joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140013a30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rdi, rdx
movzx ebp, byte [rdx + 0x38]
xor ebx, ebx
cmp bpl, 1
setne dl
mov eax, 0
sbb eax, eax
mov rsi, rcx
or al, dl
movzx ecx, al
cmp cl, 0xff
je 0x140013a60
test ecx, ecx
jne 0x140013ab0
movzx ebx, byte [rdi + 0x3a]
cmp al, 0xff
je 0x140013a6c
test ecx, ecx
jne 0x140013ab0
mov rcx, rdi
call fcn.140013910
movzx eax, al
test bpl, bpl
jne 0x140013ab7
lea rdx, [rdi + 0x10]
xor ecx, ecx
cmp byte [rdi + 0x10], 6
cmove rdx, rcx
je case.0x140013aa3.2
movzx r8d, byte [rdx]
mov ecx, 6
lea r9, [0x140013c28]
movsxd r8, dword [r9 + r8*4]
add r8, r9
jmp r8
mov rcx, qword [rdx + 0x10]
add rcx, 4
jmp case.0x140013aa3.2
xor eax, eax
test bpl, bpl
je 0x140013a7c
xor ecx, ecx
add rax, rcx
movzx r10d, bl
lea rcx, [rax + r10]
mov rdx, qword [rdi + 8]
cmp rdx, rcx
jb 0x140013c09
mov r11, qword [rdi]
lea r8, [r11 + rcx]
cmp rdx, rcx
jne 0x140013aea
movzx r9d, byte [rdi + 0x10]
xor r10d, r10d
jmp 0x140013b69
movzx r9d, byte [rdi + 0x10]
add rax, r10
sub rax, rdx
inc rax
lea rdi, [rdx + r11]
dec rdi
xor r10d, r10d
cmp r9b, 3
jae 0x140013b30
nop dword [rax + rax]
cmp byte [rdi], 0x5c
je 0x140013b4b
inc rax
dec rdi
cmp rax, 1
jne 0x140013b10
jmp 0x140013b69
movzx ebx, byte [rdi]
cmp ebx, 0x2f
je 0x140013b4b
cmp ebx, 0x5c
je 0x140013b4b
inc rax
dec rdi
cmp rax, 1
jne 0x140013b30
jmp 0x140013b69
neg rax
add rcx, rax
inc rcx
cmp rdx, rcx
jb 0x140013c17
add r11, rcx
mov r10d, 1
mov r8, r11
sub rdx, rcx
je 0x140013b93
mov al, 9
cmp rdx, 2
je 0x140013b97
cmp rdx, 1
jne 0x140013ba7
cmp byte [r8], 0x2e
jne 0x140013ba7
xor eax, eax
cmp r9b, 3
setae al
lea eax, [rax + rax*2]
add eax, 7
jmp 0x140013ba7
mov al, 0xa
jmp 0x140013ba7
cmp byte [r8], 0x2e
jne 0x140013ba7
cmp byte [r8 + 1], 0x2e
sete al
xor al, 9
add r10, rdx
mov qword [rsi], r10
mov byte [rsi + 8], al
mov qword [rsi + 0x10], r8
mov qword [rsi + 0x18], rdx
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
mov rcx, qword [rdx + 0x10]
mov rdx, qword [rdx + 0x20]
lea r8, [rdx + 1]
test rdx, rdx
cmove r8, rdx
add rcx, r8
add rcx, 8
jmp case.0x140013aa3.2
mov rcx, qword [rdx + 0x10]
mov rdx, qword [rdx + 0x20]
lea r8, [rdx + 1]
test rdx, rdx
cmove r8, rdx
add rcx, r8
add rcx, 2
jmp case.0x140013aa3.2
mov ecx, 2
jmp case.0x140013aa3.2
lea r8, str.library_std_srcpath.rs
call fcn.14001dee0
ud2
lea r8, str.library_std_srcpath.rs
call fcn.14001dee0
ud2
Function at 0x140015c10
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
mov rdi, rdx
mov rsi, rcx
movups xmm0, xmmword [0x140023eb0]
movaps xmmword [rsp + 0x60], xmm0
mov eax, 0xffffffff
cmp r9, rax
cmovb rax, r9
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r8
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov rcx, rdx
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtReadFile]
cmp eax, 0x103
jne 0x140015c7c
mov rcx, rdi
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [rsp + 0x60]
cmp eax, 0xc0000011
jne 0x140015c8b
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
jmp 0x140015cc3
cmp eax, 0x103
je 0x140015ccd
test eax, eax
js 0x140015ca8
