joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140012320
Capabilities:
Execute shellcode via indirect call

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x14088af74]
test esi, esi
mov rdi, rcx
mov rbp, rdx
mov rbx, r8
jle 0x1400124b0
mov rax, qword [0x14088af78]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp rdi, rdx
jb 0x14001236c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rdi, rdx
jb 0x1400123f5
add ecx, 1
add rax, 0x28
cmp ecx, esi
jne 0x140012350
mov rcx, rdi
call fcn.140012e80
test rax, rax
mov r12, rax
je 0x140012502
mov rax, qword [0x14088af78]
lea rsi, [rsi + rsi*4]
shl rsi, 3
add rax, rsi
mov qword [rax + 0x20], r12
mov dword [rax], 0
call fcn.140012fc0
mov ecx, dword [r12 + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x14088af78]
mov qword [rax + rsi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1400124e5
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x1400123ee
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x140012460
add dword [0x14088af74], 1
cmp ebx, 8
jae 0x140012421
test bl, 4
jne 0x1400124c0
test ebx, ebx
je 0x140012416
movzx eax, byte [rbp]
test bl, 2
mov byte [rdi], al
jne 0x1400124d4
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov eax, ebx
sub ebx, 1
mov rdx, qword [rbp + rax - 8]
cmp ebx, 8
mov qword [rdi + rax - 8], rdx
jb 0x140012416
and ebx, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov rcx, qword [rbp + rdx]
cmp eax, ebx
mov qword [rdi + rdx], rcx
jb 0x14001243a
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
cmp eax, 2
mov r8d, 4
mov eax, 0x40
mov rcx, qword [rsp + 0x20]
cmovne r8d, eax
mov rdx, qword [rsp + 0x38]
add rsi, qword [0x14088af78]
mov r9, rsi
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1400123ee
call qword [0x14088c2c4]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.1400122b0
xor esi, esi
jmp 0x140012377
mov eax, dword [rbp]
mov ebx, ebx
mov dword [rdi], eax
mov eax, dword [rbp + rbx - 4]
mov dword [rdi + rbx - 4], eax
jmp 0x140012416
mov ebx, ebx
movzx eax, word [rbp + rbx - 2]
mov word [rdi + rbx - 2], ax
jmp 0x140012416
mov rax, qword [0x14088af78]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov edx, dword [r12 + 8]
mov r8, qword [rax + rsi + 0x18]
call fcn.1400122b0
lea rcx, str.Address__p_has_no_image_section
mov rdx, rdi
call fcn.1400122b0
nop
nop dword [rax]
nop word cs:[rax + rax]
Function at 0x140012e80
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r9, qword [0x14087d750]
xor edx, edx
cmp word [r9], 0x5a4d
mov r8, rcx
jne 0x140012eef
mov rcx, r9
call fcn.140012d50
test eax, eax
je 0x140012eef
movsxd rax, dword [r9 + 0x3c]
mov rcx, r8
sub rcx, r9
add r9, rax
movzx eax, word [r9 + 0x14]
lea rdx, [r9 + rax + 0x18]
movzx eax, word [r9 + 6]
test eax, eax
je 0x140012eed
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [rdx + rax*8 + 0x28]
mov r8d, dword [rdx + 0xc]
cmp rcx, r8
mov rax, r8
jb 0x140012ee4
add eax, dword [rdx + 8]
cmp rcx, rax
jb 0x140012eef
add rdx, 0x28
cmp rdx, r9
jne 0x140012ed0
xor edx, edx
mov rax, rdx
add rsp, 0x28
ret
Function at 0x14001d390
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
lea rcx, [0x140873b60]
jmp 0x140013cb0

Function at 0x14001d3a0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
lea rcx, [0x140873b60]
jmp 0x140013cb0

