joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1406e4fa0
Capabilities:
Encode data using base64

Disassembly:
js 0x14070e0e8
mov r9d, dword [rbx + rsi*8 - 0x7fffffd8]
rol ax, cl
or qword [rsp + rsi*8 - 0x7fffffd0], rax
lea rbx, [rbx + rdx + 3]
pop rcx
inc word [rsp + rdx*8 - 7]
xor r9d, ebp
shl dx, 0x6c
sub r10w, word [rsp + rdx - 0xffd]
push rsi
dec r9d
ror word [rsp + rdx - 0xff6], 0x41
rol r9d, 1
lea r9d, [rdx + r9 + 0x463541b8]
movsx edi, dx
ror r9d, 3
movsx ecx, al
not r9d
not qword [rsp + rsi*8 - 0x7fffffd0]
ror rsi, 0x20
sar rsi, cl
bswap r9d
dec rcx
xor r9d, 0x882a3c0f
push rcx
mov qword [rsp + rsi*4 + 4], rbp
lea rbp, [rcx + rsi*4 + 0x3196beae]
xor dword [rsp + rsi + 0xd], r9d
mov rbp, qword [rsp + rsi + 0xd]
movsxd r9, r9d
neg qword [rsp + rsi*2 - 5]
sar esi, cl
adc r8, r9
lea rdx, [rax*8 - 0x1f66cde5]
mov qword [rsp + rdi*8 - 0x7ff0], 0x5186e92a
dec dword [rsp + rsi*4 + 1]
pop rax
pop r10
pop r10
jno fcn.1406daf8c

Function at 0x1406e9d3f
Capabilities:
Encode data using base64

Disassembly:
lea rax, [rcx + rcx - 0x3c7e4646]
lea rsi, [rcx + rsi - 0x1816a230]
movzx ebx, cl
push rax
xor ebp, r8d
xchg word [rsp + rcx*2 - 0x302d4463], cx
lea r10, [rbx + rbx*4 + 0x7aa81ebc]
rol ebp, 1
movsx edx, cl
mov qword [rsp + rcx*2 - 0x302dfff6], 0xffffffff94070099
dec ebp
shl rbx, cl
sub word [rsp + rcx - 0x1816fffe], cx
rol ebp, 1
dec ebp
shr byte [rsp + rcx - 0x1816fff6], 0xc5
dec ecx
rol ebp, 1
mov qword [rsp + rcx*4 - 0x605bfff0], r8
neg bx
inc r10b
xor word [rsp + rcx - 0x1816fff8], dx
xor dword [rsp + rcx*4 - 0x605bfff0], ebp
ror ebx, cl
call fcn.1407be1ad
movzx r8d, bp
inc eax
dec r9
jg 0x140722ee0

Function at 0x140712be4
Capabilities:
Encode data using base64

Disassembly:
pop rcx
xor r10d, ebp
movsx ecx, dx
lea rsi, [rcx*4 - 0x4dc06ae0]
lea r10d, [r10 + rcx - 0x2206de6b]
dec rcx
ror r10d, 1
and rdx, rdx
neg r10d
lea r10d, [r10 + rsi*4 + 0x7ec5fb63]
bswap r10d
add di, di
movsx eax, cx
ja 0x14073fc5a
mov eax, dword [r9 + rcx - 0x87fbbef]
xor r10d, 0x24052aa0
push rbp
sal sil, 0x83
xor dword [rsp + rcx - 0x67d5], r10d
pop rbp
neg sil
shl rdx, 0xb0
lea rdi, [rdx + rcx*4 + 0x698d0a07]
movsxd r10, r10d
je 0x14081517c
lea rsi, [rcx*8 - 0x237da3c5]
not esi
add r8, r10
jmp fcn.1407fb11a
sets byte [rsp + rcx - 0x87fbbef]
jp 0x140730286

Function at 0x14071703d
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
inc ecx
shr bpl, 0xa2
not ecx
jp 0x1407720b4
mov edi, 0x3f113a83
movsx eax, dil
mov r10, qword [rsi + rdi*2 - 0x7e227506]
movsx r9d, dil
rol al, 0xc6
call fcn.14073214a