mov rax, qword [rsp + 0x68]
mov qword [rsi + 8], rax
mov qword [rsi], 0
jmp 0x140015cc3
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov qword [rsi], 1
add rsp, 0xa8
pop rdi
pop rsi
ret
mov byte [rsp + 0x5c], 0
mov dword [rsp + 0x58], 0
lea rax, str.fatal_runtime_error:_I_O_error:_operation_failed_to_complete_synchronously_n
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x88], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x90], xmm0
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x78]
call fcn.14000f5a0
mov rcx, rax
call fcn.14000f640
mov ecx, 7
int 0x29
ud2

Function at 0x14001a3a8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14001a3f2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14001a3f2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14001a3f2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14001a3f2
cmp dword [rcx + 0x84], 0xe
jbe 0x14001a3f2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14001a3f4
xor al, al
add rsp, 0x28
ret
Function at 0x140ba7849
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfq
cmc
jmp 0x140c07791
push rdi
test rdx, r11
test edi, 0x28c17f94
push r10
push r11
movzx r11d, cx
inc r11b
push rbx
or r10w, 0x2811
push r8
push rax
movzx rax, ax
add r11w, 0x4f80
cmp r15b, al
push r12
push r9
shr ax, cl
sbb r8w, 0x5b5c
push rdx
sar r8b, cl
neg r11b
not r10b
push rsi
xor r11w, 0x761b
push rbp
cbw
push r14
movabs r8, 0
test cx, r15w
xchg r10b, r11b
push r8
mov r10, qword [rsp + 0x90]
xor r10d, 0x4c524e4e
rdtsc
cmc
ror r10d, 3
rdtsc
mov dh, cl
setle bpl
inc r10d
stc
cwd
movsxd r11, esi
rol r10d, 1
neg bpl
add r10d, 0x3acd2a95
movsxd rsi, ebp
mov bpl, bpl
not r10d
movsx bp, r8b
movzx eax, dx
cbw
dec r10d
or sil, cl
rol dl, 0xa6
jmp 0x140c1e580
push r15
push rcx
jmp 0x140b19698
push r13
jmp 0x140b6fbb5
movsxd rax, eax
add rsi, rax
jmp rsi
bswap r10d
add r10d, 0x29e505f8
stc
ror r10d, 3
cmovs r11w, r13w
xor r11d, r14d
mov sil, 0x36
add r10, r8
shrd r11w, r9w, 0xc
movsx rdx, dx
shr r11w, 0x49
movabs rdx, 0x100000000
lea r10, [r10 + rdx]
mov rbp, rsp
sub rsp, 0x180
xchg si, r11w
bts r11w, r8w
and rsp, 0xfffffffffffffff0
sbb sil, spl
bsr esi, edx
mov r11, r10
btr si, 0x17
xor r8, rdx
inc r8b
movabs r8, 0
sal ah, cl
sub r11, r8
shl ah, cl
lea rsi, [0x140c1e5f9]
rcl rax, cl
movzx ax, dil
cdqe
sub r10, 4
test r9, rcx
mov ah, 0xb
mov eax, dword [r10]
cmp r15, 0x2266169c
xor eax, r11d
stc
xor eax, 0x752646
sub eax, 0x6abe2aa4
ror eax, 3
clc
xor eax, 0x2a2f0502
dec eax
jmp 0x140c5ecb3
push r11
add r11b, 5
rcl r11w, cl
movsx r11d, r13w
xor dword [rsp], eax
movsx r11, ax
and r11w, 0x127b
pop r11
test r9b, 0x3b
jmp 0x140c144e3
Function at 0x180002130
Capabilities:
Access peb ldr_data

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
cmp dword [0x180020a94], 0xa
jl 0x180002162
mov eax, dword [0x180020a98]
lea edx, [rax - 1]
imul edx, eax
and edx, 1
je 0x180002162
nop word cs:[rax + rax]
jmp 0x180002160
mov rax, qword gs:[0x60]
mov r11, qword [rax + 0x18]
add r11, 0x10
mov eax, dword [0x180020a80]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete al
cmp dword [0x180020a7c], 0xa
