joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1404447c2
Capabilities:
Execute anti-debugging instructions

Disassembly:
bsr ecx, edx
jmp 0x14044424a
bsr ecx, edx
mov sil, byte [rsp]
mov di, r11w
mov bl, r12b
bswap r13
jmp 0x140444223
lea rsp, [rsp + 2]
jmp 0x1404442b8
jmp 0x14044426d
bswap r13
mov ebx, dword [rsp]
mov eax, esi
dec ebx
jne 0x14044420a
pushfq
add si, r12w
jmp 0x140444272
bt rbx, r9
jne 0x140444257
bsr r15w, cx
neg r13b
mov cl, 0x55
jmp 0x140444278
mov sil, byte [rsp]
mov di, r11w
mov bl, r12b
jmp 0x140444220
bsr r15w, cx
neg r13b
jmp 0x14044428e
pushfq
add si, r12w
rol r8d, 0
jmp 0x140444233
mov ebx, 0x27547054
neg cl
jmp 0x140444297
mov cl, 0x55
mov ebx, 0x27547054
neg cl
mov r9, rdx
jmp 0x1404442ee
mov di, 0xa431
lea rsp, [rsp + 2]
mov r12d, r8d
mov r15, r9
neg r10d
jl 0x1404441d9
jge 0x1404441e2
or r10d, esi
jno 0x14044431d
bswap ebp
lea rbx, [rsi + riz]
dec rbx
jmp 0x140444379
lea rsp, [rsp + 8]
neg r8d
mov si, sp
mov dx, r8w
lea rbx, [rax + riz + 0x646c]
jmp 0x1404442cd
bswap ebp
lea rbx, [rsi + riz]
call fcn.1404443ec
pop rax
mov ebx, 0x526e5095
mov r9b, 0xbe
bswap r15
setl r9b
jmp 0x14044435c
xchg dl, r13b
xchg qword [rsp + 8], rdi
mov di, word [rsp]
bswap rcx
jmp 0x14044439a
mov rbx, 0x3a71cceb
lea rdi, [rdi + riz - 0x21]
mov bpl, byte [rsp]
neg edx
rdtsc
mov dx, word [rsp]
jmp 0x140444346
mov di, word [rsp]
jmp 0x1404443be
cpuid
jmp 0x1404443a8
mov rsi, qword [rsp]
jmp 0x140444416
rdtsc
clc
xchg r10b, bpl
push qword [rsp + 8]
ret 0x10
xchg r10w, bx
mov r10, r14
xchg bp, ax
jmp 0x140444383
inc r8d
dec r13b
jno 0x14044437f
cpuid
xchg r10w, bx
mov r10, r14
xchg bp, ax
mov rsi, qword [rsp]
jmp 0x140444416
add r8d, 0x35295e9b
sete bl
mov ebx, r14d
mov si, word [rsp]
mov cx, 0xc6dc
call fcn.140444448
mov ds, word [rcx]
xchg qword [rsp], rdx
and bp, dx
lea rbx, [rdx + rdx]
bswap ebp
mov r10d, edx
jmp 0x140444673
mov r13, 0xffffffffaf0cd3a3
push word [rsp + 3]
js 0x1404442af
mov di, 0xa431
jmp 0x140444200
neg ebp
lea rdx, [rdx + riz - 0x30]
mov al, byte [rsp]
xchg rcx, rbp
mov ecx, dword [rsp]
neg di
call fcn.14044459e
call fcn.1404446b9
invalid
jmp 0x140444462
Function at 0x1405fa6fa
Capabilities:
Execute anti-debugging instructions

