joyce8/EMBER2024-capa huggingface dataset:
Function at 0x399967659
Capabilities:
Authenticate hmac

Disassembly:
push rsi
push rbx
sub rsp, 0x48
mov qword [rsp + 0x60], rcx
push r9
rol r9b, 0x17
psraw mm0, 0x69
sar r9w, 0xf
emms
emms
push r12
orps xmm7, xmm8
movups xmm2, xmm3
nop
rcl r9w, 8
push rdx
subps xmm15, xmm6
punpcklbw mm4, mm3
shl r9d, 2
push rcx
xorps xmm11, xmm15
addss xmm13, xmm12
push r13
nop
pop r13
nop
psrld mm6, 0x2e
pop rcx
emms
not r9w
emms
pop rdx
nop
pmaxsw mm6, mm5
psrad mm1, 0x22
rcpps xmm15, xmm6
pop r12
psrlw mm7, 0x58
nop
psllq mm7, 0x6a
psrlq mm7, 0x2d
nop
pop r9
mov qword [rsp + 0x28], rdx
push rdx
pcmpgtw mm5, mm3
dec edx
pandn mm3, mm7
emms
inc rdx
inc edx
shl dx, 0x10
inc rdx
sbb dl, 1
nop
emms
emms
pop rdx
mov ecx, 2
mov edx, 8
call sub.msvcrt.dll_calloc
mov rcx, rax
xor eax, eax
push r14
dec r14
inc r14d
nop
psadbw mm3, mm5
push r9
shr r9d, 0xd
movaps xmm8, xmm1
por mm1, mm6
emms
pop r9
nop
paddsb mm6, mm4
neg r14d
mov r14, 5
pop r14
xor qword [rcx + rax*8], 0x36
push r15
mov r15, 1
push r8
push r11
pop r11
pop r8
dec r15
jne 0x399967742
pop r15
test rax, rax
jne 0x39996775d
mov eax, 1
jmp 0x399967707
call sub.msvcrt.dll_free
push rcx
emms
push r13
rcpss xmm4, xmm2
pop r13
punpcklbw mm6, mm2
pop rcx
mov r9d, 0x8000
lea r8, [rsp + 0x28]
lea rdx, [rsp + 0x60]
or rcx, 0xffffffffffffffff
call fcn.39996c159
mov word [rsp + 0x3e], 0
mov esi, eax
movabs rax, 0x7c0052007d0033
mov qword [rsp + 0x36], rax
push r13
mov r13, 3
push r8
pop r8
dec r13
jne 0x3999677ab
pop r13
lea rbx, [rsp + 0x36]
mov rcx, rbx
call sub.msvcrt.dll_wcslen
cmp rax, 5
jne 0x3999677e1
push r8
mov r8, 1
push r11
push rdx
pop rdx
pop r11
dec r8
jne 0x3999677d2
pop r8
jmp 0x39996784a
mov rdx, rbx
lea rax, [rsp + 0x3e]
cmp rbx, r8
jne 0x3999677ff
push r9
psrlq mm6, 0x51
pop r9
jmp 0x399967802
push rax
nop
pop rax
push r10
psraw mm2, 0x53
pop r10
xor word [rdx], 0x42
push rcx
emms
sar rcx, 8
emms
push r8
emms
punpckhwd mm7, mm3
nop
push rdx
ror ecx, 0x11
psrlq mm2, 0x5c
and r8, rcx
pop rdx
psrlw mm0, 0x16
not cl
pslld mm4, 0x27
pop r8
nop
rcr rcx, 4
psllq mm6, 0x27
pop rcx
add rdx, 2
cmp rdx, rax
jne 0x3999677e9
push rbx
inc rbx
push r13
psrad mm0, 0x42
push r15
mov r15b, bl
push rcx
sar bl, 6
pop rcx
nop
pop r15
not bl
pop r13
psrad mm1, 0x34
pop rbx
test esi, esi
jne 0x3999678b2
push r11
movlhps xmm2, xmm9
emms
rcr r11d, 4
pmulhuw mm0, mm2
rol r11, 9
push rax
rcpps xmm9, xmm10
not ax
pslld mm7, 0x20
neg eax
sar ax, 1
pop rax
emms
psrld mm0, 0x47
emms
not r11b
emms
shl r11b, 0xf
pop r11
call fcn.399978042
mov eax, 1
jmp 0x3999678f8
cmp bl, dl
jne 0x3999678cf
push r12
movaps xmm4, xmm5
push r15
movhlps xmm15, xmm10
psraw mm5, 0x59
pop r15
sub r12, 0x13
pop r12
jmp 0x3999678e3
push r8
shr r8d, 0xd
push r13
inc r8d
emms
pop r13
inc r8
pop r8
push r14
addss xmm11, xmm7
push rcx
emms
