joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48e5e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48e6ff
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
movabs rdx, 0x65746e5976898a62
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x934e9689a28fc462
mov qword [rsp + 0x22], rdx
movabs rdx, 0xbfbe81f9c846d198
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x1315010b171615
mov qword [rsp + 0x32], rdx
movabs rdx, 0x70f0b11000c0d09
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x70d05101014070f
mov qword [rsp + 0x40], rdx
movabs rdx, 0x20205090b0b0a0a
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x48e680
movzx r9d, byte [rsp + rsi + 0x1a]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x4b]
mov byte [rsp + rdi + 0x1a], dl
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
nop
cmp rax, 0x1e
jge 0x48e6bc
movzx edx, byte [rsp + rax + 0x32]
lea rsi, [rax + 1]
cmp rsi, 0x1e
jae 0x48e6f1
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x18
jae 0x48e6e5
movzx r8d, byte [rsp + rdi + 0x1a]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x4b]
cmp rsi, 0x18
jb 0x48e665
jmp 0x48e6d7
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x18
call fcn.00449020
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov eax, esi
mov ecx, 0x18
nop
call fcn.0045cdc0
mov eax, edi
mov ecx, 0x18
call fcn.0045cdc0
mov rax, rsi
mov ecx, 0x1e
call fcn.0045cdc0
nop
nop
call fcn.0045a6e0
jmp fcn.0048e5e0
Function at 0x412a40
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x412be6
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.0042e9a0
xorps xmm15, xmm15
mov r14, qword [0x005438a0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x412aab
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x412ac0
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
nop
test rbx, rbx
jbe 0x412ae5
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x412af9
cmp rbx, 0x1000
jae 0x412ab5
nop dword [rax]
jmp 0x412b69
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop
cmp rbx, 0x1000
jae 0x412b0d
xor edx, edx
jmp 0x412b60
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.0042e9a0
xorps xmm15, xmm15
mov r14, qword [0x005438a0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
nop dword [rax]
test dl, dl
jne 0x412aef
jmp 0x412ad4
call fcn.0045c040
xorps xmm15, xmm15
mov r14, qword [0x005438a0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.00432da0
lea rax, [0x0048327d]
mov ebx, 0x18
call fcn.004336a0
mov rax, qword [rsp + 0x38]
call fcn.004333a0
lea rax, [0x0048333d]
mov ebx, 0x19
call fcn.004336a0
mov rax, qword [rsp + 0x30]
nop
call fcn.004333a0
call fcn.00433000
call fcn.00432e20
lea rax, [0x0048518e]
mov ebx, 0x21
nop dword [rax + rax]
call fcn.00431460
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004584e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.00412a40
Function at 0x412c20
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x412e4a
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.0042ea20
xorps xmm15, xmm15
