joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400112e0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x14008e060]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x140090d10]
mov edi, edx
cmp byte [rbx + 0x2005], 0
jne 0x140011340
cmp byte [rbx + 0x2006], 0
jne 0x140011340
mov r9d, dword [rbx + 0x30a8]
lea r8, [0x14007b8b8]
mov edx, 0x10
lea rcx, [rsp + 0x20]
call fcn.1400059b0
test dil, 1
je 0x14001145e
jmp 0x1400113c8
movss xmm1, dword [rbx + 0x1614]
lea r8, [0x14007b8b8]
mov r9d, dword [rbx + 0x30a8]
lea rcx, [rsp + 0x20]
movaps xmm0, xmm1
xor eax, eax
mulss xmm0, dword [0x140083e50]
mulss xmm1, dword [0x140083e3c]
lea edx, [rax + 0x10]
addss xmm0, dword [rbx + 0x128]
addss xmm1, dword [rbx + 0x12c]
mov qword [rbx + 0x1ba0], rax
mov dword [rbx + 0x1b8c], 1
movss dword [rbx + 0x1b98], xmm0
movss dword [rbx + 0x1b9c], xmm1
movss xmm0, dword [rbx + 0x1670]
mulss xmm0, dword [0x140083dd4]
or dword [rbx + 0x1b88], 0x41
movss dword [rbx + 0x1be8], xmm0
call fcn.1400059b0
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x140011418
lea r11, [0x14007ada0]
cmp r9b, 0x23
jne 0x1400113fb
cmp byte [r8], r9b
jne 0x1400113fb
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x1400113e8
not ecx
call fcn.14000b850
test rax, rax
je 0x14001145e
cmp byte [rax + 0x8e], 0
je 0x14001145e
mov byte [rax + 0x95], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xac], 1
lea rcx, [rsp + 0x20]
inc dword [rbx + 0x30a8]
mov edx, 0x10
mov r9d, dword [rbx + 0x30a8]
call fcn.1400059b0
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x20c0347
call fcn.14000df10
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14003d9a0
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x140015290
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rdx
mov qword [rax + 0x18], r8
mov qword [rax + 0x20], r9
push rbx
sub rsp, 0x40
mov rbx, qword [0x140090d10]
cmp byte [rbx + 0x313c], 0
je 0x14001537b
cmp qword [rbx + 0x3148], 0
mov qword [rax - 0x18], rsi
lea rsi, [rax + 0x10]
mov qword [rax - 0x20], rdi
lea rdi, [rbx + 0x3150]
je 0x140015363
mov r9d, dword [rdi + 4]
mov qword [rax - 0x10], rbp
xor ebp, ebp
test r9d, r9d
jns 0x14001530b
mov eax, r9d
mov rcx, rdi
cdq
sub eax, edx
mov edx, ebp
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.140016960
mov rcx, qword [rsp + 0x50]
mov rdx, rcx
mov dword [rdi], ebp
mov rcx, rdi
mov r8, rsi
call fcn.140006120
mov eax, dword [rdi]
mov edx, 1
mov r9, qword [rbx + 0x3148]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rbx + 0x3158]
cmove ecx, ebp
test rax, rax
movsxd r8, ecx
lea rcx, [0x140090d08]
cmovne rcx, rax
call fcn.140045804
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x28]
add rsp, 0x40
pop rbx
ret
mov rdx, rcx
mov r8, rsi
mov rcx, rdi
call fcn.140006120
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x28]
add rsp, 0x40
pop rbx
ret
Function at 0x140027b50
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x14008e060]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rcx, qword [0x1400912e0]
lea rdx, [rsp + 0x38]
mov rdi, qword [0x140090d10]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x38], xmm0
call qword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [rsp + 0x40]
lea rcx, [rsp + 0x30]
sub eax, dword [rsp + 0x38]
mov qword [rsp + 0x30], 0
movd xmm1, eax
mov eax, dword [rsp + 0x44]
sub eax, dword [rsp + 0x3c]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
cvtdq2ps xmm0, xmm0
movss dword [rdi + 0x10], xmm1
movss dword [rdi + 0x14], xmm0
