joyce8/EMBER2024-capa huggingface dataset:
Function at 0x64602290
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x64b2e8c0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x64b2e8a0]
test rbx, rbx
je 0x646022e4
mov rdi, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rbx]
call rdi
mov r12, rax
call rsi
test eax, eax
jne 0x646022db
test r12, r12
je 0x646022db
mov rax, qword [rbx + 8]
mov rcx, r12
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x646022c0
lea rcx, [0x64b2e8c0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x64602510
Capabilities:
Parse pe header

Disassembly:
cmp word [rcx], 0x5a4d
jne 0x64602520
jmp sym._ValidateImageBase.part.0
xor eax, eax
ret

Function at 0x64602530
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x64602575
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
nop dword [rax]
mov r8d, dword [rax + 0xc]
mov rcx, r8
cmp r8, rdx
ja 0x6460256c
add ecx, dword [rax + 8]
cmp rcx, rdx
ja 0x64602577
add rax, 0x28
cmp rax, r9
jne 0x64602558
xor eax, eax
ret

Function at 0x64602620
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r10, qword [0x64b2b240]
xor r8d, r8d
cmp word [r10], 0x5a4d
mov r9, rcx
jne 0x64602699
mov rcx, r10
call sym._ValidateImageBase.part.0
test eax, eax
je 0x64602699
movsxd rax, dword [r10 + 0x3c]
mov rcx, r9
sub rcx, r10
add r10, rax
movzx eax, word [r10 + 0x14]
lea r8, [r10 + rax + 0x18]
movzx eax, word [r10 + 6]
test eax, eax
je 0x64602696
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [r8 + rax*8 + 0x28]
nop dword [rax]
mov edx, dword [r8 + 0xc]
mov rax, rdx
cmp rcx, rdx
jb 0x6460268d
add eax, dword [r8 + 8]
cmp rcx, rax
jb 0x64602699
add r8, 0x28
cmp r8, r9
jne 0x64602678
xor r8d, r8d
mov rax, r8
add rsp, 0x28
ret

Function at 0x64602780
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r9, qword [0x64b2b240]
xor eax, eax
cmp word [r9], 0x5a4d
mov r8, rcx
jne 0x646027ef
mov rcx, r9
call sym._ValidateImageBase.part.0
test eax, eax
je 0x646027ef
movsxd rax, dword [r9 + 0x3c]
mov rcx, r8
sub rcx, r9
add r9, rax
movzx eax, word [r9 + 0x14]
movzx edx, word [r9 + 6]
lea rax, [r9 + rax + 0x18]
test edx, edx
je 0x646027ed
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x646027e4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x646027f8
add rax, 0x28
cmp rax, r9
jne 0x646027d0
xor eax, eax
add rsp, 0x28
ret
mov eax, dword [rax + 0x24]
not eax
shr eax, 0x1f
add rsp, 0x28
ret
Function at 0x64602810
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r11, qword [0x64b2b240]
xor r9d, r9d
cmp word [r11], 0x5a4d
mov r8d, ecx
jne 0x64602888
mov rcx, r11
call sym._ValidateImageBase.part.0
test eax, eax
je 0x64602888
movsxd rcx, dword [r11 + 0x3c]
add rcx, r11
mov eax, dword [rcx + 0x90]
test eax, eax
je 0x64602888
movzx edx, word [rcx + 0x14]
lea rdx, [rcx + rdx + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x64602888