dec r14
pop rcx
paddb mm6, mm5
pop r14
xor eax, eax
add rsp, 0x48
pop rbx
pop rsi
ret
Function at 0x399978e20
Capabilities:
Encode data using xor

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x30
mov rsi, rcx
mov rdi, rdx
push rdx
packuswb mm1, mm2
nop
psraw mm2, 0x51
pcmpgtw mm1, mm3
psrlq mm7, 2
shl dl, 4
por mm3, mm6
paddsb mm6, mm1
mov dx, 0xb
pslld mm5, 0x40
emms
emms
pop rdx
mov qword [rcx + 8], rdx
test rdx, rdx
je 0x3999790c1
movabs rax, 0x4c0030005a0029
mov word [rsp + 0x2e], 0
mov qword [rsp + 0x26], rax
push r8
psadbw mm0, mm4
push rdx
dec edx
xadd r8d, edx
push rax
emms
andnps xmm6, xmm12
not r8
push r10
cmp r10b, r8b
pslld mm3, 0x21
sar r8, 2
dec r8d
push r11
xchg edx, r8d
nop
punpcklbw mm0, mm3
punpckldq mm4, mm5
rol r8d, 5
pop r11
mov r8d, 0x15
pcmpeqb mm0, mm1
maxss xmm7, xmm6
mov ax, 4
pop r10
sbb r8, rax
nop
emms
pop rax
emms
psraw mm5, 0x62
pop rdx
nop
pop r8
mov dword [rsp + 0x20], 0x30005d
mov word [rsp + 0x24], 0
push r9
emms
nop
push r11
pcmpeqd mm0, mm5
pop r11
pxor mm1, mm4
emms
pop r9
lea rbx, [rsp + 0x20]
lea rcx, [rsp + 0x26]
mov rdx, rbx
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x399978f15
push r10
emms
pop r10
jmp 0x399978f99
mov rax, rbx
lea rdx, [rsp + 0x24]
push rax
not al
emms
nop
push r11
shr r11w, 0x14
inc r11
xor eax, r11d
push r15
movss xmm4, xmm8
mov rax, r15
push r14
psrld mm7, 9
pmaxsw mm0, mm2
pop r14
psrlw mm0, 0x55
nop
cmp r11, rax
pop r15
emms
shl r11, 2
pop r11
emms
emms
pop rax
xor word [rax], 0x84
push r8
nop
dec r8
inc r8d
push r9
psrad mm5, 0x32
rcr r9b, 0x17
push rcx
inc r8d
pop rcx
addps xmm7, xmm14
not r9b
pop r9
psrlq mm2, 0x69
psllq mm1, 0x3e
rcl r8b, 0xe
pop r8
add rax, 2
cmp rax, rdx
jne 0x399978f1d
cmp bx, r9w
jne 0x399978fc0
push r9
andnps xmm11, xmm0
push r14
emms
nop
pop r14
punpckhwd mm7, mm3
pop r9
jmp 0x399978fd2
push r12
pminsw mm3, mm0
push r11
nop
addss xmm8, xmm10
pop r11
nop
pop r12
push r15
ror r15d, 0x11
push r10
nop
sub r15b, r10b
pop r10
mulps xmm5, xmm1
pop r15
mov rcx, rdi
call fcn.39996be5e
push rdx
comiss xmm13, xmm8
push r12
emms
shl r12, 8
push rbx
nop
rcl r12b, 0xd
punpcklbw mm5, mm3
pop rbx
add r12w, dx
movss xmm7, xmm3
pop r12
emms
pop rdx
push rcx
paddsw mm2, mm5
push rax
maxps xmm9, xmm14
push r14
psrad mm5, 0x5c
push r11
psrad mm6, 0x4a
push r15
nop
pop r15
movss xmm12, xmm8
pop r11
emms
pop r14
mulps xmm7, xmm15
pop rax
emms
pop rcx
mov edx, 0xfffc
add eax, eax
cmp eax, edx
cmova eax, edx
mov word [rsi], ax
push r13
psllq mm0, 0x32
push rbx
nop
neg r13b
push r12
emms
psrld mm3, 0x35
emms
push r8
psllq mm3, 0x6a
pcmpgtb mm4, mm3
neg r8
nop
pop r8
sar r12w, 2
rcr r12, 4
not r13
pop r12
not r13w
packuswb mm2, mm6
pop rbx
mov r13, 4
pop r13
mov eax, dword [rsi]
add eax, 2
mov word [rsi + 2], ax
push r11
movlhps xmm10, xmm15
push r13
neg r13b
paddd mm7, mm4
push r15
dec r11
