joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140010354
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x10], edx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x50
xor esi, esi
lea r8, [rbp - 0x10]
lea rdx, [0x1400117f0]
mov qword [rbp - 0x10], rsi
mov qword [rbp - 0x20], rsi
mov rbx, rcx
call qword [sym.imp.SHELL32.dll_SHAssocEnumHandlersForProtocolByApplication]
test eax, eax
js 0x1400104fc
mov rcx, qword [rbp - 0x10]
lea r9, [rbp + 0x28]
mov dword [rbp + 0x28], esi
lea r8, [rbp - 0x18]
mov qword [rbp - 0x18], rsi
mov edx, 1
mov rax, qword [rcx]
call qword [rax + 0x18]
test eax, eax
js 0x1400104e9
cmp dword [rbp + 0x28], esi
je 0x1400104f2
mov rcx, qword [rbp - 0x18]
lea r8, [rbp - 0x20]
lea rdx, [0x1400117e0]
mov rax, qword [rcx]
call qword [rax]
test eax, eax
js 0x1400104df
mov rcx, qword [rbp - 0x20]
lea rdx, [rbp + 0x38]
mov qword [rbp + 0x38], rsi
mov rax, qword [rcx]
call qword [rax + 0x20]
test eax, eax
js 0x1400104d5
mov rdx, qword [rbp + 0x38]
test rdx, rdx
je 0x1400104d5
mov rax, rbx
test rbx, rbx
jne 0x14001040c
mov rax, rsi
jmp 0x140010420
cmp word [rbx], si
je 0x14001041a
add rax, 2
cmp word [rax], si
jne 0x140010411
sub rax, rbx
sar rax, 1
mov rcx, rdx
cmp word [rdx], si
je 0x140010431
add rcx, 2
cmp word [rcx], si
jne 0x140010428
sub rcx, rdx
mov edx, 8
sar rcx, 1
lea r8, [rcx + rax]
mov rcx, qword [0x140019fd8]
lea r8, [r8*2 + 8]
mov rcx, qword [rcx + 0x18]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rdi, rax
test rax, rax
je 0x1400104cb
mov rdx, qword [rbp + 0x38]
mov rcx, rax
call fcn.140001b70
lea rdx, [0x140016760]
call fcn.140001ac8
mov rdx, rbx
mov rcx, rdi
call fcn.140001ac8
lea rax, [rbp + 0x30]
mov dword [rsp + 0x28], 4
mov r9d, 4
mov qword [rsp + 0x20], rax
mov r8, rdi
mov dword [rbp + 0x30], esi
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionApplicationAssociationToasts
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
mov rcx, qword [0x140019fd8]
mov r8, rdi
xor edx, edx
mov rcx, qword [rcx + 0x18]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rcx, qword [rbp + 0x38]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [rbp - 0x20]
mov rax, qword [rcx]
call qword [rax + InitCommonControls]
mov rcx, qword [rbp - 0x18]
mov rax, qword [rcx]
call qword [rax + InitCommonControls]
cmp dword [rbp + 0x28], esi
jne 0x14001038d
mov rcx, qword [rbp - 0x10]
mov rax, qword [rcx]
call qword [rax + InitCommonControls]
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
Function at 0x419b80
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x419d10
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call sym.runtime.stdcall3.abi0
xorps xmm15, xmm15
mov r14, qword [0x006d2c68]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x419be5
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x419c00
add rsp, 0x48
pop rbp
ret
call sym.runtime.add
mov rbx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x38]
sub rbx, rcx
nop dword [rax]
test rbx, rbx
jbe 0x419c1f
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x419c2f
cmp rbx, 0x1000
jae 0x419beb
jmp 0x419c9a
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x419c42
xor edx, edx
nop
jmp 0x419c91
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call sym.runtime.stdcall3.abi0
xorps xmm15, xmm15
mov r14, qword [0x006d2c68]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x419c25
jmp 0x419c14
call sym.runtime.getlasterror.abi0
xorps xmm15, xmm15
mov r14, qword [0x006d2c68]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call sym.runtime.printlock
lea rax, [0x005a8669]
mov ebx, 0x18
call sym.runtime.printstring
mov rax, qword [rsp + 0x38]
call sym.runtime.printuint
lea rax, [0x005a8dd8]
mov ebx, 0x19
