joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140629d2b
Capabilities:
Get geographical location

Disassembly:
push rax
pushf
mov eax, 0x1d8595e1
pushf
not eax
add eax, 0xd4be56c7
xor eax, 0x9184bb1a
rol eax, 0xae
popf
pushf
not eax
add eax, 0xf59821d1
xor eax, 0xf724df35
rol eax, 0xa0
popf
pushf
not eax
add eax, 0xff15f201
xor eax, 0xca3719f1
rol eax, 0xbb
popf
pushf
not eax
add eax, 0xa87b2131
xor eax, 0xbfbfad98
rol eax, 0x63
popf
cmp eax, 4
jne 0x140629d8e
popf
pop rax
jmp 0x140629f9a
cmp eax, 0
jne 0x140629d9d
popf
pop rax
jmp 0x140629dd9
cmp eax, 3
jne 0x140629dac
popf
pop rax
jmp 0x140629f52
cmp eax, 1
jne 0x140629dbb
popf
pop rax
jmp 0x140629e6b
cmp eax, 5
jne 0x140629dca
popf
pop rax
jmp 0x14062a00e
cmp eax, 2
jne 0x140629dd9
popf
pop rax
jmp 0x140629f0f
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rax, qword [0x14059e050]
mov ebx, r9d
mov rdi, r8
mov esi, edx
mov rbp, rcx
cmp rax, 0xffffffffffffffff
je 0x140629e38
push rax
pushf
mov eax, 0x3a1c54a9
pushf
not eax
add eax, 0xe9da10e7
xor eax, 0x84cda54c
rol eax, 0x2c
popf
pushf
not eax
add eax, 0xcbc52a4d
xor eax, 0xca2e1695
rol eax, 0xf8
popf
jmp 0x140629d7f
push rax
pushf
mov eax, 0x188af39
pushf
not eax
add eax, 0xc5b5a674
xor eax, 0x926ed36b
rol eax, 0xc5
popf
pushf
not eax
add eax, 0x853bb1bd
xor eax, 0xbcf73792
rol eax, 0xd6
popf
jmp 0x140629d7f
test rax, rax
jne 0x140629ec9
push rax
pushf
mov eax, 0x3110e538
pushf
not eax
add eax, 0x9845df32
xor eax, 0xba6a4fe9
rol eax, 0xf3
popf
pushf
not eax
add eax, 0x9c0b1920
xor eax, 0xfc211b9f
rol eax, 0x72
popf
pushf
not eax
add eax, 0xf231469f
xor eax, 0xc9393cf7
rol eax, 0x4b
popf
pushf
not eax
add eax, 0xe066a8c3
xor eax, 0xb1be9a2f
rol eax, 0x54
popf
jmp 0x140629d7f
push rax
pushf
mov eax, 0x3c4355ae
pushf
not eax
add eax, 0xe64d7fd8
xor eax, 0x96597a3c
rol eax, 0x72
popf
pushf
not eax
add eax, 0x95ea6e42
xor eax, 0xa2fdbd38
rol eax, 0xf0
popf
pushf
not eax
add eax, 0xafbeb121
xor eax, 0xedf1a1b8
rol eax, 0x95
popf
jmp 0x140629d7f
lea r9, [0x1b17a870e]
pushf
sub r9, 0x71772f0e
popf
lea r8, [0x1b5171e29]
pushf
sub r8, 0x7513c631
popf
lea rdx, [0x18c53b5c4]
pushf
sub rdx, 0x4c505dc4
popf
lea ecx, [rax + 0xa]
call fcn.140023930
test rax, rax
je 0x140629f9a
mov r9d, ebx
mov r8, rdi
mov edx, esi
mov rcx, rbp
call fcn.140668a94
jmp 0x14062a00e
xor edx, edx
mov rcx, rbp
call fcn.140646380
mov ecx, eax
mov r9d, ebx
mov r8, rdi
mov edx, esi
jmp 0x140629faf
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push rax
pushf
mov eax, 0x959d18e6
pushf
not eax
add eax, 0x8e69bbd2
xor eax, 0x9d5a9c4b
rol eax, 0x2d
popf
pushf
not eax
add eax, 0x8d6ea97d
xor eax, 0xe5921d46
rol eax, 7
popf
pushf
not eax
add eax, 0xacd1f56d
xor eax, 0xf188af91
rol eax, 0xf9
