joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000f322
Capabilities:
Hash data using murmur3

Disassembly:
push rax
pushf
mov eax, 0x4fdf19a7
pushf
not eax
add eax, 0xeb3d221a
xor eax, 0xd65b2ac8
rol eax, 0xd
popf
pushf
not eax
add eax, 0xed0aef96
xor eax, 0xb7c24daa
rol eax, 0xbf
popf
pushf
not eax
add eax, 0xc098ccc9
xor eax, 0xc0dfd899
rol eax, 0xf
popf
cmp eax, 2
jne 0x14000f372
popf
pop rax
jmp 0x14000f42f
cmp eax, 0
jne 0x14000f381
popf
pop rax
jmp 0x14000f39f
cmp eax, 3
jne 0x14000f390
popf
pop rax
jmp 0x14000f469
cmp eax, 1
jne 0x14000f39f
popf
pop rax
jmp 0x14000f42b
push rbx
sub rsp, 0x20
mov bl, cl
call fcn.14000a498
xor edx, edx
test eax, eax
je 0x14000f3f8
push rax
pushf
mov eax, 0x3bebd09
pushf
not eax
add eax, 0xdc79cada
xor eax, 0xbdfa77a5
rol eax, 0xd8
popf
pushf
not eax
add eax, 0x835e0f01
xor eax, 0xeac0e78d
rol eax, 0xc0
popf
pushf
not eax
add eax, 0x8726e9a2
xor eax, 0x9fecbf96
rol eax, 0xef
popf
jmp 0x14000f363
push rax
pushf
mov eax, 0xde5107ec
pushf
not eax
add eax, 0xdff82fca
xor eax, 0xcedb78f4
rol eax, 0x80
popf
pushf
not eax
add eax, 0x97fb9a6f
xor eax, 0xc87f3b46
rol eax, 0x60
popf
jmp 0x14000f363
test bl, bl
jne 0x14000f469
xchg qword [0x1400055b8], rdx
push rax
pushf
mov eax, 0xe2db5fdf
pushf
not eax
add eax, 0xdf279e4f
xor eax, 0xfb223549
rol eax, 0xa1
popf
pushf
not eax
add eax, 0xd13a3d6b
xor eax, 0xc246271e
rol eax, 0xcd
popf
jmp 0x14000f363
add rsp, 0x20
pop rbx
ret
Function at 0x140003f60
Capabilities:
Write file on windows

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x14003a120]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, 0xffff
movzx esi, dx
mov rbx, rcx
cmp di, dx
jne 0x140003f91
xor eax, eax
jmp 0x1400040df
mov rax, qword [rcx + 0x40]
mov r8, qword [rax]
test r8, r8
je 0x140003fce
mov r9, qword [rcx + 0x58]
movsxd r10, dword [r9]
lea rdx, [r8 + r10*2]
cmp r8, rdx
jae 0x140003fce
lea ecx, [r10 - 1]
movzx eax, si
mov dword [r9], ecx
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 2]
mov qword [rdx], rcx
mov word [r8], si
jmp 0x1400040df
cmp qword [rcx + 0x80], 0
mov qword [rsp + 0xb0], rbp
je 0x1400040d4
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x140004015
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub rdx, rcx
mov rax, qword [rbx + 0x38]
sar rdx, 1
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x14000403e
movzx ecx, si
mov rdx, qword [rbx + 0x80]
call fcn.14000f7d8
cmp ax, di
je 0x1400040d4
movzx edi, si
jmp 0x1400040d4
lea r8, [rsp + 0x40]
mov word [rsp + 0x50], si
mov rax, qword [rcx]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x38], r8
lea r9, [rsp + 0x52]
lea r8, [rsp + 0x78]
mov qword [rsp + 0x30], r8
lea r8, [rsp + 0x58]
mov qword [rsp + 0x28], r8
lea r8, [rsp + 0x48]
mov qword [rsp + 0x20], r8
lea r8, [rsp + 0x50]
call qword [rax + 0x38]
test eax, eax
js 0x1400040d4
cmp eax, 1
jle 0x140004094
cmp eax, 3
jne 0x1400040d4
movzx ecx, word [rsp + 0x50]
jmp 0x140004021
mov rbp, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rbp, rax
je 0x1400040c1
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rbp
