joyce8/EMBER2024-capa huggingface dataset:
Function at 0x495840
Capabilities:
Access peb ldr_data

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [0x007491b0]
test rcx, rcx
jne 0x495864
xor ecx, ecx
xor edx, edx
jmp 0x495879
call fcn.004ad740
mov rcx, rbx
mov rdx, rax
mov rax, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rdx
mov qword [rsp + 0x20], r14
mov rsi, qword [r14 + 0x30]
inc dword [rsi + 0xd8]
mov qword [r14 + 0x10], 0xfffffffffffffade
mov byte [r14 + 0xb7], 1
call fcn.004957e0
mov rcx, qword [rsp + 0x68]
mov rax, qword [rsp + 0x20]
mov qword [rax + 0x70], rcx
mov rdx, qword [rsp + 0x60]
mov qword [rax + 0x78], rdx
mov ebx, 2
mov ecx, 3
call fcn.0048f0a0
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rcx + 0x70]
cmp qword [rcx], rdx
ja 0x4958e6
nop dword [rax + rax]
cmp qword [rcx + 8], rdx
jae 0x495922
movups xmmword [rsp + 0x40], xmm15
lea rax, [0x00495b40]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rcx
lea rax, [rsp + 0x40]
mov qword [rsp], rax
call fcn.004bbba0
xorps xmm15, xmm15
mov r14, qword [0x00749460]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rcx, qword [rsp + 0x20]
mov rax, qword [rsp + 0x10]
test rax, rax
je 0x49598b
movups xmmword [rsp + 0x28], xmm15
mov qword [rsp + 0x38], 0
lea rcx, [0x00495ac0]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x28]
mov qword [rsp], rax
nop
call fcn.004bbba0
xorps xmm15, xmm15
mov r14, qword [0x00749460]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
call fcn.004957e0
mov rcx, qword [rsp + 0x20]
mov al, byte [0x006c5898]
test al, al
je 0x4959cb
lea rax, [0x005bf5b0]
mov qword [rsp], rax
call fcn.004bbba0
xorps xmm15, xmm15
mov r14, qword [0x00749460]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
call fcn.004957e0
mov rcx, qword [rsp + 0x20]
mov rax, qword [rcx + 0x30]
mov rax, qword [rax + 0xa0]
test byte [rax], al
cmp dword [rax + 0x2298], 0
nop
je 0x495a18
lea rax, fcn.00490920
mov qword [rsp], rax
call fcn.004bbba0
xorps xmm15, xmm15
mov r14, qword [0x00749460]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
call fcn.004957e0
mov rcx, qword [rsp + 0x20]
mov rax, qword [rcx + 0x30]
mov rdx, qword [rax + 0xa0]
mov edx, dword [rdx + 0x14]
mov dword [rax + 0x388], edx
mov rax, qword [rcx + 0x30]
mov rax, qword [rax + 0xa0]
mov qword [rax + 0x38], 0
mov rdx, qword [rcx + 0x30]
mov rbx, rax
mov qword [rdx + 0xb0], rax
mov rax, qword [rcx + 0x30]
mov qword [rax + 0xa0], 0
mov eax, 2
xchg dword [rbx + 4], eax
mov al, byte [0x006c5888]
test al, al
je 0x495aa4
lea rax, [0x005bf5a8]
mov qword [rsp], rax
call fcn.004bbba0
xorps xmm15, xmm15
mov r14, qword [0x00749460]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
call fcn.004957e0
mov rcx, qword [rsp + 0x20]
mov rax, qword [rcx + 0x30]
dec dword [rax + 0xd8]
add rsp, 0x50
pop rbp
ret
Function at 0x49aa00
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49ab67
push rbp
mov rbp, rsp
sub rsp, 0x18
mov ecx, dword [rax + 0x190]
mov edx, dword [rax + 0x194]
mov rsi, qword [rax + 0x998]
mov edi, dword [rax + 0x194]
cmp edi, edx
jne 0x49aa12
cmp edx, ecx
jne 0x49ab55
nop word [rax + rax]
test rsi, rsi
jne 0x49ab55
mov qword [rsp + 0x28], rax
test rbx, rbx
jne 0x49aa74
nop
call fcn.004c0040
xorps xmm15, xmm15
mov r14, qword [0x00749460]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rbx, qword [rsp]
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x10], rbx
call fcn.0049a920
mov rcx, qword [rsp + 0x28]
mov edx, dword [rcx]
mov ebx, edx
sar edx, 0x1f
shr edx, 0x1b
add edx, ebx
mov esi, edx
and edx, 0xffffffe0
sub ebx, edx
test ebx, ebx
jl 0x49ab50
mov rdx, qword [0x006c44d8]
sar esi, 5
mov rax, rcx
mov ecx, ebx
mov edi, 1
shl edi, cl
movsxd rsi, esi
cmp ecx, 0x20
sbb r8d, r8d
and edi, r8d
cmp rdx, rsi
jbe 0x49ab45
mov rcx, qword [0x006c44d0]
lea rcx, [rcx + rsi*4]
lock or dword [rcx], edi
mov rcx, qword [0x006c57f0]
mov qword [rax + 8], rcx
mov rcx, rax
nop
mov qword [0x006c57f0], rax
nop
mov edx, 1
lea rsi, [0x006c57f8]
lock xadd dword [rsi], edx
mov rdx, qword [rcx + 0x1248]
shr rdx, 0x3d
test dl, dl
jne 0x49ab33
mov rax, qword [rsp + 0x10]
movabs rdx, 0x1fffffffffffffff
and rdx, rax
bts rdx, 0x3f
nop
nop
xchg qword [rcx + 0x1248], rdx
add rsp, 0x18
pop rbp
ret
lea rax, [0x005bc710]
mov ebx, 0x28
nop
call fcn.0048a720
mov rax, rsi
mov rcx, rdx
call fcn.004bdfc0
call fcn.00488fe0
lea rax, [0x005bb631]
mov ebx, 0x23
call fcn.0048a720
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004bbcc0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0049aa00
Function at 0x4a1320
Capabilities:
Access peb ldr_data

