joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400f3870
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.1400d61e4
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.1400d61e4
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x1400f39c0
cmp rax, 0xffffffffffffffff
je 0x1400f39c0
xor edi, edi
test rbp, rbp
jle 0x1400f396b
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.1400d63e0
mov rbx, rax
test rax, rax
jne 0x1400f38f8
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x1400f3961
mov edx, 0x8000
mov ecx, r14d
call fcn.1400d4d7c
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.1400e3978
cmp eax, 0xffffffff
je 0x1400f3941
cdqe
sub rbp, rax
test rbp, rbp
jg 0x1400f3908
mov edx, r15d
mov ecx, r14d
call fcn.1400d4d7c
jmp 0x1400f3961
cmp byte [rsi + 0x38], dil
je 0x1400f3958
cmp dword [rsi + 0x34], 5
jne 0x1400f3958
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x1400f3961
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.1400d6460
jmp 0x1400f39d4
jns 0x1400f39d4
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.1400d61e4
cmp rax, 0xffffffffffffffff
jne 0x1400f398c
cmp byte [rsi + 0x30], dil
je 0x1400f39d4
mov edi, dword [rsi + 0x2c]
jmp 0x1400f39d4
mov ecx, r14d
call fcn.1400df77c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1400f39d4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x1400f39d4
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x1400f39cd
mov eax, dword [rsi + 0x2c]
jmp 0x1400f39d2
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.1400d61e4
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x140001100
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x68
mov qword [rsp + 0x50], 0x7786d5e8
mov qword [rsp + 0x48], 0x2f353c2e
mov eax, dword [rsp + 0x5c]
mov rcx, qword [rsp + 0x48]
mov rdx, rcx
add rdx, rdx
mov r8, rcx
sub r8, r8
mov r9, rcx
imul r9, r9
mov r10, qword [rsp + 0x50]
imul r8, rdx
cmp r10, 0x6c69a444
mov dword [rsp + 0x44], eax
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x28], r9
jne 0x140001157
mov eax, 0x392407c8
mov rcx, qword [rsp + 0x38]
imul rcx, rcx
mov rdx, qword [rsp + 0x28]
sub rcx, rdx
mov r8, qword [rsp + 0x38]
mov qword [rsp + 0x60], r8
mov r9d, dword [rsp + 0x44]
sub eax, r9d
mov dword [rsp + 0x5c], eax
mov r10, qword [rsp + 0x30]
cmp r10, rcx
ja 0x1400011a0
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call rax
cmp eax, 4
jb 0x1400011a0
add rsp, 0x68
ret
mov rax, qword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, 0xfffffffe
call rax
ud2
Function at 0x140065360
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x50
mov eax, 0x9c3924b
mov dword [rsp + 0x4c], 0x37d2add
mov ecx, dword [rsp + 0x4c]
mov dword [rsp + 0x48], 0xbe511b53
mov edx, ecx
xor edx, 0x7efa8ad6
mov dword [rsp + 0x3c], edx
mov edx, dword [rsp + 0x3c]
mov r8, qword [rsp + 0x40]
mov r9d, dword [rsp + 0x3c]
mov qword [rsp + 0x40], 0x49586616
cmp eax, edx
mov dword [rsp + 0xc], r9d
mov dword [rsp + 8], ecx
mov qword [rsp], r8
ja 0x140065441
jmp 0x1400653ce
