joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180afb058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.180afb1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x180afb089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x180afb06f
add dl, dl
jne 0x180afb096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x180afb0f6
xor eax, eax
add dl, dl
jne 0x180afb0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x180afb1ad
add dl, dl
jne 0x180afb0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x180afb0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x180afb0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x180afb0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x180afb0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x180afb07e
mov eax, 1
add dl, dl
jne 0x180afb106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x180afb113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x180afb0fb
sub eax, ebx
mov ebx, 1
jne 0x180afb14c
mov ecx, 1
add dl, dl
jne 0x180afb12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x180afb13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x180afb123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x180afb07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x180afb168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x180afb175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x180afb15d
cmp eax, 0x7d00
jae 0x180afb19b
cmp eax, 0x500
jb 0x180afb196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x180afb07e
cmp eax, 0x7f
ja 0x180afb19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x180afb07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x180afb1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x180afb07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140003f50
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x478
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3f0], 0xfffffffffffffffe
mov qword [rbp + 0x3e0], rcx
mov qword [rbp + 0x3c8], 2
xorps xmm0, xmm0
movups xmmword [rbp + 0x3d0], xmm0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3e8], rax
xor edi, edi
xor ebx, ebx
xor r12d, r12d
cmp r8, 0x201
jae 0x140003fe0
jmp 0x140003fcf
jae 0x1400040a0
cmp r8, 0x201
jae 0x140003fe0
mov esi, 0x200
lea r13, [rbp - 0x58]
mov r15, r8
jmp 0x140004038
sub r8, r12
sub rbx, r12
cmp rbx, r8
jae 0x14000400f
lea rcx, [rbp + 0x3c8]
mov rdx, r12
call fcn.14001be70
mov rax, qword [rbp + 0x3c8]
mov qword [rbp + 0x3e8], rax
mov rdi, qword [rbp + 0x3d0]
mov eax, 0xffffffff
cmp rdi, rax
mov r12d, 0xffffffff
cmovb r12, rdi
mov qword [rbp + 0x3d8], r12
mov rbx, rdi
mov rsi, r12
mov r13, qword [rbp + 0x3e8]
mov r15, r12
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, r15d
mov rdx, r13
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov r14d, eax
test eax, eax
jne 0x140004061
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x140004108
mov r8d, r14d
cmp r15, r8
jne 0x140003fc0
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x14000412b
add r15, r15
mov eax, 0xffffffff
cmp r15, rax
cmovae r15, rax
mov r8, r15
cmp r8, 0x201
jb 0x140003fcf
jmp 0x140003fe0
cmp rsi, r8
jb 0x140004145
lea rcx, [rbp + 0x3a8]
mov rdx, r13
call fcn.140006d30
movups xmm0, xmmword [rbp + 0x3a8]
movups xmm1, xmmword [rbp + 0x3b8]
mov rsi, qword [rbp + 0x3e0]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
test rdi, rdi
je 0x1400040f1
add rdi, rdi
mov r8d, 2
mov rcx, qword [rbp + 0x3e8]
mov rdx, rdi
call fcn.140001530
mov rax, rsi
add rsp, 0x478
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3e0]
mov qword [rsi], rax
mov byte [rsi + 0x18], 2
test rdi, rdi
jne 0x1400040d9
jmp 0x1400040f1
lea rcx, str.internal_error:_entered_unreachable_code_rustc_a28077b28a02b92985b3a3faecf92813155f1ea1library_alloc_src_vecmod.rs
lea r8, str.library_std_src_syswindowsmod.rs
mov edx, 0x28
call fcn.14001cb20
jmp 0x14000415a
lea rax, str.library_std_src_syswindowsmod.rs
mov rcx, r8
mov rdx, rsi
mov r8, rax
call fcn.14001cf70
ud2
Function at 0x14000bd30
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
mov rdi, rdx
mov rsi, rcx
mov rcx, qword [rsp + 0xe0]
movups xmm0, xmmword [0x140020350]