Function at 0x14071e7d2
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
sub esi, 0x69bac983
neg esi
movzx eax, di
mov ecx, eax
lea esi, [rsi + rdi + 0x30589407]
xadd word [rsp + rax - 0x1c01], cx
mov qword [rsp + rax*2 - 0x382e], 0x4131531a
mov qword [rsp + rax - 0x1c07], r10
xor dword [rsp + rax*2 - 0x381e], esi
movsx ebp, byte [rsp + rcx*2 - 0x1fffc]
mov r10, qword [rsp + rax*4 - 0x704c]
movsxd rsi, esi
rol bp, 0x2b
add rbx, rsi
movzx r9d, bpl
neg r9
mov eax, dword [r8 + rax*8 - 0xe0b8]
mov edx, dword [r8 + rcx - 0xfffb]
pop r9
mov qword [rsp + rcx*8 - 0x7fff0], rbp
movsx esi, r9w
lea r8, [rcx + r8 - 0xfffb]
jb 0x140790ddd
Function at 0x1407232c3
Capabilities:
Hash data using murmur3

Disassembly:
sal rdx, cl
lea rsi, [rdi + rsi + 0x197455b]
setp al
call fcn.1406ee741
xor eax, ebx
call fcn.1407e6feb
mov ecx, dword [rdi]
push 0x61a34e3f
inc word [rsp + 3]
add rdi, 4
mov r11d, 0x9a9f529
movzx edx, r11b
xor ecx, r10d
neg ecx
jmp 0x14073ff6f
movsx esi, r11b
dec ecx
push rsi
xchg qword [rsp + r11*8 - 0x4d4fa941], rdx
sub word [rsp + r11 - 0x9a9f51f], r11w
rol ecx, 2
movzx r9d, byte [rsp + r11 - 0x9a9f51f]
ror r11d, 0x31
dec r11b
lea ecx, [r11 + rcx - 0x4700574b]
push r9
jne 0x140730893

Function at 0x14072e8d1
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
movsxd rcx, ecx
add rdi, rcx
mov rax, qword [rsi + rdx - 0x1e259003]
rol r9w, 0x6f
movzx ecx, bp
call fcn.14078a35b
push 0xffffffffce290a25
call fcn.1407a645e

Function at 0x140739e46
Capabilities:
Encode data using base64

Disassembly:
shl dx, 0xab
lea rax, [rcx + rdx*4 + 0x595843c]
movzx ecx, word [r9 + rdx*2 - 0x5869b000]
mov qword [rsp + rdx*2 - 0x5869b000], rax
ja 0x1407c0301
ror ebp, 2
xor ebp, 0x383bf01e
push r9
call fcn.1407a05d0

Function at 0x14074f66c
Capabilities:
Hash data using murmur3

Disassembly:
movsx eax, bpl
mov ecx, dword [rdx + r10*2 - 0x112]
movzx edx, byte [rsp + r10 - 0x78]
call fcn.140815d6f
lea rsi, [rsi + rcx*4 - 0x32356e54]
push rdx
popfq
movzx r10d, r9w
ror cl, 2
mov edx, r9d
mov eax, dword [rcx + rbp - 0xc8d5be5]
and edx, edx
lea rbp, [rbp + rcx*2 - 0x191ab7c6]
mov r8d, r10d
jge 0x1407232d6