setl r8b
or r8b, al
mov eax, dword [0x180020a9c]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete al
cmp dword [0x180020aa0], 0xa
setl r9b
or r9b, al
lea r10, [rcx - 1]
xor eax, eax
mov r14, r11
mov r14, qword [r14]
cmp r14, r11
je 0x180002238
mov rsi, r10
test r8b, r8b
je 0x180002250
cmp byte [rsi + 1], 0
lea rsi, [rsi + 1]
jne 0x1800021d0
test r9b, r9b
je 0x180002260
sub rsi, rcx
je 0x180002234
mov r15, qword [r14 + 0x60]
xor ebx, ebx
nop
movzx r13d, word [r15 + rbx*2]
lea edi, [r13 - 0x41]
lea ebp, [r13 + 0x20]
cmp di, 0x1a
cmovae ebp, r13d
movsx edi, byte [rcx + rbx]
lea r12d, [rdi - 0x41]
lea edx, [rdi + 0x20]
cmp r12b, 0x1a
cmovae edx, edi
sub ebp, edx
test r13d, r13d
je 0x180002230
test ebp, ebp
jne 0x180002230
add rbx, 1
cmp rsi, rbx
jne 0x1800021f0
jmp 0x180002234
test ebp, ebp
jne 0x1800021bc
mov rax, qword [r14 + 0x30]
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
jmp 0x180002250
jmp 0x180002260
Function at 0x417100
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41728b
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.004359a0
xorps xmm15, xmm15
mov r14, qword [0x006620f0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x417165
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x417174
add rsp, 0x48
pop rbp
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x417193
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x4171a3
cmp rbx, 0x1000
jae 0x41716b
jmp 0x41720d
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x4171b5
xor edx, edx
jmp 0x417204
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.004359a0
xorps xmm15, xmm15
mov r14, qword [0x006620f0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x417199
jmp 0x417188
call fcn.0046b260
xorps xmm15, xmm15
mov r14, qword [0x006620f0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.00439e80
lea rax, [0x0050a0bb]
mov ebx, 0x18
nop dword [rax]
call fcn.0043a700
mov rax, qword [rsp + 0x38]
call fcn.0043a440
lea rax, [0x0050a5bf]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.0043a700
mov rax, qword [rsp + 0x30]
call fcn.0043a440
call fcn.0043a0c0
call fcn.00439ee0
lea rax, [0x0050cb2e]
mov ebx, 0x21
call fcn.004383e0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00467b00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00417100
Function at 0x4172c0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4174e6
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.00435a20
xorps xmm15, xmm15
mov r14, qword [0x006620f0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x417333
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x417342
add rsp, 0x50
pop rbp
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x417365
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x417375
cmp rbx, 0x1000
jae 0x417339
nop
jmp 0x4173f8
add rsp, 0x50
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop word [rax + rax]
cmp rbx, 0x1000
jae 0x41738d
xor esi, esi
jmp 0x4173ea
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.00435a20
xorps xmm15, xmm15
mov r14, qword [0x006620f0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x41736b
jmp 0x417356
