joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001924
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x370]
sub rsp, 0x470
mov rax, qword [0x140005008]
xor rax, rsp
mov qword [rbp + 0x360], rax
lea rax, [rsp + 0x40]
xor ebx, ebx
mov rdi, 0xffffffff80000002
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionTelephonyProviders
mov rcx, rdi
lea r9d, [rbx + 1]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
je 0x14000198a
xor eax, eax
jmp 0x140001b3c
lea rax, [rsp + 0x50]
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionTelephony
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x140001b29
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x38]
lea rax, [rsp + 0x34]
mov dword [rsp + 0x30], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.NumProviders
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x140001b18
mov eax, dword [rsp + 0x34]
mov edi, ebx
test eax, eax
je 0x140001b13
lea r9, str.ProviderFilename
mov dword [rsp + 0x20], edi
lea r8, str._s_d
mov edx, 0x200
lea rcx, [rsp + 0x60]
call fcn.1400010a8
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x38]
lea rax, [rbp + 0x160]
mov dword [rsp + 0x30], 0x100
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x140001a8c
lea rdx, str.RemoteSP.TSP
lea rcx, [rbp + 0x160]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
nop dword [rax + rax]
test eax, eax
je 0x140001a9b
mov eax, dword [rsp + 0x34]
inc edi
cmp edi, eax
jae 0x140001b15
jmp 0x140001a0d
lea r9, str.ProviderID
mov dword [rsp + 0x20], edi
lea r8, str._s_d
mov edx, 0x200
lea rcx, [rsp + 0x60]
call fcn.1400010a8
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x38]
lea rax, [rsp + 0x48]
mov dword [rsp + 0x30], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x140001b18
mov ecx, dword [rsp + 0x48]
xor edx, edx
call qword [sym.imp.TAPI32.dll_lineRemoveProvider]
nop dword [rax + rax]
test eax, eax
sete bl
jmp 0x140001b18
cmp edi, eax
cmove ebx, ebx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
mov eax, ebx
mov rcx, qword [rbp + 0x360]
xor rcx, rsp
call fcn.1400024f0
lea r11, [rsp + 0x470]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x140002050
Capabilities:
Check mutex on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
xor ebx, ebx
call fcn.140001490
mov qword [0x1400055d0], rax
test rax, rax
je 0x140002139
lea r8, str.TapisrvProviderListMutex
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
jne 0x14000209f
mov ecx, 0xfc9
call fcn.140001130
jmp 0x140002139
or edx, 0xffffffff
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
nop dword [rax + rax]
mov r8, qword [0x1400055d0]
lea rax, [0x140003380]
or r9d, 0xffffffff
mov dword [rsp + 0x28], r9d
mov qword [rsp + 0x20], rax
lea edx, [r9 + 2]
lea ecx, [rdx + 0x7e]
call qword [sym.imp.KERNEL32.dll_CompareStringW]
nop dword [rax + rax]
cmp eax, 2
jne 0x1400020fc
call fcn.140001924
test eax, eax
jne 0x1400020f5
mov ecx, 0xfc0
jmp 0x140002116
mov ecx, 0xfae
jmp 0x140002111
call fcn.140001b68
test eax, eax
jne 0x14000210c
mov ecx, 0xfc1
jmp 0x140002116
mov ecx, 0xfaf
mov ebx, 1
call fcn.140001130
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
nop dword [rax + rax]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x140002298
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
