joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40bb80
Capabilities:
Run powershell expression

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x38
mov rcx, qword [r14 + 0x30]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x20]
mov rdx, rax
xor eax, eax
lock cmpxchg qword [rdx], rcx
sete cl
test cl, cl
je 0x40bc12
mov qword [rsp + 0x30], r14
test rbx, rbx
jge 0x40bbde
mov rcx, qword [r14 + 0x30]
mov byte [rcx + 0xe5], 1
mov rcx, qword [0x0096af08]
cmp qword [rcx], 0
jne 0x40bde3
mov rax, 0xffffffffffffffff
call fcn.00433b00
jmp 0x40bd9a
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x50], rbx
call fcn.00469020
xorps xmm15, xmm15
mov r14, qword [0x009d9398]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp]
mov rbx, qword [rsp + 0x50]
add rax, rbx
mov qword [rsp + 0x18], rax
jmp 0x40bc3a
cmp qword [rdx], 1
jne 0x40bc23
mov eax, 1
add rsp, 0x38
pop rbp
ret
lea rax, [0x0071307a]
mov ebx, 0x1e
call fcn.00437620
mov rax, rdx
mov rbx, rcx
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rcx + 0x30]
mov byte [rdx + 0xe5], 1
mov rdx, qword [0x0096af08]
cmp qword [rdx], 0
je 0x40bc6e
nop word [rax + rax]
cmp rbx, 0x989680
jle 0x40bc6e
mov ebx, 0x989680
mov rax, rbx
call fcn.00433b00
test eax, eax
jge 0x40bcfc
mov rax, qword [0x0096af08]
mov rax, qword [rax]
test rax, rax
je 0x40bcb1
mov qword [rsp], rax
mov qword [rsp + 8], 0
call fcn.00466f60
xorps xmm15, xmm15
mov r14, qword [0x009d9398]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 0x30]
mov byte [rcx + 0xe5], 0
call fcn.00469020
xorps xmm15, xmm15
mov r14, qword [0x009d9398]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp]
mov rcx, qword [rsp + 0x18]
mov rdx, rcx
sub rcx, rax
test rcx, rcx
jg 0x40bc34
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x30]
jmp 0x40bd17
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rcx + 0x30]
mov byte [rcx + 0xe5], 0
mov eax, 1
add rsp, 0x38
pop rbp
ret
mov rax, qword [rcx]
mov rsi, qword [rdx + 0x30]
mov rdi, rsi
cmp rax, rsi
jne 0x40bd40
xor esi, esi
lock cmpxchg qword [rcx], rsi
sete dil
test dil, dil
je 0x40bd17
xor eax, eax
add rsp, 0x38
pop rbp
ret
cmp rax, 1
jne 0x40bd89
mov byte [rdi + 0xe5], 1
mov rax, 0xffffffffffffffff
call fcn.00433b00
test eax, eax
jl 0x40bd78
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rcx + 0x30]
mov byte [rcx + 0xe5], 0
mov eax, 1
add rsp, 0x38
pop rbp
ret
lea rax, [0x0071b456]
mov ebx, 0x32
call fcn.00437620
lea rax, [0x0071af56]
mov ebx, 0x31
call fcn.00437620
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rcx + 0x30]
mov byte [rcx + 0xe5], 0
mov eax, 1
add rsp, 0x38
pop rbp
ret
mov rax, qword [0x0096af08]
mov rax, qword [rax]
mov qword [rsp], rax
mov qword [rsp + 8], 0
call fcn.00466f60
xorps xmm15, xmm15
mov r14, qword [0x009d9398]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, 0x989680
call fcn.00433b00
test eax, eax
jl 0x40bdb5
jmp 0x40bd9a
Function at 0x40cc60
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x40ce38
push rbp
mov rbp, rsp
sub rsp, 0x38
test byte [rax], al
movzx edx, bl
nop word [rax + rax]
