joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180406f79
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rax
pushf
mov eax, 0x77637592
pushf
not eax
add eax, 0x90d7c196
xor eax, 0xe1b358fe
rol eax, 0x26
popf
pushf
not eax
add eax, 0xa61138c6
xor eax, 0xc76076cc
rol eax, 0xc1
popf
pushf
not eax
add eax, 0xf728de70
xor eax, 0x90d1bf58
rol eax, 0x49
popf
cmp eax, 2
jne 0x180406fc9
popf
pop rax
jmp 0x18040713b
cmp eax, 0
jne 0x180406fd8
popf
pop rax
jmp 0x180406fe7
cmp eax, 1
jne 0x180406fe7
popf
pop rax
jmp 0x180407097
sub rsp, 0x38
mov rax, qword [0x180259f90]
mov r9, qword [rax + 0x3ed0]
mov r8, qword [r9 + 0x1a0]
cmp dword [r8 + 0x10], 1
je 0x180407064
push rax
pushf
mov eax, 0x187fe909
pushf
not eax
add eax, 0xb48c1b74
xor eax, 0xdbee0564
rol eax, 0xae
popf
pushf
not eax
add eax, 0xe936bf31
xor eax, 0xcfff39d0
rol eax, 0x7a
popf
pushf
not eax
add eax, 0x8090af71
xor eax, 0x9236c023
rol eax, 0x73
popf
pushf
not eax
add eax, 0xa21ba9fe
xor eax, 0xa829c9b8
rol eax, 0x91
popf
jmp 0x180406fba
push rax
pushf
mov eax, 0x6143d01
pushf
not eax
add eax, 0xffa88f8d
xor eax, 0xf41a7b4b
rol eax, 0x1c
popf
pushf
not eax
add eax, 0xbb02d6e7
xor eax, 0xba29f45a
rol eax, 0xdd
popf
jmp 0x180406fba
movups xmm0, xmmword [r9 + 0x230]
movups xmmword [r8 + 0x3c], xmm0
mov rax, qword [r9 + 0x290]
movups xmm0, xmmword [r8 + 0x2c]
movss xmm4, dword [r8 + 0x2c]
movss xmm3, dword [r8 + 0x30]
movss xmm2, dword [r8 + 0x34]
movss xmm1, dword [r8 + 0x38]
movups xmmword [r9 + 0x230], xmm0
movss dword [rsp + 0x20], xmm4
movss dword [rsp + 0x24], xmm3
movss dword [rsp + 0x28], xmm2
movss dword [rsp + 0x2c], xmm1
movss dword [rax + 0x88], xmm4
movss dword [rax + 0x8c], xmm3
movss dword [rax + 0x90], xmm2
movss dword [rax + 0x94], xmm1
mov rax, qword [r9 + 0x290]
movups xmm0, xmmword [rsp + 0x20]
movsxd rdx, dword [rax + 0x58]
mov rcx, qword [rax + 0x60]
add rdx, rdx
movups xmmword [rcx + rdx*8 - 0x10], xmm0
mov rdx, qword [r9 + 0x290]
lea rcx, [r8 + 0x70]
xor r8d, r8d
add rsp, 0x38
jmp fcn.1800b7690
add rsp, 0x38
ret
Function at 0x180426a43
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rax
pushf
mov eax, 0xf8ca3597
pushf
not eax
add eax, 0xfb1af47d
xor eax, 0x97f3beeb
rol eax, 0xec
popf
pushf
not eax
add eax, 0x82a47eae
xor eax, 0x81c73ef0
rol eax, 0x9e
popf
pushf
not eax
add eax, 0x96d5dbfa
xor eax, 0xb31ef6c1
rol eax, 0xff
popf
pushf
not eax
add eax, 0xa4785d42
xor eax, 0x9b073959
rol eax, 0x18
popf
cmp eax, 2
jne 0x180426aa6
popf
pop rax
jmp 0x180426c22
cmp eax, 0
jne 0x180426ab5
popf
pop rax
jmp 0x180426ac4
cmp eax, 1
jne 0x180426ac4
popf
pop rax
jmp 0x180426b87
sub rsp, 0x38
mov rax, qword [0x180259f90]
mov r10, qword [rax + 0x3ed0]
mov r9, qword [r10 + 0x1a0]
cmp dword [r9 + 0x10], 1
je 0x180426b2e
push rax
pushf
mov eax, 0x44f80d6f
pushf
not eax
add eax, 0xb5afa247
xor eax, 0xe6962e6a
rol eax, 0x11
popf
pushf
not eax
add eax, 0xb1565628
xor eax, 0x9227d6b6
rol eax, 0xf2
popf
pushf
not eax
add eax, 0xeeb80c1b
xor eax, 0xf16d6c27
rol eax, 0xd5
popf
jmp 0x180426a97
push rax
pushf
mov eax, 0xb5b74e90
pushf
not eax
add eax, 0xb1cacfcf
