joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2476221e0
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
movzx r8d, word [rcx + 6]
lea rax, [rcx + rax + 0x18]
test r8w, r8w
je 0x24762222d
lea ecx, [r8 - 1]
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
mov rcx, r8
cmp rdx, r8
jb 0x247622224
add ecx, dword [rax + 8]
cmp rdx, rcx
jb 0x24762222f
add rax, 0x28
cmp rax, r9
jne 0x247622210
xor eax, eax
ret

Function at 0x247622230
Capabilities:
Parse pe header

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rsi, rcx
call sym.strlen
cmp rax, 8
ja 0x2476222c0
mov rdx, qword [0x247624320]
xor ebx, ebx
cmp word [rdx], 0x5a4d
jne 0x2476222ae
movsxd rax, dword [rdx + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
jne 0x2476222ae
cmp word [rax + 0x18], 0x20b
jne 0x2476222ae
movzx edx, word [rax + 0x14]
lea rbx, [rax + rdx + 0x18]
movzx edx, word [rax + 6]
test dx, dx
je 0x2476222c0
lea eax, [rdx - 1]
lea rax, [rax + rax*4]
lea rdi, [rbx + rax*8 + 0x28]
jmp 0x247622299
add rbx, 0x28
cmp rbx, rdi
je 0x2476222c0
mov r8d, 8
mov rdx, rsi
mov rcx, rbx
call sym.strncmp
test eax, eax
jne 0x247622290
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
xor ebx, ebx
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret

Function at 0x2476222d0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x247624320]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x2476222f0
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x2476222f8
ret
cmp word [r8 + 0x18], 0x20b
jne 0x2476222f0
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x24762234d
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x247622344
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x2476222f0
add rax, 0x28
cmp rax, r9
jne 0x247622330
xor eax, eax
ret

Function at 0x247622350
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x247624320]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x24762236f
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x247622378
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x24762236f
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x247622390
Capabilities:
Parse pe header

Disassembly:
mov r8, qword [0x247624320]
xor eax, eax
cmp word [r8], 0x5a4d
jne 0x2476223b0
movsxd rdx, dword [r8 + 0x3c]
add rdx, r8
cmp dword [rdx], 0x4550
je 0x2476223b8
ret
cmp word [rdx + 0x18], 0x20b
jne 0x2476223b0
movzx eax, word [rdx + 0x14]
movzx r8d, word [rdx + 6]
lea rax, [rdx + rax + 0x18]
test r8w, r8w
je 0x247622400
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea rdx, [rax + rdx*8 + 0x28]
nop dword [rax]
test byte [rax + 0x27], 0x20
je 0x2476223f7
test rcx, rcx
je 0x2476223b0
sub rcx, 1
add rax, 0x28
cmp rdx, rax
jne 0x2476223e8
xor eax, eax
ret
Function at 0x247622410
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x247624320]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x24762242f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x247622438
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret

Function at 0x247622450
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x247624320]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x247622470
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x247622478
ret
cmp word [r8 + 0x18], 0x20b
jne 0x247622470
sub rcx, rdx
movzx r9d, word [r8 + 6]
movzx edx, word [r8 + 0x14]
lea rdx, [r8 + rdx + 0x18]
test r9w, r9w
je 0x247622470
lea eax, [r9 - 1]
lea rax, [rax + rax*4]
lea r9, [rdx + rax*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rdx + 0xc]
mov rax, r8
cmp rcx, r8
jb 0x2476224c4
add eax, dword [rdx + 8]
cmp rcx, rax
jb 0x2476224d0
add rdx, 0x28
cmp rdx, r9
jne 0x2476224b0
xor eax, eax
ret
mov eax, dword [rdx + 0x24]
not eax
shr eax, 0x1f
ret

