joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140058880
Capabilities:
Generate random numbers via winapi
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
sub rsp, 0x30
mov ecx, dword [0x14006a1c8]
test ecx, ecx
je 0x140058976
dec ecx
call fcn.1400620d4
cmp rax, 2
jb 0x1400588b0
cmp qword [rax + 8], 0
je 0x1400588b0
add rax, 0x10
jmp 0x140058970
mov ecx, dword [0x14006a1c8]
test ecx, ecx
je 0x140058989
dec ecx
call fcn.1400620d4
cmp rax, 1
je 0x140058950
mov rsi, rax
test rax, rax
jne 0x140058920
movzx eax, byte [0x1402641d8]
mov edx, 0x20
xor ecx, ecx
call fcn.140053b40
test rax, rax
je 0x1400589af
mov rsi, rax
lea rax, [0x14006a1b0]
mov qword [rsi], rax
mov qword [rsi + 8], 0
mov ecx, dword [0x14006a1c8]
test ecx, ecx
je 0x14005899c
dec ecx
mov rdx, rsi
call fcn.1400620dc
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
xor ecx, ecx
mov r8d, 0x10
mov r9d, 2
call sub.bcrypt.dll_BCryptGenRandom
test eax, eax
js 0x140058954
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
jmp 0x14005895c
xor eax, eax
jmp 0x140058970
call fcn.140051900
mov rcx, rax
mov qword [rsi + 8], 1
lea rax, [rsi + 0x10]
mov qword [rsi + 0x10], rcx
mov qword [rsi + 0x18], rdx
add rsp, 0x30
pop rsi
ret
lea rcx, [0x14006a1b0]
call fcn.140025860
mov ecx, eax
jmp 0x140058895
lea rcx, [0x14006a1b0]
call fcn.140025860
mov ecx, eax
jmp 0x1400588c0
lea rcx, [0x14006a1b0]
call fcn.140025860
mov ecx, eax
jmp 0x140058918
mov ecx, 8
mov edx, 0x20
call fcn.14000bfa0
int3

Function at 0x14005bcdf
Capabilities:
Accept command line arguments

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rax, rdx
mov rsi, rcx
lea rdx, [rsp + 0x2c]
mov rcx, rax
call sub.shell32.dll_CommandLineToArgvW
test rax, rax
je 0x14005bd85
mov rdi, rax
lea rbx, [rsp + 0x30]
and qword [rbx], 0
mov qword [rbx + 8], 8
and qword [rbx + 0x10], 0
movsxd r12, dword [rsp + 0x2c]
shl r12, 3
xor r13d, r13d
lea r14, [rsp + 0x48]
cmp r12, r13
je 0x14005bd60
mov r15, qword [rdi + r13]
mov rcx, r15
call sub.msvcrt.dll_wcslen
mov rcx, r14
mov rdx, r15
mov r8, rax
call fcn.14005a84c
mov rcx, rbx
mov rdx, r14
call fcn.14005c04b
add r13, 8
jmp 0x14005bd30
mov rcx, rdi
call sub.kernel32.dll_LocalFree
test rax, rax
jne 0x14005bd72
call fcn.140061677
mov rax, qword [rsp + 0x40]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rsi], xmm0
jmp 0x14005bd96
and qword [rsi], 0
mov qword [rsi + 8], 8
and qword [rsi + 0x10], 0
add rsp, 0x60
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140067a10
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.1400687b0
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.1400687b0
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop dword [rax]