call fcn.1400028e4
add rsp, 0x28
jmp 0x140002298
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push r14
sub rsp, 0xb0
and dword [rsp + 0x20], 0
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
xor edi, edi
xor eax, eax
lock cmpxchg qword [0x140005600], rbx
je 0x1400022e2
cmp rax, rbx
jne 0x1400022f7
mov edi, 1
mov eax, dword [0x140005608]
cmp eax, 1
jne 0x140002304
lea ecx, [rax + 0x1e]
call sub.msvcrt.dll__amsg_exit
jmp 0x140002371
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400022cb
mov eax, dword [0x140005608]
test eax, eax
jne 0x140002367
mov dword [0x140005608], 1
lea r14, [0x140003350]
lea rbx, [0x140003338]
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x24], eax
cmp rbx, r14
jae 0x140002359
test eax, eax
jne 0x14000235d
cmp qword [rbx], 0
je 0x14000234e
mov rax, qword [rbx]
mov rcx, qword [vtable.H_MA8HI.0]
call rcx
mov dword [rsp + 0x24], eax
add rbx, 8
mov qword [rsp + 0x30], rbx
jmp 0x14000232f
test eax, eax
je 0x140002371
mov eax, 0xff
jmp 0x1400024c4
mov dword [0x140005024], 1
mov eax, dword [0x140005608]
cmp eax, 1
jne 0x140002399
lea rdx, [0x140003330]
lea rcx, [0x140003320]
call sub.msvcrt.dll__initterm
mov dword [0x140005608], 2
test edi, edi
jne 0x1400023a6
xor eax, eax
xchg qword [0x140005600], rax
cmp qword [0x140005610], 0
je 0x1400023da
lea rcx, [0x140005610]
call fcn.140002850
test eax, eax
je 0x1400023da
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x140005610]
mov r9, qword [vtable.H_MA8HI.0]
call r9
mov rax, qword [sym.imp.msvcrt.dll__acmdln]
mov rbx, qword [rax]
mov qword [rsp + 0x28], rbx
mov edi, dword [rsp + 0x20]
movzx ecx, byte [rbx]
cmp cl, 0x20
ja 0x140002466
test cl, cl
je 0x1400023fd
test edi, edi
jne 0x140002466
dec cl
cmp cl, 0x1f
ja 0x140002410
inc rbx
mov qword [rsp + 0x28], rbx
mov cl, byte [rbx]
jmp 0x1400023fd
test byte [rsp + 0x7c], 1
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rbx
xor edx, edx
lea rcx, [0x140000000]
call fcn.1400016b0
mov dword [0x140005020], eax
cmp dword [0x140005040], 0
jne 0x14000244f
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x140005024], 0
jne 0x140002464
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x140005020]
jmp 0x1400024c4
cmp cl, 0x22
jne 0x140002478
xor eax, eax
test edi, edi
sete al
mov edi, eax
mov dword [rsp + 0x20], eax
call qword [sym.imp.msvcrt.dll__ismbblead]
test eax, eax
je 0x14000248a
inc rbx
mov qword [rsp + 0x28], rbx
inc rbx
mov qword [rsp + 0x28], rbx
jmp 0x1400023ed
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop r14
ret
Function at 0x14000273c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140002788
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140002780
cmp dword [rcx + 0x3c], edx
jl 0x140002780
cmp dword [rcx + 0x3c], 0x10000000
jae 0x140002780
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x140002788
mov rax, rdx
add rsp, 0x18
ret
Function at 0x2e1af6b40
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x2e1af6ccb
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [0x2e1bb9b78]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.2e1b15000
xorps xmm15, xmm15
mov r14, qword [0x2e1f71f78]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x2e1af6ba5
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x2e1af6bb4