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r10, [rdx + rcx*8 + 0x28]
nop dword [rax + rax]
mov r9d, dword [rdx + 0xc]
mov rcx, r9
cmp rax, r9
jb 0x6460287c
add ecx, dword [rdx + 8]
cmp rax, rcx
jb 0x64602890
add rdx, 0x28
cmp rdx, r10
jne 0x64602868
xor r9d, r9d
mov rax, r9
add rsp, 0x28
ret
add rax, r11
jmp 0x646028a0
sub r8d, 1
add rax, 0x14
mov ecx, dword [rax + 4]
test ecx, ecx
jne 0x646028ae
mov edx, dword [rax + 0xc]
test edx, edx
je 0x64602885
test r8d, r8d
jg 0x64602898
mov r9d, dword [rax + 0xc]
add r9, r11
mov rax, r9
add rsp, 0x28
ret
Function at 0x41baa0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x41bc8f
sub rsp, 0x18
mov rax, qword [rsp + 0x28]
xor ebp, ebp
cmp rax, rbp
je 0x41bc70
mov rbx, qword [rax]
cmp rbx, 0
je 0x41bc70
movzx ebx, byte [rax + 8]
and rbx, 4
cmp bl, 0
je 0x41bb06
lea rbx, [0x00728aa0]
mov qword [rsp], rbx
mov qword [rsp + 8], 0x21
call fcn.0043bd20
mov rax, qword [rsp + 0x28]
movzx ebx, byte [rax + 9]
cmp bl, 0
jne 0x41bbb6
mov rcx, qword [rax + 0x10]
xor eax, eax
cmp rax, 8
jae 0x41bb43
mov rdx, rax
shl rdx, 2
add rdx, 8
mov rbx, rcx
add rbx, rdx
mov ebx, dword [rbx]
mov ebp, dword [rsp + 0x30]
cmp ebx, ebp
je 0x41bb83
inc rax
cmp rax, 8
jb 0x41bb1f
mov rax, qword [rsp + 0x20]
movzx rbx, word [rax + 0x64]
sub rbx, 8
mov rax, rbx
mov rbx, rcx
add rbx, rax
mov rcx, qword [rbx]
xor ebp, ebp
cmp rcx, rbp
jne 0x41bb17
lea rbx, [0x008447b0]
mov qword [rsp], rbx
call fcn.0054bda0
mov rbx, qword [rsp + 8]
mov qword [rsp + 0x38], rbx
add rsp, 0x18
ret
mov rbx, rcx
add rbx, rax
movzx ebp, byte [rbx]
cmp bpl, 0
je 0x41bb3a
mov rbx, qword [rsp + 0x20]
movzx ebx, byte [rbx + 0x62]
imul rbx, rax
add rbx, 0x28
mov rax, rbx
mov rbx, rcx
add rbx, rax
mov qword [rsp + 0x38], rbx
add rsp, 0x18
ret
lea rbx, [rsp + 0x30]
xor rbx, 0
mov qword [rsp], rbx
mov ebp, dword [rax + 0xc]
mov qword [rsp + 8], rbp
mov rbp, qword [rsp + 0x20]
mov rbp, qword [rbp + 0x40]
mov rbp, qword [rbp + 0x18]
mov rdx, qword [rbp]
mov rbx, qword [rdx]
call rbx
mov rdi, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x10]
movzx ecx, byte [rdi + 9]
movzx ecx, cl
mov rbx, 1
cmp ecx, 0x40
jae 0x41bc6c
shl rbx, cl
dec rbx
mov rbp, qword [rsp + 0x20]
mov rax, rsi
and rax, rbx
movzx rbp, word [rbp + 0x64]
imul rax, rbp
mov rcx, qword [rdi + 0x10]
add rcx, rax
mov rax, qword [rdi + 0x18]
xor ebp, ebp
cmp rax, rbp
je 0x41bb17
mov rbp, qword [rsp + 0x20]
shr rbx, 1
and rbx, rsi
movzx rbp, word [rbp + 0x64]
imul rbx, rbp
mov rdx, rax
add rdx, rbx
movzx ebp, byte [rdx]
cmp bpl, 0
jbe 0x41bc68
cmp bpl, 4
setb al
cmp al, 0
jne 0x41bb17
mov rcx, rdx
jmp 0x41bb17
xor eax, eax
jmp 0x41bc58
xor ebx, ebx
jmp 0x41bbfe
lea rbx, [0x008447b0]
mov qword [rsp], rbx
call fcn.0054bda0
mov rbx, qword [rsp + 8]
mov qword [rsp + 0x38], rbx
add rsp, 0x18
ret
call fcn.00465260
