joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140055384
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400553ce
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400553ce
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400553ce
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400553ce
cmp dword [rcx + 0x84], 0xe
jbe 0x1400553ce
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400553d0
xor al, al
add rsp, 0x28
ret

Function at 0x140059300
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14005916b
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14005916b
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14005916b
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14005916b
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14005916b
cmp dword [rcx + 0x84], 0xe
jbe 0x14005916b
cmp dword [rcx + 0xf8], 0
je 0x14005916b
mov ecx, ebx
call fcn.14005921c
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.140058ff8
nop
cmp dword [rbp + 0x20], 0
je 0x1400591b9
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.1400591c4
int3
xor r8d, r8d
xor edx, edx
jmp 0x1400590fc
Function at 0x140069d4c
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x140069dd3
mov rsi, rbx
cmp word [rax], bp
je 0x140069d92
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x140069d7c
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x140069d78
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.1400675d4
mov rdi, rax
test rax, rax
je 0x140069dc0
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.1400701f0
mov rbp, rdi
xor ecx, ecx
call fcn.140065a90
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14006d4ec
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x14006d502
mov al, 1
jmp 0x14006d562
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x14006d513
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x14006d560
mov ecx, dword [rcx + 0x18]
nop
call fcn.14006a094
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14006d560
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x14006d560
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x14006d560
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x14006d562
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x14006fb20
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14006fb48
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14006fb48
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x1400011a4
Capabilities:
Create directory

Disassembly:
and al, 0x48
mov dword [rsp + 0x3c], 0x2fe6135
mov edx, dword [rsp + 0x3c]

Function at 0x1400011b0
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 0x30], rcx
jb sym.DUI70.dll_public:_class_DirectUI::CCTrackBar____ptr64___cdecl_DirectUI::CCTrackBar::operator_class_DirectUI::CCTrackBar_const____ptr64____ptr64
jmp 0x14000120b
invalid

Function at 0x1400011b4
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 0x30], rcx
jb sym.DUI70.dll_public:_class_DirectUI::CCTrackBar____ptr64___cdecl_DirectUI::CCTrackBar::operator_class_DirectUI::CCTrackBar_const____ptr64____ptr64
jmp 0x14000120b
invalid

Function at 0x1400011c0
Capabilities:
Create directory

Disassembly:
mov ecx, 0x65
call rax
lea rcx, str.:
lea ecx, str.:

Function at 0x1400011c4
Capabilities:
Create directory

Disassembly:
add bh, bh
ror byte [rax - 0x73], 1
lea ecx, str.:

Function at 0x140001224
Capabilities:
Create directory

Disassembly:
push rbx
mov ebp, ebp
sub dword [rax - 0x75], ecx
mov rdx, qword [rsp + 0x30]

Function at 0x140001228
Capabilities:
Create directory

Disassembly:
mov rdx, qword [rsp + 0x30]
mov qword [rsp + 0x20], rcx

Function at 0x140001230
Capabilities:
Create directory

Disassembly:
mov rdx, qword [rsp + 0x30]
mov qword [rsp + 0x20], rcx

Function at 0x140001238
Capabilities:
Create directory

Disassembly:
ror dword [rax - 0x2d], 1
loop 0x140001281
invalid
mov dword [rsp + 0x48], edx
mov rdx, qword [rsp + 0x40]
adc byte [rax - 0x75], cl

Function at 0x140001250
Capabilities:
Create directory

Disassembly:
imul eax, dword [rcx - 0x77], 0x4c542444
mov eax, dword [rsp + 0x20]
and al, 0x20

Function at 0x140001280
Capabilities:
Terminate process

Disassembly:
jae fcn.140001292
mov rax, qword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x1400012b8
Capabilities:
Terminate process

Disassembly:
and al, 0x7c
invalid
test byte [rsp + riz*4], ah
and al, 0xa4
add al, byte [rax]

Function at 0x1400012c4
Capabilities:
Terminate process

Disassembly:
push rsi
invalid
invalid
test byte [rax + rcx*4], ah
and al, 0x88
add al, byte [rax]