Function at 0x14089904f
Capabilities:
Encode data using xor

Disassembly:
not byte [rsp + 0x58]
jne 0x14099dacf
add dword [rcx + 0x37], esp
jo 0x14099da1d
int3
add byte [rsi + 0x7e], dl
jae 0x14099d99b
mov cl, 0x64
invalid
invalid
jb 0x14099d9cb
cli
cmc
idiv byte [rdx + 0x3d]
mov ah, 0x72
invalid
cwde
cli
pop r13
fadd dword [rax - 0x145a5971]
rcr byte [rax - 0x55], 1
rol byte [rdi + 0x6c7cd54b], 1
cdq
fidiv word [rbx]
je 0x14099da47
invalid
scasb al, byte [rdi]
js 0x14099da67
mov esi, dword [r14 + 0x79fa89cc]
cmc
jns 0x14099da86
mov ebx, 0x91767d72
mov ebx, edi
jns 0x14099da8f
mov ebx, 0x2140ed37
cmp dword [rbx + rsi*8 - 0x7095e2fd], ebp
mov cs, word ds:[rbx]
pop rsp
cmp al, 0x7a
or ebx, dword [rsp + rdi + 0x7a]
cmp eax, 0x4016130
adc esi, dword [rbx]
invalid
jo 0x1409a8d40
sub dword [rcx + 0x68fefb01], 0x2f957578
rol byte [rsp + rsi*2], cl
stc
mov dword [rbx - 0xa], esi
loopne 0x14099da98
mov ebp, 0x2c3a27dd
je 0x14099daa8
loope 0x14099db4c
jle 0x14099db1b
rcr byte [rbp - 0x732548f3], 1
movsb byte [rdi], byte [rsi]
jmp 0x10550ae68
movabs al, byte [0x853bbf31145c67b5]
xor al, 0x71
stosd dword [rdi], eax
cmpsd dword [rsi], dword [rdi]
cmp eax, dword [rbp - 0x58548ecc]
push 0xffffffff847a23ef
xor al, 0x71
stosd dword [rdi], eax
stosb byte [rdi], al
loop 0x14099db14
invalid
lahf
call 0x181f8c22a
push rsp
pushfq
movabs r12, 0x2fb7a533999ccc2b
push rbx
neg r12w
test r12, 0xffffffffb1a64e1c
xchg qword [rsp + 0x18], rsi
call fcn.1409caf4a
Function at 0x1408ad4e8
Capabilities:
Encode data using xor

Disassembly:
add r13d, 0xf6188e3e
jbe 0x1409a535a
setg r11b
je fcn.14092c562
sub r13, r13
lea r11, [r11 + r11*2 - 0x4c753e51]
mov r11, qword [rsp + r13 + 0x28]
jae 0x14098330b
push rcx
cmp dword [rcx + 0x6c], esp
or al, 0xb6
xchg ebx, eax
add eax, 0x4278101d
mul ecx
xor esp, edi
lodsb al, byte [rsi]
xchg esi, eax
invalid

Function at 0x1408b0f30
Capabilities:
Packed with generic packer

Disassembly:
sub qword [rsp + r11*2 - 0xf4], r11
jl 0x14094ec82
jle 0x1409c96de
and byte [rsp + r11 - 0x4a], 0xf
mov r10, qword [rsp + 0x38]
mov r11, qword [rsp + r11 - 0x5a]
call fcn.14090ebaf

Function at 0x1408bf214
Capabilities:
Execute shellcode via indirect call

Disassembly:
jae 0x14094b245
jle 0x1408bf255
int3
add rsp, 0x20
pop rbp
ret

Function at 0x140946e0e
Capabilities:
Execute shellcode via indirect call

Disassembly:
xor bpl, dl
shl rbp, 0x57
or bp, word [rsp + 0x13]
jle 0x1409bd737
test dl, 0xb
mov qword [rsp + 0x10], 0x31a18f9d
add qword [rsp], 0xfffffffffffa0a4e
push r15
mov r15, qword [rsp + 0x18]

