joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14008c9a0
Capabilities:
Check http status code

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rbp, qword [rcx + 0x18]
lea eax, [rdx - 0xc8]
xor edi, edi
mov esi, r8d
mov rbx, rcx
cmp eax, 0x64
jb 0x14008c9df
lea rdx, [0x1400b4c60]
call fcn.14006c7e0
lea eax, [rdi + 0x11]
jmp 0x14008cb4b
cmp edx, 0xc8
je 0x14008c9f6
mov r8d, edx
lea rdx, [0x1400b4c80]
call fcn.14006c940
cmp esi, 0x13
jne 0x14008ca0b
mov rdx, rbp
mov rcx, rbx
call fcn.14008c8a0
jmp 0x14008cb47
cmp esi, 0x14
jne 0x14008cb29
cmp dword [rbx + 0x730], 2
mov rbp, qword [rbx + 0x18]
jne 0x14008ca8e
mov rax, qword [rbx + 0x1b8]
mov rdx, qword [rax]
test rdx, rdx
je 0x14008ca8e
mov dword [rsp + 0x28], 3
lea r9, [rsp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
mov rcx, rbx
mov qword [rsp + 0x40], rdi
call fcn.1400840a0
test eax, eax
jne 0x14008cb47
mov rcx, qword [rsp + 0x40]
lea edx, [rsi + 0x1b]
call sub.VCRUNTIME140.dll_strrchr
test rax, rax
je 0x14008ca83
mov rdi, qword [rsp + 0x40]
mov ecx, 1
sub rax, rdi
cmovne rcx, rax
mov byte [rcx + rdi], 0
jmp 0x14008ca8e
mov rcx, qword [rsp + 0x40]
call qword [fcn.1400ab4b6]
mov rdx, qword [rbx + 0x798]
test rdx, rdx
jne 0x14008cab3
cmp byte [rbx + 0xadd], 0
lea rax, [0x1400b4900]
lea rdx, [0x1400b3a4c]
cmovne rdx, rax
lea r8, [0x1400bb370]
test rdi, rdi
mov r9, r8
lea rax, [0x1400c4bc8]
cmovne r9, rdi
lea rcx, [0x1400af130]
cmovne r8, rax
call fcn.14007e020
mov rcx, rdi
mov rsi, rax
call qword [fcn.1400ab4b6]
test rsi, rsi
jne 0x14008caf1
lea edi, [rsi + 0x1b]
jmp 0x14008cb49
lea rdx, [rbp + 0x6d8]
mov r9, rsi
lea r8, [0x1400bb6dc]
mov rcx, rbx
call fcn.1400a5430
mov rcx, rsi
mov edi, eax
call qword [fcn.1400ab4b6]
test edi, edi
jne 0x14008cb49
mov rcx, qword [rbx + 0x18]
mov dword [rcx + 0x7a8], 0x1f
jmp 0x14008cb49
cmp esi, 0x15
jne 0x14008cb34
lea r8d, [rsi - 8]
jmp 0x14008cb3d
cmp esi, 0x16
jne 0x14008cb49
lea r8d, [rsi - 8]
mov dl, 1
mov rcx, rbx
call fcn.14008c370
mov edi, eax
mov eax, edi
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x140092e70
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x38
cmp byte [rcx + 0xaee], 0
movsxd r10, r9d
je 0x140092f94
cmp r8d, 0xff
jne 0x140092ed1
lea eax, [r10 - 0xec]
cmp eax, 0x13
ja 0x140092ebb
lea r8, [0x140000000]
mov r9, qword [r8 + r10*8 + 0xb5880]
mov r8, rdx
lea rdx, [0x1400b6278]
add rsp, 0x38
jmp fcn.14006c940
mov r8, rdx
mov r9d, r10d
lea rdx, [0x1400b6288]
add rsp, 0x38
jmp fcn.14006c940
cmp r8d, 0xfb
jne 0x140092ee3
lea r9, [0x1400b5ddc]
jmp 0x140092f21
cmp r8d, 0xfc
jne 0x140092ef5
lea r9, [0x1400b5de4]
jmp 0x140092f21
cmp r8d, 0xfd
jne 0x140092f07
lea r9, [0x1400b5dec]
jmp 0x140092f21
xor r9d, r9d
lea rax, [0x1400b5df0]
cmp r8d, 0xfe
cmove r9, rax
test r9, r9
je 0x140092f7d
cmp r10d, 0x27
jg 0x140092f54
lea r8, [0x140000000]
mov r8, qword [r8 + r10*8 + 0xb5ea0]
test r8, r8
jne 0x140092f64
mov r8, rdx
mov dword [rsp + 0x20], r10d
lea rdx, [0x1400b62b0]
call fcn.14006c940
add rsp, 0x38
ret
cmp r10d, 0xff
jne 0x140092f3b
lea r8, [0x1400b6294]