mov r14, qword [0x005438a0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x412c99
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x412cac
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x412cd0
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
nop
jmp 0x412ce4
cmp rbx, 0x1000
jae 0x412ca3
jmp 0x412d65
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x412cf6
xor esi, esi
jmp 0x412d56
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
nop dword [rax]
call fcn.0042ea20
xorps xmm15, xmm15
mov r14, qword [0x005438a0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x412cda
nop
jmp 0x412cc2
call fcn.0045c040
xorps xmm15, xmm15
mov r14, qword [0x005438a0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x412de5
call fcn.00432da0
lea rax, [0x004836f3]
mov ebx, 0x19
call fcn.004336a0
mov rax, qword [rsp + 0x68]
call fcn.004333a0
lea rax, [0x0048333d]
mov ebx, 0x19
call fcn.004336a0
mov eax, dword [rsp + 0x34]
nop dword [rax]
call fcn.004333a0
call fcn.00433000
call fcn.00432e20
lea rax, [0x00480994]
mov ebx, 0xd
nop dword [rax + rax]
call fcn.00431460
cmp eax, 0x5af
je 0x412d88
call fcn.00432da0
lea rax, [0x004836f3]
mov ebx, 0x19
nop dword [rax]
call fcn.004336a0
mov rax, qword [rsp + 0x38]
call fcn.004333a0
lea rax, [0x0048333d]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.004336a0
mov eax, dword [rsp + 0x34]
call fcn.004333a0
call fcn.00433000
call fcn.00432e20
lea rax, [0x00484be9]
mov ebx, 0x1f
call fcn.00431460
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004584e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00412c20
Function at 0x41b100
Capabilities:
Hash data using murmur3

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
cmp byte [0x005436cf], 0
jne 0x41b1ef
mov rdx, qword [rax + 0x50]
test byte [rdx], al
nop
nop
nop
sub rbx, qword [rax + 0x18]
mov esi, dword [rax + 0x5c]
imul rbx, rsi
mov rsi, rbx
shr rbx, 0x20
shr rsi, 0x23
and ebx, 7
mov rdi, rcx
mov rcx, rbx
mov r8d, 1
shl r8d, cl
add rdx, rsi
lock or byte [rdx], r8b
nop
nop
mov rcx, qword [rax + 0x18]
nop
movabs rdx, 0x800000000000
lea rax, [rdx + rcx]
mov rdx, rax
shr rax, 0x2a
cmp rax, 0x40
jae 0x41b1e5
lea rbx, [0x00515b10]
mov rax, qword [rbx + rax*8]
shr rdx, 0x16
and edx, 0xfffff
mov rdx, qword [rax + rdx*8]
test byte [rdx], al
test byte [rax], al
mov rax, rcx
shr rcx, 0x10
and ecx, 0x3f
movzx ebx, byte [rdx + rcx + 0x11440]
lea rdx, [rdx + rcx]
lea rdx, [rdx + 0x11440]
shr rax, 0xd
and eax, 7
mov rcx, rax
mov eax, 1
shl eax, cl
test al, bl
jne 0x41b1c7
lock or byte [rdx], al
mov rax, qword [r14 + 0x30]
mov rax, qword [rax + 0xa0]
test byte [rax], al
add qword [rax + 0x1248], rdi
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov ecx, 0x40
call fcn.0045ab40
lea rax, [0x004865fd]
mov ebx, 0x2c
nop dword [rax + rax]
call fcn.00431460
nop
int3

Function at 0x41d5e0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41d6de
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rbx
mov qword [rsp + 8], 0
jmp 0x41d620
mov rax, qword [rsp + 0x50]
mov rcx, rdx
mov rbx, qword [rsp + 0x58]
nop