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rcx, qword [rsp + 0x30]
xorps xmm1, xmm1
mov rax, rcx
xorps xmm0, xmm0
sub rax, qword [0x1400912e8]
cvtsi2ss xmm0, qword [0x1400912f0]
cvtsi2ss xmm1, rax
divss xmm1, xmm0
movss dword [rdi + 0x18], xmm1
mov qword [0x1400912e8], rcx
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov ecx, 0x10
and al, 1
mov byte [rdi + 0x140], al
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov ecx, 0x12
and al, 1
mov byte [rdi + 0x141], al
call qword [sym.imp.USER32.dll_GetKeyState]
mov rbx, qword [0x140090d10]
shr eax, 0xf
and al, 1
mov byte [rdi + 0x143], 0
mov byte [rdi + 0x142], al
cmp byte [rbx + 0x39b], 0
je 0x140027c8f
cvttss2si eax, dword [rbx + 0x128]
mov rcx, qword [0x1400912e0]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], eax
cvttss2si eax, dword [rbx + 0x12c]
mov dword [rsp + 0x24], eax
call qword [sym.imp.USER32.dll_ClientToScreen]
test eax, eax
je 0x140027c8f
mov edx, dword [rsp + 0x24]
mov ecx, dword [rsp + 0x20]
call qword [sym.imp.USER32.dll_SetCursorPos]
mov dword [rbx + 0x128], 0xff7fffff
mov dword [rbx + 0x12c], 0xff7fffff
call qword [sym.imp.USER32.dll_GetForegroundWindow]
test rax, rax
je 0x140027d0e
mov rdx, qword [0x1400912e0]
cmp rax, rdx
je 0x140027cc7
mov rcx, rax
call qword [sym.imp.USER32.dll_IsChild]
test eax, eax
je 0x140027d0e
lea rcx, [rsp + 0x28]
call qword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x140027d0e
mov rcx, qword [0x1400912e0]
lea rdx, [rsp + 0x28]
call qword [sym.imp.USER32.dll_ScreenToClient]
test eax, eax
je 0x140027d0e
movd xmm0, dword [rsp + 0x28]
movd xmm1, dword [rsp + 0x2c]
cvtdq2ps xmm0, xmm0
cvtdq2ps xmm1, xmm1
movss dword [rbx + 0x128], xmm0
movss dword [rbx + 0x12c], xmm1
cmp byte [rdi + 0xc8], 0
je 0x140027d1e
mov eax, 0xffffffff
jmp 0x140027d2b
mov rax, qword [0x140090d10]
mov eax, dword [rax + 0x2000]
cmp dword [0x14008ee34], eax
je 0x140027d3e
mov dword [0x14008ee34], eax
call fcn.140027700
call fcn.140027880
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14003d9a0
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x140031060
Capabilities:
Read .ini file

Disassembly:
sub rsp, 0x68
mov rax, qword [0x14008e060]
xor rax, rsp
mov qword [rsp + 0x58], rax
xor eax, eax
lea r9, [rsp + 0x30]
xorps xmm0, xmm0
mov byte [rsp + 0x50], al
lea rax, [0x1400824b8]
mov qword [rsp + 0x28], rax
lea r8, [0x14007ab4e]
lea rdx, [0x140082908]
mov dword [rsp + 0x20], 0x21
lea rcx, [0x1400824c8]
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
movups xmm0, xmmword [rsp + 0x30]
movzx eax, byte [rsp + 0x50]
movups xmm1, xmmword [rsp + 0x40]
mov byte [0x140090d38], al
movups xmmword [0x140090d18], xmm0
movups xmmword [0x140090d28], xmm1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14003d9a0
add rsp, 0x68
ret
Function at 0x140038a10
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x20
lea rdi, [0x140090d60]
mov qword [rsp + 0x30], rdi
xor ebx, ebx
mov qword [0x140091160], rbx
mov qword [0x140091168], rbx
lea ecx, [rbx + 0x48]
call fcn.14003dd3c
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [0x140091160], rax
mov qword [0x140091170], rbx
lea rax, [0x140083cc3]
mov qword [0x140091178], rax
mov qword [0x140091180], 0xf4241
mov qword [0x140091188], rbx
mov dword [0x140091190], 1
mov dword [0x140091194], 1
lea rax, str._Data
mov qword [0x140091198], rax
mov qword [0x1400911a0], 1
mov qword [0x1400911a8], rbx
xorps xmm0, xmm0
movdqa xmmword [0x1400911b0], xmm0
mov qword [0x1400911c0], rbx
mov dword [0x1400911c8], 1
movdqa xmmword [0x1400911d0], xmm0