Function at 0x14094b1fd
Capabilities:
Execute shellcode via indirect call

Disassembly:
pushfq
add qword [rsp + 8], 0x9bf5f
nop
movabs rbx, 0xf3e93901272b0
neg bx
push r11
push 0x46275c33
movabs r11, 0xbda809027fac30a2
shl byte [rsp], 0x88
mov rbx, qword [rsp + 0x18]
mov rbx, qword [rbx]
lea r11, [r11 + r11*2 + 0x621c198f]
mov qword [rsp + 0x18], r11
call fcn.140934237
xchg qword [rsp + 0x58], rdx
mov rbx, qword [rsp + 0x20]
shr r10, 0x98
xor r10d, r12d
movsx r10w, byte [rsp + 0x1c]
sub r12d, dword [rsp + 0x19]
jb 0x140944b25
movabs r15, 0xa692390f99321c1d
test word [rsp + 0x19], r12w
movzx r10d, word [rsp + 0x34]
mov r12, qword [rsp + 0x40]
movsx r10w, byte [rsp + r10 + 0x32]
bswap r15
call fcn.1408ad496

Function at 0x14094b295
Capabilities:
Execute shellcode via indirect call

Disassembly:
call fcn.1408a5d96
add al, 0x90
neg ebx
and bl, bh
add bx, bx
call fcn.1409531a5
jmp 0x140968fea
je 0x140954c42
jmp 0x1408996d5
mov rax, qword [0x1408cf7c8]
dec dh
mov rdx, rcx
neg ch
mov rcx, qword [rax]
test rcx, rcx
jmp 0x14095a2aa

Function at 0x14094efbf
Capabilities:
Execute shellcode via indirect call

Disassembly:
neg dword [rsp + 0x38]
add qword [rsp + 0x10], 0xffffffffbf6bfac0
and bx, 0xf3a2
mov r12, qword [rsp + 0x48]
sub byte [rsp + 0x28], bh
xor word [rsp + 0x38], bx
jno 0x14099399b
movabs al, byte ds:[0x89483a2ad719bc19]
pop rsp
and al, 0x58

Function at 0x140954bce
Capabilities:
Execute shellcode via indirect call

Disassembly:
call fcn.1408a0423
push r13
je 0x140963de1
push r14
mov rbp, qword [rsp + 0x30]
mov rbp, qword [rbp + riz]
shl r13b, 0xf7
je 0x1408acf69
lea rsp, [rsp + 0x90]
ret
Function at 0x140954bf4
Capabilities:
Execute shellcode via indirect call

Disassembly:
add qword [rsp + r11*4 - 0x468], 0xffffffffbf76270d
lea rdx, [rdx + 0x6e28a5b4]
call fcn.14097986f
not dword [rsp + 0x28]
mov r10, qword [rsp + 0x48]
jbe 0x14093ff31
call fcn.140968f0b
xadd dword [rcx + 0x539ee49c], edx
add eax, 0xa7ba4048
int1
pop rcx
push rsp
xor al, 0xe
jnp 0x14092f748
lodsd eax, dword [rsi]
movabs al, byte [0x4ef41419c9dfa218]
invalid
mov ah, 0xaa
add edi, dword [rbp - 0x44]
xchg edx, eax
invalid
jns 0x14092f6b3
test qword [rsp + r13 - 0x55008405], rcx
jge 0x1408abd3f

Function at 0x140954c08
Capabilities:
Execute shellcode via indirect call

Disassembly:
mov rdi, qword [rsp + r11 + 0x57]
and dl, dl
xor r14b, byte [rsp + r11*2 + 0x24]
neg word [rsp + 0x20]
or r14d, dword [rsp + 0x23]

Function at 0x14095734c
Capabilities:
Execute shellcode via indirect call

Disassembly:
not cl
xchg qword [rsp + 0x60], rbp
mov r14, qword [rsp + rcx - 0x393]
jle 0x1408a2a87

Function at 0x14095e201
Capabilities:
Packed with generic packer

Disassembly:
mov rdi, qword [rsp + 8]
mov rdi, qword [rdi]
shl ebp, 0x86
xor bp, bp
movzx rbp, bpl
shl rbp, 0x14
mov qword [rsp + rbp*2 + 8], rbp
lea rdi, [rdi + rbp*2 + 0x60a12b3a]
and bpl, 0xa4
cmp qword [rsp + rbp*4 + 8], rbp
jg fcn.14095eda5
jne 0x1409872d9
movzx bp, bpl