popf
pushf
not eax
add eax, 0xc374da17
xor eax, 0x88c2a715
rol eax, 3
popf
jmp 0x140629d7f
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x14067921f
Capabilities:
Encode data using base64

Disassembly:
push rax
pushf
mov eax, 0xa9fc9276
pushf
not eax
add eax, 0x9130f508
xor eax, 0xbc0462ad
rol eax, 0x92
popf
pushf
not eax
add eax, 0xff187607
xor eax, 0xfe270946
rol eax, 0x8a
popf
cmp eax, 0
jne 0x14067925c
popf
pop rax
jmp 0x14067925c
jmp fcn.1406eab40
Function at 0x1406ac5ac
Capabilities:
Delete file

Disassembly:
push rax
pushf
mov eax, 0x3e1b43e7
pushf
not eax
add eax, 0xe2d088c0
xor eax, 0xc412f745
rol eax, 0xd6
popf
pushf
not eax
add eax, 0xca6c3f38
xor eax, 0xecd8a0fb
rol eax, 0x1a
popf
pushf
not eax
add eax, 0xb24957b6
xor eax, 0xf20a24df
rol eax, 0xfc
popf
cmp eax, 2
jne 0x1406ac5fc
popf
pop rax
jmp 0x1406ac6ea
cmp eax, 0
jne 0x1406ac60b
popf
pop rax
jmp 0x1406ac629
cmp eax, 3
jne 0x1406ac61a
popf
pop rax
jmp 0x1406ac71f
cmp eax, 1
jne 0x1406ac629
popf
pop rax
jmp 0x1406ac6d8
sub rsp, 0x28
jmp 0x1406ac62e
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1406ac67e
push rax
pushf
mov eax, 0x29ab924d
pushf
not eax
add eax, 0xf26e47eb
xor eax, 0xe2af66e0
rol eax, 0xe4
popf
pushf
not eax
add eax, 0xc0a98a17
xor eax, 0xc9816fbe
rol eax, 0x7a
popf
pushf
not eax
add eax, 0xcbeaa4d4
xor eax, 0xe4a96fdc
rol eax, 0x46
popf
jmp 0x1406ac5ed
push rax
pushf
mov eax, 0x679bb395
pushf
not eax
add eax, 0xa6a712d7
xor eax, 0xf501c5ac
rol eax, 0xd7
popf
pushf
not eax
add eax, 0xdc64c564
xor eax, 0xddd544e1
rol eax, 0xce
popf
pushf
not eax
add eax, 0x9ef14216
xor eax, 0xc2d08c03
rol eax, 0x7c
popf
pushf
not eax
add eax, 0x82b534c2
xor eax, 0xfebe76c3
rol eax, 0x52
popf
jmp 0x1406ac5ed
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14062a023
or eax, 0xffffffff
jmp 0x1406ac71f
xor eax, eax
push rax
pushf
mov eax, 0xb53e3ff
pushf
not eax
add eax, 0x86f15a2d
xor eax, 0xc09f480c
rol eax, 0xc6
popf
pushf
not eax
add eax, 0xa5fe4db6
xor eax, 0xfd6ec547
rol eax, 0x25
popf
jmp 0x1406ac5ed
add rsp, 0x28
ret
Function at 0x1406bace9
Capabilities:
Encode data using xor

Disassembly:
push rax
pushf
mov eax, 0x97901b96
pushf
not eax
add eax, 0xd34bd594
xor eax, 0x9f0dd0d6
rol eax, 0x4f
popf
pushf
not eax
add eax, 0xdbbdd32d
xor eax, 0xa72800d1
rol eax, 0x20
popf
cmp eax, 4
jne 0x1406bad26
popf
pop rax
jmp 0x1406bb00a
cmp eax, 0
jne 0x1406bad35
popf
pop rax
jmp 0x1406bad62
cmp eax, 3
jne 0x1406bad44
popf
pop rax
jmp 0x1406bafcf
cmp eax, 1
jne 0x1406bad53
popf
pop rax
jmp 0x1406badec
cmp eax, 2
jne 0x1406bad62
popf
pop rax
jmp 0x1406bae64
sub rsp, 8
cmp byte [rcx + 0x34], 0
mov rax, rcx
je 0x1406bada6
push rax
pushf
mov eax, 0x9c0ba982
pushf
not eax
add eax, 0xc5c4e424