movaps xmmword [rsp + 0x60], xmm0
mov eax, 0xffffffff
cmp r9, rax
cmovb rax, r9
test rcx, rcx
je 0x14000bd74
mov rdx, qword [rsp + 0xe8]
mov qword [rsp + 0x80], rdx
test rcx, rcx
mov qword [rsp + 0x78], rcx
lea rdx, [rsp + 0x80]
cmove rdx, rcx
mov qword [rsp + 0x38], rdx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r8
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov rcx, rdi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtReadFile]
cmp eax, 0x103
jne 0x14000bdd3
mov rcx, rdi
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [rsp + 0x60]
cmp eax, 0xc0000011
jne 0x14000bde2
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
jmp 0x14000be1a
cmp eax, 0x103
je 0x14000be24
test eax, eax
js 0x14000bdff
mov rax, qword [rsp + 0x68]
mov qword [rsi + 8], rax
mov qword [rsi], 0
jmp 0x14000be1a
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov qword [rsi], 1
add rsp, 0xa8
pop rdi
pop rsi
ret
mov byte [rsp + 0x5c], 0
mov dword [rsp + 0x58], 0
lea rax, str.fatal_runtime_error:_I_O_error:_operation_failed_to_complete_synchronously_n
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x88], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x90], xmm0
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x78]
call fcn.140006650
mov rcx, rax
call fcn.140001fc0
mov ecx, 7
int 0x29
ud2
Function at 0x14000be90
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
mov rdi, rdx
mov rsi, rcx
mov rcx, qword [rsp + 0xe0]
movups xmm0, xmmword [0x140020350]
movaps xmmword [rsp + 0x60], xmm0
mov eax, 0xffffffff
cmp r9, rax
cmovb rax, r9
test rcx, rcx
je 0x14000bed4
mov rdx, qword [rsp + 0xe8]
mov qword [rsp + 0x80], rdx
test rcx, rcx
mov qword [rsp + 0x78], rcx
lea rdx, [rsp + 0x80]
cmove rdx, rcx
mov qword [rsp + 0x38], rdx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r8
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov rcx, rdi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x14000bf3a
mov rcx, rdi
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [rsp + 0x60]
cmp eax, 0x103
je 0x14000bf71
test eax, eax
js 0x14000bf4b
mov rax, qword [rsp + 0x68]
mov qword [rsi + 8], rax
xor eax, eax
jmp 0x14000bf64
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
add rsp, 0xa8
pop rdi
pop rsi
ret
mov byte [rsp + 0x5c], 0
mov dword [rsp + 0x58], 0
lea rax, str.fatal_runtime_error:_I_O_error:_operation_failed_to_complete_synchronously_n
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x88], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x90], xmm0
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x78]
call fcn.140006650
mov rcx, rax
call fcn.140001fc0
mov ecx, 7
int 0x29
ud2
Function at 0x140019d40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
test r8, r8
je 0x140019dba
mov rax, rdx
mov rdx, qword [rsp + 0x70]
mov esi, ecx
shr esi, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov rbx, rax
movzx edi, byte [rax + 1]
add rax, 2
lea r10, [r11 + rdi]
cmp byte [rbx], sil
jne 0x140019db0
cmp r11, r10
ja 0x140019e53
cmp r10, rdx
ja 0x140019e67
add r11, r9
xor ebx, ebx
nop dword [rax]
cmp rdi, rbx
je 0x140019db2
lea r14, [rbx + 1]
cmp byte [r11 + rbx], cl
mov rbx, r14
jne 0x140019d90
jmp 0x140019e27
ja 0x140019dba
mov r11, r10
cmp rax, r8
jne 0x140019d62
mov rdx, qword [rsp + 0x80]
test rdx, rdx
je 0x140019e2b
mov r8, qword [rsp + 0x78]
add rdx, r8
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r10, [r8 + 1]
movzx r9d, byte [r8]
test r9b, r9b
js 0x140019e00
mov r8, r10
sub ecx, r9d
jns 0x140019e1e
jmp 0x140019e2d
cmp r10, rdx
je 0x140019e39
movzx r10d, byte [r8 + 1]
add r8, 2
and r9d, 0x7f
shl r9d, 8
or r9d, r10d
sub ecx, r9d
js 0x140019e2d
xor al, 1
cmp r8, rdx
jne 0x140019de0
jmp 0x140019e2d
xor eax, eax
jmp 0x140019e2d
mov al, 1
and al, 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, str.called__Option::unwrap____on_a__None__valuefrom_str_radix_int:_must_lie_in_the_range___2__36_____found
lea r8, str.librarycore_srcunicodeprintable.rs
mov edx, 0x2b
call fcn.14001cb20
ud2
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.14001cff0
ud2
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.14001cf70
ud2