Function at 0x140997721
Capabilities:
Encode data using xor

Disassembly:
xchg qword [rsp + 0x38], rbx
mov r12, qword [rsp + 0x28]
call fcn.140952f4b
xor dword [rsp + 0x30], 0x4e909f30
jg 0x140938dcf
fidiv word [rsi + 0x310b6b66]
test byte [rdx - 0x3a40b8b6], dl
xor dword [rdx + rdx*4 - 0x3a40b8b6], eax
add byte [rsi + 0x7e], dl
mov bl, 0xe3
sbb dword [rdx + rcx*2], ebx
loop 0x140997734
mov r13b, 0x38
outsb dx, byte [rsi]
push rsi
sbb ebx, dword [rbx]
and dword [rdx + rax*4 - 0x4e], edx
mov edi, 0x4ed8e55f
pop rsi
adc ecx, dword [rbx + 0x36ab5ac5]
idiv byte [rbx + 0x65ca8316]
out 0x7a, eax
xchg ebx, eax
pushfq
cmp eax, 0x65ca42cb
out 0x7a, eax
lahf
invalid
Function at 0x14099be39
Capabilities:
Execute shellcode via indirect call

Disassembly:
shr qword [rsp + 0x40], 0xa9
call fcn.14091560c
mov r13w, bp
lea rdi, [rdi - 0x5ce1b775]
shl cx, cl
xor dword [rsp], 0x17adf893
jns 0x1409cce25
sub r13b, byte [rsp + 0x15]
xchg qword [rsp + 0x50], rdi
mov rbp, qword [rsp + 0x48]
mov byte [rsp + 0x10], 0xb7
cmp rdx, qword [rsp]
movsxd r13, dword [rsp + 0x18]
not edx
jbe 0x140943c5b
outsb dx, byte [rsi]
sbb al, 0xb5
in al, dx
cmp eax, 0x3545f0be
ret
push qword [rsp]
popfq
lea rsp, [rsp + 8]
ret
add qword [rsp + 8], 0xfffffffffffe6438
mov rcx, qword [rsp + 0x38]
shl qword [rsp + r13 - 0x252a9886], 0xd1
mov dword [rsp + r13*2 - 0x4a55311c], 0x45a4db15
shl r13b, 0xcc
sub byte [rsp + r13*2 - 0x4a552fe8], 0x9d
mov r13, qword [rsp + r13 - 0x252a97d8]
sub word [rsp + 0x18], 0x7991
call fcn.1409ba4ff
sub dword [rsp + 0x18], 0x7ee87991
nop
adc byte [rax], al
loope 0x1408b1476
int3
seta byte [rsp + r11 + 0x17]
or word [rsp + 0x20], 0x330c
jae 0x140957395
shr r14w, 0xfc
mov r14, qword [rsp + r14 - 0x1f85ffe0]
call fcn.1409c6a46
mov r11, qword [rsp + r11 - 0xc0160fc]
or dword [rsp + r13 - 0x2a1e6cd8], 0x47a766a8
jae 0x1409a5e68
not r11w
xor dword [rsp + 0x20], 0xc2b77932
mov r14, qword [rsp + 0x10]
call fcn.1408b0fba
xor byte [rsp + 0x10], 0x87
mov rdx, qword [rsp + 0x20]
neg qword [rsp + r13 - 0x252a987e]
shl dword [rsp + r13 - 0x252a987e], 0x17
shl word [rsp + r13*2 - 0x4a55312c], 0x9e
jns 0x1408b143d
mov dl, 0x35
jbe 0x1408a3979
mov rdx, qword [rsp + 0x38]
jle 0x14091255e
sub al, al
jmp 0x1400123d0
jne 0x1409410f8
mov qword [rsp + 0x60], 0x16a0301e
xor byte [rsp + 0x60], r9b
call fcn.14093a2c9
jbe 0x1408b113f
lea rsp, [rsp + 0x18]
ret
jbe 0x140954c2f
mov rcx, qword [rsp + 0x50]
jle 0x1408a17cd
setno byte [rsp + 8]
xor qword [rsp + 8], 0x2dbe253f
add word [rsp + 0x28], 0xa3b9
push qword [rsp + 0x48]
popfq
lea rsp, [rsp + 0x58]
ret 8
xchg esp, eax
invalid
call fcn.1408acd97
outsd dx, dword [rsi]
invalid
sub r14w, 0x8d1f
add qword [rsp], 0xfffffffffff78c7f
movabs rdi, 0x7a0295946fae58a3
add r14d, 0x8f0f7d20
add rdi, 0xffffffffd61a432e
seta r14b
test di, di
mov rdi, qword [rsp]
mov rdi, qword [rdi]
call fcn.14095d42b
jb 0x1409a5f04
cmpsd dword [rsi], dword [rdi]
xor dword [rcx], ebp
in al, 0x1e
adc ebp, 0xfffffff5
cmp byte [rax - 0x3e], bh
out dx, eax
stc
and dword [rsp + rdx*4], ebp
popfq
sub eax, 0xa7ca7060
mov cl, 0x79
je 0x1409a5e53
mul byte [rbx]
xor eax, 0x3a80e8e5
push rdi
add dword [r8], ebp
loopne 0x1409a5e6a
lodsd eax, dword [rsi]
in eax, dx
cmp ebx, dword [rdi + 0x48dcf497]
add ebx, dword [rax + 0x57]
jmp 0x1409a5f23
or byte [rbp + 0x6ee9ece4], al
js 0x1409a5f43
rol byte [rbx + 0x71616663], cl
invalid
imul edi, dword [rdi + 0x2f], 0x2d20da22
cmp ebp, ebx
jbe 0x1409a5efb
and dword [rdi - 0x69], esi
pop rdx
add bh, byte [rax - 0x4b]
xchg edi, edi
jmp 0x1409a5fb0
int3
in eax, dx
add eax, 0xb937799f
stosb byte [rdi], al
sub al, 0x23
mov word [rdi], ss
shl byte [rdx], cl
invalid
mov r14, qword [rsp + 0x30]
cmp qword [rsp + 0x68], 0x58ba711a
jle 0x14098abe9
neg dword [rsp + 0x18]
jae 0x1409257b4
not qword [rsp + 0x58]
push qword [rsp + 0x78]
popfq
lea rsp, [rsp + 0x88]
ret
Function at 0x1409a046e
Capabilities:
Encode data using xor