call fcn.0046b260
xorps xmm15, xmm15
mov r14, qword [0x006620f0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x417480
nop dword [rax + rax]
call fcn.00439e80
lea rax, [0x0050a5d8]
mov ebx, 0x19
call fcn.0043a700
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
call fcn.0043a440
lea rax, [0x0050a5bf]
mov ebx, 0x19
call fcn.0043a700
mov eax, dword [rsp + 0x34]
call fcn.0043a440
nop
call fcn.0043a0c0
call fcn.00439ee0
lea rax, [0x00506c1e]
mov ebx, 0xd
call fcn.004383e0
nop dword [rax + rax]
cmp eax, 0x5af
je 0x417420
call fcn.00439e80
lea rax, [0x0050a5d8]
mov ebx, 0x19
call fcn.0043a700
mov rax, qword [rsp + 0x38]
call fcn.0043a440
lea rax, [0x0050a5bf]
mov ebx, 0x19
call fcn.0043a700
mov eax, dword [rsp + 0x34]
nop dword [rax]
call fcn.0043a440
call fcn.0043a0c0
call fcn.00439ee0
lea rax, [0x0050c2b1]
mov ebx, 0x1f
nop dword [rax + rax]
call fcn.004383e0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00467b00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.004172c0
Function at 0x4212c0
Capabilities:
Hash data using murmur3

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
cmp byte [0x00661ed2], 0
jne 0x4213b0
sub rbx, qword [rax + 0x18]
mov rdx, qword [rax + 0x48]
test byte [rdx], al
mov ecx, dword [rax + 0x5c]
imul rcx, rbx
mov rbx, rcx
shr rbx, 0x20
shr rcx, 0x23
and ebx, 7
mov rsi, rcx
mov rcx, rbx
mov edi, 1
shl edi, cl
add rdx, rsi
nop
nop
nop
nop
lock or byte [rdx], dil
mov rcx, qword [rax + 0x18]
movabs rdx, 0x800000000000
add rdx, rcx
mov rbx, rdx
shr rdx, 0x2a
nop
nop
nop
cmp rdx, 0x40
jae 0x4213a3
lea rsi, [0x005f3fd8]
mov rdx, qword [rsi + rdx*8]
test byte [rdx], al
mov rsi, rcx
shr rsi, 0x10
and esi, 0x3f
shr rcx, 0xd
and ecx, 7
mov edi, 1
shl edi, cl
shr rbx, 0x16
and ebx, 0xfffff
mov rdx, qword [rdx + rbx*8]
test byte [rdx], al
movzx ebx, byte [rdx + rsi + 0x1040]
lea rdx, [rdx + rsi]
lea rdx, [rdx + 0x1040]
test dil, bl
jne 0x42137e
lock or byte [rdx], dil
mov rcx, qword [r14 + 0x30]
mov rcx, qword [rcx + 0xa0]
test byte [rcx], al
mov rdx, qword [rcx + 0x1270]
add rdx, qword [rax + 0x68]
mov qword [rcx + 0x1270], rdx
add rsp, 0x10
pop rbp
ret
mov rax, rdx
mov ecx, 0x40
call fcn.00469e00
lea rax, [0x0050ecfa]
mov ebx, 0x2c
nop dword [rax]
call fcn.004383e0
nop
int3

Function at 0x423800
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x423906
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov byte [rsp + 0x70], dil
mov qword [rsp + 0x10], 0
jmp 0x423843
mov rax, qword [rsp + 0x58]
mov rcx, rdx
mov rbx, qword [rsp + 0x60]
movzx edi, byte [rsp + 0x70]
cmp qword [rsp + 0x10], rbx
jae 0x4238fb
test byte [rax], al
lea rcx, [rax + 0x100b8]
mov ebx, edi
mov rax, rcx
nop dword [rax]
call fcn.004245e0
test rax, rax
je 0x4238fb
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
lea rcx, [0x00423940]
mov qword [rsp + 0x18], rcx
lea rdx, [rsp + 0x10]
mov qword [rsp + 0x20], rdx
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x40], rax
lea rbx, [rsp + 0x18]
mov qword [rsp], rbx
nop dword [rax]
call fcn.004679e0
xorps xmm15, xmm15
mov r14, qword [0x006620f0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x68]
