joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140002330
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x14001a540]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x140002350
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x140002358
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140002350
movzx eax, word [r8 + 0x14]
sub rcx, rdx
movzx edx, word [r8 + 6]
lea rax, [r8 + rax + 0x18]
test edx, edx
je 0x1400023a5
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x14000239c
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x140002350
add rax, 0x28
cmp rax, r9
jne 0x140002388
xor eax, eax
ret

Function at 0x1400023b0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x14001a540]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x1400023d0
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400023d8
mov eax, r8d
ret
cmp word [rax + 0x18], 0x20b
jne 0x1400023d0
movzx r8d, word [rax + 6]
mov eax, r8d
ret

Function at 0x140002460
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x14001a540]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x140002480
movsxd rdx, dword [rax + 0x3c]
add rdx, rax
cmp dword [rdx], 0x4550
je 0x140002488
mov rax, r8
ret
cmp word [rdx + 0x18], 0x20b
cmove r8, rax
mov rax, r8
ret

Function at 0x140002710
Capabilities:
Encode data using xor

Disassembly:
shl rcx, 4
xor eax, eax
and ecx, 0xff0
add r8, rcx
lea r9, [rdx + rax]
lea r10, [rax + r8]
xor ecx, ecx
mov r11b, byte [r10 + rcx]
inc rcx
xor byte [r9], r11b
inc r9
cmp rcx, 4
jne 0x140002729
add rax, 4
cmp rax, 0x10
jne 0x14000271f
ret
Function at 0x1400037f0
Capabilities:
Inspect section memory permissions