cmp qword [rsp + 8], rbx
jae 0x41d6cf
test byte [rax], al
lea rcx, [rax + 0x100b8]
mov rax, rcx
call fcn.0041e1a0
nop dword [rax]
test rax, rax
je 0x41d6cf
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x30], xmm15
lea rcx, [0x0041d720]
mov qword [rsp + 0x10], rcx
lea rdx, [rsp + 8]
mov qword [rsp + 0x18], rdx
mov rdx, qword [rsp + 0x50]
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rbx
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x38], rax
lea rbx, [rsp + 0x10]
mov qword [rsp], rbx
call fcn.004583a0
xorps xmm15, xmm15
mov r14, qword [0x005438a0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x60]
test rdx, rdx
jne 0x41d6bd
xor eax, eax
jmp 0x41d6c7
mov rax, qword [rdx]
call rax
mov rdx, qword [rsp + 0x60]
test al, al
je 0x41d612
mov rax, qword [rsp + 8]
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.004584e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0041d5e0
Function at 0x42afe0
Capabilities:
Hash data using murmur3

Disassembly:
cmp rsp, qword [r14 + 0x18]
jbe 0x42b286
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
test byte [rax], al
lea rsi, [rax + 0x1270]
mov rcx, qword [rax + 0x1260]
sub rcx, rsi
shr rcx, 3
cmp rcx, 0x200
ja 0x42b27a
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x30], rcx
mov qword [rax + 0x1260], 0
cmp byte [0x005436cf], 0
jne 0x42b042
xor edx, edx
xor ebx, ebx
nop
jmp 0x42b08a
xor edx, edx
jmp 0x42b06d
mov qword [rsp + 0x28], rdx
mov rcx, qword [rax + rdx*8 + 0x1270]
mov rax, rcx
call fcn.0041a920
mov rdx, qword [rsp + 0x28]
inc rdx
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
cmp rdx, rcx
jl 0x42b046
add rax, 0x1260
call fcn.0042aea0
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
inc rdx
cmp rdx, rcx
jge 0x42b214
mov rsi, qword [rax + rdx*8 + 0x1270]
nop dword [rax + rax]
cmp rsi, 0x1000
jb 0x42b087
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rbx
mov rax, rsi
xor ebx, ebx
mov rcx, rbx
nop dword [rax + rax]
call fcn.0040f9c0
test rax, rax
jne 0x42b0e2
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
nop
jmp 0x42b087
mov rsi, qword [rbx + 0x50]
test byte [rsi], al
nop
mov r8, rcx
shr rcx, 3
movzx r9d, byte [rsi + rcx]
and r8d, 7
mov rdx, rcx
mov rcx, r8
mov r10d, 1
shl r10d, cl
add rsi, rdx
test r10b, r9b
je 0x42b129
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
jmp 0x42b087
nop
lock or byte [rsi], r10b
nop
nop
mov rcx, qword [rbx + 0x18]
nop
movabs rsi, 0x800000000000
lea r8, [rsi + rcx]
mov r9, r8
shr r8, 0x2a
cmp r8, 0x40
jae 0x42b26d
lea r10, [0x00515b10]
mov r8, qword [r10 + r8*8]
shr r9, 0x16
and r9d, 0xfffff
mov r9, qword [r8 + r9*8]
test byte [r9], al
test byte [r8], al
mov r8, rcx
shr rcx, 0x10
and ecx, 0x3f
movzx r10d, byte [r9 + rcx + 0x11440]
lea r9, [r9 + rcx]
lea r9, [r9 + 0x11440]
shr r8, 0xd
and r8d, 7
mov rcx, r8
mov r8d, 1
shl r8d, cl
test r8b, r10b
jne 0x42b1af
lock or byte [r9], r8b
movzx r8d, byte [rbx + 0x62]
test r8b, 1
je 0x42b1e5
mov rax, qword [rsp + 0x48]
mov r8, qword [rax + 0x1248]
add r8, qword [rbx + 0x68]
mov qword [rax + 0x1248], r8