xor eax, 0xaf397685
rol eax, 0x54
popf
pushf
not eax
add eax, 0xcde2e37c
xor eax, 0xd5d29dc8
rol eax, 0x94
popf
pushf
not eax
add eax, 0x8926763f
xor eax, 0x9ee52a79
rol eax, 0x60
popf
pushf
not eax
add eax, 0xd4ada468
xor eax, 0x8e74c832
rol eax, 0xe4
popf
jmp 0x180426a97
movups xmm0, xmmword [r9 + 0x3c]
mov rax, qword [r10 + 0x290]
movss xmm4, dword [r9 + 0x3c]
movss xmm3, dword [r9 + 0x40]
movss xmm2, dword [r9 + 0x44]
movss xmm1, dword [r9 + 0x48]
movups xmmword [r10 + 0x230], xmm0
movss dword [rsp + 0x20], xmm4
movss dword [rsp + 0x24], xmm3
movss dword [rsp + 0x28], xmm2
movss dword [rsp + 0x2c], xmm1
movss dword [rax + 0x88], xmm4
movss dword [rax + 0x8c], xmm3
movss dword [rax + 0x90], xmm2
movss dword [rax + 0x94], xmm1
mov rax, qword [r10 + 0x290]
movups xmm0, xmmword [rsp + 0x20]
movsxd rdx, dword [rax + 0x58]
mov rcx, qword [rax + 0x60]
add rdx, rdx
movups xmmword [rcx + rdx*8 - 0x10], xmm0
mov r8d, dword [r9 + 0xc]
lea rcx, [r9 + 0x70]
mov rdx, qword [r10 + 0x290]
inc r8d
add rsp, 0x38
jmp fcn.1800b7690
add rsp, 0x38
ret
Function at 0x180426cd5
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rax
pushf
mov eax, 0xb4af2fcc
pushf
not eax
add eax, 0xc5a12038
xor eax, 0xad466d80
rol eax, 0xf7
popf
pushf
not eax
add eax, 0xf050a962
xor eax, 0xba6d3797
rol eax, 0x91
popf
pushf
not eax
add eax, 0x97df0745
xor eax, 0xa3d6870b
rol eax, 0x1b
popf
cmp eax, 2
jne 0x180426d25
popf
pop rax
jmp 0x180426dfb
cmp eax, 0
jne 0x180426d34
popf
pop rax
jmp 0x180426d43
cmp eax, 1
jne 0x180426d43
popf
pop rax
jmp 0x180426dea
push rbx
sub rsp, 0x20
mov rbx, rcx
lea rax, [rcx + 0xd4]
mov ecx, 0x87b1dfca
pushf
not ecx
add ecx, 0xe338744f
xor ecx, 0x9ca14aa5
rol ecx, 0x73
popf
pushf
not ecx
add ecx, 0xba6e1a2c
xor ecx, 0xb65636ee
rol ecx, 0x9b
popf
pushf
not ecx
add ecx, 0x9bf60065
xor ecx, 0xe49dd5bd
rol ecx, 0xf
popf
pushf
not ecx
add ecx, 0x8802901c
xor ecx, 0x8dfdc26b
rol ecx, 0x46
popf
xor edx, edx
nop word [rax + rax]
push rax
pushf
mov eax, 0xdcc9a0ec
pushf
not eax
add eax, 0x8f8612f4
xor eax, 0x9230eedc
rol eax, 0xe0
popf
pushf
not eax
add eax, 0xe88df140
xor eax, 0xc8015564
rol eax, 0x18
popf
jmp 0x180426d16
mov qword [rax], rdx
mov qword [rax + 8], rdx
lea rax, [rax + 0x10]
sub rcx, 1
jne 0x180426dea
mov rcx, rbx
mov dword [rbx], 0x3f800000
mov dword [rbx + 4], 0x3f19999a
mov dword [rbx + 8], 0x41000000
mov qword [rbx + 0xc], 0x41000000
mov dword [rbx + 0x14], 0x3f800000
mov dword [rbx + 0x18], 0x42000000
mov qword [rbx + 0x1c], 0x42000000
mov qword [rbx + 0x24], 0x3f000000
mov dword [rbx + 0x2c], edx
mov qword [rbx + 0x30], 0x3f800000
mov dword [rbx + 0x38], 0x3f800000
mov dword [rbx + 0x3c], 0x40800000
mov qword [rbx + 0x40], 0x40400000
mov dword [rbx + 0x48], edx
mov dword [rbx + 0x4c], 0x41000000
mov dword [rbx + 0x50], 0x40800000
mov dword [rbx + 0x54], 0x40800000
mov dword [rbx + 0x58], 0x40800000
mov dword [rbx + 0x5c], 0x40800000
mov qword [rbx + 0x60], 0x40000000
mov dword [rbx + 0x68], edx
mov dword [rbx + 0x6c], 0x41a80000
mov dword [rbx + 0x70], 0x40c00000
mov dword [rbx + 0x74], 0x41600000