cmp rdx, 0x88
jae 0x40ce2a
mov qword [rsp + 0x30], rdx
mov byte [rsp + 0x50], bl
mov qword [rsp + 0x48], rax
mov rcx, qword [rax + rdx*8 + 0x28]
mov qword [rsp + 0x28], rcx
mov rax, rcx
call fcn.00413c60
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rcx + 0x38]
cmp rax, rdx
jne 0x40cd0f
mov qword [rsp + 0x20], rdx
movzx ecx, word [rcx + 0x68]
cmp rdx, rcx
jne 0x40cdc7
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x48]
movzx ebx, byte [rsp + 0x50]
nop dword [rax]
call fcn.00415c40
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x48]
mov rax, qword [rdx + rcx*8 + 0x28]
mov qword [rsp + 0x28], rax
call fcn.00413c60
mov rdx, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x28]
jmp 0x40cd12
mov rbx, rax
cmp qword [rcx + 0x38], rax
jbe 0x40cdb6
mov rsi, qword [rcx + 0x70]
imul rax, rsi
movzx esi, word [rcx + 0x68]
inc esi
movzx edi, si
add rax, qword [rcx + 0x18]
mov word [rcx + 0x68], si
mov r8, qword [rcx + 0x38]
cmp r8, rdi
jb 0x40cd4f
cmp rbx, rdx
sete dl
mov rbx, rcx
mov ecx, edx
add rsp, 0x38
pop rbp
ret
mov word [rsp + 0x16], si
mov qword [rsp + 0x20], r8
call fcn.00438fc0
lea rax, [0x0070950d]
mov ebx, 0xe
call fcn.00439840
movzx eax, word [rsp + 0x16]
movzx eax, ax
call fcn.00439580
lea rax, [0x00707bf4]
mov ebx, 0xb
call fcn.00439840
mov rax, qword [rsp + 0x20]
call fcn.00439580
call fcn.00439200
nop dword [rax]
call fcn.00439020
lea rax, [0x0070ec3d]
mov ebx, 0x17
call fcn.00437620
lea rax, [0x0070e0b2]
mov ebx, 0x16
call fcn.00437620
mov word [rsp + 0x16], cx
call fcn.00438fc0
lea rax, [0x0070ec26]
mov ebx, 0x17
nop dword [rax]
call fcn.00439840
movzx eax, word [rsp + 0x16]
call fcn.00439580
lea rax, [0x00707bf4]
mov ebx, 0xb
nop dword [rax + rax]
call fcn.00439840
mov rax, qword [rsp + 0x20]
call fcn.00439580
call fcn.00439200
call fcn.00439020
lea rax, [0x0071af87]
mov ebx, 0x31
call fcn.00437620
mov rax, rdx
mov ecx, 0x88
call fcn.00467760
nop
mov qword [rsp + 8], rax
mov byte [rsp + 0x10], bl
call fcn.004654a0
mov rax, qword [rsp + 8]
movzx ebx, byte [rsp + 0x10]
jmp fcn.0040cc60
Function at 0x416ce0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x416e6b
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00434860
xorps xmm15, xmm15
mov r14, qword [0x009d9398]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x416d45
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x416d54
add rsp, 0x48
pop rbp
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x416d73
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x416d83
cmp rbx, 0x1000
jae 0x416d4b
jmp 0x416ded
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x416d95
xor edx, edx
jmp 0x416de4
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00434860
xorps xmm15, xmm15
mov r14, qword [0x009d9398]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x416d79
jmp 0x416d68
call fcn.00468c00
xorps xmm15, xmm15
mov r14, qword [0x009d9398]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.00438fc0
lea rax, [0x0070f583]
mov ebx, 0x18
nop dword [rax]
call fcn.00439840
mov rax, qword [rsp + 0x38]