call sym.runtime.printstring
mov rax, qword [rsp + 0x30]
call sym.runtime.printuint
call sym.runtime.printnl
call sym.runtime.printunlock
lea rax, [0x005abbf1]
mov ebx, 0x21
call sym.runtime.throw
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp sym.runtime.sysUnusedOS
Function at 0x419d40
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x419f6a
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call sym.runtime.stdcall4.abi0
xorps xmm15, xmm15
mov r14, qword [0x006d2c68]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x419db3
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x419dda
add rsp, 0x50
pop rbp
ret
mov rax, rcx
nop dword [rax]
call sym.runtime.add
mov rbx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
sub rbx, rcx
mov rcx, rax
mov rax, qword [rsp + 0x68]
test rbx, rbx
jbe 0x419dfc
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x419e0c
cmp rbx, 0x1000
jae 0x419db9
jmp 0x419e8e
add rsp, 0x50
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x419e1e
xor esi, esi
jmp 0x419e80
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call sym.runtime.stdcall4.abi0
xorps xmm15, xmm15
mov r14, qword [0x006d2c68]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
test sil, sil
jne 0x419e02
jmp 0x419dee
call sym.runtime.getlasterror.abi0
xorps xmm15, xmm15
mov r14, qword [0x006d2c68]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x419f09
call sym.runtime.printlock
lea rax, [0x005a8df1]
mov ebx, 0x19
call sym.runtime.printstring
mov rax, qword [rsp + 0x68]
call sym.runtime.printuint
lea rax, [0x005a8dd8]
mov ebx, 0x19
nop dword [rax]
call sym.runtime.printstring
mov eax, dword [rsp + 0x34]
call sym.runtime.printuint
call sym.runtime.printnl
call sym.runtime.printunlock
lea rax, [0x005a4548]
mov ebx, 0xd
call sym.runtime.throw
cmp eax, 0x5af
je 0x419eb1
call sym.runtime.printlock
lea rax, [0x005a8df1]
mov ebx, 0x19
call sym.runtime.printstring
mov rax, qword [rsp + 0x38]
call sym.runtime.printuint
lea rax, [0x005a8dd8]
mov ebx, 0x19
nop dword [rax]
call sym.runtime.printstring
mov eax, dword [rsp + 0x34]
call sym.runtime.printuint
call sym.runtime.printnl
call sym.runtime.printunlock
lea rax, [0x005ab333]
mov ebx, 0x1f
call sym.runtime.throw
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp sym.runtime.sysUsedOS
Function at 0x426580
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x426686
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x70], rcx
mov byte [rsp + 0x17], dil
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x18], 0
jmp 0x4265c3
mov rax, qword [rsp + 0x60]
mov rcx, rdx
mov rbx, qword [rsp + 0x68]
movzx edi, byte [rsp + 0x17]
cmp qword [rsp + 0x18], rbx
jae 0x42667b
test byte [rax], al
lea rcx, [rax + 0x100b8]
mov ebx, edi
mov rax, rcx
nop dword [rax]
call sym.runtime._scavengeIndex_.find
test rax, rax
je 0x42667b
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x30], xmm15
movups xmmword [rsp + 0x40], xmm15
lea rcx, [sym.runtime._pageAlloc_.scavenge.func1]
mov qword [rsp + 0x20], rcx
lea rdx, [rsp + 0x18]
mov qword [rsp + 0x28], rdx
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x48], rax
lea rbx, [rsp + 0x20]
mov qword [rsp], rbx
nop dword [rax]
call sym.runtime.systemstack.abi0
xorps xmm15, xmm15
mov r14, qword [0x006d2c68]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x70]
nop dword [rax]
test rdx, rdx
jne 0x426669
xor eax, eax
jmp 0x426673
mov rax, qword [rdx]
call rax
mov rdx, qword [rsp + 0x70]
test al, al
je 0x4265b1
mov rax, qword [rsp + 0x18]
add rsp, 0x50
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov byte [rsp + 0x20], dil
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movzx edi, byte [rsp + 0x20]
jmp sym.runtime._pageAlloc_.scavenge