lea rax, [fcn.140065360]
mov qword [rsp + 0x10], 0x1130ae78
mov qword [rsp + 0x20], rax
jmp 0x1400653e2
mov qword [rsp + 0x20], 0
mov eax, dword [rsp + 0xc]
cmp eax, 0x2012b69f
ja 0x1400653b7
mov eax, 0x56f1de
mov rcx, qword [rsp + 0x20]
mov qword [rsp + 0x30], rcx
mov rcx, qword [rsp + 0x30]
mov dword [rsp + 0x48], 0x4dbe0746
mov dx, word [rcx]
mov word [rsp + 0x2e], dx
cmp eax, dword [rsp + 0x3c]
je 0x140065415
cmp word [rsp + 0x2e], 0x5a4d
je 0x140065441
mov eax, 0x64b9bcd4
mov ecx, eax
mov rdx, qword [rsp + 0x30]
mov r8, qword [rsp + 0x10]
sub r8, 0x51be019d
mov qword [rsp + 0x18], rdx
cmp rcx, r8
jne 0x14006547b
mov rax, qword [rsp + 0x30]
add rsp, 0x50
ret
mov rax, qword [rsp + 0x30]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp]
xor rdx, rdx
mov qword [rsp + 0x40], rdx
mov r8d, dword [rcx + rax]
mov r9d, dword [rsp + 8]
or r9d, 0x531cd6c2
mov dword [rsp + 0x48], r9d
cmp r8d, 0x4550
je 0x140065437
jmp 0x140065415
mov rax, qword [rsp + 0x18]
add rax, 0xfffffffffffff000
and rax, 0xfffffffffffff000
mov ecx, dword [rsp + 8]
or ecx, 0x320a06fd
mov dword [rsp + 0x48], ecx
mov ecx, dword [rsp + 8]
mov dword [rsp + 0x48], ecx
mov qword [rsp + 0x20], rax
mov rax, qword [rsp]
imul rdx, rax, 0x51ce6579
mov qword [rsp + 0x40], rdx
jmp 0x1400653e2
Function at 0x1400654c0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x30], 0x6bf4db89
mov dword [rsp + 0x2c], 0x327de9bb
mov qword [rsp + 0x20], 0x70889630
mov dword [rsp + 0x10], 0
mov qword [rsp + 8], rcx
jmp 0x140065503
mov eax, dword [rsp + 0x40]
or eax, 0xa1bae93
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x14]
add rsp, 0x48
ret
mov eax, 0xb4d4882
mov ecx, eax
mov eax, 0x9b26bd3
mov edx, eax
mov eax, dword [rsp + 0x10]
mov dword [rsp + 0x14], eax
mov r8, qword [rsp + 0x40]
mov eax, dword [rsp + 0x14]
imul r8, r8, 0x46534deb
mov qword [rsp + 0x40], r8
mov r9d, dword [rsp + 0x3c]
xor r9d, dword [rsp + 0x3c]
mov eax, eax
mov r8d, eax
mov dword [rsp + 0x3c], r9d
mov r10, qword [rsp + 8]
add r10, r8
mov qword [rsp + 0x18], r10
sub rdx, qword [rsp + 0x40]
mov r8, qword [rsp + 0x20]
mov qword [rsp + 0x40], rdx
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffc81866a2
add r8, 0x71e79e50
sub rcx, qword [rsp + 0x40]
mov qword [rsp + 0x40], rcx
mov dword [rsp + 0x10], 0x4f127502
cmp r8, rdx
jbe 0x140065503
mov eax, 0x327de9bc
mov rcx, qword [rsp + 0x40]
add rcx, 0x69c42e0e
mov qword [rsp + 0x40], rcx
mov edx, dword [rsp + 0x3c]
mov rcx, qword [rsp + 0x18]
mov r8d, dword [rsp + 0x3c]
mov qword [rsp], rcx
mov ecx, r8d
shl edx, cl
mov r8d, dword [rsp + 0x2c]
mov dword [rsp + 0x3c], edx
sub eax, r8d
mov r9, qword [rsp + 0x40]
imul r9, qword [rsp + 0x40]
mov qword [rsp + 0x40], r9
mov edx, dword [rsp + 0x3c]
add edx, dword [rsp + 0x3c]
mov r9, qword [rsp]
mov cl, byte [r9]
mov dword [rsp + 0x3c], edx
add eax, dword [rsp + 0x14]
mov dword [rsp + 0x10], eax
cmp cl, 0
je 0x1400654ed
jmp 0x140065503
Function at 0x140013ec0
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140013cec

