joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400597a8
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
mov rax, rsp
push rsi
push rdi
push r14
sub rsp, 0x350
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rax, qword [0x1400da318]
xor rax, rsp
mov qword [rsp + 0x340], rax
mov r14d, edx
mov rsi, rcx
mov edi, 1
test rcx, rcx
je 0x1400597fc
lea rdx, [0x1400a4a80]
call qword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrcmpW]
nop dword [rax + rax]
test eax, eax
jne 0x1400597fe
xor edi, edi
test edi, edi
je 0x14005998b
mov rdx, rsi
lea rcx, [rsp + 0x50]
call fcn.14001bc34
nop
lea rcx, [rsp + 0x50]
call fcn.140057cdc
mov rax, qword [rsp + 0x50]
or r9d, 0xffffffff
mov r8d, dword [rsp + 0x64]
lea rdx, [0x1400b53c8]
lea rcx, [rsp + 0x50]
mov rax, qword [rax + 0x20]
call qword [case.0x140024095.0]
and qword [rsp + 0x30], 0
lea rdx, [rsp + 0xf0]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindFirstFileW]
nop dword [rax + rax]
mov rbx, rax
mov qword [rsp + 0x40], rax
lea rax, [rbx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14005994d
lea rdx, [0x1400a4b90]
lea rcx, [rsp + 0x11c]
call qword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrcmpW]
nop dword [rax + rax]
test eax, eax
je 0x14005992e
lea rdx, [0x1400b537c]
lea rcx, [rsp + 0x11c]
call qword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrcmpW]
nop dword [rax + rax]
test eax, eax
je 0x14005992e
mov rax, qword [rsp + 0x50]
or r9d, 0xffffffff
xor r8d, r8d
mov rdx, rsi
lea rcx, [rsp + 0x50]
mov rax, qword [rax + 0x20]
call qword [case.0x140024095.0]
lea rcx, [rsp + 0x50]
call fcn.140057cdc
mov rax, qword [rsp + 0x50]
or r9d, 0xffffffff
mov r8d, dword [rsp + 0x64]
lea rdx, [rsp + 0x11c]
lea rcx, [rsp + 0x50]
mov rax, qword [rax + 0x20]
call qword [case.0x140024095.0]
mov rcx, qword [rsp + 0x58]
test byte [rsp + 0xf0], 0x10
je 0x140059922
xor r8d, r8d
mov edx, r14d
call fcn.1400597a8
jmp 0x14005992e
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_DeleteFileW]
nop dword [rax + rax]
lea rdx, [rsp + 0xf0]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindNextFileW]
nop dword [rax + rax]
test eax, eax
jne 0x140059869
lea rax, [rbx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140059966
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindClose]
nop dword [rax + rax]
test r14d, r14d
je 0x140059980
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_RemoveDirectoryW]
nop dword [rax + rax]
neg eax
sbb ecx, ecx
and edi, ecx
lea rcx, [rsp + 0x50]
call fcn.14001456c
nop
jmp 0x140059991
mov eax, edi
mov rcx, qword [rsp + 0x340]
xor rcx, rsp
call fcn.140029fb0
mov rbx, qword [rsp + 0x380]
add rsp, 0x350
pop r14
pop rdi
pop rsi
ret
Function at 0x140059e18
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0x258]
sub rsp, 0x340
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x1400da318]
xor rax, rsp
mov qword [rbp + 0x230], rax
mov r14, rdx
mov rsi, rcx
lea rcx, [rsp + 0x40]
call fcn.14001bbb4
nop
lea rcx, [rsp + 0x40]
call fcn.140057cdc
mov rax, qword [rsp + 0x40]
or r9d, 0xffffffff
mov r8d, dword [rsp + 0x54]
lea rdx, [0x1400b53c8]
lea rcx, [rsp + 0x40]
mov rax, qword [rax + 0x20]
call qword [case.0x140024095.0]
lea rdx, [rbp - 0x20]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindFirstFileW]
nop dword [rax + rax]
mov rbx, rax
mov qword [rsp + 0x38], rax
lea rax, [rbx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140059fa5
lea rdx, [0x1400a4b90]
lea rcx, [rbp + 0xc]