Function at 0x14001b8f0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14001b93a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14001b93a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14001b93a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14001b93a
cmp dword [rcx + 0x84], 0xe
jbe 0x14001b93a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14001b93c
xor al, al
add rsp, 0x28
ret
Function at 0x67625ee0
Capabilities:
Access peb ldr_data

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x67626150
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
lea rax, [0x678cefb0]
mov qword [rsp], rax
call sym.combase.dll_runtime.lock
lea rax, [0x678cef20]
mov qword [rsp], rax
call sym.combase.dll_runtime._fixalloc_.alloc
mov rax, qword [rsp + 8]
mov qword [rsp + 0x48], rax
lea rcx, [0x678cefb0]
mov qword [rsp], rcx
call sym.combase.dll_runtime.unlock
mov rax, qword [rsp + 0x48]
mov byte [rax + 0xa], 1
lea rdi, [rax + 0x10]
cmp dword [sym.combase.dll_runtime.writeBarrier], 0
jne 0x6762613b
mov rcx, qword [rsp + 0x68]
mov qword [rax + 0x10], rcx
mov qword [rsp + 0x40], rdi
mov rcx, qword [rsp + 0x70]
mov qword [rax + 0x18], rcx
cmp dword [sym.combase.dll_runtime.writeBarrier], 0
jne 0x6762610e
mov rcx, qword [rsp + 0x78]
mov qword [rax + 0x20], rcx
mov rcx, qword [rsp + 0x80]
mov qword [rax + 0x28], rcx
mov rcx, qword [rsp + 0x60]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
call sym.combase.dll_runtime.addspecial
cmp byte [rsp + 0x10], 0
je 0x676260b0
cmp dword [sym.combase.dll_runtime.gcphase], 0
jne 0x67625fce
mov byte [rsp + 0x88], 1
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov rax, qword [rsp + 0x60]
mov qword [rsp], rax
xorps xmm0, xmm0
movups xmmword [rsp + 8], xmm0
call sym.combase.dll_runtime.findObject
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov rcx, qword [rax + 0x30]
mov rdx, qword [rsp + 0x18]
nop
inc dword [rcx + 0xd8]
mov rcx, qword [rax + 0x30]
mov qword [rsp + 0x30], rcx
mov rbx, qword [rcx + 0xa0]
test byte [rbx], al
test byte [rax], al
mov qword [rsp], rdx
lea rax, [rbx + 0x1698]
mov qword [rsp + 0x38], rax
mov qword [rsp + 8], rax
call sym.combase.dll_runtime.scanobject
mov rax, qword [rsp + 0x40]
mov qword [rsp], rax
mov qword [rsp + 8], 8
lea rax, sym.combase.dll_runtime.oneptrmask
mov qword [rsp + 0x10], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x20], 0
call sym.combase.dll_runtime.scanblock
nop
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x30]
mov edx, dword [rcx + 0xd8]
lea ebx, [rdx - 1]
mov dword [rcx + 0xd8], ebx
cmp edx, 1
jne 0x67625fbc
cmp byte [rax + 0xb1], 0
je 0x67625fbc
mov qword [rax + 0x10], 0xfffffffffffffade
jmp 0x67625fbc
lea rax, [0x678cefb0]
mov qword [rsp], rax
call sym.combase.dll_runtime.lock
nop
mov rax, qword [0x678cef50]
sub rax, qword [0x678cef20]
mov qword [0x678cef50], rax
mov rax, qword [0x678cef38]
mov rcx, qword [rsp + 0x48]
mov qword [rcx], rax
mov qword [0x678cef38], rcx
lea rax, [0x678cefb0]
mov qword [rsp], rax
call sym.combase.dll_runtime.unlock
mov byte [rsp + 0x88], 0
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
lea rcx, [rax + 0x20]
mov rdi, rcx
mov rbx, rax
mov rax, qword [rsp + 0x78]
call sym.combase.dll_runtime.gcWriteBarrier
lea rdi, [rbx + 0x28]
mov rax, qword [rsp + 0x80]
call sym.combase.dll_runtime.gcWriteBarrier
mov rax, rbx
jmp 0x67625f95
mov rcx, rax
mov rax, qword [rsp + 0x68]
call sym.combase.dll_runtime.gcWriteBarrier
mov rax, rcx
jmp 0x67625f65
call sym.combase.dll_runtime.morestack_noctxt
jmp sym.combase.dll_runtime.addfinalizer
Function at 0x6764c310
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x6764c4de
sub rsp, 0x68
mov qword [rsp + 0x60], rbp
lea rbp, [rsp + 0x60]
mov rax, qword [rsp + 0x70]
test rax, rax
je 0x6764c498
mov ecx, dword [rax + 0x18]
mov qword [rsp], rax
mov rdx, qword [rsp + 0x78]
mov qword [rsp + 8], rdx
mov dword [rsp + 0x10], ecx
mov rcx, qword [rsp + 0x80]
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], 0