mov edx, 1
call fcn.140010254
cmp rbp, rax
jne 0x1400040d4
lea rax, [rsp + 0x50]
mov byte [rbx + 0x72], 1
cmp qword [rsp + 0x48], rax
movzx eax, si
jne 0x1400040d7
movzx eax, di
mov rbp, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140008da0
add rsp, 0x80
pop rdi
pop rsi
pop rbx
ret
Function at 0x140004880
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x14003a120]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140004954
cmp byte [rcx + 0x72], 0
je 0x140004954
mov rax, qword [rcx]
mov qword [rsp + 0x78], rdi
mov edi, 0xffff
mov edx, edi
call qword [rax + 0x18]
cmp di, ax
je 0x140004950
mov rcx, qword [rbx + 0x68]
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], r8
lea rdx, [rbx + 0x74]
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
mov rax, qword [rcx]
call qword [rax + 0x40]
test eax, eax
je 0x140004916
sub eax, 1
je 0x14000491a
cmp eax, 2
jne 0x140004950
mov byte [rbx + 0x72], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140008da0
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x72], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140004947
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call fcn.140010254
cmp rdi, rax
jne 0x140004950
cmp byte [rbx + 0x72], 0
sete al
jmp 0x1400048fe
xor al, al
jmp 0x1400048fe
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140008da0
add rsp, 0x60
pop rbx
ret
Function at 0x14000efb4
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x14000ee47
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000ee47
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000ee47
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000ee47
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000ee47
cmp dword [rcx + 0x84], 0xe
jbe 0x14000ee47
cmp dword [rcx + 0xf8], 0
je 0x14000ee47
mov ecx, ebx
call fcn.14000eee8
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.14000ecd8
cmp dword [rbp + 0x20], 0
je 0x14000ee94
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14000ee9c
int3
xor r8d, r8d
xor edx, edx
jmp 0x14000ede0
Function at 0x1400196c8
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
jne 0x1400193ee
call fcn.140010c28
mov dword [rax], 0x16
call fcn.140010ad0
jmp 0x140019539
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x140019539
mov eax, dword [rcx + 0x14]
shr eax, 0xc
test al, 1
jne 0x140019539
mov eax, dword [rcx + 0x14]
shr eax, 1
test al, 1
je 0x14001941d
lock or dword [rcx + 0x14], 0x10
jmp 0x140019539
lock or dword [rcx + 0x14], 1
mov eax, dword [rcx + 0x14]
test eax, 0x4c0
jne 0x140019431
call fcn.140019350
mov esi, dword [rbx + 0x10]
cmp esi, 1
jne 0x140019441
mov rax, qword [rbx]
mov bpl, byte [rax]
jmp 0x140019444
xor bpl, bpl
mov rdi, qword [rbx + 8]
mov rcx, rbx
mov qword [rbx], rdi
call fcn.140018854
mov r8d, dword [rbx + 0x20]
mov ecx, eax
mov rdx, rdi
call fcn.140021544
mov dword [rbx + 0x10], eax
lea ecx, [rax + 1]
cmp ecx, 2
jbe 0x140019527
mov eax, dword [rbx + 0x14]
test al, 6
jne 0x1400194d5
mov rcx, rbx
call fcn.140018854
cmp eax, 0xffffffff
je 0x1400194c0
mov rcx, rbx
call fcn.140018854