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
jmp 0x42b087
mov r8, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
cmp r8, rcx
jae 0x42b265
mov rbx, qword [rsp + 0x48]
mov qword [rbx + r8*8 + 0x1270], rax
inc r8
mov rax, rbx
mov rdx, qword [rsp + 0x28]
mov rbx, r8
jmp 0x42b087
cmp rbx, 0x200
ja 0x42b258
lea rdx, [rax + 0x1270]
lea rsi, [rax + 0x1238]
mov rcx, rbx
mov edi, 0x200
mov rbx, rdx
mov rax, rsi
call fcn.00420aa0
mov rax, qword [rsp + 0x48]
add rax, 0x1260
call fcn.0042aea0
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov rcx, rbx
mov edx, 0x200
call fcn.0045aba0
mov rax, r8
call fcn.0045ab20
mov rax, r8
mov ecx, 0x40
call fcn.0045ab40
mov edx, 0x200
nop
call fcn.0045ab80
nop
mov qword [rsp + 8], rax
call fcn.0045cf00
mov rax, qword [rsp + 8]
jmp fcn.0042afe0
Function at 0x43f8c0
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x43fa2a
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov ecx, dword [rax + 0x190]
mov edx, dword [rax + 0x194]
mov rsi, qword [rax + 0x998]
mov edi, dword [rax + 0x194]
cmp edi, edx
jne 0x43f8d8
cmp edx, ecx
jne 0x43fa18
nop dword [rax]
test rsi, rsi
jne 0x43fa18
mov qword [rsp + 0x28], rax
test rbx, rbx
jne 0x43f934
nop
call fcn.0045c4a0
xorps xmm15, xmm15
mov r14, qword [0x005438a0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rbx, qword [rsp]
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x10], rbx
call fcn.0043f7c0
mov rcx, qword [0x004f09e8]
mov rdx, qword [0x004f09e0]
mov rbx, qword [rsp + 0x28]
mov esi, dword [rbx]
mov edi, esi
sar esi, 0x1f
shr esi, 0x1b
add esi, edi
mov r8d, esi
and esi, 0xffffffe0
sub edi, esi
test edi, edi
jl 0x43fa13
cmp edi, 0x20
sbb esi, esi
sar r8d, 5
mov rax, rcx
mov ecx, edi
mov r9d, 1
shl r9d, cl
and r9d, esi
movsxd rsi, r8d
cmp rax, rsi
jbe 0x43fa08
lea rcx, [rdx + rsi*4]
lock or dword [rcx], r9d
mov rcx, qword [0x004f13d0]
mov qword [rbx + 8], rcx
nop
mov rcx, rbx
mov qword [0x004f13d0], rbx
nop
mov edx, 1
lea rsi, [0x004f13d8]
lock xadd dword [rsi], edx
mov rdx, qword [rcx + 0x1220]
shr rdx, 0x3d
test dl, dl
jne 0x43f9f7
nop
nop
mov rax, qword [rsp + 0x10]
movabs rdx, 0x1fffffffffffffff
and rdx, rax
bts rdx, 0x3f
xchg qword [rcx + 0x1220], rdx
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x00485f1f]
mov ebx, 0x28
call fcn.00431460
mov rcx, rax
mov rax, rsi
call fcn.0045ab20
call fcn.0042fb20
lea rax, [0x004855ca]
mov ebx, 0x23
call fcn.00431460
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004584e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0043f8c0
Function at 0x449ac0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov qword [rsp + 0x20], rax
test rbx, rbx
jbe 0x449c38
movzx edx, byte [rax]
nop
test edx, edx
jne 0x449afc
test r8b, r8b
jne 0x449afc
xor eax, eax
xor ebx, ebx
mov rcx, rbx
xor edi, edi
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
bt edx, 7
jae 0x449b0f
xor edx, edx
xor r8d, r8d
xor r9d, r9d
jmp 0x449bf8
mov r8d, 1
mov r9d, edx
and edx, 1
neg edx
shr r9d, 1
xor edx, r9d
add dword [rsi], edx
cmp rbx, r8
jb 0x449be6
sub rbx, r8
sub rcx, r8
mov rdx, rcx
neg rcx