mov dword [rbx + 0x78], 0x41100000
mov qword [rbx + 0x7c], 0x41400000
mov dword [rbx + 0x84], 0x40800000
mov qword [rbx + 0x88], 0x40800000
mov dword [rbx + 0x90], edx
mov dword [rbx + 0x94], 1
mov dword [rbx + 0x98], 0x3f000000
mov qword [rbx + 0x9c], 0x3f000000
mov dword [rbx + 0xa4], edx
mov dword [rbx + 0xa8], 0x41980000
mov dword [rbx + 0xac], 0x41980000
mov dword [rbx + 0xb0], 0x40400000
mov dword [rbx + 0xb4], 0x40400000
mov dword [rbx + 0xb8], 0x3f800000
mov word [rbx + 0xbc], 0x101
mov byte [rbx + 0xbe], 1
mov dword [rbx + 0xc0], 0x3fa00000
mov dword [rbx + 0xc4], 0x3e99999a
mov qword [rbx + 0xc8], 0x42c80000
mov dword [rbx + 0xd0], 0x3f490fdb
call fcn.1802d391a
mov rax, rbx
add rsp, 0x20
pop rbx
ret
Function at 0x18044efe7
Capabilities:
Manually build aes constants

Disassembly:
push rax
pushf
mov eax, 0xa2b017f7
pushf
not eax
add eax, 0x98135dcb
xor eax, 0xbf994ffc
rol eax, 0xa2
popf
pushf
not eax
add eax, 0xcadf7179
xor eax, 0x9ef748bb
rol eax, 0x11
popf
cmp eax, 0
jne 0x18044f024
popf
pop rax
jmp 0x18044f024
xor r8d, r8d
jmp fcn.1803ec2d8
Function at 0x18046819b
Capabilities:
Hash data using murmur3

Disassembly:
push rax
pushf
mov eax, 0xd5824f8e
pushf
not eax
add eax, 0xbaf96ab9
xor eax, 0xa275009c
rol eax, 0xec
popf
pushf
not eax
add eax, 0x99319f77
xor eax, 0xf18a5cdc
rol eax, 0xa4
popf
pushf
not eax
add eax, 0xb06cd00a
xor eax, 0xf8b1af3f
rol eax, 0xde
popf
pushf
not eax
add eax, 0xa7d2aa31
xor eax, 0xf9ccaad9
rol eax, 0xf
popf
cmp eax, 4
jne 0x1804681fe
popf
pop rax
jmp 0x1804683d2
cmp eax, 0
jne 0x18046820d
popf
pop rax
jmp 0x180468249
cmp eax, 3
jne 0x18046821c
popf
pop rax
jmp 0x180468368
cmp eax, 1
jne 0x18046822b
popf
pop rax
jmp 0x1804682db
cmp eax, 5
jne 0x18046823a
popf
pop rax
jmp 0x180468414
cmp eax, 2
jne 0x180468249
popf
pop rax
jmp 0x180468339
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ebx, r8d
mov edi, edx
mov eax, ecx
test ecx, 0xf800
je 0x1804682a8
push rax
pushf
mov eax, 0x5a94491
pushf
not eax
add eax, 0x8d46e139
xor eax, 0x98d0e0f5
rol eax, 0x4c
popf
pushf
not eax
add eax, 0xdf3de9e3
xor eax, 0xc2385926
rol eax, 0x67
popf
pushf
not eax
add eax, 0x8b1d5af3
xor eax, 0xeacdf694
rol eax, 0x7e
popf
jmp 0x1804681ef
push rax
pushf
mov eax, 0x76221fae
pushf
not eax
add eax, 0xd166457c
xor eax, 0xcaeeee02
rol eax, 0xe5
popf
pushf
not eax
add eax, 0xd7e1df69
xor eax, 0xa2887576
rol eax, 0xf5
popf
jmp 0x1804681ef
call fcn.18030c107
push rax
pushf
mov eax, 0x7c2920ac
pushf
not eax
add eax, 0xa96061af
xor eax, 0x87dcc167
rol eax, 0xd4
popf
pushf
not eax
add eax, 0xcf442941
xor eax, 0xd40718ec
rol eax, 0xd1
popf
pushf
not eax
add eax, 0xd2a15548
xor eax, 0xb8ce6c67
rol eax, 0x79
popf
pushf
not eax
add eax, 0xae550d97
xor eax, 0x94eadeac
rol eax, 0x5f
popf
jmp 0x1804681ef
cdqe
mov edx, ebx
add rax, 0x34a
shr edx, 7
and dl, 1
lea rcx, [rax + rax*2]
mov rax, qword [0x180259f90]
mov dword [rax + rcx*4 + 4], edi
mov dword [rax + rcx*4], edi
mov byte [rax + rcx*4 + 9], dl
test bl, 0x40
jne 0x180468414
test dl, dl
jne 0x18046839f
push rax
pushf
mov eax, 0x8cc8ea6a
pushf
not eax
add eax, 0xdcd7f3cb
