joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7feeff48464
Capabilities:
Terminate process

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rbx, rdx
mov rdi, rcx
call fcn.7feeff31066
mov r14, rax
mov rsi, qword [rdi]
test rbx, rbx
je 0x7feeff4848b
mov rcx, rbx
call fcn.7feeff42188
mov qword [rdi], rbx
mov rcx, rsi
call fcn.7feeff3d96b
test al, al
je 0x7feeff484a8
mov rcx, rsi
call fcn.7feeff3d9bc
cmp byte [r14], 0
je 0x7feeff484b2
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
mov edx, 8
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.7feeff31c2a

Function at 0x7feeff48743
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call fcn.7feeff331b4
test al, al
je 0x7feeff48762
mov edx, 8
xor ecx, ecx
add rsp, 0x28
jmp fcn.7feeff31c2a
nop
add rsp, 0x28
ret

Function at 0x7feeff488d0
Capabilities:
Terminate process

Disassembly:
test rcx, rcx
jne fcn.7feeff311e0
ret
Function at 0x7feeff4967b
Capabilities:
Terminate process

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x50
mov rdi, rcx
call fcn.7feeff31066
mov rsi, rax
movups xmm0, xmmword [rdi + 0x20]
lea rcx, [rsp + 0x30]
movaps xmmword [rcx], xmm0
call fcn.7feeff4985d
test al, al
je 0x7feeff496b7
cmp byte [rsi], 0
jne 0x7feeff497f4
jmp 0x7feeff4983b
mov qword [rsp + 0x28], 0
mov rcx, qword [rdi + 0x28]
call qword [rdi + 0x20]
mov r12b, 1
cmp byte [rsi], 0
jne 0x7feeff497da
mov rbx, rax
mov qword [rsp + 0x28], rax
test rax, rax
je 0x7feeff49783
lea rbp, [rdi + 0x20]
lea r14, [rsp + 0x28]
lea r15, [rsp + 0x30]
mov cl, byte [rbx + 0x20]
call fcn.7feeff43162
test al, al
je 0x7feeff49746
mov rcx, qword [rdi + 0x28]
call qword [rdi + 0x20]
cmp byte [rsi], 0
jne 0x7feeff497da
mov rcx, r14
mov rdx, rax
call fcn.7feeff41ae5
cmp byte [rsi], 0
jne 0x7feeff497da
movups xmm0, xmmword [rbp]
movaps xmmword [rsp + 0x30], xmm0
mov rcx, r15
call fcn.7feeff4985d
mov rbx, qword [rsp + 0x28]
test al, al
jne 0x7feeff49741
test rbx, rbx
jne 0x7feeff496f2
test rbx, rbx
je 0x7feeff49783
lea r14, [rsp + 0x30]
mov edx, 0x10
mov rcx, r14
call fcn.7feeff318bc
lea rax, [fcn.7feeff4967b]
mov qword [r14], rax
mov qword [r14 + 8], rdi
mov rax, qword [r14]
mov rcx, qword [r14 + 8]
lea rdx, [rsp + 0x40]
mov qword [rdx], rax
mov qword [rdx + 8], rcx
mov rcx, rbx
call fcn.7feeff43f67
jmp 0x7feeff497d7
mov rax, qword [rdi + 0x18]
mov cl, byte [rax + 0x20]
call fcn.7feeff43162
test al, al
je 0x7feeff49798
xor r12d, r12d
jmp 0x7feeff497da
mov ecx, 0x40
mov edx, 8
call fcn.7feeff3fbf8
lea rcx, [0x7feeffe4f48]
mov qword [rax], rcx
lea rdx, str.AssertionDefect
mov qword [rax + 0x10], rdx
movups xmm0, xmmword [0x7feeffceb50]
movups xmmword [rax + 0x18], xmm0
mov qword [rax + 8], 0
mov rcx, rax
call fcn.7feeff3fc31
mov r12b, byte [rsi]
mov byte [rsi], 0
mov rcx, qword [rsp + 0x28]
call fcn.7feeff41b10
cmp byte [rsi], 0
jne 0x7feeff497f4
mov byte [rsi], r12b
test r12b, r12b
je 0x7feeff4983b
mov byte [rsi], 0
mov rax, qword [rdi + 0x18]
mov cl, byte [rax + 0x20]
call fcn.7feeff43162
test al, al
je 0x7feeff4981a
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
jmp fcn.7feeff4986a
call fcn.7feeff45705
mov rbx, rax
mov rcx, qword [rdi + 0x18]
mov rdx, rax
call fcn.7feeff431e9
mov rcx, rbx
call fcn.7feeff3fab9
cmp byte [rsi], 0
je 0x7feeff4984a
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
jmp fcn.7feeff45730
Function at 0x7feeff49899
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, rcx
call fcn.7feeff31066
mov ecx, 0x40
mov edx, 8
call fcn.7feeff3fbf8
mov rdi, rax
lea rax, [0x7feeffd9390]
mov qword [rdi], rax
lea rbx, str.ReraiseDefect
mov qword [rdi + 0x10], rbx
movups xmm0, xmmword [rsi]
movaps xmmword [rsp + 0x20], xmm0
mov rcx, rsi
call fcn.7feeff3fc2a
movaps xmm0, xmmword [rsp + 0x20]
movups xmmword [rdi + 0x18], xmm0
mov rcx, rdi
mov rdx, rbx
call fcn.7feeff3fc31
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x7feeff4990e
test byte [rcx + 7], 0x40
jne 0x7feeff4990e
add rsp, 0x30
pop rbx
pop rdi
pop rsi
jmp fcn.7feeff311e0
nop
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
Function at 0x7feeff4a730
Capabilities:
Terminate process

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x50
mov rdi, rcx
call fcn.7feeff31066
mov rsi, rax
movups xmm0, xmmword [rdi + 0x38]
lea rcx, [rsp + 0x30]
movaps xmmword [rcx], xmm0
call fcn.7feeff4985d
test al, al
je 0x7feeff4a76c
cmp byte [rsi], 0
jne 0x7feeff4a8a9
jmp 0x7feeff4a8f0
mov qword [rsp + 0x28], 0
mov rcx, qword [rdi + 0x40]
call qword [rdi + 0x38]
mov r12b, 1
cmp byte [rsi], 0
jne 0x7feeff4a88f
mov rbx, rax
mov qword [rsp + 0x28], rax
test rax, rax
je 0x7feeff4a838
lea rbp, [rdi + 0x38]
lea r14, [rsp + 0x28]
lea r15, [rsp + 0x30]
mov cl, byte [rbx + 0x20]
call fcn.7feeff43162
test al, al
je 0x7feeff4a7fb
mov rcx, qword [rdi + 0x40]
call qword [rdi + 0x38]
cmp byte [rsi], 0
jne 0x7feeff4a88f
mov rcx, r14
mov rdx, rax
call fcn.7feeff41ae5
cmp byte [rsi], 0
jne 0x7feeff4a88f
movups xmm0, xmmword [rbp]
movaps xmmword [rsp + 0x30], xmm0
mov rcx, r15
call fcn.7feeff4985d
mov rbx, qword [rsp + 0x28]
test al, al
jne 0x7feeff4a7f6
test rbx, rbx
jne 0x7feeff4a7a7
test rbx, rbx
je 0x7feeff4a838
lea r14, [rsp + 0x30]
mov edx, 0x10
mov rcx, r14
call fcn.7feeff318bc
lea rax, [fcn.7feeff4a730]
mov qword [r14], rax
mov qword [r14 + 8], rdi
mov rax, qword [r14]
mov rcx, qword [r14 + 8]
lea rdx, [rsp + 0x40]
mov qword [rdx], rax
mov qword [rdx + 8], rcx
mov rcx, rbx
call fcn.7feeff43f67
jmp 0x7feeff4a88c
mov rax, qword [rdi + 0x30]
mov cl, byte [rax + 0x20]
call fcn.7feeff43162
test al, al
je 0x7feeff4a84d
xor r12d, r12d
jmp 0x7feeff4a88f
mov ecx, 0x40
mov edx, 8
call fcn.7feeff3fbf8
lea rcx, [0x7feeffe4f48]
mov qword [rax], rcx
lea rdx, str.AssertionDefect
mov qword [rax + 0x10], rdx
movups xmm0, xmmword [0x7feeffceb90]
movups xmmword [rax + 0x18], xmm0
mov qword [rax + 8], 0
mov rcx, rax
call fcn.7feeff3fc31
mov r12b, byte [rsi]
mov byte [rsi], 0
mov rcx, qword [rsp + 0x28]
call fcn.7feeff41b10
cmp byte [rsi], 0
jne 0x7feeff4a8a9
mov byte [rsi], r12b
test r12b, r12b
je 0x7feeff4a8f0
mov byte [rsi], 0
mov rax, qword [rdi + 0x30]
mov cl, byte [rax + 0x20]
call fcn.7feeff43162
test al, al
je 0x7feeff4a8cf
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
jmp fcn.7feeff4986a
call fcn.7feeff45705
mov rbx, rax
mov rcx, qword [rdi + 0x30]
mov rdx, rax
call fcn.7feeff431e9
mov rcx, rbx
call fcn.7feeff3fab9
cmp byte [rsi], 0
je 0x7feeff4a8ff
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
jmp fcn.7feeff45730
Function at 0x7feeff4afdc
Capabilities:
Terminate process

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x50
mov rdi, rcx
call fcn.7feeff31066
mov rsi, rax
movups xmm0, xmmword [rdi + 0x30]
lea rcx, [rsp + 0x30]
movaps xmmword [rcx], xmm0
call fcn.7feeff4985d
test al, al
je 0x7feeff4b018
cmp byte [rsi], 0
jne 0x7feeff4b155
jmp 0x7feeff4b19c
mov qword [rsp + 0x28], 0
mov rcx, qword [rdi + 0x38]
call qword [rdi + 0x30]
mov r12b, 1
cmp byte [rsi], 0
jne 0x7feeff4b13b
mov rbx, rax
mov qword [rsp + 0x28], rax
test rax, rax
je 0x7feeff4b0e4
lea rbp, [rdi + 0x30]
lea r14, [rsp + 0x28]
lea r15, [rsp + 0x30]
mov cl, byte [rbx + 0x20]
call fcn.7feeff43162
test al, al
je 0x7feeff4b0a7
mov rcx, qword [rdi + 0x38]
call qword [rdi + 0x30]
cmp byte [rsi], 0
jne 0x7feeff4b13b
mov rcx, r14
mov rdx, rax
call fcn.7feeff41ae5
cmp byte [rsi], 0
jne 0x7feeff4b13b
movups xmm0, xmmword [rbp]
movaps xmmword [rsp + 0x30], xmm0
mov rcx, r15
call fcn.7feeff4985d
mov rbx, qword [rsp + 0x28]
test al, al
jne 0x7feeff4b0a2
test rbx, rbx
jne 0x7feeff4b053
test rbx, rbx
je 0x7feeff4b0e4
lea r14, [rsp + 0x30]
mov edx, 0x10
mov rcx, r14
call fcn.7feeff318bc
lea rax, [fcn.7feeff4afdc]
mov qword [r14], rax
mov qword [r14 + 8], rdi
mov rax, qword [r14]
mov rcx, qword [r14 + 8]
lea rdx, [rsp + 0x40]
mov qword [rdx], rax
mov qword [rdx + 8], rcx
mov rcx, rbx
call fcn.7feeff43f67
jmp 0x7feeff4b138
mov rax, qword [rdi + 0x28]
mov cl, byte [rax + 0x20]
call fcn.7feeff43162
test al, al
je 0x7feeff4b0f9
xor r12d, r12d
jmp 0x7feeff4b13b
mov ecx, 0x40
mov edx, 8
call fcn.7feeff3fbf8
lea rcx, [0x7feeffe4f48]
mov qword [rax], rcx
lea rdx, str.AssertionDefect
mov qword [rax + 0x10], rdx
movups xmm0, xmmword [0x7feeffceb90]
movups xmmword [rax + 0x18], xmm0
mov qword [rax + 8], 0
mov rcx, rax
call fcn.7feeff3fc31
mov r12b, byte [rsi]
mov byte [rsi], 0
mov rcx, qword [rsp + 0x28]
call fcn.7feeff41b10
cmp byte [rsi], 0
jne 0x7feeff4b155
mov byte [rsi], r12b
test r12b, r12b
je 0x7feeff4b19c
mov byte [rsi], 0
mov rax, qword [rdi + 0x28]
mov cl, byte [rax + 0x20]
call fcn.7feeff43162
test al, al
je 0x7feeff4b17b
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
jmp fcn.7feeff4986a
call fcn.7feeff45705
mov rbx, rax
mov rcx, qword [rdi + 0x28]
mov rdx, rax
call fcn.7feeff431e9
mov rcx, rbx
call fcn.7feeff3fab9
cmp byte [rsi], 0
je 0x7feeff4b1ab
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
jmp fcn.7feeff45730

Function at 0x7feeff4b520
Capabilities:
Terminate process

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov rcx, qword [rcx + 8]
test rcx, rcx
je 0x7feeff4b53c
test byte [rcx + 7], 0x40
jne 0x7feeff4b53c
call fcn.7feeff311e0
mov rcx, qword [rsi + 0x10]
call fcn.7feeff331b4
test al, al
je 0x7feeff4b55c
mov rcx, qword [rsi + 0x10]
mov edx, 8
add rsp, 0x20
pop rsi
jmp fcn.7feeff31c2a
nop
add rsp, 0x20
pop rsi
ret
Function at 0x7feeff4bfcb
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov rbp, r8
mov rbx, rdx
mov rsi, rcx
lea rax, [r8*4]
movabs rdi, 0x5555555555555556
imul rdi
mov rax, rdx
shr rax, 0x3f
add rdx, rax
add rdx, 6
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
call fcn.7feeff43826
mov rax, rbp
imul rdi
mov rax, rdx
shr rax, 0x3f
add rax, rdx
lea rcx, [rax + rax*2]
mov qword [rsp + 0x30], rbp
sub rbp, rcx
mov rax, rcx
mov qword [rsp + 0x28], rcx
test rcx, rcx
mov qword [rsp + 0x38], rbp
je 0x7feeff4c0fe
sub qword [rsp + 0x30], rbp
xor edi, edi
xor ebp, ebp
mov qword [rsp + 0x40], rbx
movzx r13d, byte [rbx + rbp]
mov r14d, r13d
shl r14d, 0x10
movzx r12d, byte [rbx + rbp + 1]
shl r12d, 8
or r14d, r12d
movzx r15d, byte [rbx + rbp + 2]
or r12d, r15d
add rbp, 3
mov rcx, rsi
call fcn.7feeff4175a
shr r13, 2
lea rbx, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
mov al, byte [r13 + rbx]
mov rcx, qword [rsi + 8]
mov byte [rcx + rdi + 8], al
mov rcx, rsi
call fcn.7feeff4175a
shr r14d, 0xc
and r14d, 0x3f
mov al, byte [r14 + rbx]
mov rcx, qword [rsi + 8]
mov byte [rcx + rdi + 9], al
mov rcx, rsi
call fcn.7feeff4175a
shr r12d, 6
and r12d, 0x3f
mov al, byte [r12 + rbx]
mov rcx, qword [rsi + 8]
mov byte [rcx + rdi + 0xa], al
mov rcx, rsi
call fcn.7feeff4175a
and r15d, 0x3f
mov al, byte [r15 + rbx]
mov rbx, qword [rsp + 0x40]
mov rcx, qword [rsi + 8]
mov byte [rcx + rdi + 0xb], al
add rdi, 4
cmp qword [rsp + 0x30], rbp
jne 0x7feeff4c052
jmp 0x7feeff4c100
xor edi, edi
mov rax, qword [rsp + 0x38]
cmp rax, 2
je 0x7feeff4c16d
cmp rax, 1
jne 0x7feeff4c205
mov rax, qword [rsp + 0x28]
movzx ebx, byte [rbx + rax]
mov ebp, ebx
shl ebp, 4
mov rcx, rsi
call fcn.7feeff4175a
shr rbx, 2
lea r14, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
mov al, byte [rbx + r14]
mov rcx, qword [rsi + 8]
mov byte [rcx + rdi + 8], al
mov rbx, rdi
or rbx, 1
mov rcx, rsi
call fcn.7feeff4175a
and ebp, 0x30
mov al, byte [rbp + r14]
mov rcx, qword [rsi + 8]
mov byte [rcx + rbx + 8], al
mov rcx, rsi
call fcn.7feeff4175a
mov al, 0x3d
jmp 0x7feeff4c1da
mov rcx, qword [rsp + 0x28]
movzx ebp, byte [rbx + rcx]
mov eax, ebp
shl eax, 0x10
movzx r14d, byte [rbx + rcx + 1]
mov ebx, r14d
shl ebx, 8
or ebx, eax
mov rcx, rsi
call fcn.7feeff4175a
shr rbp, 2
lea r15, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
mov al, byte [rbp + r15]
mov rcx, qword [rsi + 8]
mov byte [rcx + rdi + 8], al
mov rbp, rdi
or rbp, 1
mov rcx, rsi
call fcn.7feeff4175a
shr ebx, 0xc
and ebx, 0x3f
mov al, byte [rbx + r15]
mov rcx, qword [rsi + 8]
mov byte [rcx + rbp + 8], al
mov rcx, rsi
call fcn.7feeff4175a
and r14d, 0xf
mov al, byte [r15 + r14*4]
mov rcx, rdi
or rcx, 2
mov rdx, qword [rsi + 8]
mov byte [rdx + rcx + 8], al
mov rbx, rdi
or rbx, 3
mov rcx, rsi
call fcn.7feeff4175a
mov rax, qword [rsi + 8]
mov byte [rax + rbx + 8], 0x3d
add rdi, 4
mov rcx, rsi
mov rdx, rdi
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp fcn.7feeff43826
Function at 0x7feeff4c85e
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
call fcn.7feeff31066
mov rdi, rax
mov rcx, qword [rsi + 0x18]
test rcx, rcx
je 0x7feeff4c883
test byte [rcx + 7], 0x40
jne 0x7feeff4c883
call fcn.7feeff311e0
mov rcx, qword [rsi + 0x20]
call fcn.7feeff34303
test al, al
je 0x7feeff4c89e
mov rcx, qword [rsi + 0x20]
call fcn.7feeff34340
cmp byte [rdi], 0
je 0x7feeff4c8a5
add rsp, 0x28
pop rdi
pop rsi
ret
mov rcx, qword [rsi + 0x20]
mov edx, 8
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.7feeff31c2a

Function at 0x7feeff4cc77
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x7feeff4ccc7
mov rax, qword [rcx]
mov edx, eax
not edx
lea r8d, [rdx + rdx*2]
mov edx, 0xfffffffe
sub edx, eax
lea esi, [r8 + rax*2]
inc esi
xor esi, edx
movabs rdx, 0x52acc8d350b7a309
add rdx, rsi
movabs rsi, 0x12acc8d350b7a309
xor rsi, rdx
test rax, rsi
jne 0x7feeff4ccc7
call fcn.7feeff311e0
mov rcx, qword [rdi + 0x20]
test rcx, rcx
je 0x7feeff4cce1
test byte [rcx + 7], 0x40
jne 0x7feeff4cce1
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.7feeff311e0
nop
add rsp, 0x28
pop rdi
pop rsi
ret

Function at 0x7feeff4d026
Capabilities:
Terminate process

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x20
mov r13, rcx
mov r12d, 0xffffffff
cmp qword [rcx], 0
jle 0x7feeff4d0f5
xor ebx, ebx
movabs r14, 0xc000000000000000
movabs r15, 0x41b606d8241fcc6f
xor edi, edi
mov rax, qword [r13 + 8]
mov rcx, qword [rax + rbx + 0x18]
test rcx, rcx
je 0x7feeff4d09b
mov rsi, qword [rcx]
mov edx, esi
xor edx, r12d
lea r8d, [rdx + rdx*2]
lea r9d, [rsi + rsi]
lea edx, [rsi + r8]
inc edx
xor edx, r9d
not edx
shl rdx, 0x3e
test rsi, rdx
jne 0x7feeff4d09b
call fcn.7feeff311e0
mov rax, qword [r13 + 8]
mov rcx, qword [rax + rbx + 0x28]
test rcx, rcx
je 0x7feeff4d0e4
mov r8, qword [rcx]
mov edx, r8d
or edx, 5
movzx edx, dl
imul edx, edx
imul esi, edx, 0x1ee3
mov eax, 0xfffffffe
sub eax, esi
not esi
lea esi, [rsi + rsi*2]
imul edx, edx, 0x3dc6
add edx, esi
or edx, 1
xor edx, eax
or rdx, r14
imul rdx, r15
test r8, rdx
jne 0x7feeff4d0e4
call fcn.7feeff311e0
inc rdi
add rbx, 0x28
cmp rdi, qword [r13]
jl 0x7feeff4d060
mov rcx, qword [r13 + 8]
test rcx, rcx
je 0x7feeff4d13e
mov rax, qword [rcx]
xor r12, rax
lea rdx, [r12 + r12*2]
lea rbx, [rax + rax]
add rdx, rax
inc rdx
xor rdx, rbx
mov ebx, edx
xor edx, 0xfffffffe
lea edi, [rdx + rax]
mov esi, edx
xor esi, eax
sub edi, esi
and edx, eax
add edx, edx
xor edx, edi
movabs rdi, 0x40000000fffffffe
xor rdi, rbx
xor rdi, rdx
test rax, rdi
je 0x7feeff4d14e
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov edx, 8
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp fcn.7feeff311a3
Function at 0x7feeff4d280
Capabilities:
Hash data using murmur3

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
call fcn.7feeff31066
mov rdx, qword [rsi]
mov rax, qword [rsi + 8]
lea rcx, [rax + 8]
test rax, rax
cmove rcx, rax
add rsp, 0x20
pop rsi
jmp 0x7feeff4d2e9
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x20
mov r12, rdx
mov rbx, rcx
call fcn.7feeff31066
lea r13, [r12 + 3]
test r12, r12
cmovns r13, r12
mov r14, rax
and r13, 0xfffffffffffffffc
xor r15d, r15d
xor edi, edi
cmp r12, 4
jl 0x7feeff4d364
cmp byte [r14], 0
jne 0x7feeff4d3d8
xor esi, esi
imul ecx, dword [rbx + rsi], 0xcc9e2d51
mov edx, 0xf
call fcn.7feeff4d3eb
add rsi, 4
imul ecx, eax, 0x1b873593
xor ecx, edi
mov edx, 0xd
call fcn.7feeff4d3eb
lea edi, [rax + rax*4]
add edi, 0xe6546b64
cmp rsi, r13
jl 0x7feeff4d32d
jmp 0x7feeff4d366
xor esi, esi
mov rax, r12
sub rax, r13
test rax, rax
jle 0x7feeff4d395
inc rax
add rbx, rsi
xor ecx, ecx
mov edx, ecx
shl edx, 8
movzx ecx, byte [rbx + rax - 2]
or ecx, edx
dec rax
cmp rax, 1
jg 0x7feeff4d379
imul r15d, ecx, 0xcc9e2d51
cmp byte [r14], 0
je 0x7feeff4d39f
xor edi, edi
jmp 0x7feeff4d3d8
mov edx, 0xf
mov ecx, r15d
call fcn.7feeff4d3eb
imul eax, eax, 0x1b873593
xor edi, r12d
xor edi, eax
mov eax, edi
shr eax, 0x10
xor eax, edi
imul eax, eax, 0x85ebca6b
mov ecx, eax
shr ecx, 0xd
xor ecx, eax
imul eax, ecx, 0xc2b2ae35
mov edi, eax
shr edi, 0x10
xor edi, eax
mov rax, rdi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x7feeff4d2e9
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
call fcn.7feeff31066
mov rdx, qword [rsi]
mov rax, qword [rsi + 8]
lea rcx, [rax + 8]
test rax, rax
cmove rcx, rax
add rsp, 0x20
pop rsi
jmp 0x7feeff4d2e9
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x20
mov r12, rdx
mov rbx, rcx
call fcn.7feeff31066
lea r13, [r12 + 3]
test r12, r12
cmovns r13, r12
mov r14, rax
and r13, 0xfffffffffffffffc
xor r15d, r15d
xor edi, edi
cmp r12, 4
jl 0x7feeff4d364
cmp byte [r14], 0
jne 0x7feeff4d3d8
xor esi, esi
imul ecx, dword [rbx + rsi], 0xcc9e2d51
mov edx, 0xf
call fcn.7feeff4d3eb
add rsi, 4
imul ecx, eax, 0x1b873593
xor ecx, edi
mov edx, 0xd
call fcn.7feeff4d3eb
lea edi, [rax + rax*4]
add edi, 0xe6546b64
cmp rsi, r13
jl 0x7feeff4d32d
jmp 0x7feeff4d366
xor esi, esi
mov rax, r12
sub rax, r13
test rax, rax
jle 0x7feeff4d395
inc rax
add rbx, rsi
xor ecx, ecx
mov edx, ecx
shl edx, 8
movzx ecx, byte [rbx + rax - 2]
or ecx, edx
dec rax
cmp rax, 1
jg 0x7feeff4d379
imul r15d, ecx, 0xcc9e2d51
cmp byte [r14], 0
je 0x7feeff4d39f
xor edi, edi
jmp 0x7feeff4d3d8
mov edx, 0xf
mov ecx, r15d
call fcn.7feeff4d3eb
imul eax, eax, 0x1b873593
xor edi, r12d
xor edi, eax
mov eax, edi
shr eax, 0x10
xor eax, edi
imul eax, eax, 0x85ebca6b
mov ecx, eax
shr ecx, 0xd
xor ecx, eax
imul eax, ecx, 0xc2b2ae35
mov edi, eax
shr edi, 0x10
xor edi, eax
mov rax, rdi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x7feeff4da10
Capabilities:
Terminate process

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov r15, rcx
call fcn.7feeff31066
mov r14, rax
mov rcx, qword [r15 + 0x10]
test rcx, rcx
je 0x7feeff4da98
mov rsi, qword [rcx]
mov r8d, 0xfffffffe
lea rdx, [r8 + 1]
xor rdx, rsi
lea rdi, [rdx + rdx*2]
lea rdx, [rsi + rsi]
lea rbx, [rsi + rdi]
inc rbx
xor rbx, rdx
mov edi, ebx
xor rdi, r8
movabs r9, 0x7abdcafc99bdea47
add r9, rdi
xor ebx, 1
or ebx, esi
mov eax, esi
or eax, edi
not eax
lea eax, [rax + rax*2]
xor edx, r8d
sub edx, edi
xor edi, esi
sub edi, ebx
add edi, eax
xor edi, edx
movabs rax, 0x3abdcafc99bdea47
add rax, rdi
xor rax, r9
test rsi, rax
jne 0x7feeff4da98
call fcn.7feeff311e0
mov rcx, qword [r15 + 0x18]
lea rdx, [0x7feeffe4728]
call fcn.7feeff3ed00
test al, al
je 0x7feeff4dabb
mov rcx, qword [r15 + 0x18]
call fcn.7feeff34987
cmp byte [r14], 0
je 0x7feeff4dac7
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov rcx, qword [r15 + 0x18]
mov edx, 8
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp fcn.7feeff31c2a

Function at 0x7feeff4daeb
Capabilities:
Terminate process

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rbx, rdx
mov rdi, rcx
call fcn.7feeff31066
mov r14, rax
mov rax, qword [rbx]
mov qword [rdi], rax
mov rcx, qword [rdi + 0x10]
mov r10, qword [rbx + 0x10]
test rcx, rcx
je 0x7feeff4db5b
cmp rcx, r10
je 0x7feeff4db5b
mov rsi, qword [rcx]
mov edx, esi
not edx
lea r8d, [rdx + rdx*2]
lea r9d, [rsi + rsi]
lea edx, [rsi + r8]
inc edx
xor edx, r9d
movabs rax, 0x40000000fffffffe
xor rax, rdx
movabs rdx, 0x37745fdc94b28911
imul rdx, rax
test rsi, rdx
jne 0x7feeff4db5b
call fcn.7feeff311e0
mov r10, qword [rbx + 0x10]
mov rax, qword [rbx + 8]
mov qword [rdi + 8], rax
mov qword [rdi + 0x10], r10
mov rsi, qword [rdi + 0x18]
mov rax, qword [rbx + 0x18]
mov qword [rdi + 0x18], rax
lea rdx, [0x7feeffe4728]
mov rcx, rsi
call fcn.7feeff3ed00
test al, al
je 0x7feeff4db94
mov rcx, rsi
call fcn.7feeff34987
cmp byte [r14], 0
je 0x7feeff4db9e
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
mov edx, 8
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.7feeff31c2a

Function at 0x7feeff4deda
Capabilities:
Terminate process

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rbx, rdx
mov rdi, rcx
call fcn.7feeff31066
mov r14, rax
mov rsi, qword [rdi]
mov qword [rdi], rbx
mov rcx, rsi
call fcn.7feeff34936
test al, al
je 0x7feeff4df11
mov rcx, rsi
call fcn.7feeff34987
cmp byte [r14], 0
je 0x7feeff4df1b
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
mov edx, 8
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.7feeff31c2a
Function at 0x7feeff4df31
Capabilities:
Terminate process

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
call fcn.7feeff31066
cmp qword [rsi], 0
jle 0x7feeff4dfb9
mov r15, rax
xor ebx, ebx
lea r14, [0x7feeffe4728]
xor edi, edi
mov rax, qword [rsi + 8]
mov rcx, qword [rax + rbx + 0x18]
test rcx, rcx
je 0x7feeff4df75
test byte [rcx + 7], 0x40
jne 0x7feeff4df75
call fcn.7feeff311e0
mov rax, qword [rsi + 8]
mov rcx, qword [rax + rbx + 0x20]
mov rdx, r14
call fcn.7feeff3ed00
test al, al
je 0x7feeff4dfad
mov rax, qword [rsi + 8]
mov rcx, qword [rax + rbx + 0x20]
call fcn.7feeff34987
cmp byte [r15], 0
jne 0x7feeff4dff4
mov rax, qword [rsi + 8]
mov rcx, qword [rax + rbx + 0x20]
mov edx, 8
call fcn.7feeff31c2a
inc rdi
add rbx, 0x20
cmp rdi, qword [rsi]
jl 0x7feeff4df58
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x7feeff4dff4
mov rax, qword [rcx]
mov edx, eax
not edx
lea edx, [rdx + rdx*2]
lea ebx, [rax + rax]
add edx, eax
inc edx
xor edx, ebx
movabs rbx, 0x182f70743bbd44b9
xor rbx, rdx
movabs rdx, 0x27d08f8b3bbd44b9
add rdx, rbx
test rax, rdx
je 0x7feeff4e000
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov edx, 8
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp fcn.7feeff311a3