Function at 0x140036398
Capabilities:
Inspect section memory permissions

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x38
mov dword [rsp + 4], 0
mov dword [rsp + 8], 0
mov dword [rsp + 0xc], 0
mov dword [rsp], 0
mov eax, dword [rsp + 0x40]
and eax, 0x20000000
test eax, eax
je 0x1400363d8
mov dword [rsp + 4], 1
mov eax, dword [rsp + 0x40]
and eax, 0x40000000
test eax, eax
je 0x1400363f1
mov dword [rsp + 8], 1
mov eax, dword [rsp + 0x40]
and eax, 0x80000000
test eax, eax
je 0x14003640a
mov dword [rsp + 0xc], 1
mov dword [rsp + 0x10], 1
mov dword [rsp + 0x14], 8
mov dword [rsp + 0x18], 2
mov dword [rsp + 0x1c], 4
mov dword [rsp + 0x20], 0x10
mov dword [rsp + 0x24], 0x80
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x2c], 0x40
movsxd rax, dword [rsp + 4]
imul rax, rax, 0x10
lea rax, [rsp + rax + 0x10]
movsxd rcx, dword [rsp + 8]
lea rax, [rax + rcx*8]
movsxd rcx, dword [rsp + 0xc]
mov eax, dword [rax + rcx*4]
mov dword [rsp], eax
mov eax, dword [rsp + 0x40]
and eax, 0x4000000
test eax, eax
je 0x140036487
mov eax, dword [rsp]
bts eax, 9
mov dword [rsp], eax
mov eax, dword [rsp]
add rsp, 0x38
ret
Function at 0x6d89a5d0
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x6d8bb5e4]
test esi, esi
mov rbx, rcx
mov rbp, rdx
mov rdi, r8
jle 0x6d89a758
mov rax, qword [0x6d8bb5e8]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp rbx, rdx
jb 0x6d89a61c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rbx, rdx
jb 0x6d89a6a5
add ecx, 1
add rax, 0x28
cmp ecx, esi
jne 0x6d89a600
mov rcx, rbx
call sym.__mingw_GetSectionForAddress
test rax, rax
mov r12, rax
je 0x6d89a78d
mov rax, qword [0x6d8bb5e8]
lea rsi, [rsi + rsi*4]
shl rsi, 3
add rax, rsi
mov qword [rax + 0x20], r12
mov dword [rax], 0
call sym._GetPEImageBase
mov ecx, dword [r12 + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x6d8bb5e8]
mov qword [rax + rsi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x6d89a770
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x6d89a69e
sub eax, 0x40
and eax, 0xffffffbf
jne 0x6d89a700
add dword [0x6d8bb5e4], 1
cmp edi, 8
jae 0x6d89a6d3
test dil, 4
jne 0x6d89a744
test edi, edi
je 0x6d89a6c8
movzx eax, byte [rbp]
test dil, 2
mov byte [rbx], al
jne 0x6d89a75f
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov eax, edi
sub edi, 1
mov rdx, qword [rbp + rax - 8]
cmp edi, 8
mov qword [rbx + rax - 8], rdx
jb 0x6d89a6c8
and edi, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov rcx, qword [rbp + rdx]
cmp eax, edi
mov qword [rbx + rdx], rcx
jb 0x6d89a6ec
jmp 0x6d89a6c8
add rsi, qword [0x6d8bb5e8]
mov r8d, 0x40
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r9, rsi
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x6d89a69e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call sym.__report_error
mov eax, dword [rbp]
mov edi, edi
mov dword [rbx], eax
mov eax, dword [rbp + rdi - 4]
mov dword [rbx + rdi - 4], eax
jmp 0x6d89a6c8
xor esi, esi
jmp 0x6d89a627
mov edi, edi
movzx eax, word [rbp + rdi - 2]
mov word [rbx + rdi - 2], ax
jmp 0x6d89a6c8
mov rax, qword [0x6d8bb5e8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov edx, dword [r12 + 8]
mov r8, qword [rax + rsi + 0x18]
call sym.__report_error
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call sym.__report_error
nop
nop dword [rax]

Function at 0x6d89aee0
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x6d8bb8c0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x6d8bb8a0]
test rbx, rbx
je 0x6d89af34
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x6d89af2b
test rsi, rsi
je 0x6d89af2b
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x6d89af10
lea rcx, [0x6d8bb8c0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x6d89b170
Capabilities:
Parse pe header

Disassembly:
cmp word [rcx], 0x5a4d
je 0x6d89b180
xor eax, eax
ret
jmp sym._ValidateImageBase.part.0

Function at 0x6d89b190
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x6d89b1d1
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
mov r8d, dword [rax + 0xc]
cmp r8, rdx
mov rcx, r8
ja 0x6d89b1c8
add ecx, dword [rax + 8]
cmp rcx, rdx
ja 0x6d89b1d3
add rax, 0x28
cmp rax, r9
jne 0x6d89b1b4
xor eax, eax
ret