cmp eax, 0xfffffffe
je 0x1400194c0
mov rcx, rbx
call fcn.140018854
movsxd rdi, eax
lea r14, [0x14003c470]
mov rcx, rbx
sar rdi, 6
call fcn.140018854
and eax, 0x3f
lea rcx, [rax + rax*8]
mov rax, qword [r14 + rdi*8]
lea rdx, [rax + rcx*8]
jmp 0x1400194c7
lea rdx, [0x14003a4c0]
mov al, byte [rdx + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x1400194d5
lock or dword [rbx + 0x14], 0x20
cmp dword [rbx + 0x20], 0x200
jne 0x1400194f9
mov eax, dword [rbx + 0x14]
shr eax, 6
test al, 1
je 0x1400194f9
mov eax, dword [rbx + 0x14]
shr eax, 8
test al, 1
jne 0x1400194f9
mov dword [rbx + 0x20], 0x1000
mov rax, qword [rbx]
cmp esi, 1
jne 0x140019517
movzx ecx, byte [rax]
dec dword [rbx + 0x10]
shl cx, 8
movzx eax, bpl
or cx, ax
inc qword [rbx]
jmp 0x140019522
movzx ecx, word [rax]
add dword [rbx + 0x10], 0xfffffffe
add qword [rbx], 2
movzx eax, cx
jmp 0x14001953e
neg eax
sbb eax, eax
and eax, 8
add eax, 8
lock or dword [rbx + 0x14], eax
and dword [rbx + 0x10], 0
mov eax, 0xffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
jmp 0x1400193b8
Function at 0x140001010
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
mov dword [rsp + 0x68], 0x2da5297e
call fcn.1400014e0
mov rcx, rax
mov edx, 0xb9f2133d
call fcn.140001228
call rax
mov rbx, rax
call fcn.140001502
mov rcx, rax
mov edx, 0x278e4f75
call fcn.140001228
mov ebp, 0xa8
mov edx, 8
mov r8d, ebp
mov rcx, rbx
call rax
mov rsi, rax
call fcn.140001521
mov rbx, rax
lea rcx, [0x140001530]
lea rax, [fcn.140001521]
sub rcx, rax
add rbx, rcx
lea rdi, [rbx + 0xa8]
call fcn.1400014a8
mov r8d, ebp
mov rdx, rbx
mov rcx, rsi
call rax
xor ecx, ecx
mov r8, rsi
mov eax, ecx
inc ecx
and eax, 3
mov al, byte [rsp + rax + 0x68]
xor byte [r8], al
inc r8
cmp ecx, ebp
jb 0x140001094
mov ecx, dword [rsi + 0x28]
call fcn.1400012e0
mov ebx, dword [rsi + 0x28]
mov rbp, rax
call fcn.1400014a8
mov r8d, ebx
mov rdx, rdi
mov rcx, rbp
call rax
mov edx, dword [rsi + 0x28]
xor r8d, r8d
test edx, edx
je 0x1400010ee
mov rcx, rbp
mov eax, r8d
inc r8d
and eax, 3
mov al, byte [rax + rsi + 0x2c]
xor byte [rcx], al
inc rcx
mov edx, dword [rsi + 0x28]
cmp r8d, edx
jb 0x1400010d4
lea r9, [rsp + 0x60]
xor r8d, r8d
mov rcx, rbp
call fcn.140001388
mov ecx, dword [rsp + 0x60]
call fcn.1400012e0
mov r15d, dword [rsi + 0x28]
mov r14, rax
test rbp, rbp
je 0x1400011da
test r15d, r15d
je 0x1400011da
test rax, rax
je 0x14000115c
mov ebx, dword [rsp + 0x60]
call fcn.140001502
mov rcx, rax
mov edx, 0xc3a9e061
call fcn.140001228
lea rdx, [rsp + 0x60]
mov ecx, 2
mov qword [rsp + 0x28], rdx
mov r9, rbp
mov rdx, r14
mov dword [rsp + 0x20], r15d
mov r8d, ebx
call rax
jmp 0x1400011da
imul r12d, r15d, 0xf
jmp 0x140001169
add r12d, 0x80000
call fcn.1400014e0
mov edx, 0x3e20dd16
mov rcx, rax
call fcn.140001228
mov edx, r12d
mov ecx, 0x40
call rax
mov rdi, rax
call fcn.140001502
mov edx, 0xc3a9e061
mov rcx, rax
call fcn.140001228
lea rdx, [rsp + 0x60]
mov r9, rbp
mov qword [rsp + 0x28], rdx
mov r8d, r12d
mov rdx, rdi
mov dword [rsp + 0x20], r15d
mov ecx, 2
call rax
mov ebx, eax
call fcn.1400014e0
mov edx, 0xb45168cd
