joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180005154
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov esi, ecx
xor edx, edx
xor ecx, ecx
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
mov edi, eax
je 0x1800051ec
mov rcx, qword [0x18000f5b0]
lea r8d, [rax + 0x1d]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
mov rbx, rax
je 0x1800051ec
mov rdx, rax
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x1800051d8
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r9, rbx
xor edx, edx
lea r8d, [rsi + rax]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
je 0x1800051d8
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathFindExtensionA]
lea rdx, [0x180011230]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x1800051ec
mov rcx, qword [0x18000f5b0]
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor ebx, ebx
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x180005200
Capabilities:
Create directory
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov edi, ecx
call fcn.180005154
test rax, rax
mov rbx, rax
je 0x1800052b1
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
test rax, rax
je 0x18000524a
lea rcx, [rbx + 4]
cmp rax, rcx
jbe 0x18000524a
cmp dword [rax - 5], 0x776f4c5c
jne 0x18000524a
lea rcx, [rax - 4]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathFindExtensionA]
xor edx, edx
mov rcx, rbx
mov byte [rax], 0
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x18000529d
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r9, rbx
xor edx, edx
xor eax, edi
mov rcx, rbx
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
je 0x18000529d
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathFindExtensionA]
lea rdx, [0x180011230]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x1800052b1
mov rcx, qword [0x18000f5b0]
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor ebx, ebx
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x180005358
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
lea rcx, [0x180011481]
xor r8d, r8d
xor edx, edx
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
mov edi, eax
je 0x1800053c1
mov rcx, qword [0x18000f5b0]
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
mov rbx, rax
je 0x1800053c1
lea rcx, [0x180011481]
mov r8d, edi
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
jne 0x1800053c1
mov rcx, qword [0x18000f5b0]
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor ebx, ebx
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x180005e74
Capabilities:
Delete internet cache
Enumerate internet cache

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x20
mov rbp, rcx
mov rcx, qword [0x18000f5b0]
xor edx, edx
mov r8d, 0x1000
xor edi, edi
mov dword [rax + 0x10], 0x1000
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
mov rbx, rax
je 0x180005f22
lea r8, [rsp + 0x38]
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.WININET.dll_FindFirstUrlCacheEntryA]
test rax, rax
mov rsi, rax
je 0x180005f10
mov edi, 1
mov rcx, qword [rbx + 8]
mov rdx, rbp
call qword [sym.imp.SHLWAPI.dll_StrStrIA]
test rax, rax
je 0x180005eea
mov rcx, qword [rbx + 8]
call qword [sym.imp.WININET.dll_DeleteUrlCacheEntry]
lea r8, [rsp + 0x38]
mov rdx, rbx
mov rcx, rsi
mov dword [rsp + 0x38], 0x1000
call qword [sym.imp.WININET.dll_FindNextUrlCacheEntryA]
test eax, eax
jne 0x180005ece
mov rcx, rsi
call qword [sym.imp.WININET.dll_FindCloseUrlCache]
mov rcx, qword [0x18000f5b0]
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov eax, edi
add rsp, 0x20
pop rdi
ret
Function at 0x180006420
Capabilities:
Connect to http server
Create http request

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x40
mov rbx, rcx
mov rcx, r8
mov r12, r9
mov rsi, r8
mov rbp, rdx
mov dword [rax + 0x30], 0xea60
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov rcx, qword [0x18000f5b0]
xor edx, edx
add eax, eax
mov dword [rsp + 0x60], eax
lea r8d, [rax + 1]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
mov rdi, rax
je 0x18000648a
lea r8, [rsp + 0x60]
xor r9d, r9d
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetCanonicalizeUrlA]
test eax, eax
cmovne rsi, rdi
mov rcx, qword [rsp + 0x80]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 0x10000000
call qword [sym.imp.WININET.dll_InternetOpenA]
test rax, rax
mov qword [rbx + 0x18], rax
je 0x1800065a7
lea rdx, [0x180006384]
mov rcx, rax
call qword [sym.imp.WININET.dll_InternetSetStatusCallback]
cmp rax, 0xffffffffffffffff
je 0x1800065a7
mov rcx, qword [rbx + 0x30]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rcx, qword [rbx + 0x18]
mov qword [rsp + 0x38], rbx
and dword [rsp + 0x30], 0
xor r9d, r9d
mov r8w, 0x50
mov rdx, rbp
mov dword [rsp + 0x28], 3
and qword [rsp + 0x20], 0
call qword [sym.imp.WININET.dll_InternetConnectA]
test rax, rax
mov qword [rbx + 0x20], rax
jne 0x180006532
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x1800065a7
mov rcx, qword [rbx + 0x30]
mov edx, 0xea60
call fcn.1800061fc
test eax, eax
jne 0x1800065a7
mov rcx, qword [rbx + 0x20]
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x30], 0x84404000
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rsi
mov rdx, r12
call qword [sym.imp.WININET.dll_HttpOpenRequestA]
test rax, rax
mov qword [rbx + 0x28], rax
je 0x1800065a7
mov esi, 4
lea r8, [rsp + 0x88]
mov rcx, rax
lea edx, [rsi + 2]
mov r9d, esi
call qword [sym.imp.WININET.dll_InternetSetOptionA]
test eax, eax
je 0x1800065a7
mov rcx, qword [rbx + 0x28]
lea r8, [rsp + 0x88]
lea edx, [rsi + 1]
mov r9d, esi
call qword [sym.imp.WININET.dll_InternetSetOptionA]
test eax, eax
je 0x1800065a7
xor ebx, ebx
jmp 0x1800065af
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test rdi, rdi
je 0x1800065c6
mov rcx, qword [0x18000f5b0]
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbp, qword [rsp + 0x70]
mov eax, ebx
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop r12
pop rdi
pop rsi
ret
Function at 0x1800067b8
Capabilities:
Check http status code
Read data from internet
Receive data

Disassembly:
mov rax, rsp
push rbx
push rsi
push rdi
sub rsp, 0xa0
and dword [rax + 8], 0
mov rdi, rcx
mov rcx, qword [rcx + 0x30]
mov edx, 0xea60
call fcn.1800061fc
test eax, eax
mov ebx, eax
jne 0x1800069de
mov ebx, dword [rdi + 0x40]
test ebx, ebx
jne 0x1800069d4
cmp qword [rdi], 0
jne 0x1800069d4
lea r8, [rsp + 0x38]
lea edx, [rax + 1]
xor ecx, ecx
lea ebx, [rax + 8]
call qword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
jne 0x1800069d4
mov rcx, qword [0x18000f5b0]
xor edx, edx
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
mov rsi, rax
je 0x1800069c9
mov rcx, qword [rdi + 0x30]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rcx, qword [rdi + 0x28]
lea r9, [rsp + 0xc0]
mov r8d, 0x1000
mov rdx, rsi
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x180006886
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
mov ebx, eax
jne 0x1800068a8
mov rcx, qword [rdi + 0x30]
or edx, 0xffffffff
call fcn.1800061fc
test eax, eax
mov ebx, eax
jne 0x1800068a8
mov ebx, dword [rdi + 0x40]
test ebx, ebx
jne 0x1800068a8
mov r8d, dword [rsp + 0xc0]
test r8d, r8d
je 0x1800068a6
mov rcx, qword [rsp + 0x38]
xor r9d, r9d
mov rdx, rsi
mov rax, qword [rcx]
call qword [rax + 0x20]
jmp 0x180006835
xor ebx, ebx
mov rcx, qword [0x18000f5b0]
mov r8, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
test ebx, ebx
jne 0x1800069c9
mov rcx, qword [rdi + 0x28]
and dword [rsp + 0xd0], ebx
and dword [rsp + 0xd8], ebx
lea rax, [rsp + 0xd8]
lea r9, [rsp + 0x30]
lea r8, [rsp + 0xd0]
mov edx, 0x20000013
mov dword [rsp + 0x30], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.WININET.dll_HttpQueryInfoA]
test eax, eax
je 0x1800069c4
cmp dword [rsp + 0xd0], 0xc8
jne 0x1800069c4
mov rcx, qword [rsp + 0x38]
lea r8d, [rbx + 1]
lea rdx, [rsp + 0x50]
mov rax, qword [rcx]
call qword [rax + 0x60]
mov r11d, dword [rsp + 0x60]
test r11d, r11d
mov dword [rsp + 0xc0], r11d
je 0x1800069bd
mov rcx, qword [rsp + 0x38]
and dword [rsp + 0x40], ebx
and dword [rsp + 0x44], ebx
mov rax, qword [rcx]
mov rdx, qword [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
call qword [rax + 0x28]
movsxd r8, dword [rsp + 0xc0]
mov rcx, qword [0x18000f5b0]
add r8, 1
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
mov rsi, rax
je 0x1800069b6
mov rcx, qword [rsp + 0x38]
mov r8d, dword [rsp + 0xc0]
xor r9d, r9d
mov r10, qword [rcx]
mov rdx, rax
call qword [r10 + 0x18]
movsxd r11, dword [rsp + 0xc0]
mov byte [r11 + rsi], bl
mov eax, dword [rsp + 0xc0]
mov qword [rdi], rsi
mov dword [rdi + 0x44], eax
jmp 0x1800069c9
mov ebx, 8
jmp 0x1800069c9
mov ebx, 0x10d2
jmp 0x1800069c9
mov ebx, 0xe8
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rdi + 0x30]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, ebx
add rsp, 0xa0
pop rdi
pop rsi
pop rbx
ret

Function at 0x18000702d
Capabilities:
Execute syscall

Disassembly:
mov r10, rdx
mov rax, rcx
syscall
ret
Function at 0x413dc0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x413f4b
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [0x00bfb1f8]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00431340
xorps xmm15, xmm15
mov r14, qword [0x00c5e668]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x413e25
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x413e34
add rsp, 0x48
pop rbp
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x413e53
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x413e63
cmp rbx, 0x1000
jae 0x413e2b
jmp 0x413ecd
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x413e75
xor edx, edx
jmp 0x413ec4
mov rcx, qword [0x00bfb1f8]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00431340
xorps xmm15, xmm15
mov r14, qword [0x00c5e668]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x413e59
jmp 0x413e48
call fcn.004606e0
xorps xmm15, xmm15
mov r14, qword [0x00c5e668]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.004356a0
lea rax, [0x00499d3d]
mov ebx, 0x18
nop dword [rax]
call fcn.00435f20
mov rax, qword [rsp + 0x38]
call fcn.00435c60
lea rax, [0x0049a1cd]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.00435f20
mov rax, qword [rsp + 0x30]
call fcn.00435c60
call fcn.004358e0
call fcn.00435700
lea rax, [0x0049c312]
mov ebx, 0x21
call fcn.00433d00
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045d040
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00413dc0
Function at 0x413f80
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4141a6
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [0x00bfb200]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.004313c0
xorps xmm15, xmm15
mov r14, qword [0x00c5e668]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x413ff3
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x414002
add rsp, 0x50
pop rbp
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x414025
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x414035
cmp rbx, 0x1000
jae 0x413ff9
nop
jmp 0x4140b8
add rsp, 0x50
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop word [rax + rax]
cmp rbx, 0x1000
jae 0x41404d
xor esi, esi
jmp 0x4140aa
mov rax, qword [0x00bfb200]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.004313c0
xorps xmm15, xmm15
mov r14, qword [0x00c5e668]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x41402b
jmp 0x414016
call fcn.004606e0
xorps xmm15, xmm15
mov r14, qword [0x00c5e668]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x414140
nop dword [rax + rax]
call fcn.004356a0
lea rax, [0x0049a1e6]
mov ebx, 0x19
call fcn.00435f20
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
call fcn.00435c60
lea rax, [0x0049a1cd]
mov ebx, 0x19
call fcn.00435f20
mov eax, dword [rsp + 0x34]
call fcn.00435c60
nop
call fcn.004358e0
call fcn.00435700
lea rax, [0x00496e62]
mov ebx, 0xd
call fcn.00433d00
nop dword [rax + rax]
cmp eax, 0x5af
je 0x4140e0
call fcn.004356a0
lea rax, [0x0049a1e6]
mov ebx, 0x19
call fcn.00435f20
mov rax, qword [rsp + 0x38]
call fcn.00435c60
lea rax, [0x0049a1cd]
mov ebx, 0x19
call fcn.00435f20
mov eax, dword [rsp + 0x34]
nop dword [rax]
call fcn.00435c60
call fcn.004358e0
call fcn.00435700
lea rax, [0x0049bc98]
mov ebx, 0x1f
nop dword [rax + rax]
call fcn.00433d00
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045d040
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.00413f80
Function at 0x41d620
Capabilities:
Hash data using murmur3

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
cmp byte [0x00c5e430], 0
jne 0x41d707
sub rbx, qword [rax + 0x18]
mov rdx, qword [rax + 0x50]
test byte [rdx], al
mov esi, dword [rax + 0x64]
imul rbx, rsi
mov rsi, rbx
shr rbx, 0x20
shr rsi, 0x23
and ebx, 7
mov rdi, rcx
mov rcx, rbx
mov r8d, 1
shl r8d, cl
add rdx, rsi
nop
nop
nop
nop
lock or byte [rdx], r8b
mov rcx, qword [rax + 0x18]
movabs rdx, 0x800000000000
lea rax, [rdx + rcx]
mov rdx, rax
shr rdx, 0x2a
nop
nop
nop
cmp rdx, 0x40
jae 0x41d6fa
lea rbx, [0x00c30818]
mov rdx, qword [rbx + rdx*8]
test byte [rdx], al
mov rbx, rcx
shr rbx, 0x10
and ebx, 0x3f
shr rcx, 0xd
and ecx, 7
mov esi, 1
shl esi, cl
shr rax, 0x16
and eax, 0xfffff
mov rax, qword [rdx + rax*8]
test byte [rax], al
movzx edx, byte [rax + rbx + 0x11440]
lea rax, [rax + rbx]
lea rax, [rax + 0x11440]
test sil, dl
jne 0x41d6e0
lock or byte [rax], sil
mov rax, qword [r14 + 0x30]
mov rax, qword [rax + 0xa0]
test byte [rax], al
add qword [rax + 0x1250], rdi
add rsp, 0x10
pop rbp
ret
mov rax, rdx
mov ecx, 0x40
call fcn.0045f2c0
lea rax, [0x0049dca6]
mov ebx, 0x2c
call fcn.00433d00
nop
int3

Function at 0x41f9e0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41fae6
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x70], rcx
mov byte [rsp + 0x17], dil
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x18], 0
jmp 0x41fa23
mov rax, qword [rsp + 0x60]
mov rcx, rdx
mov rbx, qword [rsp + 0x68]
movzx edi, byte [rsp + 0x17]
cmp qword [rsp + 0x18], rbx
jae 0x41fadb
test byte [rax], al
lea rcx, [rax + 0x100b8]
mov ebx, edi
mov rax, rcx
nop dword [rax]
call fcn.004207c0
test rax, rax
je 0x41fadb
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x30], xmm15
movups xmmword [rsp + 0x40], xmm15
lea rcx, [0x0041fb20]
mov qword [rsp + 0x20], rcx
lea rdx, [rsp + 0x18]
mov qword [rsp + 0x28], rdx
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x48], rax
lea rbx, [rsp + 0x20]
mov qword [rsp], rbx
nop dword [rax]
call fcn.0045cf00
xorps xmm15, xmm15
mov r14, qword [0x00c5e668]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x70]
nop dword [rax]
test rdx, rdx
jne 0x41fac9
xor eax, eax
jmp 0x41fad3
mov rax, qword [rdx]
call rax
mov rdx, qword [rsp + 0x70]
test al, al
je 0x41fa11
mov rax, qword [rsp + 0x18]
add rsp, 0x50
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov byte [rsp + 0x20], dil
call fcn.0045d040
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movzx edi, byte [rsp + 0x20]
jmp fcn.0041f9e0
Function at 0x42daa0
Capabilities:
Hash data using murmur3

Disassembly:
cmp rsp, qword [r14 + 0x18]
jbe 0x42dd26
push rbp
mov rbp, rsp
sub rsp, 0x38
test byte [rax], al
mov rcx, qword [rax + 0x1268]
lea rsi, [rax + 0x1278]
sub rcx, rsi
shr rcx, 3
cmp rcx, 0x200
ja 0x42dd1a
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x30], rcx
mov qword [rax + 0x1268], 0
cmp byte [0x00c5e430], 0
jne 0x42dafa
xor edx, edx
xor ebx, ebx
jmp 0x42db40
xor edx, edx
jmp 0x42db25
mov qword [rsp + 0x28], rdx
mov rcx, qword [rax + rdx*8 + 0x1278]
mov rax, rcx
call fcn.0041ce80
mov rdx, qword [rsp + 0x28]
inc rdx
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
cmp rdx, rcx
jl 0x42dafe
add rax, 0x1268
call fcn.0042da20
add rsp, 0x38
pop rbp
ret
inc rdx
nop
cmp rdx, rcx
jge 0x42dcb4
mov rsi, qword [rax + rdx*8 + 0x1278]
cmp rsi, 0x1000
jb 0x42db3b
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rbx
mov rax, rsi
xor ebx, ebx
mov rcx, rbx
call fcn.004110e0
test rax, rax
jne 0x42db8c
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
jmp 0x42db3b
mov rsi, qword [rbx + 0x50]
test byte [rsi], al
mov r8, rcx
shr r8, 3
movzx r9d, byte [rsi + r8]
and ecx, 7
mov r10d, 1
shl r10d, cl
nop
add rsi, r8
test r10b, r9b
je 0x42dbcc
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
jmp 0x42db3b
nop
lock or byte [rsi], r10b
mov rcx, qword [rbx + 0x18]
movabs rsi, 0x800000000000
lea r8, [rsi + rcx]
mov r9, r8
shr r8, 0x2a
nop
nop
nop
cmp r8, 0x40
jae 0x42dd0d
lea r10, [0x00c30818]
mov r8, qword [r10 + r8*8]
test byte [r8], al
mov r10, rcx
shr r10, 0x10
and r10d, 0x3f
shr rcx, 0xd
and ecx, 7
mov r11d, 1
shl r11d, cl
shr r9, 0x16
and r9d, 0xfffff
mov r8, qword [r8 + r9*8]
test byte [r8], al
movzx r9d, byte [r8 + r10 + 0x11440]
lea r8, [r8 + r10]
lea r8, [r8 + 0x11440]
test r11b, r9b
jne 0x42dc4f
lock or byte [r8], r11b
movzx r8d, byte [rbx + 0x6a]
test r8b, 1
je 0x42dc85
mov rax, qword [rsp + 0x48]
mov r8, qword [rax + 0x1250]
add r8, qword [rbx + 0x70]
mov qword [rax + 0x1250], r8
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
jmp 0x42db3b
mov r8, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
cmp r8, rcx
jae 0x42dd05
mov rbx, qword [rsp + 0x48]
mov qword [rbx + r8*8 + 0x1278], rax
inc r8
mov rax, rbx
mov rdx, qword [rsp + 0x28]
mov rbx, r8
jmp 0x42db3b
cmp rbx, 0x200
ja 0x42dcf4
lea rdx, [rax + 0x1278]
lea rsi, [rax + 0x1240]
mov rcx, rbx
mov edi, 0x200
mov rbx, rdx
mov rax, rsi
call fcn.004236a0
mov rax, qword [rsp + 0x48]
add rax, 0x1268
call fcn.0042da20
add rsp, 0x38
pop rbp
ret
mov rcx, rbx
mov edx, 0x200
nop dword [rax]
call fcn.0045f320
mov rax, r8
call fcn.0045f2a0
mov rax, r8
mov ecx, 0x40
call fcn.0045f2c0
mov edx, 0x200
nop
call fcn.0045f300
nop
mov qword [rsp + 8], rax
call fcn.00463b60
mov rax, qword [rsp + 8]
jmp fcn.0042daa0
Function at 0x4424c0
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x442627
push rbp
mov rbp, rsp
sub rsp, 0x18
mov ecx, dword [rax + 0x190]
mov edx, dword [rax + 0x194]
mov rsi, qword [rax + 0x998]
mov edi, dword [rax + 0x194]
cmp edi, edx
jne 0x4424d2
cmp edx, ecx
jne 0x442615
nop word [rax + rax]
test rsi, rsi
jne 0x442615
mov qword [rsp + 0x28], rax
test rbx, rbx
jne 0x442534
nop
call fcn.00460b00
xorps xmm15, xmm15
mov r14, qword [0x00c5e668]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rbx, qword [rsp]
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x10], rbx
call fcn.004423e0
mov rcx, qword [rsp + 0x28]
mov edx, dword [rcx]
mov ebx, edx
sar edx, 0x1f
shr edx, 0x1b
add edx, ebx
mov esi, edx
and edx, 0xffffffe0
sub ebx, edx
test ebx, ebx
jl 0x442610
mov rdx, qword [0x00c0b448]
sar esi, 5
mov rax, rcx
mov ecx, ebx
mov edi, 1
shl edi, cl
movsxd rsi, esi
cmp ecx, 0x20
sbb r8d, r8d
and edi, r8d
cmp rdx, rsi
jbe 0x442605
mov rcx, qword [0x00c0b440]
lea rcx, [rcx + rsi*4]
lock or dword [rcx], edi
mov rcx, qword [0x00c0c0b0]
mov qword [rax + 8], rcx
mov rcx, rax
nop
mov qword [0x00c0c0b0], rax
nop
mov edx, 1
lea rsi, [0x00c0c0b8]
lock xadd dword [rsi], edx
mov rdx, qword [rcx + 0x1228]
shr rdx, 0x3d
test dl, dl
jne 0x4425f3
mov rax, qword [rsp + 0x10]
movabs rdx, 0x1fffffffffffffff
and rdx, rax
bts rdx, 0x3f
nop
nop
xchg qword [rcx + 0x1228], rdx
add rsp, 0x18
pop rbp
ret
lea rax, [0x0049d565]
mov ebx, 0x28
nop
call fcn.00433d00
mov rax, rsi
mov rcx, rdx
call fcn.0045f2a0
call fcn.00432440
lea rax, [0x0049c9a8]
mov ebx, 0x23
call fcn.00433d00
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045d040
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004424c0
Function at 0x44d400
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
test rbx, rbx
jbe 0x44d577
movzx edx, byte [rax]
test edx, edx
jne 0x44d434
nop dword [rax]
test r8b, r8b
jne 0x44d434
xor eax, eax
xor ebx, ebx
mov rcx, rbx
xor edi, edi
add rsp, 0x10
pop rbp
ret
bt edx, 7
jae 0x44d447
xor edx, edx
xor r8d, r8d
xor r9d, r9d
jmp 0x44d537
mov r8d, 1
mov r9d, edx
and edx, 1
neg edx
shr r9d, 1
xor edx, r9d
add dword [rsi], edx
nop dword [rax]
cmp rbx, r8
jb 0x44d525
sub rbx, r8
sub rcx, r8
mov rdx, rcx
neg rdx
sar rdx, 0x3f
and r8, rdx
lea rdx, [rax + r8]
test rbx, rbx
jbe 0x44d517
movzx esi, byte [rax + r8]
bt esi, 7
jae 0x44d49d
xor eax, eax
xor esi, esi
xor r8d, r8d
jmp 0x44d4e0
mov eax, 1
cmp rax, rbx
ja 0x44d4cb
add qword [rdi], rsi
sub rcx, rax
sub rbx, rax
mov rsi, rcx
neg rsi
sar rsi, 0x3f
and rax, rsi
add rax, rdx
mov edi, 1
add rsp, 0x10
pop rbp
ret
mov rcx, rbx
call fcn.0045f360
lea r8d, [rcx + 7]
mov rcx, r11
mov eax, r12d
nop dword [rax]
cmp rax, rbx
jae 0x44d50f
movzx r9d, byte [rax + rdx]
mov r10d, r9d
and r9d, 0x7f
mov r11, rcx
mov ecx, r8d
shl r9d, cl
lea r12d, [rax + 1]
or esi, r9d
test r10b, 0x80
jne 0x44d4d3
mov rcx, r11
mov eax, r12d
jmp 0x44d4a2
mov rcx, rbx
call fcn.0045f2a0
xor eax, eax
mov rcx, rax
nop dword [rax]
call fcn.0045f2a0
mov eax, r8d
mov rcx, rbx
call fcn.0045f360
lea r9d, [rcx + 7]
mov rcx, r12
cmp rbx, rdx
jbe 0x44d56d
movzx r10d, byte [rdx + rax]
mov r11d, r10d
and r10d, 0x7f
mov r12, rcx
mov ecx, r9d
shl r10d, cl
inc edx
or r8d, r10d
test r11b, 0x80
jne 0x44d530
mov rcx, r12
mov r9d, edx
mov edx, r8d
mov r8d, r9d
jmp 0x44d44d
mov eax, edx
mov rcx, rbx
call fcn.0045f2a0
xor eax, eax
mov rcx, rax
nop dword [rax]
call fcn.0045f2a0
nop
int3