Function at 0x1400012e0
Capabilities:
Terminate process

Disassembly:
cwde
add al, byte [rax]
add byte [rax - 0x39], cl
invalid
invalid
test byte [rax + rbx*4], ah
cwde
add al, byte [rax]
invalid

Function at 0x1400012e8
Capabilities:
Terminate process

Disassembly:
cwde
add al, byte [rax]
add byte [rax - 0x39], cl
invalid
invalid
test byte [rax + rbx*4], ah
cwde
add al, byte [rax]
invalid

Function at 0x14000134c
Capabilities:
Terminate process

Disassembly:
ror byte [rax + rax], 0x4c
lea ecx, [rsp + 0x7c]
invalid
mov r10, qword [rsp + 0x60]
jmp 0x1400013ae
invalid
invalid

Function at 0x140001350
Capabilities:
Terminate process

Disassembly:
ror byte [rax + rax], 0x4c
lea ecx, [rsp + 0x7c]
invalid
mov r10, qword [rsp + 0x60]
jmp 0x1400013ae
invalid
invalid

Function at 0x140001358
Capabilities:
Terminate process

Disassembly:
jl 0x1400013a2
mov edx, dword [rsp + 0x60]
mov qword [rsp + 0x38], rcx
mov rcx, r10
and al, 0x98
Function at 0x1400013dc
Capabilities:
Terminate process

Disassembly:
add byte [rax], al
and byte [rbx - 0x74b7c247], cl
invalid
invalid
invalid
invalid

Function at 0x1400013e4
Capabilities:
Terminate process

Disassembly:
add eax, 0x4c47
mov ecx, 7
add byte [rax], al

Function at 0x140001660
Capabilities:
Enumerate gui resources

Disassembly:
add byte [rax], al
jmp qword [sym.imp.KERNEL32.dll_EnumResourceTypesA]
ror byte [rcx], 1
invalid
Function at 0x1400037f0
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x80
xor eax, eax
mov dword [rsp + 0x6c], 0x6669cab2
mov r9d, dword [rsp + 0x6c]
xor r9d, 0x6669cab2
mov r10d, r8d
xor r10d, 0xffffffff
mov dword [rsp + 0x7c], r10d
cmp r8d, r9d
mov qword [rsp + 0x60], rdx
mov dword [rsp + 0x5c], r8d
mov qword [rsp + 0x50], rcx
mov dword [rsp + 0x4c], eax
je 0x1400038a4
mov eax, dword [rsp + 0x4c]
lea rcx, [0x1400252c0]
mov edx, eax
and edx, 0xf
mov edx, edx
mov r8d, edx
mov edx, dword [rsp + 0x6c]
xor edx, 0x6669cab3
mov r9, qword [rsp + 0x50]
mov qword [rsp + 0x40], rcx
mov rcx, r9
mov r10, qword [rsp + 0x60]
mov dword [rsp + 0x3c], edx
mov rdx, r10
mov qword [rsp + 0x30], r8
mov r8d, eax
mov r11, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x30]
movzx r9d, byte [r11 + rsi]
mov dword [rsp + 0x2c], eax
call sym.DUI70.dll_const_DirectUI::AnimationStrip::vftable
mov eax, dword [rsp + 0x2c]
mov r8d, dword [rsp + 0x3c]
add eax, r8d
mov r8d, dword [rsp + 0x5c]
cmp eax, r8d
mov dword [rsp + 0x4c], eax
jne 0x140003832
add rsp, 0x80
pop rsi
ret