pmullw mm6, mm0
nop
pop r15
adc r13, r11
emms
pop r13
psrad mm0, 0x3e
pop r11
jmp 0x3999790c5
xor eax, eax
mov dword [rcx], eax
push rbx
nop
nop
pslld mm4, 0x32
push r15
emms
emms
neg rbx
push r8
inc r15d
psrad mm5, 0x69
push r12
pcmpgtb mm5, mm3
mov r15b, 0xf
pop r12
nop
emms
psrlq mm1, 0x61
pop r8
nop
nop
pop r15
sub bl, 0xf
nop
pop rbx
add rsp, 0x30
pop rbx
pop rsi
pop rdi
ret
Function at 0x416780
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41690b
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call sym.runtime.stdcall3.abi0
xorps xmm15, xmm15
mov r14, qword [0x007d38d8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x4167e5
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x4167f4
add rsp, 0x48
pop rbp
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x416813
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x416823
cmp rbx, 0x1000
jae 0x4167eb
jmp 0x41688d
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x416835
xor edx, edx
jmp 0x416884
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call sym.runtime.stdcall3.abi0
xorps xmm15, xmm15
mov r14, qword [0x007d38d8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x416819
jmp 0x416808
call sym.runtime.getlasterror.abi0
xorps xmm15, xmm15
mov r14, qword [0x007d38d8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call sym.runtime.printlock
lea rax, [0x005deb6b]
mov ebx, 0x18
nop dword [rax]
call sym.runtime.printstring
mov rax, qword [rsp + 0x38]
call sym.runtime.printuint
lea rax, [0x005df25f]
mov ebx, 0x19
nop dword [rax + rax]
call sym.runtime.printstring
mov rax, qword [rsp + 0x30]
call sym.runtime.printuint
call sym.runtime.printnl
call sym.runtime.printunlock
lea rax, [0x005e2337]
mov ebx, 0x21
call sym.runtime.throw
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp sym.runtime.sysUnusedOS
Function at 0x416940
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x416b66
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call sym.runtime.stdcall4.abi0
xorps xmm15, xmm15
mov r14, qword [0x007d38d8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x4169b3
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x4169c2
add rsp, 0x50
pop rbp
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x4169e5
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x4169f5
cmp rbx, 0x1000
jae 0x4169b9
nop
jmp 0x416a78
add rsp, 0x50
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop word [rax + rax]
cmp rbx, 0x1000
jae 0x416a0d
xor esi, esi
jmp 0x416a6a
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call sym.runtime.stdcall4.abi0
xorps xmm15, xmm15
mov r14, qword [0x007d38d8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x4169eb
jmp 0x4169d6
call sym.runtime.getlasterror.abi0
xorps xmm15, xmm15
mov r14, qword [0x007d38d8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x416b00