Function at 0x140757e17
Capabilities:
Manually build aes constants

Disassembly:
xor bx, cx
mov ebp, dword [rcx + rdi - 0x2e360000]
mov ecx, dword [rdi + rcx - 0x2e35fffc]
call fcn.14073e226
bswap r10d
lea rcx, [r8*8 - 0x54f13479]
lea r10d, [r10 + rcx - 0x78278d31]
call fcn.1407f51b5
Function at 0x14077438a
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
movzx r8d, r9b
lea rsi, [rsi + rcx + 0x261514e]
sar r8w, 0xa5
xor edx, r10d
inc r8d
lea rax, [r9*8 - 0x6c4b69eb]
call fcn.1407b1b0d
mov edi, 0xb50d2037
lea rsi, [rdi + rdi - 0x385397fb]
movzx edx, dil
lea r11, [rdx + r11 - 0x3b]
lea r9, [rdx + rsi*2 + 0x7c25d4bb]
mov eax, edi
mov esi, dword [r11 + rdx - 0x37]
lea rcx, [rax + rdi*8 - 0x45d48ced]
or edi, 0x178ae8a5
xor esi, r10d
mov ebp, edx
bswap esi
dec esi
sar ax, 0x8b
sal edi, 0xdb
jne 0x140848ad1
jmp 0x1406dccb1
mov qword [rcx + r11 + 0x2615149], r8
pop rdx
rol word [rsp + rcx*4 + 0x985452e], 0x2d
mov edx, dword [rsi + rcx*2 + 0x4c2a293]
dec byte [rsp + rcx + 0x2615155]
jne 0x1406992ea
mov ecx, dword [rbx]
add rbx, 4
xor ecx, ebp
mov esi, 0x2e28581b
inc ecx
rol sil, 0x67
push rsi
lea r10, [rsi + rsi*2 + 0x1709e920]
ror ecx, 3
inc ecx
mov word [rsp + rsi - 0x2e28588d], r10w
mov byte [rsp + rsi*2 - 0x5c50b113], sil
neg ecx
movsx eax, r10w
call fcn.140870aab
mov r8d, 0xf0382d01
movsx ecx, r8b
lea rbx, [r8 + r8*8 + 0x338b0abb]
mov rbx, qword [rcx + rsi - 1]
lea rax, [r8 + 0x1583e7a8]
jmp 0x1406e5487
xor r10b, al
rol r9, cl
mov qword [rsp + rcx*4 + 0x9854524], rcx
mov qword [rsp + rcx + 0x2615151], 0xffffffffff2ff126
lea rax, [rsp + rax + 0x10]
sbb rdi, qword [rsp + rcx + 0x2615151]
mov r8, qword [rax + rcx + 0x2615149]
push rdi
seto r9b
jne 0x1406f9696

Function at 0x1407772bb
Capabilities:
Encode data using base64

Disassembly:
lea r11, [r11 + r9*2 - 0xe]
neg r9b
sub r9b, byte [rsp + r9 - 0xed]
mov ebx, dword [r11 + r9*2 - 0x1f6]
lea r9, [rdx + rdx*2 - 0x18de9d00]
xor ebx, esi
xor ebx, 0x82925c0c
sub word [rsp + 0x15], 0xdb16
not dword [rsp + 0xb]
not ebx
lea r8, [rcx + rcx*8 + 0x7fb2d601]
sar qword [rsp + 0xd], cl
sal byte [rsp + 0x13], cl
neg ebx
lea ebx, [rcx + rbx + 0x20011af9]
mov qword [rsp + 0x10], rsi
not qword [rsp + 8]
xor dword [rsp + 0x10], ebx
pop rbp
mov rsi, qword [rsp + 8]
add ecx, 0xba7ba2
call fcn.14074c834

Function at 0x14079356c
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
mov qword [rsp + rcx*8 + 0x62dd328], r10
mov qword [rsp + rcx + 0xc5ba64], rax
sar sil, 0x41
rol ebx, cl
xor dword [rsp + r11 - 0x4f0fa200], edx
mov r10d, 0x1c1594af
mov r10, qword [rsp + r11 - 0x4f0fa200]
call fcn.140849e52

Function at 0x1407acf52
Capabilities:
Hash data using murmur3

Disassembly:
and rcx, 0xffffffffc9a8f918
add r8d, ecx
mov qword [rsp + r8 - 0x4919751c], r11
ret 8
xor dword [rsp + rcx - 0xfffff38], r10d
lea rcx, [rbp*4 - 0x4bd1db5b]
sar cl, 0xe4
mov rdi, qword [rsp + rbx + 0x10]
mov qword [rsp + rbx*4], rbx
ror ebp, 0x2e
movsxd r10, r10d
inc rcx
inc word [rsp + rbp*2 - 0x5bd9a2cf]
call fcn.1407ba412
ror edi, 3
dec edi
rol r9d, 0xa9
movzx ecx, r9b
not edi
jb 0x140751ab5
lea edi, [rsi + rdi - 0x33e90e2e]
add cx, cx
xor edi, 0x159383bc
or cx, r9w
push r10
movzx eax, r9w
xor dword [rsp + r9*4 - 0x17000], edi
neg sil
pop r10
sal r9w, 0x23
movsxd rdi, edi
sub r9, r9
inc r9d
or ecx, 0x963b1f3b
adc rbx, rdi
inc ax
mov r8d, dword [r9 + r8 - 1]
mov edi, r9d
mov ebp, r9d
jns fcn.1406d950e
Function at 0x1407bea01
Capabilities:
Encode data using base64