mov qword [rsp + 0x20], r8
mov r8, rdx
lea rdx, [0x1400b62a0]
call fcn.14006c940
add rsp, 0x38
ret
mov r9d, r8d
mov dword [rsp + 0x20], r10d
mov r8, rdx
lea rdx, [0x1400b62c0]
call fcn.14006c940
add rsp, 0x38
ret

Function at 0x1400932e0
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
mov byte [rsp + 0x38], 0xff
mov rcx, qword [rcx + 0x18]
mov edi, r8d
mov esi, edx
mov byte [rsp + 0x3a], dil
xor r9d, r9d
mov byte [rsp + 0x39], sil
lea rdx, [rsp + 0x38]
mov rcx, qword [rcx + 0x1f0]
lea r8d, [r9 + 3]
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x14009333f
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, [0x1400b62d0]
mov rcx, rbx
mov r8d, eax
call fcn.14006c7e0
mov r9d, edi
lea rdx, [0x1400b62ec]
mov r8d, esi
mov rcx, rbx
call fcn.140092e70
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400934e0
Capabilities:
Send data
Send data on socket

Disassembly:
cmp edx, 0x1f
jne 0x140093689
push rsi
push rdi
push r15
sub rsp, 0x20
mov rdi, qword [rcx + 0x1b8]
mov rsi, rcx
mov r15, qword [rcx + 0x18]
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x50], rbp
lea rbx, [rdi + 0x1eb8]
mov qword [rsp + 0x58], r14
lea r14, [rdi + 0x1cb8]
mov qword [rbx], r14
cmp r14, rbx
jae 0x140093547
lea rax, [r14 + 1]
mov byte [r14], 0xff
mov qword [rbx], rax
cmp rax, rbx
jae 0x140093547
mov byte [rax], 0xfa
inc qword [rbx]
mov rax, qword [rbx]
cmp rax, rbx
jae 0x140093547
mov byte [rax], dl
inc qword [rbx]
movzx ecx, word [rdi + 0x1ca8]
call qword [sym.imp.WS2_32.dll_htons]
movzx ecx, word [rdi + 0x1caa]
movzx ebp, ax
mov word [rsp + 0x48], ax
call qword [sym.imp.WS2_32.dll_htons]
mov r9, qword [rbx]
movzx ecx, ax
cmp r9, rbx
jae 0x14009357d
mov byte [r9], bpl
inc qword [rbx]
mov r9, qword [rbx]
mov rbp, qword [rsp + 0x50]
cmp r9, rbx
jae 0x1400935d3
movzx eax, byte [rsp + 0x49]
mov byte [r9], al
inc qword [rbx]
mov r9, qword [rbx]
cmp r9, rbx
jae 0x1400935d3
mov byte [r9], cl
inc qword [rbx]
mov r9, qword [rbx]
cmp r9, rbx
jae 0x1400935d3
shr cx, 8
mov byte [r9], cl
inc qword [rbx]
mov r9, qword [rbx]
cmp r9, rbx
jae 0x1400935d3
mov byte [r9], 0xff
inc qword [rbx]
mov r9, qword [rbx]
cmp r9, rbx
jae 0x1400935d3
mov byte [r9], 0xf0
mov r9, qword [rbx]
inc r9
mov qword [rdi + 0x1ec0], r9
lea r8, [rdi + 0x1cba]
sub r9, r14
mov qword [rbx], r14
sub r9, 2
mov edx, 0x3e
mov rcx, rsi
call fcn.140092fa0
mov rcx, qword [r15 + 0x1f0]
xor r9d, r9d
mov rdx, r14
lea r8d, [r9 + 3]
call qword [sym.imp.WS2_32.dll_send]
mov r14, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x40]
test eax, eax
jns 0x140093635
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, [0x1400b62d0]
mov rcx, rsi
mov r8d, eax
call fcn.14006c7e0
lea rdx, [rdi + 0x1cbb]
mov r8d, 4
mov rcx, rsi
call fcn.140093370
mov rcx, qword [r15 + 0x1f0]
lea rdx, [rdi + 0x1cbf]
xor r9d, r9d
lea r8d, [r9 + 2]
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x140093681
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, [0x1400b62d0]
mov rcx, rsi
mov r8d, eax
call fcn.14006c7e0
add rsp, 0x20
pop r15
pop rdi
pop rsi
ret