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rcx, r14
test rcx, rcx
je 0x4a1368
mov rcx, qword [rcx + 0x30]
mov rcx, qword [rcx + 0x90]
nop dword [rax + rax]
test rcx, rcx
je 0x4a1368
mov qword [rsp + 0x68], rcx
nop
mov rax, qword [rdi + 0x28]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x50], 0
jmp 0x4a1378
mov eax, 1
add rsp, 0x70
pop rbp
ret
mov rax, qword [rsp + 0x60]
mov rcx, qword [sym.imp.kernel32.dll_RtlLookupFunctionEntry]
lea rdx, [rsp + 0x58]
mov rbx, qword [rax + 0xf8]
mov qword [rsp], rcx
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], 0
call fcn.00487cc0
xorps xmm15, xmm15
mov r14, qword [0x00749460]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
nop
test rax, rax
je 0x4a1451
mov rcx, qword [rsp + 0x58]
mov rdx, qword [sym.imp.kernel32.dll_RtlVirtualUnwind]
mov rbx, qword [rsp + 0x60]
mov rsi, rbx
lea rdi, [rsp + 0x50]
mov r8, qword [rsi + 0xf8]
mov qword [rsp], rdx
mov qword [rsp + 8], 0
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x40], 0
call fcn.00487f40
xorps xmm15, xmm15
mov r14, qword [0x00749460]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x68]
cmp qword [rcx], rax
ja 0x4a1451
cmp qword [rcx + 8], rax
ja 0x4a1373
mov eax, 1
add rsp, 0x70
pop rbp
ret
Function at 0x4a9420
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
test rbx, rbx
jbe 0x4a9597
movzx edx, byte [rax]
test edx, edx
jne 0x4a9454
nop dword [rax]
test r8b, r8b
jne 0x4a9454
xor eax, eax
xor ebx, ebx
mov rcx, rbx
xor edi, edi
add rsp, 0x10
pop rbp
ret
bt edx, 7
jae 0x4a9467
xor edx, edx
xor r8d, r8d
xor r9d, r9d
jmp 0x4a9557
mov r8d, 1
mov r9d, edx
and edx, 1
neg edx
shr r9d, 1
xor edx, r9d
add dword [rsi], edx
nop dword [rax]
cmp rbx, r8
jb 0x4a9545
sub rbx, r8
sub rcx, r8
mov rdx, rcx
neg rdx
sar rdx, 0x3f
and r8, rdx
lea rdx, [rax + r8]
test rbx, rbx
jbe 0x4a9537
movzx esi, byte [rax + r8]
bt esi, 7
jae 0x4a94bd
xor eax, eax
xor esi, esi
xor r8d, r8d
jmp 0x4a9500
mov eax, 1
cmp rax, rbx
ja 0x4a94eb
add qword [rdi], rsi
sub rcx, rax
sub rbx, rax
mov rsi, rcx
neg rsi
sar rsi, 0x3f
and rax, rsi
add rax, rdx
mov edi, 1
add rsp, 0x10
pop rbp
ret
mov rcx, rbx
call fcn.004be080
lea r8d, [rcx + 7]
mov rcx, r11
mov eax, r12d
nop dword [rax]
cmp rax, rbx
jae 0x4a952f
movzx r9d, byte [rax + rdx]
mov r10d, r9d
and r9d, 0x7f
mov r11, rcx
mov ecx, r8d
shl r9d, cl
lea r12d, [rax + 1]
or esi, r9d
test r10b, 0x80
jne 0x4a94f3
mov rcx, r11
mov eax, r12d
jmp 0x4a94c2
mov rcx, rbx
call fcn.004bdfc0
xor eax, eax
mov rcx, rax
nop dword [rax]
call fcn.004bdfc0
mov eax, r8d
mov rcx, rbx
call fcn.004be080
lea r9d, [rcx + 7]
mov rcx, r12
cmp rbx, rdx
jbe 0x4a958d
movzx r10d, byte [rdx + rax]
mov r11d, r10d
and r10d, 0x7f
mov r12, rcx
mov ecx, r9d
shl r10d, cl
inc edx
or r8d, r10d
test r11b, 0x80
jne 0x4a9550
mov rcx, r12
mov r9d, edx
mov edx, r8d
mov r8d, r9d
jmp 0x4a946d
mov eax, edx
mov rcx, rbx
call fcn.004bdfc0
xor eax, eax
mov rcx, rax
nop dword [rax]
call fcn.004bdfc0
nop
int3