movzx ebx, byte [rsp + 0x88]
mov byte [rsp + 0x28], bl
call sym.combase.dll_runtime.pcvalue
movsxd rax, dword [rsp + 0x30]
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x70]
mov edx, dword [rcx + 0x1c]
mov qword [rsp], rcx
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 8], rcx
mov dword [rsp + 0x10], edx
mov rdx, qword [rsp + 0x80]
mov qword [rsp + 0x18], rdx
mov qword [rsp + 0x20], 0
movzx edx, byte [rsp + 0x88]
mov byte [rsp + 0x28], dl
call sym.combase.dll_runtime.pcvalue
mov eax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x40]
cmp rcx, 0xffffffffffffffff
jne 0x6764c40c
lea rax, [0x6770ffa5]
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x98], 1
mov dword [rsp + 0xa0], 0
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
cmp eax, 0xffffffff
je 0x6764c3dc
mov rdx, qword [rsp + 0x78]
mov rbx, qword [rdx + 0x38]
mov rsi, qword [rdx + 0x30]
cmp rcx, rbx
jge 0x6764c3dc
mov rdi, qword [rdx]
mov rdx, qword [rdx + 8]
jae 0x6764c4d2
mov ebx, dword [rsi + rcx*4]
cmp rbx, rdx
jae 0x6764c4c8
mov dword [rsp + 0x3c], eax
lea rax, [rdi + rbx]
mov qword [rsp + 0x48], rax
mov qword [rsp], rax
call sym.combase.dll_runtime.findnull
mov rax, qword [rsp + 8]
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], rax
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x90], rcx
mov qword [rsp + 0x98], rax
mov eax, dword [rsp + 0x3c]
mov dword [rsp + 0xa0], eax
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
lea rax, [0x6770ffa5]
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x98], 1
mov dword [rsp + 0xa0], 0
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov eax, ebx
mov rcx, rdx
call sym.combase.dll_runtime.panicIndex
mov rax, rcx
mov rcx, rbx
call sym.combase.dll_runtime.panicIndex
nop
call sym.combase.dll_runtime.morestack_noctxt
jmp sym.combase.dll_runtime.funcline1
Function at 0x6764c570
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x6764c6d2
sub rsp, 0x68
mov qword [rsp + 0x60], rbp
lea rbp, [rsp + 0x60]
mov rax, qword [rsp + 0x70]
mov ecx, dword [rax + 0x14]
mov qword [rsp], rax
mov rdx, qword [rsp + 0x78]
mov qword [rsp + 8], rdx
mov dword [rsp + 0x10], ecx
mov rcx, qword [rsp + 0x80]
mov qword [rsp + 0x18], rcx
mov rbx, qword [rsp + 0x88]
mov qword [rsp + 0x20], rbx
mov byte [rsp + 0x28], 1
call sym.combase.dll_runtime.pcvalue
mov eax, dword [rsp + 0x30]
test eax, 7
jne 0x6764c5f2
mov dword [rsp + 0x90], eax
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov dword [rsp + 0x3c], eax
mov rax, qword [rsp + 0x70]
mov qword [rsp], rax
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 8], rcx
call sym.combase.dll_runtime.funcname
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x10]
mov qword [rsp + 0x58], rcx
mov rdx, qword [rsp + 0x70]
mov rbx, qword [rdx]
mov qword [rsp + 0x48], rbx
movsxd rdx, dword [rdx + 0x14]
mov qword [rsp + 0x40], rdx
call sym.combase.dll_runtime.printlock
lea rax, [0x67712622]
mov qword [rsp], rax
mov qword [rsp + 8], 0x10
call sym.combase.dll_runtime.printstring
mov rax, qword [rsp + 0x58]
mov qword [rsp], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 8], rax
call sym.combase.dll_runtime.printstring
call sym.combase.dll_runtime.printsp
mov rax, qword [rsp + 0x48]
mov qword [rsp], rax
call sym.combase.dll_runtime.printhex
call sym.combase.dll_runtime.printsp
mov rax, qword [rsp + 0x80]
mov qword [rsp], rax
call sym.combase.dll_runtime.printhex
call sym.combase.dll_runtime.printsp
mov rax, qword [rsp + 0x40]
mov qword [rsp], rax
call sym.combase.dll_runtime.printhex
call sym.combase.dll_runtime.printsp
mov eax, dword [rsp + 0x3c]
movsxd rcx, eax
mov qword [rsp], rcx
call sym.combase.dll_runtime.printint
call sym.combase.dll_runtime.printnl
call sym.combase.dll_runtime.printunlock
mov eax, dword [rsp + 0x3c]
jmp 0x6764c5e1
call sym.combase.dll_runtime.morestack_noctxt
jmp sym.combase.dll_runtime.funcspdelta
Function at 0x67654060
Capabilities:
Access peb ldr_data