Function at 0x140094d90
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0xd0
mov rax, qword [0x1400d5058]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rax, qword [rcx + 0x18]
mov rdi, rcx
xor r9d, r9d
mov rbx, qword [rax + 0x6d8]
lea rax, [rsp + 0x30]
mov dword [rsp + 0x30], pe_nt_image_headers64
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r8d, dword [rbx + 0x154]
mov rdx, qword [rbx + 0x160]
add r8d, 4
mov rcx, qword [rbx + 0x18]
call qword [sym.imp.WS2_32.dll_recvfrom]
cmp dword [rbx + 0x148], 0
mov dword [rbx + 0x14c], eax
jne 0x140094e27
movsxd r8, dword [rsp + 0x30]
lea rcx, [rbx + 0xc8]
lea rdx, [rsp + 0x40]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [rsp + 0x30]
mov dword [rbx + 0x148], eax
mov r8d, dword [rbx + 0x14c]
mov qword [rsp + 0xe8], rbp
mov qword [rsp + 0xf0], rsi
cmp r8d, 4
jge 0x140094e8d
lea rdx, [0x1400b69f0]
mov rcx, rdi
call fcn.14006c7e0
mov dword [rbx + 0xc], 7
xor eax, eax
mov rsi, qword [rsp + 0xf0]
mov rbp, qword [rsp + 0xe8]
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.1400aa330
mov rbx, qword [rsp + 0xf8]
add rsp, 0xd0
pop rdi
ret
mov rdx, qword [rbx + 0x160]
movzx eax, byte [rdx]
movzx ecx, byte [rdx + 1]
shl eax, 8
or ecx, eax
mov dword [rbx + 0xc], ecx
sub ecx, 3
je 0x140094f48
sub ecx, 1
je 0x140094fbe
sub ecx, 1
je 0x140094ef7
cmp ecx, 1
je 0x140094eda
lea r8, [0x1400b6a20]
mov rcx, rdi
lea rdx, [0x1400bb6dc]
call fcn.14006c7e0
jmp 0x140094fbe
add r8d, 0xfffffffe
add rdx, 2
mov rcx, rbx
call fcn.140094ac0
test eax, eax
je 0x140094fbe
jmp 0x140094e5c
movzx ecx, byte [rdx + 2]
lea eax, [r8 - 4]
movsxd rbp, eax
lea rsi, [rdx + 4]
movzx eax, byte [rdx + 3]
mov r8, rbp
shl ecx, 8
xor edx, edx
or ecx, eax
mov dword [rbx + 8], ecx
mov rcx, rsi
call sub.VCRUNTIME140.dll_memchr
test rax, rax
je 0x140094fbe
sub rax, rsi
cmp rax, rbp
jae 0x140094fbe
mov r8, rsi
lea rdx, [0x1400b6a10]
mov rcx, rdi
call fcn.14006c940
jmp 0x140094fbe
cmp r8d, 4
jle 0x140094fbe
movzx eax, byte [rdx + 3]
movzx ecx, byte [rdx + 2]
shl ecx, 8
or ecx, eax
movzx eax, word [rbx + 0x15c]
inc eax
movzx eax, ax
cmp eax, ecx
jne 0x140094fbe
lea eax, [r8 - 4]
mov rcx, rdi
lea r8, [rdx + 4]
movsxd r9, eax
mov edx, 1
call fcn.14006c700
mov esi, eax
test eax, eax
je 0x140094f9d
mov edx, 5
mov rcx, rbx
call fcn.140095a70
mov eax, esi
jmp 0x140094e5c
mov eax, dword [rbx + 0x14c]
mov rcx, rdi
sub eax, 4
cdqe
add qword [rdi + 0x100], rax
mov rdx, qword [rdi + 0x100]
call fcn.14007b7a0
mov rcx, rdi
call fcn.14007bab0
test eax, eax
je 0x140094e5a
mov edx, 5
mov rcx, rbx
call fcn.140095a70
mov eax, Ordinal_46
jmp 0x140094e5c
Function at 0x1400a81d0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r14
sub rsp, 0x20
mov eax, dword [rcx + 0x18]
mov rbx, rcx
mov ebp, r8d
mov r14, rdx
lea ecx, [rax + rax]
mov eax, dword [rbx + 0x20]
add rax, 0x18
add rcx, rax
call qword [section.sect_2]
mov rdi, rax
test rax, rax
jne 0x1400a8212
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
lea rcx, [rax + 0x18]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov eax, dword [rbx + 0x18]