mov qword [0x1400911e8], rbx
mov qword [0x1400911f0], 0xf
lea r8d, [rbx + 6]
lea rdx, str.010001
lea rcx, [0x1400911d8]
call fcn.140003fd0
nop
mov qword [0x1400911f8], rbx
mov qword [0x140091208], rbx
mov qword [0x140091210], 0xf
xor r8d, r8d
lea rdx, [0x14007abe2]
lea rcx, [0x1400911f8]
call fcn.140003fd0
mov qword [0x140091218], rbx
mov qword [0x140091228], rbx
mov qword [0x140091230], 0xf
mov dword [0x140091238], 1
mov r9, rdi
nop dword [rax]
mov eax, ebx
and al, 1
neg al
sbb ecx, ecx
and ecx, 0xedb88320
mov eax, ebx
shr eax, 1
xor ecx, eax
mov eax, ecx
and al, 1
neg al
sbb edx, edx
and edx, 0xedb88320
shr ecx, 1
xor edx, ecx
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
and ecx, 0xedb88320
shr edx, 1
xor ecx, edx
mov eax, ecx
and al, 1
neg al
sbb edx, edx
and edx, 0xedb88320
shr ecx, 1
xor edx, ecx
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
and ecx, 0xedb88320
shr edx, 1
xor ecx, edx
mov eax, ecx
and al, 1
neg al
sbb edx, edx
and edx, 0xedb88320
shr ecx, 1
xor edx, ecx
mov eax, edx
and al, 1
neg al
sbb r8d, r8d
and r8d, 0xedb88320
shr edx, 1
xor r8d, edx
mov eax, r8d
and al, 1
neg al
sbb ecx, ecx
and ecx, 0xedb88320
shr r8d, 1
xor ecx, r8d
mov dword [r9], ecx
inc ebx
lea r9, [r9 + 4]
cmp ebx, 0x100
jl 0x140038b60
mov rax, rdi
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x14004dc50
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14004da7c
Function at 0x1405833db
Capabilities:
Encode data using xor

Disassembly:
not esi
call fcn.1405a1613
mov ecx, 0xcbb13e9f
mov cx, word [r9]
mov ebx, 0x422f75a8
lea r9, [rbx + r9 - 0x422f75a6]
add rbx, rbx
sbb bx, bx
jbe 0x14059bc0b
lea rsp, [rsp + 0x18]
jmp 0x140573baa
lea rsp, [rsp + 0x18]
je 0x140598d5c
push r11
mov ebx, 0xf00e7b30
jmp 0x140598d06
mov r11d, ebx
lea rbx, [0x140583f20]
mov r11d, 0x7eb0211d
movzx r11d, byte [r8 + r11 - 0x7eb0211d]
push 0xc98988f
xor r11d, esi
push 0x70af1a1c
and r11d, 0xff
mov r11d, dword [rbx + r11*4]
shr esi, 8
ror qword [rsp + 5], 0x99
xor esi, r11d
inc r8
xor esi, 0x228e5284
dec rdx
lea rsp, [rsp + 0x10]
jne 0x140598d10
pop r11
jmp 0x140575eb6
sbb rdi, 1
bswap ebx
and rbx, rbx
movzx ebx, byte [rbx + rdi - 0x5e84]
xor bl, r8b
sub bl, 0xb6
push 0x6cabaeb8
xor word [rsp + 5], 0x9d91
neg bl
ror dword [rsp + 4], 0x79
not bl
inc byte [rsp + 7]
sbb bl, 0xa1
sub dword [rsp + 3], 0x89101321
xor qword [rsp], 0xffffffffcb3e4cad
xor r8b, bl
lea rbx, [rsp + rbx + 8]
mov byte [rbx], cl
push 0xffffffffb391431f
call fcn.14059c7ac
Function at 0x418000
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4181ab
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00434c40
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
nop
jne 0x41806e
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x418081
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x4180a5
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x4180b9
cmp rbx, 0x1000
jae 0x418078
nop
jmp 0x418129
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop
cmp rbx, 0x1000
jae 0x4180cd
xor edx, edx
jmp 0x418120
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00434c40
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
nop
test dl, dl
jne 0x4180af
jmp 0x418095
call fcn.00466160
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.00439400
lea rax, [0x0068f7a2]
mov ebx, 0x18
nop dword [rax + rax]
call fcn.00439d00
mov rax, qword [rsp + 0x38]
call fcn.00439a00
lea rax, [0x0068f8da]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.00439d00
mov rax, qword [rsp + 0x30]
call fcn.00439a00
