joyce8/EMBER2024-capa huggingface dataset:
Function at 0x50f7e0
Capabilities:
Access peb ldr_data

Disassembly:
lea r12, [rsp - 0x30]
cmp r12, qword [r14 + 0x10]
jbe 0x50fa29
push rbp
mov rbp, rsp
sub rsp, 0xa8
nop word [rax + rax]
test rax, rax
je 0x50fa14
mov qword [rsp + 0xb8], rax
mov rbx, qword [rax + 8]
test rbx, rbx
jne 0x50f822
xor ebx, ebx
xor ecx, ecx
nop
jmp 0x50f83c
mov rdx, qword [rax]
mov rcx, qword [rax + 0x10]
mov rax, rdx
call fcn.00501f80
mov rcx, rax
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x88], rcx
mov qword [rsp + 0x48], rbx
cmp qword [rax + 0x28], 0
je 0x50f951
mov rcx, qword [rax + 0x18]
mov rax, rcx
nop dword [rax + rax]
call fcn.004826e0
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x58], rbx
mov rcx, qword [rsp + 0xb8]
mov r8, qword [rcx + 0x20]
mov r9, qword [rcx + 0x28]
mov rcx, qword [rsp + 0x48]
lea rdi, [0x006381f0]
mov esi, 1
lea rax, [rsp + 0x68]
mov rbx, qword [rsp + 0x88]
call fcn.0044f180
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x3a
call fcn.00403c20
xorps xmm15, xmm15
mov r14, qword [0x007c9fa0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x50f91b
xor eax, eax
lea rbx, [0x00638360]
mov ecx, 1
mov rdi, qword [rsp + 0xa0]
mov rsi, qword [rsp + 0x60]
lea r8, [0x005dbb6d]
mov r9d, 2
mov r10, qword [rsp + 0x98]
mov r11, qword [rsp + 0x58]
call fcn.0044f240
jmp 0x50f948
xor eax, eax
mov rbx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x60]
lea rdi, [0x00638300]
mov esi, 1
mov r8, qword [rsp + 0x98]
mov r9, qword [rsp + 0x58]
call fcn.0044f180
add rsp, 0xa8
pop rbp
ret
mov rax, qword [rax + 0x18]
call fcn.004826e0
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x50], rbx
mov rcx, qword [rsp + 0x88]
mov qword [rsp], rcx
mov rdx, qword [rsp + 0x48]
mov qword [rsp + 8], rdx
mov byte [rsp + 0x10], 0x3a
call fcn.00403c20
xorps xmm15, xmm15
mov r14, qword [0x007c9fa0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
nop
jl 0x50f9de
xor eax, eax
lea rbx, [0x00638360]
mov ecx, 1
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x48]
lea r8, [0x005dbb6d]
mov r9d, 2
mov r10, qword [rsp + 0x90]
mov r11, qword [rsp + 0x50]
call fcn.0044f240
jmp 0x50fa0b
xor eax, eax
mov rbx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x48]
lea rdi, [0x00638300]
mov esi, 1
mov r8, qword [rsp + 0x90]
mov r9, qword [rsp + 0x50]
call fcn.0044f180
add rsp, 0xa8
pop rbp
ret
lea rax, [0x005dbf6d]
mov ebx, 5
add rsp, 0xa8
pop rbp
ret
mov qword [rsp + 8], rax
call fcn.00463920
mov rax, qword [rsp + 8]
jmp fcn.0050f7e0
Function at 0x513940
Capabilities:
Parse credit card information

Disassembly:
lea ecx, [rax - 0x61]
cmp cl, 0x19
jbe 0x513958
lea ecx, [rax - 0x41]
cmp cl, 0x19
jbe 0x513958
lea ecx, [rax - 0x30]
cmp cl, 9
ja 0x513960
xor eax, eax
ret
cmp rbx, 3
je 0x51396c
cmp rbx, 4
jne 0x513999
cmp al, 0x2c
ja 0x513986
lea ecx, [rax - 0x21]
cmp cl, 1
jbe 0x513996
cmp al, 0x24
je 0x513996
nop dword [rax]
cmp al, 0x26
jae 0x513996
jmp 0x513999
lea ecx, [rax - 0x3a]
cmp cl, 4
jbe 0x513996
cmp al, 0x5b
je 0x513996
cmp al, 0x5d
jne 0x513999
xor eax, eax
ret
cmp al, 0x2f
ja 0x5139d2
nop dword [rax]
cmp al, 0x26
ja 0x5139b1
cmp al, 0x24
je 0x5139f1
cmp al, 0x26
je 0x5139f1
jmp 0x513a6b
lea ecx, [rax - 0x2b]
cmp cl, 1
jbe 0x5139f1
lea ecx, [rax - 0x2d]
nop dword [rax]
cmp cl, 1
jbe 0x513a68
cmp al, 0x2f
je 0x5139f1
jmp 0x513a6b
cmp al, 0x3d
ja 0x5139e9
lea ecx, [rax - 0x3a]
cmp cl, 1
jbe 0x5139f1
nop
cmp al, 0x3d
je 0x5139f1
jmp 0x513a6b
lea ecx, [rax - 0x3f]
cmp cl, 1
ja 0x513a60
cmp rbx, 2
jg 0x513a27
cmp rbx, 1
je 0x513a21
nop dword [rax]
cmp rbx, 2
jne 0x513a6b
cmp al, 0x2f
je 0x513a12
cmp al, 0x3b
je 0x513a12
cmp al, 0x2c
jne 0x513a19
mov ecx, 1
jmp 0x513a1e
cmp al, 0x3f
sete cl
mov eax, ecx
ret
cmp al, 0x3f
sete al
ret
cmp rbx, 5
jne 0x513a4a
cmp al, 0x40
je 0x513a39
cmp al, 0x2f
je 0x513a39
cmp al, 0x3f