add rsp, 0x48
pop rbp
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x2e1af6bd3
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x2e1af6be3
cmp rbx, 0x1000
jae 0x2e1af6bab
jmp 0x2e1af6c4d
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x2e1af6bf5
xor edx, edx
jmp 0x2e1af6c44
mov rcx, qword [0x2e1bb9b78]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.2e1b15000
xorps xmm15, xmm15
mov r14, qword [0x2e1f71f78]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x2e1af6bd9
jmp 0x2e1af6bc8
call fcn.2e1b48a20
xorps xmm15, xmm15
mov r14, qword [0x2e1f71f78]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.2e1b19440
lea rax, [0x2e1bfadd5]
mov ebx, 0x18
nop dword [rax]
call fcn.2e1b19cc0
mov rax, qword [rsp + 0x38]
call fcn.2e1b19a00
lea rax, [0x2e1bfb40e]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.2e1b19cc0
mov rax, qword [rsp + 0x30]
call fcn.2e1b19a00
call fcn.2e1b19680
call fcn.2e1b194a0
lea rax, [0x2e1bfdcfe]
mov ebx, 0x21
call fcn.2e1b179a0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.2e1b45280
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.2e1af6b40
Function at 0x2e1af6d00
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x2e1af6f26
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [0x2e1bb9b70]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.2e1b15080
xorps xmm15, xmm15
mov r14, qword [0x2e1f71f78]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x2e1af6d73
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x2e1af6d82
add rsp, 0x50
pop rbp
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x2e1af6da5
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x2e1af6db5
cmp rbx, 0x1000
jae 0x2e1af6d79
nop
jmp 0x2e1af6e38
add rsp, 0x50
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop word [rax + rax]
cmp rbx, 0x1000
jae 0x2e1af6dcd
xor esi, esi
jmp 0x2e1af6e2a
mov rax, qword [0x2e1bb9b70]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.2e1b15080
xorps xmm15, xmm15
mov r14, qword [0x2e1f71f78]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x2e1af6dab
jmp 0x2e1af6d96
call fcn.2e1b48a20
xorps xmm15, xmm15
mov r14, qword [0x2e1f71f78]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x2e1af6ec0
nop dword [rax + rax]
call fcn.2e1b19440
lea rax, [0x2e1bfb427]
mov ebx, 0x19
call fcn.2e1b19cc0
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
call fcn.2e1b19a00
lea rax, [0x2e1bfb40e]
mov ebx, 0x19
call fcn.2e1b19cc0
mov eax, dword [rsp + 0x34]
call fcn.2e1b19a00
nop
call fcn.2e1b19680
call fcn.2e1b194a0
lea rax, [0x2e1bf705a]
mov ebx, 0xd
call fcn.2e1b179a0
nop dword [rax + rax]
cmp eax, 0x5af
je 0x2e1af6e60
call fcn.2e1b19440
lea rax, [0x2e1bfb427]
mov ebx, 0x19
call fcn.2e1b19cc0
mov rax, qword [rsp + 0x38]
call fcn.2e1b19a00
lea rax, [0x2e1bfb40e]
mov ebx, 0x19
call fcn.2e1b19cc0
mov eax, dword [rsp + 0x34]
nop dword [rax]
call fcn.2e1b19a00
call fcn.2e1b19680
call fcn.2e1b194a0
lea rax, [0x2e1bfd466]
mov ebx, 0x1f
nop dword [rax + rax]
call fcn.2e1b179a0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.2e1b45280
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.2e1af6d00
Function at 0x2e1b00d00
Capabilities:
Hash data using murmur3

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
cmp byte [0x2e1f71d51], 0