call fcn.00439580
lea rax, [0x0070ffd3]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.00439840
mov rax, qword [rsp + 0x30]
call fcn.00439580
call fcn.00439200
call fcn.00439020
lea rax, [0x00714932]
mov ebx, 0x21
call fcn.00437620
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004654a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00416ce0
Function at 0x416ea0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4170c6
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.004348e0
xorps xmm15, xmm15
mov r14, qword [0x009d9398]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x416f13
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x416f22
add rsp, 0x50
pop rbp
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x416f45
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x416f55
cmp rbx, 0x1000
jae 0x416f19
nop
jmp 0x416fd8
add rsp, 0x50
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop word [rax + rax]
cmp rbx, 0x1000
jae 0x416f6d
xor esi, esi
jmp 0x416fca
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.004348e0
xorps xmm15, xmm15
mov r14, qword [0x009d9398]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x416f4b
jmp 0x416f36
call fcn.00468c00
xorps xmm15, xmm15
mov r14, qword [0x009d9398]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x417060
nop dword [rax + rax]
call fcn.00438fc0
lea rax, [0x0070ffec]
mov ebx, 0x19
call fcn.00439840
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
call fcn.00439580
lea rax, [0x0070ffd3]
mov ebx, 0x19
call fcn.00439840
mov eax, dword [rsp + 0x34]
call fcn.00439580
nop
call fcn.00439200
call fcn.00439020
lea rax, [0x00708d2e]
mov ebx, 0xd
call fcn.00437620
nop dword [rax + rax]
cmp eax, 0x5af
je 0x417000
call fcn.00438fc0
lea rax, [0x0070ffec]
mov ebx, 0x19
call fcn.00439840
mov rax, qword [rsp + 0x38]
call fcn.00439580
lea rax, [0x0070ffd3]
mov ebx, 0x19
call fcn.00439840
mov eax, dword [rsp + 0x34]
nop dword [rax]
call fcn.00439580
call fcn.00439200
call fcn.00439020
lea rax, [0x007139be]
mov ebx, 0x1f
nop dword [rax + rax]
call fcn.00437620
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004654a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.00416ea0
Function at 0x419a20
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x419b1c
push rbp
mov rbp, rsp
sub rsp, 0x28
mov rsi, qword [rax]
test rsi, rsi
je 0x419aee
mov rdi, qword [rax + 0x18]
test rdi, rdi
je 0x419a79
mov rcx, qword [rdi]
mov qword [rax + 0x18], rcx
mov rcx, qword [rax]
add qword [rax + 0x30], rcx
cmp byte [rax + 0x40], 0
je 0x419a70
mov qword [rsp + 0x18], rdi
mov rbx, qword [rax]
mov rax, rdi
call fcn.00467e60
mov rdi, qword [rsp + 0x18]
mov rax, rdi
add rsp, 0x28
pop rbp
ret
mov qword [rsp + 0x38], rax
mov edi, dword [rax + 0x28]
cmp rsi, rdi
jbe 0x419aa9
mov edx, dword [rax + 0x2c]
mov rcx, qword [rax + 0x38]
xor ebx, ebx
mov rax, rdx
call fcn.0040da80
mov rdx, qword [rsp + 0x38]
mov qword [rdx + 0x20], rax
mov esi, dword [rdx + 0x2c]
mov dword [rdx + 0x28], esi
mov rax, rdx
mov rbx, qword [rax + 0x20]