Disassembly:
setbe bl
test bl, 0x11
seto bl
test rbx, 0xffffffffc9aea6b7
js 0x14094dbde

Function at 0x1409bd730
Capabilities:
Execute shellcode via indirect call

Disassembly:
mov rcx, r12
shl cx, 0x8b
cmp r12w, 0x6839
call fcn.14089f316

Function at 0x1409bd742
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
not r14
lea rdx, [r14*2 - 0x484ed1cc]
nop
movabs rdi, 0x7c1e4b88532ede96
and edi, 0x33222b0
sub rdi, 0xffffffffc43c8d19
ja 0x140954c24
add dil, 0x96
ja 0x14093f039
shl dil, 0x94
call fcn.140923d4e
in eax, dx
add eax, 0x6ba616c0
xor ecx, ecx
fcmovbe st(0), st(2)
fistp qword [rdi]
invalid

Function at 0x1413fdb22
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
ror r10w, 0x82
bts bx, dx
mov qword [rsp + 0x10], rdi
sub edi, edi
movzx ebx, r8b
inc r11w
mov r11, rcx
mov r9d, 0x3cb31523
movsx r9, r10w
mov r8, rdi
mov r9, rbx
nop
movzx r10d, cx
movsx r10w, r15b
movzx r9d, byte [r11]
movzx r10w, r9b
movsxd r10, edx
movzx r10d, byte [rdx]
jmp 0x1413fdb71
inc r11
jmp 0x1413fdb79
inc rdx
cmp rbp, rbx
test bl, bl
jmp 0x1413fdb86
je 0x1413fdbb0
mov ecx, r8d
mov eax, 0x861ba90a
jmp 0x1413fdb99
rol eax, cl
test dl, 0x24
add al, r8b
clc
xor r9b, al
jmp 0x1413fdbaa
inc r8
cmp r10b, r10b
test r9b, r9b
jmp 0x1413fdbb8
je 0x1413fdbcc
cmp r9b, r10b
jmp 0x1413fdbc6
je 0x1413fdb5c
cmp r9b, r10b
jmp 0x1413fdbd4
jae 0x1413fdbfb
or eax, 0xffffffff
movsx edi, r11w
mov rbx, qword [rsp + 8]
movsx edi, si
xchg rdi, rdi
movzx rdi, r12w
mov rdi, qword [rsp + 0x10]
jmp 0x1413fdbfa
ret
mov rbx, qword [rsp + 8]
seto ah
seta dil
not al
movzx rax, di
mov eax, edi
not dil
movzx rdi, di
xchg edi, edi
mov rdi, qword [rsp + 0x10]
jmp 0x1413fdc22
ret
Function at 0x140732d10
Capabilities:
Decompress data using aplib

Disassembly:
call 0x140732e97
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140732d41
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140732d27
add dl, dl
jne 0x140732d4e
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140732dae
xor eax, eax
add dl, dl
jne 0x140732d5d
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140732e65
add dl, dl
jne 0x140732d6e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140732d7b
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140732d88
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140732d95
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140732da2
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140732d36
mov eax, 1
add dl, dl
jne 0x140732dbe
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140732dcb
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140732db3
sub eax, ebx
mov ebx, 1
jne 0x140732e04
mov ecx, 1
add dl, dl
jne 0x140732de6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140732df3
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140732ddb
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140732d36
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140732e20
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140732e2d
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140732e15
cmp eax, 0x7d00
jae 0x140732e53
cmp eax, 0x500
jb 0x140732e4e
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140732d36
cmp eax, 0x7f
ja 0x140732e56
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140732d36
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140732e8a