mov rcx, rax
call fcn.140001228
mov rcx, rdi
call rax
cmp ebx, 0xc0000242
je 0x140001162
mov rcx, rbp
call fcn.140001338
mov ebx, dword [rsp + 0x60]
call fcn.1400014e0
mov rcx, rax
mov edx, 0x77e9f7c8
call fcn.140001228
mov edx, ebx
lea r9, [rsp + 0x68]
mov r8d, 0x40
mov rcx, r14
call rax
mov rcx, rsi
call r14
Function at 0x140001228
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov ebx, edx
mov r8, rcx
test rcx, rcx
je 0x140001284
mov eax, dword [rcx + 0x3c]
xor r10d, r10d
mov r9d, dword [rax + rcx + 0x88]
add r9, rcx
mov ecx, dword [r9 + 0x20]
add rcx, r8
cmp dword [r9 + 0x18], r10d
jbe 0x140001284
mov edx, dword [rcx]
add rdx, r8
xor r11d, r11d
jmp 0x14000126c
imul r11d, r11d, 0x21
movsx eax, al
add r11d, eax
inc rdx
mov al, byte [rdx]
test al, al
jne 0x14000125f
cmp r11d, ebx
je 0x14000128c
add rcx, 4
inc r10d
cmp r10d, dword [r9 + 0x18]
jb 0x140001255
xor eax, eax
mov rbx, qword [rsp + 8]
ret
mov eax, dword [r9 + 0x24]
add rax, r8
movsxd rcx, r10d
movzx edx, word [rax + rcx*2]
mov ecx, dword [r9 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
add rax, r8
jmp 0x140001286

Function at 0x1400014e0
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, 0x30
mov rax, qword gs:[rax]
mov rax, qword [rax + 0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov rax, qword [rax]
mov rax, qword [rax]
mov rax, qword [rax + 0x30]
ret

Function at 0x140001500
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov rax, 0x30
mov rax, qword gs:[rax]
mov rax, qword [rax + 0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov rax, qword [rax]
mov rax, qword [rax]
mov rax, qword [rax + 0x30]
ret

Function at 0x140001502
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov rax, 0x30
mov rax, qword gs:[rax]
mov rax, qword [rax + 0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov rax, qword [rax]
mov rax, qword [rax + 0x30]
ret
Function at 0x4187a0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41892b
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [0x007dbd20]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00436220
xorps xmm15, xmm15
mov r14, qword [0x00adb030]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x418805
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x418814
add rsp, 0x48
pop rbp
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x418833
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x418843
cmp rbx, 0x1000
jae 0x41880b
jmp 0x4188ad
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x418855
xor edx, edx
jmp 0x4188a4
mov rcx, qword [0x007dbd20]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00436220
xorps xmm15, xmm15
mov r14, qword [0x00adb030]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x418839
jmp 0x418828
call fcn.0046c200
xorps xmm15, xmm15
mov r14, qword [0x00adb030]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.0043a8e0
lea rax, [0x0086e446]
mov ebx, 0x18
nop dword [rax]
call fcn.0043b160
mov rax, qword [rsp + 0x38]
call fcn.0043aea0
lea rax, [0x0086ec4e]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.0043b160