call fcn.00439660
call fcn.00439480
lea rax, [0x006936a9]
mov ebx, 0x21
call fcn.00437b40
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004625a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00418000
Function at 0x4181e0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41840a
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.00434cc0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x41825b
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x41826e
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x418290
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x4182a4
cmp rbx, 0x1000
jae 0x418265
jmp 0x41832e
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x4182b6
xor esi, esi
jmp 0x418320
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
nop dword [rax]
call fcn.00434cc0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
test sil, sil
jne 0x41829a
jmp 0x418282
call fcn.00466160
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x4183a9
call fcn.00439400
lea rax, [0x0068fee8]
mov ebx, 0x19
call fcn.00439d00
mov rax, qword [rsp + 0x68]
call fcn.00439a00
lea rax, [0x0068f8da]
mov ebx, 0x19
nop
call fcn.00439d00
mov eax, dword [rsp + 0x34]
call fcn.00439a00
call fcn.00439660
call fcn.00439480
lea rax, [0x0068af02]
mov ebx, 0xd
call fcn.00437b40
cmp eax, 0x5af
je 0x418353
call fcn.00439400
lea rax, [0x0068fee8]
mov ebx, 0x19
call fcn.00439d00
mov rax, qword [rsp + 0x38]
call fcn.00439a00
lea rax, [0x0068f8da]
mov ebx, 0x19
nop dword [rax]
call fcn.00439d00
mov eax, dword [rsp + 0x34]
call fcn.00439a00
call fcn.00439660
call fcn.00439480
lea rax, [0x0069286f]
mov ebx, 0x1f
call fcn.00437b40
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004625a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004181e0
Function at 0x420ae0
Capabilities:
Hash data using murmur3

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
cmp byte [0x008c71e4], 0
jne 0x420bcf
nop
nop
nop
nop
sub rbx, qword [rax + 0x18]
nop
mov edx, dword [rax + 0x5c]
imul rbx, rdx
mov rdx, rbx
shr rbx, 0x20
nop
shr rdx, 0x23
and ebx, 7
mov rsi, rcx
mov rcx, rbx
mov edi, 1
shl edi, cl
nop
add rdx, qword [rax + 0x50]
lock or byte [rdx], dil
nop
nop
mov rcx, qword [rax + 0x18]
nop
movabs rdx, 0x800000000000
lea rax, [rdx + rcx]
mov rdx, rax
shr rax, 0x2a
cmp rax, 0x40
jae 0x420bc5
lea rbx, [0x00899630]
mov rax, qword [rbx + rax*8]
shr rdx, 0x16
and edx, 0xfffff
mov rdx, qword [rax + rdx*8]
test byte [rdx], al
test byte [rax], al
mov rax, rcx
shr rcx, 0x10
and ecx, 0x3f
movzx ebx, byte [rdx + rcx + 0x21040]
lea rdx, [rdx + rcx]
lea rdx, [rdx + 0x21040]
shr rax, 0xd
and eax, 7
mov rcx, rax
mov eax, 1
shl eax, cl
nop dword [rax]
test al, bl
jne 0x420ba7
lock or byte [rdx], al
mov rax, qword [r14 + 0x30]
mov rax, qword [rax + 0xa0]
test byte [rax], al
add qword [rax + 0x1250], rsi
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov ecx, 0x40
call fcn.00464ca0
lea rax, [0x0069715e]
mov ebx, 0x2c
nop dword [rax + rax]
call fcn.00437b40
nop
int3

Function at 0x423320
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x423421
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rbx
mov qword [rsp + 8], 0
jmp 0x423360
mov rax, qword [rsp + 0x50]
mov rcx, rdx
mov rbx, qword [rsp + 0x58]
nop
cmp qword [rsp + 8], rbx
jae 0x423411
test byte [rax], al
lea rcx, [rax + 0x100c0]
mov rax, rcx
call fcn.00423e80
nop dword [rax]
test rax, rax
je 0x423411
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x30], xmm15
lea rcx, [0x00423460]
mov qword [rsp + 0x10], rcx