nop dword [rax + rax]
call sym.runtime.printlock
lea rax, [0x005df278]
mov ebx, 0x19
call sym.runtime.printstring
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
call sym.runtime.printuint
lea rax, [0x005df25f]
mov ebx, 0x19
call sym.runtime.printstring
mov eax, dword [rsp + 0x34]
call sym.runtime.printuint
nop
call sym.runtime.printnl
call sym.runtime.printunlock
lea rax, [0x005da17a]
mov ebx, 0xd
call sym.runtime.throw
nop dword [rax + rax]
cmp eax, 0x5af
je 0x416aa0
call sym.runtime.printlock
lea rax, [0x005df278]
mov ebx, 0x19
call sym.runtime.printstring
mov rax, qword [rsp + 0x38]
call sym.runtime.printuint
lea rax, [0x005df25f]
mov ebx, 0x19
call sym.runtime.printstring
mov eax, dword [rsp + 0x34]
nop dword [rax]
call sym.runtime.printuint
call sym.runtime.printnl
call sym.runtime.printunlock
lea rax, [0x005e1862]
mov ebx, 0x1f
nop dword [rax + rax]
call sym.runtime.throw
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp sym.runtime.sysUsedOS
Function at 0x41ffe0
Capabilities:
Hash data using murmur3

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
cmp byte [0x007d3653], 0
jne 0x4200c7
sub rbx, qword [rax + 0x18]
mov rdx, qword [rax + 0x50]
test byte [rdx], al
mov esi, dword [rax + 0x64]
imul rbx, rsi
mov rsi, rbx
shr rbx, 0x20
shr rsi, 0x23
and ebx, 7
mov rdi, rcx
mov rcx, rbx
mov r8d, 1
shl r8d, cl
add rdx, rsi
nop
nop
nop
nop
lock or byte [rdx], r8b
mov rcx, qword [rax + 0x18]
movabs rdx, 0x800000000000
lea rax, [rdx + rcx]
mov rdx, rax
shr rdx, 0x2a
nop
nop
nop
cmp rdx, 0x40
jae 0x4200ba
lea rbx, [0x007a5a38]
mov rdx, qword [rbx + rdx*8]
test byte [rdx], al
mov rbx, rcx
shr rbx, 0x10
and ebx, 0x3f
shr rcx, 0xd
and ecx, 7
mov esi, 1
shl esi, cl
shr rax, 0x16
and eax, 0xfffff
mov rax, qword [rdx + rax*8]
test byte [rax], al
movzx edx, byte [rax + rbx + 0x11440]
lea rax, [rax + rbx]
lea rax, [rax + 0x11440]
test sil, dl
jne 0x4200a0
lock or byte [rax], sil
mov rax, qword [r14 + 0x30]
mov rax, qword [rax + 0xa0]
test byte [rax], al
add qword [rax + 0x1250], rdi
add rsp, 0x10
pop rbp
ret
mov rax, rdx
mov ecx, 0x40
call sym.runtime.panicIndexU
lea rax, [0x005e4ea1]
mov ebx, 0x2c
call sym.runtime.throw
nop
int3

Function at 0x4223a0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4224a6
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x70], rcx
mov byte [rsp + 0x17], dil
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x18], 0
jmp 0x4223e3
mov rax, qword [rsp + 0x60]
mov rcx, rdx
mov rbx, qword [rsp + 0x68]
movzx edi, byte [rsp + 0x17]
cmp qword [rsp + 0x18], rbx
jae 0x42249b
test byte [rax], al
lea rcx, [rax + 0x100b8]
mov ebx, edi
mov rax, rcx
nop dword [rax]
call sym.runtime._scavengeIndex_.find
test rax, rax
je 0x42249b
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x30], xmm15
movups xmmword [rsp + 0x40], xmm15