Disassembly:
push rbp
lea rsp, [rsp + 9]
sub rsp, 0x15
sub rsp, 0x18
jmp 0x1405fa4f7
mov qword [rsp + 3], rsp
sub rsp, 0x1d
lea rsp, [rsp + 5]
jmp 0x1405fa4de
cmc
sub rsp, 0x14
sub rsp, 0x14
std
mov dword [rsp + 0x1b], r10d
lea rsp, [rsp + 0x10]
jmp 0x1405fa4b2
mov qword [rsp + 0x10], rsi
mov sil, bl
mov esi, dword [rsp]
sub rsp, 0x10
jmp 0x1405fa526
mov byte [rsp + 0x26], al
pushfq
push word [rsp + 0xd]
lea rsp, [rsp + 6]
lea rsp, [rsp + 0x38]
cld
jmp 0x1405fa4c8
lea rsp, [rsp + 4]
mov qword [rsp + 8], rbx
clc
neg rsi
mov bl, byte [rsp]
jmp 0x1405fa5fe
lea rsi, [r14*4]
bswap esi
mov si, 0x36dd
pop word [rsp + 6]
bswap esi
lea rsp, [rsp + 2]
jmp 0x1405fa50e
setnp r12b
mov qword [rsp + 3], rbp
mov bp, 0x12a9
bt bx, dx
mov ebp, dword [rsp]
mov esi, dword [rsp]
jmp 0x1405fa5a6
mov sil, 0xa
cld
lea rsi, [r15*4]
pushfq
xchg qword [rsp], rsi
mov rsi, 0x1dc0b2ee
jmp 0x1405fa542
xchg bx, r15w
bts bx, bp
setg r12b
push rdi
lea rdi, [0xffffffffc74a4942]
setg sil
jmp 0x1405fa5d5
mov r12b, 0x58
not r12b
xchg sil, bl
push r15
xor ebp, 0x4ad962e6
mov r12d, 0x8d9e2b97
jmp 0x1405fa57f
xchg r12b, bpl
mov bl, byte [rsp]
btr r15, rdi
mov bpl, r13b
push rax
stc
jmp 0x1405fa62c
bswap ebp
mov r15d, dword [rsp]
lea r15, [r11 + riz]
xchg rsi, rbx
push r14
or rdi, 0x63752b8a
jmp 0x1405fa5bf
mov esi, dword [rsp]
setl bl
push r14
mov qword [rsp + 7], r12
bsr si, r8w
cld
jmp 0x1405fa565
mov byte [rsp + 0xb], sil
bswap rsi
lea rsp, [rsp + 7]
jmp 0x1405fa67b
lea rdi, [rax*4]
sub rsp, 0x15
inc si
mov rdi, 0xffffffffe40ba046
add rsp, 6
bsf esi, r9d
jmp 0x1405fa616
xchg r13b, r12b
ror r15b, cl
xchg ebx, edi
bswap ebx
push r8
mov r8, rsp
jmp 0x1405fa6ad
bsf r15w, dx
push r13
lea r14, [0x27405d73]
mov r14b, 0x2c
jmp 0x1405fa64c
mov qword [rsp], r11
and bp, 0x51d8
mov r15b, r11b
xchg r12, r15
mov al, bl
lea rbx, [rdi*8]
jmp 0x1405fa662
mov r13w, word [rsp + 7]
mov qword [rsp], rdx
mov r11d, dword [rsp]
sbb r8d, r13d
jmp 0x1405fa6bf
cld
std
add r14w, r14w
not r12b
mov r12d, 0xcc988644
pushfq
jmp 0x1405fa696
lea rdx, [r14*4]
bts r14d, edi
mov r8w, word [rsp]
mov ebp, dword [rsp]
jmp 0x1405fa717
pushfq
push rdi
jmp 0x1405fa45c
mov rsi, 0xffffffffa9734cb2
lea r15, [rcx + r10]
push r9
jmp 0x1405fa758
rdtsc
btc bx, r12w
push rcx
mov edx, dword [rsp]
mov r14d, 0x9e790496
neg r13
jmp 0x1405fa701
push r10
mov rcx, 0xffffffffb9a7b09f
neg rcx
lea r13, [rcx + riz - 0x71cb]
xchg r14, r8
mov r14d, 0xedc781ca
jmp 0x1405fa773
mov r13d, dword [rsp]
clc
lea r12, [0x8194fd6]
mov rax, rdx
mov ecx, 0x12a65edf
bt r14, r9
jmp 0x1405fa72d
clc
bsf r13, r13
bswap r9d
xchg r14b, r9b
lea r11, [r9*4]
mov rbx, rbp
jmp 0x1405fab9f
mov dword [rsp + 9], r10d
xchg r9b, r11b
lea rsp, [rsp + 0x2b]
mov si, ax
rol dil, 6
bswap rbx
jmp 0x1405fa7b7
lea rsp, [rsp + 1]
sub rsp, 0x18
cpuid
push qword [rsp + 0x14]
sub rsp, 0x13
mov eax, 0x9bbe4719
jmp 0x1405fa7cd
mov byte [rsp + 6], dil
cld
bsr r13, r12
mov si, 0x3b32
add rsp, 6
add r11, 0xe8b1fad
jmp 0x1405fa7f9
push rbx
mov r14b, sil
xchg r8d, r12d
bswap rbx
xchg r15b, r10b
mov r14b, byte [rsp + 6]
jmp 0x1405fa863
Function at 0x1405fa8c3
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov r13, qword [rsp + 0x36]
mov ecx, 0xaf49fe1e
jmp 0x1405fa904
xor ecx, 0xc374d7dc
pop word [rsp + 0xc]
xchg r14, r11
pop qword [rsp + 0x20]
mov ax, word [rsp + 0x12]
jmp 0x1405fa8ad
lea r15, [0x557efed5]
mov sil, r10b
xchg byte [rsp + 0x1e], cl
mov qword [rsp + 0x12], r9
clc
xchg r8d, r14d
jmp 0x1405fa8ee