Disassembly:
push r15
push r14
mov r14, r8
push r13
mov r13, rdx
push r12
push rbp
push rdi
mov rdi, rcx
mov rcx, rdx
push rsi
mov rsi, r9
push rbx
sub rsp, 0x48
call fcn.140013f80
mov rbx, qword [0x14001a4c0]
mov qword [rsp + 0x38], rax
cmp dword [rbx + 0xec], 0
je 0x14000385c
lea rdx, [0x140017a20]
mov ecx, 1
call qword [rbx + 0x1a8]
mov r12, rax
test rax, rax
jne 0x14000385f
mov rax, qword [rbx + 0x8b2]
mov ecx, 1
mov edx, dword [rax + 0x68]
call fcn.140010350
jmp 0x1400039ef
xor r12d, r12d
xor ebp, ebp
mov r15d, 0x40
mov rax, qword [rdi + 8]
cmp word [rax + 2], bp
jbe 0x14000392e
movzx edx, bp
mov rcx, qword [rdi]
imul rax, rdx, 0x28
lea rax, [rcx + rax + 0x14]
cmp dword [rax + 0x10], 0
mov qword [rdi + 0x10], rax
jne 0x140003892
inc ebp
jmp 0x140003867
mov r8d, dword [rax + 0x24]
mov eax, 1
mov ecx, r8d
and ecx, 0xe0000000
je 0x1400038f6
mov eax, 0x10
cmp ecx, 0x20000000
je 0x1400038f6
mov eax, 2
cmp ecx, 0x40000000
je 0x1400038f6
mov eax, 0x20
cmp ecx, 0x60000000
je 0x1400038f6
mov eax, 8
cmp ecx, 0x80000000
je 0x1400038f6
mov eax, pe_nt_image_headers64
cmp ecx, 0xa0000000
je 0x1400038f6
cmp ecx, 0xc0000000
mov eax, 4
cmovne eax, r15d
bt r8d, 0x1a
jae 0x140003900
or ah, 2
shl rdx, 4
add rdx, qword [rdi + 0x3c]
mov ecx, 2
mov r9, qword [rdx + 8]
mov dword [rsp + 0x20], eax
mov r8, qword [rdx]
or rdx, 0xffffffffffffffff
call fcn.14000fb90
test eax, eax
jne 0x14000388e
jmp 0x1400039ef
mov r9, qword [rdi + 0x4c]
test r9, r9
jne 0x14000393c
xor r15d, r15d
jmp 0x140003962
mov dword [rsp + 0x20], 2
mov r8, qword [rdi + 0x44]
or rdx, 0xffffffffffffffff
mov ecx, 2
call fcn.14000fb90
test eax, eax
jne 0x140003937
jmp 0x1400039ef
inc r15d
mov rax, qword [rdi + 8]
mov eax, dword [rax + 0xc]
cmp eax, r15d
jbe 0x1400039bb
mov ebp, r15d
mov rdx, qword [rdi + 0x20]
imul rbp, rbp, 0x12
lea rcx, [rdx + rbp]
cmp dword [rcx], 0
jne 0x140003990
imul rax, rax, 0x12
mov ecx, dword [rcx + 4]
add rax, rcx
lea rcx, [rdx + rax]
mov r8d, dword [rsp + 0x38]
mov rdx, r13
call fcn.14000f830
test eax, eax
jne 0x14000395f
add rbp, qword [rdi + 0x20]
mov rax, qword [rdi + 0x3c]
movzx edx, word [rbp + 0xc]
mov ecx, dword [rbp + 8]
shl rdx, 4
add rcx, qword [rax + rdx - 0x10]
jne 0x1400039f3
mov edx, dword [rsp + 0xb0]
mov ecx, 0x14
call fcn.1400100c0
mov edx, 2
mov r12, rax
mov rcx, rax
call fcn.14000fe50
mov rcx, r12
mov rdx, r13
call fcn.14000ff80
mov rcx, r12
call fcn.140010160
xor eax, eax
jmp 0x140003a54
mov rdx, qword [rdi + 8]
mov r9w, word [rdx + 2]
xor edx, edx
jmp 0x140003a0f
mov r8, qword [rax]
cmp r8, rcx
jbe 0x140003a17
inc rdx
add rax, 0x10
cmp r9w, dx
ja 0x140003a00
jmp 0x1400039ef
add r8, qword [rax + 8]
cmp rcx, r8
jae 0x140003a08
imul rdx, rdx, 0x28
mov rax, qword [rdi]
lea rax, [rax + rdx + 0x14]
mov qword [rdi + 0x10], rax
test byte [rax + 0x27], 0x20
je 0x1400039ef
mov r8, rsi
mov rdx, r14
call fcn.140003a70
test r12, r12
je 0x140003a4f
mov rcx, r12
call qword [rbx + 0x1b0]
mov eax, 1
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14000c8e0
Capabilities:
Enumerate pe sections
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
mov r12, rcx
push rbp
mov rdx, r12
push rdi
push rsi
xor esi, esi
push rbx
sub rsp, 0x28
movsxd rax, dword [rcx + 0x3c]
mov ecx, dword [rcx + rax + 0x88]
call 0x1400132b0
mov rdx, r12
mov ebx, eax
add rbx, r12
mov ecx, dword [rbx + 0x20]
call 0x1400132b0
mov ecx, dword [rbx + 0x24]
mov rdx, r12
mov ebp, eax
call 0x1400132b0
mov r15d, dword [rbx + 0x18]
add rbp, r12
mov edi, eax
add rdi, r12
lea r14, [rsi + rsi]
add r14, rdi
cmp r15, rsi
je 0x14000c9a1
mov ecx, dword [rbp + rsi*4]
mov rdx, r12
call 0x1400132b0
mov r13d, eax
add r13, r12
mov rcx, r13
call fcn.14000ce50
cmp eax, 0xa6caa1c5
jne 0x14000c98d
mov ecx, dword [rbx + 0x1c]
mov rdx, r12
call 0x1400132b0
movzx edx, word [r14]
mov eax, eax
add rax, r12
mov ecx, dword [rax + rdx*4]
add rsp, 0x28
mov rdx, r12
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp 0x1400132b0
mov rcx, r13
inc rsi
call fcn.14000ce50
cmp eax, 0xffe885ef
jne 0x14000c931
jmp 0x14000c95e
add rsp, 0x28
xor eax, eax
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov eax, ecx
movsxd rcx, dword [rdx + 0x3c]
add rcx, rdx
movzx edx, word [rcx + 0x14]
lea rdx, [rcx + rdx + 0x18]
cmp dword [rdx + 0x14], eax
ja 0x1400132fa
mov r9w, word [rcx + 6]
xor ecx, ecx
cmp r9w, cx
je 0x1400132f8
mov r8d, dword [rdx + 0xc]
cmp eax, r8d
jb 0x1400132f0
mov r10d, dword [rdx + 0x10]
add r10d, r8d
cmp r10d, eax
jbe 0x1400132f0
add eax, dword [rdx + 0x14]
sub eax, r8d
ret
inc ecx
add rdx, 0x28
jmp 0x1400132ce
xor eax, eax
ret