Function at 0x2476224e0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov r11, qword [0x247624320]
xor r9d, r9d
cmp word [r11], 0x5a4d
jne 0x247622502
movsxd r8, dword [r11 + 0x3c]
add r8, r11
cmp dword [r8], 0x4550
je 0x247622510
mov rax, r9
ret
cmp word [r8 + 0x18], 0x20b
jne 0x247622502
mov eax, dword [r8 + 0x90]
test eax, eax
je 0x247622502
movzx edx, word [r8 + 0x14]
movzx r10d, word [r8 + 6]
lea rdx, [r8 + rdx + 0x18]
test r10w, r10w
je 0x247622502
lea r8d, [r10 - 1]
lea r8, [r8 + r8*4]
lea r10, [rdx + r8*8 + 0x28]
nop word cs:[rax + rax]
mov r9d, dword [rdx + 0xc]
mov r8, r9
cmp rax, r9
jb 0x247622565
add r8d, dword [rdx + 8]
cmp rax, r8
jb 0x247622578
add rdx, 0x28
cmp r10, rdx
jne 0x247622550
xor r9d, r9d
mov rax, r9
ret
add rax, r11
jmp 0x247622587
sub ecx, 1
add rax, 0x14
mov r8d, dword [rax + 4]
test r8d, r8d
jne 0x247622597
mov edx, dword [rax + 0xc]
test edx, edx
je 0x24762256e
test ecx, ecx
jg 0x247622580
mov r9d, dword [rax + 0xc]
add r9, r11
mov rax, r9
ret
Function at 0x414ee0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x415070
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.004351e0
xorps xmm15, xmm15
mov r14, qword [0x005dfb98]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x414f45
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x414f60
add rsp, 0x48
pop rbp
ret
call fcn.004687a0
mov rbx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x38]
sub rbx, rcx
nop dword [rax]
test rbx, rbx
jbe 0x414f7f
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x414f8f
cmp rbx, 0x1000
jae 0x414f4b
jmp 0x414ffa
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x414fa2
xor edx, edx
nop
jmp 0x414ff1
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.004351e0
xorps xmm15, xmm15
mov r14, qword [0x005dfb98]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x414f85
jmp 0x414f74
call fcn.0046f000
xorps xmm15, xmm15
mov r14, qword [0x005dfb98]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.00439100
lea rax, [0x004ea9e2]
mov ebx, 0x18
call fcn.00439940
mov rax, qword [rsp + 0x38]
call fcn.004396a0
lea rax, [0x004eafe9]
mov ebx, 0x19
call fcn.00439940
mov rax, qword [rsp + 0x30]
call fcn.004396a0
call fcn.00439320
call fcn.00439160
lea rax, [0x004edcaa]
mov ebx, 0x21
call fcn.00467040
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0046bb20
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00414ee0
Function at 0x4150a0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4152ca
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.00435280
xorps xmm15, xmm15
mov r14, qword [0x005dfb98]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x415113
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x41513a
add rsp, 0x50
pop rbp
ret
mov rax, rcx
nop dword [rax]
call fcn.004687a0
mov rbx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
sub rbx, rcx
mov rcx, rax
mov rax, qword [rsp + 0x68]
test rbx, rbx
jbe 0x41515c
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x41516c
cmp rbx, 0x1000
jae 0x415119
jmp 0x4151ee
add rsp, 0x50
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x41517e
xor esi, esi
jmp 0x4151e0
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.00435280
xorps xmm15, xmm15
mov r14, qword [0x005dfb98]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
test sil, sil
jne 0x415162
jmp 0x41514e
call fcn.0046f000
xorps xmm15, xmm15
mov r14, qword [0x005dfb98]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x415269
call fcn.00439100
lea rax, [0x004eb002]
mov ebx, 0x19
call fcn.00439940
mov rax, qword [rsp + 0x68]
call fcn.004396a0
lea rax, [0x004eafe9]
mov ebx, 0x19
nop dword [rax]
call fcn.00439940
mov eax, dword [rsp + 0x34]
call fcn.004396a0
call fcn.00439320
call fcn.00439160
lea rax, [0x004e6d9a]
mov ebx, 0xd
call fcn.00467040
cmp eax, 0x5af
je 0x415211
call fcn.00439100
lea rax, [0x004eb002]
mov ebx, 0x19
call fcn.00439940
mov rax, qword [rsp + 0x38]
call fcn.004396a0
lea rax, [0x004eafe9]
mov ebx, 0x19
nop dword [rax]
call fcn.00439940
mov eax, dword [rsp + 0x34]
call fcn.004396a0
call fcn.00439320
call fcn.00439160
lea rax, [0x004ed47f]
mov ebx, 0x1f
call fcn.00467040
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0046bb20
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004150a0
Function at 0x421720
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x421826
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov byte [rsp + 0x70], dil
mov qword [rsp + 0x10], 0
jmp 0x421763
mov rax, qword [rsp + 0x58]
mov rcx, rdx
mov rbx, qword [rsp + 0x60]
movzx edi, byte [rsp + 0x70]
cmp qword [rsp + 0x10], rbx
jae 0x42181b
test byte [rax], al
lea rcx, [rax + 0x100b8]
mov ebx, edi
mov rax, rcx
nop dword [rax]
call fcn.00422420
test rax, rax
je 0x42181b
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
lea rcx, [0x00421860]
mov qword [rsp + 0x18], rcx
lea rdx, [rsp + 0x10]
mov qword [rsp + 0x20], rdx
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x40], rax
lea rbx, [rsp + 0x18]
mov qword [rsp], rbx
nop dword [rax]
call fcn.0046ba00
xorps xmm15, xmm15
mov r14, qword [0x005dfb98]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x68]
nop dword [rax]
test rdx, rdx
jne 0x421809
xor eax, eax
jmp 0x421813
mov rax, qword [rdx]
call rax
mov rdx, qword [rsp + 0x68]
test al, al
je 0x421751
mov rax, qword [rsp + 0x10]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov byte [rsp + 0x20], dil
call fcn.0046bb20
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movzx edi, byte [rsp + 0x20]
jmp fcn.00421720
Function at 0x42e6a0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x42e809
push rbp
mov rbp, rsp
sub rsp, 0x78
mov rdx, qword [rax + 0x280]
nop dword [rax]
test rdx, rdx
je 0x42e803
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0x98], rcx
mov rdi, qword [rax + 0x290]
movsxd rcx, dword [0x005dff9c]
mov rbx, rdx
mov eax, 4
call fcn.0046a4c0
mov qword [rsp + 0x38], rax
lea rax, [0x005df958]
call fcn.0042dda0
lea edx, [rax + 2]
mov esi, 0xaaaaaaab
imul rsi, rdx
shr rsi, 0x21
lea edx, [rsi + rsi*2]
sub eax, edx
lea edx, [rax + 2]
mov dword [rsp + 0x34], edx
mov rsi, qword [rsp + 0x88]
mov rcx, qword [rsi + 0x280]
mov rsi, qword [rsi + 0x290]
mov eax, 1
mov rbx, qword [rsp + 0x98]
mov rdi, qword [rsp + 0x38]
mov r8d, 1
call fcn.0042e0a0
mov qword [rsp + 0x40], rax
call fcn.0042dfe0
mov qword [rsp + 0x50], rax
test byte [rax], al
mov edx, dword [rsp + 0x34]
mov esi, edx
shl rdx, 5
mov qword [rsp + 0x48], rdx
lea r8, [0x005dfc60]
lea rsi, [r8 + rsi*8]
mov qword [rsp + 0x58], rsi
mov rax, rsi
call fcn.0040bec0
mov rdx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
inc qword [rsi + rdx + 0x20]
mov r8, qword [rsp + 0x98]
add qword [rsi + rdx + 0x30], r8
mov rax, qword [rsp + 0x58]
call fcn.0040c100
lea rdx, [0x0042e840]
mov qword [rsp + 0x60], rdx
mov rdx, qword [rsp + 0x90]
mov qword [rsp + 0x68], rdx
mov rdx, qword [rsp + 0x40]
mov qword [rsp + 0x70], rdx
lea rdx, [rsp + 0x60]
mov qword [rsp], rdx
call fcn.0046ba00
xorps xmm15, xmm15
mov r14, qword [0x005dfb98]
mov r14, qword gs:[r14]
mov r14, qword [r14]
add rsp, 0x78
pop rbp
ret
add rsp, 0x78
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.0046bb20
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0042e6a0
Function at 0x442f60
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x443122
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rsp + 0x30], rax
lea rax, [0x0059a218]
nop
call fcn.0040c980
call fcn.0040c9e0
jmp 0x442faa
dec edx
mov dword [rcx + 0x18c], edx
movzx edx, dl
mov rax, qword [rcx + rdx*8 + 0x190]
nop
call fcn.00448c60
call fcn.00445500
mov rcx, qword [rsp + 0x30]
mov edx, dword [rcx + 0x18c]
cmp dword [rcx + 0x188], edx
jne 0x442f8c
mov rax, qword [rcx + 0x990]
test rax, rax
je 0x442fe3
call fcn.00448c60
call fcn.00445500
mov rcx, qword [rsp + 0x30]
mov qword [rcx + 0x990], 0
mov rcx, qword [r14 + 0x30]
mov rax, qword [rcx + 0xa0]
call fcn.00448d00
test byte [rax], al
add rax, 0x2288
mov rbx, qword [rsp + 0x30]
lea rcx, [rbx + 0x2288]
mov rbx, rcx
call fcn.004530a0
cmp dword [0x005df94c], 0
je 0x443039
mov rax, qword [rsp + 0x30]
nop dword [rax]
call fcn.00431a40
mov rax, qword [rsp + 0x30]
lea rcx, [rax + 0x1248]
mov rax, rcx
call fcn.00425940
mov rax, qword [rsp + 0x30]
lea rcx, [rax + 0x9c0]
mov ebx, 0x400
mov rax, rcx
call fcn.004660e0
mov rax, qword [rsp + 0x30]
mov qword [rax + 0x9b0], 0
mov qword [rax + 0x9b8], 0x80
lea rcx, [rax + 0x9c0]
mov qword [rax + 0x9a8], rcx
mov qword [rax + 0x11c8], 0
lea rcx, [rax + 0x78]
mov ebx, 0x100
mov rax, rcx
call fcn.004660e0
mov rcx, qword [rsp + 0x30]
mov qword [rcx + 0x68], 0
mov qword [rcx + 0x70], 0x20
lea rdx, [rcx + 0x78]
mov qword [rcx + 0x60], rdx
lea rdx, [0x00443140]
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], rcx
lea rdx, [rsp + 0x10]
mov qword [rsp], rdx
call fcn.0046ba00
xorps xmm15, xmm15
mov r14, qword [0x005dfb98]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx + 0x38]
call fcn.00413a20
mov rax, qword [rsp + 0x30]
mov qword [rax + 0x38], 0
call fcn.00442a60
mov rcx, qword [rsp + 0x30]
mov qword [rcx + 0x1220], 0
mov dword [rcx + 4], 4
add rsp, 0x20
pop rbp
ret
mov qword [rsp + 8], rax
call fcn.0046bb20
mov rax, qword [rsp + 8]
jmp fcn.00442f60
Function at 0x44a380
Capabilities:
Access peb ldr_data