mov rax, qword [rsp + 0x30]
call fcn.0043aea0
call fcn.0043ab20
call fcn.0043a940
lea rax, [0x00872d70]
mov ebx, 0x21
call fcn.00438f40
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00468380
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004187a0
Function at 0x418960
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x418b86
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [0x007dbd18]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.004362a0
xorps xmm15, xmm15
mov r14, qword [0x00adb030]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x4189d3
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x4189e2
add rsp, 0x50
pop rbp
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x418a05
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x418a15
cmp rbx, 0x1000
jae 0x4189d9
nop
jmp 0x418a98
add rsp, 0x50
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop word [rax + rax]
cmp rbx, 0x1000
jae 0x418a2d
xor esi, esi
jmp 0x418a8a
mov rax, qword [0x007dbd18]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.004362a0
xorps xmm15, xmm15
mov r14, qword [0x00adb030]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x418a0b
jmp 0x4189f6
call fcn.0046c200
xorps xmm15, xmm15
mov r14, qword [0x00adb030]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x418b20
nop dword [rax + rax]
call fcn.0043a8e0
lea rax, [0x0086ec67]
mov ebx, 0x19
call fcn.0043b160
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
call fcn.0043aea0
lea rax, [0x0086ec4e]
mov ebx, 0x19
call fcn.0043b160
mov eax, dword [rsp + 0x34]
call fcn.0043aea0
nop
call fcn.0043ab20
call fcn.0043a940
lea rax, [0x00868b31]
mov ebx, 0xd
call fcn.00438f40
nop dword [rax + rax]
cmp eax, 0x5af
je 0x418ac0
call fcn.0043a8e0
lea rax, [0x0086ec67]
mov ebx, 0x19
call fcn.0043b160
mov rax, qword [rsp + 0x38]
call fcn.0043aea0
lea rax, [0x0086ec4e]
mov ebx, 0x19
call fcn.0043b160
mov eax, dword [rsp + 0x34]
nop dword [rax]
call fcn.0043aea0
call fcn.0043ab20
call fcn.0043a940
lea rax, [0x00871f65]
mov ebx, 0x1f
nop dword [rax + rax]
call fcn.00438f40
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00468380
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.00418960
Function at 0x4220e0
Capabilities:
Hash data using murmur3

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
cmp byte [0x00adad5a], 0
jne 0x4221c7
sub rbx, qword [rax + 0x18]
mov rdx, qword [rax + 0x50]
test byte [rdx], al
mov esi, dword [rax + 0x64]
imul rbx, rsi
mov rsi, rbx
shr rbx, 0x20
shr rsi, 0x23
and ebx, 7
mov rdi, rcx
mov rcx, rbx
mov r8d, 1
shl r8d, cl
add rdx, rsi
nop
nop
nop
nop
lock or byte [rdx], r8b
mov rcx, qword [rax + 0x18]
movabs rdx, 0x800000000000
lea rax, [rdx + rcx]
mov rdx, rax
shr rdx, 0x2a
nop
nop
nop
cmp rdx, 0x40
jae 0x4221ba
lea rbx, [0x00aad138]
mov rdx, qword [rbx + rdx*8]
test byte [rdx], al
mov rbx, rcx
shr rbx, 0x10
and ebx, 0x3f
shr rcx, 0xd
and ecx, 7
mov esi, 1
shl esi, cl
shr rax, 0x16
and eax, 0xfffff
mov rax, qword [rdx + rax*8]
test byte [rax], al
movzx edx, byte [rax + rbx + 0x11440]
lea rax, [rax + rbx]
lea rax, [rax + 0x11440]