Function at 0x14000ca10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r12
xor r8d, r8d
push rbp
push rdi
push rsi
push rbx
mov rbx, qword [0x14001a4c0]
mov rax, qword [rbx + 0x83a]
test rax, rax
je 0x14000cac2
mov r8d, dword [rbx + 0x7f0]
test r8d, r8d
jne 0x14000cac2
movsxd rdx, dword [rax + 0x3c]
xor ecx, ecx
mov edx, dword [rax + rdx + 0x88]
add rdx, rax
mov edi, dword [rdx + 0x20]
mov r10d, dword [rdx + 0x1c]
mov esi, dword [rdx + 0x24]
mov ebp, dword [rdx + 0x18]
xor edx, edx
add r10, rax
add rdi, rax
add rsi, rax
cmp ebp, ecx
jbe 0x14000cabb
mov r9d, dword [rdi + rcx*4]
cmp word [rax + r9], 0x775a
jne 0x14000cab6
test rdx, rdx
movzx r9d, word [rsi + rcx*2]
jne 0x14000ca8c
mov edx, dword [r10 + r9*4]
add rdx, rax
jmp 0x14000cab6
mov r9d, dword [r10 + r9*4]
mov r11, rdx
add r9, rax
mov r12, r9
sub r11, r9
sub r12, rdx
cmp rdx, r9
mov r9d, r12d
cmova r9d, r11d
test r8d, r8d
je 0x14000cab3
cmp r8d, r9d
jbe 0x14000cab6
mov r8d, r9d
inc rcx
jmp 0x14000ca68
mov dword [rbx + 0x7f0], r8d
pop rbx
mov eax, r8d
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x14000ce00
Capabilities:
Hash data using djb2

Disassembly:
xor eax, eax
test rcx, rcx
je 0x14000ce4d
mov r10, rcx
mov eax, 0x1505
mov r9b, byte [r10]
test edx, edx
jne 0x14000ce1c
test r9b, r9b
jne 0x14000ce2f
ret
mov r11, r10
sub r11, rcx
cmp edx, r11d
jbe 0x14000ce4d
cmp r9b, 1
adc r10, 0
cmp r9b, 0x60
jbe 0x14000ce3e
test r8d, r8d
je 0x14000ce3e
sub r9d, 0x20
imul eax, eax, 0x21
movzx r9d, r9b
inc r10
add eax, r9d
jmp 0x14000ce0f
ret
Function at 0x14000ce50
Capabilities:
Hash data using djb2

Disassembly:
mov eax, 0x1505
movsx edx, byte [rcx]
inc rcx
test dl, dl
je 0x14000ce66
imul eax, eax, 0x21
add eax, edx
jmp 0x14000ce55
ret

Function at 0x14000e880
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push rsi
xor eax, eax
push rbx
mov r8b, byte [rdx + rax]
mov byte [rcx + rax], r8b
mov r8b, byte [rdx + rax + 1]
mov byte [rcx + rax + 1], r8b
mov r8b, byte [rdx + rax + 2]
mov byte [rcx + rax + 2], r8b
mov r8b, byte [rdx + rax + 3]
mov byte [rcx + rax + 3], r8b
add rax, 4
cmp rax, 0x20
jne 0x14000e884
mov r11d, 8
lea r10, str.cw
lea rbx, [0x14001a6f0]
mov esi, r11d
movzx r9d, byte [rcx + 0x1c]
movzx r8d, byte [rcx + 0x1d]
movzx edx, byte [rcx + 0x1e]
movzx eax, byte [rcx + 0x1f]
and esi, 7
jne 0x14000e902
mov sil, byte [r10 + r8]
mov r8b, byte [r10 + rdx]
mov dl, byte [r10 + rax]
mov al, byte [r10 + r9]
mov r9d, r11d
shr r9d, 3
xor sil, byte [rbx + r9]
mov r9d, esi
jmp 0x14000e917
cmp esi, 4
jne 0x14000e917
mov r9b, byte [r10 + r9]
mov r8b, byte [r10 + r8]
mov dl, byte [r10 + rdx]
mov al, byte [r10 + rax]
xor r9b, byte [rcx]
xor r8b, byte [rcx + 1]
inc r11d
add rcx, 4
xor dl, byte [rcx - 2]
xor al, byte [rcx - 1]
mov byte [rcx + 0x1c], r9b
mov byte [rcx + 0x1d], r8b
mov byte [rcx + 0x1e], dl
mov byte [rcx + 0x1f], al
cmp r11d, 0x3c
jne 0x14000e8c8
pop rbx
pop rsi
ret