xor eax, 0x91cede86
rol eax, 0x4d
popf
pushf
not eax
add eax, 0xd453e2fa
xor eax, 0xf7ceebeb
rol eax, 0x43
popf
jmp 0x1406bad17
push rax
pushf
mov eax, 0xa462f2ea
pushf
not eax
add eax, 0xc9195bcd
xor eax, 0xc0214cbe
rol eax, 0x1d
popf
pushf
not eax
add eax, 0xcc908206
xor eax, 0xbfebfb91
rol eax, 0x55
popf
pushf
not eax
add eax, 0xa0f6762a
xor eax, 0x8384735d
rol eax, 0xc4
popf
jmp 0x1406bad17
mov qword [rsp], rbx
lea r11, [rcx + 2]
mov rbx, 0xfffffffffffffffe
sub rbx, rcx
nop dword [rax]
nop word [rax + rax]
push rax
pushf
mov eax, 0xe4915ea9
pushf
not eax
add eax, 0xb4e42113
xor eax, 0xcd42482e
rol eax, 0x70
popf
pushf
not eax
add eax, 0x943f4426
xor eax, 0x9a6ce721
rol eax, 0x26
popf
pushf
not eax
add eax, 0x92d96bce
xor eax, 0xd38b25c7
rol eax, 0x28
popf
pushf
not eax
add eax, 0xc80684e9
xor eax, 0xa48b166a
rol eax, 0xc9
popf
jmp 0x1406bad17
lea r10, [rbx + r11]
mov ecx, 0x34bf51b4
pushf
not ecx
add ecx, 0x8d17f717
xor ecx, 0x8152878e
rol ecx, 0x9a
popf
pushf
not ecx
add ecx, 0xf3c2dce2
xor ecx, 0x91838fe8
rol ecx, 0xa9
popf
pushf
not ecx
add ecx, 0xe58578ae
xor ecx, 0xb6ec0568
rol ecx, 0x68
popf
pushf
not ecx
add ecx, 0xdc129797
xor ecx, 0xfa1434d9
rol ecx, 0x9e
popf
lea r8d, [r10 - 0x22]
mov r9d, r10d
xor r8b, byte [r11 - 2]
lea r11, [r11 + 3]
movzx edx, r8b
and r9d, 7
sub ecx, r9d
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [r10 + 1]
or dl, r8b
and r9d, 7
mov byte [r11 - 5], dl
lea r8d, [r10 - 0x21]
xor r8b, byte [r11 - 4]
mov ecx, 0x82ab78a
pushf
not ecx
add ecx, 0xb2aea60a
xor ecx, 0xb3dd51ee
rol ecx, 0x61
popf
pushf
not ecx
add ecx, 0xceaffa27
xor ecx, 0x973e9bab
rol ecx, 0x82
popf
pushf
not ecx
add ecx, 0xe7be1fc3
xor ecx, 0xbc8a9d06
rol ecx, 0xe8
popf
sub ecx, r9d
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
mov ecx, 0x9d96cae9
pushf
not ecx
add ecx, 0x892c3e4e
xor ecx, 0xfdf03d96
rol ecx, 0xbc
popf
pushf
not ecx
add ecx, 0xfae626b1
xor ecx, 0xdde937b4
rol ecx, 0xb5
popf
pushf
not ecx
add ecx, 0xc684436f
xor ecx, 0xf7e3b090
rol ecx, 0x42
popf
or dl, r8b
lea r8d, [r10 + 2]
mov byte [r11 - 4], dl
sub r10b, 0x20
xor r10b, byte [r11 - 3]
and r8d, 7
sub ecx, r8d
movzx edx, r10b
shl dl, cl
movzx ecx, r8b
shr r10b, cl
lea rcx, [rbx + r11]
or dl, r10b
mov byte [r11 - 3], dl
cmp rcx, 0x33
jb 0x1406bae64
mov rbx, qword [rsp]
mov byte [rax + 0x34], 0
push rax
pushf
mov eax, 0xc01e6cf2
pushf
not eax
add eax, 0xfcc33b97
xor eax, 0x9698fc2a
rol eax, 5
popf
pushf
not eax
add eax, 0xd1dcd5f7
xor eax, 0x8a568521
rol eax, 0x7a
popf
jmp 0x1406bad17
add rsp, 8
ret
Function at 0x1406eab40
Capabilities:
Encode data using base64

Disassembly:
push rax
pushf
mov eax, 0xc9425880
pushf
not eax
add eax, 0xb4f48086
xor eax, 0xac5444a7
rol eax, 9
popf
pushf
not eax