jmp fcn.0041baa0
Function at 0x41bca0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x41be92
sub rsp, 0x18
mov rax, qword [rsp + 0x28]
xor ebp, ebp
cmp rax, rbp
je 0x41be73
mov rbx, qword [rax]
cmp rbx, 0
je 0x41be73
movzx ebx, byte [rax + 8]
and rbx, 4
cmp bl, 0
je 0x41bd06
lea rbx, [0x00728aa0]
mov qword [rsp], rbx
mov qword [rsp + 8], 0x21
call fcn.0043bd20
mov rax, qword [rsp + 0x28]
movzx ebx, byte [rax + 9]
cmp bl, 0
jne 0x41bdb9
mov rcx, qword [rax + 0x10]
xor eax, eax
cmp rax, 8
jae 0x41bd46
mov rdx, rax
shl rdx, 3
add rdx, 8
mov rbx, rcx
add rbx, rdx
mov rbx, qword [rbx]
mov rbp, qword [rsp + 0x30]
cmp rbx, rbp
je 0x41bd86
inc rax
cmp rax, 8
jb 0x41bd1f
mov rax, qword [rsp + 0x20]
movzx rbx, word [rax + 0x64]
sub rbx, 8
mov rax, rbx
mov rbx, rcx
add rbx, rax
mov rcx, qword [rbx]
xor ebp, ebp
cmp rcx, rbp
jne 0x41bd17
lea rbx, [0x008447b0]
mov qword [rsp], rbx
call fcn.0054bda0
mov rbx, qword [rsp + 8]
mov qword [rsp + 0x38], rbx
add rsp, 0x18
ret
mov rbx, rcx
add rbx, rax
movzx ebp, byte [rbx]
cmp bpl, 0
je 0x41bd3d
mov rbx, qword [rsp + 0x20]
movzx ebx, byte [rbx + 0x62]
imul rbx, rax
add rbx, 0x48
mov rax, rbx
mov rbx, rcx
add rbx, rax
mov qword [rsp + 0x38], rbx
add rsp, 0x18
ret
lea rbx, [rsp + 0x30]
xor rbx, 0
mov qword [rsp], rbx
mov ebp, dword [rax + 0xc]
mov qword [rsp + 8], rbp
mov rbp, qword [rsp + 0x20]
mov rbp, qword [rbp + 0x40]
mov rbp, qword [rbp + 0x18]
mov rdx, qword [rbp]
mov rbx, qword [rdx]
call rbx
mov rdi, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x10]
movzx ecx, byte [rdi + 9]
movzx ecx, cl
mov rbx, 1
cmp ecx, 0x40
jae 0x41be6f
shl rbx, cl
dec rbx
mov rbp, qword [rsp + 0x20]
mov rax, rsi
and rax, rbx
movzx rbp, word [rbp + 0x64]
imul rax, rbp
mov rcx, qword [rdi + 0x10]
add rcx, rax
mov rax, qword [rdi + 0x18]
xor ebp, ebp
cmp rax, rbp
je 0x41bd17
mov rbp, qword [rsp + 0x20]
shr rbx, 1
and rbx, rsi
movzx rbp, word [rbp + 0x64]
imul rbx, rbp
mov rdx, rax
add rdx, rbx
movzx ebp, byte [rdx]
cmp bpl, 0
jbe 0x41be6b
cmp bpl, 4
setb al
cmp al, 0
jne 0x41bd17
mov rcx, rdx
jmp 0x41bd17
xor eax, eax
jmp 0x41be5b
xor ebx, ebx
jmp 0x41be01
lea rbx, [0x008447b0]
mov qword [rsp], rbx
call fcn.0054bda0
mov rbx, qword [rsp + 8]
mov qword [rsp + 0x38], rbx
add rsp, 0x18
ret
call fcn.00465260
jmp fcn.0041bca0
Function at 0x41bea0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x41c0a1
sub rsp, 0x18
mov rax, qword [rsp + 0x28]
xor ebp, ebp
cmp rax, rbp
je 0x41c07d
mov rbx, qword [rax]
cmp rbx, 0
je 0x41c07d
movzx ebx, byte [rax + 8]
and rbx, 4
cmp bl, 0
je 0x41bf06
lea rbx, [0x00728aa0]
mov qword [rsp], rbx
mov qword [rsp + 8], 0x21
call fcn.0043bd20
mov rax, qword [rsp + 0x28]
movzx ebx, byte [rax + 9]
cmp bl, 0
jne 0x41bfc3
mov rcx, qword [rax + 0x10]
xor eax, eax
cmp rax, 8
jae 0x41bf46
mov rdx, rax
shl rdx, 3
add rdx, 8
mov rbx, rcx
add rbx, rdx