Function at 0x462240
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4622ef
push rbp
mov rbp, rsp
sub rsp, 0x58
mov qword [rsp + 0x70], rbx
lea rdx, [rsp + 0x68]
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rsi, [sym.runtime.callers.func1]
mov qword [rsp + 0x10], rsi
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdx
mov rdx, r14
mov qword [rsp + 0x28], rdx
lea rdx, [rsp + 8]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call sym.runtime.systemstack.abi0
xorps xmm15, xmm15
mov r14, qword [0x006d2c68]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
add rsp, 0x58
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp sym.runtime.callers

Function at 0x46d040
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp byte [0x006d2a0b], 0
je 0x46d04e
jmp sym.aeshashbody
jmp sym.runtime.memhashFallback
Function at 0x46d060
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp byte [0x006d2a0b], 0
je 0x46d075
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp sym.aeshashbody
jmp sym.runtime.strhashFallback

Function at 0x46d080
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp byte [0x006d2a0b], 0
je 0x46d0b5
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x006d30a0]
aesenc xmm0, xmmword [0x006d30b0]
aesenc xmm0, xmmword [0x006d30c0]
movq rax, xmm0
ret
jmp sym.runtime.memhash32Fallback

Function at 0x46d0c0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp byte [0x006d2a0b], 0
je 0x46d0f6
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x006d30a0]
aesenc xmm0, xmmword [0x006d30b0]
aesenc xmm0, xmmword [0x006d30c0]
movq rax, xmm0
ret
jmp sym.runtime.memhash64Fallback

Function at 0x46ea40
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov rdx, 2
jmp sym.sigtramp

Function at 0x46ee40
Capabilities:
Allocate thread local storage

Disassembly:
push rbp
mov rbp, rsp
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x46ee74
mov rcx, 0x28
jmp 0x46ee7f
shl rcx, 3
add rcx, 0x1480
mov qword [0x006d2c68], rcx
pop rbp
ret
Function at 0x499ea0
Capabilities:
Access peb ldr_data

Disassembly:
lea r12, [rsp - 0x30]
cmp r12, qword [r14 + 0x10]
jbe 0x49a07b
push rbp
mov rbp, rsp
sub rsp, 0xa8
mov qword [rsp + 0xb8], rax
mov qword [rsp + 0xc0], rbx
mov qword [rsp + 0x60], 0
movups xmmword [rsp + 0x68], xmm15
movups xmmword [rsp + 0x40], xmm15
mov rax, qword [rsp + 0xb8]
mov rcx, qword [rsp + 0xc0]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov byte [rsp + 0x10], 0
nop dword [rax]
call sym.internal_bytealg.IndexByteString.abi0
xorps xmm15, xmm15
mov r14, qword [0x006d2c68]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0x38], rax
cmp rax, 0xffffffffffffffff
jne 0x499f29
jmp 0x499f72
mov qword [rsp + 0x60], 0
movups xmmword [rsp + 0x68], xmm15
lea rdx, [0x005bb9d8]
mov qword [rsp + 0x40], rdx
lea rdx, [0x005bb000]
mov qword [rsp + 0x48], rdx
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x70]
mov rax, qword [rsp + 0x60]
add rsp, 0xa8
pop rbp
ret
mov rcx, qword [rsp + 0xc0]
mov qword [rsp + 0x38], rcx
inc rcx
mov qword [rsp + 0x30], rcx
lea rax, [0x00575e60]
mov rbx, rcx
call sym.runtime.makeslice
mov rdx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x30]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], rdx
mov qword [rsp + 0x88], rsi
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x98], rdx
mov qword [rsp + 0xa0], rsi
mov rdx, qword [rsp + 0xc0]
mov rsi, qword [rsp + 0xb8]
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rdx
mov rsi, qword [rsp + 0x98]
mov qword [rsp + 0x28], rsi
cmp rsi, rdx
jg 0x499ffb
jmp 0x49a002
mov qword [rsp + 0x28], rdx
jmp 0x49a004
jmp 0x49a004
mov rdx, qword [rsp + 0x90]
cmp qword [rsp + 0x50], rdx
jne 0x49a015
jmp 0x49a033
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x20], rcx
mov rbx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x90]
call sym.runtime.memmove
jmp 0x49a035
jmp 0x49a035
mov rdx, qword [rsp + 0x78]
mov r8, qword [rsp + 0x80]
mov r9, qword [rsp + 0x88]
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x68], r8
mov qword [rsp + 0x70], r9
movups xmmword [rsp + 0x40], xmm15
mov rbx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x70]
mov rax, qword [rsp + 0x60]
xor edi, edi
xor esi, esi
add rsp, 0xa8
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp sym.syscall.ByteSliceFromString
Function at 0x49a3c0
Capabilities:
Access peb ldr_data