add rax, rcx
mov qword [rsp + 0x48], rsi
mov qword [rdi + 0x10], rax
cmp ebp, dword [rbx + 0x1c]
jbe 0x1400a8259
call qword [rbx]
mov rcx, qword [rdi + 8]
mov r8d, ebp
mov rdx, r14
call qword [rbx + reloc.WS2_32.dll_htonl]
mov r14d, dword [rbx + 0x18]
add r14, qword [rdi + 0x10]
mov rdx, qword [rdi + 8]
mov rcx, r14
call qword [rbx + reloc.WS2_32.dll_recv]
mov rcx, qword [rdi + 8]
mov ebp, dword [rbx + 0x20]
call qword [rbx]
mov rcx, qword [rdi + 0x10]
call qword [rbx]
xor esi, esi
test rbp, rbp
je 0x1400a82b2
mov rsi, rbp
nop dword [rax + rax]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x36
mov r8d, 1
mov byte [rsp + 0x40], al
mov rcx, qword [rdi + 8]
call qword [rbx + reloc.WS2_32.dll_htonl]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x5c
lea r14, [r14 + 1]
mov byte [rsp + 0x40], al
mov r8d, 1
mov rcx, qword [rdi + 0x10]
call qword [rbx + reloc.WS2_32.dll_htonl]
sub rbp, 1
jne 0x1400a8270
mov eax, dword [rbx + 0x1c]
cmp rsi, rax
jae 0x1400a82f3
nop word [rax + rax]
mov rcx, qword [rdi + 8]
lea rdx, [0x1400baf8c]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov rcx, qword [rdi + 0x10]
lea rdx, [0x1400baf8d]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov eax, dword [rbx + 0x1c]
inc rsi
cmp rsi, rax
jb 0x1400a82c0
mov rsi, qword [rsp + 0x48]
mov rax, rdi
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret

Function at 0x1400ab1d8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400ab222
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400ab222
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400ab222
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400ab222
cmp dword [rcx + 0x84], 0xe
jbe 0x1400ab222
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400ab224
xor al, al
add rsp, 0x28
ret
Function at 0x1400e7540
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x50
mov r12, r9
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
test r8, r8
jne 0x1400e756d
xor al, al
jmp 0x1400e76cf
mov rax, qword [0x1401076c0]
lea rcx, [rsp]
xor r11d, r11d
mov qword [rcx], rax
mov rax, qword [0x1401076c8]
mov qword [rsp + 0x60], rbp
mov qword [rcx + 8], rax
mov rax, qword [0x1401076d0]
mov rdx, r11
mov qword [rcx + 0x10], rax
mov rax, qword [0x1401076d8]
mov qword [rcx + 0x18], rax
mov rax, qword [0x1401076e0]
mov qword [rcx + 0x20], rax
mov rax, qword [0x1401076e8]
mov qword [rcx + 0x28], rax
mov rax, qword [0x1401076f0]
mov qword [rcx + 0x30], rax
mov rax, qword [0x1401076f8]
mov qword [rcx + 0x38], rax
movzx eax, byte [0x140107700]
mov byte [rcx + 0x40], al
mov rax, qword [r9]
mov rcx, r8
lea rbp, [r8 + rax]
test rbx, rbx
je 0x1400e76c1
add r8, 4
nop word [rax + rax]
movzx r9d, byte [rdx + rdi]
inc rdx
shl r9d, 0x10
cmp rdx, rbx
jne 0x1400e7619
mov r11d, 2
jmp 0x1400e763d
movzx eax, byte [rdx + rdi]
inc rdx
shl eax, 8
or r9d, eax
cmp rdx, rbx
jne 0x1400e7633
mov r11d, 1
jmp 0x1400e763d
movzx eax, byte [rdx + rdi]
or r9d, eax
inc rdx
mov r10d, r9d
and r9d, 0x3f
cmp r8, rbp
ja 0x1400e76e5
mov rax, r10