mov rbx, qword [rbx]
mov rbp, qword [rsp + 0x30]
cmp rbx, rbp
je 0x41bf8b
inc rax
cmp rax, 8
jb 0x41bf1f
mov rax, qword [rsp + 0x20]
movzx rbx, word [rax + 0x64]
sub rbx, 8
mov rax, rbx
mov rbx, rcx
add rbx, rax
mov rcx, qword [rbx]
xor ebp, ebp
cmp rcx, rbp
jne 0x41bf17
lea rbx, [0x008447b0]
mov qword [rsp], rbx
call fcn.0054bda0
mov rbx, qword [rsp + 8]
mov qword [rsp + 0x38], rbx
mov byte [rsp + 0x40], 0
add rsp, 0x18
ret
mov rbx, rcx
add rbx, rax
movzx ebp, byte [rbx]
cmp bpl, 0
je 0x41bf3d
mov rbx, qword [rsp + 0x20]
movzx ebx, byte [rbx + 0x62]
imul rbx, rax
add rbx, 0x48
mov rax, rbx
mov rbx, rcx
add rbx, rax
mov qword [rsp + 0x38], rbx
mov byte [rsp + 0x40], 1
add rsp, 0x18
ret
lea rbx, [rsp + 0x30]
xor rbx, 0
mov qword [rsp], rbx
mov ebp, dword [rax + 0xc]
mov qword [rsp + 8], rbp
mov rbp, qword [rsp + 0x20]
mov rbp, qword [rbp + 0x40]
mov rbp, qword [rbp + 0x18]
mov rdx, qword [rbp]
mov rbx, qword [rdx]
call rbx
mov rdi, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x10]
movzx ecx, byte [rdi + 9]
movzx ecx, cl
mov rbx, 1
cmp ecx, 0x40
jae 0x41c079
shl rbx, cl
dec rbx
mov rbp, qword [rsp + 0x20]
mov rax, rsi
and rax, rbx
movzx rbp, word [rbp + 0x64]
imul rax, rbp
mov rcx, qword [rdi + 0x10]
add rcx, rax
mov rax, qword [rdi + 0x18]
xor ebp, ebp
cmp rax, rbp
je 0x41bf17
mov rbp, qword [rsp + 0x20]
shr rbx, 1
and rbx, rsi
movzx rbp, word [rbp + 0x64]
imul rbx, rbp
mov rdx, rax
add rdx, rbx
movzx ebp, byte [rdx]
cmp bpl, 0
jbe 0x41c075
cmp bpl, 4
setb al
cmp al, 0
jne 0x41bf17
mov rcx, rdx
jmp 0x41bf17
xor eax, eax
jmp 0x41c065
xor ebx, ebx
jmp 0x41c00b
lea rbx, [0x008447b0]
mov qword [rsp], rbx
call fcn.0054bda0
mov rbx, qword [rsp + 8]
mov qword [rsp + 0x38], rbx
mov byte [rsp + 0x40], 0
add rsp, 0x18
ret
call fcn.00465260
jmp fcn.0041bea0
Function at 0x443d50
Capabilities:
Access peb ldr_data

Disassembly:
sub rsp, 0x70
mov rbx, qword gs:[0x28]
mov rax, qword [rbx]
mov rcx, qword [rax + 0x30]
mov ebp, dword [rcx + 0xd0]
inc ebp
mov dword [rcx + 0xd0], ebp
mov rbp, 1
mov byte [rax + 0xed], bpl
mov rbp, 0xfffffffffffffade
mov qword [rax + 0x10], rbp
mov rbx, qword [rax + 0x30]
mov rbp, qword [rbx + 0xa0]
mov rbx, qword [rax + 0x30]
cmp rbx, 0
je 0x443fb9
mov ebp, dword [rbp + 0x1c]
mov dword [rbx + 0x314], ebp
mov rbp, 1
mov byte [rax + 0xef], bpl
mov qword [rsp + 0x28], rax
mov rbx, qword [rax + 0x30]
mov rax, qword [rbx + 0xa0]
mov ebp, dword [rax + 0x1c]
inc ebp
mov dword [rax + 0x1c], ebp
lea rbx, [rsp + 0x78]
mov qword [rsp], rbx
call fcn.00466e90
mov rbx, qword [rsp + 8]
mov qword [rsp + 0x18], rbx
lea rbx, [rsp + 0x78]
mov qword [rsp], rbx
call fcn.00466ec0
mov rax, qword [rsp + 0x28]
mov rdi, qword [rsp + 8]
mov rsi, qword [rsp + 0x18]
mov qword [rsp + 0x10], rdi
mov rbx, qword gs:[0x28]
mov rcx, qword [rbx]
mov qword [rcx + 0x48], rsi
mov qword [rcx + 0x40], rdi