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x419ad1
mov qword [rsp + 0x20], rbx
mov rcx, qword [rdx]
mov rsi, qword [rax + 0x10]
mov rax, rsi
call rcx
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x20]
mov rcx, qword [rax]
add qword [rax + 0x20], rcx
mov rcx, qword [rax]
sub dword [rax + 0x28], ecx
mov rcx, qword [rax]
add qword [rax + 0x30], rcx
mov rax, rbx
add rsp, 0x28
pop rbp
ret
call fcn.00438fc0
lea rax, [0x0071bb77]
mov ebx, 0x34
nop
call fcn.00439840
call fcn.00439020
lea rax, [0x0070ec82]
mov ebx, 0x17
call fcn.00437620
nop
mov qword [rsp + 8], rax
call fcn.004654a0
mov rax, qword [rsp + 8]
jmp fcn.00419a20
Function at 0x41c580
Capabilities:
Run powershell expression

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
cmp rdi, 0x989680
jb 0x41c5b9
mov rdx, rax
movabs rax, 0x8637bd05af6c69b6
mov rsi, rdx
mul rdi
shr rdx, 0x13
lea rdi, [rbx - 1]
mov rax, rdi
jmp 0x41c6e5
shr rdi, 1
mov rdx, rax
movabs rax, 0x83126e978d4fdf3c
mov rsi, rdx
mul rdi
shr rdx, 8
test rdx, rdx
je 0x41c5e0
mov eax, 3
jmp 0x41c62a
test rbx, rbx
jbe 0x41c608
mov byte [rsi], 0x30
cmp rcx, 1
jb 0x41c5fc
mov rax, rsi
mov ebx, 1
add rsp, 0x10
pop rbp
ret
mov ecx, 1
xor edx, edx
call fcn.004677e0
xor eax, eax
mov rcx, rax
call fcn.00467760
mov rdi, rax
movabs rax, 0xcccccccccccccccd
mul rdx
shr rdx, 3
lea rax, [rdi - 1]
cmp rdx, 0x64
jae 0x41c612
mov rdi, rbx
sub rdi, rax
lea r8, [rbx - 1]
dec rdi
jmp 0x41c642
mov r8, rax
cmp rdx, 0xa
jae 0x41c64d
cmp r8, rdi
jl 0x41c696
movabs rax, 0xcccccccccccccccd
mov r9, rdx
mul rdx
shr rdx, 3
lea r10, [rdx + rdx*4]
shl r10, 1
sub r9, r10
cmp rbx, r8
jbe 0x41c6d4
add r9, 0x30
mov byte [rsi + r8], r9b
lea rax, [r8 - 1]
nop dword [rax]
cmp rax, rdi
jne 0x41c63f
cmp rbx, rax
jbe 0x41c6cc
mov byte [r8 + rsi - 1], 0x2e
lea rax, [r8 - 2]
jmp 0x41c63f
cmp rbx, r8
jbe 0x41c6c1
add rdx, 0x30
mov byte [rsi + r8], dl
sub rcx, r8
mov rdx, rcx
neg rdx
sar rdx, 0x3f
and rdx, r8
lea rax, [rdx + rsi]
sub rbx, r8
add rsp, 0x10
pop rbp
nop
ret
mov rax, r8
mov rcx, rbx
call fcn.00467760
mov rcx, rbx
call fcn.00467760
mov rax, r8
mov rcx, rbx
call fcn.00467760
mov rdi, rax
mov rax, r8
cmp rdx, 0xa
jae 0x41c6f0
cmp rdi, rax
jl 0x41c737
mov r8, rax
movabs rax, 0xcccccccccccccccd
mov r9, rdx
mul rdx
shr rdx, 3
lea r10, [rdx + rdx*4]
shl r10, 1
sub r9, r10
cmp rbx, rdi
jbe 0x41c774
add r9, 0x30
mov byte [rsi + rdi], r9b
lea rax, [rdi - 1]
cmp rax, r8
jne 0x41c6df
cmp rbx, rax
jbe 0x41c76c
mov byte [rdi + rsi - 1], 0x2e
lea rax, [rdi - 2]
jmp 0x41c6df
cmp rbx, rdi
jbe 0x41c761
add rdx, 0x30
mov byte [rsi + rdi], dl
sub rcx, rdi
mov rdx, rcx
neg rdx
sar rdx, 0x3f
and rdx, rdi
lea rax, [rsi + rdx]
sub rbx, rdi
add rsp, 0x10
pop rbp
nop
ret
mov rax, rdi
mov rcx, rbx
call fcn.00467760
mov rcx, rbx
call fcn.00467760
mov rax, rdi
mov rcx, rbx
call fcn.00467760
nop

Function at 0x41c780
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41c7f8
push rbp
mov rbp, rsp
sub rsp, 0x18
mov rdx, rax
xor eax, eax
mov esi, 1
lock cmpxchg dword [rdx], esi
sete sil
test sil, sil
je 0x41c7e6
cmp byte [rdx + 0x20], bl