Function at 0x4af5a0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4af655
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], rdi
test byte [rax], al
lea rdx, [rax + 0x10]
mov rsi, qword [rsp + 0x68]
mov rcx, rdi
mov rax, rdx
mov rbx, rsi
call fcn.004ad220
nop
test bl, bl
je 0x4af64f
mov qword [rsp + 0x18], rax
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
lea rcx, [0x004af6a0]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x40], rcx
lea rcx, [rsp + 0x20]
mov qword [rsp], rcx
call fcn.004bbba0
xorps xmm15, xmm15
mov r14, qword [0x00749460]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x18]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.004bbcc0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.004af5a0
Function at 0x4b25c0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b266f
push rbp
mov rbp, rsp
sub rsp, 0x58
mov qword [rsp + 0x70], rbx
lea rdx, [rsp + 0x68]
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rsi, [0x004b26c0]
mov qword [rsp + 0x10], rsi
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdx
mov rdx, r14
mov qword [rsp + 0x28], rdx
lea rdx, [rsp + 8]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.004bbba0
xorps xmm15, xmm15
mov r14, qword [0x00749460]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
add rsp, 0x58
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.004bbcc0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp fcn.004b25c0
Function at 0x4bdac0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x455483
push rbp
mov rbp, rsp
sub rsp, 0x18
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
mov rax, rdx
call fcn.0045bbc0
add rsp, 0x18
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004bbcc0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x455460
cmp byte [0x007491eb], 0
je 0x4bdad5
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp 0x4bad00
jmp 0x455460

Function at 0x4bdae0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
nop
mov eax, dword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x007495c0]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d124b
mul rcx
xor rax, rdx
nop
nop
ret
cmp byte [0x007491eb], 0
je 0x4bdb15
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x00749940]
aesenc xmm0, xmmword [0x00749950]
aesenc xmm0, xmmword [0x00749960]
movq rax, xmm0
ret
jmp 0x45bde0