sar rcx, 0x3f
and r8, rcx
lea rsi, [rax + r8]
test rbx, rbx
jbe 0x449bdc
movzx r8d, byte [rax + r8]
bt r8d, 7
jae 0x449b63
xor eax, eax
xor ecx, ecx
xor r8d, r8d
jmp 0x449ba6
mov eax, 1
cmp rax, rbx
ja 0x449b95
add qword [rdi], r8
sub rdx, rax
sub rbx, rax
mov rcx, rdx
neg rdx
sar rdx, 0x3f
and rax, rdx
add rax, rsi
mov edi, 1
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov rcx, rbx
call fcn.0045abe0
lea r8d, [rcx + 7]
mov ecx, eax
mov eax, r10d
cmp rax, rbx
jae 0x449bd4
movzx r9d, byte [rax + rsi]
lea r10d, [rax + 1]
mov r11d, r9d
and r9d, 0x7f
mov eax, ecx
mov ecx, r8d
shl r9d, cl
or eax, r9d
test r11b, 0x80
jne 0x449b9d
mov r8d, eax
mov eax, r10d
jmp 0x449b68
mov rcx, rbx
call fcn.0045ab20
xor eax, eax
mov rcx, rax
call fcn.0045ab20
mov eax, r8d
mov rcx, rbx
call fcn.0045abe0
lea r9d, [rcx + 7]
mov rcx, r12
cmp rbx, rdx
jbe 0x449c2e
movzx r10d, byte [rdx + rax]
inc edx
mov r11d, r10d
and r10d, 0x7f
mov r12, rcx
mov ecx, r9d
shl r10d, cl
or r8d, r10d
test r11b, 0x80
jne 0x449bf1
mov rcx, r12
mov r9d, edx
mov edx, r8d
mov r8d, r9d
jmp 0x449b15
mov eax, edx
mov rcx, rbx
call fcn.0045ab20
xor eax, eax
mov rcx, rax
nop dword [rax]
call fcn.0045ab20
nop
int3
Function at 0x451320
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4513d9
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov qword [rsp + 0x70], rbx
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rdx, [0x00451420]
mov qword [rsp + 0x10], rdx
lea rdx, [rsp + 8]
mov qword [rsp + 0x18], rdx
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x20], rdx
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x28], rdx
mov rdx, r14
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.004583a0
xorps xmm15, xmm15
mov r14, qword [0x005438a0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.004584e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00451320
Function at 0x45a5e0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, qword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x00543980]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
nop
nop
xor rax, rdx
ret
cmp byte [0x005436ce], 0
je 0x45a616
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x00543cc0]
aesenc xmm0, xmmword [0x00543cd0]
aesenc xmm0, xmmword [0x00543ce0]
movq rax, xmm0
ret
jmp 0x408640

Function at 0x45bfc0
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x30
mov rcx, 0xfffffffffffffff4
mov qword [rsp], rcx
mov rax, qword [sym.imp.kernel32.dll_GetStdHandle]
call rax
mov rcx, rax
mov qword [rsp], rcx
lea rdx, [0x00543c40]
mov qword [rsp + 8], rdx
lea r8d, [0x005436e4]
mov qword [rsp + 0x10], r8
lea r9, [rsp + 0x28]
mov qword [r9], 0
mov qword [rsp + 0x18], r9
mov qword [rsp + 0x20], 0
mov rax, qword [sym.imp.kernel32.dll_WriteFile]
call rax
call fcn.0045a4c0
add rsp, 0x30
ret

Function at 0x45c500
Capabilities:
Allocate thread local storage

Disassembly:
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x45c530
mov rcx, 0x28
jmp 0x45c53b
shl rcx, 3
add rcx, 0x1480
mov qword [0x005438a0], rcx
ret
Function at 0x6e415150
Capabilities:
Encode data using xor

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rax, qword [rcx + 8]
mov rax, qword [rax + 0xc8]
lea edi, [r9 + 1]
mov rsi, rdx
mov rbp, rcx
mov edx, dword [rdx + 4]
test byte [rax + 0x70], 1
je 0x6e415223
lea ecx, [rdi + r8]
xor eax, eax
cmp ecx, edx
ja 0x6e415218
mov rcx, qword [rsi + 0x10]
mov eax, r8d
sub edx, r8d
movdqu xmm1, xmmword [rsi + 0x10]
movq xmm0, rax
mov dword [rsi + 4], edx
punpcklqdq xmm0, xmm0
paddq xmm0, xmm1
add rcx, rax
movups xmmword [rsi + 0x10], xmm0
jmp 0x6e41522d
mov r11d, 0xff
mov r10, qword [rsi + 0x10]
xor edx, edx
nop
mov eax, ebx
mov ecx, ebx
sub eax, edx
xor ecx, edx
xor eax, edx
or eax, ecx
mov ecx, r9d
sub ecx, edx
xor eax, ebx
add edx, 1
movzx ecx, byte [r10 + rcx]
sar eax, 0x1f
xor ecx, ebx
not ecx
or eax, ecx
and r8d, eax
cmp r11d, edx
ja 0x6e4151c0
mov eax, r8d
not eax
movzx eax, al
or r8d, 0xffffff00
add ebx, 1
sub eax, 1
and eax, r8d
sar eax, 0x1f
and ebx, eax
and eax, 0xfffffffe
sub edi, ebx
shl ebx, 8
not eax
or dword [rsi], ebx
mov dword [rsi + 4], edi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
xor eax, eax
cmp edi, edx
ja 0x6e415218
mov rcx, qword [rsi + 0x10]
lea eax, [rdx - 1]
test byte [rbp + 0x19d], 2
movzx ebx, byte [rcx + rax]
mov r12d, ebx
je 0x6e41524a
cmp qword [rbp + 0xe0], 0
je 0x6e4152c0
mov rax, qword [rbp + 0xd0]
mov rcx, qword [rax]
call fcn.6e4402c0
test eax, 0x200000
jne 0x6e4152a2
lea r9d, [rbx + rdi]
mov edi, dword [rsi + 4]
mov eax, edi
sub eax, r9d
xor eax, r9d
xor r9d, edi
or eax, r9d
lea r9d, [rdi - 1]
xor eax, edi
sar eax, 0x1f
cmp r9d, 0xfe
mov r8d, eax
not r8d
ja 0x6e4151b2
test r9d, r9d
mov r11d, r9d
jne 0x6e4151b8
jmp 0x6e4151f1
not ebx
mov eax, 1
add dword [rsi + 4], ebx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rax, qword [rbp + 0x80]
mov r8d, 8
lea rdx, [0x6e448400]
lea rcx, [rax + 8]
call fcn.6e4404a8
test eax, eax
je 0x6e4152fd
mov rax, qword [rbp + 0x80]
mov eax, dword [rax]
test al, 8
je 0x6e41524a
cmp ebx, 1
adc ebx, 0xffffffff
jmp 0x6e41524a
mov rdx, qword [rbp + 0x80]
and r12d, 1
mov eax, dword [rdx]
jne 0x6e4152ea
or eax, 8
mov dword [rdx], eax
jmp 0x6e4152f2
Function at 0x6e415320
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xa8
mov ebp, dword [rdx + 4]
mov r12d, ebp
mov rdi, rcx
mov r13, rdx
sub r12d, r8d
cmp r8d, r9d
mov esi, r8d
mov r14d, r9d
ja 0x6e415480
cmp esi, 0x40
ja 0x6e4154a1
lea rax, [rsp + 0x20]
xor r15d, r15d
mov r10, rax
neg r10
and r10d, 0x3f
add r10, rax
lea eax, [rsi + 0x100]
cmp eax, r14d
jae 0x6e415384
lea r15d, [r14 - 0x100]
sub r15d, esi
mov eax, esi
xor edx, edx
mov rcx, r10
shr eax, 1
mov r8d, esi
shl eax, 0x18
add eax, r12d
sub eax, r15d
div esi
mov ebx, edx
xor edx, edx
call sub.msvcrt.dll_memset
cmp r15d, r14d
mov r10, rax
jae 0x6e415425
mov r8d, r15d
add r8, qword [r13 + 0x10]
mov edx, r15d
mov r9d, r14d
sub edx, ebp
sub r9d, ebp
xor eax, eax
lea r13d, [rbp + rdx]
mov r14d, r12d
mov r15d, ebp
lea r11d, [rsi + rdx]
xor r14d, r13d
xor r15d, edx
xor r11d, r12d
add edx, 1
add r8, 1
lea ecx, [rax + 1]
or r11d, r14d
mov r14d, ebp