je 0x41c7d5
mov qword [rsp + 0x10], rdx
mov byte [rsp + 0x30], bl
mov rax, rdx
mov rbx, rcx
call fcn.0041c960
movzx ecx, byte [rsp + 0x30]
mov rdx, qword [rsp + 0x10]
mov byte [rdx + 0x20], cl
mov byte [rdx + 0x21], 1
add rsp, 0x18
pop rbp
ret
lea rax, [0x007199d6]
mov ebx, 0x2d
call fcn.00437620
lea rax, [0x0071a5a5]
mov ebx, 0x2f
call fcn.00437620
nop
mov qword [rsp + 8], rax
mov byte [rsp + 0x10], bl
mov qword [rsp + 0x18], rcx
call fcn.004654a0
mov rax, qword [rsp + 8]
movzx ebx, byte [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0041c780
Function at 0x41c820
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41c88c
push rbp
mov rbp, rsp
sub rsp, 0x18
cmp byte [rax + 0x21], 0
je 0x41c87a
mov rdx, qword [rax + 0x40]
cmp rdx, rbx
jg 0x41c866
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rax
mov rcx, rbx
sub rcx, rdx
movsxd rdx, dword [rax + 0x4c]
imul rcx, rdx
xor ebx, ebx
call fcn.0041cb60
mov rax, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x30]
nop
xchg qword [rax + 0x40], rbx
mov byte [rax + 0x21], 0
call fcn.0041cc00
add rsp, 0x18
pop rbp
ret
lea rax, [0x0071a5d4]
mov ebx, 0x2f
call fcn.00437620
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004654a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0041c820

Function at 0x41cde0
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41cf2b
push rbp
mov rbp, rsp
sub rsp, 0x18
jmp 0x41cdf7
mov rax, rdx
mov rdx, qword [rax]
mov rsi, rdx
shr rdx, 0x3d
cmp bl, dl
jne 0x41cec7
mov rdx, rax
mov rax, rsi
xor edi, edi
lock cmpxchg qword [rdx], rdi
sete r8b
test r8b, r8b
je 0x41cdf4
movabs rdx, 0xe000000000000000
and rdx, rcx
movabs rdi, 0x1fffffffffffffff
and rdi, rsi
or rdx, rdi
mov rsi, rcx
sub rcx, rdx
cmp rsi, rdx
mov edx, 0
cmovl rcx, rdx
test rcx, rcx
je 0x41ceb0
cmp bl, 2
ja 0x41ce73
cmp bl, 1
jne 0x41ce6c
nop
lea rax, [0x009d9938]
lock xadd qword [rax], rcx
jmp 0x41ceaa
cmp bl, 2
je 0x41ce78
jmp 0x41ceb6
cmp bl, 3
jne 0x41ce87
nop
lea rax, [0x009d9928]
lock xadd qword [rax], rcx
jmp 0x41ceaa
cmp bl, 4
jne 0x41ceb6
nop
nop
lea rax, [0x009d9938]
mov rdx, rcx
lock xadd qword [rax], rcx
nop
lea rax, [0x00986110]
lock xadd qword [rax], rdx
add rsp, 0x18
pop rbp
ret
add rsp, 0x18
pop rbp
ret
lea rax, [0x0071b80f]
mov ebx, 0x33
call fcn.00437620
mov byte [rsp + 0x30], bl
mov qword [rsp + 0x10], rdx
call fcn.00438fc0
lea rax, [0x00709561]
mov ebx, 0xe
call fcn.00439840
movzx eax, byte [rsp + 0x30]
movzx eax, al
call fcn.00439580
lea rax, [0x00704ceb]
mov ebx, 5
nop
call fcn.00439840
mov rax, qword [rsp + 0x10]
call fcn.00439580
call fcn.00439200
call fcn.00439020
lea rax, [0x0071d43e]
mov ebx, 0x3e
call fcn.00437620
nop
mov qword [rsp + 8], rax
mov byte [rsp + 0x10], bl
mov qword [rsp + 0x18], rcx
call fcn.004654a0
mov rax, qword [rsp + 8]
movzx ebx, byte [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0041cde0
Function at 0x4204c0
Capabilities:
Hash data using murmur3

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
cmp byte [0x009d90f8], 0
jne 0x4205a7
sub rbx, qword [rax + 0x18]
mov rdx, qword [rax + 0x50]