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x67654140
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov qword [rsp + 8], 0
mov qword [rsp + 0x10], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x18], xmm0
movups xmmword [rsp + 0x28], xmm0
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
lea rcx, [sym.combase.dll_runtime.callers.func1]
mov qword [rsp + 0x10], rcx
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x18], rcx
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 8]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call sym.combase.dll_runtime.systemstack
mov rax, qword [rsp + 8]
mov qword [rsp + 0x88], rax
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
call sym.combase.dll_runtime.morestack_noctxt
jmp sym.combase.dll_runtime.callers
Function at 0x6765d330
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp byte [sym.combase.dll_runtime.useAeshash], 0
je 0x6765d34f
mov rax, qword [rsp + 8]
mov rcx, qword [rax + 8]
mov rax, qword [rax]
lea rdx, [rsp + 0x18]
jmp 0x6765d360
jmp sym.combase.dll_runtime.strhashFallback

Function at 0x6765d8b0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp byte [sym.combase.dll_runtime.useAeshash], 0
je 0x6765d8ec
mov rax, qword [rsp + 8]
movq xmm0, qword [rsp + 0x10]
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [sym.combase.dll_runtime.aeskeysched]
aesenc xmm0, xmmword [0x678cf490]
aesenc xmm0, xmmword [0x678cf4a0]
movq qword [rsp + 0x18], xmm0
ret
jmp sym.combase.dll_runtime.memhash32Fallback