Function at 0x4bdb20
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
nop
mov rax, qword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x007495c0]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
xor rax, rdx
nop
nop
ret
cmp byte [0x007491eb], 0
je 0x4bdb56
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x00749940]
aesenc xmm0, xmmword [0x00749950]
aesenc xmm0, xmmword [0x00749960]
movq rax, xmm0
ret
jmp 0x45be40

Function at 0x4c0080
Capabilities:
Allocate thread local storage

Disassembly:
push rbp
mov rbp, rsp
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x4c00b4
mov rcx, 0x28
jmp 0x4c00bf
shl rcx, 3
add rcx, 0x1480
mov qword [0x00749460], rcx
pop rbp
ret
Function at 0x4f02c0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f03f6
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rax, qword [rsp + 0x58]
call fcn.004c2fc0
mov rcx, qword [rsp + 0x60]
mov qword [rsp], rcx
mov rdx, qword [rsp + 0x68]
mov qword [rsp + 8], rdx
mov byte [rsp + 0x10], 0
nop
call fcn.00454920
xorps xmm15, xmm15
mov r14, qword [0x00749460]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
nop dword [rax]
jne 0x4f03d6
mov rcx, qword [rsp + 0x68]
lea rdx, [rcx + 1]
mov qword [rsp + 0x30], rdx
lea rax, [0x0058a500]
xor ebx, ebx
mov rcx, rdx
call fcn.004a1ec0
mov rbx, qword [rsp + 0x68]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x30]
mov rax, qword [rsp + 0x60]
call fcn.004f2b40
mov qword [rsp + 0x28], rbx
lea rdx, [rbx + 1]
cmp rcx, rdx
jae 0x4f038d
mov rbx, rdx
mov edi, 1
lea rsi, [0x0058a500]
nop dword [rax + rax]
call fcn.004a1fa0
mov rdx, rbx
mov rbx, qword [rsp + 0x28]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], rcx
lea rsi, [rax + rbx*2]
mov rax, rsi
call fcn.004bf3a0
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x48]
mov word [rdx + rcx*2], 0
call fcn.004c3000
mov rax, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
xor edi, edi
xor esi, esi
add rsp, 0x50
pop rbp
ret
call fcn.004c3000
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x005e4738]
lea rsi, [0x005e3dd0]
add rsp, 0x50
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004bbcc0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004f02c0
Function at 0x52f700
Capabilities:
Hash data using fnv

Disassembly:
lea r12, [rsp - 0xa0]
cmp r12, qword [r14 + 0x10]
jbe 0x53057b
push rbp
mov rbp, rsp
sub rsp, 0x118
mov qword [rsp + 0x130], rbx
mov qword [rsp + 0x128], rax
mov rax, qword [rsp + 0x120]
call fcn.004c2fc0
mov rcx, qword [rsp + 0x128]
mov rax, qword [rsp + 0x130]
movabs rdx, 0xcbf29ce484222325
jmp 0x52f773
mov rsi, qword [rsp + 0x110]
add rsi, 0x10
mov rax, qword [rsp + 0xb8]
dec rax
mov rdx, rcx
mov rcx, rsi
mov qword [rsp + 0x68], rdx
nop dword [rax + rax]
test rax, rax
jle 0x52ff10
mov qword [rsp + 0xb8], rax
mov qword [rsp + 0x110], rcx
mov rax, rcx
lea rbx, [0x0058f4a0]
mov ecx, 1
call fcn.00458bc0
mov rax, qword [rsp + 0x110]
call fcn.004bf340
mov rdx, qword [rsp + 0x110]
mov rsi, qword [rdx]
test rsi, rsi
je 0x52ff48
mov qword [rsp + 0x18], rsi
mov ecx, dword [rsi + 0x10]
shr ecx, 1
mov rax, qword [rdx + 8]
mov qword [rsp + 0x100], rax
and ecx, 0x3f
lea rbx, [0x005e6ae0]
jmp qword [rbx + rcx*8]
call fcn.004c3000
mov rax, qword [rsp + 0x68]
add rsp, 0x118
pop rbp
ret
lea rax, [0x0058a400]
lea rbx, [0x005e4548]
call fcn.00489b60
lea rax, [rcx + 1]
mov rcx, qword [rsp + 0x20]
mov rbx, rsi
cmp rax, rcx
jge 0x52ffa8
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xa8], rbx
lea rcx, [rdx + rax*8]
mov rax, rcx
call fcn.004bf340
mov rcx, qword [rsp + 0xb0]
mov rdx, qword [rsp + 0xc0]
mov rbx, qword [rdx + rcx*8]
mov rsi, qword [rsp + 0xa8]
xor eax, eax
jmp 0x52ffd5
movabs rdx, 0x100000001b3
mov rcx, rbx
jmp 0x52f756
movzx edi, bl
xor rsi, rdi
inc rax
shr rbx, 8
movabs rdi, 0x100000001b3
imul rsi, rdi
cmp rax, 8
jl 0x52ffba
nop dword [rax + rax]
jmp 0x52ff5b
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.004bbcc0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
nop
jmp fcn.0052f700
Function at 0x5307c0
Capabilities:
Hash data using fnv