test byte [rdx], al
mov esi, dword [rax + 0x64]
imul rbx, rsi
mov rsi, rbx
shr rbx, 0x20
shr rsi, 0x23
and ebx, 7
mov rdi, rcx
mov rcx, rbx
mov r8d, 1
shl r8d, cl
add rdx, rsi
nop
nop
nop
nop
lock or byte [rdx], r8b
mov rcx, qword [rax + 0x18]
movabs rdx, 0x800000000000
lea rax, [rdx + rcx]
mov rdx, rax
shr rdx, 0x2a
nop
nop
nop
cmp rdx, 0x40
jae 0x42059a
lea rbx, [0x009ab4d8]
mov rdx, qword [rbx + rdx*8]
test byte [rdx], al
mov rbx, rcx
shr rbx, 0x10
and ebx, 0x3f
shr rcx, 0xd
and ecx, 7
mov esi, 1
shl esi, cl
shr rax, 0x16
and eax, 0xfffff
mov rax, qword [rdx + rax*8]
test byte [rax], al
movzx edx, byte [rax + rbx + 0x11440]
lea rax, [rax + rbx]
lea rax, [rax + 0x11440]
test sil, dl
jne 0x420580
lock or byte [rax], sil
mov rax, qword [r14 + 0x30]
mov rax, qword [rax + 0xa0]
test byte [rax], al
add qword [rax + 0x1250], rdi
add rsp, 0x10
pop rbp
ret
mov rax, rdx
mov ecx, 0x40
call fcn.00467780
lea rax, [0x00719559]
mov ebx, 0x2c
call fcn.00437620
nop
int3
Function at 0x421180
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4213f6
push rbp
mov rbp, rsp
sub rsp, 0x28
cmp dword [0x009d9124], 0
je 0x4213e4
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
test rcx, rcx
jne 0x4211d4
nop
call fcn.00469020
xorps xmm15, xmm15
mov r14, qword [0x009d9398]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rcx, qword [rsp]
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov qword [rsp + 0x10], rcx
mov rdx, qword [0x009d9940]
mov rsi, rcx
sub rcx, rdx
cmp rcx, 0x989680
jle 0x42120d
lea rax, [0x009d9900]
mov rbx, rsi
call fcn.0041c8c0
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x10]
test rbx, rbx
je 0x42123a
mov rdx, qword [rbx + 0x1240]
test rdx, rdx
je 0x42123a
cmp qword [rdx + 0x10], 0
jne 0x421233
mov rdx, qword [rbx + 0x1248]
cmp qword [rdx + 0x10], 0
je 0x42123a
mov ecx, 1
jmp 0x421264
mov rdx, qword [0x00985480]
test rdx, rdx
jne 0x42125f
mov edx, dword [0x00985548]
cmp dword [0x0098554c], edx
jbe 0x42125b
mov ecx, 1
jmp 0x421264
xor ecx, ecx
jmp 0x421264
mov ecx, 1
test cl, cl
je 0x42126b
nop
jmp 0x421279
xor eax, eax
mov rbx, rsi
add rsp, 0x28
pop rbp
ret
mov rax, rcx
mov rdx, qword [0x009d92d8]
test rdx, rdx
je 0x4212b2
mov rdi, rdx
sar rdx, 0x13
shl rdx, 3
nop
nop
mov r8, qword [rdx]
mov rcx, rax
mov rax, rdi
lea r9, [0x009d92d8]
lock cmpxchg qword [r9], r8
sete dil
test dil, dil
je 0x421276
jmp 0x4212c0
mov rcx, rax
lea r9, [0x009d92d8]
xor edx, edx
nop
test rdx, rdx
je 0x4212c9
test byte [rcx], al
jmp 0x4212d4
xor eax, eax
mov rbx, rsi
add rsp, 0x28
pop rbp
ret
nop
mov rax, qword [rcx + 0xe8]
nop dword [rax]
test rax, rax
jle 0x42130d
mov qword [rsp + 0x18], rax
lea rdi, [rax - 1]
lock cmpxchg qword [rcx + 0xe8], rdi
sete dil
nop dword [rax + rax]
test dil, dil
je 0x4212d4
mov rdi, qword [rsp + 0x18]
test rdi, rdi
jg 0x42139a
movsd xmm0, qword [rcx + 0x108]
xorps xmm1, xmm1
ucomisd xmm0, xmm1
jne 0x421326
jnp 0x421382
mov rdi, qword [rcx + 0xe0]
mov r8, rsi
sub rsi, rdi
test rsi, rsi
jle 0x421373
test byte [rbx], al
mov rdi, qword [rbx + 0x1220]
xorps xmm1, xmm1