add eax, 0xb3e6fa43
xor eax, 0xe70db5b3
rol eax, 0x78
popf
cmp eax, 4
jne 0x1406eab7d
popf
pop rax
jmp 0x1406ead26
cmp eax, 0
jne 0x1406eab8c
popf
pop rax
jmp 0x1406eabc8
cmp eax, 3
jne 0x1406eab9b
popf
pop rax
jmp 0x1406eacd7
cmp eax, 1
jne 0x1406eabaa
popf
pop rax
jmp 0x1406eac73
cmp eax, 5
jne 0x1406eabb9
popf
pop rax
jmp 0x1406ead8d
cmp eax, 2
jne 0x1406eabc8
popf
pop rax
jmp 0x1406eacd1
sub rsp, 0x28
mov rdx, rcx
test rcx, rcx
jne 0x1406eac1a
push rax
pushf
mov eax, 0x47d6fa5
pushf
not eax
add eax, 0xb5f11cc6
xor eax, 0x84a7c920
rol eax, 0x23
popf
pushf
not eax
add eax, 0xe6752eb1
xor eax, 0x81ee0e54
rol eax, 0x82
popf
pushf
not eax
add eax, 0xb9bb5061
xor eax, 0xf0cb4c72
rol eax, 0xc4
popf
jmp 0x1406eab6e
push rax
pushf
mov eax, 0xca0a13e5
pushf
not eax
add eax, 0xa807ea04
xor eax, 0xb1a68bf4
rol eax, 0x56
popf
pushf
not eax
add eax, 0xecb16640
xor eax, 0x81ec6ab0
rol eax, 0xbc
popf
pushf
not eax
add eax, 0xa730fa28
xor eax, 0x92018cc6
rol eax, 8
popf
pushf
not eax
add eax, 0xc87dfeb2
xor eax, 0xf7a2f22c
rol eax, 0x84
popf
jmp 0x1406eab6e
call fcn.1406220c4
mov dword [rax], 0x16
call fcn.14066720a
or eax, 0xffffffff
jmp 0x1406ead8d
sub dword [rcx + 0x10], 1
jns 0x1406ead26
add rsp, 0x28
jmp fcn.14060aab3
mov rax, qword [rcx]
movzx ecx, byte [rax]
inc rax
mov qword [rdx], rax
mov eax, ecx
push rax
pushf
mov eax, 0x5fc8a2bc
pushf
not eax
add eax, 0xb24fe09d
xor eax, 0xa9c405ac
rol eax, 0xc5
popf
pushf
not eax
add eax, 0xc72be2fa
xor eax, 0xa9842e8b
rol eax, 0x6a
popf
pushf
not eax
add eax, 0xf486392b
xor eax, 0xa07b2c19
rol eax, 0xd0
popf
pushf
not eax
add eax, 0xc0405629
xor eax, 0xe2ec040b
rol eax, 0x1a
popf
jmp 0x1406eab6e
add rsp, 0x28
ret
Function at 0x1406efd6c
Capabilities:
Access peb ldr_data
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rax, qword gs:[0x60]
xor r11d, r11d
mov rsi, r8
mov ebp, edx
mov rdi, qword [rax + 0x10]
movsxd rbx, dword [rdi + 0x3c]
add rbx, rdi
movzx eax, word [rbx + 0x14]
lea r9, [rbx + 0x18]
movzx r10d, word [rbx + 6]
add r9, rax
test r10, r10
je 0x1406efe2b
mov dword [rsp + 0x78], 0x6544302e
mov byte [rsp + 0x7c], 0x76
movups xmm2, xmmword [r9]
lea rcx, [rsp + 0x78]
movups xmm0, xmmword [r9 + 0x10]
movsd xmm1, qword [r9 + 0x20]
movd edx, xmm2
movups xmmword [rsp + 0x20], xmm2
movsd qword [rsp + 0x40], xmm1
movups xmmword [rsp + 0x30], xmm0
test dl, dl
je 0x1406efe13
lea rax, [rsp + 0x78]
lea r8, [rsp + 0x20]
sub r8, rax
movzx eax, dl
nop
movzx edx, al
cmp al, byte [rcx]
jne 0x1406efe13
movzx eax, byte [r8 + rcx + 1]
inc rcx
movzx edx, al
test al, al
jne 0x1406efdfc
cmp dl, byte [rcx]
lea rdx, [rsp + 0x20]
cmovne rdx, r11
add r9, 0x28
mov r11, rdx
sub r10, 1
jne 0x1406efdbe
mov eax, dword [r11 + 0xc]
mov rdx, rsi