Function at 0x14000ee10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
test rcx, rcx
je 0x14000ee46
mov esi, edx
test edx, edx
jne 0x14000ee4d
xor eax, eax
jmp 0x14000ef33
movsxd rax, dword [rcx + 0x3c]
mov r12, rcx
xor ebx, ebx
add rax, rcx
mov r9d, dword [rax + 0x88]
mov eax, dword [rax + 0x8c]
lea r15, [rcx + r9]
mov dword [rsp + 0x28], eax
mov eax, dword [r15 + 0x18]
mov r14d, dword [r15 + 0x20]
mov ebp, dword [r15 + 0x1c]
mov r13d, dword [r15 + 0x24]
mov dword [rsp + 0x2c], eax
add r14, rcx
cmp dword [rsp + 0x2c], ebx
jbe 0x14000ee46
mov edi, dword [r14 + rbx*4]
mov r8d, 1
xor edx, edx
add rdi, r12
mov rcx, rdi
call fcn.14000ce00
mov r8d, eax
lea rax, [rbx + 1]
cmp r8d, esi
jne 0x14000ef2b
add rbx, rbx
add rbx, r12
movzx eax, word [rbx + r13]
lea rax, [r12 + rax*4]
mov eax, dword [rax + rbp]
add rax, r12
mov qword [rsp + 0x38], rax
cmp rax, r15
jae 0x14000eed4
mov rax, qword [rsp + 0x38]
jmp 0x14000ef33
mov esi, dword [rsp + 0x28]
add rsi, r12
add rsi, r15
cmp rax, rsi
jae 0x14000eecd
call fcn.140013f80
mov qword [rsp + 0x48], rdi
mov word [rsp + 0x40], ax
inc eax
mov word [rsp + 0x42], ax
mov rax, qword [0x14001a4c0]
mov rax, qword [rax + 0x130]
test rax, rax
je 0x14000ee46
xor r8d, r8d
lea rdx, [rsp + 0x40]
lea r9, [rsp + 0x38]
mov rcx, r12
call rax
test eax, eax
jns 0x14000eecd
jmp 0x14000ee46
mov rbx, rax
jmp 0x14000ee85
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1400132b0
Capabilities:
Enumerate pe sections