test sil, dl
jne 0x4221a0
lock or byte [rax], sil
mov rax, qword [r14 + 0x30]
mov rax, qword [rax + 0xa0]
test byte [rax], al
add qword [rax + 0x1250], rdi
add rsp, 0x10
pop rbp
ret
mov rax, rdx
mov ecx, 0x40
call fcn.0046a660
lea rax, [0x00877126]
mov ebx, 0x2c
call fcn.00438f40
nop
int3

Function at 0x424480
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x424586
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x70], rcx
mov byte [rsp + 0x17], dil
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x18], 0
jmp 0x4244c3
mov rax, qword [rsp + 0x60]
mov rcx, rdx
mov rbx, qword [rsp + 0x68]
movzx edi, byte [rsp + 0x17]
cmp qword [rsp + 0x18], rbx
jae 0x42457b
test byte [rax], al
lea rcx, [rax + 0x100b8]
mov ebx, edi
mov rax, rcx
nop dword [rax]
call fcn.00425260
test rax, rax
je 0x42457b
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x30], xmm15
movups xmmword [rsp + 0x40], xmm15
lea rcx, [0x004245c0]
mov qword [rsp + 0x20], rcx
lea rdx, [rsp + 0x18]
mov qword [rsp + 0x28], rdx
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x48], rax
lea rbx, [rsp + 0x20]
mov qword [rsp], rbx
nop dword [rax]
call fcn.00468240
xorps xmm15, xmm15
mov r14, qword [0x00adb030]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x70]
nop dword [rax]
test rdx, rdx
jne 0x424569
xor eax, eax
jmp 0x424573
mov rax, qword [rdx]
call rax
mov rdx, qword [rsp + 0x70]
test al, al
je 0x4244b1
mov rax, qword [rsp + 0x18]
add rsp, 0x50
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov byte [rsp + 0x20], dil
call fcn.00468380
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movzx edi, byte [rsp + 0x20]
jmp fcn.00424480
Function at 0x4325c0
Capabilities:
Hash data using murmur3

Disassembly:
cmp rsp, qword [r14 + 0x18]
jbe 0x432846
push rbp
mov rbp, rsp
sub rsp, 0x38
test byte [rax], al
mov rcx, qword [rax + 0x1268]
lea rsi, [rax + 0x1278]
sub rcx, rsi
shr rcx, 3
cmp rcx, 0x200
ja 0x43283a
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x30], rcx
mov qword [rax + 0x1268], 0
cmp byte [0x00adad5a], 0
jne 0x43261a
xor edx, edx
xor ebx, ebx
jmp 0x432660
xor edx, edx
jmp 0x432645
mov qword [rsp + 0x28], rdx
mov rcx, qword [rax + rdx*8 + 0x1278]
mov rax, rcx
call fcn.00421940
mov rdx, qword [rsp + 0x28]
inc rdx
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
cmp rdx, rcx
jl 0x43261e
add rax, 0x1268
call fcn.00432540
add rsp, 0x38
pop rbp
ret
inc rdx
nop
cmp rdx, rcx
jge 0x4327d4
mov rsi, qword [rax + rdx*8 + 0x1278]
cmp rsi, 0x1000
jb 0x43265b
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rbx
mov rax, rsi
xor ebx, ebx
mov rcx, rbx
call fcn.00415ac0
test rax, rax
jne 0x4326ac
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
jmp 0x43265b
mov rsi, qword [rbx + 0x50]
test byte [rsi], al
mov r8, rcx
shr r8, 3
movzx r9d, byte [rsi + r8]
and ecx, 7
mov r10d, 1
shl r10d, cl
nop
add rsi, r8
test r10b, r9b
je 0x4326ec
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
jmp 0x43265b
nop
lock or byte [rsi], r10b
mov rcx, qword [rbx + 0x18]
movabs rsi, 0x800000000000
lea r8, [rsi + rcx]
mov r9, r8
shr r8, 0x2a