jne 0x2e1b00df0
sub rbx, qword [rax + 0x18]
mov rdx, qword [rax + 0x48]
test byte [rdx], al
mov ecx, dword [rax + 0x5c]
imul rcx, rbx
mov rbx, rcx
shr rbx, 0x20
shr rcx, 0x23
and ebx, 7
mov rsi, rcx
mov rcx, rbx
mov edi, 1
shl edi, cl
add rdx, rsi
nop
nop
nop
nop
lock or byte [rdx], dil
mov rcx, qword [rax + 0x18]
movabs rdx, 0x800000000000
add rdx, rcx
mov rbx, rdx
shr rdx, 0x2a
nop
nop
nop
cmp rdx, 0x40
jae 0x2e1b00de3
lea rsi, [0x2e1f03e58]
mov rdx, qword [rsi + rdx*8]
test byte [rdx], al
mov rsi, rcx
shr rsi, 0x10
and esi, 0x3f
shr rcx, 0xd
and ecx, 7
mov edi, 1
shl edi, cl
shr rbx, 0x16
and ebx, 0xfffff
mov rdx, qword [rdx + rbx*8]
test byte [rdx], al
movzx ebx, byte [rdx + rsi + 0x1040]
lea rdx, [rdx + rsi]
lea rdx, [rdx + 0x1040]
test dil, bl
jne 0x2e1b00dbe
lock or byte [rdx], dil
mov rcx, qword [r14 + 0x30]
mov rcx, qword [rcx + 0xa0]
test byte [rcx], al
mov rdx, qword [rcx + 0x1270]
add rdx, qword [rax + 0x68]
mov qword [rcx + 0x1270], rdx
add rsp, 0x10
pop rbp
ret
mov rax, rdx
mov ecx, 0x40
call fcn.2e1b475a0
lea rax, [0x2e1bfff12]
mov ebx, 0x2c
nop dword [rax]
call fcn.2e1b179a0
nop
int3

Function at 0x2e1b03240
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x2e1b03346
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov byte [rsp + 0x70], dil
mov qword [rsp + 0x10], 0
jmp 0x2e1b03283
mov rax, qword [rsp + 0x58]
mov rcx, rdx
mov rbx, qword [rsp + 0x60]
movzx edi, byte [rsp + 0x70]
cmp qword [rsp + 0x10], rbx
jae 0x2e1b0333b
test byte [rax], al
lea rcx, [rax + 0x100b8]
mov ebx, edi
mov rax, rcx
nop dword [rax]
call fcn.2e1b04020
test rax, rax
je 0x2e1b0333b
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
lea rcx, [0x2e1b03380]
mov qword [rsp + 0x18], rcx
lea rdx, [rsp + 0x10]
mov qword [rsp + 0x20], rdx
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x40], rax
lea rbx, [rsp + 0x18]
mov qword [rsp], rbx
nop dword [rax]
call fcn.2e1b45160
xorps xmm15, xmm15
mov r14, qword [0x2e1f71f78]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x68]
nop dword [rax]
test rdx, rdx
jne 0x2e1b03329
xor eax, eax
jmp 0x2e1b03333
mov rax, qword [rdx]
call rax
mov rdx, qword [rsp + 0x68]
test al, al
je 0x2e1b03271
mov rax, qword [rsp + 0x10]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov byte [rsp + 0x20], dil
call fcn.2e1b45280
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movzx edi, byte [rsp + 0x20]
jmp fcn.2e1b03240
Function at 0x2e1b0fde0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x2e1b0fed9
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rax + 0x108], 0
mov ecx, dword [0x2e1f72390]
test ecx, ecx
je 0x2e1b0feb2
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x10], 0
lea rcx, [rsp + 0x60]
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x30], xmm15
movups xmmword [rsp + 0x40], xmm15
lea rdx, [0x2e1b0ff00]
mov qword [rsp + 0x18], rdx
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], rcx
mov rcx, r14
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x10]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], 3
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x18]
mov qword [rsp], rcx
call fcn.2e1b45160
xorps xmm15, xmm15
mov r14, qword [0x2e1f71f78]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x10]
cmp rax, 0x20
jge 0x2e1b0feac