Function at 0x140003980
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x48
mov eax, 0x173a69d7
mov edx, 0x4223d576
mov dword [rsp + 0x3c], 0x25b1be8b
sub edx, dword [rsp + 0x3c]
mov dword [rsp + 0x38], edx
mov edx, dword [rsp + 0x38]
add edx, 0x496e9615
mov r8d, dword [rcx + 0x3c]
mov qword [rsp + 0x40], 0x3a880ee1
movsxd r9, r8d
mov r10, rcx
add r10, r9
mov r8d, dword [rcx + r9]
cmp eax, edx
mov qword [rsp + 0x30], r10
mov dword [rsp + 0x2c], r8d
jae 0x1400039f3
xor eax, eax
mov ecx, dword [rsp + 0x2c]
sub ecx, 0x4550
mov edx, eax
mov r8, qword [rsp + 0x30]
cmove rdx, r8
mov rax, rdx
mov dword [rsp + 0x28], ecx
add rsp, 0x48
ret
mov rax, qword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, 0x3a59ad19
call rax
xor ecx, ecx
mov eax, ecx
add rsp, 0x48
ret
Function at 0x140003e40
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0xf8
mov eax, 0x5f5be6f8
lea rcx, [rsp + 0x60]
mov edx, 0x1f9c68a6
mov r8d, edx
mov edx, 0x35075593
mov r9d, edx
mov dword [rsp + 0xe8], 0x5f5be6f9
mov qword [rsp + 0xe0], 0x286a9392
mov r10, qword [rsp + 0xf0]
sub r9, r10
mov qword [rsp + 0xf0], r9
mov qword [rsp + 0x58], 0x247c9a2e
mov dword [rsp + 0x44], 0x385d4464
mov edx, dword [rsp + 0xe8]
mov r11d, dword [rsp + 0x44]
mov esi, r11d
and esi, esi
mov edi, r11d
imul edi, edi
mov dword [rsp + 0xec], edi
mov edi, eax
sub edi, edx
mov edx, r11d
xor edx, edi
mov edi, r11d
xor edi, 0xffffffff
and edi, edx
mov qword [rsp + 0x38], rcx
mov rcx, r8
mov r8, r10
shr r8, cl
mov edx, dword [rsp + 0xe8]
mov qword [rsp + 0xf0], r8
sub eax, edx
xor edi, eax
cmp esi, edi
mov qword [rsp + 0x30], r10
mov dword [rsp + 0x2c], r11d
ja 0x140003ffe
lea rdx, [0x14002526b]
mov r8d, 0xe
lea rax, [rsp + 0x80]
mov qword [rsp + 0xd0], rax
mov rcx, qword [rsp + 0x38]
call fcn.1400037f0
mov qword [rsp + 0xd8], 0
mov dword [rsp + 0xec], 0x4aea9b7c
mov eax, 0x286a9393
mov ecx, eax
mov rdx, qword [rsp + 0xe0]
mov r8, qword [rsp + 0xd8]
mov r9, r8
mov r10b, byte [rsp + r8 + 0x60]
movsx eax, r10b
mov r11w, ax
sub rcx, rdx
mov word [rsp + r9*2 + 0x80], r11w
add r9, rcx
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0xf0], rcx
mov qword [rsp + 0xd8], r9
cmp r9, 0x20
je 0x140003ffe
jmp 0x140003f3e
cmp dword [rsp + 0x54], 0x776b1bdb
ja 0x140004047
mov rcx, qword [rsp + 0x48]
call fcn.1400038b0
mov qword [rsp + 0xf0], 0x45da25e4
add rsp, 0xf8
pop rdi
pop rsi
ret
mov eax, 0x9be6445b
mov ecx, dword [rsp + 0x2c]
imul edx, ecx, 0x2f2803a5
mov dword [rsp + 0xec], edx
mov edx, dword [rsp + 0xe8]
add ecx, ecx
mov dword [rsp + 0xec], ecx
sub eax, edx
mov qword [rsp + 0xf0], 0x466f5aa2
cmp eax, dword [rsp + 0xcc]
jbe 0x140003f91
jmp 0x140003f91
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0xe0]
mov rdx, qword [rsp + 0x58]
add rcx, 0x1838686b
xor rdx, rcx
mov qword [rsp + 0x48], rax
mov r8d, dword [rsp + 0x44]
mov dword [rsp + 0x54], r8d
mov r8d, dword [rsp + 0x44]
mov dword [rsp + 0xcc], r8d
cmp rdx, 0x2d94f780
je 0x140003ffe
jmp 0x140003fbf
xor eax, eax
mov ecx, eax
mov r8d, 0x54ded8f8
mov qword [rsp + 0x20], rcx
mov rdx, qword [rsp + 0x20]
call fcn.1400037f0
mov rax, qword [rsp + 0x20]
add rsp, 0xf8
pop rdi
pop rsi
ret