call qword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrcmpW]
nop dword [rax + rax]
test eax, eax
je 0x140059f8a
lea rdx, [0x1400b537c]
lea rcx, [rbp + 0xc]
call qword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrcmpW]
nop dword [rax + rax]
test eax, eax
je 0x140059f8a
mov rax, qword [rsp + 0x40]
or r9d, 0xffffffff
xor r8d, r8d
mov rdx, qword [r14 + 8]
lea rcx, [rsp + 0x40]
mov rax, qword [rax + 0x20]
call qword [case.0x140024095.0]
lea rcx, [rsp + 0x40]
call fcn.140057cdc
mov rax, qword [rsp + 0x40]
or r9d, 0xffffffff
mov r8d, dword [rsp + 0x54]
lea rdx, [rbp + 0xc]
lea rcx, [rsp + 0x40]
mov rax, qword [rax + 0x20]
call qword [case.0x140024095.0]
mov rax, qword [rsi]
mov r8d, dword [rbp - 0x20]
lea rdx, [rsp + 0x40]
mov rcx, rsi
test r8b, 0x10
je 0x140059f7b
mov rax, qword [rax + 8]
call qword [case.0x140024095.0]
mov edi, eax
test eax, eax
js 0x140059ff4
jne 0x140059f8a
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.140059e18
jmp 0x140059f84
mov rax, qword [rax]
call qword [case.0x140024095.0]
test eax, eax
mov edi, eax
js 0x140059ff4
lea rdx, [rbp - 0x20]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindNextFileW]
nop dword [rax + rax]
test eax, eax
jne 0x140059eab
lea rax, [rbx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140059fbe
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindClose]
nop dword [rax + rax]
xor edi, edi
lea rcx, [rsp + 0x40]
call fcn.14001456c
mov eax, edi
mov rcx, qword [rbp + 0x230]
xor rcx, rsp
call fcn.140029fb0
lea r11, [rsp + 0x340]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindClose]
nop dword [rax + rax]
jmp 0x140059fc0
Function at 0x14005a594
Capabilities:
Access the windows event log

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
lea rbp, [rsp - 0xf0]
sub rsp, 0x1f0
mov rax, qword [0x1400da318]
xor rax, rsp
mov qword [rbp + 0xe0], rax
mov rbx, rcx
call fcn.140002870
test al, al
je 0x14005a772
mov eax, dword [rcx + 0x14]
lea rdx, str.SoftwareMicrosoftWindows_SearchTracingEventThrottleLastReported
and dword [rsp + 0x58], 0
lea rcx, [rsp + 0x58]
and qword [rsp + 0x5c], 0
and dword [rsp + 0x64], 0
and dword [rsp + 0x68], 0
mov dword [rsp + 0x6c], eax
call fcn.1400032e8
test al, al
je 0x14005a61b
mov eax, dword [rbx]
cmp dword [rsp + 0x58], eax
jne 0x14005a61b
mov rax, qword [rbx + 4]
cmp qword [rsp + 0x5c], rax
jne 0x14005a61b
mov eax, dword [rbx + 0x10]
cmp dword [rsp + 0x68], eax
je 0x14005a772
mov r9d, dword [rbx + 0x14]
lea r8, [0x1400b53d4]
mov edx, reloc.OLEAUT32.dll_SafeArrayGetDim
lea rcx, [rbp - 0x60]
call fcn.14000388c
test eax, eax
js 0x14005a772
mov r9d, dword [rbx + 0x10]
lea r8, [0x1400b3550]
mov edx, reloc.OLEAUT32.dll_SafeArrayGetDim
lea rcx, [rbp - 0x40]
call fcn.14000388c
test eax, eax
js 0x14005a772
imul rax, qword [rbx + 4], 0x2710
lea rdx, [rsp + 0x70]
mov dword [rsp + 0x50], eax
lea rcx, [rsp + 0x50]
shr rax, 0x20
mov dword [rsp + 0x54], eax
call qword [sym.imp.api_ms_win_core_timezone_l1_1_0.dll_FileTimeToSystemTime]
nop dword [rax + rax]
test eax, eax
je 0x14005a772
lea r8, [rsp + 0x58]
xor ecx, ecx
lea rdx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_core_timezone_l1_1_0.dll_SystemTimeToTzSpecificLocalTime]
nop dword [rax + rax]
test eax, eax
je 0x14005a772
lea rax, [rbp - 0x20]
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x58]
xor edx, edx
mov ecx, 0x800
call qword [sym.imp.api_ms_win_core_datetime_l1_1_0.dll_GetTimeFormatW]
nop dword [rax + rax]
test eax, eax
jle 0x14005a772
lea rax, [0x1400a4a80]