Function at 0x6765d900
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp byte [sym.combase.dll_runtime.useAeshash], 0
je 0x6765d93d
mov rax, qword [rsp + 8]
movq xmm0, qword [rsp + 0x10]
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [sym.combase.dll_runtime.aeskeysched]
aesenc xmm0, xmmword [0x678cf490]
aesenc xmm0, xmmword [0x678cf4a0]
movq qword [rsp + 0x18], xmm0
ret
jmp sym.combase.dll_runtime.memhash64Fallback

Function at 0x6765f6b0
Capabilities:
Access peb ldr_data

Disassembly:
lea rax, [sym.combase.dll_runtime.lastcontinuehandler]
jmp 0x6765f580

Function at 0x67672a40
Capabilities:
Encode data using base64

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov rdx, qword [rsp + 0x20]
mov rbx, qword [rdx + 8]
lea rsi, [rbx + 0x2e]
imul rsi, rsi, 0xffffffffffffffe4
movabs rax, 0x5816058160581606
mov rcx, rdx
imul rsi
sar rsi, 0x3f
sar rdx, 5
sub rdx, rsi
lea rsi, [rdx + 0x15c]
sar rsi, 0x3f
shr rsi, 0x3d
lea rdx, [rsi + rdx]
lea rdx, [rdx + 0x15c]
sar rdx, 3
cmp rdx, 0x57
jae 0x67672b18
lea rsi, [rdx + rdx*2]
lea rdi, sym.combase.dll_strconv.powersOfTen
mov r8, qword [rdi + rsi*8 + 8]
lea r9, [r8 + rbx]
lea r9, [r9 + 0x40]
cmp r9, 0xffffffffffffffc4
jge 0x67672ac1
inc rdx
jmp 0x67672a98
cmp r9, 0xffffffffffffffe0
jle 0x67672acc
dec rdx
jmp 0x67672a98
mov rbx, qword [rdi + rsi*8]
mov rax, qword [rcx]
mov rsi, rdx
mul rbx
shr rax, 0x3f
add rdx, rax
mov qword [rcx], rdx
mov rdx, qword [rcx + 8]
lea rdx, [rdx + r8]
lea rdx, [rdx + 0x40]
mov qword [rcx + 8], rdx
mov rcx, rsi
shl rsi, 3
lea rdx, [rsi - 0x15c]
neg rdx
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rcx
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov rax, rdx
mov ecx, 0x57
call sym.combase.dll_runtime.panicIndex
nop
int3
Function at 0x67681990
Capabilities:
Hash data using fnv

Disassembly:
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov edx, dword [rsp + 8]
xor ebx, ebx
jmp 0x676819b1
movzx esi, byte [rax + rbx]
inc rbx
imul edx, edx, 0x1000193
xor edx, esi
cmp rbx, rcx
jl 0x676819a2
mov dword [rsp + 0x28], edx
ret

Function at 0x6768eda0
Capabilities:
Encode data using xor

Disassembly:
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdx, qword [rsp + 0x20]
test rdx, 0xf
jne 0x6768ee0b
mov rax, 0
movdqu xmm0, xmmword [rsi + rax]
movdqu xmm1, xmmword [rcx + rax]
pxor xmm0, xmm1
movdqu xmmword [rbx + rax], xmm0
add rax, 0x10
cmp rdx, rax
jne 0x6768edc4
ret
sub rdx, 1
mov dil, byte [rsi + rdx]
mov al, byte [rcx + rdx]
xor dil, al
mov byte [rbx + rdx], dil
test rdx, 7
jne 0x6768ede1
cmp rdx, 0
je 0x6768ee2d
test rdx, 0xf
je 0x6768edbd
test rdx, 7
jne 0x6768ede1
sub rdx, 8
mov rdi, qword [rsi + rdx]
mov rax, qword [rcx + rdx]
xor rdi, rax
mov qword [rbx + rdx], rdi
cmp rdx, 0x10
jge 0x6768edbd
ret