Function at 0x1404982b4
Capabilities:
Encode data using xor

Disassembly:
xchg esp, eax
adc dword [rbx - 7], edx
fsubr qword [rsi + riz*2 + 0x51df3344]
rol r11w, 1
shl ecx, 0x8f
or dword [rsp], 0xa3293f9b
inc r11w
or dword [rsp + 1], ecx
xor qword [rsp], rcx
rol r11w, 1
shl rcx, 0x9d
shl cx, 0xe7
call fcn.140479321
ror cl, 1
xor r11b, cl
call fcn.14048ec4d
add byte [rax], al
cdq
cli
cwde
xchg esi, eax
bswap edx
lahf
loope 0x14049827e
wait
xchg esi, eax
js 0x1404982f0
stosd dword [rdi], eax
xchg ecx, eax
jo 0x156db7813
invalid
mov dl, 0xb6
lahf
and al, 0x86
sub eax, ebp
sahf
xlatb
and byte [rcx + 8], dh
out 0x27, eax
invalid
Function at 0x140004000
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
cld
and rsp, 0xfffffffffffffff0
call fcn.1400040d6
push r9
push r8
push rdx
push rcx
push rsi
xor rdx, rdx
mov rdx, qword gs:[rdx + 0x60]
mov rdx, qword [rdx + 0x18]
mov rdx, qword [rdx + 0x20]
movzx rcx, word [rdx + 0x4a]
mov rsi, qword [rdx + 0x50]
xor r9, r9
xor rax, rax
lodsb al, byte [rsi]
cmp al, 0x61
jl 0x140004037
sub al, 0x20
ror r9d, 0xd
add r9d, eax
loop 0x14000402d
push rdx
push r9
mov rdx, qword [rdx + 0x20]
mov eax, dword [rdx + 0x3c]
add rax, rdx
cmp word [rax + 0x18], 0x20b
jne 0x1400040cb
mov eax, dword [rax + 0x88]
test rax, rax
je 0x1400040cb
add rax, rdx
push rax
mov r8d, dword [rax + 0x20]
add r8, rdx
mov ecx, dword [rax + 0x18]
jrcxz 0x1400040ca
dec rcx
xor r9, r9
mov esi, dword [r8 + rcx*4]
add rsi, rdx
xor rax, rax
ror r9d, 0xd
lodsb al, byte [rsi]
add r9d, eax
cmp al, ah
jne 0x140004081
add r9, qword [rsp + 8]
cmp r9d, r10d
jne 0x140004072
pop rax
mov r8d, dword [rax + 0x24]
add r8, rdx
mov cx, word [r8 + rcx*2]
mov r8d, dword [rax + 0x1c]
add r8, rdx
mov eax, dword [r8 + rcx*4]
pop r8
add rax, rdx
pop r8
pop rsi
pop rcx
pop rdx
pop r8
pop r9
pop r10
sub rsp, 0x20
push r10
jmp rax
pop rax
pop r9
pop rdx
mov rdx, qword [rdx]
jmp 0x140004021
Function at 0x10007510
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0xa0
mov dword [rsp + 0x20], 0
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoA]
nop
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
xor edi, edi
xor eax, eax
lock cmpxchg qword [0x10015150], rbx
je 0x10007566
cmp rax, rbx
jne 0x10007559
mov edi, 1
jmp 0x10007566
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10007540
mov eax, dword [0x10015148]
cmp eax, 1
jne 0x1000757b
lea ecx, [rax + 0x1e]
call sub.MSVCR80.dll__amsg_exit
jmp 0x100075ba
mov eax, dword [0x10015148]
test eax, eax
jne 0x100075b0
mov dword [0x10015148], 1
lea rdx, [0x100014d0]
lea rcx, [0x100014b8]
call sub.MSVCR80.dll__initterm_e
test eax, eax
je 0x100075ba
mov eax, 0xff
jmp 0x10007714
mov dword [0x10014314], 1
mov eax, dword [0x10015148]
cmp eax, 1
jne 0x100075e2
lea rdx, [0x100014b0]
lea rcx, [0x10001470]
call sub.MSVCR80.dll__initterm
mov dword [0x10015148], 2
test edi, edi
jne 0x100075ef
xor eax, eax
xchg qword [0x10015150], rax
cmp qword [0x10015168], 0
je 0x10007618
lea rcx, [0x10015168]
call fcn.10007b90
test eax, eax
je 0x10007618
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
call qword [0x10015168]
mov rax, qword [sym.imp.MSVCR80.dll__acmdln]
mov rbx, qword [rax]
mov qword [rsp + 0x28], rbx
mov edi, dword [rsp + 0x20]
nop
nop
movzx ecx, byte [rbx]
cmp cl, 0x20
ja 0x100076aa
test cl, cl
je 0x10007640
test edi, edi
jne 0x100076aa
movzx eax, byte [rbx]
test al, al
je 0x10007656
cmp al, 0x20
ja 0x10007656
add rbx, 1
mov qword [rsp + 0x28], rbx
jmp 0x10007640
test byte [rsp + 0x6c], 1
je 0x10007665
movzx r9d, word [rsp + 0x70]
jmp 0x1000766b
mov r9d, 0xa
mov r8, rbx
xor edx, edx
lea rcx, [0x10000000]
call fcn.10005300
mov dword [0x10014310], eax
cmp dword [0x100142f4], 0
jne 0x10007693
mov ecx, eax
call qword [sym.imp.MSVCR80.dll_exit]
cmp dword [0x10014314], 0