xor ecx, ecx
mov qword [rbp - 0x80], rax
lea rdx, [0x1400a4198]
lea rax, [rbp - 0x60]
mov qword [rbp - 0x78], rax
lea rax, [rbp - 0x40]
mov qword [rbp - 0x70], rax
lea rax, [rbp - 0x20]
mov qword [rbp - 0x68], rax
call qword [sym.imp.ext_ms_win_advapi32_eventlog_l1_1_0.dll_RegisterEventSourceW]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
je 0x14005a772
and qword [rsp + 0x40], 0
lea rax, [rbp - 0x80]
mov ecx, 4
mov qword [rsp + 0x38], rax
and dword [rsp + 0x30], 0
mov r9d, 0x800003f7
mov word [rsp + 0x28], cx
and qword [rsp + 0x20], 0
lea edx, [rcx - 2]
lea r8d, [rcx - 3]
mov rcx, rbx
call qword [sym.imp.ext_ms_win_advapi32_eventlog_l1_1_0.dll_ReportEventW]
nop dword [rax + rax]
mov rcx, rbx
call qword [sym.imp.ext_ms_win_advapi32_eventlog_l1_1_0.dll_DeregisterEventSource]
nop dword [rax + rax]
mov rcx, qword [rbp + 0xe0]
xor rcx, rsp
call fcn.140029fb0
mov rbx, qword [rsp + 0x208]
add rsp, 0x1f0
pop rbp
ret
Function at 0x14005bb10
Capabilities:
Get disk information

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x250
mov rax, qword [0x1400da318]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rsi, r9
mov rbp, r8
movzx ebx, dx
xor edi, edi
call qword [sym.imp.msvcrt.dll_towupper]
nop dword [rax + rax]
movzx ecx, bx
movzx r14d, ax
call qword [sym.imp.msvcrt.dll_towupper]
nop dword [rax + rax]
cmp r14w, ax
jne 0x14005bb75
mov r8, rbp
mov edx, 0x104
mov rcx, rsi
call fcn.14000c1ec
jmp 0x14005bc12
movabs rax, 0x5c003a0020
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x20]
mov r8d, 0x104
mov word [rsp + 0x20], r14w
call qword [sym.imp.api_ms_win_core_file_l1_2_0.dll_GetVolumeNameForVolumeMountPointW]
nop dword [rax + rax]
test eax, eax
jne 0x14005bbc9
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov edi, eax
test eax, eax
jle 0x14005bbc5
movzx edi, ax
or edi, 0x80070000
test edi, edi
js 0x14005bc14
mov edx, 0x7b
lea rcx, [rsp + 0x30]
call qword [sym.imp.msvcrt.dll_wcschr]
nop dword [rax + rax]
mov rbx, rax
mov eax, 0x8000ffff
test rbx, rbx
cmove edi, eax
test edi, edi
js 0x14005bc14
mov r8, rbp
mov edx, 0x104
mov rcx, rsi
call fcn.14000c1ec
mov edi, eax
test eax, eax
js 0x14005bc14
mov r8, rbx
mov rcx, rsi
call fcn.14005bc3c
mov edi, eax
mov eax, edi
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.140029fb0
add rsp, 0x250
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x14005dbac
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x70
mov rax, qword [0x1400da318]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov r9d, 0x20
lea r8, [rsp + 0x20]
mov edi, 0x404
mov ebx, 0xc04
mov ecx, edi
lea edx, [r9 - 0x18]
call qword [sym.imp.api_ms_win_core_localization_l1_2_0.dll_GetLocaleInfoW]
nop dword [rax + rax]
test eax, eax
je 0x14005dc0e
mov r8d, 3
lea rdx, [0x1400b59cc]
lea rcx, [rsp + 0x20]
call sub.msvcrt.dll_wcsncmp
test eax, eax
je 0x14005dc0e
movzx ebx, di
movzx eax, bx
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140029fb0
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret
Function at 0x415040
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4151e6
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00431160
xorps xmm15, xmm15
mov r14, qword [0x005b7808]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x4150ab
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x4150c0
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
nop
test rbx, rbx
jbe 0x4150e5
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x4150f9
cmp rbx, 0x1000