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x78
mov rcx, r14
test rcx, rcx
je 0x44a3cb
mov rcx, qword [rcx + 0x30]
mov rcx, qword [rcx + 0x90]
nop dword [rax + rax]
test rcx, rcx
je 0x44a3cb
mov qword [rsp + 0x70], rcx
mov rax, rdi
call fcn.004084e0
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x50], 0
jmp 0x44a3db
mov eax, 1
add rsp, 0x78
pop rbp
ret
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
call fcn.00407ea0
mov rcx, qword [sym.imp.kernel32.dll_RtlLookupFunctionEntry]
lea rdx, [rsp + 0x60]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], 0
call fcn.004351e0
xorps xmm15, xmm15
mov r14, qword [0x005dfb98]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x44a4bf
mov qword [rsp + 0x58], rcx
mov rax, qword [rsp + 0x68]
call fcn.00407ea0
mov rcx, qword [rsp + 0x60]
mov rdx, qword [sym.imp.kernel32.dll_RtlVirtualUnwind]
mov rbx, qword [rsp + 0x68]
lea rdi, [rsp + 0x50]
mov qword [rsp], rdx
mov qword [rsp + 8], 0
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rax
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x40], 0
call fcn.00435500
xorps xmm15, xmm15
mov r14, qword [0x005dfb98]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x70]
cmp qword [rdx], rcx
ja 0x44a4bf
cmp qword [rdx + 8], rcx
ja 0x44a3d6
mov eax, 1
add rsp, 0x78
pop rbp
ret