nop
nop
nop
cmp r8, 0x40
jae 0x43282d
lea r10, [0x00aad138]
mov r8, qword [r10 + r8*8]
test byte [r8], al
mov r10, rcx
shr r10, 0x10
and r10d, 0x3f
shr rcx, 0xd
and ecx, 7
mov r11d, 1
shl r11d, cl
shr r9, 0x16
and r9d, 0xfffff
mov r8, qword [r8 + r9*8]
test byte [r8], al
movzx r9d, byte [r8 + r10 + 0x11440]
lea r8, [r8 + r10]
lea r8, [r8 + 0x11440]
test r11b, r9b
jne 0x43276f
lock or byte [r8], r11b
movzx r8d, byte [rbx + 0x6a]
test r8b, 1
je 0x4327a5
mov rax, qword [rsp + 0x48]
mov r8, qword [rax + 0x1250]
add r8, qword [rbx + 0x70]
mov qword [rax + 0x1250], r8
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
jmp 0x43265b
mov r8, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
cmp r8, rcx
jae 0x432825
mov rbx, qword [rsp + 0x48]
mov qword [rbx + r8*8 + 0x1278], rax
inc r8
mov rax, rbx
mov rdx, qword [rsp + 0x28]
mov rbx, r8
jmp 0x43265b
cmp rbx, 0x200
ja 0x432814
lea rdx, [rax + 0x1278]
lea rsi, [rax + 0x1240]
mov rcx, rbx
mov edi, 0x200
mov rbx, rdx
mov rax, rsi
call fcn.004281c0
mov rax, qword [rsp + 0x48]
add rax, 0x1268
call fcn.00432540
add rsp, 0x38
pop rbp
ret
mov rcx, rbx
mov edx, 0x200
nop dword [rax]
call fcn.0046a6c0
mov rax, r8
call fcn.0046a640
mov rax, r8
mov ecx, 0x40
call fcn.0046a660
mov edx, 0x200
nop
call fcn.0046a6a0
nop
mov qword [rsp + 8], rax
call fcn.0046fc20
mov rax, qword [rsp + 8]
jmp fcn.004325c0
Function at 0x447d20
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x447e87
push rbp
mov rbp, rsp
sub rsp, 0x18
mov ecx, dword [rax + 0x190]
mov edx, dword [rax + 0x194]
mov rsi, qword [rax + 0x998]
mov edi, dword [rax + 0x194]
cmp edi, edx
jne 0x447d32
cmp edx, ecx
jne 0x447e75
nop word [rax + rax]
test rsi, rsi
jne 0x447e75
mov qword [rsp + 0x28], rax
test rbx, rbx
jne 0x447d94
nop
call fcn.0046c620
xorps xmm15, xmm15
mov r14, qword [0x00adb030]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rbx, qword [rsp]
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x10], rbx
call fcn.00447c40
mov rcx, qword [rsp + 0x28]
mov edx, dword [rcx]
mov ebx, edx
sar edx, 0x1f
shr edx, 0x1b
add edx, ebx
mov esi, edx
and edx, 0xffffffe0
sub ebx, edx
test ebx, ebx
jl 0x447e70
mov rdx, qword [0x00a86478]
sar esi, 5
mov rax, rcx
mov ecx, ebx
mov edi, 1
shl edi, cl
movsxd rsi, esi
cmp ecx, 0x20
sbb r8d, r8d
and edi, r8d
cmp rdx, rsi
jbe 0x447e65
mov rcx, qword [0x00a86470]
lea rcx, [rcx + rsi*4]
lock or dword [rcx], edi
mov rcx, qword [0x00a87770]
mov qword [rax + 8], rcx
mov rcx, rax
nop
mov qword [0x00a87770], rax
nop
mov edx, 1
lea rsi, [0x00a87778]
lock xadd dword [rsi], edx
mov rdx, qword [rcx + 0x1228]
shr rdx, 0x3d
test dl, dl
jne 0x447e53
mov rax, qword [rsp + 0x10]
movabs rdx, 0x1fffffffffffffff
and rdx, rax
bts rdx, 0x3f
nop
nop
xchg qword [rcx + 0x1228], rdx
add rsp, 0x18
pop rbp
ret
lea rax, [0x00875d40]
mov ebx, 0x28
nop
call fcn.00438f40
mov rax, rsi
mov rcx, rdx
call fcn.0046a640
call fcn.00437460
lea rax, [0x00873c22]
mov ebx, 0x23
call fcn.00438f40
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00468380
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00447d20