Function at 0x1405fb0b0
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea rsp, [rsp + 0x43]
mov ax, word [rsp + 7]
xchg qword [rsp], r10
jmp 0x1405fb0d0

Function at 0x1405fb447
Capabilities:
Execute anti-debugging instructions

Disassembly:
inc r14b
bt r9w, cx
jmp 0x1405fb431

Function at 0x1405fce08
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
lea rsp, [rsp + 3]
lea rsp, [rsp + 0x18]
jmp 0x1405fce4e
mov rax, qword gs:[0x60]
mov rax, qword [rax + riz + 0x18]
mov rax, qword [rax + riz + 0x30]
jmp 0x1405fce38
Function at 0x4148c0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x414a4b
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call sym.runtime.stdcall3.abi0
xorps xmm15, xmm15
mov r14, qword [0x005976c8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x414925
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x414934
add rsp, 0x48
pop rbp
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x414953
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x414963
cmp rbx, 0x1000
jae 0x41492b
jmp 0x4149cd
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x414975
xor edx, edx
jmp 0x4149c4
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call sym.runtime.stdcall3.abi0
xorps xmm15, xmm15
mov r14, qword [0x005976c8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x414959
jmp 0x414948
call sym.runtime.getlasterror.abi0
xorps xmm15, xmm15
mov r14, qword [0x005976c8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call sym.runtime.printlock
lea rax, [0x004adf43]
mov ebx, 0x18
nop dword [rax]
call sym.runtime.printstring
mov rax, qword [rsp + 0x38]
call sym.runtime.printuint
lea rax, [0x004ae263]
mov ebx, 0x19
nop dword [rax + rax]
call sym.runtime.printstring
mov rax, qword [rsp + 0x30]
call sym.runtime.printuint
call sym.runtime.printnl
call sym.runtime.printunlock
lea rax, [0x004afe44]
mov ebx, 0x21
call sym.runtime.throw
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp sym.runtime.sysUnusedOS
Function at 0x414a80
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x414ca6
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call sym.runtime.stdcall4.abi0
xorps xmm15, xmm15
mov r14, qword [0x005976c8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x414af3
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x414b02
add rsp, 0x50
pop rbp
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x414b25
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x414b35
cmp rbx, 0x1000
jae 0x414af9
nop
jmp 0x414bb8
add rsp, 0x50
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop word [rax + rax]
cmp rbx, 0x1000
jae 0x414b4d
xor esi, esi
jmp 0x414baa
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call sym.runtime.stdcall4.abi0
xorps xmm15, xmm15
mov r14, qword [0x005976c8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x414b2b
jmp 0x414b16
call sym.runtime.getlasterror.abi0
xorps xmm15, xmm15
mov r14, qword [0x005976c8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x414c40
nop dword [rax + rax]
call sym.runtime.printlock
lea rax, [0x004ae27c]
mov ebx, 0x19
call sym.runtime.printstring
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
call sym.runtime.printuint
lea rax, [0x004ae263]
mov ebx, 0x19
call sym.runtime.printstring
mov eax, dword [rsp + 0x34]
call sym.runtime.printuint
nop
call sym.runtime.printnl
call sym.runtime.printunlock
lea rax, [0x004ab900]
mov ebx, 0xd
call sym.runtime.throw
nop dword [rax + rax]
cmp eax, 0x5af
je 0x414be0
call sym.runtime.printlock
lea rax, [0x004ae27c]
mov ebx, 0x19
call sym.runtime.printstring
mov rax, qword [rsp + 0x38]
call sym.runtime.printuint
lea rax, [0x004ae263]
mov ebx, 0x19
call sym.runtime.printstring
mov eax, dword [rsp + 0x34]
nop dword [rax]
call sym.runtime.printuint
call sym.runtime.printnl
call sym.runtime.printunlock
lea rax, [0x004af743]
mov ebx, 0x1f
nop dword [rax + rax]
call sym.runtime.throw
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp sym.runtime.sysUsedOS
Function at 0x41c9c0
Capabilities:
Hash data using murmur3