Function at 0x6d89b270
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x6d8b81f0]
cmp word [r8], 0x5a4d
mov rdx, rcx
jne 0x6d89b2dd
mov rcx, r8
call sym._ValidateImageBase.part.0
test eax, eax
je 0x6d89b2dd
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x6d89b2dd
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x6d89b2d4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x6d89b2df
add rax, 0x28
cmp rax, r9
jne 0x6d89b2c0
xor eax, eax
add rsp, 0x28
ret

Function at 0x6d89b3e0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x6d8b81f0]
xor eax, eax
cmp word [r8], 0x5a4d
mov rdx, rcx
je 0x6d89b400
add rsp, 0x28
ret
mov rcx, r8
call sym._ValidateImageBase.part.0
test eax, eax
je 0x6d89b3f8
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x6d89b45d
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x6d89b454
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x6d89b464
add rax, 0x28
cmp rax, r9
jne 0x6d89b440
xor eax, eax
add rsp, 0x28
ret
mov eax, dword [rax + 0x24]
not eax
shr eax, 0x1f
add rsp, 0x28
ret

Function at 0x6d89b480
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r11, qword [0x6d8b81f0]
cmp word [r11], 0x5a4d
mov r9d, ecx
jne 0x6d89b4ee
mov rcx, r11
call sym._ValidateImageBase.part.0
test eax, eax
je 0x6d89b4ee
movsxd rax, dword [r11 + 0x3c]
add rax, r11
mov edx, dword [rax + 0x90]
test edx, edx
je 0x6d89b4ee
movzx ecx, word [rax + 0x14]
lea rcx, [rax + rcx + 0x18]
movzx eax, word [rax + 6]
test eax, eax
je 0x6d89b4ee
sub eax, 1
lea rax, [rax + rax*4]
lea rax, [rcx + rax*8 + 0x28]
mov r10d, dword [rcx + 0xc]
cmp rdx, r10
mov r8, r10
jb 0x6d89b4e5
add r8d, dword [rcx + 8]
cmp rdx, r8
jb 0x6d89b4f5
add rcx, 0x28
cmp rcx, rax
jne 0x6d89b4d0
xor eax, eax
add rsp, 0x28
ret
add rdx, r11
jne 0x6d89b508
jmp 0x6d89b4ee
sub r9d, 1
add rdx, 0x14
mov ecx, dword [rdx + 4]
test ecx, ecx
jne 0x6d89b516
mov eax, dword [rdx + 0xc]
test eax, eax
je 0x6d89b4ee
test r9d, r9d
jg 0x6d89b500
mov eax, dword [rdx + 0xc]
add rax, r11
add rsp, 0x28
ret
Function at 0x6d89b880
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call sym.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call sym.__acrt_iob_func
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sym.vfprintf
call sym.abort
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x414340
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4144b9
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.0042e6e0
xorps xmm15, xmm15
mov r14, qword [0x00634310]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x4143b0
mov rbx, qword [rsp + 0x60]
jmp 0x4143c0
add rsp, 0x48
pop rbp
ret
sub rax, rbx
add rcx, rbx
mov rbx, rax
nop
test rbx, rbx
jbe 0x4143e5
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rcx
mov rax, rbx
jmp 0x4143f5
cmp rbx, 0x1000
jae 0x4143b6
nop dword [rax]
jmp 0x414469
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
cmp rbx, 0x1000
jae 0x414402
xor edx, edx
jmp 0x414460
mov qword [rsp + 0x30], rbx
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.0042e6e0
xorps xmm15, xmm15
mov r14, qword [0x00634310]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
mov edx, eax
mov rax, qword [rsp + 0x38]
nop
test dl, dl
jne 0x4143eb
jmp 0x4143d4
call fcn.00458ea0
xorps xmm15, xmm15
mov r14, qword [0x00634310]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
cmp eax, 8
jne 0x4144a0
lea rax, [0x0050b946]
mov ebx, 0xd
call fcn.00430e20
nop dword [rax]
cmp eax, 0x5af
je 0x414488
lea rax, [0x00510292]
mov ebx, 0x1f
call fcn.00430e20
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004557a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00414340
Function at 0x41c560
Capabilities:
Hash data using murmur3