Function at 0x140067a80
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x140264c44]
mov rbx, rcx
test esi, esi
jle 0x140067bb0
mov rax, qword [0x140264c48]
xor r9d, r9d
add rax, 0x18
nop word [rax + rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x140067acb
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x140067b55
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x140067ab0
mov rcx, rbx
call fcn.1400684d0
mov rdi, rax
test rax, rax
je 0x140067bd2
mov rax, qword [0x140264c48]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call fcn.140068610
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x140264c48]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x140067bb7
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x140067b4e
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x140067b60
add dword [0x140264c44], 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x140264c48]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140067b4e
call qword [sym.imp.kernel32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.140067a10
nop dword [rax]
xor esi, esi
jmp 0x140067ad8
mov rax, qword [0x140264c48]
mov edx, dword [rdi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.140067a10
mov rdx, rbx
lea rcx, str.Address__p_has_no_image_section
call fcn.140067a10
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x140068140
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x140264ca0]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x140264c80]
test rbx, rbx
je 0x14006819c
mov rbp, qword [sym.imp.kernel32.dll_TlsGetValue]
mov rdi, qword [sym.imp.kernel32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x140068193
test rsi, rsi
je 0x140068193
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x140068178
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x1400684d0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x14025a890]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x1400684f0
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x1400684f8
ret
cmp word [r8 + 0x18], 0x20b
jne 0x1400684f0
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x14006854d
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x140068544
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x1400684f0
add rax, 0x28
cmp rax, r9
jne 0x140068530
xor eax, eax
ret

Function at 0x140068550
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x14025a890]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x14006856f
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x140068578
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x14006856f
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x140068610
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x14025a890]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x14006862f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x140068638
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret

Function at 0x140068f70
Capabilities:
Get memory capacity

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0xa0
mov dword [rsp + 0x60], 0x40
mov rbx, rcx
lea rcx, [rsp + 0x60]
lea rsi, [rsp + 0x28]
call qword [sym.imp.kernel32.dll_GlobalMemoryStatusEx]
test eax, eax
je 0x140068ffc
mov rdx, qword [rsp + 0x68]
mov rax, rdx
shr rax, 0xa
mov qword [rsp + 0x28], rax
xor eax, eax
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x70]
mov rcx, rax
shr rcx, 0xa
mov qword [rsp + 0x30], rcx
xor ecx, ecx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], rcx
mov rcx, qword [rsp + 0x78]
sub rcx, rdx
mov rdx, qword [rsp + 0x80]
shr rcx, 0xa
sub rdx, rax
mov qword [rsp + 0x50], rcx
shr rdx, 0xa
cmp rdx, rcx
cmova rdx, rcx
mov qword [rsp + 0x58], rdx
jmp 0x140069006
mov ecx, 0xe
mov rdi, rsi
rep stosd dword [rdi], eax
mov rdi, rbx
mov ecx, 0xe
mov rax, rbx
rep movsd dword [rdi], dword [rsi]
add rsp, 0xa0
pop rbx
pop rsi
pop rdi
ret
Function at 0x140018ae0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x30
mov rdi, rcx
lea rcx, str.EDB_LISTEN_PORT
mov rsi, r9
movzx ebp, r8w
mov r14, rdx
mov ebx, 0x30eb
call fcn.14001b678
test rax, rax
je 0x140018b28
mov rcx, rax
call fcn.14001ac54
movzx ebx, ax
lea rcx, [rsp + 0x20]
movzx r8d, bx
mov rdx, rdi
call fcn.140018ef0
test eax, eax
je 0x140018b42
or eax, 0xffffffff
jmp 0x140018b9a
xor r8d, r8d
lea edx, [r8 + 1]
lea ecx, [rdx + 1]
call qword [sym.imp.WS2_32.dll_socket]
lea rdx, [rsp + 0x20]
mov r8d, reloc.WS2_32.dll_recv
mov rcx, rax
mov rbx, rax
call fcn.14001a8c0
mov edi, eax
test eax, eax
jne 0x140018b98
movzx r8d, bp
mov rdx, r14
mov rcx, rbx
call fcn.140018d90
test eax, eax
jne 0x140018b90
mov rdx, rsi
mov rcx, rbx
call fcn.140018cb0
neg eax
sbb edi, edi
mov rcx, rbx
call sub.WS2_32.dll_closesocket
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret

Function at 0x140018cb0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
sub rsp, 0x20
xor r9d, r9d
mov rbx, rdx
lea rdx, [rsp + 0x40]
lea r8d, [r9 + 2]
call sub.WS2_32.dll_recv
mov ecx, eax
cmp eax, 2
jne 0x140018ce7
movzx ecx, word [rsp + 0x40]
call qword [sym.imp.WS2_32.dll_ntohs]
mov word [rbx], ax
xor eax, eax
add rsp, 0x20
pop rbx
ret
or eax, 0xffffffff
mov edx, 0xfffffff9
test ecx, ecx
cmove eax, edx
add rsp, 0x20
pop rbx
ret