xor eax, 0xf6871a03
rol eax, 0xd
popf
pushf
not eax
add eax, 0x87b66acd
xor eax, 0x8549f57b
rol eax, 0xbb
popf
jmp 0x1804681ef
push rax
pushf
mov eax, 0x50f9d69a
pushf
not eax
add eax, 0xb3cca8df
xor eax, 0xee58e2ee
rol eax, 0x51
popf
pushf
not eax
add eax, 0xeb3dfe10
xor eax, 0x89e2e4fb
rol eax, 0x6f
popf
jmp 0x1804681ef
mov byte [rax + rcx*4 + 8], dl
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
mov byte [rax + rcx*4 + 8], 1
add rsp, 0x20
pop rdi
ret
Function at 0x140018240
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x1400183cb
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [0x14024a050]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.140036da0
xorps xmm15, xmm15
mov r14, qword [0x140594ca0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x1400182a5
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x1400182b4
add rsp, 0x48
pop rbp
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x1400182d3
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x1400182e3
cmp rbx, 0x1000
jae 0x1400182ab
jmp 0x14001834d
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x1400182f5
xor edx, edx
jmp 0x140018344
mov rcx, qword [0x14024a050]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.140036da0
xorps xmm15, xmm15
mov r14, qword [0x140594ca0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x1400182d9
jmp 0x1400182c8
call fcn.14006d880
xorps xmm15, xmm15
mov r14, qword [0x140594ca0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.14003b2e0
lea rax, [0x1402ebe6a]
mov ebx, 0x18
nop dword [rax]
call fcn.14003bb60
mov rax, qword [rsp + 0x38]
call fcn.14003b8a0
lea rax, [0x1402ec6cb]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.14003bb60
mov rax, qword [rsp + 0x30]
call fcn.14003b8a0
call fcn.14003b520
call fcn.14003b340
lea rax, [0x1402f013f]
mov ebx, 0x21
call fcn.140039840
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.14006a120
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.140018240
Function at 0x140018400
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x140018626
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [0x14024a048]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.140036e20
xorps xmm15, xmm15
mov r14, qword [0x140594ca0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x140018473
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x140018482
add rsp, 0x50
pop rbp
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x1400184a5
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x1400184b5
cmp rbx, 0x1000
jae 0x140018479
nop
jmp 0x140018538
add rsp, 0x50
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop word [rax + rax]
cmp rbx, 0x1000
jae 0x1400184cd
xor esi, esi
jmp 0x14001852a
mov rax, qword [0x14024a048]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.140036e20
xorps xmm15, xmm15
mov r14, qword [0x140594ca0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x1400184ab
jmp 0x140018496
call fcn.14006d880
xorps xmm15, xmm15
mov r14, qword [0x140594ca0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x1400185c0
nop dword [rax + rax]