mov ecx, dword [rbx + 8]
mov eax, dword [rax + rdi]
xor eax, dword [rbx + 0x68]
ror eax, cl
mov ecx, ebp
add rax, rdi
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
jmp rax
Function at 0x14001a5a0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x14001a72b
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [0x1402f5258]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.140038460
xorps xmm15, xmm15
mov r14, qword [0x14069ad40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x14001a605
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x14001a614
add rsp, 0x48
pop rbp
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x14001a633
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x14001a643
cmp rbx, 0x1000
jae 0x14001a60b
jmp 0x14001a6ad
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x14001a655
xor edx, edx
jmp 0x14001a6a4
mov rcx, qword [0x1402f5258]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.140038460
xorps xmm15, xmm15
mov r14, qword [0x14069ad40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x14001a639
jmp 0x14001a628
call fcn.14006c580
xorps xmm15, xmm15
mov r14, qword [0x14069ad40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.14003cb40
lea rax, [0x1403a4100]
mov ebx, 0x18
nop dword [rax]
call fcn.14003d3c0
mov rax, qword [rsp + 0x38]
call fcn.14003d100
lea rax, [0x1403a4d12]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.14003d3c0
mov rax, qword [rsp + 0x30]
call fcn.14003d100
call fcn.14003cd80
call fcn.14003cba0
lea rax, [0x1403a9cd1]
mov ebx, 0x21
call fcn.14003b1a0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.140068e60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.14001a5a0
Function at 0x14001a760
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x14001a986
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [0x1402f5250]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.1400384e0
xorps xmm15, xmm15
mov r14, qword [0x14069ad40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x14001a7d3
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x14001a7e2
add rsp, 0x50
pop rbp
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x14001a805
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x14001a815
cmp rbx, 0x1000
jae 0x14001a7d9
nop
jmp 0x14001a898
add rsp, 0x50
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop word [rax + rax]
cmp rbx, 0x1000
jae 0x14001a82d
xor esi, esi
jmp 0x14001a88a
mov rax, qword [0x1402f5250]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.1400384e0
xorps xmm15, xmm15
mov r14, qword [0x14069ad40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x14001a80b
jmp 0x14001a7f6
call fcn.14006c580
xorps xmm15, xmm15