Disassembly:
lea r12, [rsp - 0x28]
cmp r12, qword [r14 + 0x10]
jbe 0x49a572
push rbp
mov rbp, rsp
sub rsp, 0xa0
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xb8], rbx
mov qword [rsp + 0x58], 0
movups xmmword [rsp + 0x60], xmm15
movups xmmword [rsp + 0x48], xmm15
mov rax, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0xb8]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov byte [rsp + 0x10], 0
nop dword [rax]
call sym.internal_bytealg.IndexByteString.abi0
xorps xmm15, xmm15
mov r14, qword [0x006d2c68]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0x40], rax
cmp rax, 0xffffffffffffffff
jne 0x49a449
jmp 0x49a492
mov qword [rsp + 0x58], 0
movups xmmword [rsp + 0x60], xmm15
lea rdx, [0x005bb9d8]
mov qword [rsp + 0x48], rdx
lea rdx, [0x005bb000]
mov qword [rsp + 0x50], rdx
mov rdi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x68]
mov rax, qword [rsp + 0x58]
add rsp, 0xa0
pop rbp
ret
mov rcx, qword [rsp + 0xb8]
mov qword [rsp + 0x40], rcx
inc rcx
lea rax, [0x00575fa0]
xor ebx, ebx
call sym.runtime.makeslice
mov rsi, qword [rsp + 0x40]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], 0
inc rsi
mov qword [rsp + 0x80], rsi
mov rdx, qword [rsp + 0xb0]
mov rbx, qword [rsp + 0xb8]
mov rcx, rax
xor edi, edi
mov rax, rdx
call sym.syscall.encodeWTF16
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x80], rcx
inc rbx
cmp rcx, rbx
jae 0x49a507
jmp 0x49a509
jmp 0x49a51c
mov edi, 1
lea rsi, [0x00575fa0]
call sym.runtime.growslice
jmp 0x49a51c
lea rdx, [rax + rbx*2]
lea rdx, [rdx - 2]
mov word [rdx], 0
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0x98], rcx
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
movups xmmword [rsp + 0x48], xmm15
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
xor edi, edi
xor esi, esi
add rsp, 0xa0
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
nop dword [rax]
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp sym.syscall.UTF16FromString

Function at 0x4dd300
Capabilities:
Hash data using fnv

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 8
mov qword [rsp + 0x18], rax
mov byte [rsp + 0x20], bl
mov qword [rsp], 0
movzx ecx, byte [rsp + 0x20]
xor rax, rcx
mov qword [rsp + 0x18], rax
movabs rcx, 0x100000001b3
imul rax, rcx
mov qword [rsp + 0x18], rax
mov qword [rsp], rax
add rsp, 8
pop rbp
ret
Function at 0x4dd360
Capabilities:
Hash data using fnv

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x28
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x10], 0
mov qword [rsp + 0x18], 0
jmp 0x4dd38b
mov rdx, qword [rsp + 0x48]
mov qword [rsp + 0x20], rdx
cmp qword [rsp + 0x18], rdx
jl 0x4dd39e
jmp 0x4dd3e3
mov rdx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
cmp rcx, rax
ja 0x4dd3b9
jmp 0x4dd3f3
add rbx, rax
movzx ebx, byte [rbx]
xor rdx, rbx
mov qword [rsp + 0x38], rdx
movabs rbx, 0x100000001b3
imul rdx, rbx
mov qword [rsp + 0x38], rdx
jmp 0x4dd3dc
inc qword [rsp + 0x18]
jmp 0x4dd38b
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x10], rax
add rsp, 0x28
pop rbp
ret
call sym.runtime.panicIndex
nop
int3

Function at 0x4dd400
Capabilities:
Hash data using fnv

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rbx
mov qword [rsp], 0
mov qword [rsp + 8], 0
jmp 0x4dd425
cmp qword [rsp + 8], 8
jl 0x4dd42f
jmp 0x4dd469
movzx ecx, byte [rsp + 0x28]
xor rcx, qword [rsp + 0x20]
mov qword [rsp + 0x20], rcx
mov rdx, qword [rsp + 0x28]
shr rdx, 8
mov qword [rsp + 0x28], rdx
movabs rdx, 0x100000001b3
imul rcx, rdx
mov qword [rsp + 0x20], rcx
nop
jmp 0x4dd462
inc qword [rsp + 8]
jmp 0x4dd425
mov rax, qword [rsp + 0x20]
mov qword [rsp], rax
add rsp, 0x10
pop rbp
ret