Function at 0x45a4a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45a517
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rsp + 0x50], rax
mov byte [rsp + 0x27], dil
test rcx, rcx
jne 0x45a4c4
mov edx, 1
jmp 0x45a4f7
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rax
mov rax, rcx
mov rbx, rsi
call fcn.00459720
xor eax, 1
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x30]
movzx edi, byte [rsp + 0x27]
mov edx, eax
mov rax, qword [rsp + 0x38]
test dl, dl
je 0x45a50f
mov byte [rsp + 0x26], dl
nop
call fcn.00459360
movzx edx, byte [rsp + 0x26]
movzx edi, byte [rsp + 0x27]
mov esi, edx
add rsp, 0x40
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov byte [rsp + 0x20], dil
mov qword [rsp + 0x28], rsi
call fcn.0046bb20
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movzx edi, byte [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
jmp fcn.0045a4a0
Function at 0x45de80
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45df30
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], rdi
lea rax, [rsp + 0x68]
call fcn.0044f080
mov rcx, qword [rsp + 0x58]
test byte [rcx], al
lea rdx, [rcx + 0x10]
mov rbx, qword [rax]
mov rsi, qword [rax + 8]
mov rax, rdx
mov rcx, rsi
call fcn.0045a560
test bl, bl
je 0x45df2a
mov qword [rsp + 0x18], rax
lea rcx, [0x0045df80]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x40], rcx
lea rcx, [rsp + 0x20]
mov qword [rsp], rcx
call fcn.0046ba00
xorps xmm15, xmm15
mov r14, qword [0x005dfb98]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x18]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.0046bb20
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp fcn.0045de80