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140732d36
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x415e00
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x415fa6
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00431f20
xorps xmm15, xmm15
mov r14, qword [0x00738ce0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x415e6b
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x415e80
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
nop
test rbx, rbx
jbe 0x415ea5
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x415eb9
cmp rbx, 0x1000
jae 0x415e75
nop dword [rax]
jmp 0x415f29
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop
cmp rbx, 0x1000
jae 0x415ecd
xor edx, edx
jmp 0x415f20
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00431f20
xorps xmm15, xmm15
mov r14, qword [0x00738ce0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
nop dword [rax]
test dl, dl
jne 0x415eaf
jmp 0x415e94
call fcn.00461900
xorps xmm15, xmm15
mov r14, qword [0x00738ce0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.00436600
lea rax, [0x005a0995]
mov ebx, 0x18
call fcn.00436f00
mov rax, qword [rsp + 0x38]
call fcn.00436c00
lea rax, [0x005a0a6d]
mov ebx, 0x19
call fcn.00436f00
mov rax, qword [rsp + 0x30]
nop
call fcn.00436c00
call fcn.00436860
call fcn.00436680
lea rax, [0x005a41de]
mov ebx, 0x21
nop dword [rax + rax]
call fcn.00434cc0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045dd20
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.00415e00
Function at 0x415fe0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41620a
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.00431fa0
xorps xmm15, xmm15
mov r14, qword [0x00738ce0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x416059
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x41606c
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x416090
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
nop
jmp 0x4160a4
cmp rbx, 0x1000
jae 0x416063
jmp 0x416125
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x4160b6
xor esi, esi
jmp 0x416116
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
nop dword [rax]
call fcn.00431fa0
xorps xmm15, xmm15
mov r14, qword [0x00738ce0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x41609a
nop
jmp 0x416082
call fcn.00461900
xorps xmm15, xmm15
mov r14, qword [0x00738ce0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x4161a5
call fcn.00436600
lea rax, [0x005a10c6]
mov ebx, 0x19
call fcn.00436f00
mov rax, qword [rsp + 0x68]
call fcn.00436c00
lea rax, [0x005a0a6d]
mov ebx, 0x19
call fcn.00436f00
mov eax, dword [rsp + 0x34]
nop dword [rax]
call fcn.00436c00
call fcn.00436860
call fcn.00436680
lea rax, [0x0059c576]
mov ebx, 0xd
nop dword [rax + rax]
call fcn.00434cc0
cmp eax, 0x5af
je 0x416148
call fcn.00436600
lea rax, [0x005a10c6]
mov ebx, 0x19
nop dword [rax]
call fcn.00436f00
mov rax, qword [rsp + 0x38]
call fcn.00436c00
lea rax, [0x005a0a6d]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.00436f00
mov eax, dword [rsp + 0x34]
call fcn.00436c00
call fcn.00436860
call fcn.00436680
lea rax, [0x005a36cd]
mov ebx, 0x1f
call fcn.00434cc0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045dd20
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00415fe0
Function at 0x41e4c0
Capabilities:
Hash data using murmur3