mov qword [rcx + 0x68], 0
mov qword [rcx + 0x60], 0
xor ebp, ebp
mov qword [rcx + 0x58], rbp
mov qword [rcx + 0x50], rcx
cmp rax, 0
je 0x443fb2
mov rbp, qword [rax + 0x40]
mov qword [rax + 0x78], rbp
mov rbp, qword [rax + 0x48]
mov qword [rax + 0x80], rbp
mov rbx, qword [rax + 0x78]
mov rbp, qword [rax]
cmp rbx, rbp
jb 0x443f78
mov rbx, qword [rax + 8]
mov rbp, qword [rax + 0x78]
cmp rbx, rbp
jb 0x443f78
mov qword [rsp], rax
mov dword [rsp + 8], 2
mov dword [rsp + 0xc], 3
call fcn.0043f6e0
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rcx + 0x78]
mov rbp, qword [rcx]
cmp rbx, rbp
jb 0x443f4e
mov rbx, qword [rcx + 8]
mov rbp, qword [rcx + 0x78]
cmp rbx, rbp
jb 0x443f4e
lea rbx, [0x0075c638]
mov qword [rsp], rbx
call fcn.00465100
lea rbx, [rsp + 0x78]
mov qword [rsp], rbx
call fcn.00466e90
mov rbx, qword [rsp + 8]
mov qword [rsp + 0x20], rbx
lea rbx, [rsp + 0x78]
mov qword [rsp], rbx
call fcn.00466ec0
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x20]
mov rbx, qword gs:[0x28]
mov rax, qword [rbx]
mov qword [rax + 0x48], rdx
mov qword [rax + 0x40], rcx
mov qword [rax + 0x68], 0
mov qword [rax + 0x60], 0
xor ebp, ebp
mov qword [rax + 0x58], rbp
mov qword [rax + 0x50], rax
mov rbx, qword [rsp + 0x28]
mov rax, qword [rbx + 0x30]
mov ebp, dword [rax + 0xd0]
dec ebp
mov dword [rax + 0xd0], ebp
add rsp, 0x70
ret
lea rbx, [rsp + 0x30]
lea rbp, [0x0045d270]
mov qword [rbx], rbp
mov rbp, qword [rsp + 0x10]
mov qword [rbx + 8], rbp
mov qword [rbx + 0x10], rcx
mov qword [rsp], rbx
call fcn.00465100
jmp 0x443ec0
mov rsi, qword [rax + 0x40]
mov rdx, qword [rax + 0x78]
lea rbx, [rsp + 0x48]
lea rbp, [0x0045d110]
mov qword [rbx], rbp
mov qword [rbx + 8], rdi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], rdx
mov qword [rbx + 0x20], rax
mov qword [rsp], rbx
call fcn.00465100
mov rax, qword [rsp + 0x28]
jmp 0x443e81
mov dword [rax], eax
jmp 0x443e4d
mov dword [rbx], eax
jmp 0x443da8
Function at 0x454a40
Capabilities:
Check for software breakpoints

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x454c1d
sub rsp, 0x40
mov rcx, qword [rsp + 0x48]
mov rax, qword [rcx + 8]
movzx ebx, byte [rax]
cmp bl, 0xe9
jne 0x454a8d
mov rbx, qword [rcx + 8]
add rbx, 5
mov rbp, rax
inc rbp
movsxd rbp, dword [rbp]
add rbx, rbp
mov qword [rcx + 8], rbx
add rsp, 0x40
ret
movzx ebx, byte [rax]
cmp bl, 0xeb
jne 0x454ab4
mov rbx, qword [rcx + 8]
add rbx, 2
mov rbp, rax
inc rbp
movsx rbp, byte [rbp]
add rbx, rbp
mov qword [rcx + 8], rbx
add rsp, 0x40
ret
movzx ebx, byte [rax]
cmp bl, 0xcc
jne 0x454ac1
add rsp, 0x40
ret
movzx ebp, byte [rax]
mov qword [rsp + 0x30], rbp
movzx ebp, byte [rax + 1]
mov qword [rsp + 0x28], rbp
movzx ebp, byte [rax + 2]
mov qword [rsp + 0x20], rbp
movzx ebp, byte [rax + 3]
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x38], rax
movzx ebp, byte [rax + 4]