call fcn.14003b2e0
lea rax, [0x1402ec6e4]
mov ebx, 0x19
call fcn.14003bb60
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
call fcn.14003b8a0
lea rax, [0x1402ec6cb]
mov ebx, 0x19
call fcn.14003bb60
mov eax, dword [rsp + 0x34]
call fcn.14003b8a0
nop
call fcn.14003b520
call fcn.14003b340
lea rax, [0x1402e5e62]
mov ebx, 0xd
call fcn.140039840
nop dword [rax + rax]
cmp eax, 0x5af
je 0x140018560
call fcn.14003b2e0
lea rax, [0x1402ec6e4]
mov ebx, 0x19
call fcn.14003bb60
mov rax, qword [rsp + 0x38]
call fcn.14003b8a0
lea rax, [0x1402ec6cb]
mov ebx, 0x19
call fcn.14003bb60
mov eax, dword [rsp + 0x34]
nop dword [rax]
call fcn.14003b8a0
call fcn.14003b520
call fcn.14003b340
lea rax, [0x1402ef441]
mov ebx, 0x1f
nop dword [rax + rax]
call fcn.140039840
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.14006a120
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.140018400
Function at 0x140022400
Capabilities:
Hash data using murmur3

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
cmp byte [0x140594994], 0
jne 0x1400224f0
sub rbx, qword [rax + 0x18]
mov rdx, qword [rax + 0x48]
test byte [rdx], al
mov ecx, dword [rax + 0x5c]
imul rcx, rbx
mov rbx, rcx
shr rbx, 0x20
shr rcx, 0x23
and ebx, 7
mov rsi, rcx
mov rcx, rbx
mov edi, 1
shl edi, cl
add rdx, rsi
nop
nop
nop
nop
lock or byte [rdx], dil
mov rcx, qword [rax + 0x18]
movabs rdx, 0x800000000000
add rdx, rcx
mov rbx, rdx
shr rdx, 0x2a
nop
nop
nop
cmp rdx, 0x40
jae 0x1400224e3
lea rsi, [0x140526a98]
mov rdx, qword [rsi + rdx*8]
test byte [rdx], al
mov rsi, rcx
shr rsi, 0x10
and esi, 0x3f
shr rcx, 0xd
and ecx, 7
mov edi, 1
shl edi, cl
shr rbx, 0x16
and ebx, 0xfffff
mov rdx, qword [rdx + rbx*8]
test byte [rdx], al
movzx ebx, byte [rdx + rsi + 0x1040]
lea rdx, [rdx + rsi]
lea rdx, [rdx + 0x1040]
test dil, bl
jne 0x1400224be
lock or byte [rdx], dil
mov rcx, qword [r14 + 0x30]
mov rcx, qword [rcx + 0xa0]
test byte [rcx], al
mov rdx, qword [rcx + 0x1270]
add rdx, qword [rax + 0x68]
mov qword [rcx + 0x1270], rdx
add rsp, 0x10
pop rbp
ret
mov rax, rdx
mov ecx, 0x40
call fcn.14006c440
lea rax, [0x1402f3b7f]
mov ebx, 0x2c
nop dword [rax]
call fcn.140039840
nop
int3

Function at 0x140024940
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x140024a46
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov byte [rsp + 0x70], dil
mov qword [rsp + 0x10], 0
jmp 0x140024983
mov rax, qword [rsp + 0x58]
mov rcx, rdx
mov rbx, qword [rsp + 0x60]
movzx edi, byte [rsp + 0x70]
cmp qword [rsp + 0x10], rbx
jae 0x140024a3b
test byte [rax], al
lea rcx, [rax + 0x100b8]
mov ebx, edi
mov rax, rcx
nop dword [rax]
call fcn.140025720
test rax, rax
je 0x140024a3b
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
lea rcx, [0x140024a80]
mov qword [rsp + 0x18], rcx
lea rdx, [rsp + 0x10]
mov qword [rsp + 0x20], rdx
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x40], rax
lea rbx, [rsp + 0x18]
mov qword [rsp], rbx
nop dword [rax]
call fcn.14006a000
xorps xmm15, xmm15
mov r14, qword [0x140594ca0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x68]
nop dword [rax]
test rdx, rdx
jne 0x140024a29