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
cmp byte [0x005974b2], 0
jne 0x41caa7
sub rbx, qword [rax + 0x18]
mov rdx, qword [rax + 0x50]
test byte [rdx], al
mov esi, dword [rax + 0x64]
imul rbx, rsi
mov rsi, rbx
shr rbx, 0x20
shr rsi, 0x23
and ebx, 7
mov rdi, rcx
mov rcx, rbx
mov r8d, 1
shl r8d, cl
add rdx, rsi
nop
nop
nop
nop
lock or byte [rdx], r8b
mov rcx, qword [rax + 0x18]
movabs rdx, 0x800000000000
lea rax, [rdx + rcx]
mov rdx, rax
shr rdx, 0x2a
nop
nop
nop
cmp rdx, 0x40
jae 0x41ca9a
lea rbx, [0x00569898]
mov rdx, qword [rbx + rdx*8]
test byte [rdx], al
mov rbx, rcx
shr rbx, 0x10
and ebx, 0x3f
shr rcx, 0xd
and ecx, 7
mov esi, 1
shl esi, cl
shr rax, 0x16
and eax, 0xfffff
mov rax, qword [rdx + rax*8]
test byte [rax], al
movzx edx, byte [rax + rbx + 0x11440]
lea rax, [rax + rbx]
lea rax, [rax + 0x11440]
test sil, dl
jne 0x41ca80
lock or byte [rax], sil
mov rax, qword [r14 + 0x30]
mov rax, qword [rax + 0xa0]
test byte [rax], al
add qword [rax + 0x1250], rdi
add rsp, 0x10
pop rbp
ret
mov rax, rdx
mov ecx, 0x40
call sym.runtime.panicIndexU
lea rax, [0x004b18b5]
mov ebx, 0x2c
call sym.runtime.throw
nop
int3

Function at 0x41ed80
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41ee86
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x70], rcx
mov byte [rsp + 0x17], dil
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x18], 0
jmp 0x41edc3
mov rax, qword [rsp + 0x60]
mov rcx, rdx
mov rbx, qword [rsp + 0x68]
movzx edi, byte [rsp + 0x17]
cmp qword [rsp + 0x18], rbx
jae 0x41ee7b
test byte [rax], al
lea rcx, [rax + 0x100b8]
mov ebx, edi
mov rax, rcx
nop dword [rax]
call sym.runtime._scavengeIndex_.find
test rax, rax
je 0x41ee7b
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x30], xmm15
movups xmmword [rsp + 0x40], xmm15
lea rcx, [sym.runtime._pageAlloc_.scavenge.func1]
mov qword [rsp + 0x20], rcx
lea rdx, [rsp + 0x18]
mov qword [rsp + 0x28], rdx
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x48], rax
lea rbx, [rsp + 0x20]
mov qword [rsp], rbx
nop dword [rax]
call sym.runtime.systemstack.abi0
xorps xmm15, xmm15
mov r14, qword [0x005976c8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x70]
nop dword [rax]
test rdx, rdx
jne 0x41ee69
xor eax, eax
jmp 0x41ee73
mov rax, qword [rdx]
call rax
mov rdx, qword [rsp + 0x70]
test al, al
je 0x41edb1
mov rax, qword [rsp + 0x18]
add rsp, 0x50
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov byte [rsp + 0x20], dil
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movzx edi, byte [rsp + 0x20]
jmp sym.runtime._pageAlloc_.scavenge
Function at 0x42ce80
Capabilities:
Hash data using murmur3

