx + 0x18]
nop
movabs rdx, 0x800000000000
lea rax, [rdx + rcx]
mov rdx, rax
shr rax, 0x2a
cmp rax, 0x40
jae 0x4231ba
lea rbx, [0x0091d1f8]
mov rax, qword [rbx + rax*8]
shr rdx, 0x16
and rdx, 0xfffff
mov rdx, qword [rax + rdx*8]
test byte [rdx], al
test byte [rax], al
mov rax, rcx
shr rcx, 0x10
and rcx, 0x3f
movzx ebx, byte [rdx + rcx + 0x21040]
lea rdx, [rdx + rcx]
lea rdx, [rdx + 0x21040]
shr rax, 0xd
and rax, 7
mov rcx, rax
mov esi, 1
shl esi, cl
test sil, bl
jne 0x42312f
lock or byte [rdx], sil
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov rax, qword [rax + 0x30]
mov rax, qword [rax + 0xa0]
test byte [rax], al
mov rcx, qword [rsp + 0x30]
add qword [rax + 0x16a8], rcx
mov rcx, qword [rsp + 0x38]
add qword [rax + 0x16b0], rcx
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
cmp word [rbx + 0x5e], 0
je 0x42318a
movzx ecx, byte [rbx + 0x65]
cmp cl, 0x40
sbb rax, rax
shr rdx, cl
and rax, rdx
jmp 0x423095
movzx ecx, byte [rbx + 0x65]
cmp cl, 0x40
sbb rax, rax
movzx esi, byte [rbx + 0x66]
cmp sil, 0x40
sbb rdi, rdi
shr rdx, cl
and rax, rdx
movzx edx, word [rbx + 0x5c]
imul rax, rdx
mov ecx, esi
shr rax, cl
and rax, rdi
jmp 0x423095
mov ecx, 0x40
nop
call fcn.0046ce00
lea rax, [0x0071c27b]
mov qword [rsp], rax
mov qword [rsp + 8], 0x2c
call fcn.004392a0
nop
int3
Function at 0x42a5a0
Capabilities:
Access peb ldr_data