Disassembly:
mov edx, 0x7f2c6c11
lea r11, [r11 + rdx - 0x7f2c6c15]
shr dx, 0xc8
call fcn.14075f181
mov r8d, 0x87054d31
lea r10, [r8 - 0x2d6f61eb]
dec r10b
mov ax, word [r10 + rdi - 0x5995eb45]
js 0x1407be629
lea rcx, [r10 + r8 - 0x1bef5679]
mov r10w, word [rdi + r10 - 0x5995eb43]
add rdi, 2
and ax, r10w
mov ebp, ecx
push r8
not ax
add dword [rsp + 4], ecx
mov byte [rsp + 2], __WSAFDIsSet
rol dword [rsp + 4], 0x72
mov word [rdi], ax
sub rbx, 4
mov edx, dword [rbx]
call fcn.140740c9f
and bx, 0x1c0d
lea r8d, [rbx + r8 - 0xc8e18ec]
push r9
neg r8d
inc dword [rsp + rbx - 0x73981402]
sub dword [rsp + rbx - 0x73981403], ebx
sub r8d, 0x6903cf01
movzx edx, r9b
rol r9b, 0x81
inc dx
mov qword [rsp + rdx - 0x30], r11
call fcn.140855552
adc eax, 0xa38d1da3
inc r9d
mov edx, r10d
shl qword [rsp + rbp - 0x2a278c12], 0xd4
mov qword [rsp + rbp - 0x2a278c12], r8
jne 0x14075adc0
not cl
lea r11, [r11 + rdx - 0x4a34]
mov r8d, dword [r11 + rdx - 0x4a30]
xor r8d, esi
neg r8d
inc r8d
bswap r8d
dec r8d
and ax, r9w
xor ax, ax
push rsi
xor dword [rsp + rdx*2 - 0x9460], r8d
mov ebx, eax
movzx esi, cl
pop rsi
movsxd r8, r8d
add r10, r8
add bx, dx
bswap rdx
inc r9d
jg fcn.140868343
jmp 0x1407abcd1
Function at 0x1407cc601
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
lea r11, [rsi + r11 - 0x24]
inc esi
ror r9w, 0x27
mov qword [rsp + rsi - 0x2b], r9
mov word [r11 + rsi*4 - 0xac], ax
mov eax, dword [rbx + rsi*2 - 0x56]
lea rbx, [rbx + rsi*8 - 0x154]
xor eax, ebp
call fcn.14084d629
mov ecx, 0xccb529b4
mov ebp, dword [rsi]
call fcn.140708949
jmp 0x140816997
mov cx, word [rsi]
jmp 0x140756eab

Function at 0x1407ccea2
Capabilities:
Hash data using murmur3

Disassembly:
xor edi, ebp
bswap edi
movzx r10d, si
xadd r10, rdx
mov qword [rsp + rax - 0x4fc7], rsi
adc edi, 0xec21c28f
mov r9d, edx
jmp 0x1407ee86d
xor edi, 0x2a3f2609
ror r10, cl
add cx, cx
not edi
lea rdx, [rdx*2 - 0xe6e35fb]
neg word [rsp + rax*4 - 0x13f1a]
lea edi, [rdi + rdx*8 - 0x7a3ece3d]
add r10d, 0x9d8b27a5
jno 0x140820762
bswap edi
neg esi
jb 0x1406cc8c7

Function at 0x1407d4a16
Capabilities:
Hash data using murmur3

Disassembly:
bswap eax
ror r8d, 0x92
mov qword [rsp + rdx*2 - 0x51107c66], rbp
inc eax
jmp 0x14078bee4

Function at 0x1407df28e
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
mov qword [rsp], r10
neg edi
not edi
rol ecx, cl
sbb esi, esi
xor edi, 0xd9939838
sub edi, 0xd81ace89
call fcn.1407f1891

Function at 0x1407f0530
Capabilities:
Hash data using murmur3

Disassembly:
or cx, 0x3e26
mov cl, byte [r11 + rcx*4 - 0x2d11f894]
mov qword [rsp + rdi + 0x4de45132], r9
lea r11, [rdi + r11 + 0x4de45134]
lea rdx, [r9 + r10*4 + 0x35881611]
rol word [rsp + rdi + 0x4de45138], 0xe1
pop rsi
shl rax, cl
call fcn.14069b432
mov r8, qword [rsp + r10 + 8]
jbe 0x1407eb329
jmp 0x140707b5e