Disassembly:
cmp rsp, qword [r14 + 0x18]
jbe 0x42d106
push rbp
mov rbp, rsp
sub rsp, 0x38
test byte [rax], al
mov rcx, qword [rax + 0x1268]
lea rsi, [rax + 0x1278]
sub rcx, rsi
shr rcx, 3
cmp rcx, 0x200
ja 0x42d0fa
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x30], rcx
mov qword [rax + 0x1268], 0
cmp byte [0x005974b2], 0
jne 0x42ceda
xor edx, edx
xor ebx, ebx
jmp 0x42cf20
xor edx, edx
jmp 0x42cf05
mov qword [rsp + 0x28], rdx
mov rcx, qword [rax + rdx*8 + 0x1278]
mov rax, rcx
call sym.runtime.shade
mov rdx, qword [rsp + 0x28]
inc rdx
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
cmp rdx, rcx
jl 0x42cede
add rax, 0x1268
call sym.runtime._wbBuf_.reset
add rsp, 0x38
pop rbp
ret
inc rdx
nop
cmp rdx, rcx
jge 0x42d094
mov rsi, qword [rax + rdx*8 + 0x1278]
cmp rsi, 0x1000
jb 0x42cf1b
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rbx
mov rax, rsi
xor ebx, ebx
mov rcx, rbx
call sym.runtime.findObject
test rax, rax
jne 0x42cf6c
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
jmp 0x42cf1b
mov rsi, qword [rbx + 0x50]
test byte [rsi], al
mov r8, rcx
shr r8, 3
movzx r9d, byte [rsi + r8]
and ecx, 7
mov r10d, 1
shl r10d, cl
nop
add rsi, r8
test r10b, r9b
je 0x42cfac
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
jmp 0x42cf1b
nop
lock or byte [rsi], r10b
mov rcx, qword [rbx + 0x18]
movabs rsi, 0x800000000000
lea r8, [rsi + rcx]
mov r9, r8
shr r8, 0x2a
nop
nop
nop
cmp r8, 0x40
jae 0x42d0ed
lea r10, [0x00569898]
mov r8, qword [r10 + r8*8]
test byte [r8], al
mov r10, rcx
shr r10, 0x10
and r10d, 0x3f
shr rcx, 0xd
and ecx, 7
mov r11d, 1
shl r11d, cl
shr r9, 0x16
and r9d, 0xfffff
mov r8, qword [r8 + r9*8]
test byte [r8], al
movzx r9d, byte [r8 + r10 + 0x11440]
lea r8, [r8 + r10]
lea r8, [r8 + 0x11440]
test r11b, r9b
jne 0x42d02f
lock or byte [r8], r11b
movzx r8d, byte [rbx + 0x6a]
test r8b, 1
je 0x42d065
mov rax, qword [rsp + 0x48]
mov r8, qword [rax + 0x1250]
add r8, qword [rbx + 0x70]
mov qword [rax + 0x1250], r8
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
jmp 0x42cf1b
mov r8, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
cmp r8, rcx
jae 0x42d0e5
mov rbx, qword [rsp + 0x48]
mov qword [rbx + r8*8 + 0x1278], rax
inc r8
mov rax, rbx
mov rdx, qword [rsp + 0x28]
mov rbx, r8
jmp 0x42cf1b
cmp rbx, 0x200
ja 0x42d0d4
lea rdx, [rax + 0x1278]
lea rsi, [rax + 0x1240]
mov rcx, rbx
mov edi, 0x200
mov rbx, rdx
mov rax, rsi
call sym.runtime._gcWork_.putBatch
mov rax, qword [rsp + 0x48]
add rax, 0x1268
call sym.runtime._wbBuf_.reset
add rsp, 0x38
pop rbp
ret
mov rcx, rbx
mov edx, 0x200
nop dword [rax]
call sym.runtime.panicSliceAcap
mov rax, r8
call sym.runtime.panicIndex
mov rax, r8
mov ecx, 0x40
call sym.runtime.panicIndexU
mov edx, 0x200
nop
call sym.runtime.panicSliceAlenU
nop
mov qword [rsp + 8], rax
call sym.runtime.morestackc.abi0
mov rax, qword [rsp + 8]
jmp sym.runtime.wbBufFlush1
Function at 0x441c40
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x441da7
push rbp
mov rbp, rsp
sub rsp, 0x18
mov ecx, dword [rax + 0x190]
mov edx, dword [rax + 0x194]
mov rsi, qword [rax + 0x998]
mov edi, dword [rax + 0x194]
cmp edi, edx
jne 0x441c52
cmp edx, ecx
jne 0x441d95
nop word [rax + rax]
test rsi, rsi
jne 0x441d95
mov qword [rsp + 0x28], rax
test rbx, rbx
jne 0x441cb4
nop
call sym.runtime.nanotime1.abi0
xorps xmm15, xmm15
mov r14, qword [0x005976c8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rbx, qword [rsp]
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x10], rbx
call sym.runtime.updateTimerPMask
mov rcx, qword [rsp + 0x28]