xor eax, eax
jmp 0x140024a33
mov rax, qword [rdx]
call rax
mov rdx, qword [rsp + 0x68]
test al, al
je 0x140024971
mov rax, qword [rsp + 0x10]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov byte [rsp + 0x20], dil
call fcn.14006a120
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movzx edi, byte [rsp + 0x20]
jmp fcn.140024940
Function at 0x1400314e0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x1400315d9
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rax + 0x108], 0
mov ecx, dword [0x140595350]
test ecx, ecx
je 0x1400315b2
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x10], 0
lea rcx, [rsp + 0x60]
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x30], xmm15
movups xmmword [rsp + 0x40], xmm15
lea rdx, [0x140031600]
mov qword [rsp + 0x18], rdx
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], rcx
mov rcx, r14
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x10]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], 3
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x18]
mov qword [rsp], rcx
call fcn.14006a000
xorps xmm15, xmm15
mov r14, qword [0x140594ca0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x10]
cmp rax, 0x20
jge 0x1400315ac
jae 0x1400315ce
mov rcx, qword [rsp + 0x60]
mov qword [rcx + rax*8 + 8], 0
add rsp, 0x50
pop rbp
ret
lea rcx, [fcn.1400469e0]
inc rcx
mov qword [rax + 8], rcx
mov qword [rax + 0x10], 0
add rsp, 0x50
pop rbp
ret
mov ecx, 0x20
call fcn.14006c420
nop
mov qword [rsp + 8], rax
nop
call fcn.14006a120
mov rax, qword [rsp + 8]
jmp fcn.1400314e0
Function at 0x140033820
Capabilities:
Hash data using murmur3

Disassembly:
cmp rsp, qword [r14 + 0x18]
jbe 0x140033aa6
push rbp
mov rbp, rsp
sub rsp, 0x38
test byte [rax], al
lea rsi, [rax + 0x1298]
mov rcx, qword [rax + 0x1288]
sub rcx, rsi
shr rcx, 3
cmp rcx, 0x200
ja 0x140033a9a
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x30], rcx
mov qword [rax + 0x1288], 0
cmp byte [0x140594994], 0
jne 0x14003387a
xor edx, edx
xor ebx, ebx
jmp 0x1400338c0
xor edx, edx
jmp 0x1400338a5
mov qword [rsp + 0x28], rdx
mov rcx, qword [rax + rdx*8 + 0x1298]
mov rax, rcx
call fcn.140021c60
mov rdx, qword [rsp + 0x28]
inc rdx
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
cmp rdx, rcx
jl 0x14003387e
add rax, 0x1288
call fcn.1400337a0
add rsp, 0x38
pop rbp
ret
inc rdx
nop
cmp rdx, rcx
jge 0x140033a34
mov rsi, qword [rax + rdx*8 + 0x1298]
cmp rsi, 0x1000
jb 0x1400338bb
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rbx
mov rax, rsi
xor ebx, ebx
mov rcx, rbx
call fcn.140015540
test rax, rax
jne 0x14003390c
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
jmp 0x1400338bb
mov rsi, qword [rbx + 0x48]
test byte [rsi], al
mov r8, rcx
shr r8, 3
movzx r9d, byte [rsi + r8]
and ecx, 7
mov r10d, 1
shl r10d, cl
nop
add rsi, r8
test r10b, r9b
je 0x14003394c
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
jmp 0x1400338bb
nop
lock or byte [rsi], r10b
mov rcx, qword [rbx + 0x18]
movabs rsi, 0x800000000000
lea r8, [rsi + rcx]
mov r9, r8
shr r8, 0x2a
nop
nop
nop
cmp r8, 0x40
jae 0x140033a8d
lea r10, [0x140526a98]