mov qword [rsp + 0x10], rbp
call fcn.0043c560
lea rbx, [0x006f0450]
mov qword [rsp], rbx
mov qword [rsp + 8], 0xc
call fcn.0043cfd0
mov rbx, qword [rsp + 0x38]
mov qword [rsp], rbx
call fcn.0043cf90
lea rbx, [0x006dd048]
mov qword [rsp], rbx
mov qword [rsp + 8], 1
call fcn.0043cfd0
mov rbx, qword [rsp + 0x30]
mov qword [rsp], rbx
call fcn.0043ce40
lea rbx, [0x006dd048]
mov qword [rsp], rbx
mov qword [rsp + 8], 1
call fcn.0043cfd0
mov rbx, qword [rsp + 0x28]
mov qword [rsp], rbx
call fcn.0043ce40
lea rbx, [0x006dd048]
mov qword [rsp], rbx
mov qword [rsp + 8], 1
call fcn.0043cfd0
mov rbx, qword [rsp + 0x20]
mov qword [rsp], rbx
call fcn.0043ce40
lea rbx, [0x006dd048]
mov qword [rsp], rbx
mov qword [rsp + 8], 1
call fcn.0043cfd0
mov rbx, qword [rsp + 0x18]
mov qword [rsp], rbx
call fcn.0043ce40
lea rbx, [0x006dd048]
mov qword [rsp], rbx
mov qword [rsp + 8], 1
call fcn.0043cfd0
mov rbx, qword [rsp + 0x10]
mov qword [rsp], rbx
call fcn.0043ce40
lea rbx, [0x006dfbf0]
mov qword [rsp], rbx
mov qword [rsp + 8], 1
call fcn.0043cfd0
call fcn.0043c5f0
lea rbx, [0x007347a0]
mov qword [rsp], rbx
mov qword [rsp + 8], 0x22
call fcn.0043bd20
add rsp, 0x40
ret
call fcn.00465260
jmp fcn.00454a40
Function at 0x4c77f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4c78f9
sub rsp, 0x68
mov r10, qword [rsp + 0x78]
mov r9, qword [rsp + 0x80]
mov r8, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x90]
mov rdx, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x70]
mov byte [rsp + 0xa9], 0
mov byte [rsp + 0xa8], 0
mov qword [rsp + 0x40], r10
mov qword [rsp + 0x48], r9
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], rdx
mov rbx, qword [rcx + 0x128]
mov qword [rsp + 0x50], r8
cmp rbx, r8
jge 0x4c78f5
movzx ebx, byte [rcx + 0x48]
cmp bl, 0
je 0x4c78ec
movzx ebp, byte [rcx + 0x130]
mov rax, rbp
xor rax, 1
cmp al, 0
je 0x4c78d8
mov qword [rsp], rcx
mov qword [rsp + 8], r10
mov qword [rsp + 0x10], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x28], rdx
mov rbx, qword [rsp + 0xa0]
mov qword [rsp + 0x30], rbx
call fcn.004c60a0
movzx ebx, byte [rsp + 0x38]
mov byte [rsp + 0xa8], bl
movzx ebx, byte [rsp + 0x39]
mov byte [rsp + 0xa9], bl
add rsp, 0x68
ret
mov rbp, qword [rcx + 0x68]
mov qword [rsp], rcx
mov qword [rsp + 8], rbp
call fcn.004c6630
jmp 0x4c78d3
mov rax, 1
jmp 0x4c7888
xor eax, eax
jmp 0x4c7888
call fcn.00465260
jmp fcn.004c77f0
Function at 0x4e9470
Capabilities:
Encode data using base64

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4e95a7
sub rsp, 0x28
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsi + 8]
mov rbp, 0xffffffffffffffd2
sub rbp, rbx
mov rbx, rbp
imul rbx, rbx, 0x1c
mov rbx, qword [rsi + 8]
mov rax, 0xffffffffffffffd2
sub rax, rbx
imul rax, rax, 0x1c
movabs r9, 0x2c0b02c0b02c0b03
mov rbp, rax
imul r9
mov rbx, rdx
sar rbx, 4
sar rbp, 0x3f
sub rbx, rbp