mov edx, dword [rcx]
mov ebx, edx
sar edx, 0x1f
shr edx, 0x1b
add edx, ebx
mov esi, edx
and edx, 0xffffffe0
sub ebx, edx
test ebx, ebx
jl 0x441d90
mov rdx, qword [0x00544678]
sar esi, 5
mov rax, rcx
mov ecx, ebx
mov edi, 1
shl edi, cl
movsxd rsi, esi
cmp ecx, 0x20
sbb r8d, r8d
and edi, r8d
cmp rdx, rsi
jbe 0x441d85
mov rcx, qword [0x00544670]
lea rcx, [rcx + rsi*4]
lock or dword [rcx], edi
mov rcx, qword [0x00545130]
mov qword [rax + 8], rcx
mov rcx, rax
nop
mov qword [0x00545130], rax
nop
mov edx, 1
lea rsi, [0x00545138]
lock xadd dword [rsi], edx
mov rdx, qword [rcx + 0x1228]
shr rdx, 0x3d
test dl, dl
jne 0x441d73
mov rax, qword [rsp + 0x10]
movabs rdx, 0x1fffffffffffffff
and rdx, rax
bts rdx, 0x3f
nop
nop
xchg qword [rcx + 0x1228], rdx
add rsp, 0x18
pop rbp
ret
lea rax, [0x004b10d1]
mov ebx, 0x28
nop
call sym.runtime.throw
mov rax, rsi
mov rcx, rdx
call sym.runtime.panicIndex
call sym.runtime.panicshift
lea rax, [0x004b0437]
mov ebx, 0x23
call sym.runtime.throw
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp sym.runtime.pidleput
Function at 0x44c880
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
test rbx, rbx
jbe 0x44c9f7
movzx edx, byte [rax]
test edx, edx
jne 0x44c8b4
nop dword [rax]
test r8b, r8b
jne 0x44c8b4
xor eax, eax
xor ebx, ebx
mov rcx, rbx
xor edi, edi
add rsp, 0x10
pop rbp
ret
bt edx, 7
jae 0x44c8c7
xor edx, edx
xor r8d, r8d
xor r9d, r9d
jmp 0x44c9b7
mov r8d, 1
mov r9d, edx
and edx, 1
neg edx
shr r9d, 1
xor edx, r9d
add dword [rsi], edx
nop dword [rax]
cmp rbx, r8
jb 0x44c9a5
sub rbx, r8
sub rcx, r8
mov rdx, rcx
neg rdx
sar rdx, 0x3f
and r8, rdx
lea rdx, [rax + r8]
test rbx, rbx
jbe 0x44c997
movzx esi, byte [rax + r8]
bt esi, 7
jae 0x44c91d
xor eax, eax
xor esi, esi
xor r8d, r8d
jmp 0x44c960
mov eax, 1
cmp rax, rbx
ja 0x44c94b
add qword [rdi], rsi
sub rcx, rax
sub rbx, rax
mov rsi, rcx
neg rsi
sar rsi, 0x3f
and rax, rsi
add rax, rdx
mov edi, 1
add rsp, 0x10
pop rbp
ret
mov rcx, rbx
call sym.runtime.panicSliceB
lea r8d, [rcx + 7]
mov rcx, r11
mov eax, r12d
nop dword [rax]
cmp rax, rbx
jae 0x44c98f
movzx r9d, byte [rax + rdx]
mov r10d, r9d
and r9d, 0x7f
mov r11, rcx
mov ecx, r8d
shl r9d, cl
lea r12d, [rax + 1]
or esi, r9d
test r10b, 0x80
jne 0x44c953
mov rcx, r11
mov eax, r12d
jmp 0x44c922
mov rcx, rbx
call sym.runtime.panicIndex
xor eax, eax
mov rcx, rax
nop dword [rax]
call sym.runtime.panicIndex
mov eax, r8d
mov rcx, rbx
call sym.runtime.panicSliceB
lea r9d, [rcx + 7]
mov rcx, r12
cmp rbx, rdx
jbe 0x44c9ed
movzx r10d, byte [rdx + rax]
mov r11d, r10d
and r10d, 0x7f
mov r12, rcx
mov ecx, r9d
shl r10d, cl
inc edx
or r8d, r10d
test r11b, 0x80
jne 0x44c9b0
mov rcx, r12
mov r9d, edx
mov edx, r8d
mov r8d, r9d
jmp 0x44c8cd
mov eax, edx
mov rcx, rbx
call sym.runtime.panicIndex
xor eax, eax
mov rcx, rax
nop dword [rax]
call sym.runtime.panicIndex
nop
int3
Function at 0x453dc0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x453e6f
push rbp
mov rbp, rsp
sub rsp, 0x58
mov qword [rsp + 0x70], rbx
lea rdx, [rsp + 0x68]
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rsi, [sym.runtime.callers.func1]
mov qword [rsp + 0x10], rsi
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdx
mov rdx, r14
mov qword [rsp + 0x28], rdx
lea rdx, [rsp + 8]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call sym.runtime.systemstack.abi0
xorps xmm15, xmm15
mov r14, qword [0x005976c8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
add rsp, 0x58
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp sym.runtime.callers