lea rcx, [sym.runtime._pageAlloc_.scavenge.func1]
mov qword [rsp + 0x20], rcx
lea rdx, [rsp + 0x18]
mov qword [rsp + 0x28], rdx
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x48], rax
lea rbx, [rsp + 0x20]
mov qword [rsp], rbx
nop dword [rax]
call sym.runtime.systemstack.abi0
xorps xmm15, xmm15
mov r14, qword [0x007d38d8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x70]
nop dword [rax]
test rdx, rdx
jne 0x422489
xor eax, eax
jmp 0x422493
mov rax, qword [rdx]
call rax
mov rdx, qword [rsp + 0x70]
test al, al
je 0x4223d1
mov rax, qword [rsp + 0x18]
add rsp, 0x50
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov byte [rsp + 0x20], dil
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movzx edi, byte [rsp + 0x20]
jmp sym.runtime._pageAlloc_.scavenge
Function at 0x42ec60
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x42ed70
push rbp
mov rbp, rsp
sub rsp, 0x58
mov qword [rsp + 0x68], rax
mov byte [rsp + 0x80], dil
nop
test dil, dil
je 0x42ecb5
mov qword [rsp + 0x78], rcx
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rbx
mov eax, 6
call sym.runtime.stopTheWorld
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
movzx edi, byte [rsp + 0x80]
mov qword [rsp + 8], 0
nop
test rbx, rbx
jne 0x42eccd
test dil, dil
jmp 0x42ed5b
lea rdx, [rsp + 0x68]
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rsi, [sym.runtime.Stack.func1]
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x28], rcx
mov rax, r14
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rdx
mov byte [rsp + 0x48], dil
lea rax, [rsp + 8]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call sym.runtime.systemstack.abi0
xorps xmm15, xmm15
mov r14, qword [0x007d38d8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
movzx eax, byte [rsp + 0x80]
test al, al
je 0x42ed65
nop dword [rax]
call sym.runtime.startTheWorld
mov rax, qword [rsp + 8]
add rsp, 0x58
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov byte [rsp + 0x20], dil
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movzx edi, byte [rsp + 0x20]
nop dword [rax]
jmp sym.runtime.Stack
Function at 0x430700
Capabilities:
Hash data using murmur3

Disassembly:
cmp rsp, qword [r14 + 0x18]
jbe 0x430986
push rbp
mov rbp, rsp
sub rsp, 0x38
test byte [rax], al
mov rcx, qword [rax + 0x1268]
lea rsi, [rax + 0x1278]
sub rcx, rsi
shr rcx, 3
cmp rcx, 0x200
ja 0x43097a
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x30], rcx
mov qword [rax + 0x1268], 0
cmp byte [0x007d3653], 0
jne 0x43075a
xor edx, edx
xor ebx, ebx
jmp 0x4307a0
xor edx, edx
jmp 0x430785
mov qword [rsp + 0x28], rdx
mov rcx, qword [rax + rdx*8 + 0x1278]
mov rax, rcx
call sym.runtime.shade
mov rdx, qword [rsp + 0x28]
inc rdx
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
cmp rdx, rcx
jl 0x43075e
add rax, 0x1268
call sym.runtime._wbBuf_.reset
add rsp, 0x38
pop rbp
ret