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx], al
mov rax, r10
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx + 1], al
cmp r11, 1
jbe 0x1400e7682
mov byte [rcx + 2], 0x3d
add rcx, 3
add r8, 3
jmp 0x1400e769a
shr r10, 6
add rcx, 3
and r10d, 0x3f
add r8, 3
movzx eax, byte [rsp + r10]
mov byte [rcx - 1], al
test r11, r11
je 0x1400e76aa
mov byte [rcx], 0x3d
inc rcx
inc r8
jmp 0x1400e76b8
movzx eax, byte [rsp + r9]
inc rcx
inc r8
mov byte [rcx - 1], al
cmp rdx, rbx
jb 0x1400e7600
sub rcx, rsi
mov al, 1
mov qword [r12], rcx
mov rbp, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r12
ret
xor al, al
jmp 0x1400e76ca
Function at 0x416660
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x416806
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00432740
xorps xmm15, xmm15
mov r14, qword [0x006bf738]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x4166cb
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x4166e0
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
nop
test rbx, rbx
jbe 0x416705
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x416719
cmp rbx, 0x1000
jae 0x4166d5
nop dword [rax]
jmp 0x416789
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop
cmp rbx, 0x1000
jae 0x41672d
xor edx, edx
jmp 0x416780
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00432740
xorps xmm15, xmm15
mov r14, qword [0x006bf738]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
nop dword [rax]
test dl, dl
jne 0x41670f
jmp 0x4166f4
call fcn.004629c0
xorps xmm15, xmm15
mov r14, qword [0x006bf738]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.00436c80
lea rax, [0x00526a49]
mov ebx, 0x18
call fcn.00437580
mov rax, qword [rsp + 0x38]
call fcn.00437280
lea rax, [0x00526b21]
mov ebx, 0x19
call fcn.00437580
mov rax, qword [rsp + 0x30]
nop
call fcn.00437280
call fcn.00436ee0
call fcn.00436d00
lea rax, [0x00529c4f]
mov ebx, 0x21
nop dword [rax + rax]
call fcn.00435340
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045ee20
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.00416660
Function at 0x416840
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x416a6a
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.004327c0
xorps xmm15, xmm15
mov r14, qword [0x006bf738]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x4168b9
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x4168cc
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x4168f0
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
nop
jmp 0x416904
cmp rbx, 0x1000
jae 0x4168c3
jmp 0x416985
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x416916
xor esi, esi
jmp 0x416976
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
nop dword [rax]
call fcn.004327c0
xorps xmm15, xmm15
mov r14, qword [0x006bf738]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x4168fa
nop
jmp 0x4168e2
call fcn.004629c0
xorps xmm15, xmm15
mov r14, qword [0x006bf738]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x416a05
call fcn.00436c80
lea rax, [0x0052712f]
mov ebx, 0x19
call fcn.00437580
mov rax, qword [rsp + 0x68]