mov r8, qword [r10 + r8*8]
test byte [r8], al
mov r10, rcx
shr r10, 0x10
and r10d, 0x3f
shr rcx, 0xd
and ecx, 7
mov r11d, 1
shl r11d, cl
shr r9, 0x16
and r9d, 0xfffff
mov r8, qword [r8 + r9*8]
test byte [r8], al
movzx r9d, byte [r8 + r10 + 0x1040]
lea r8, [r8 + r10]
lea r8, [r8 + 0x1040]
test r11b, r9b
jne 0x1400339cf
lock or byte [r8], r11b
movzx r8d, byte [rbx + 0x62]
test r8b, 1
je 0x140033a05
mov rax, qword [rsp + 0x48]
mov r8, qword [rax + 0x1270]
add r8, qword [rbx + 0x68]
mov qword [rax + 0x1270], r8
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
jmp 0x1400338bb
mov r8, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
cmp r8, rcx
jae 0x140033a85
mov rbx, qword [rsp + 0x48]
mov qword [rbx + r8*8 + 0x1298], rax
inc r8
mov rax, rbx
mov rdx, qword [rsp + 0x28]
mov rbx, r8
jmp 0x1400338bb
cmp rbx, 0x200
ja 0x140033a74
lea rdx, [rax + 0x1298]
lea rsi, [rax + 0x1260]
mov rcx, rbx
mov edi, 0x200
mov rbx, rdx
mov rax, rsi
call fcn.140028740
mov rax, qword [rsp + 0x48]
add rax, 0x1288
call fcn.1400337a0
add rsp, 0x38
pop rbp
ret
mov rcx, rbx
mov edx, 0x200
nop dword [rax]
call fcn.14006c4a0
mov rax, r8
call fcn.14006c420
mov rax, r8
mov ecx, 0x40
call fcn.14006c440
mov edx, 0x200
nop
call fcn.14006c480
nop
mov qword [rsp + 8], rax
call fcn.140070d00
mov rax, qword [rsp + 8]
jmp fcn.140033820
Function at 0x1400498e0
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x140049a47
push rbp
mov rbp, rsp
sub rsp, 0x18
mov ecx, dword [rax + 0x190]
mov edx, dword [rax + 0x194]
mov rsi, qword [rax + 0x998]
mov edi, dword [rax + 0x194]
cmp edi, edx
jne 0x1400498f2
cmp edx, ecx
jne 0x140049a35
nop word [rax + rax]
test rsi, rsi
jne 0x140049a35
mov qword [rsp + 0x28], rax
test rbx, rbx
jne 0x140049954
nop
call fcn.14006dd40
xorps xmm15, xmm15
mov r14, qword [0x140594ca0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rbx, qword [rsp]
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x10], rbx
call fcn.140049800
mov rcx, qword [rsp + 0x28]
mov edx, dword [rcx]
mov ebx, edx
sar edx, 0x1f
shr edx, 0x1b
add edx, ebx
mov esi, edx
and edx, 0xffffffe0
sub ebx, edx
test ebx, ebx
jl 0x140049a30
mov rdx, qword [0x14050dfd8]
sar esi, 5
mov rax, rcx
mov ecx, ebx
mov edi, 1
shl edi, cl
movsxd rsi, esi
cmp ecx, 0x20
sbb r8d, r8d
and edi, r8d
cmp rdx, rsi
jbe 0x140049a25
mov rcx, qword [0x14050dfd0]
lea rcx, [rcx + rsi*4]
lock or dword [rcx], edi
mov rcx, qword [0x140510f90]
mov qword [rax + 8], rcx
mov rcx, rax
nop
mov qword [0x140510f90], rax
nop
mov edx, 1
lea rsi, [0x140510f98]
lock xadd dword [rsi], edx
mov rdx, qword [rcx + 0x1248]
shr rdx, 0x3d
test dl, dl
jne 0x140049a13
mov rax, qword [rsp + 0x10]
movabs rdx, 0x1fffffffffffffff
and rdx, rax
bts rdx, 0x3f
nop
nop
xchg qword [rcx + 0x1248], rdx
add rsp, 0x18
pop rbp
ret
lea rax, [0x1402f2ac8]
mov ebx, 0x28
nop
call fcn.140039840
mov rax, rsi
mov rcx, rdx
call fcn.14006c420
call fcn.1400380c0
lea rax, [0x1402f0dac]
mov ebx, 0x23
call fcn.140039840
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.14006a120
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.1400498e0