jae 0x4150b5
nop dword [rax]
jmp 0x415169
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop
cmp rbx, 0x1000
jae 0x41510d
xor edx, edx
jmp 0x415160
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00431160
xorps xmm15, xmm15
mov r14, qword [0x005b7808]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
nop dword [rax]
test dl, dl
jne 0x4150ef
jmp 0x4150d4
call fcn.004603c0
xorps xmm15, xmm15
mov r14, qword [0x005b7808]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.004356a0
lea rax, [0x004c180c]
mov ebx, 0x18
call fcn.00435fa0
mov rax, qword [rsp + 0x38]
call fcn.00435ca0
lea rax, [0x004c18cc]
mov ebx, 0x19
call fcn.00435fa0
mov rax, qword [rsp + 0x30]
nop
call fcn.00435ca0
call fcn.00435900
call fcn.00435720
lea rax, [0x004c3ad5]
mov ebx, 0x21
nop dword [rax + rax]
call fcn.00433d60
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045c820
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.00415040
Function at 0x415220
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41544a
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.004311e0
xorps xmm15, xmm15
mov r14, qword [0x005b7808]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x415299
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x4152ac
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x4152d0
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
nop
jmp 0x4152e4
cmp rbx, 0x1000
jae 0x4152a3
jmp 0x415365
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x4152f6
xor esi, esi
jmp 0x415356
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
nop dword [rax]
call fcn.004311e0
xorps xmm15, xmm15
mov r14, qword [0x005b7808]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x4152da
nop
jmp 0x4152c2
call fcn.004603c0
xorps xmm15, xmm15
mov r14, qword [0x005b7808]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x4153e5
call fcn.004356a0
lea rax, [0x004c1cb4]
mov ebx, 0x19
call fcn.00435fa0
mov rax, qword [rsp + 0x68]
call fcn.00435ca0
lea rax, [0x004c18cc]
mov ebx, 0x19
call fcn.00435fa0
mov eax, dword [rsp + 0x34]
nop dword [rax]
call fcn.00435ca0
call fcn.00435900
call fcn.00435720
lea rax, [0x004be87e]
mov ebx, 0xd
nop dword [rax + rax]
call fcn.00433d60
cmp eax, 0x5af
je 0x415388
call fcn.004356a0
lea rax, [0x004c1cb4]
mov ebx, 0x19
nop dword [rax]
call fcn.00435fa0
mov rax, qword [rsp + 0x38]
call fcn.00435ca0
lea rax, [0x004c18cc]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.00435fa0
mov eax, dword [rsp + 0x34]
call fcn.00435ca0
call fcn.00435900
call fcn.00435720
lea rax, [0x004c33e9]
mov ebx, 0x1f
call fcn.00433d60
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045c820
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00415220
Function at 0x41d700
Capabilities:
Hash data using murmur3

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
cmp byte [0x005b7630], 0
jne 0x41d7ef
mov rdx, qword [rax + 0x50]
test byte [rdx], al
nop
nop
nop
sub rbx, qword [rax + 0x18]
mov esi, dword [rax + 0x5c]
imul rbx, rsi
mov rsi, rbx
shr rbx, 0x20
shr rsi, 0x23
and ebx, 7
mov rdi, rcx
mov rcx, rbx
mov r8d, 1
shl r8d, cl
add rdx, rsi
lock or byte [rdx], r8b
nop
nop
mov rcx, qword [rax + 0x18]
nop
movabs rdx, 0x800000000000
lea rax, [rdx + rcx]
mov rdx, rax
shr rax, 0x2a
cmp rax, 0x40
jae 0x41d7e5
lea rbx, [0x00589a70]
mov rax, qword [rbx + rax*8]
shr rdx, 0x16
and edx, 0xfffff
mov rdx, qword [rax + rdx*8]
test byte [rdx], al
test byte [rax], al
mov rax, rcx
shr rcx, 0x10
and ecx, 0x3f
movzx ebx, byte [rdx + rcx + 0x11440]