Disassembly:
push r15
push r14
push r13
push r12
mov r12, rcx
push rbp
mov rdx, r12
push rdi
push rsi
xor esi, esi
push rbx
sub rsp, 0x28
movsxd rax, dword [rcx + 0x3c]
mov ecx, dword [rcx + rax + 0x88]
call 0x1400132b0
mov rdx, r12
mov ebx, eax
add rbx, r12
mov ecx, dword [rbx + 0x20]
call 0x1400132b0
mov ecx, dword [rbx + 0x24]
mov rdx, r12
mov ebp, eax
call 0x1400132b0
mov r15d, dword [rbx + 0x18]
add rbp, r12
mov edi, eax
add rdi, r12
lea r14, [rsi + rsi]
add r14, rdi
cmp r15, rsi
je 0x14000c9a1
mov ecx, dword [rbp + rsi*4]
mov rdx, r12
call 0x1400132b0
mov r13d, eax
add r13, r12
mov rcx, r13
call fcn.14000ce50
cmp eax, 0xa6caa1c5
jne 0x14000c98d
mov ecx, dword [rbx + 0x1c]
mov rdx, r12
call 0x1400132b0
movzx edx, word [r14]
mov eax, eax
add rax, r12
mov ecx, dword [rax + rdx*4]
add rsp, 0x28
mov rdx, r12
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp 0x1400132b0
mov rcx, r13
inc rsi
call fcn.14000ce50
cmp eax, 0xffe885ef
jne 0x14000c931
jmp 0x14000c95e
add rsp, 0x28
xor eax, eax
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov eax, ecx
movsxd rcx, dword [rdx + 0x3c]
add rcx, rdx
movzx edx, word [rcx + 0x14]
lea rdx, [rcx + rdx + 0x18]
cmp dword [rdx + 0x14], eax
ja 0x1400132fa
mov r9w, word [rcx + 6]
xor ecx, ecx
cmp r9w, cx
je 0x1400132f8
mov r8d, dword [rdx + 0xc]
cmp eax, r8d
jb 0x1400132f0
mov r10d, dword [rdx + 0x10]
add r10d, r8d
cmp r10d, eax
jbe 0x1400132f0
add eax, dword [rdx + 0x14]
sub eax, r8d
ret
inc ecx
add rdx, 0x28
jmp 0x1400132ce
xor eax, eax
ret
Function at 0x415320
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4154cb
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.0042f920
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
nop
jne 0x41538e
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x4153a1
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x4153c5
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x4153d9
cmp rbx, 0x1000
jae 0x415398
nop
jmp 0x415449
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop
cmp rbx, 0x1000
jae 0x4153ed
xor edx, edx
jmp 0x415440
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.0042f920
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
nop
test dl, dl
jne 0x4153cf
jmp 0x4153b5
call fcn.0045e880
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.004348e0
lea rax, [0x004b9caa]
mov ebx, 0x18
nop dword [rax + rax]
call fcn.004351e0
mov rax, qword [rsp + 0x38]
call fcn.00434ee0
lea rax, [0x004b9d3a]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.004351e0
mov rax, qword [rsp + 0x30]
call fcn.00434ee0
call fcn.00434b40
call fcn.00434960
lea rax, [0x004bbf9e]
mov ebx, 0x21
call fcn.00433160
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045ad00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00415320
Function at 0x415500
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41572a
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.0042f9a0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x41557b
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x41558e
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x4155b0
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x4155c4
cmp rbx, 0x1000
jae 0x415585
jmp 0x41564e
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x4155d6
xor esi, esi
jmp 0x415640
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
nop dword [rax]
call fcn.0042f9a0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
test sil, sil
jne 0x4155ba
jmp 0x4155a2
call fcn.0045e880
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x4156c9
call fcn.004348e0
lea rax, [0x004ba109]
mov ebx, 0x19
call fcn.004351e0
mov rax, qword [rsp + 0x68]
call fcn.00434ee0
lea rax, [0x004b9d3a]
mov ebx, 0x19
nop
call fcn.004351e0
mov eax, dword [rsp + 0x34]
call fcn.00434ee0
call fcn.00434b40
call fcn.00434960
lea rax, [0x004b6be8]
mov ebx, 0xd
call fcn.00433160
cmp eax, 0x5af
je 0x415673
call fcn.004348e0
lea rax, [0x004ba109]
mov ebx, 0x19
call fcn.004351e0
mov rax, qword [rsp + 0x38]
call fcn.00434ee0
lea rax, [0x004b9d3a]
mov ebx, 0x19
nop dword [rax]
call fcn.004351e0
mov eax, dword [rsp + 0x34]
call fcn.00434ee0
call fcn.00434b40
call fcn.00434960
lea rax, [0x004bb8cf]
mov ebx, 0x1f
call fcn.00433160
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045ad00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00415500
Function at 0x41cbe0
Capabilities:
Hash data using murmur3