mov r14, qword [0x14069ad40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x14001a920
nop dword [rax + rax]
call fcn.14003cb40
lea rax, [0x1403a4d2b]
mov ebx, 0x19
call fcn.14003d3c0
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
call fcn.14003d100
lea rax, [0x1403a4d12]
mov ebx, 0x19
call fcn.14003d3c0
mov eax, dword [rsp + 0x34]
call fcn.14003d100
nop
call fcn.14003cd80
call fcn.14003cba0
lea rax, [0x14039d216]
mov ebx, 0xd
call fcn.14003b1a0
nop dword [rax + rax]
cmp eax, 0x5af
je 0x14001a8c0
call fcn.14003cb40
lea rax, [0x1403a4d2b]
mov ebx, 0x19
call fcn.14003d3c0
mov rax, qword [rsp + 0x38]
call fcn.14003d100
lea rax, [0x1403a4d12]
mov ebx, 0x19
call fcn.14003d3c0
mov eax, dword [rsp + 0x34]
nop dword [rax]
call fcn.14003d100
call fcn.14003cd80
call fcn.14003cba0
lea rax, [0x1403a8a7c]
mov ebx, 0x1f
nop dword [rax + rax]
call fcn.14003b1a0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.140068e60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.14001a760
Function at 0x140023f80
Capabilities:
Hash data using murmur3

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
cmp byte [0x14069aa95], 0
jne 0x140024067
sub rbx, qword [rax + 0x18]
mov rdx, qword [rax + 0x50]
test byte [rdx], al
mov esi, dword [rax + 0x64]
imul rbx, rsi
mov rsi, rbx
shr rbx, 0x20
shr rsi, 0x23
and ebx, 7
mov rdi, rcx
mov rcx, rbx
mov r8d, 1
shl r8d, cl
add rdx, rsi
nop
nop
nop
nop
lock or byte [rdx], r8b
mov rcx, qword [rax + 0x18]
movabs rdx, 0x800000000000
lea rax, [rdx + rcx]
mov rdx, rax
shr rdx, 0x2a
nop
nop
nop
cmp rdx, 0x40
jae 0x14002405a
lea rbx, [0x14066ce78]
mov rdx, qword [rbx + rdx*8]
test byte [rdx], al
mov rbx, rcx
shr rbx, 0x10
and ebx, 0x3f
shr rcx, 0xd
and ecx, 7
mov esi, 1
shl esi, cl
shr rax, 0x16
and eax, 0xfffff
mov rax, qword [rdx + rax*8]
test byte [rax], al
movzx edx, byte [rax + rbx + 0x11440]
lea rax, [rax + rbx]
lea rax, [rax + 0x11440]
test sil, dl
jne 0x140024040
lock or byte [rax], sil
mov rax, qword [r14 + 0x30]
mov rax, qword [rax + 0xa0]
test byte [rax], al
add qword [rax + 0x1250], rdi
add rsp, 0x10
pop rbp
ret
mov rax, rdx
mov ecx, 0x40
call fcn.14006b140
lea rax, [0x1403aeaed]
mov ebx, 0x2c
call fcn.14003b1a0
nop
int3

Function at 0x140026340
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x140026446
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x70], rcx
mov byte [rsp + 0x17], dil
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x18], 0
jmp 0x140026383
mov rax, qword [rsp + 0x60]
mov rcx, rdx
mov rbx, qword [rsp + 0x68]
movzx edi, byte [rsp + 0x17]
cmp qword [rsp + 0x18], rbx
jae 0x14002643b
test byte [rax], al
lea rcx, [rax + 0x100b8]
mov ebx, edi
mov rax, rcx
nop dword [rax]
call fcn.140027140
test rax, rax
je 0x14002643b