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5308d8
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rbx
mov rax, qword [rsp + 0x38]
call fcn.004c2fc0
mov rcx, qword [rsp + 0x40]
test byte [rcx], al
mov rbx, qword [rsp + 0x48]
mov rdx, rbx
and edx, 0x7f
shl rdx, 5
add rcx, rdx
mov qword [rsp + 0x28], rcx
xor eax, eax
jmp 0x530815
mov rax, qword [rsp + 0x10]
inc rax
mov rcx, qword [rsp + 0x28]
cmp rax, 4
jge 0x530846
mov qword [rsp + 0x10], rax
lea rdx, [rcx + rax*8]
mov rax, rdx
call fcn.004c3160
mov rbx, qword [rsp + 0x48]
cmp rax, rbx
jne 0x530808
call fcn.004c3000
mov eax, 1
add rsp, 0x30
pop rbp
ret
xor eax, eax
movabs rdx, 0xcbf29ce484222325
jmp 0x530863
lea rax, [rcx + 1]
mov rcx, rdx
mov rbx, qword [rsp + 0x48]
mov rdx, rsi
cmp rax, 4
jge 0x530897
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x18], rdx
lea rdx, [rcx + rax*8]
mov rax, rdx
call fcn.004bf340
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rdx + rcx*8]
nop
mov rsi, qword [rsp + 0x18]
xor eax, eax
jmp 0x5308cd
and edx, 3
lea rax, [rcx + rdx*8]
nop
call fcn.004c32a0
call fcn.004c3000
xor eax, eax
add rsp, 0x30
pop rbp
ret
movzx edi, bl
xor rsi, rdi
inc rax
shr rbx, 8
movabs rdi, 0x100000001b3
imul rsi, rdi
cmp rax, 8
jl 0x5308b2
jmp 0x530854
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004bbcc0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.005307c0
Function at 0x54c7c0
Capabilities:
Access peb ldr_data