mov rdx, qword [rsp + 0x50]
mov qword [rsp + 0x18], rdx
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rbx
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x30], rax
lea rbx, [rsp + 8]
mov qword [rsp + 0x38], rbx
lea rbx, [rsp + 0x10]
mov qword [rsp], rbx
call fcn.00462460
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x60]
test rdx, rdx
jne 0x4233ff
xor eax, eax
jmp 0x423409
mov rax, qword [rdx]
call rax
mov rdx, qword [rsp + 0x60]
test al, al
je 0x423352
mov rax, qword [rsp + 8]
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
nop
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.004625a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.00423320
Function at 0x430920
Capabilities:
Hash data using murmur3

Disassembly:
cmp rsp, qword [r14 + 0x18]
jbe 0x430bc6
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
test byte [rax], al
lea rsi, [rax + 0x1278]
mov rcx, qword [rax + 0x1268]
sub rcx, rsi
shr rcx, 3
cmp rcx, 0x200
ja 0x430bba
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x30], rcx
mov qword [rax + 0x1268], 0
cmp byte [0x008c71e4], 0
jne 0x430982
xor edx, edx
xor ebx, ebx
nop
jmp 0x4309ca
xor edx, edx
jmp 0x4309ad
mov qword [rsp + 0x28], rdx
mov rcx, qword [rax + rdx*8 + 0x1278]
mov rax, rcx
call fcn.00420300
mov rdx, qword [rsp + 0x28]
inc rdx
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
cmp rdx, rcx
jl 0x430986
add rax, 0x1268
call fcn.004307a0
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
inc rdx
cmp rdx, rcx
jge 0x430b54
mov rsi, qword [rax + rdx*8 + 0x1278]
nop dword [rax + rax]
cmp rsi, 0x1000
jb 0x4309c7
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rbx
mov rax, rsi
xor ebx, ebx
mov rcx, rbx
nop dword [rax + rax]
call fcn.004142a0
test rax, rax
jne 0x430a22
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
nop
jmp 0x4309c7
nop
mov rsi, rcx
shr rcx, 3
and esi, 7
mov rdx, rcx
mov rcx, rsi
mov r8d, 1
shl r8d, cl
nop
add rdx, qword [rbx + 0x50]
movzx esi, byte [rdx]
test r8b, sil
je 0x430a65
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
nop dword [rax]
jmp 0x4309c7
nop
lock or byte [rdx], r8b
nop
nop
mov rcx, qword [rbx + 0x18]
nop
movabs rsi, 0x800000000000
lea r8, [rsi + rcx]
mov r9, r8
shr r8, 0x2a
cmp r8, 0x40
jae 0x430bad
lea r10, [0x00899630]
mov r8, qword [r10 + r8*8]
shr r9, 0x16
and r9d, 0xfffff
mov r9, qword [r8 + r9*8]
test byte [r9], al
test byte [r8], al
mov r8, rcx
shr rcx, 0x10
and ecx, 0x3f
movzx r10d, byte [r9 + rcx + 0x21040]
lea r9, [r9 + rcx]
lea r9, [r9 + 0x21040]
shr r8, 0xd
and r8d, 7
mov rcx, r8
mov r8d, 1
shl r8d, cl
test r8b, r10b
jne 0x430aeb
lock or byte [r9], r8b
movzx r8d, byte [rbx + 0x62]
test r8b, 1
je 0x430b25
mov rax, qword [rsp + 0x48]
mov r8, qword [rax + 0x1250]
add r8, qword [rbx + 0x68]
mov qword [rax + 0x1250], r8
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
nop dword [rax]
jmp 0x4309c7
mov r8, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
cmp r8, rcx
jae 0x430ba5
mov rbx, qword [rsp + 0x48]
mov qword [rbx + r8*8 + 0x1278], rax
inc r8
mov rax, rbx
mov rdx, qword [rsp + 0x28]
mov rbx, r8
jmp 0x4309c7
cmp rbx, 0x200
ja 0x430b98
lea rdx, [rax + 0x1278]
lea rsi, [rax + 0x1240]
mov rcx, rbx
mov edi, 0x200
mov rbx, rdx
mov rax, rsi
call fcn.004264a0
mov rax, qword [rsp + 0x48]
add rax, 0x1268
call fcn.004307a0
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov rcx, rbx
mov edx, 0x200
call fcn.00464d00
mov rax, r8
call fcn.00464c80
mov rax, r8
mov ecx, 0x40
call fcn.00464ca0
mov edx, 0x200
nop
call fcn.00464ce0