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
cmp byte [0x005b2434], 0
jne 0x41ccd9
nop
nop
nop
nop
sub rbx, qword [rax + 0x18]
nop
mov edx, dword [rax + 0x5c]
imul rbx, rdx
mov rdx, rbx
shr rbx, 0x20
nop
shr rdx, 0x23
and rbx, 7
mov rsi, rcx
mov rcx, rbx
mov r8d, 1
shl r8d, cl
nop
add rdx, qword [rax + 0x50]
lock or byte [rdx], r8b
nop
nop
mov rcx, qword [rax + 0x18]
nop
movabs rdx, 0x800000000000
lea rax, [rdx + rcx]
mov rdx, rax
shr rax, 0x2a
cmp rax, 0x40
jae 0x41cccf
lea rbx, [0x00584898]
mov rax, qword [rbx + rax*8]
shr rdx, 0x16
and rdx, 0xfffff
mov rdx, qword [rax + rdx*8]
test byte [rdx], al
test byte [rax], al
mov rax, rcx
shr rcx, 0x10
and rcx, 0x3f
movzx ebx, byte [rdx + rcx + 0x21040]
lea rdx, [rdx + rcx]
lea rdx, [rdx + 0x21040]
shr rax, 0xd
and rax, 7
mov rcx, rax
mov eax, 1
shl eax, cl
test al, bl
jne 0x41ccaa
lock or byte [rdx], al
mov rax, qword [r14 + 0x30]
mov rax, qword [rax + 0xa0]
test byte [rax], al
add qword [rax + 0x16a8], rsi
add qword [rax + 0x16b0], rdi
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov ecx, 0x40
call fcn.0045d420
lea rax, [0x004bd8b3]
mov ebx, 0x2c
call fcn.00433160
nop
int3
Function at 0x42bd60
Capabilities:
Hash data using murmur3