Function at 0x140018d90
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
or rsi, 0xffffffffffffffff
mov rdi, rdx
mov rbp, rcx
mov rbx, rsi
inc rbx
cmp byte [rdx + rbx], 0
jne 0x140018db1
movzx ecx, r8w
inc bx
call qword [sym.imp.WS2_32.dll_htons]
movzx ecx, bx
mov word [rsp + 0x58], ax
call qword [sym.imp.WS2_32.dll_htons]
xor r9d, r9d
lea rdx, [rsp + 0x58]
lea r8d, [r9 + 2]
mov rcx, rbp
mov word [rsp + 0x20], ax
call sub.WS2_32.dll_send
cmp eax, 2
jne 0x140018e27
lea rdx, [rsp + 0x20]
xor r9d, r9d
mov r8d, eax
mov rcx, rbp
call sub.WS2_32.dll_send
cmp eax, 2
jne 0x140018e27
movsx ebx, bx
xor r9d, r9d
mov rdx, rdi
mov r8d, ebx
mov rcx, rbp
call sub.WS2_32.dll_send
cmp eax, ebx
jne 0x140018e27
xor eax, eax
jmp 0x140018e33
test eax, eax
mov ecx, 0xfffffff9
cmove esi, ecx
mov eax, esi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x140018ef0
Capabilities:
Resolve dns

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
movzx esi, r8w
mov rbx, rcx
test rdx, rdx
je 0x140018f10
cmp byte [rdx], 0
jne 0x140018f17
lea rdx, str.localhost
mov rcx, rdx
call qword [sym.imp.WS2_32.dll_gethostbyname]
mov rdi, rax
test rax, rax
jne 0x140018f3b
or eax, 0xffffffff
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov eax, 2
movzx ecx, si
mov word [rbx], ax
call qword [sym.imp.WS2_32.dll_htons]
mov rsi, qword [rsp + 0x38]
mov word [rbx + 2], ax
mov rax, qword [rdi + 0x18]
mov rcx, qword [rax]
mov eax, dword [rcx]
mov dword [rbx + 4], eax
xor eax, eax
mov qword [rbx + 8], rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140019000
Capabilities:
Get local ipv4 addresses
Get socket information
Set socket configuration

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rdi, rdx
mov rsi, rcx
mov ebx, 2
lea rcx, [rsp + 0x38]
lea edx, [rbx + 6]
mov dword [rsp + 0x68], 1
mov dword [rsp + 0x60], reloc.WS2_32.dll_recv
mov qword [rsp + 0x30], 2
call fcn.14001aa20
xor ecx, ecx
call fcn.14001a8a0
call fcn.14001a8f0
test eax, eax
js 0x1400190f3
lea edx, [rbx - 1]
xor r8d, r8d
mov ecx, ebx
call qword [sym.imp.WS2_32.dll_socket]
lea r9, [rsp + 0x68]
mov edx, 0xffff
mov r8d, 4
mov rcx, rax
mov dword [rsp + 0x20], 4
mov rbx, rax
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jne 0x1400190eb
mov r8d, dword [rsp + 0x60]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_bind]
test eax, eax
jne 0x1400190eb
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x1400190eb
lea edx, [rax + 0xa]
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_listen]
test eax, eax
jne 0x1400190eb
movzx ecx, word [rsp + 0x32]
call qword [sym.imp.WS2_32.dll_ntohs]
mov word [rdi], ax
mov qword [rsi], rbx
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov rcx, rbx
call sub.WS2_32.dll_closesocket
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
or eax, 0xffffffff
add rsp, 0x40
pop rdi
ret
Function at 0x14001a710
Capabilities:
Accept command line arguments
Create process on windows
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0xe0
lea rcx, str.EDB_BIN
call fcn.14001b678
mov rbx, rax
test rax, rax
je 0x14001a752
or rcx, 0xffffffffffffffff
inc rcx
cmp byte [rax + rcx], 0
jne 0x14001a735
add ecx, 0xd
movsxd rcx, ecx
call fcn.14001b770
lea rdx, str._s_s
jmp 0x14001a78b
lea rcx, str.E3E_PATH
call fcn.14001b678
mov rbx, rax
test rax, rax
je 0x14001a829
or rcx, 0xffffffffffffffff
nop
inc rcx
cmp byte [rax + rcx], 0
jne 0x14001a770
add ecx, 0x1d
movsxd rcx, ecx
call fcn.14001b770
lea rdx, str._shost_bin_s
lea r9, str.edb_streamd
mov r8, rbx
mov rcx, rax
mov rdi, rax
call fcn.14001aa2c
lea rcx, [rsp + 0x70]
mov edx, 0x68
call fcn.14001aa20
lea rcx, [rsp + 0x50]
mov edx, 0x18
mov dword [rsp + 0x70], WSAGetLastError
call fcn.14001aa20
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
lea rax, [rsp + 0x50]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
mov rdx, rdi
mov qword [rsp + 0x40], rax
xor eax, eax
xor ecx, ecx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test rdi, rdi
je 0x14001a816
mov rcx, rdi
call fcn.14001aca4
xor eax, eax
mov rbx, qword [rsp + 0xf0]
add rsp, 0xe0
pop rdi
ret
mov eax, 0xfffffff6
mov rbx, qword [rsp + 0xf0]
add rsp, 0xe0
pop rdi
ret