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41c77a
push rbp
mov rbp, rsp
sub rsp, 0x30
test rax, 7
jne 0x41c768
mov qword [rsp + 0x40], rax
mov rdx, qword [rdi + 0x50]
test byte [rdx], al
mov r9, r8
shr r9, 3
mov r10, r8
and r10d, 7
nop
mov r11, rcx
mov rcx, r10
mov r12d, 1
shl r12d, cl
lea r10, [rdx + r9]
cmp byte [0x006340f2], 0
jne 0x41c6a1
cmp dword [0x00634690], 0
nop
jle 0x41c5e9
cmp qword [rdi + 0xa0], r8
ja 0x41c5e9
mov r8, qword [rdi + 0x48]
test byte [r8], al
movzx r8d, byte [r9 + r8]
nop
nop dword [rax + rax]
test r12b, r8b
je 0x41c718
movzx edx, byte [r9 + rdx]
test r12b, dl
jne 0x41c69b
nop
lock or byte [r10], r12b
mov rcx, qword [rdi + 0x18]
movabs rdx, 0x800000000000
add rdx, rcx
mov r8, rdx
shr rdx, 0x2a
nop
nop
nop
nop word [rax + rax]
cmp rdx, 0x40
jae 0x41c70b
lea r9, [0x006064d8]
mov rdx, qword [r9 + rdx*8]
test byte [rdx], al
mov r9, rcx
shr r9, 0x10
and r9d, 0x3f
shr rcx, 0xd
and ecx, 7
mov r10d, 1
shl r10d, cl
shr r8, 0x16
and r8d, 0xfffff
mov rdx, qword [rdx + r8*8]
test byte [rdx], al
movzx r8d, byte [rdx + r9 + 0x11440]
lea rdx, [rdx + r9]
lea rdx, [rdx + 0x11440]
test r10b, r8b
jne 0x41c680
lock or byte [rdx], r10b
movzx edx, byte [rdi + 0x6a]
test dl, 1
je 0x41c6c2
mov rax, qword [rsi + 0x10]
add rax, qword [rdi + 0x70]
mov qword [rsi + 0x10], rax
add rsp, 0x30
pop rbp
ret
add rsp, 0x30
pop rbp
ret
mov qword [rsp + 0x60], rsi
mov rcx, r11
mov rdi, r10
mov esi, r12d
call fcn.00413f60
test al, al
jne 0x41c6f8
mov rax, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x60]
prefetcht0 byte [rax]
mov rdx, qword [rsi]
test rdx, rdx
je 0x41c6e7
mov rdi, qword [rdx + 0x10]
cmp rdi, 0xfd
je 0x41c6e7
jae 0x41c6fe
mov qword [rdx + rdi*8 + 0x18], rax
inc qword [rdx + 0x10]
jmp 0x41c6f2
mov rbx, rax
mov rax, rsi
call fcn.00421b00
add rsp, 0x30
pop rbp
ret
add rsp, 0x30
pop rbp
ret
mov rax, rdi
mov ecx, 0xfd
call fcn.00457a20
mov rax, rdx
mov ecx, 0x40
call fcn.00457a40
lea rax, [0x0050aca0]
mov rcx, rbx
mov rdi, r11
mov ebx, 4
call fcn.0041c7e0
lea rax, [0x0050ab86]
mov ebx, 3
mov rcx, qword [rsp + 0x40]
mov rdi, 0xffffffffffffffff
call fcn.0041c7e0
mov rdx, qword [r14 + 0x30]
mov byte [rdx + 0xf9], 2
lea rax, [0x0050cc00]
mov ebx, 0x13
call fcn.00430e20
lea rax, [0x0051105b]
mov ebx, 0x23
call fcn.00430e20
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
call fcn.004557a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
nop dword [rax + rax]
jmp fcn.0041c560
Function at 0x41c8e0
Capabilities:
Hash data using murmur3