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x30], xmm15
movups xmmword [rsp + 0x40], xmm15
lea rcx, [0x140026480]
mov qword [rsp + 0x20], rcx
lea rdx, [rsp + 0x18]
mov qword [rsp + 0x28], rdx
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x48], rax
lea rbx, [rsp + 0x20]
mov qword [rsp], rbx
nop dword [rax]
call fcn.140068d20
xorps xmm15, xmm15
mov r14, qword [0x14069ad40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x70]
nop dword [rax]
test rdx, rdx
jne 0x140026429
xor eax, eax
jmp 0x140026433
mov rax, qword [rdx]
call rax
mov rdx, qword [rsp + 0x70]
test al, al
je 0x140026371
mov rax, qword [rsp + 0x18]
add rsp, 0x50
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov byte [rsp + 0x20], dil
call fcn.140068e60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movzx edi, byte [rsp + 0x20]
jmp fcn.140026340
Function at 0x140034800
Capabilities:
Hash data using murmur3

Disassembly:
cmp rsp, qword [r14 + 0x18]
jbe 0x140034a86
push rbp
mov rbp, rsp
sub rsp, 0x38
test byte [rax], al
mov rcx, qword [rax + 0x1268]
lea rsi, [rax + 0x1278]
sub rcx, rsi
shr rcx, 3
cmp rcx, 0x200
ja 0x140034a7a
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x30], rcx
mov qword [rax + 0x1268], 0
cmp byte [0x14069aa95], 0
jne 0x14003485a
xor edx, edx
xor ebx, ebx
jmp 0x1400348a0
xor edx, edx
jmp 0x140034885
mov qword [rsp + 0x28], rdx
mov rcx, qword [rax + rdx*8 + 0x1278]
mov rax, rcx
call fcn.1400237e0
mov rdx, qword [rsp + 0x28]
inc rdx
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
cmp rdx, rcx
jl 0x14003485e
add rax, 0x1268
call fcn.140034780
add rsp, 0x38
pop rbp
ret
inc rdx
nop
cmp rdx, rcx
jge 0x140034a14
mov rsi, qword [rax + rdx*8 + 0x1278]
cmp rsi, 0x1000
jb 0x14003489b
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rbx
mov rax, rsi
xor ebx, ebx
mov rcx, rbx
call fcn.1400178c0
test rax, rax
jne 0x1400348ec
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
jmp 0x14003489b
mov rsi, qword [rbx + 0x50]
test byte [rsi], al
mov r8, rcx
shr r8, 3
movzx r9d, byte [rsi + r8]
and ecx, 7
mov r10d, 1
shl r10d, cl
nop
add rsi, r8
test r10b, r9b
je 0x14003492c
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
jmp 0x14003489b
nop
lock or byte [rsi], r10b
mov rcx, qword [rbx + 0x18]
movabs rsi, 0x800000000000
lea r8, [rsi + rcx]
mov r9, r8
shr r8, 0x2a
nop
nop
nop
cmp r8, 0x40
jae 0x140034a6d
lea r10, [0x14066ce78]
mov r8, qword [r10 + r8*8]
test byte [r8], al
mov r10, rcx
shr r10, 0x10
and r10d, 0x3f
shr rcx, 0xd
and ecx, 7
mov r11d, 1
shl r11d, cl
shr r9, 0x16
and r9d, 0xfffff
mov r8, qword [r8 + r9*8]
test byte [r8], al
movzx r9d, byte [r8 + r10 + 0x11440]
lea r8, [r8 + r10]
lea r8, [r8 + 0x11440]
test r11b, r9b
jne 0x1400349af
lock or byte [r8], r11b
movzx r8d, byte [rbx + 0x6a]