Function at 0x46a4c0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46a56f
push rbp
mov rbp, rsp
sub rsp, 0x58
mov qword [rsp + 0x70], rbx
lea rdx, [rsp + 0x68]
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rsi, [0x00457f20]
mov qword [rsp + 0x10], rsi
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdx
mov rdx, r14
mov qword [rsp + 0x28], rdx
lea rdx, [rsp + 8]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.0046ba00
xorps xmm15, xmm15
mov r14, qword [0x005dfb98]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
add rsp, 0x58
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.0046bb20
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp fcn.0046a4c0
Function at 0x46d920
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x404a23
push rbp
mov rbp, rsp
sub rsp, 0x18
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
mov rax, rdx
call fcn.00409f60
add rsp, 0x18
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0046bb20
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x404a00
cmp byte [0x005df929], 0
je 0x46d935
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp 0x46ac40
jmp 0x404a00

Function at 0x46d940
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x40a391
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x28], rbx
call fcn.0040a460
mov rcx, qword [0x005dfc88]
xor rcx, rax
mov rbx, qword [rsp + 0x28]
xor rbx, rax
xor rbx, qword [0x005dfc80]
mov rax, rcx
call fcn.0040a440
mov rbx, rax
movabs rax, 0x1d8e4e27c47d124b
call fcn.0040a440
add rsp, 0x10
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
nop dword [rax + rax]
call fcn.0046bb20
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x40a340
cmp byte [0x005df929], 0
je 0x46d975
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x005dffc0]
aesenc xmm0, xmmword [0x005dffd0]
aesenc xmm0, xmmword [0x005dffe0]
movq rax, xmm0
ret
jmp 0x40a340

Function at 0x46d980
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x40a411
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x28], rbx
call fcn.0040a4a0
mov rcx, qword [0x005dfc88]
xor rcx, rax
mov rbx, qword [rsp + 0x28]
xor rbx, rax
xor rbx, qword [0x005dfc80]
mov rax, rcx
call fcn.0040a440
mov rbx, rax
movabs rax, 0x1d8e4e27c47d1247
call fcn.0040a440
add rsp, 0x10
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
nop dword [rax + rax]
call fcn.0046bb20
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x40a3c0
cmp byte [0x005df929], 0
je 0x46d9b6
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x005dffc0]
aesenc xmm0, xmmword [0x005dffd0]
aesenc xmm0, xmmword [0x005dffe0]
movq rax, xmm0
ret
jmp 0x40a3c0

Function at 0x46f500
Capabilities:
Allocate thread local storage

Disassembly:
push rbp
mov rbp, rsp
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x46f534
mov rcx, 0x28
jmp 0x46f53f
shl rcx, 3
add rcx, 0x1480
mov qword [0x005dfb98], rcx
pop rbp
ret