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
cmp byte [0x006340f2], 0
jne 0x41c9c7
sub rbx, qword [rax + 0x18]
mov rdx, qword [rax + 0x50]
test byte [rdx], al
mov esi, dword [rax + 0x64]
imul rbx, rsi
mov rsi, rbx
shr rbx, 0x20
shr rsi, 0x23
and ebx, 7
mov rdi, rcx
mov rcx, rbx
mov r8d, 1
shl r8d, cl
add rdx, rsi
nop
nop
nop
nop
lock or byte [rdx], r8b
mov rcx, qword [rax + 0x18]
movabs rdx, 0x800000000000
lea rax, [rdx + rcx]
mov rdx, rax
shr rdx, 0x2a
nop
nop
nop
cmp rdx, 0x40
jae 0x41c9ba
lea rbx, [0x006064d8]
mov rdx, qword [rbx + rdx*8]
test byte [rdx], al
mov rbx, rcx
shr rbx, 0x10
and ebx, 0x3f
shr rcx, 0xd
and ecx, 7
mov esi, 1
shl esi, cl
shr rax, 0x16
and eax, 0xfffff
mov rax, qword [rdx + rax*8]
test byte [rax], al
movzx edx, byte [rax + rbx + 0x11440]
lea rax, [rax + rbx]
lea rax, [rax + 0x11440]
test sil, dl
jne 0x41c9a0
lock or byte [rax], sil
mov rax, qword [r14 + 0x30]
mov rax, qword [rax + 0xa0]
test byte [rax], al
add qword [rax + 0x1250], rdi
add rsp, 0x10
pop rbp
ret
mov rax, rdx
mov ecx, 0x40
call fcn.00457a40
lea rax, [0x00512bee]
mov ebx, 0x2c
call fcn.00430e20
nop
int3

Function at 0x41e7a0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41e8a6
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x70], rcx
mov byte [rsp + 0x17], dil
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x18], 0
jmp 0x41e7e3
mov rax, qword [rsp + 0x60]
mov rcx, rdx
mov rbx, qword [rsp + 0x68]
movzx edi, byte [rsp + 0x17]
cmp qword [rsp + 0x18], rbx
jae 0x41e89b
test byte [rax], al
lea rcx, [rax + 0x100b8]
mov ebx, edi
mov rax, rcx
nop dword [rax]
call fcn.0041f340
test rax, rax
je 0x41e89b
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x30], xmm15
movups xmmword [rsp + 0x40], xmm15
lea rcx, [0x0041e8e0]
mov qword [rsp + 0x20], rcx
lea rdx, [rsp + 0x18]
mov qword [rsp + 0x28], rdx
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x48], rax
lea rbx, [rsp + 0x20]
mov qword [rsp], rbx
nop dword [rax]
call fcn.00455660
xorps xmm15, xmm15
mov r14, qword [0x00634310]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x70]
nop dword [rax]
test rdx, rdx
jne 0x41e889
xor eax, eax
jmp 0x41e893
mov rax, qword [rdx]
call rax
mov rdx, qword [rsp + 0x70]
test al, al
je 0x41e7d1
mov rax, qword [rsp + 0x18]
add rsp, 0x50
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov byte [rsp + 0x20], dil
call fcn.004557a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movzx edi, byte [rsp + 0x20]
jmp fcn.0041e7a0
Function at 0x429d00
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x429e10
push rbp
mov rbp, rsp
sub rsp, 0x58
mov qword [rsp + 0x68], rax
mov byte [rsp + 0x80], dil
nop
test dil, dil
je 0x429d55
mov qword [rsp + 0x78], rcx
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rbx
mov eax, 6
call fcn.00434920
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
movzx edi, byte [rsp + 0x80]
mov qword [rsp + 8], 0
nop
test rbx, rbx
jne 0x429d6d
test dil, dil
jmp 0x429dfb
lea rdx, [rsp + 0x68]
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rsi, [0x00429e60]
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x28], rcx
mov rax, r14
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rdx
mov byte [rsp + 0x48], dil
lea rax, [rsp + 8]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.00455660
xorps xmm15, xmm15
mov r14, qword [0x00634310]
mov r14, qword gs:[r14]
mov r14, qword [r14]
movzx eax, byte [rsp + 0x80]
test al, al
je 0x429e05
nop dword [rax]
call fcn.00434aa0
mov rax, qword [rsp + 8]
add rsp, 0x58
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov byte [rsp + 0x20], dil
call fcn.004557a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movzx edi, byte [rsp + 0x20]
nop dword [rax]
jmp fcn.00429d00