sub rbx, 0xfffffffffffffea4
mov rax, rbx
sar rbx, 0x3f
shr rbx, 0x3d
add rbx, rax
sar rbx, 3
mov rax, rbx
mov rbx, qword [rsi + 8]
lea r8, [0x00842060]
mov r9, rax
cmp rax, 0x57
jae 0x4e95a0
imul r9, r9, 0x18
add r8, r9
mov rbp, qword [r8 + 8]
add rbx, rbp
add rbx, 0x40
cmp rbx, 0xffffffffffffffc4
jge 0x4e9529
inc rax
jmp 0x4e94f4
cmp rbx, 0xffffffffffffffe0
jle 0x4e9534
dec rax
jmp 0x4e94f4
mov qword [rsp], rsi
lea rsi, [0x00842060]
mov rbx, rax
mov qword [rsp + 0x20], rax
cmp rax, 0x57
jae 0x4e9599
imul rbx, rbx, 0x18
add rsi, rbx
lea rdi, [rsp + 8]
mov rcx, qword [rsi]
mov qword [rdi], rcx
mov rcx, qword [rsi + 8]
mov qword [rdi + 8], rcx
mov rcx, qword [rsi + 0x10]
mov qword [rdi + 0x10], rcx
call fcn.004e90e0
mov rbx, qword [rsp + 0x20]
mov rcx, rbx
shl rbx, 3
add rbx, 0xfffffffffffffea4
neg rbx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rcx
add rsp, 0x28
ret
call fcn.00439d40
ud2
call fcn.00439d40
ud2
call fcn.00465260
jmp fcn.004e9470

Function at 0x56d8a0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov edx, dword [rsp + 8]
mov rax, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x20]
xor ecx, ecx
cmp rcx, rdi
jge 0x56d8d4
movzx ebp, byte [rax]
imul edx, edx, 0x1000193
movzx ebp, bpl
xor edx, ebp
inc rax
inc rcx
cmp rcx, rdi
jl 0x56d8ba
mov dword [rsp + 0x28], edx
ret
Function at 0x5f2ee0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x5f3041
sub rsp, 0x48
mov r12, qword [rsp + 0x68]
mov r11, qword [rsp + 0x50]
mov r10, qword [rsp + 0x58]
mov r9, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x70]
xor ebx, ebx
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0x90], rbx
xor eax, eax
xor ecx, ecx
cmp rcx, rdi
jge 0x5f2fd2
mov rdx, rcx
inc rdx
cmp rdx, rdi
jae 0x5f303a
lea rbx, [r12 + rdx*4]
mov esi, dword [rbx]
mov qword [rsp + 0x40], rcx
cmp rcx, rdi
jae 0x5f3033
lea rbx, [r12 + rcx*4]
mov ebx, dword [rbx]
mov dword [rsp + 0x3c], esi
mov edx, ebx
dec ebx
cmp ebx, eax
jl 0x5f2fbf
mov qword [rsp + 0x50], r11
mov qword [rsp], r11
mov qword [rsp + 0x58], r10
mov qword [rsp + 8], r10
mov qword [rsp + 0x60], r9
mov qword [rsp + 0x10], r9
mov dword [rsp + 0x18], eax
mov ebx, edx
dec ebx
mov dword [rsp + 0x1c], ebx
call fcn.005f2890
mov r12, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x40]
mov r11, qword [rsp + 0x20]
mov r10, qword [rsp + 0x28]
mov r9, qword [rsp + 0x30]
mov eax, dword [rsp + 0x3c]
inc eax
add rcx, 2
cmp rcx, rdi
jl 0x5f2f3e
cmp eax, 0x10ffff
jg 0x5f3016
mov qword [rsp + 0x50], r11
mov qword [rsp], r11
mov qword [rsp + 0x58], r10
mov qword [rsp + 8], r10
mov qword [rsp + 0x60], r9
mov qword [rsp + 0x10], r9
mov dword [rsp + 0x18], eax
mov dword [rsp + 0x1c], 0x10ffff
call fcn.005f2890
mov r11, qword [rsp + 0x20]
mov r10, qword [rsp + 0x28]
mov r9, qword [rsp + 0x30]
mov qword [rsp + 0x80], r11
mov qword [rsp + 0x88], r10
mov qword [rsp + 0x90], r9