lea rdx, [rdx + rcx]
lea rdx, [rdx + 0x11440]
shr rax, 0xd
and eax, 7
mov rcx, rax
mov eax, 1
shl eax, cl
test al, bl
jne 0x41d7c7
lock or byte [rdx], al
mov rax, qword [r14 + 0x30]
mov rax, qword [rax + 0xa0]
test byte [rax], al
add qword [rax + 0x1248], rdi
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov ecx, 0x40
call fcn.0045eea0
lea rax, [0x004c54fd]
mov ebx, 0x2c
nop dword [rax + rax]
call fcn.00433d60
nop
int3

Function at 0x41fbe0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41fcde
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rbx
mov qword [rsp + 8], 0
jmp 0x41fc20
mov rax, qword [rsp + 0x50]
mov rcx, rdx
mov rbx, qword [rsp + 0x58]
nop
cmp qword [rsp + 8], rbx
jae 0x41fccf
test byte [rax], al
lea rcx, [rax + 0x100b8]
mov rax, rcx
call fcn.004207a0
nop dword [rax]
test rax, rax
je 0x41fccf
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x30], xmm15
lea rcx, [0x0041fd20]
mov qword [rsp + 0x10], rcx
lea rdx, [rsp + 8]
mov qword [rsp + 0x18], rdx
mov rdx, qword [rsp + 0x50]
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rbx
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x38], rax
lea rbx, [rsp + 0x10]
mov qword [rsp], rbx
call fcn.0045c6e0
xorps xmm15, xmm15
mov r14, qword [0x005b7808]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x60]
test rdx, rdx
jne 0x41fcbd
xor eax, eax
jmp 0x41fcc7
mov rax, qword [rdx]
call rax
mov rdx, qword [rsp + 0x60]
test al, al
je 0x41fc12
mov rax, qword [rsp + 8]
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.0045c820
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0041fbe0
Function at 0x42d5e0
Capabilities:
Hash data using murmur3

Disassembly:
cmp rsp, qword [r14 + 0x18]
jbe 0x42d886
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
test byte [rax], al
lea rsi, [rax + 0x1270]
mov rcx, qword [rax + 0x1260]
sub rcx, rsi
shr rcx, 3
cmp rcx, 0x200
ja 0x42d87a
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x30], rcx
mov qword [rax + 0x1260], 0
cmp byte [0x005b7630], 0
jne 0x42d642
xor edx, edx
xor ebx, ebx
nop
jmp 0x42d68a
xor edx, edx
jmp 0x42d66d
mov qword [rsp + 0x28], rdx
mov rcx, qword [rax + rdx*8 + 0x1270]
mov rax, rcx
call fcn.0041cf20
mov rdx, qword [rsp + 0x28]
inc rdx
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
cmp rdx, rcx
jl 0x42d646
add rax, 0x1260
call fcn.0042d4a0
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
inc rdx
cmp rdx, rcx
jge 0x42d814
mov rsi, qword [rax + rdx*8 + 0x1270]
nop dword [rax + rax]
cmp rsi, 0x1000
jb 0x42d687
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rbx
mov rax, rsi
xor ebx, ebx
mov rcx, rbx
nop dword [rax + rax]
call fcn.00411fc0
test rax, rax
jne 0x42d6e2
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
nop
jmp 0x42d687
mov rsi, qword [rbx + 0x50]
test byte [rsi], al
nop
mov r8, rcx
shr rcx, 3
movzx r9d, byte [rsi + rcx]
and r8d, 7
mov rdx, rcx
mov rcx, r8
mov r10d, 1
shl r10d, cl
add rsi, rdx
test r10b, r9b
je 0x42d729
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
jmp 0x42d687
nop
lock or byte [rsi], r10b
nop
nop
mov rcx, qword [rbx + 0x18]
nop
movabs rsi, 0x800000000000
lea r8, [rsi + rcx]
mov r9, r8
shr r8, 0x2a
cmp r8, 0x40
jae 0x42d86d
lea r10, [0x00589a70]
mov r8, qword [r10 + r8*8]
shr r9, 0x16
and r9d, 0xfffff
mov r9, qword [r8 + r9*8]
test byte [r9], al
test byte [r8], al
mov r8, rcx
shr rcx, 0x10
and ecx, 0x3f
movzx r10d, byte [r9 + rcx + 0x11440]
lea r9, [r9 + rcx]
lea r9, [r9 + 0x11440]
shr r8, 0xd