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x42a80e
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
nop
lea rax, [0x00923bb0]
mov qword [rsp], rax
call fcn.0040c0e0
lea rax, [0x00923b20]
mov qword [rsp], rax
call fcn.0041b3a0
mov rax, qword [rsp + 8]
mov qword [rsp + 0x48], rax
nop
nop
lea rcx, [0x00923bb0]
mov qword [rsp], rcx
call fcn.0040c340
mov rax, qword [rsp + 0x48]
mov byte [rax + 0xa], 1
lea rdi, [rax + 0x10]
cmp dword [0x0093b760], 0
jne 0x42a7ff
mov rcx, qword [rsp + 0x68]
mov qword [rax + 0x10], rcx
mov qword [rsp + 0x40], rdi
mov rcx, qword [rsp + 0x70]
mov qword [rax + 0x18], rcx
cmp dword [0x0093b760], 0
nop dword [rax]
jne 0x42a7d8
mov rcx, qword [rsp + 0x78]
mov qword [rax + 0x20], rcx
mov rcx, qword [rsp + 0x80]
mov qword [rax + 0x28], rcx
mov rcx, qword [rsp + 0x60]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
call fcn.0042a100
cmp byte [rsp + 0x10], 0
je 0x42a776
cmp dword [0x0093b3ac], 0
jne 0x42a694
mov byte [rsp + 0x88], 1
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov rax, qword [rsp + 0x60]
mov qword [rsp], rax
xorps xmm0, xmm0
movups xmmword [rsp + 8], xmm0
call fcn.00415d60
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov rcx, qword [rax + 0x30]
mov rdx, qword [rsp + 0x18]
nop
inc dword [rcx + 0xd8]
mov rcx, qword [rax + 0x30]
mov qword [rsp + 0x30], rcx
mov rbx, qword [rcx + 0xa0]
test byte [rbx], al
test byte [rax], al
mov qword [rsp], rdx
lea rax, [rbx + 0x1698]
mov qword [rsp + 0x38], rax
mov qword [rsp + 8], rax
call fcn.00422100
mov rax, qword [rsp + 0x40]
mov qword [rsp], rax
mov qword [rsp + 8], 8
lea rax, [0x008b9161]
mov qword [rsp + 0x10], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x20], 0
call fcn.00421f60
nop
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x30]
mov edx, dword [rcx + 0xd8]
lea ebx, [rdx - 1]
mov dword [rcx + 0xd8], ebx
cmp edx, 1
jne 0x42a682
cmp byte [rax + 0xb1], 0
je 0x42a682
mov qword [rax + 0x10], 0xfffffffffffffade
jmp 0x42a682
nop
nop
lea rax, [0x00923bb0]
mov qword [rsp], rax
call fcn.0040c0e0
nop
mov rax, qword [0x00923b50]
sub rax, qword [0x00923b20]
mov qword [0x00923b50], rax
mov rax, qword [0x00923b38]
mov rcx, qword [rsp + 0x48]
mov qword [rcx], rax
mov qword [0x00923b38], rcx
nop
nop
lea rax, [0x00923bb0]
mov qword [rsp], rax
call fcn.0040c340
mov byte [rsp + 0x88], 0
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
lea rcx, [rax + 0x20]
mov rdi, rcx
mov rbx, qword [rsp + 0x78]
call fcn.0046ca80
lea rdi, [rax + 0x28]
mov rcx, qword [rsp + 0x80]
call fcn.0046ca40
jmp 0x42a65b
mov rcx, qword [rsp + 0x68]
call fcn.0046ca40
jmp 0x42a628
call fcn.0046ac00
jmp fcn.0042a5a0
Function at 0x455c80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov rcx, qword [rsp + 0x28]
test rcx, rcx
jbe 0x455e39
mov rdx, qword [rsp + 0x20]
movzx ebx, byte [rdx]
test ebx, ebx
jne 0x455cb6
movzx esi, byte [rsp + 0x48]
test sil, sil
je 0x455de7
bt ebx, 7
nop word [rax + rax]
jae 0x455dd9
xor eax, eax
xor ebx, ebx
xor esi, esi
jmp 0x455ce0
lea esi, [rcx + 7]
mov rcx, rax
mov eax, r8d
nop word [rax + rax]
cmp rcx, rax
jbe 0x455e34
movzx edi, byte [rax + rdx]
lea r8d, [rax + 1]
mov r9d, edi
and edi, 0x7f
mov rax, rcx
mov ecx, esi
shl edi, cl
or ebx, edi
test r9b, 0x80
jne 0x455cce
mov esi, ebx
and ebx, 1
neg ebx
shr esi, 1
xor ebx, esi
mov rsi, qword [rsp + 0x40]
add dword [rsi], ebx
nop dword [rax + rax]
cmp rax, r8
jb 0x455e29
sub rax, r8
mov rbx, qword [rsp + 0x30]
sub rbx, r8
mov rsi, rbx
neg rbx
sar rbx, 0x3f
and r8, rbx
lea rbx, [rdx + r8]
test rax, rax
jbe 0x455e1f
movzx edx, byte [rdx + r8]
bt edx, 7
jae 0x455dd1
xor ecx, ecx
xor edx, edx
xor edi, edi
nop
jmp 0x455d68
lea edi, [rcx + 7]
mov ecx, r9d
cmp rax, rcx
jbe 0x455e12
movzx r8d, byte [rcx + rbx]
lea r9d, [rcx + 1]
mov r10d, r8d
and r8d, 0x7f
mov ecx, edi
shl r8d, cl
or edx, r8d
test r10b, 0x80
jne 0x455d62
cmp rax, r9
jb 0x455e07
mov rcx, qword [rsp + 0x38]
add qword [rcx], rdx
sub rsi, r9
mov rcx, rsi
neg rsi
sar rsi, 0x3f
and rsi, r9
lea rdx, [rbx + rsi]
mov qword [rsp + 0x50], rdx
sub rax, r9
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rcx
mov byte [rsp + 0x68], 1
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov r9d, 1
jmp 0x455d8f
mov rax, rcx
mov r8d, 1
jmp 0x455d06
mov qword [rsp + 0x50], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov byte [rsp + 0x68], 0
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov rcx, rax
mov eax, r9d
call fcn.0046cea0
mov rdx, rax
mov eax, ecx
mov rcx, rdx
call fcn.0046cde0
mov rcx, rax
xor eax, eax
call fcn.0046cde0
mov rcx, rax
mov eax, r8d
call fcn.0046cea0
call fcn.0046cde0
xor eax, eax
nop dword [rax + rax]
call fcn.0046cde0
nop
int3

Function at 0x45d520
Capabilities:
Access peb ldr_data

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x45d601
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov qword [rsp + 8], 0
mov qword [rsp + 0x10], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x18], xmm0
movups xmmword [rsp + 0x28], xmm0
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
lea rcx, [0x004654e0]
mov qword [rsp + 0x10], rcx
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x18], rcx
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 8]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.0046aaa0
mov rax, qword [rsp + 8]
mov qword [rsp + 0x88], rax
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
nop
ret
call fcn.0046ac00
jmp fcn.0045d520