jae 0x2e1b0fece
mov rcx, qword [rsp + 0x60]
mov qword [rcx + rax*8 + 8], 0
add rsp, 0x50
pop rbp
ret
lea rcx, [fcn.2e1b24b40]
inc rcx
mov qword [rax + 8], rcx
mov qword [rax + 0x10], 0
add rsp, 0x50
pop rbp
ret
mov ecx, 0x20
call fcn.2e1b47580
nop
mov qword [rsp + 8], rax
nop
call fcn.2e1b45280
mov rax, qword [rsp + 8]
jmp fcn.2e1b0fde0
Function at 0x2e1b11e60
Capabilities:
Hash data using murmur3

Disassembly:
cmp rsp, qword [r14 + 0x18]
jbe 0x2e1b120e6
push rbp
mov rbp, rsp
sub rsp, 0x38
test byte [rax], al
lea rsi, [rax + 0x1298]
mov rcx, qword [rax + 0x1288]
sub rcx, rsi
shr rcx, 3
cmp rcx, 0x200
ja 0x2e1b120da
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x30], rcx
mov qword [rax + 0x1288], 0
cmp byte [0x2e1f71d51], 0
jne 0x2e1b11eba
xor edx, edx
xor ebx, ebx
jmp 0x2e1b11f00
xor edx, edx
jmp 0x2e1b11ee5
mov qword [rsp + 0x28], rdx
mov rcx, qword [rax + rdx*8 + 0x1298]
mov rax, rcx
call fcn.2e1b00560
mov rdx, qword [rsp + 0x28]
inc rdx
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
cmp rdx, rcx
jl 0x2e1b11ebe
add rax, 0x1288
call fcn.2e1b11de0
add rsp, 0x38
pop rbp
ret
inc rdx
nop
cmp rdx, rcx
jge 0x2e1b12074
mov rsi, qword [rax + rdx*8 + 0x1298]
cmp rsi, 0x1000
jb 0x2e1b11efb
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rbx
mov rax, rsi
xor ebx, ebx
mov rcx, rbx
call fcn.2e1af3e40
test rax, rax
jne 0x2e1b11f4c
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
jmp 0x2e1b11efb
mov rsi, qword [rbx + 0x48]
test byte [rsi], al
mov r8, rcx
shr r8, 3
movzx r9d, byte [rsi + r8]
and ecx, 7
mov r10d, 1
shl r10d, cl
nop
add rsi, r8
test r10b, r9b
je 0x2e1b11f8c
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
jmp 0x2e1b11efb
nop
lock or byte [rsi], r10b
mov rcx, qword [rbx + 0x18]
movabs rsi, 0x800000000000
lea r8, [rsi + rcx]
mov r9, r8
shr r8, 0x2a
nop
nop
nop
cmp r8, 0x40
jae 0x2e1b120cd
lea r10, [0x2e1f03e58]
mov r8, qword [r10 + r8*8]
test byte [r8], al
mov r10, rcx
shr r10, 0x10
and r10d, 0x3f
shr rcx, 0xd
and ecx, 7
mov r11d, 1
shl r11d, cl
shr r9, 0x16
and r9d, 0xfffff
mov r8, qword [r8 + r9*8]
test byte [r8], al
movzx r9d, byte [r8 + r10 + 0x1040]
lea r8, [r8 + r10]
lea r8, [r8 + 0x1040]
test r11b, r9b
jne 0x2e1b1200f
lock or byte [r8], r11b
movzx r8d, byte [rbx + 0x62]
test r8b, 1
je 0x2e1b12045
mov rax, qword [rsp + 0x48]
mov r8, qword [rax + 0x1270]
add r8, qword [rbx + 0x68]
mov qword [rax + 0x1270], r8
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
jmp 0x2e1b11efb
mov r8, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
cmp r8, rcx
jae 0x2e1b120c5
mov rbx, qword [rsp + 0x48]
mov qword [rbx + r8*8 + 0x1298], rax
inc r8
mov rax, rbx
mov rdx, qword [rsp + 0x28]
mov rbx, r8
jmp 0x2e1b11efb
cmp rbx, 0x200
ja 0x2e1b120b4
lea rdx, [rax + 0x1298]
lea rsi, [rax + 0x1260]
mov rcx, rbx
mov edi, 0x200
mov rbx, rdx
mov rax, rsi
call fcn.2e1b07040
mov rax, qword [rsp + 0x48]
add rax, 0x1288
call fcn.2e1b11de0
add rsp, 0x38
pop rbp
ret
mov rcx, rbx
mov edx, 0x200
nop dword [rax]
call fcn.2e1b47600
mov rax, r8
call fcn.2e1b47580
mov rax, r8
mov ecx, 0x40
call fcn.2e1b475a0
mov edx, 0x200
nop
call fcn.2e1b475e0
nop
mov qword [rsp + 8], rax
call fcn.2e1b4bea0
mov rax, qword [rsp + 8]
jmp fcn.2e1b11e60
Function at 0x2e1b15280
Capabilities:
Access peb ldr_data