Function at 0x14001a8c0
Capabilities:
Connect socket

Disassembly:
push rbx
sub rsp, 0x20
call qword [sym.imp.WS2_32.dll_connect]
mov ebx, eax
test eax, eax
jns 0x14001a8e4
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x274d
mov eax, 0xfffffff6
je 0x14001a8e6
mov eax, ebx
add rsp, 0x20
pop rbx
ret

Function at 0x14001a8f0
Capabilities:
Initialize winsock library

Disassembly:
sub rsp, 0x1c8
lea rdx, [rsp + 0x20]
mov ecx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x14001a91c
call qword [sym.imp.WS2_32.dll_WSACleanup]
or eax, 0xffffffff
add rsp, 0x1c8
ret
xor eax, eax
add rsp, 0x1c8
ret

Function at 0x14001d254
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.14001d0bc
Function at 0x14058d2e0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x14058d2ed
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14058d2fd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x14058d2e5
lea eax, [rcx + 1]
jmp 0x14058d30b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x14058d31e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x14058d304
sub eax, 3
jb 0x14058d33e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x14058d38d
sar eax, 1
movsxd rbp, eax
jb 0x14058d374
jmp 0x14058d34c
add ebx, ebx
jne 0x14058d34a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x14058d374
inc ecx
add ebx, ebx
jne 0x14058d35a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x14058d374
call r11
adc ecx, ecx
add ebx, ebx
jne 0x14058d36d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x14058d35c
add ecx, 2
jmp 0x14058d379
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.14058d2a2
jmp 0x14058d2ed
pop rsi
pop rdi
pop rax
mov dword [rdi], eax
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x284a00
mov dl, 0x8e
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x14058d3dd
cmp rsi, rcx
jae 0x14058d3e5
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x14058d3c4
cmp al, 0x8f
ja 0x14058d3c4
cmp byte [rsi - 2], 0xf
je 0x14058d3ca
sub al, 0xe8
cmp al, 1
ja 0x14058d3ae
cmp rsi, rcx
jae 0x14058d3e5
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x14058d3b4
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x14058d3e5
lodsb al, byte [rsi]
jmp 0x14058d3c4
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x58a000]
mov eax, dword [rdi]
or eax, eax
je 0x14058d442
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x58d000]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x14058d3f2
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x14058d43c
mov qword [rbx], rax
add rbx, 8
jmp 0x14058d412
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x237]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
mov byte [fcn.14058d4c5], 0xfc
lea rcx, [rsi - 0x1000]
push 1
pop rdx
xor r8, r8
push rax
call fcn.14058d4c5
pop rax
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x14058d4b5
sub rsp, 0xffffffffffffff80
jmp 0x140060408
Function at 0x415180
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41532b
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.004301c0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
nop
jne 0x4151ee
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x415201
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x415225
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x415239
cmp rbx, 0x1000
jae 0x4151f8
nop
jmp 0x4152a9
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop
cmp rbx, 0x1000
jae 0x41524d
xor edx, edx
jmp 0x4152a0