nop dword [rax]
test rdx, rdx
jne 0x4238e9
xor eax, eax
jmp 0x4238f3
mov rax, qword [rdx]
call rax
mov rdx, qword [rsp + 0x68]
test al, al
je 0x423831
mov rax, qword [rsp + 0x10]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov byte [rsp + 0x20], dil
call fcn.00467b00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movzx edi, byte [rsp + 0x20]
jmp fcn.00423800
Function at 0x4303a0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x430499
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rax + 0x108], 0
mov ecx, dword [0x00662510]
test ecx, ecx
je 0x430472
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x10], 0
lea rcx, [rsp + 0x60]
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x30], xmm15
movups xmmword [rsp + 0x40], xmm15
lea rdx, [0x004304c0]
mov qword [rsp + 0x18], rdx
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], rcx
mov rcx, r14
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x10]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], 3
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x18]
mov qword [rsp], rcx
call fcn.004679e0
xorps xmm15, xmm15
mov r14, qword [0x006620f0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x10]
cmp rax, 0x20
jge 0x43046c
jae 0x43048e
mov rcx, qword [rsp + 0x60]
mov qword [rcx + rax*8 + 8], 0
add rsp, 0x50
pop rbp
ret
lea rcx, [fcn.00445580]
inc rcx
mov qword [rax + 8], rcx
mov qword [rax + 0x10], 0
add rsp, 0x50
pop rbp
ret
mov ecx, 0x20
call fcn.00469de0
nop
mov qword [rsp + 8], rax
nop
call fcn.00467b00
mov rax, qword [rsp + 8]
jmp fcn.004303a0
Function at 0x432420
Capabilities:
Hash data using murmur3

Disassembly:
cmp rsp, qword [r14 + 0x18]
jbe 0x4326a6
push rbp
mov rbp, rsp
sub rsp, 0x38
test byte [rax], al
lea rsi, [rax + 0x1298]
mov rcx, qword [rax + 0x1288]
sub rcx, rsi
shr rcx, 3
cmp rcx, 0x200
ja 0x43269a
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x30], rcx
mov qword [rax + 0x1288], 0
cmp byte [0x00661ed2], 0
jne 0x43247a
xor edx, edx
xor ebx, ebx
jmp 0x4324c0
xor edx, edx
jmp 0x4324a5
mov qword [rsp + 0x28], rdx
mov rcx, qword [rax + rdx*8 + 0x1298]
mov rax, rcx
call fcn.00420b20
mov rdx, qword [rsp + 0x28]
inc rdx
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
cmp rdx, rcx
jl 0x43247e
add rax, 0x1288
call fcn.004323a0
add rsp, 0x38
pop rbp
ret
inc rdx
nop
cmp rdx, rcx
jge 0x432634
mov rsi, qword [rax + rdx*8 + 0x1298]
cmp rsi, 0x1000
jb 0x4324bb
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rbx
mov rax, rsi
xor ebx, ebx
mov rcx, rbx
call fcn.004143e0
test rax, rax
jne 0x43250c
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
jmp 0x4324bb
mov rsi, qword [rbx + 0x48]
test byte [rsi], al
mov r8, rcx
shr r8, 3
movzx r9d, byte [rsi + r8]
and ecx, 7
mov r10d, 1
shl r10d, cl
nop
add rsi, r8
test r10b, r9b
je 0x43254c
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
jmp 0x4324bb
nop
lock or byte [rsi], r10b
mov rcx, qword [rbx + 0x18]
movabs rsi, 0x800000000000
lea r8, [rsi + rcx]
mov r9, r8
shr r8, 0x2a
nop
nop
nop
cmp r8, 0x40
jae 0x43268d
lea r10, [0x005f3fd8]
mov r8, qword [r10 + r8*8]
test byte [r8], al