inc rdx
nop
cmp rdx, rcx
jge 0x430914
mov rsi, qword [rax + rdx*8 + 0x1278]
cmp rsi, 0x1000
jb 0x43079b
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rbx
mov rax, rsi
xor ebx, ebx
mov rcx, rbx
call sym.runtime.findObject
test rax, rax
jne 0x4307ec
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
jmp 0x43079b
mov rsi, qword [rbx + 0x50]
test byte [rsi], al
mov r8, rcx
shr r8, 3
movzx r9d, byte [rsi + r8]
and ecx, 7
mov r10d, 1
shl r10d, cl
nop
add rsi, r8
test r10b, r9b
je 0x43082c
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
jmp 0x43079b
nop
lock or byte [rsi], r10b
mov rcx, qword [rbx + 0x18]
movabs rsi, 0x800000000000
lea r8, [rsi + rcx]
mov r9, r8
shr r8, 0x2a
nop
nop
nop
cmp r8, 0x40
jae 0x43096d
lea r10, [0x007a5a38]
mov r8, qword [r10 + r8*8]
test byte [r8], al
mov r10, rcx
shr r10, 0x10
and r10d, 0x3f
shr rcx, 0xd
and ecx, 7
mov r11d, 1
shl r11d, cl
shr r9, 0x16
and r9d, 0xfffff
mov r8, qword [r8 + r9*8]
test byte [r8], al
movzx r9d, byte [r8 + r10 + 0x11440]
lea r8, [r8 + r10]
lea r8, [r8 + 0x11440]
test r11b, r9b
jne 0x4308af
lock or byte [r8], r11b
movzx r8d, byte [rbx + 0x6a]
test r8b, 1
je 0x4308e5
mov rax, qword [rsp + 0x48]
mov r8, qword [rax + 0x1250]
add r8, qword [rbx + 0x70]
mov qword [rax + 0x1250], r8
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
jmp 0x43079b
mov r8, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
cmp r8, rcx
jae 0x430965
mov rbx, qword [rsp + 0x48]
mov qword [rbx + r8*8 + 0x1278], rax
inc r8
mov rax, rbx
mov rdx, qword [rsp + 0x28]
mov rbx, r8
jmp 0x43079b
cmp rbx, 0x200
ja 0x430954
lea rdx, [rax + 0x1278]
lea rsi, [rax + 0x1240]
mov rcx, rbx
mov edi, 0x200
mov rbx, rdx
mov rax, rsi
call sym.runtime._gcWork_.putBatch
mov rax, qword [rsp + 0x48]
add rax, 0x1268
call sym.runtime._wbBuf_.reset
add rsp, 0x38
pop rbp
ret
mov rcx, rbx
mov edx, 0x200
nop dword [rax]
call sym.runtime.panicSliceAcap
mov rax, r8
call sym.runtime.panicIndex
mov rax, r8
mov ecx, 0x40
call sym.runtime.panicIndexU
mov edx, 0x200
nop
call sym.runtime.panicSliceAlenU
nop
mov qword [rsp + 8], rax
call sym.runtime.morestackc.abi0
mov rax, qword [rsp + 8]
jmp sym.runtime.wbBufFlush1
Function at 0x445c20
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x445d87
push rbp
mov rbp, rsp
sub rsp, 0x18
mov ecx, dword [rax + 0x190]
mov edx, dword [rax + 0x194]
mov rsi, qword [rax + 0x998]
mov edi, dword [rax + 0x194]
cmp edi, edx
jne 0x445c32
cmp edx, ecx
jne 0x445d75
nop word [rax + rax]
test rsi, rsi
jne 0x445d75
mov qword [rsp + 0x28], rax
test rbx, rbx
jne 0x445c94
nop
call sym.runtime.nanotime1.abi0
xorps xmm15, xmm15
mov r14, qword [0x007d38d8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rbx, qword [rsp]
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x10], rbx
call sym.runtime.updateTimerPMask
mov rcx, qword [rsp + 0x28]