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 8
mov qword [rsp + 0x60], 0
mov rcx, qword [0x2e1f71f78]
mov rcx, qword gs:[rcx]
mov rcx, qword [rcx]
mov rcx, qword [rcx + 0x30]
mov qword [rcx + 0x3c0], 8
lea rdx, [rsp + 0x20]
mov qword [rcx + 0x3c8], rdx
mov rax, qword [rsp + 0x18]
xorps xmm15, xmm15
mov r14, qword [0x2e1f71f78]
mov r14, qword gs:[r14]
mov r14, qword [r14]
call fcn.2e1b14e20
mov qword [rsp + 0x60], rax
add rsp, 8
pop rbp
ret
Function at 0x2e1b22a60
Capabilities:
Access peb ldr_data

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [0x2e1f71d10]
test rcx, rcx
jne 0x2e1b22a84
xor ecx, ecx
xor edx, edx
jmp 0x2e1b22a99
call fcn.2e1b37500
mov rcx, rbx
mov rdx, rax
mov rax, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rdx
mov qword [rsp + 0x20], r14
mov rsi, qword [r14 + 0x30]
inc dword [rsi + 0xd8]
mov qword [r14 + 0x10], 0xfffffffffffffade
mov byte [r14 + 0xb7], 1
call fcn.2e1b22a00
mov rcx, qword [rsp + 0x68]
mov rax, qword [rsp + 0x20]
mov qword [rax + 0x70], rcx
mov rdx, qword [rsp + 0x60]
mov qword [rax + 0x78], rdx
mov ebx, 2
mov ecx, 3
call fcn.2e1b1c320
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rcx + 0x70]
cmp qword [rcx], rdx
ja 0x2e1b22b06
nop dword [rax + rax]
cmp qword [rcx + 8], rdx
jae 0x2e1b22b42
movups xmmword [rsp + 0x40], xmm15
lea rax, [0x2e1b22d60]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rcx
lea rax, [rsp + 0x40]
mov qword [rsp], rax
call fcn.2e1b45160
xorps xmm15, xmm15
mov r14, qword [0x2e1f71f78]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rcx, qword [rsp + 0x20]
mov rax, qword [rsp + 0x10]
test rax, rax
je 0x2e1b22bab
movups xmmword [rsp + 0x28], xmm15
mov qword [rsp + 0x38], 0
lea rcx, [0x2e1b22ce0]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x28]
mov qword [rsp], rax
nop
call fcn.2e1b45160
xorps xmm15, xmm15
mov r14, qword [0x2e1f71f78]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
call fcn.2e1b22a00
mov rcx, qword [rsp + 0x20]
mov al, byte [0x2e1eee3f8]
test al, al
je 0x2e1b22beb
lea rax, [0x2e1e2e9a0]
mov qword [rsp], rax
call fcn.2e1b45160
xorps xmm15, xmm15
mov r14, qword [0x2e1f71f78]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
call fcn.2e1b22a00
mov rcx, qword [rsp + 0x20]
mov rax, qword [rcx + 0x30]
mov rax, qword [rax + 0xa0]
test byte [rax], al
cmp dword [rax + 0x2298], 0
nop
je 0x2e1b22c38
lea rax, fcn.2e1b1dba0
mov qword [rsp], rax
call fcn.2e1b45160
xorps xmm15, xmm15
mov r14, qword [0x2e1f71f78]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
call fcn.2e1b22a00
mov rcx, qword [rsp + 0x20]
mov rax, qword [rcx + 0x30]
mov rdx, qword [rax + 0xa0]
mov edx, dword [rdx + 0x14]
mov dword [rax + 0x388], edx
mov rax, qword [rcx + 0x30]
mov rax, qword [rax + 0xa0]
mov qword [rax + 0x38], 0
mov rdx, qword [rcx + 0x30]
mov rbx, rax
mov qword [rdx + 0xb0], rax
mov rax, qword [rcx + 0x30]
mov qword [rax + 0xa0], 0
mov eax, 2
xchg dword [rbx + 4], eax
mov al, byte [0x2e1eee3e8]
test al, al
je 0x2e1b22cc4
lea rax, [0x2e1e2e998]
mov qword [rsp], rax
call fcn.2e1b45160
xorps xmm15, xmm15
mov r14, qword [0x2e1f71f78]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
call fcn.2e1b22a00
mov rcx, qword [rsp + 0x20]
mov rax, qword [rcx + 0x30]
dec dword [rax + 0xd8]
add rsp, 0x50
pop rbp
ret