cvtsi2sd xmm1, rdi
xorps xmm2, xmm2
cvtsi2sd xmm2, rsi
divsd xmm1, xmm2
ucomisd xmm1, xmm0
jbe 0x421373
mov rax, r9
mov rbx, rdx
call fcn.0040b440
xor eax, eax
mov rbx, qword [rsp + 0x10]
add rsp, 0x28
pop rbp
ret
test byte [rbx], al
mov qword [rbx + 0x1230], 2
jmp 0x4213a7
mov rax, r9
mov rbx, rdx
call fcn.0040b440
xor eax, eax
mov rbx, qword [rsp + 0x10]
add rsp, 0x28
pop rbp
ret
test byte [rbx], al
mov qword [rbx + 0x1230], 1
mov rax, qword [rdx + 0x10]
mov qword [rsp + 0x20], rax
mov ebx, 4
mov ecx, 1
call fcn.0043bf60
cmp byte [0x0098b248], 0
je 0x4213d4
mov rax, qword [rsp + 0x20]
xor ebx, ebx
call fcn.00457d20
mov rax, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x10]
add rsp, 0x28
pop rbp
ret
lea rax, [0x0071c13d]
mov ebx, 0x36
call fcn.00437620
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.004654a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.00421180
Function at 0x4217a0
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x42190b
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rsp + 0x40], rax
call fcn.00421660
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rcx + 0x98]
cmp rax, rdx
jbe 0x421846
mov rsi, rax
sub rsi, rdx
shr rsi, 6
lea rdi, [rsi + rsi*4]
lea rdi, [rdi + rdi*8]
add rdi, rdx
imul rsi, rsi, 0x3d
add rsi, rdx
cmp rbx, rdx
cmovb rbx, rdx
cmp rbx, rdi
cmovb rbx, rdi
cmp rax, 0x400000
jbe 0x42180b
lea rdx, [rax - 0x400000]
cmp rdx, rsi
ja 0x42180e
mov rdx, rsi
nop
mov rcx, qword [rcx + 0x18]
mov rsi, rax
sub rsi, rcx
cmp rdx, rbx
cmovb rdx, rbx
cmp rax, rcx
cmovb rsi, rbx
cmp rsi, rbx
cmovb rsi, rbx
cmp rdx, rsi
cmovb rsi, rdx
cmp rax, rsi
jb 0x42184f
mov rbx, rax
mov rax, rsi
add rsp, 0x30
pop rbp
ret
mov rbx, rax
add rsp, 0x30
pop rbp
ret
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x18], rbx
call fcn.00438fc0
lea rax, [0x0070678b]
mov ebx, 8
call fcn.00439840
mov rax, qword [rsp + 0x10]
nop
call fcn.00439580
lea rax, [0x00707420]
mov ebx, 0xa
call fcn.00439840
mov rax, qword [rsp + 0x28]
nop dword [rax + rax]
call fcn.00439580
call fcn.00439200
call fcn.00439020
call fcn.00438fc0
lea rax, [0x00707c41]
mov ebx, 0xb
call fcn.00439840
mov rax, qword [rsp + 0x18]
call fcn.00439580
lea rax, [0x0070857e]
mov ebx, 0xc
nop dword [rax + rax]
call fcn.00439840
mov rax, qword [rsp + 0x20]
call fcn.00439580
call fcn.00439200
call fcn.00439020
lea rax, [0x00719a03]
mov ebx, 0x2d
call fcn.00437620
nop
mov qword [rsp + 8], rax
call fcn.004654a0
mov rax, qword [rsp + 8]
jmp fcn.004217a0

Function at 0x422240
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4222a6
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rsp + 0x30], rax
test byte [rax], al
nop
call fcn.0040b6c0
mov rcx, r14
mov rbx, qword [rsp + 0x30]
cmp qword [rbx + 8], rcx
jne 0x42228f
mov byte [rbx + 0x10], 1
nop
lea rax, [0x0073ad10]
mov ecx, 0xd
mov edi, 0x14
mov esi, 2
call fcn.0043a2c0
add rsp, 0x20
pop rbp
ret
lea rax, [0x00719f53]
mov ebx, 0x2e
nop dword [rax + rax]
call fcn.00437620
nop
mov qword [rsp + 8], rax
call fcn.004654a0
mov rax, qword [rsp + 8]
jmp fcn.00422240