jne 0x513a42
mov ecx, 1
nop
jmp 0x513a47
cmp al, 0x3a
sete cl
mov eax, ecx
ret
cmp rbx, 6
je 0x513a59
cmp rbx, 7
jne 0x513a6b
xor eax, eax
ret
mov eax, 1
ret
cmp al, 0x5f
je 0x513a68
cmp al, 0x7e
jne 0x513a6b
xor eax, eax
ret
cmp rbx, 7
jne 0x513a81
cmp al, 0x21
je 0x513a7d
lea ecx, [rax - 0x28]
cmp cl, 2
ja 0x513a81
xor eax, eax
nop
ret
mov eax, 1
ret
Function at 0x552920
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea r12, [rsp - 0x30]
cmp r12, qword [r14 + 0x10]
jbe 0x552b79
push rbp
mov rbp, rsp
sub rsp, 0xa8
mov rdx, rax
mov r8d, dword [rax + 0x3c]
add r8, rdx
nop
cmp dword [r8], 0x4550
jne 0x552996
mov qword [rsp + 0x88], rdx
mov r8d, dword [r8 + 0x88]
add r8, rdx
mov qword [rsp + 0xa0], r8
mov r9d, dword [r8 + 0x1c]
mov r10d, dword [r8 + 0x20]
mov r11d, dword [r8 + 0x24]
add r9, rdx
mov qword [rsp + 0x58], r9
add r10, rdx
mov qword [rsp + 0x50], r10
add r11, rdx
mov qword [rsp + 0x48], r11
xor eax, eax
xor ecx, ecx
xor ebx, ebx
xor esi, esi
jmp 0x5529b1
xor eax, eax
xor ebx, ebx
mov rcx, rbx
add rsp, 0xa8
pop rbp
ret
mov qword [rbx + rsi*8 - 0x18], rdi
inc rax
mov rsi, r15
mov r12d, dword [r8 + 0x18]
cmp rax, r12
jae 0x552ac5
mov qword [rsp + 0x80], rax
lea r12, [r10 + rax*4]
mov r12d, dword [r12]
add r12, rdx
lea r13, [r11 + rax*2]
movzx r13d, word [r13]
lea r13, [r9 + r13*4]
mov r13d, dword [r13]
mov r15, r12
add r13, rdx
mov qword [rsp + 0x78], r13
test r12, r12
je 0x552a14
cmp byte [r12], 0
jne 0x552a02
xor edi, edi
xor r12d, r12d
nop
jmp 0x552a19
mov rdi, r12
xor edi, edi
mov qword [rsp + 0x60], rdi
mov rdi, r12
jmp 0x552ae9
xor edi, edi
xor r12d, r12d
lea r15, [rsi + 1]
nop dword [rax]
cmp rcx, r15
jae 0x552a88
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x90], rdi
mov rax, rbx
mov rbx, r15
mov edi, 1
lea rsi, [0x005b6680]
call fcn.0044b400
mov rdx, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x90]
mov r8, qword [rsp + 0xa0]
mov r9, qword [rsp + 0x58]
mov r10, qword [rsp + 0x50]
mov r11, qword [rsp + 0x48]
mov r12, qword [rsp + 0x40]
mov r13, qword [rsp + 0x78]
mov r15, rbx
mov rbx, rax
mov rax, qword [rsp + 0x80]
lea rsi, [r15 + r15*2]
mov qword [rbx + rsi*8 - 0x10], r12
mov qword [rbx + rsi*8 - 8], r13
cmp dword [0x007ca080], 0
nop dword [rax]
je 0x5529a6
mov r12, r11
call fcn.00465840
mov qword [r11], rdi
mov r13, qword [rbx + rsi*8 - 0x18]
mov qword [r11 + 8], r13
mov r11, r12
nop dword [rax]
jmp 0x5529a6
mov rax, rbx
mov rbx, rsi
add rsp, 0xa8
pop rbp
ret
mov r9, qword [rsp + 0x60]
inc r9
inc r12
mov qword [rsp + 0x60], r9
mov r9, qword [rsp + 0x58]
cmp byte [r12], 0
jne 0x552ad4
mov r12, qword [rsp + 0x60]
test r12, r12
jl 0x552b73
neg r15
nop dword [rax]
cmp r12, r15
ja 0x552b6e
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x98], rbx
xor eax, eax
mov rbx, rdi
mov rcx, r12
nop
call fcn.0044f460
mov rcx, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x68]
mov r8, qword [rsp + 0xa0]
mov r9, qword [rsp + 0x58]
mov r10, qword [rsp + 0x50]
mov r11, qword [rsp + 0x48]
mov r13, qword [rsp + 0x78]
mov rdi, rax
mov r12, rbx
mov rax, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x98]
jmp 0x552a19
call fcn.0045ce00
call fcn.0045ce00
nop
mov qword [rsp + 8], rax
nop
call fcn.00463920
mov rax, qword [rsp + 8]
jmp fcn.00552920
Function at 0x55bee0
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, qword gs:[0x60]
nop
mov rax, qword [rax + 0x18]
nop
mov rax, qword [rax + 0x20]
nop
xor r10, r10
cmp r10, qword [rsp + 8]
nop
je 0x55bf09
nop
mov rax, qword [rax]
nop
inc r10
jmp 0x55bef7
mov rcx, qword [rax + 0x30]
nop
mov qword [rsp + 0x18], rcx
nop
mov rcx, qword [rax + 0x20]
nop
mov qword [rsp + 0x10], rcx
nop
mov rcx, rax
nop
add rcx, 0x38
nop
mov qword [rsp + 0x20], rcx
ret
Function at 0x140002244
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov ebx, edx
xor r8d, r8d
xor edx, edx