Function at 0x4dd480
Capabilities:
Hash data using fnv

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], ebx
mov qword [rsp], 0
mov qword [rsp + 8], 0
jmp 0x4dd4a4
cmp qword [rsp + 8], 4
jl 0x4dd4ae
jmp 0x4dd4e4
movzx ecx, byte [rsp + 0x28]
xor qword [rsp + 0x20], rcx
mov ecx, dword [rsp + 0x28]
shr ecx, 8
mov dword [rsp + 0x28], ecx
mov rcx, qword [rsp + 0x20]
movabs rdx, 0x100000001b3
imul rcx, rdx
mov qword [rsp + 0x20], rcx
jmp 0x4dd4dd
inc qword [rsp + 8]
jmp 0x4dd4a4
mov rax, qword [rsp + 0x20]
mov qword [rsp], rax
add rsp, 0x10
pop rbp
ret
Function at 0x502d80
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x502e76
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
movups xmmword [rsp + 0x40], xmm15
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov byte [rsp + 0x10], 0x2e
call sym.internal_bytealg.IndexByteString.abi0
xorps xmm15, xmm15
mov r14, qword [0x006d2c68]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0x38], rax
cmp rax, 0xffffffffffffffff
setne byte [rsp + 0x2f]
jne 0x502de8
jmp 0x502e19
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x60]
lea r8, [rax - 1]
cmp rcx, r8
ja 0x502e07
jmp 0x502e6d
lea rdx, [rax + rdx]
lea rdx, [rdx - 1]
cmp byte [rdx], 0x2e
setne byte [rsp + 0x2f]
jmp 0x502e1b
jmp 0x502e1b
cmp byte [rsp + 0x2f], 0
jne 0x502e24
jmp 0x502e51
mov rbx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
xor eax, eax
lea rdi, [0x005ba0d8]
mov esi, 1
nop dword [rax]
call sym.runtime.concatstring2
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
jmp 0x502e53
jmp 0x502e53
mov rax, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rbx
add rsp, 0x50
pop rbp
ret
mov rax, r8
call sym.runtime.panicIndex
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp sym.net.absDomainName
Function at 0x528aa0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x528b58
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
movups xmmword [rsp + 0x28], xmm15
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov byte [rsp + 0x10], 0x23
call sym.internal_bytealg.IndexByteString.abi0
xorps xmm15, xmm15
mov r14, qword [0x006d2c68]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rcx, qword [rsp + 0x18]
mov qword [rsp + 0x20], rcx
nop dword [rax + rax]
cmp rcx, 0xffffffffffffffff
jne 0x528b08
jmp 0x528b38
mov rax, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
cmp rdx, rcx
jae 0x528b19
jmp 0x528b52
jmp 0x528b1b
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rcx
mov rbx, rcx
add rsp, 0x48
pop rbp
ret
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rbx
add rsp, 0x48
pop rbp
ret
call sym.runtime.panicSliceAlen
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp sym.net.removeComment
Function at 0x14003a510
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x38
mov ecx, 3
call fcn.14004b4c0
cmp eax, 1
je 0x14003a542
mov ecx, 3
call fcn.14004b4c0
test eax, eax
jne 0x14003a5f6
cmp dword [0x140077f88], 1
jne 0x14003a5f6
mov qword [rsp + 0x48], rbx
lea rbx, [0x1400781c0]
mov qword [rsp + 0x30], rdi
mov rax, rbx
xor edi, edi
cmp dword [rax], 0xfc
je 0x14003a56e
add edi, 1
add rax, 0x10
cmp edi, 0x17
jb 0x14003a558
jmp 0x14003a5e2
cmp edi, 0x17
jae 0x14003a5e2
mov ecx, 3
call fcn.14004b4c0
cmp eax, 1
je 0x14003a599
mov ecx, 3
call fcn.14004b4c0
test eax, eax
jne 0x14003a5e2
cmp dword [0x140077f88], 1
jne 0x14003a5e2
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
test rax, rax
mov r11, rax
je 0x14003a5e2
cmp rax, 0xffffffffffffffff
je 0x14003a5e2
movsxd rcx, edi
xor eax, eax
lea r9, [rsp + 0x40]
add rcx, rcx
mov qword [rsp + 0x20], rax
mov rdx, qword [rbx + rcx*8 + 8]
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
mov rcx, r11
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, 0xff
call fcn.14003a2d0
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x48]
add rsp, 0x38
ret