mov edx, dword [rcx]
mov ebx, edx
sar edx, 0x1f
shr edx, 0x1b
add edx, ebx
mov esi, edx
and edx, 0xffffffe0
sub ebx, edx
test ebx, ebx
jl 0x445d70
mov rdx, qword [0x0077f388]
sar esi, 5
mov rax, rcx
mov ecx, ebx
mov edi, 1
shl edi, cl
movsxd rsi, esi
cmp ecx, 0x20
sbb r8d, r8d
and edi, r8d
cmp rdx, rsi
jbe 0x445d65
mov rcx, qword [0x0077f380]
lea rcx, [rcx + rsi*4]
lock or dword [rcx], edi
mov rcx, qword [0x007808b0]
mov qword [rax + 8], rcx
mov rcx, rax
nop
mov qword [0x007808b0], rax
nop
mov edx, 1
lea rsi, [0x007808b8]
lock xadd dword [rsi], edx
mov rdx, qword [rcx + 0x1228]
shr rdx, 0x3d
test dl, dl
jne 0x445d53
mov rax, qword [rsp + 0x10]
movabs rdx, 0x1fffffffffffffff
and rdx, rax
bts rdx, 0x3f
nop
nop
xchg qword [rcx + 0x1228], rdx
add rsp, 0x18
pop rbp
ret
lea rax, [0x005e41f6]
mov ebx, 0x28
nop
call sym.runtime.throw
mov rax, rsi
mov rcx, rdx
call sym.runtime.panicIndex
call sym.runtime.panicshift
lea rax, [0x005e2de9]
mov ebx, 0x23
call sym.runtime.throw
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp sym.runtime.pidleput
Function at 0x452d60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
test rbx, rbx
jbe 0x452ed7
movzx edx, byte [rax]
test edx, edx
jne 0x452d94
nop dword [rax]
test r8b, r8b
jne 0x452d94
xor eax, eax
xor ebx, ebx
mov rcx, rbx
xor edi, edi
add rsp, 0x10
pop rbp
ret
bt edx, 7
jae 0x452da7
xor edx, edx
xor r8d, r8d
xor r9d, r9d
jmp 0x452e97
mov r8d, 1
mov r9d, edx
and edx, 1
neg edx
shr r9d, 1
xor edx, r9d
add dword [rsi], edx
nop dword [rax]
cmp rbx, r8
jb 0x452e85
sub rbx, r8
sub rcx, r8
mov rdx, rcx
neg rdx
sar rdx, 0x3f
and r8, rdx
lea rdx, [rax + r8]
test rbx, rbx
jbe 0x452e77
movzx esi, byte [rax + r8]
bt esi, 7
jae 0x452dfd
xor eax, eax
xor esi, esi
xor r8d, r8d
jmp 0x452e40
mov eax, 1
cmp rax, rbx
ja 0x452e2b
add qword [rdi], rsi
sub rcx, rax
sub rbx, rax
mov rsi, rcx
neg rsi
sar rsi, 0x3f
and rax, rsi
add rax, rdx
mov edi, 1
add rsp, 0x10
pop rbp
ret
mov rcx, rbx
call sym.runtime.panicSliceB
lea r8d, [rcx + 7]
mov rcx, r11
mov eax, r12d
nop dword [rax]
cmp rax, rbx
jae 0x452e6f
movzx r9d, byte [rax + rdx]
mov r10d, r9d
and r9d, 0x7f
mov r11, rcx
mov ecx, r8d
shl r9d, cl
lea r12d, [rax + 1]
or esi, r9d
test r10b, 0x80
jne 0x452e33
mov rcx, r11
mov eax, r12d
jmp 0x452e02
mov rcx, rbx
call sym.runtime.panicIndex
xor eax, eax
mov rcx, rax
nop dword [rax]
call sym.runtime.panicIndex
mov eax, r8d
mov rcx, rbx
call sym.runtime.panicSliceB
lea r9d, [rcx + 7]
mov rcx, r12
cmp rbx, rdx
jbe 0x452ecd
movzx r10d, byte [rdx + rax]
mov r11d, r10d
and r10d, 0x7f
mov r12, rcx
mov ecx, r9d
shl r10d, cl
inc edx
or r8d, r10d
test r11b, 0x80
jne 0x452e90
mov rcx, r12
mov r9d, edx
mov edx, r8d
mov r8d, r9d
jmp 0x452dad
mov eax, edx
mov rcx, rbx
call sym.runtime.panicIndex
xor eax, eax
mov rcx, rax
nop dword [rax]
call sym.runtime.panicIndex
nop
int3