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
xor ebp, ebp
mov edi, eax
test eax, eax
je 0x140002272
dec edi
mov edx, ebx
mov ecx, edi
call fcn.140003950
lea r8d, [rdi + 1]
mov rcx, rsi
mov rdx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov rsi, qword [rsp + 0x40]
movsxd rcx, edi
mov word [rbx + rcx*2], bp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140002efc
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rax, qword [0x140006718]
xor r13d, r13d
mov rsi, r8
mov r15, rdx
mov rdi, rcx
mov r14d, r13d
test rax, rax
jne 0x140002f4e
lea r8, [fcn.140003070]
lea edx, [rax + 0x10]
mov ecx, 0x260
call fcn.140003438
mov qword [0x140006718], rax
mov rdx, rdi
mov rcx, rax
call fcn.140003398
mov rbx, rax
test rax, rax
je 0x14000304f
test r15, r15
lea rbp, [0x140004200]
cmovne rbp, r15
test rsi, rsi
je 0x140002f7e
cmp word [rsi], r13w
jne 0x140002f85
lea rsi, [0x140004220]
mov rcx, rbp
call sub.msvcrt.dll_wcslen
mov rcx, rsi
mov r12, rax
call sub.msvcrt.dll_wcslen
mov rcx, qword [0x140006688]
add eax, 2
xor edx, edx
add eax, r12d
movsxd r8, eax
add r8, r8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r15, rax
test rax, rax
je 0x140003038
mov rdx, rbp
mov rcx, rax
call sub.msvcrt.dll_wcscpy
test r12d, r12d
je 0x140002fe5
movsxd rax, r12d
cmp word [rbp + rax*2 - 2], 0x5c
je 0x140002fe5
lea rdx, [0x140004228]
mov rcx, r15
call sub.msvcrt.dll_wcscat
mov rdx, rsi
mov rcx, r15
call sub.msvcrt.dll_wcscat
lea rdx, [rbx + 0xc]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rbx], rax
cmp rax, 0xffffffffffffffff
je 0x14000300c
mov dword [rbx + 8], r13d
jmp 0x14000301e
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x140003021
mov dword [rbx + 8], 1
mov r14, rbx
mov rcx, qword [0x140006688]
mov r8, r15
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
test r14, r14
jne 0x14000304f
mov rcx, qword [0x140006718]
cmp rdi, 0xffffffffffffffff
cmove rdi, rbx
mov rdx, rdi
call fcn.140003330
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rax, r14
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1415b1058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1415b11df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, pe_nt_image_headers64
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1415b1089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1415b106f
add dl, dl
jne 0x1415b1096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1415b10f6
xor eax, eax
add dl, dl
jne 0x1415b10a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1415b11ad
add dl, dl
jne 0x1415b10b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1415b10c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1415b10d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1415b10dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1415b10ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1415b107e
mov eax, 1
add dl, dl
jne 0x1415b1106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1415b1113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1415b10fb
sub eax, ebx
mov ebx, 1
jne 0x1415b114c
mov ecx, 1
add dl, dl
jne 0x1415b112e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1415b113b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1415b1123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1415b107e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1415b1168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1415b1175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1415b115d
cmp eax, 0x7d00
jae 0x1415b119b
cmp eax, 0x500
jb 0x1415b1196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1415b107e
cmp eax, 0x7f
ja 0x1415b119e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1415b107e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1415b11d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1415b107e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x141a880b0