nop
mov qword [rsp + 8], rax
call fcn.00466d00
mov rax, qword [rsp + 8]
jmp fcn.00430920
Function at 0x446160
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4462cf
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov ecx, dword [rax + 0x190]
mov edx, dword [rax + 0x194]
mov rsi, qword [rax + 0x998]
mov edi, dword [rax + 0x194]
cmp edi, edx
jne 0x446178
cmp edx, ecx
jne 0x4462bd
nop dword [rax]
test rsi, rsi
jne 0x4462bd
mov qword [rsp + 0x28], rax
test rbx, rbx
jne 0x4461d6
nop
call fcn.004665c0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rbx, qword [rsp]
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x10], rbx
nop dword [rax + rax]
call fcn.00446060
mov rcx, qword [0x00871ac8]
mov rdx, qword [0x00871ac0]
mov rbx, qword [rsp + 0x28]
mov esi, dword [rbx]
mov edi, esi
sar esi, 0x1f
shr esi, 0x1b
add esi, edi
sar esi, 5
mov r8d, esi
shl esi, 5
sub edi, esi
test edi, edi
jl 0x4462b8
cmp edi, 0x20
sbb esi, esi
mov rax, rcx
mov ecx, edi
mov r9d, 1
shl r9d, cl
and r9d, esi
movsxd rsi, r8d
cmp rax, rsi
jbe 0x4462ad
lea rcx, [rdx + rsi*4]
lock or dword [rcx], r9d
mov rcx, qword [0x00873d70]
mov qword [rbx + 8], rcx
nop
mov rcx, rbx
mov qword [0x00873d70], rbx
mov edx, 1
lea rsi, [0x00873d78]
lock xadd dword [rsi], edx
mov rdx, qword [rcx + 0x1228]
shr rdx, 0x3d
test dl, dl
jne 0x44629c
nop
nop
mov rax, qword [rsp + 0x10]
movabs rdx, 0x1fffffffffffffff
and rdx, rax
bts rdx, 0x3f
xchg qword [rcx + 0x1228], rdx
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x00696035]
mov ebx, 0x28
call fcn.00437b40
mov rcx, rax
mov rax, rsi
call fcn.00464c80
call fcn.00435f00
lea rax, [0x00694365]
mov ebx, 0x23
call fcn.00437b40
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004625a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00446160
Function at 0x452cc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov qword [rsp + 0x20], rax
test rbx, rbx
jbe 0x452e38
movzx edx, byte [rax]
nop
test edx, edx
jne 0x452cfc
test r8b, r8b
jne 0x452cfc
xor eax, eax
xor ebx, ebx
mov rcx, rbx
xor edi, edi
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
bt edx, 7
jae 0x452d0f
xor edx, edx
xor r8d, r8d
xor r9d, r9d
jmp 0x452df8
mov r8d, 1
mov r9d, edx
and edx, 1
neg edx
shr r9d, 1
xor edx, r9d
add dword [rsi], edx
cmp rbx, r8
jb 0x452de6
sub rbx, r8
sub rcx, r8
mov rdx, rcx
neg rcx
sar rcx, 0x3f
and r8, rcx
lea rsi, [rax + r8]
test rbx, rbx
jbe 0x452ddc
movzx r8d, byte [rax + r8]
bt r8d, 7
jae 0x452d63
xor eax, eax
xor ecx, ecx
xor r8d, r8d
jmp 0x452da6
mov eax, 1
cmp rax, rbx
ja 0x452d95
add qword [rdi], r8
sub rdx, rax
sub rbx, rax
mov rcx, rdx
neg rdx
sar rdx, 0x3f
and rax, rdx
add rax, rsi
mov edi, 1
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov rcx, rbx
call fcn.00464d40
lea r8d, [rcx + 7]
mov ecx, eax
mov eax, r10d
cmp rax, rbx
jae 0x452dd4
movzx r9d, byte [rax + rsi]
lea r10d, [rax + 1]
mov r11d, r9d
and r9d, 0x7f
mov eax, ecx
mov ecx, r8d
shl r9d, cl
or eax, r9d
test r11b, 0x80
jne 0x452d9d
mov r8d, eax
mov eax, r10d
jmp 0x452d68
mov rcx, rbx
call fcn.00464c80
xor eax, eax
mov rcx, rax
call fcn.00464c80
mov eax, r8d
mov rcx, rbx
call fcn.00464d40
lea r9d, [rcx + 7]
mov rcx, r12
cmp rbx, rdx
jbe 0x452e2e
movzx r10d, byte [rdx + rax]
inc edx
mov r11d, r10d
and r10d, 0x7f
mov r12, rcx
mov ecx, r9d
shl r10d, cl
or r8d, r10d
test r11b, 0x80
jne 0x452df1
mov rcx, r12
mov r9d, edx
mov edx, r8d
mov r8d, r9d
jmp 0x452d15
mov eax, edx
mov rcx, rbx
call fcn.00464c80
xor eax, eax
mov rcx, rax
nop dword [rax]
call fcn.00464c80
nop
int3