jne 0x100076a8
call qword [sym.imp.MSVCR80.dll__cexit]
mov eax, dword [0x10014310]
jmp 0x1000770d
cmp cl, 0x22
jne 0x100076bc
xor eax, eax
test edi, edi
sete al
mov edi, eax
mov dword [rsp + 0x20], eax
movzx ecx, cl
call qword [sym.imp.MSVCR80.dll__ismbblead]
test eax, eax
je 0x100076d2
add rbx, 1
mov qword [rsp + 0x28], rbx
add rbx, 1
mov qword [rsp + 0x28], rbx
jmp 0x10007630
jmp 0x10007714
mov rbx, qword [rsp + 0xb0]
add rsp, 0xa0
pop rdi
ret
sub rsp, 0x28
call fcn.10187000
add rsp, 0x28
jmp 0x10007510
Function at 0x415bc0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x415d66
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00431ce0
xorps xmm15, xmm15
mov r14, qword [0x00601c68]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x415c2b
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x415c40
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
nop
test rbx, rbx
jbe 0x415c65
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x415c79
cmp rbx, 0x1000
jae 0x415c35
nop dword [rax]
jmp 0x415ce9
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop
cmp rbx, 0x1000
jae 0x415c8d
xor edx, edx
jmp 0x415ce0
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00431ce0
xorps xmm15, xmm15
mov r14, qword [0x00601c68]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
nop dword [rax]
test dl, dl
jne 0x415c6f
jmp 0x415c54
call fcn.00461b40
xorps xmm15, xmm15
mov r14, qword [0x00601c68]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.00436220
lea rax, [0x004ec21d]
mov ebx, 0x18
call fcn.00436b20
mov rax, qword [rsp + 0x38]
call fcn.00436820
lea rax, [0x004ec2dd]
mov ebx, 0x19
call fcn.00436b20
mov rax, qword [rsp + 0x30]
nop
call fcn.00436820
call fcn.00436480
call fcn.004362a0
lea rax, [0x004eeeea]
mov ebx, 0x21
nop dword [rax + rax]
call fcn.004348e0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045dfa0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.00415bc0
Function at 0x415da0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x415fca
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.00431d60
xorps xmm15, xmm15
mov r14, qword [0x00601c68]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x415e19
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x415e2c
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x415e50
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
nop
jmp 0x415e64
cmp rbx, 0x1000
jae 0x415e23
jmp 0x415ee5
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x415e76
xor esi, esi
jmp 0x415ed6
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
nop dword [rax]
call fcn.00431d60
xorps xmm15, xmm15
mov r14, qword [0x00601c68]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x415e5a
nop
jmp 0x415e42
call fcn.00461b40
xorps xmm15, xmm15
mov r14, qword [0x00601c68]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x415f65
call fcn.00436220
lea rax, [0x004ec8a0]
mov ebx, 0x19
call fcn.00436b20
mov rax, qword [rsp + 0x68]
call fcn.00436820
lea rax, [0x004ec2dd]
mov ebx, 0x19
call fcn.00436b20
mov eax, dword [rsp + 0x34]
nop dword [rax]
call fcn.00436820
call fcn.00436480
call fcn.004362a0
lea rax, [0x004e8461]
mov ebx, 0xd
nop dword [rax + rax]
call fcn.004348e0
cmp eax, 0x5af
je 0x415f08
call fcn.00436220
lea rax, [0x004ec8a0]
mov ebx, 0x19
nop dword [rax]
call fcn.00436b20
mov rax, qword [rsp + 0x38]
call fcn.00436820
lea rax, [0x004ec2dd]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.00436b20
mov eax, dword [rsp + 0x34]
call fcn.00436820
call fcn.00436480
call fcn.004362a0
lea rax, [0x004ee6d8]
mov ebx, 0x1f
call fcn.004348e0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045dfa0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00415da0
Function at 0x41e280
Capabilities:
Hash data using murmur3