Function at 0x45d440
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp byte [0x005974ab], 0
je 0x45d44e
jmp sym.aeshashbody
jmp sym.runtime.memhashFallback

Function at 0x45d460
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp byte [0x005974ab], 0
je 0x45d475
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp sym.aeshashbody
jmp sym.runtime.strhashFallback

Function at 0x45d480
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp byte [0x005974ab], 0
je 0x45d4b5
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x00597a20]
aesenc xmm0, xmmword [0x00597a30]
aesenc xmm0, xmmword [0x00597a40]
movq rax, xmm0
ret
jmp sym.runtime.memhash32Fallback

Function at 0x45d4c0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp byte [0x005974ab], 0
je 0x45d4f6
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x00597a20]
aesenc xmm0, xmmword [0x00597a30]
aesenc xmm0, xmmword [0x00597a40]
movq rax, xmm0
ret
jmp sym.runtime.memhash64Fallback

Function at 0x45edc0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov rdx, 2
jmp sym.sigtramp

Function at 0x45f1c0
Capabilities:
Allocate thread local storage

Disassembly:
push rbp
mov rbp, rsp
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x45f1f4
mov rcx, 0x28
jmp 0x45f1ff
shl rcx, 3
add rcx, 0x1480
mov qword [0x005976c8], rcx
pop rbp
ret