add rsp, 0x48
ret
call fcn.00439d40
ud2
call fcn.00439d40
ud2
call fcn.00465260
jmp fcn.005f2ee0
Function at 0x140001050
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x88
xor eax, eax
mov r14, r8
mov rbx, rdx
mov qword [rsp + 0x50], rax
mov rdi, rcx
mov qword [rsp + 0x58], rax
lea rdx, str.1.3.1
mov qword [rsp + 0x60], rax
lea r8d, [rax + 0x58]
mov dword [rsp + 0x28], eax
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], rax
mov rsi, r9
mov ebp, eax
call fcn.14000b850
mov r15d, eax
test eax, eax
je 0x1400010d3
lea rdx, [rbx + 0x12]
mov r8d, eax
lea rcx, str.Failed_to_extract__s:_inflateInit___failed_with_return_code__d__n
call fcn.140002b20
lea eax, [rbp - 1]
add rsp, 0x88
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov ecx, 0x2000
mov qword [rsp + 0x80], r13
call fcn.140015620
mov r13, rax
test rax, rax
jne 0x140001109
lea r8, [rbx + 0x12]
lea rdx, str.Failed_to_extract__s:_failed_to_allocate_temporary_input_buffer__n
lea rcx, str.malloc
call fcn.140002880
jmp 0x140001264
mov ecx, 0x2000
call fcn.140015620
mov rbp, rax
test rax, rax
jne 0x140001137
lea r8, [rbx + 0x12]
lea rdx, str.Failed_to_extract__s:_failed_to_allocate_temporary_output_buffer__n
lea rcx, str.malloc
call fcn.140002880
jmp 0x140001264
mov qword [rsp + 0xd0], r12
mov r15d, 0xffffffff
mov r12d, dword [rbx + 8]
nop dword [rax]
mov eax, 0x2000
mov rbx, r12
cmp r12, rax
mov r9, rdi
mov edx, 1
mov rcx, r13
cmova rbx, rax
mov r8, rbx
call fcn.140010cd8
cmp rax, rbx
jne 0x14000125c
mov rcx, rdi
call fcn.140010a4c
test eax, eax
jne 0x14000125c
sub r12, rbx
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
nop word [rax + rax]
mov ebx, 0x2000
mov qword [rsp + 0x30], rbp
xor edx, edx
mov dword [rsp + 0x38], ebx
lea rcx, [rsp + 0x20]
call fcn.140009c90
mov edi, eax
mov r15d, 0xffffffff
lea ecx, [rax + 4]
cmp ecx, 2
jbe 0x140001241
cmp eax, 2
je 0x14000123c
mov ecx, dword [rsp + 0x38]
sub rbx, rcx
test r14, r14
je 0x140001203
mov r9, r14
lea edx, [r15 + 2]
mov r8, rbx
mov rcx, rbp
call fcn.1400113e4
cmp rax, rbx
jne 0x1400011fe
mov rcx, r14
call fcn.140010a4c
test eax, eax
je 0x140001219
mov edi, r15d
jmp 0x140001241
test rsi, rsi
je 0x140001219
mov r8, rbx
mov rdx, rbp
mov rcx, rsi
call fcn.14002ac90
add rsi, rbx
cmp dword [rsp + 0x38], 0
je 0x1400011a0
cmp edi, 1
je 0x140001237
test r12, r12
je 0x140001241
mov rdi, qword [rsp + 0xc0]
jmp 0x140001150
xor r15d, r15d
jmp 0x14000125c
mov edi, 0xfffffffd
mov rdx, qword [rsp + 0xc8]
lea rcx, str.Failed_to_extract__s:_decompression_resulted_in_return_code__d__n
add rdx, 0x12
mov r8d, edi
call fcn.140002b20
mov r12, qword [rsp + 0xd0]
lea rcx, [rsp + 0x20]
call fcn.14000b530
mov rcx, r13
call fcn.14001560c
mov rcx, rbp
call fcn.14001560c
mov r13, qword [rsp + 0x80]
mov eax, r15d
add rsp, 0x88
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret