joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14049a510
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x18
mov qword [rsp + 0x10], r8
mov qword [rsp + 8], rdx
mov dword [rsp + 4], ecx
xor r10d, r10d
lea r11, [0x1406058e0]
lea rdx, [0x140605970]
lea r15, [0x1406059c0]
lea rax, [fcn.140499760]
mov r13d, eax
and r13d, 1
xor r13d, eax
mov r12d, 0xffffffff
xor esi, esi
cmp r13d, r12d
sete sil
or esi, 0x7902b272
add esi, 0x1210
xor esi, dword [r15 + r10*4]
mov ecx, esi
and cl, 7
mov ebp, 1
shl ebp, cl
mov rdi, qword [r11 + r10*8]
movzx eax, cl
xor cl, 7
mov r9d, 1
shl r9d, cl
mov r8d, dword [rdx + r10*4]
lea ebx, [r8 - 1]
movzx ecx, byte [rdi + rbx]
bt ecx, eax
jb 0x14049a62c
mov al, byte [rdi + rbx]
mov ecx, eax
or cl, r9b
lock cmpxchg byte [rdi + rbx], cl
jne 0x14049a5ad
movzx eax, al
test r9d, eax
je 0x14049a5cb
movzx eax, byte [rdi + rbx]
test ebp, eax
je 0x14049a5c1
jmp 0x14049a62c
movzx eax, byte [rdi + rbx]
test ebp, eax
jne 0x14049a625
add r8d, 0xfffffffc
shr r8d, 2
je 0x14049a610
xor eax, eax
mov rdx, rdi
mov r11d, dword [rdx]
xor r11d, esi
mov r14d, esi
mov ecx, eax
shl r14d, cl
and cl, 0x1f
xor cl, 0x1f
shr esi, cl
mov dword [rdx], r11d
or esi, r14d
not r11d
imul esi, r11d
add rdx, 4
inc eax
cmp eax, r8d
jne 0x14049a5e2
or byte [rdi + rbx], bpl
lea rdx, [0x1406058e0]
mov r11, rdx
lea rdx, [0x140605970]
not r9b
and byte [rdi + rbx], r9b
inc r10
cmp r10, 0x12
jne 0x14049a55d
lea rax, [0x140604460]
mov edx, dword [rsp + 4]
cmp edx, 3
jne 0x14049a673
lea rcx, [0x1406554f4]
jmp 0x14049a65b
cmp dword [rax + 0x48], edx
lea rax, [rax + 0x28]
jne 0x14049a673
mov rdx, qword [rsp + 8]
mov qword [rdx], rcx
mov rax, qword [rax + 8]
mov rcx, qword [rsp + 0x10]
mov qword [rcx], rax
xor eax, eax
jmp 0x14049a681
mov rcx, qword [rax + 0x28]
test rcx, rcx
jne 0x14049a652
mov eax, 0xffffffd2
add rsp, 0x18
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1404d18e0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x98
mov r14, r9
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
lea rcx, [rsp + 0x38]
call fcn.14047cd90
lea rcx, [rsp + 0x68]
call fcn.14047cd90
xor eax, eax
mov ecx, dword [rbx + rax*4]
xor ecx, dword [rdi + rax*4]
mov dword [rsp + rax*4 + 0x38], ecx
mov ecx, dword [rbx + rax*4 + 0x14]
xor ecx, dword [rdi + rax*4 + 0x14]
mov dword [rsp + rax*4 + 0x68], ecx
inc rax
cmp rax, 5
jne 0x1404d1912
lea rcx, [rsp + 0x38]
lea r15, [rsp + 0x80]
mov rdx, r15
call fcn.14047d250
lea rdx, [rsp + 0x68]
lea r12, [rsp + 0x50]
mov rcx, r15
mov r8, r12
call fcn.14047cf70
lea r15, [rsp + 0x20]
mov rcx, r12
mov rdx, r15
call fcn.14047cda0
mov rcx, r15
call fcn.14047cd10
xor eax, eax
cmp word [r14], 0
je 0x1404d199d
mov ecx, dword [rsp + rax*4 + 0x20]
xor ecx, dword [rsp + rax*4 + 0x50]
xor ecx, dword [rdi + rax*4]
xor ecx, dword [rbx + rax*4]
xor ecx, dword [r14 + rax*4 + 2]
mov dword [rsi + rax*4], ecx
inc rax
cmp rax, 5
jne 0x1404d197c
jmp 0x1404d19b7
mov ecx, dword [rsp + rax*4 + 0x20]
xor ecx, dword [rsp + rax*4 + 0x50]
xor ecx, dword [rdi + rax*4]
xor ecx, dword [rbx + rax*4]
mov dword [rsi + rax*4], ecx
inc rax
cmp rax, 5
jne 0x1404d199d
xor eax, eax
mov ecx, dword [rsi + rax*4]
xor ecx, dword [rdi + rax*4]
mov dword [rsp + rax*4 + 0x38], ecx
inc rax
cmp rax, 5
jne 0x1404d19b9
lea rcx, [rsp + 0x38]
lea rdx, [rsp + 0x50]
lea r8, [rsp + 0x20]
call fcn.14047cf70
xor eax, eax
mov ecx, dword [rsi + rax*4]
xor ecx, dword [rsp + rax*4 + 0x20]
xor ecx, dword [rdi + rax*4 + 0x14]
mov dword [rsi + rax*4 + 0x14], ecx
inc rax
cmp rax, 5
jne 0x1404d19e2
add rsp, 0x98
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x1404d1a10
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x98
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
lea r14, [rsp + 0x68]
mov rdx, r14
call fcn.14047d250
lea rdx, [rdi + 0x14]
lea r8, [rsp + 0x20]
mov rcx, r14
call fcn.14047cf70
xor eax, eax
mov ecx, dword [rsp + rax*4 + 0x20]
xor ecx, dword [rdi + rax*4]
mov dword [rsp + rax*4 + 0x38], ecx
inc rax
cmp rax, 5
jne 0x1404d1a45
lea rcx, [rsp + 0x38]
lea r14, [rsp + 0x50]
mov rdx, r14
call fcn.14047cda0
mov rcx, r14
call fcn.14047cd10
xor eax, eax
cmp word [rbx], 0
je 0x1404d1a95
mov ecx, dword [rsp + rax*4 + 0x50]
xor ecx, dword [rsp + rax*4 + 0x38]
xor ecx, dword [rbx + rax*4 + 2]
mov dword [rsi + rax*4], ecx
inc rax
cmp rax, 5
jne 0x1404d1a7b
jmp 0x1404d1aa9
mov ecx, dword [rsp + rax*4 + 0x50]
xor ecx, dword [rsp + rax*4 + 0x38]
mov dword [rsi + rax*4], ecx
inc rax
cmp rax, 5
jne 0x1404d1a95
pcmpeqd xmm0, xmm0
movdqu xmmword [rsp + 0x24], xmm0
mov eax, 0x3fffffff
xor eax, dword [rsp + 0x38]
mov dword [rsp + 0x20], eax
xor eax, eax
lea rcx, [rax*4]
or rcx, 4
movdqu xmm0, xmmword [rsp + rcx + 0x20]
movdqu xmm1, xmmword [rsp + rcx + 0x38]
pxor xmm1, xmm0
movdqu xmmword [rsp + rcx + 0x20], xmm1
test rax, rax
lea rax, [rax + 4]
jne 0x1404d1ac2
lea rcx, [rsp + 0x20]
lea r8, [rsp + 0x80]
mov rdx, rsi
call fcn.14047cf70
lea rbx, [rsp + 0x68]
mov rcx, rdi
mov rdx, rbx
call fcn.14047cda0
mov rcx, rbx
call fcn.14047cd10
xor eax, eax
mov ecx, dword [rsp + rax*4 + 0x80]
xor ecx, dword [rsp + rax*4 + 0x68]
mov dword [rsi + rax*4 + 0x14], ecx
inc rax
cmp rax, 5
jne 0x1404d1b1c
add rsp, 0x98
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x1404d1b60
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
mov r14, r9
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.14047cda0
lea rcx, [rsp + 0x34]
call fcn.14047cd90
xor eax, eax
mov ecx, dword [rsi + rax*4 + 0x14]
xor ecx, dword [rsi + rax*4]
mov dword [rsp + rax*4 + 0x34], ecx
inc rax
cmp rax, 5
jne 0x1404d1b8e
lea rdx, [rsp + 0x20]
mov rcx, rbx
mov r8, rdi
mov r9, r14
call fcn.1404d18e0
nop
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x1404d7ec0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov ebp, edx
mov rsi, rcx
mov qword [rsp + 0x28], 0
lea rdx, [r9 - 1]
movabs rcx, 0x1ffffffffffffffe
mov eax, 0xffffffec
cmp rdx, rcx
ja 0x1404d80b6
mov r12, qword [rsp + 0xb8]
inc rcx
cmp r12, rcx
ja 0x1404d80b6
mov rbx, r9
mov rdi, r8
lea r15, [rsi + 0x168]
mov r13d, 0x10
mov r8d, 0x10
mov rcx, r15
xor edx, edx
call fcn.1401ee070
lea r14, [rsi + 0x178]
mov r8d, 0x10
mov rcx, r14
xor edx, edx
call fcn.1401ee070
mov dword [rsi + 0x188], ebp
xorps xmm0, xmm0
movups xmmword [rsi + 0x148], xmm0
cmp rbx, 0xc
jne 0x1404d7f7b
mov r8d, 0xc
mov rcx, r15
mov rdx, rdi
call fcn.1401fed70
mov byte [rsi + 0x177], 1
jmp 0x1404d803a
lea rbp, [rsp + 0x30]
mov r8d, 0x10
mov rcx, rbp
xor edx, edx
call fcn.1401ee070
mov rax, rbx
shr rax, 0x35
mov byte [rbp + 8], al
mov rax, rbx
shr rax, 0x2d
mov byte [rbp + 9], al
mov rax, rbx
shr rax, 0x25
mov byte [rbp + 0xa], al
mov rax, rbx
shr rax, 0x1d
mov byte [rbp + 0xb], al
mov rax, rbx
shr rax, 0x15
mov byte [rbp + 0xc], al
mov rax, rbx
shr rax, 0xd
mov byte [rbp + 0xd], al
mov rax, rbx
shr rax, 5
mov byte [rbp + 0xe], al
mov eax, ebx
shl al, 3
mov byte [rbp + 0xf], al
cmp rbx, r13
mov ebp, 0x10
cmovb rbp, rbx
test rbp, rbp
je 0x1404d8003
xor eax, eax
mov cl, byte [rdi + rax]
xor byte [rsi + rax + 0x168], cl
inc rax
cmp rax, rbp
jb 0x1404d7ff1
mov rcx, rsi
mov rdx, r15
mov r8, r15
call fcn.1404d80d0
add rdi, rbp
sub rbx, rbp
jne 0x1404d7fde
movups xmm0, xmmword [rsi + 0x168]
xorps xmm0, xmmword [rsp + 0x30]
movups xmmword [rsi + 0x168], xmm0
mov rcx, rsi
mov rdx, r15
mov r8, r15
call fcn.1404d80d0
lea r9, [rsi + 0x158]
lea rax, [rsp + 0x28]
mov qword [rsp + 0x20], rax
mov r8d, 0x10
mov rcx, rsi
mov rdx, r15
call fcn.14048ac00
test eax, eax
jne 0x1404d80b6
mov qword [rsi + 0x150], r12
test r12, r12
je 0x1404d80b4
mov rdi, qword [rsp + 0xb0]
mov ebx, 0x10
cmp r12, rbx
mov ebp, 0x10
cmovb rbp, r12
test rbp, rbp
je 0x1404d809e
xor eax, eax
mov cl, byte [rdi + rax]
xor byte [rsi + rax + 0x178], cl
inc rax
cmp rax, rbp
jb 0x1404d808c
mov rcx, rsi
mov rdx, r14
mov r8, r14
call fcn.1404d80d0
add rdi, rbp
sub r12, rbp
jne 0x1404d8079
xor eax, eax
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1404d84e0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov rbx, rcx
lea rcx, [r8 - 4]
mov eax, 0xffffffec
cmp rcx, 0xc
ja 0x1404d84c4
mov rsi, r8
mov rdi, rdx
mov r12, qword [rbx + 0x148]
mov r15, qword [rbx + 0x150]
lea rbp, [r12*8]
lea r13, [r15*8]
lea rdx, [rbx + 0x158]
mov rcx, rdi
call fcn.1401fed70
mov rax, r13
or rax, rbp
jne 0x1404d83b8
xor eax, eax
jmp 0x1404d84c4
mov qword [rsp + 0x28], rbp
lea r14, [rsp + 0x30]
mov r8d, 0x10
mov rcx, r14
xor edx, edx
call fcn.1401ee070
mov rdx, r15
shr rdx, 0x1d
mov rax, r15
shr rax, 0x35
mov byte [r14], al
mov rcx, r15
shr rcx, 0x2d
mov byte [r14 + 1], cl
mov rbp, r15
shr rbp, 0x25
mov byte [r14 + 2], bpl
mov byte [r14 + 3], dl
mov rdx, r15
shr rdx, 0x15
mov byte [r14 + 4], dl
mov rdx, r15
shr rdx, 0xd
mov byte [r14 + 5], dl
shr r15, 5
mov byte [r14 + 6], r15b
mov byte [r14 + 7], r13b
mov rdx, r12
shr rdx, 0x1d
mov rbp, r12
shr rbp, 0x35
mov byte [r14 + 8], bpl
mov rbp, r12
shr rbp, 0x2d
mov byte [r14 + 9], bpl
mov rbp, r12
shr rbp, 0x25
mov byte [r14 + 0xa], bpl
mov byte [r14 + 0xb], dl
mov rdx, r12
shr rdx, 0x15
mov byte [r14 + 0xc], dl
mov rdx, r12
shr rdx, 0xd
mov byte [r14 + 0xd], dl
shr r12, 5
mov byte [r14 + 0xe], r12b
mov rdx, qword [rsp + 0x28]
mov byte [r14 + 0xf], dl
lea rdx, [rbx + 0x178]
xor byte [rbx + 0x178], al
xor byte [rbx + 0x179], cl
mov eax, 2
mov cl, byte [rsp + rax + 0x30]
xor byte [rbx + rax + 0x178], cl
inc rax
cmp rax, 0x10
jne 0x1404d848a
mov rcx, rbx
mov r8, rdx
call fcn.1404d80d0
xor eax, eax
test rsi, rsi
je 0x1404d84c4
xor ecx, ecx
mov dl, byte [rbx + rcx + 0x178]
xor byte [rdi + rcx], dl
inc rcx
cmp rcx, rsi
jne 0x1404d84b2
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rax, r9
mov r12, r8
mov rsi, rcx
mov r15, qword [rsp + 0xc0]
mov r14, qword [rsp + 0xb8]
mov rbx, qword [rsp + 0xb0]
mov rdi, qword [rsp + 0xa8]
mov r9, qword [rsp + 0x90]
movups xmm0, xmmword [rsp + 0x98]
movups xmmword [rsp + 0x20], xmm0
mov r8, rax
call fcn.1404d7ec0
test eax, eax
jne 0x1404d854c
mov rcx, rsi
mov rdx, r12
mov r8, rdi
mov r9, rbx
call fcn.1404d8210
test eax, eax
je 0x1404d855a
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov rcx, rsi
mov rdx, r15
mov r8, r14
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
jmp 0x1404d8350
Function at 0x415560
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41570b
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00431d40
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
nop
jne 0x4155ce
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x4155e1
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x415605
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x415619
cmp rbx, 0x1000
jae 0x4155d8
nop
jmp 0x415689
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop
cmp rbx, 0x1000
jae 0x41562d
xor edx, edx
jmp 0x415680
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00431d40
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
nop
test dl, dl
jne 0x41560f
jmp 0x4155f5
call fcn.0045fbc0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.00436300
lea rax, [0x004ae74f]
mov ebx, 0x18
nop dword [rax + rax]
call fcn.00436c00
mov rax, qword [rsp + 0x38]
call fcn.00436900
lea rax, [0x004ae80f]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.00436c00
mov rax, qword [rsp + 0x30]
call fcn.00436900
call fcn.00436560
call fcn.00436380
lea rax, [0x004b0a2a]
mov ebx, 0x21
call fcn.00434a40
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045c020
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00415560
Function at 0x415740
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41596a
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.00431dc0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x4157bb
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x4157ce
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x4157f0
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x415804
cmp rbx, 0x1000
jae 0x4157c5
jmp 0x41588e
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x415816
xor esi, esi
jmp 0x415880
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
nop dword [rax]
call fcn.00431dc0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
test sil, sil
jne 0x4157fa
jmp 0x4157e2
call fcn.0045fbc0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x415909
call fcn.00436300
lea rax, [0x004aebc5]
mov ebx, 0x19
call fcn.00436c00
mov rax, qword [rsp + 0x68]
call fcn.00436900
lea rax, [0x004ae80f]
mov ebx, 0x19
nop
call fcn.00436c00
mov eax, dword [rsp + 0x34]
call fcn.00436900
call fcn.00436560
call fcn.00436380
lea rax, [0x004ab7e7]
mov ebx, 0xd
call fcn.00434a40
cmp eax, 0x5af
je 0x4158b3
call fcn.00436300
lea rax, [0x004aebc5]
mov ebx, 0x19
call fcn.00436c00
mov rax, qword [rsp + 0x38]
call fcn.00436900
lea rax, [0x004ae80f]
mov ebx, 0x19
nop dword [rax]
call fcn.00436c00
mov eax, dword [rsp + 0x34]
call fcn.00436900
call fcn.00436560
call fcn.00436380
lea rax, [0x004b02dc]
mov ebx, 0x1f
call fcn.00434a40
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045c020
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00415740
Function at 0x41e040
Capabilities:
Hash data using murmur3

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
cmp byte [0x0059b511], 0
jne 0x41e12f
nop
nop
nop
nop
sub rbx, qword [rax + 0x18]
nop
mov edx, dword [rax + 0x5c]
imul rbx, rdx
mov rdx, rbx
shr rbx, 0x20
nop
shr rdx, 0x23
and ebx, 7
mov rsi, rcx
mov rcx, rbx
mov edi, 1
shl edi, cl
nop
add rdx, qword [rax + 0x50]
lock or byte [rdx], dil
nop
nop
mov rcx, qword [rax + 0x18]
nop
movabs rdx, 0x800000000000
lea rax, [rdx + rcx]
mov rdx, rax
shr rax, 0x2a
cmp rax, 0x40
jae 0x41e125
lea rbx, [0x0056d970]
mov rax, qword [rbx + rax*8]
shr rdx, 0x16
and edx, 0xfffff
mov rdx, qword [rax + rdx*8]
test byte [rdx], al
test byte [rax], al
mov rax, rcx
shr rcx, 0x10
and ecx, 0x3f
movzx ebx, byte [rdx + rcx + 0x21040]
lea rdx, [rdx + rcx]
lea rdx, [rdx + 0x21040]
shr rax, 0xd
and eax, 7
mov rcx, rax
mov eax, 1
shl eax, cl
nop dword [rax]
test al, bl
jne 0x41e107
lock or byte [rdx], al
mov rax, qword [r14 + 0x30]
mov rax, qword [rax + 0xa0]
test byte [rax], al
add qword [rax + 0x1250], rsi
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov ecx, 0x40
call fcn.0045e720
lea rax, [0x004b22e6]
mov ebx, 0x2c
nop dword [rax + rax]
call fcn.00434a40
nop
int3

Function at 0x420880
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x420981
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rbx
mov qword [rsp + 8], 0
jmp 0x4208c0
mov rax, qword [rsp + 0x50]
mov rcx, rdx
mov rbx, qword [rsp + 0x58]
nop
cmp qword [rsp + 8], rbx
jae 0x420971
test byte [rax], al
lea rcx, [rax + 0x100c0]
mov rax, rcx
call fcn.004213e0
nop dword [rax]
test rax, rax
je 0x420971
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x30], xmm15
lea rcx, [0x004209c0]
mov qword [rsp + 0x10], rcx
mov rdx, qword [rsp + 0x50]
mov qword [rsp + 0x18], rdx
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rbx
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x30], rax
lea rbx, [rsp + 8]
mov qword [rsp + 0x38], rbx
lea rbx, [rsp + 0x10]
mov qword [rsp], rbx
call fcn.0045bee0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x60]
test rdx, rdx
jne 0x42095f
xor eax, eax
jmp 0x420969
mov rax, qword [rdx]
call rax
mov rdx, qword [rsp + 0x60]
test al, al
je 0x4208b2
mov rax, qword [rsp + 8]
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
nop
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.0045c020
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.00420880
Function at 0x42de60
Capabilities:
Hash data using murmur3

Disassembly:
cmp rsp, qword [r14 + 0x18]
jbe 0x42e106
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
test byte [rax], al
lea rsi, [rax + 0x1278]
mov rcx, qword [rax + 0x1268]
sub rcx, rsi
shr rcx, 3
cmp rcx, 0x200
ja 0x42e0fa
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x30], rcx
mov qword [rax + 0x1268], 0
cmp byte [0x0059b511], 0
jne 0x42dec2
xor edx, edx
xor ebx, ebx
nop
jmp 0x42df0a
xor edx, edx
jmp 0x42deed
mov qword [rsp + 0x28], rdx
mov rcx, qword [rax + rdx*8 + 0x1278]
mov rax, rcx
call fcn.0041d860
mov rdx, qword [rsp + 0x28]
inc rdx
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
cmp rdx, rcx
jl 0x42dec6
add rax, 0x1268
call fcn.0042dce0
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
inc rdx
cmp rdx, rcx
jge 0x42e094
mov rsi, qword [rax + rdx*8 + 0x1278]
nop dword [rax + rax]
cmp rsi, 0x1000
jb 0x42df07
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rbx
mov rax, rsi
xor ebx, ebx
mov rcx, rbx
nop dword [rax + rax]
call fcn.00411800
test rax, rax
jne 0x42df62
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
nop
jmp 0x42df07
nop
mov rsi, rcx
shr rcx, 3
and esi, 7
mov rdx, rcx
mov rcx, rsi
mov r8d, 1
shl r8d, cl
nop
add rdx, qword [rbx + 0x50]
movzx esi, byte [rdx]
test r8b, sil
je 0x42dfa5
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
nop dword [rax]
jmp 0x42df07
nop
lock or byte [rdx], r8b
nop
nop
mov rcx, qword [rbx + 0x18]
nop
movabs rsi, 0x800000000000
lea r8, [rsi + rcx]
mov r9, r8
shr r8, 0x2a
cmp r8, 0x40
jae 0x42e0ed
lea r10, [0x0056d970]
mov r8, qword [r10 + r8*8]
shr r9, 0x16
and r9d, 0xfffff
mov r9, qword [r8 + r9*8]
test byte [r9], al
test byte [r8], al
mov r8, rcx
shr rcx, 0x10
and ecx, 0x3f
movzx r10d, byte [r9 + rcx + 0x21040]
lea r9, [r9 + rcx]
lea r9, [r9 + 0x21040]
shr r8, 0xd
and r8d, 7
mov rcx, r8
mov r8d, 1
shl r8d, cl
test r8b, r10b
jne 0x42e02b
lock or byte [r9], r8b
movzx r8d, byte [rbx + 0x62]
test r8b, 1
je 0x42e065
mov rax, qword [rsp + 0x48]
mov r8, qword [rax + 0x1250]
add r8, qword [rbx + 0x68]
mov qword [rax + 0x1250], r8
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
nop dword [rax]
jmp 0x42df07
mov r8, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
cmp r8, rcx
jae 0x42e0e5
mov rbx, qword [rsp + 0x48]
mov qword [rbx + r8*8 + 0x1278], rax
inc r8
mov rax, rbx
mov rdx, qword [rsp + 0x28]
mov rbx, r8
jmp 0x42df07
cmp rbx, 0x200
ja 0x42e0d8
lea rdx, [rax + 0x1278]
lea rsi, [rax + 0x1240]
mov rcx, rbx
mov edi, 0x200
mov rbx, rdx
mov rax, rsi
call fcn.004239e0
mov rax, qword [rsp + 0x48]
add rax, 0x1268
call fcn.0042dce0
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov rcx, rbx
mov edx, 0x200
call fcn.0045e780
mov rax, r8
call fcn.0045e700
mov rax, r8
mov ecx, 0x40
call fcn.0045e720
mov edx, 0x200
nop
call fcn.0045e760
nop
mov qword [rsp + 8], rax
call fcn.00460760
mov rax, qword [rsp + 8]
jmp fcn.0042de60
Function at 0x442f80
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4430ef
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov ecx, dword [rax + 0x190]
mov edx, dword [rax + 0x194]
mov rsi, qword [rax + 0x998]
mov edi, dword [rax + 0x194]
cmp edi, edx
jne 0x442f98
cmp edx, ecx
jne 0x4430dd
nop dword [rax]
test rsi, rsi
jne 0x4430dd
mov qword [rsp + 0x28], rax
test rbx, rbx
jne 0x442ff6
nop
call fcn.00460020
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rbx, qword [rsp]
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x10], rbx
nop dword [rax + rax]
call fcn.00442e80
mov rcx, qword [0x00547718]
mov rdx, qword [0x00547710]
mov rbx, qword [rsp + 0x28]
mov esi, dword [rbx]
mov edi, esi
sar esi, 0x1f
shr esi, 0x1b
add esi, edi
sar esi, 5
mov r8d, esi
shl esi, 5
sub edi, esi
test edi, edi
jl 0x4430d8
cmp edi, 0x20
sbb esi, esi
mov rax, rcx
mov ecx, edi
mov r9d, 1
shl r9d, cl
and r9d, esi
movsxd rsi, r8d
cmp rax, rsi
jbe 0x4430cd
lea rcx, [rdx + rsi*4]
lock or dword [rcx], r9d
mov rcx, qword [0x005480b0]
mov qword [rbx + 8], rcx
nop
mov rcx, rbx
mov qword [0x005480b0], rbx
mov edx, 1
lea rsi, [0x005480b8]
lock xadd dword [rsi], edx
mov rdx, qword [rcx + 0x1228]
shr rdx, 0x3d
test dl, dl
jne 0x4430bc
nop
nop
mov rax, qword [rsp + 0x10]
movabs rdx, 0x1fffffffffffffff
and rdx, rax
bts rdx, 0x3f
xchg qword [rcx + 0x1228], rdx
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x004b1a90]
mov ebx, 0x28
call fcn.00434a40
mov rcx, rax
mov rax, rsi
call fcn.0045e700
call fcn.00432f60
lea rax, [0x004b0f78]
mov ebx, 0x23
call fcn.00434a40
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045c020
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00442f80