and r8d, 7
mov rcx, r8
mov r8d, 1
shl r8d, cl
test r8b, r10b
jne 0x42d7af
lock or byte [r9], r8b
movzx r8d, byte [rbx + 0x62]
test r8b, 1
je 0x42d7e5
mov rax, qword [rsp + 0x48]
mov r8, qword [rax + 0x1248]
add r8, qword [rbx + 0x68]
mov qword [rax + 0x1248], r8
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
jmp 0x42d687
mov r8, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
cmp r8, rcx
jae 0x42d865
mov rbx, qword [rsp + 0x48]
mov qword [rbx + r8*8 + 0x1270], rax
inc r8
mov rax, rbx
mov rdx, qword [rsp + 0x28]
mov rbx, r8
jmp 0x42d687
cmp rbx, 0x200
ja 0x42d858
lea rdx, [rax + 0x1270]
lea rsi, [rax + 0x1238]
mov rcx, rbx
mov edi, 0x200
mov rbx, rdx
mov rax, rsi
call fcn.004230a0
mov rax, qword [rsp + 0x48]
add rax, 0x1260
call fcn.0042d4a0
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov rcx, rbx
mov edx, 0x200
call fcn.0045ef00
mov rax, r8
call fcn.0045ee80
mov rax, r8
mov ecx, 0x40
call fcn.0045eea0
mov edx, 0x200
nop
call fcn.0045eee0
nop
mov qword [rsp + 8], rax
call fcn.00461280
mov rax, qword [rsp + 8]
jmp fcn.0042d5e0
Function at 0x442580
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4426ea
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov ecx, dword [rax + 0x190]
mov edx, dword [rax + 0x194]
mov rsi, qword [rax + 0x998]
mov edi, dword [rax + 0x194]
cmp edi, edx
jne 0x442598
cmp edx, ecx
jne 0x4426d8
nop dword [rax]
test rsi, rsi
jne 0x4426d8
mov qword [rsp + 0x28], rax
test rbx, rbx
jne 0x4425f4
nop
call fcn.00460820
xorps xmm15, xmm15
mov r14, qword [0x005b7808]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rbx, qword [rsp]
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x10], rbx
call fcn.00442480
mov rcx, qword [0x00564898]
mov rdx, qword [0x00564890]
mov rbx, qword [rsp + 0x28]
mov esi, dword [rbx]
mov edi, esi
sar esi, 0x1f
shr esi, 0x1b
add esi, edi
mov r8d, esi
and esi, 0xffffffe0
sub edi, esi
test edi, edi
jl 0x4426d3
cmp edi, 0x20
sbb esi, esi
sar r8d, 5
mov rax, rcx
mov ecx, edi
mov r9d, 1
shl r9d, cl
and r9d, esi
movsxd rsi, r8d
cmp rax, rsi
jbe 0x4426c8
lea rcx, [rdx + rsi*4]
lock or dword [rcx], r9d
mov rcx, qword [0x00565330]
mov qword [rbx + 8], rcx
nop
mov rcx, rbx
mov qword [0x00565330], rbx
nop
mov edx, 1
lea rsi, [0x00565338]
lock xadd dword [rsi], edx
mov rdx, qword [rcx + 0x1220]
shr rdx, 0x3d
test dl, dl
jne 0x4426b7
nop
nop
mov rax, qword [rsp + 0x10]
movabs rdx, 0x1fffffffffffffff
and rdx, rax
bts rdx, 0x3f
xchg qword [rcx + 0x1220], rdx
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x004c4caa]
mov ebx, 0x28
call fcn.00433d60
mov rcx, rax
mov rax, rsi
call fcn.0045ee80
call fcn.00432380
lea rax, [0x004c4067]
mov ebx, 0x23
call fcn.00433d60
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045c820
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00442580
Function at 0x454c40
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x454cf9
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov qword [rsp + 0x70], rbx
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rdx, [0x00454d40]
mov qword [rsp + 0x10], rdx
lea rdx, [rsp + 8]
mov qword [rsp + 0x18], rdx
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x20], rdx
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x28], rdx
mov rdx, r14
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.0045c6e0
xorps xmm15, xmm15
mov r14, qword [0x005b7808]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.0045c820
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00454c40