mov r10, rcx
shr r10, 0x10
and r10d, 0x3f
shr rcx, 0xd
and ecx, 7
mov r11d, 1
shl r11d, cl
shr r9, 0x16
and r9d, 0xfffff
mov r8, qword [r8 + r9*8]
test byte [r8], al
movzx r9d, byte [r8 + r10 + 0x1040]
lea r8, [r8 + r10]
lea r8, [r8 + 0x1040]
test r11b, r9b
jne 0x4325cf
lock or byte [r8], r11b
movzx r8d, byte [rbx + 0x62]
test r8b, 1
je 0x432605
mov rax, qword [rsp + 0x48]
mov r8, qword [rax + 0x1270]
add r8, qword [rbx + 0x68]
mov qword [rax + 0x1270], r8
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
jmp 0x4324bb
mov r8, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
cmp r8, rcx
jae 0x432685
mov rbx, qword [rsp + 0x48]
mov qword [rbx + r8*8 + 0x1298], rax
inc r8
mov rax, rbx
mov rdx, qword [rsp + 0x28]
mov rbx, r8
jmp 0x4324bb
cmp rbx, 0x200
ja 0x432674
lea rdx, [rax + 0x1298]
lea rsi, [rax + 0x1260]
mov rcx, rbx
mov edi, 0x200
mov rbx, rdx
mov rax, rsi
call fcn.00427600
mov rax, qword [rsp + 0x48]
add rax, 0x1288
call fcn.004323a0
add rsp, 0x38
pop rbp
ret
mov rcx, rbx
mov edx, 0x200
nop dword [rax]
call fcn.00469e60
mov rax, r8
call fcn.00469de0
mov rax, r8
mov ecx, 0x40
call fcn.00469e00
mov edx, 0x200
nop
call fcn.00469e40
nop
mov qword [rsp + 8], rax
call fcn.0046e6e0
mov rax, qword [rsp + 8]
jmp fcn.00432420
Function at 0x435c20
Capabilities:
Access peb ldr_data

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 8
mov qword [rsp + 0x60], 0
mov rcx, qword [0x006620f0]
mov rcx, qword gs:[rcx]
mov rcx, qword [rcx]
mov rcx, qword [rcx + 0x30]
mov qword [rcx + 0x3c0], 8
lea rdx, [rsp + 0x20]
mov qword [rcx + 0x3c8], rdx
mov rax, qword [rsp + 0x18]
xorps xmm15, xmm15
mov r14, qword [0x006620f0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
call fcn.004357c0
mov qword [rsp + 0x60], rax
add rsp, 8
pop rbp
ret
Function at 0x4434a0
Capabilities:
Access peb ldr_data

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [0x00661e90]
test rcx, rcx
jne 0x4434c4
xor ecx, ecx
xor edx, edx
jmp 0x4434d9
call fcn.004598c0
mov rcx, rbx
mov rdx, rax
mov rax, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rdx
mov qword [rsp + 0x20], r14
mov rsi, qword [r14 + 0x30]
inc dword [rsi + 0xd8]
mov qword [r14 + 0x10], 0xfffffffffffffade
mov byte [r14 + 0xb7], 1
call fcn.00443440
mov rcx, qword [rsp + 0x68]
mov rax, qword [rsp + 0x20]
mov qword [rax + 0x70], rcx
mov rdx, qword [rsp + 0x60]
mov qword [rax + 0x78], rdx
mov ebx, 2
mov ecx, 3
call fcn.0043cd60
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rcx + 0x70]
cmp qword [rcx], rdx
ja 0x443546
nop dword [rax + rax]
cmp qword [rcx + 8], rdx
jae 0x443582
movups xmmword [rsp + 0x40], xmm15
lea rax, [0x004437a0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rcx
lea rax, [rsp + 0x40]
mov qword [rsp], rax
call fcn.004679e0
xorps xmm15, xmm15
mov r14, qword [0x006620f0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rcx, qword [rsp + 0x20]
mov rax, qword [rsp + 0x10]
test rax, rax
je 0x4435eb
movups xmmword [rsp + 0x28], xmm15
mov qword [rsp + 0x38], 0
lea rcx, [0x00443720]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x28]
mov qword [rsp], rax
nop
call fcn.004679e0
xorps xmm15, xmm15