Capabilities:
Decompress data using aplib

Disassembly:
call 0x141a88237
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x141a880e1
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x141a880c7
add dl, dl
jne 0x141a880ee
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x141a8814e
xor eax, eax
add dl, dl
jne 0x141a880fd
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x141a88205
add dl, dl
jne 0x141a8810e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141a8811b
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141a88128
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141a88135
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x141a88142
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x141a880d6
mov eax, 1
add dl, dl
jne 0x141a8815e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141a8816b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141a88153
sub eax, ebx
mov ebx, 1
jne 0x141a881a4
mov ecx, 1
add dl, dl
jne 0x141a88186
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x141a88193
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141a8817b
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x141a880d6
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x141a881c0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x141a881cd
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141a881b5
cmp eax, 0x7d00
jae 0x141a881f3
cmp eax, 0x500
jb 0x141a881ee
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x141a880d6
cmp eax, 0x7f
ja 0x141a881f6
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x141a880d6
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x141a8822a
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x141a880d6
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x416c20
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x416dab
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [0x0092b398]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.004345a0
xorps xmm15, xmm15
mov r14, qword [0x00a1c570]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x416c85
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x416c94
add rsp, 0x48
pop rbp
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x416cb3
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x416cc3
cmp rbx, 0x1000
jae 0x416c8b
jmp 0x416d2d
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x416cd5
xor edx, edx
jmp 0x416d24
mov rcx, qword [0x0092b398]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.004345a0
xorps xmm15, xmm15
mov r14, qword [0x00a1c570]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x416cb9
jmp 0x416ca8
call fcn.004687a0
xorps xmm15, xmm15
mov r14, qword [0x00a1c570]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.00438d00
lea rax, [0x0071bc08]
mov ebx, 0x18
nop dword [rax]
call fcn.00439580
mov rax, qword [rsp + 0x38]
call fcn.004392c0
lea rax, [0x0071c673]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.00439580
mov rax, qword [rsp + 0x30]
call fcn.004392c0
call fcn.00438f40
call fcn.00438d60
lea rax, [0x00720f0e]
mov ebx, 0x21
call fcn.00437360
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00465040
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00416c20
Function at 0x416de0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x417006
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [0x0092b3a0]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.00434620
xorps xmm15, xmm15
mov r14, qword [0x00a1c570]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x416e53
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x416e62
add rsp, 0x50
pop rbp
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x416e85
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x416e95
cmp rbx, 0x1000
jae 0x416e59
nop
jmp 0x416f18
add rsp, 0x50
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop word [rax + rax]