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
cmp byte [0x00601a72], 0
jne 0x41e36f
mov rdx, qword [rax + 0x50]
test byte [rdx], al
nop
nop
nop
sub rbx, qword [rax + 0x18]
mov esi, dword [rax + 0x5c]
imul rbx, rsi
mov rsi, rbx
shr rbx, 0x20
shr rsi, 0x23
and ebx, 7
mov rdi, rcx
mov rcx, rbx
mov r8d, 1
shl r8d, cl
add rdx, rsi
lock or byte [rdx], r8b
nop
nop
mov rcx, qword [rax + 0x18]
nop
movabs rdx, 0x800000000000
lea rax, [rdx + rcx]
mov rdx, rax
shr rax, 0x2a
cmp rax, 0x40
jae 0x41e365
lea rbx, [0x005d3eb0]
mov rax, qword [rbx + rax*8]
shr rdx, 0x16
and edx, 0xfffff
mov rdx, qword [rax + rdx*8]
test byte [rdx], al
test byte [rax], al
mov rax, rcx
shr rcx, 0x10
and ecx, 0x3f
movzx ebx, byte [rdx + rcx + 0x11440]
lea rdx, [rdx + rcx]
lea rdx, [rdx + 0x11440]
shr rax, 0xd
and eax, 7
mov rcx, rax
mov eax, 1
shl eax, cl
test al, bl
jne 0x41e347
lock or byte [rdx], al
mov rax, qword [r14 + 0x30]
mov rax, qword [rax + 0xa0]
test byte [rax], al
add qword [rax + 0x1248], rdi
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov ecx, 0x40
call fcn.00460620
lea rax, [0x004f0bd0]
mov ebx, 0x2c
nop dword [rax + rax]
call fcn.004348e0
nop
int3

Function at 0x420760
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x42085e
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rbx
mov qword [rsp + 8], 0
jmp 0x4207a0
mov rax, qword [rsp + 0x50]
mov rcx, rdx
mov rbx, qword [rsp + 0x58]
nop
cmp qword [rsp + 8], rbx
jae 0x42084f
test byte [rax], al
lea rcx, [rax + 0x100b8]
mov rax, rcx
call fcn.00421320
nop dword [rax]
test rax, rax
je 0x42084f
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x30], xmm15
lea rcx, [0x004208a0]
mov qword [rsp + 0x10], rcx
lea rdx, [rsp + 8]
mov qword [rsp + 0x18], rdx
mov rdx, qword [rsp + 0x50]
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rbx
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x38], rax
lea rbx, [rsp + 0x10]
mov qword [rsp], rbx
call fcn.0045de60
xorps xmm15, xmm15
mov r14, qword [0x00601c68]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x60]
test rdx, rdx
jne 0x42083d
xor eax, eax
jmp 0x420847
mov rax, qword [rdx]
call rax
mov rdx, qword [rsp + 0x60]
test al, al
je 0x420792
mov rax, qword [rsp + 8]
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.0045dfa0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.00420760