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.004301c0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
nop
test dl, dl
jne 0x41522f
jmp 0x415215
call fcn.0045dba0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.00434520
lea rax, [0x004ccc86]
mov ebx, 0x18
nop dword [rax + rax]
call fcn.00434e20
mov rax, qword [rsp + 0x38]
call fcn.00434b20
lea rax, [0x004ccd2e]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.00434e20
mov rax, qword [rsp + 0x30]
call fcn.00434b20
call fcn.00434780
call fcn.004345a0
lea rax, [0x004cf7b1]
mov ebx, 0x21
call fcn.00432d80
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045a040
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00415180
Function at 0x415360
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41558a
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.00430240
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x4153db
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x4153ee
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x415410
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x415424
cmp rbx, 0x1000
jae 0x4153e5
jmp 0x4154ae
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x415436
xor esi, esi
jmp 0x4154a0
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
nop dword [rax]
call fcn.00430240
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
test sil, sil
jne 0x41541a
jmp 0x415402
call fcn.0045dba0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x415529
call fcn.00434520
lea rax, [0x004cd2a6]
mov ebx, 0x19
call fcn.00434e20
mov rax, qword [rsp + 0x68]
call fcn.00434b20
lea rax, [0x004ccd2e]
mov ebx, 0x19
nop
call fcn.00434e20
mov eax, dword [rsp + 0x34]
call fcn.00434b20
call fcn.00434780
call fcn.004345a0
lea rax, [0x004c87ba]
mov ebx, 0xd
call fcn.00432d80
cmp eax, 0x5af
je 0x4154d3
call fcn.00434520
lea rax, [0x004cd2a6]
mov ebx, 0x19
call fcn.00434e20
mov rax, qword [rsp + 0x38]
call fcn.00434b20
lea rax, [0x004ccd2e]
mov ebx, 0x19
nop dword [rax]
call fcn.00434e20
mov eax, dword [rsp + 0x34]
call fcn.00434b20
call fcn.00434780
call fcn.004345a0
lea rax, [0x004cf05f]
mov ebx, 0x1f
call fcn.00432d80
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045a040
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00415360
Function at 0x41d240
Capabilities:
Hash data using murmur3

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
cmp byte [0x005cf891], 0
jne 0x41d32f
nop
nop
nop
nop
sub rbx, qword [rax + 0x18]
nop
mov edx, dword [rax + 0x5c]
imul rbx, rdx
mov rdx, rbx
shr rbx, 0x20
nop
shr rdx, 0x23
and ebx, 7
mov rsi, rcx
mov rcx, rbx
mov edi, 1
shl edi, cl
nop
add rdx, qword [rax + 0x50]
lock or byte [rdx], dil
nop
nop
mov rcx, qword [rax + 0x18]
nop
movabs rdx, 0x800000000000
lea rax, [rdx + rcx]
mov rdx, rax
shr rax, 0x2a
cmp rax, 0x40
jae 0x41d325
lea rbx, [0x005a1cf0]
mov rax, qword [rbx + rax*8]
shr rdx, 0x16
and edx, 0xfffff
mov rdx, qword [rax + rdx*8]
test byte [rdx], al
test byte [rax], al
mov rax, rcx
shr rcx, 0x10
and ecx, 0x3f
movzx ebx, byte [rdx + rcx + 0x21040]
lea rdx, [rdx + rcx]
lea rdx, [rdx + 0x21040]
shr rax, 0xd
and eax, 7
mov rcx, rax
mov eax, 1
shl eax, cl
nop dword [rax]
test al, bl
jne 0x41d307
lock or byte [rdx], al
mov rax, qword [r14 + 0x30]
mov rax, qword [rax + 0xa0]
test byte [rax], al
add qword [rax + 0x1248], rsi
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov ecx, 0x40
call fcn.0045c740
lea rax, [0x004d1268]
mov ebx, 0x2c
nop dword [rax + rax]
call fcn.00432d80
nop
int3