mov r14, qword [0x006620f0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
call fcn.00443440
mov rcx, qword [rsp + 0x20]
mov al, byte [0x005de578]
test al, al
je 0x44362b
lea rax, [0x005110e8]
mov qword [rsp], rax
call fcn.004679e0
xorps xmm15, xmm15
mov r14, qword [0x006620f0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
call fcn.00443440
mov rcx, qword [rsp + 0x20]
mov rax, qword [rcx + 0x30]
mov rax, qword [rax + 0xa0]
test byte [rax], al
cmp dword [rax + 0x2298], 0
nop
je 0x443678
lea rax, fcn.0043e5e0
mov qword [rsp], rax
call fcn.004679e0
xorps xmm15, xmm15
mov r14, qword [0x006620f0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
call fcn.00443440
mov rcx, qword [rsp + 0x20]
mov rax, qword [rcx + 0x30]
mov rdx, qword [rax + 0xa0]
mov edx, dword [rdx + 0x14]
mov dword [rax + 0x388], edx
mov rax, qword [rcx + 0x30]
mov rax, qword [rax + 0xa0]
mov qword [rax + 0x38], 0
mov rdx, qword [rcx + 0x30]
mov rbx, rax
mov qword [rdx + 0xb0], rax
mov rax, qword [rcx + 0x30]
mov qword [rax + 0xa0], 0
mov eax, 2
xchg dword [rbx + 4], eax
mov al, byte [0x005de568]
test al, al
je 0x443704
lea rax, [0x005110e0]
mov qword [rsp], rax
call fcn.004679e0
xorps xmm15, xmm15
mov r14, qword [0x006620f0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
call fcn.00443440
mov rcx, qword [rsp + 0x20]
mov rax, qword [rcx + 0x30]
dec dword [rax + 0xd8]
add rsp, 0x50
pop rbp
ret
Function at 0x448480
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4485e7
push rbp
mov rbp, rsp
sub rsp, 0x18
mov ecx, dword [rax + 0x190]
mov edx, dword [rax + 0x194]
mov rsi, qword [rax + 0x998]
mov edi, dword [rax + 0x194]
cmp edi, edx
jne 0x448492
cmp edx, ecx
jne 0x4485d5
nop word [rax + rax]
test rsi, rsi
jne 0x4485d5
mov qword [rsp + 0x28], rax
test rbx, rbx
jne 0x4484f4
nop
call fcn.0046b720
xorps xmm15, xmm15
mov r14, qword [0x006620f0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rbx, qword [rsp]
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x10], rbx
call fcn.004483a0
mov rcx, qword [rsp + 0x28]
mov edx, dword [rcx]
mov ebx, edx
sar edx, 0x1f
shr edx, 0x1b
add edx, ebx
mov esi, edx
and edx, 0xffffffe0
sub ebx, edx
test ebx, ebx
jl 0x4485d0
mov rdx, qword [0x005dd208]
sar esi, 5
mov rax, rcx
mov ecx, ebx
mov edi, 1
shl edi, cl
movsxd rsi, esi
cmp ecx, 0x20
sbb r8d, r8d
and edi, r8d
cmp rdx, rsi
jbe 0x4485c5
mov rcx, qword [0x005dd200]
lea rcx, [rcx + rsi*4]
lock or dword [rcx], edi
mov rcx, qword [0x005de4d0]
mov qword [rax + 8], rcx
mov rcx, rax
nop
mov qword [0x005de4d0], rax
nop
mov edx, 1
lea rsi, [0x005de4d8]
lock xadd dword [rsi], edx
mov rdx, qword [rcx + 0x1248]
shr rdx, 0x3d
test dl, dl
jne 0x4485b3
mov rax, qword [rsp + 0x10]
movabs rdx, 0x1fffffffffffffff
and rdx, rax
bts rdx, 0x3f
nop
nop
xchg qword [rcx + 0x1248], rdx
add rsp, 0x18
pop rbp
ret
lea rax, [0x0050e345]
mov ebx, 0x28
nop
call fcn.004383e0
mov rax, rsi
mov rcx, rdx
call fcn.00469de0
call fcn.00436cc0
lea rax, [0x0050d2b2]
mov ebx, 0x23
call fcn.004383e0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00467b00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00448480