Disassembly:
cmp rsp, qword [r14 + 0x18]
jbe 0x42c006
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
test byte [rax], al
lea rsi, [rax + 0x16d0]
mov rcx, qword [rax + 0x16c0]
sub rcx, rsi
shr rcx, 3
cmp rcx, 0x200
ja 0x42bffa
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x30], rcx
mov qword [rax + 0x16c0], 0
cmp byte [0x005b2434], 0
jne 0x42bdc2
xor edx, edx
xor ebx, ebx
nop
jmp 0x42be0b
xor edx, edx
jmp 0x42bdee
mov qword [rsp + 0x28], rdx
mov rcx, qword [rax + rdx*8 + 0x16d0]
mov rax, rcx
call fcn.0041c400
mov rcx, qword [rsp + 0x28]
lea rdx, [rcx + 1]
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
cmp rdx, rcx
jl 0x42bdc6
add rax, 0x16c0
call fcn.0042bc20
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
inc rdx
cmp rdx, rcx
jge 0x42bf92
mov rsi, qword [rax + rdx*8 + 0x16d0]
nop dword [rax]
cmp rsi, 0x1000
jb 0x42be08
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rbx
mov rax, rsi
xor ebx, ebx
mov rcx, rbx
nop dword [rax + rax]
call fcn.00411360
test rax, rax
jne 0x42be62
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
nop
jmp 0x42be08
nop
mov rsi, rcx
shr rcx, 3
and rsi, 7
mov rdx, rcx
mov rcx, rsi
mov r8d, 1
shl r8d, cl
nop
add rdx, qword [rbx + 0x50]
movzx esi, byte [rdx]
test r8b, sil
je 0x42bea5
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
nop
jmp 0x42be08
nop
lock or byte [rdx], r8b
nop
nop
mov rcx, qword [rbx + 0x18]
nop
movabs rsi, 0x800000000000
lea r8, [rsi + rcx]
mov r9, r8
shr r8, 0x2a
cmp r8, 0x40
jae 0x42bfed
lea r10, [0x00584898]
mov r8, qword [r10 + r8*8]
shr r9, 0x16
and r9, 0xfffff
mov r9, qword [r8 + r9*8]
test byte [r9], al
test byte [r8], al
mov r8, rcx
shr rcx, 0x10
and rcx, 0x3f
movzx r10d, byte [r9 + rcx + 0x21040]
lea r9, [r9 + rcx]
lea r9, [r9 + 0x21040]
shr r8, 0xd
and r8, 7
mov rcx, r8
mov r8d, 1
shl r8d, cl
test r8b, r10b
jne 0x42bf2c
lock or byte [r9], r8b
movzx r8d, byte [rbx + 0x62]
test r8b, 1
je 0x42bf65
mov r8, qword [rsp + 0x48]
mov r9, qword [r8 + 0x16a8]
add r9, qword [rbx + 0x68]
mov qword [r8 + 0x16a8], r9
mov rax, r8
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
jmp 0x42be08
mov r8, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
cmp r8, rcx
jae 0x42bfe5
mov r9, qword [rsp + 0x48]
mov qword [r9 + r8*8 + 0x16d0], rax
lea rbx, [r8 + 1]
mov rax, r9
mov rdx, qword [rsp + 0x28]
jmp 0x42be08
cmp rbx, 0x200
ja 0x42bfd7
lea rdx, [rax + 0x16d0]
lea rsi, [rax + 0x1698]
mov rcx, rbx
mov edi, 0x200
mov rbx, rdx
mov rax, rsi
call fcn.00421ac0
mov rdx, qword [rsp + 0x48]
lea rax, [rdx + 0x16c0]
call fcn.0042bc20
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov rcx, rbx
mov edx, 0x200
nop
call fcn.0045d480
mov rax, r8
call fcn.0045d400
mov rax, r8
mov ecx, 0x40
call fcn.0045d420
mov edx, 0x200
nop
call fcn.0045d460
nop
mov qword [rsp + 8], rax
call fcn.0045f3e0
mov rax, qword [rsp + 8]
jmp fcn.0042bd60
Function at 0x44be80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov qword [rsp + 0x20], rax
test rbx, rbx
jbe 0x44bff8
movzx edx, byte [rax]
nop
test edx, edx
jne 0x44bebc
test r8b, r8b
jne 0x44bebc
xor eax, eax
xor ebx, ebx
mov rcx, rbx
xor edi, edi
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
bt edx, 7
jae 0x44becf
xor edx, edx
xor r8d, r8d
xor r9d, r9d
jmp 0x44bfb8
mov r8d, 1
mov r9d, edx
and edx, 1
neg edx
shr r9d, 1
xor edx, r9d
add dword [rsi], edx
cmp rbx, r8
jb 0x44bfa6
sub rbx, r8
sub rcx, r8
mov rdx, rcx
neg rcx
sar rcx, 0x3f
and r8, rcx
lea rsi, [rax + r8]
test rbx, rbx
jbe 0x44bf9c
movzx r8d, byte [rax + r8]
bt r8d, 7
jae 0x44bf23
xor eax, eax
xor ecx, ecx
xor r8d, r8d
jmp 0x44bf66
mov eax, 1
cmp rax, rbx
ja 0x44bf55
add qword [rdi], r8
sub rdx, rax
sub rbx, rax
mov rcx, rdx
neg rdx
sar rdx, 0x3f
and rax, rdx
add rax, rsi
mov edi, 1
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov rcx, rbx
call fcn.0045d4c0
lea r8d, [rcx + 7]
mov ecx, eax
mov eax, r10d
cmp rax, rbx
jae 0x44bf94
movzx r9d, byte [rax + rsi]
lea r10d, [rax + 1]
mov r11d, r9d
and r9d, 0x7f
mov eax, ecx
mov ecx, r8d
shl r9d, cl
or eax, r9d
test r11b, 0x80
jne 0x44bf5d
mov r8d, eax
mov eax, r10d
jmp 0x44bf28
mov rcx, rbx
call fcn.0045d400
xor eax, eax
mov rcx, rbx
call fcn.0045d400
mov eax, r8d
mov rcx, rbx
call fcn.0045d4c0
lea r9d, [rcx + 7]
mov rcx, r12
cmp rbx, rdx
jbe 0x44bfee
movzx r10d, byte [rdx + rax]
inc edx
mov r11d, r10d
and r10d, 0x7f
mov r12, rcx
mov ecx, r9d
shl r10d, cl
or r8d, r10d
test r11b, 0x80
jne 0x44bfb1
mov rcx, r12
mov r9d, edx
mov edx, r8d
mov r8d, r9d
jmp 0x44bed5
mov eax, edx
mov rcx, rbx
call fcn.0045d400
xor eax, eax
mov rcx, rbx
nop dword [rax]
call fcn.0045d400
nop
int3