call fcn.00437280
lea rax, [0x00526b21]
mov ebx, 0x19
call fcn.00437580
mov eax, dword [rsp + 0x34]
nop dword [rax]
call fcn.00437280
call fcn.00436ee0
call fcn.00436d00
lea rax, [0x00521b46]
mov ebx, 0xd
nop dword [rax + rax]
call fcn.00435340
cmp eax, 0x5af
je 0x4169a8
call fcn.00436c80
lea rax, [0x0052712f]
mov ebx, 0x19
nop dword [rax]
call fcn.00437580
mov rax, qword [rsp + 0x38]
call fcn.00437280
lea rax, [0x00526b21]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.00437580
mov eax, dword [rsp + 0x34]
call fcn.00437280
call fcn.00436ee0
call fcn.00436d00
lea rax, [0x0052933f]
mov ebx, 0x1f
call fcn.00435340
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045ee20
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00416840
Function at 0x41ed20
Capabilities:
Hash data using murmur3

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
cmp byte [0x006bf533], 0
jne 0x41ee0f
mov rdx, qword [rax + 0x50]
test byte [rdx], al
nop
nop
nop
sub rbx, qword [rax + 0x18]
mov esi, dword [rax + 0x5c]
imul rbx, rsi
mov rsi, rbx
shr rbx, 0x20
shr rsi, 0x23
and ebx, 7
mov rdi, rcx
mov rcx, rbx
mov r8d, 1
shl r8d, cl
add rdx, rsi
lock or byte [rdx], r8b
nop
nop
mov rcx, qword [rax + 0x18]
nop
movabs rdx, 0x800000000000
lea rax, [rdx + rcx]
mov rdx, rax
shr rax, 0x2a
cmp rax, 0x40
jae 0x41ee05
lea rbx, [0x00691970]
mov rax, qword [rbx + rax*8]
shr rdx, 0x16
and edx, 0xfffff
mov rdx, qword [rax + rdx*8]
test byte [rdx], al
test byte [rax], al
mov rax, rcx
shr rcx, 0x10
and ecx, 0x3f
movzx ebx, byte [rdx + rcx + 0x11440]
lea rsi, [rcx + 0x11440]
add rdx, rsi
shr rax, 0xd
and eax, 7
mov rcx, rax
mov eax, 1
shl eax, cl
nop
test al, bl
jne 0x41ede7
lock or byte [rdx], al
mov rax, qword [r14 + 0x30]
mov rax, qword [rax + 0xa0]
test byte [rax], al
add qword [rax + 0x1248], rdi
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov ecx, 0x40
call fcn.004614a0
lea rax, [0x0052bfaf]
mov ebx, 0x2c
nop dword [rax + rax]
call fcn.00435340
nop
int3

Function at 0x421200
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4212fe
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rbx
mov qword [rsp + 8], 0
jmp 0x421240
mov rax, qword [rsp + 0x50]
mov rcx, rdx
mov rbx, qword [rsp + 0x58]
nop
cmp qword [rsp + 8], rbx
jae 0x4212ef
test byte [rax], al
lea rcx, [rax + 0x100b8]
mov rax, rcx
call fcn.00421da0
nop dword [rax]
test rax, rax
je 0x4212ef
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x30], xmm15
lea rcx, [0x00421340]
mov qword [rsp + 0x10], rcx
lea rdx, [rsp + 8]
mov qword [rsp + 0x18], rdx
mov rdx, qword [rsp + 0x50]
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rbx
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x38], rax
lea rbx, [rsp + 0x10]
mov qword [rsp], rbx
call fcn.0045ece0
xorps xmm15, xmm15
mov r14, qword [0x006bf738]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x60]
test rdx, rdx
jne 0x4212dd
xor eax, eax
jmp 0x4212e7
mov rax, qword [rdx]
call rax
mov rdx, qword [rsp + 0x60]
test al, al
je 0x421232
mov rax, qword [rsp + 8]