cmp rbx, 0x1000
jae 0x416ead
xor esi, esi
jmp 0x416f0a
mov rax, qword [0x0092b3a0]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.00434620
xorps xmm15, xmm15
mov r14, qword [0x00a1c570]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x416e8b
jmp 0x416e76
call fcn.004687a0
xorps xmm15, xmm15
mov r14, qword [0x00a1c570]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x416fa0
nop dword [rax + rax]
call fcn.00438d00
lea rax, [0x0071c68c]
mov ebx, 0x19
call fcn.00439580
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
call fcn.004392c0
lea rax, [0x0071c673]
mov ebx, 0x19
call fcn.00439580
mov eax, dword [rsp + 0x34]
call fcn.004392c0
nop
call fcn.00438f40
call fcn.00438d60
lea rax, [0x00715dd5]
mov ebx, 0xd
call fcn.00437360
nop dword [rax + rax]
cmp eax, 0x5af
je 0x416f40
call fcn.00438d00
lea rax, [0x0071c68c]
mov ebx, 0x19
call fcn.00439580
mov rax, qword [rsp + 0x38]
call fcn.004392c0
lea rax, [0x0071c673]
mov ebx, 0x19
call fcn.00439580
mov eax, dword [rsp + 0x34]
nop dword [rax]
call fcn.004392c0
call fcn.00438f40
call fcn.00438d60
lea rax, [0x0071fea6]
mov ebx, 0x1f
nop dword [rax + rax]
call fcn.00437360
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00465040
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.00416de0
Function at 0x4204e0
Capabilities:
Hash data using murmur3

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
cmp byte [0x00a1c27d], 0
jne 0x4205c7
sub rbx, qword [rax + 0x18]
mov rdx, qword [rax + 0x50]
test byte [rdx], al
mov esi, dword [rax + 0x64]
imul rbx, rsi
mov rsi, rbx
shr rbx, 0x20
shr rsi, 0x23
and ebx, 7
mov rdi, rcx
mov rcx, rbx
mov r8d, 1
shl r8d, cl
add rdx, rsi
nop
nop
nop
nop
lock or byte [rdx], r8b
mov rcx, qword [rax + 0x18]
movabs rdx, 0x800000000000
lea rax, [rdx + rcx]
mov rdx, rax
shr rdx, 0x2a
nop
nop
nop
cmp rdx, 0x40
jae 0x4205ba
lea rbx, [0x009ee658]
mov rdx, qword [rbx + rdx*8]
test byte [rdx], al
mov rbx, rcx
shr rbx, 0x10
and ebx, 0x3f
shr rcx, 0xd
and ecx, 7
mov esi, 1
shl esi, cl
shr rax, 0x16
and eax, 0xfffff
mov rax, qword [rdx + rax*8]
test byte [rax], al
movzx edx, byte [rax + rbx + 0x11440]
lea rax, [rax + rbx]
lea rax, [rax + 0x11440]
test sil, dl
jne 0x4205a0
lock or byte [rax], sil
mov rax, qword [r14 + 0x30]
mov rax, qword [rax + 0xa0]
test byte [rax], al
add qword [rax + 0x1250], rdi
add rsp, 0x10
pop rbp
ret
mov rax, rdx
mov ecx, 0x40
call fcn.00467320
lea rax, [0x00725937]
mov ebx, 0x2c
call fcn.00437360
nop
int3

Function at 0x4228a0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4229a6
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x70], rcx
mov byte [rsp + 0x17], dil
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x18], 0
jmp 0x4228e3
mov rax, qword [rsp + 0x60]
mov rcx, rdx
mov rbx, qword [rsp + 0x68]
movzx edi, byte [rsp + 0x17]
cmp qword [rsp + 0x18], rbx
jae 0x42299b
test byte [rax], al
lea rcx, [rax + 0x100b8]
mov ebx, edi
mov rax, rcx
nop dword [rax]
call fcn.00423680
test rax, rax
je 0x42299b
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x30], xmm15
movups xmmword [rsp + 0x40], xmm15
lea rcx, [0x004229e0]
mov qword [rsp + 0x20], rcx
lea rdx, [rsp + 0x18]
mov qword [rsp + 0x28], rdx
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x48], rax
lea rbx, [rsp + 0x20]
mov qword [rsp], rbx
nop dword [rax]
call fcn.00464f00
xorps xmm15, xmm15
mov r14, qword [0x00a1c570]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x70]
nop dword [rax]
test rdx, rdx
jne 0x422989
xor eax, eax
jmp 0x422993
mov rax, qword [rdx]
call rax
mov rdx, qword [rsp + 0x70]
test al, al
je 0x4228d1
mov rax, qword [rsp + 0x18]
add rsp, 0x50
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov byte [rsp + 0x20], dil
call fcn.00465040
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movzx edi, byte [rsp + 0x20]
jmp fcn.004228a0