test r8b, 1
je 0x1400349e5
mov rax, qword [rsp + 0x48]
mov r8, qword [rax + 0x1250]
add r8, qword [rbx + 0x70]
mov qword [rax + 0x1250], r8
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
jmp 0x14003489b
mov r8, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
cmp r8, rcx
jae 0x140034a65
mov rbx, qword [rsp + 0x48]
mov qword [rbx + r8*8 + 0x1278], rax
inc r8
mov rax, rbx
mov rdx, qword [rsp + 0x28]
mov rbx, r8
jmp 0x14003489b
cmp rbx, 0x200
ja 0x140034a54
lea rdx, [rax + 0x1278]
lea rsi, [rax + 0x1240]
mov rcx, rbx
mov edi, 0x200
mov rbx, rdx
mov rax, rsi
call fcn.14002a040
mov rax, qword [rsp + 0x48]
add rax, 0x1268
call fcn.140034780
add rsp, 0x38
pop rbp
ret
mov rcx, rbx
mov edx, 0x200
nop dword [rax]
call fcn.14006b1a0
mov rax, r8
call fcn.14006b120
mov rax, r8
mov ecx, 0x40
call fcn.14006b140
mov edx, 0x200
nop
call fcn.14006b180
nop
mov qword [rsp + 8], rax
call fcn.14006fb40
mov rax, qword [rsp + 8]
jmp fcn.140034800
Function at 0x140049d40
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x140049ea7
push rbp
mov rbp, rsp
sub rsp, 0x18
mov ecx, dword [rax + 0x190]
mov edx, dword [rax + 0x194]
mov rsi, qword [rax + 0x998]
mov edi, dword [rax + 0x194]
cmp edi, edx
jne 0x140049d52
cmp edx, ecx
jne 0x140049e95
nop word [rax + rax]
test rsi, rsi
jne 0x140049e95
mov qword [rsp + 0x28], rax
test rbx, rbx
jne 0x140049db4
nop
call fcn.14006c9a0
xorps xmm15, xmm15
mov r14, qword [0x14069ad40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rbx, qword [rsp]
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x10], rbx
call fcn.140049c60
mov rcx, qword [rsp + 0x28]
mov edx, dword [rcx]
mov ebx, edx
sar edx, 0x1f
shr edx, 0x1b
add edx, ebx
mov esi, edx
and edx, 0xffffffe0
sub ebx, edx
test ebx, ebx
jl 0x140049e90
mov rdx, qword [0x140646af8]
sar esi, 5
mov rax, rcx
mov ecx, ebx
mov edi, 1
shl edi, cl
movsxd rsi, esi
cmp ecx, 0x20
sbb r8d, r8d
and edi, r8d
cmp rdx, rsi
jbe 0x140049e85
mov rcx, qword [0x140646af0]
lea rcx, [rcx + rsi*4]
lock or dword [rcx], edi
mov rcx, qword [0x140647cf0]
mov qword [rax + 8], rcx
mov rcx, rax
nop
mov qword [0x140647cf0], rax
nop
mov edx, 1
lea rsi, [0x140647cf8]
lock xadd dword [rsi], edx
mov rdx, qword [rcx + 0x1228]
shr rdx, 0x3d
test dl, dl
jne 0x140049e73
mov rax, qword [rsp + 0x10]
movabs rdx, 0x1fffffffffffffff
and rdx, rax
bts rdx, 0x3f
nop
nop
xchg qword [rcx + 0x1228], rdx
add rsp, 0x18
pop rbp
ret
lea rax, [0x1403ad2c7]
mov ebx, 0x28
nop
call fcn.14003b1a0
mov rax, rsi
mov rcx, rdx
call fcn.14006b120
call fcn.1400396a0
lea rax, [0x1403aad7d]
mov ebx, 0x23
call fcn.14003b1a0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.140068e60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.140049d40