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.0045ee20
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.00421200
Function at 0x42ebc0
Capabilities:
Hash data using murmur3

Disassembly:
cmp rsp, qword [r14 + 0x18]
jbe 0x42ee66
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
test byte [rax], al
lea rsi, [rax + 0x1270]
mov rcx, qword [rax + 0x1260]
sub rcx, rsi
shr rcx, 3
cmp rcx, 0x200
ja 0x42ee5a
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x30], rcx
mov qword [rax + 0x1260], 0
cmp byte [0x006bf533], 0
jne 0x42ec22
xor edx, edx
xor ebx, ebx
nop
jmp 0x42ec6a
xor edx, edx
jmp 0x42ec4d
mov qword [rsp + 0x28], rdx
mov rcx, qword [rax + rdx*8 + 0x1270]
mov rax, rcx
call fcn.0041e540
mov rdx, qword [rsp + 0x28]
inc rdx
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
cmp rdx, rcx
jl 0x42ec26
add rax, 0x1260
call fcn.0042ea80
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
inc rdx
cmp rdx, rcx
jge 0x42edf4
mov rsi, qword [rax + rdx*8 + 0x1270]
nop dword [rax + rax]
cmp rsi, 0x1000
jb 0x42ec67
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rbx
mov rax, rsi
xor ebx, ebx
mov rcx, rbx
nop dword [rax + rax]
call fcn.004135e0
test rax, rax
jne 0x42ecc2
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
nop
jmp 0x42ec67
mov rsi, qword [rbx + 0x50]
test byte [rsi], al
nop
mov r8, rcx
shr rcx, 3
movzx r9d, byte [rsi + rcx]
and r8d, 7
mov rdx, rcx
mov rcx, r8
mov r10d, 1
shl r10d, cl
add rsi, rdx
test r10b, r9b
je 0x42ed09
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
jmp 0x42ec67
nop
lock or byte [rsi], r10b
nop
nop
mov rcx, qword [rbx + 0x18]
nop
movabs rsi, 0x800000000000
lea r8, [rsi + rcx]
mov r9, r8
shr r8, 0x2a
cmp r8, 0x40
jae 0x42ee4d
lea r10, [0x00691970]
mov r8, qword [r10 + r8*8]
shr r9, 0x16
and r9d, 0xfffff
mov r9, qword [r8 + r9*8]
test byte [r9], al
test byte [r8], al
mov r8, rcx
shr rcx, 0x10
and ecx, 0x3f
movzx r10d, byte [r9 + rcx + 0x11440]
lea r11, [rcx + 0x11440]
add r9, r11
shr r8, 0xd
and r8d, 7
mov rcx, r8
mov r8d, 1
shl r8d, cl
test r8b, r10b
jne 0x42ed8e
lock or byte [r9], r8b
movzx r8d, byte [rbx + 0x62]
test r8b, 1
je 0x42edc5
mov rax, qword [rsp + 0x48]
mov r8, qword [rax + 0x1248]
add r8, qword [rbx + 0x68]
mov qword [rax + 0x1248], r8
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
nop
jmp 0x42ec67
mov r8, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
cmp r8, rcx
jae 0x42ee45
mov rbx, qword [rsp + 0x48]
mov qword [rbx + r8*8 + 0x1270], rax
inc r8
mov rax, rbx
mov rdx, qword [rsp + 0x28]
mov rbx, r8
jmp 0x42ec67
cmp rbx, 0x200
ja 0x42ee38
lea rdx, [rax + 0x1270]
lea rsi, [rax + 0x1238]
mov rcx, rbx
mov edi, 0x200
mov rbx, rdx
mov rax, rsi
call fcn.00424680
mov rax, qword [rsp + 0x48]
add rax, 0x1260
call fcn.0042ea80
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov rcx, rbx
mov edx, 0x200
call fcn.00461500
mov rax, r8
call fcn.00461480
mov rax, r8
mov ecx, 0x40
call fcn.004614a0
mov edx, 0x200
nop
call fcn.004614e0
nop
mov qword [rsp + 8], rax
call fcn.00463860
mov rax, qword [rsp + 8]
jmp fcn.0042ebc0