Disassembly:
lea r12, [rsp - 8]
cmp r12, qword [r14 + 0x10]
jbe 0x54c9ab
push rbp
mov rbp, rsp
add rsp, 0xffffffffffffff80
mov rax, qword [rsp + 0x88]
nop
call fcn.004c2fc0
movups xmmword [rsp + 0x50], xmm15
mov qword [rsp + 0x30], 0
lea rax, [0x006bbbf0]
nop dword [rax + rax]
call fcn.004bf340
mov rax, qword [0x006bbbf0]
call fcn.00530d80
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x28], rbx
movups xmmword [rsp + 0x60], xmm15
mov qword [rsp + 0x70], 0
lea rax, [rsp + 0x60]
call fcn.004bf3a0
lea rcx, [0x0054c9c0]
mov qword [rsp + 0x60], rcx
lea rax, [rsp + 0x68]
call fcn.004bf3a0
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x68], rcx
lea rax, [rsp + 0x70]
call fcn.004bf3a0
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x70], rcx
mov rcx, qword [rsp + 0x48]
mov qword [rsp], rcx
mov rdx, qword [rsp + 0x28]
mov qword [rsp + 8], rdx
mov byte [rsp + 0x10], 0x2b
call fcn.00454920
xorps xmm15, xmm15
mov r14, qword [0x00749460]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rcx, qword [rsp + 0x18]
nop dword [rax]
cmp rcx, 0xffffffffffffffff
je 0x54c949
mov rdx, qword [rsp + 0x28]
cmp rdx, rcx
jb 0x54c9a5
mov qword [rsp + 0x20], rcx
mov rsi, qword [rsp + 0x60]
mov rax, qword [rsp + 0x48]
mov rbx, rcx
lea rdx, [rsp + 0x60]
call rsi
mov rax, qword [rsp + 0x20]
lea rcx, [rax + 1]
mov rbx, qword [rsp + 0x28]
nop
cmp rbx, rcx
jb 0x54c99a
mov rsi, qword [rsp + 0x60]
sub rbx, rax
dec rbx
mov rdi, rbx
neg rdi
sar rdi, 0x3f
and rcx, rdi
mov rdi, qword [rsp + 0x48]
lea rax, [rdi + rcx]
lea rdx, [rsp + 0x60]
call rsi
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x40], rcx
mov rsi, qword [rsp + 0x50]
mov qword [rsp + 0x78], rsi
mov rdi, qword [rsp + 0x58]
mov qword [rsp + 0x38], rdi
call fcn.004c3000
mov rax, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
sub rsp, 0xffffffffffffff80
pop rbp
ret
mov rcx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x28]
lea rdx, [rsp + 0x60]
call rcx
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x40], rcx
mov rsi, qword [rsp + 0x50]
mov qword [rsp + 0x78], rsi
mov rdi, qword [rsp + 0x58]
mov qword [rsp + 0x38], rdi
nop dword [rax]
call fcn.004c3000
mov rax, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
sub rsp, 0xffffffffffffff80
pop rbp
ret
mov rax, rcx
mov rcx, rbx
call fcn.004be080
call fcn.004be000
nop
call fcn.004bbcc0
jmp fcn.0054c7c0
Function at 0x14001121c
Capabilities:
Terminate process

Disassembly:
jmp 0x1400137b0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret

Function at 0x1400112a8
Capabilities:
Parse pe header

Disassembly:
jmp 0x140014b00
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140014b20
xor al, al
jmp 0x140014ba1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140014b33
xor al, al
jmp 0x140014ba1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140014b5d
xor al, al
jmp 0x140014ba1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140014b71
xor al, al
jmp 0x140014ba1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140014b83
xor al, al
jmp 0x140014ba1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140014b9f
xor al, al
jmp 0x140014ba1
mov al, 1
add rsp, 0x38
ret
Function at 0x14001136b
Capabilities:
Enumerate process modules

Disassembly:
jmp 0x140011820
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rbp
push rdi
sub rsp, 0x6e8
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x122
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x708]
mov rax, qword [section..data]
xor rax, rbp
mov qword [rbp + 0x6b8], rax
lea rcx, [0x1400230a4]
call fcn.1400113ac
nop
mov edx, dword [rbp + 0x6e0]
mov ecx, 8
call fcn.1400111b8
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0xffffffffffffffff
jne 0x14001188c
xor eax, eax
jmp 0x1400118e8
mov dword [rbp + 0x30], 0x438
lea rdx, [rbp + 0x30]
mov rcx, qword [rbp + 8]
call fcn.14001125d
test eax, eax
je 0x1400118db
mov rdx, qword [rbp + 0x6e8]
lea rcx, [rbp + 0x60]
call qword [sym.imp.ucrtbased.dll__stricmp]
test eax, eax
jne 0x1400118ca
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rax, qword [rbp + 0x48]
jmp 0x1400118e8
lea rdx, [rbp + 0x30]
mov rcx, qword [rbp + 8]
call fcn.14001109b
test eax, eax
jne 0x1400118a4
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x14001ac00]
call fcn.14001133e
mov rax, rdi
mov rcx, qword [rbp + 0x6b8]
xor rcx, rbp
call fcn.1400111d1
lea rsp, [rbp + 0x6c8]
pop rdi
pop rbp
ret