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
cmp byte [0x00738ae0], 0
jne 0x41e5af
mov rdx, qword [rax + 0x50]
test byte [rdx], al
nop
nop
nop
sub rbx, qword [rax + 0x18]
mov esi, dword [rax + 0x5c]
imul rbx, rsi
mov rsi, rbx
shr rbx, 0x20
shr rsi, 0x23
and ebx, 7
mov rdi, rcx
mov rcx, rbx
mov r8d, 1
shl r8d, cl
add rdx, rsi
lock or byte [rdx], r8b
nop
nop
mov rcx, qword [rax + 0x18]
nop
movabs rdx, 0x800000000000
lea rax, [rdx + rcx]
mov rdx, rax
shr rax, 0x2a
cmp rax, 0x40
jae 0x41e5a5
lea rbx, [0x0070af10]
mov rax, qword [rbx + rax*8]
shr rdx, 0x16
and edx, 0xfffff
mov rdx, qword [rax + rdx*8]
test byte [rdx], al
test byte [rax], al
mov rax, rcx
shr rcx, 0x10
and ecx, 0x3f
movzx ebx, byte [rdx + rcx + 0x11440]
lea rdx, [rdx + rcx]
lea rdx, [rdx + 0x11440]
shr rax, 0xd
and eax, 7
mov rcx, rax
mov eax, 1
shl eax, cl
test al, bl
jne 0x41e587
lock or byte [rdx], al
mov rax, qword [r14 + 0x30]
mov rax, qword [rax + 0xa0]
test byte [rax], al
add qword [rax + 0x1248], rdi
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov ecx, 0x40
call fcn.004603a0
lea rax, [0x005a6750]
mov ebx, 0x2c
nop dword [rax + rax]
call fcn.00434cc0
nop
int3

Function at 0x4209a0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x420a9e
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rbx
mov qword [rsp + 8], 0
jmp 0x4209e0
mov rax, qword [rsp + 0x50]
mov rcx, rdx
mov rbx, qword [rsp + 0x58]
nop
cmp qword [rsp + 8], rbx
jae 0x420a8f
test byte [rax], al
lea rcx, [rax + 0x100b8]
mov rax, rcx
call fcn.00421560
nop dword [rax]
test rax, rax
je 0x420a8f
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x30], xmm15
lea rcx, [0x00420ae0]
mov qword [rsp + 0x10], rcx
lea rdx, [rsp + 8]
mov qword [rsp + 0x18], rdx
mov rdx, qword [rsp + 0x50]
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rbx
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x38], rax
lea rbx, [rsp + 0x10]
mov qword [rsp], rbx
call fcn.0045dbe0
xorps xmm15, xmm15
mov r14, qword [0x00738ce0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x60]
test rdx, rdx
jne 0x420a7d
xor eax, eax
jmp 0x420a87
mov rax, qword [rdx]
call rax
mov rdx, qword [rsp + 0x60]
test al, al
je 0x4209d2
mov rax, qword [rsp + 8]
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.0045dd20
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.004209a0