xor r11d, r13d
xor r14d, r13d
sar r11d, 0x1f
or r14d, r15d
not r11d
and r11b, byte [r8 - 1]
xor r13d, r14d
sar r13d, 0x1f
and r13d, r11d
mov r11d, esi
or byte [r10 + rax], r13b
mov eax, ecx
xor r11d, ecx
sub eax, esi
xor eax, esi
or eax, r11d
xor eax, ecx
sar eax, 0x1f
and eax, ecx
cmp r9d, edx
jne 0x6e4153c0
lea eax, [rsi - 1]
test esi, esi
lea rcx, [rdi + rax + 1]
je 0x6e415463
lea edx, [rbx + 1]
mov eax, ebx
add rdi, 1
xor eax, 0x20
add rax, r10
movzx eax, byte [rax]
movzx eax, byte [r10 + rbx]
mov ebx, edx
sub ebx, esi
xor ebx, esi
mov byte [rdi - 1], al
mov eax, esi
xor eax, edx
or ebx, eax
xor ebx, edx
sar ebx, 0x1f
and ebx, edx
cmp rdi, rcx
jne 0x6e415431
add rsp, 0xa8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea r8, str.orig_len___md_size
mov edx, 0xf8
lea rcx, str.s3_cbc.c
call fcn.6e43ff50
cmp esi, 0x40
jbe 0x6e41535a
lea r8, str.md_size___EVP_MAX_MD_SIZE
mov edx, 0xf9
lea rcx, str.s3_cbc.c
call fcn.6e43ff50
jmp 0x6e41535a
Function at 0x6e419910
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x40
mov eax, dword [rcx + 0x38]
test eax, eax
mov rbx, rcx
mov esi, edx
je 0x6e419ac9
cmp edx, 0xfffffffe
jne 0x6e419972
mov rax, qword [rcx + 0x100]
test dword [rax + 0x54], 0x30000
je 0x6e419970
mov rax, qword [rcx + 0x80]
mov rax, qword [rax + 0x3a0]
mov edx, dword [rax + 0x10]
cmp edx, 0x300c02b
je 0x6e419abf
cmp edx, 0x300c02c
mov eax, 0x2cb
je 0x6e419968
xor eax, eax
add rsp, 0x40
pop rbx
pop rsi
pop rdi
ret
xor esi, esi
mov edx, dword [rbx + 0x19c]
lea r9, [rsp + 0x38]
mov rcx, rbx
lea r8, [rsp + 0x28]
shr edx, 0x16
and edx, 1
call fcn.6e418530
test eax, eax
je 0x6e419966
mov edx, dword [rbx + 0x19c]
lea r9, [rsp + 0x30]
mov rcx, rbx
lea r8, [rsp + 0x20]
shr edx, 0x16
xor edx, 1
and edx, 1
call fcn.6e418530
test eax, eax
je 0x6e419966
mov r8, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x30]
test r8, r8
jne 0x6e4199f2
test byte [rbx + 0x19e], 0x40
jne 0x6e419a10
test rdi, rdi
jne 0x6e419a30
lea r10, [0x6e449260]
mov edi, 0x1c
mov qword [rsp + 0x30], 0x1c
mov qword [rsp + 0x20], r10
jmp 0x6e419a35
test rdi, rdi
jne 0x6e419a30
test byte [rbx + 0x19e], 0x40
je 0x6e4199d6
xor eax, eax
cmp esi, 0xffffffff
jne 0x6e419966
jmp 0x6e419968
lea rax, [0x6e449260]
test rdi, rdi
mov qword [rsp + 0x38], 0x1c
mov qword [rsp + 0x28], rax
je 0x6e419a00
mov r8d, 0x1c
mov r10, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
xor eax, eax
xor r11d, r11d
nop
test r8, r8
je 0x6e419a80
movzx r9d, byte [r10]
xor edx, edx
jmp 0x6e419a59
add rdx, 1
cmp rdx, r8
je 0x6e419a80
cmp r9b, byte [rcx + rdx*2]
jne 0x6e419a50
movzx ebx, byte [rcx + rdx*2 + 1]
cmp byte [r10 + 1], bl
jne 0x6e419a50
cmp esi, eax
je 0x6e419a97
add rdx, 1
add eax, 1
cmp rdx, r8
jne 0x6e419a59
nop word [rax + rax]
add r11, 1
add r10, 2
cmp r11, rdi
mov qword [rsp + 0x20], r10
jb 0x6e419a40
jmp 0x6e419a02
movzx eax, word [r10]
rol ax, 8
movzx eax, ax
sub eax, 1
cmp eax, 0x1b
ja 0x6e419966
lea rdx, [0x6e4492c0]
cdqe
mov eax, dword [rdx + rax*4]
jmp 0x6e419968
mov eax, 0x19f
jmp 0x6e419968
mov eax, 0xffffffff
jmp 0x6e419968