Function at 0x1407f6375
Capabilities:
Hash data using murmur3

Disassembly:
pop rdx
pop r9
pop rsi
pop rcx
pop rdx
pop rcx
pop rsi
jns fcn.1407148ae

Function at 0x1407f9994
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
call fcn.1406d3c8a
xor ecx, 0x419635ab
jmp 0x14086839b
lea rax, [rsi - 0x46553de9]
ror ecx, 3
dec ebx
movzx r9d, bl
not ecx
call fcn.1407f1f9c

Function at 0x1407fe667
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
or rcx, rbx
setns r10b
mov rbp, qword [rsi + r8 - 0x75113621]
call fcn.1407670fb
call fcn.1407f3a4e
mov r8d, ecx
mov eax, dword [r8 + r9 - 0x75113621]
xor eax, edi
sub eax, 0x6685a621
movsx ebp, cx
mov r10d, 0x699cda13
push r10
rol eax, 3
or word [rsp + r8 - 0x7511361b], bp
neg eax
pop r10
shl ebp, 0xae
xadd dx, cx
dec eax
rol eax, 1
or r10w, r10w
lea rcx, [r10*8 - 0x644336d]
movsx ebx, bp
push rdi
dec dx
adc dl, 0x18
jl 0x14081fdd0
xor ecx, r10d
inc r11
rol ecx, 1
xadd rax, rsi
ror rax, 0x95
push rdx
xor ecx, 0x6d3af437
shr word [rsp + r11 - 0x5b38701b], 0x61
or qword [rsp + r11 - 0x5b38701b], rax
not ecx
jnp 0x1407a0cd9
xor dword [rsp + r8 - 0x75113621], eax
lea rdx, [rdx + rbx - 0x64c36567]
sal bx, 0xce
sar ebp, cl
pop rdi
movsxd rax, eax
not cl
xor ebx, ebp
adc r11, rax
jmp 0x14075404a
Function at 0x140800d6f
Capabilities:
Hash data using murmur3

Disassembly:
xchg r8b, dl
xchg qword [rsp + rdx - 0x1f0fa595], rax
neg r10d
inc ebp
xor r10d, 0x2eb52e87
call fcn.14073c6a4
dec r11d
ror qword [rsp], 0x81
neg word [rsp + 4]
neg r11d
mov qword [rsp], r10
sal r9d, 0x1b
xor dword [rsp], r11d
movsx ecx, r9w
sal r9b, 0xe2
or dl, al
pop r10
call fcn.1408688c0
mov r9d, 0x7e3c1a9b
mov ecx, r9d
mov r9d, dword [r9 + r10 - 0x7e3c1a9b]
movsx edx, cl
lea r10, [rcx + r10 - 0x7e3c1a97]
movsx ebp, dl
xor r9d, r11d
xadd ebp, edx
movsx r8d, dl
ror r9d, 3
add r8w, dx
inc r8d
call fcn.140867a88

Function at 0x140829231
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsi + r10*2 - 0xa2], rbp
xchg r8w, dx
lea r9, [r9 + r10 - 0x55]
mov ebp, dword [r9 + r10*2 - 0xa2]
mov qword [rsp + r10*8 - 0x280], 0x2f1d5cac
lea rax, [rbx + rdx*2 - 0x4769dae8]
xchg byte [rsp + r10*8 - 0x27e], r8b
xor ebp, edi
dec r8d
sar dl, 0x27
mov qword [rsp + r8 - 0x541c], rax
lea ebp, [rbp + r8*2 - 0x66864e59]
rol ebp, 3
call fcn.1406bbaf8

Function at 0x140829286
Capabilities:
Encode data using base64

Disassembly:
lea rsi, [rsi + rbx*2 - 0x2567b56]
mov qword [rsp + rbx*2 - 0x2567b4e], rbx
mov qword [rsi + rbx*4 - 0x4acf69c], r8
pop rdx
pop r8
jp fcn.140781f1a

Function at 0x14084d134
Capabilities:
Manually build aes constants

Disassembly:
mov rcx, qword [rsp + rdx - 0xae7f]
shl r13b, 0x21
call fcn.14077b2f3
mov edx, dword [rsp + 0xa]
movzx r13d, dx
mov r10, qword [rsp + rdx*4 - 0x2bac8]
mov qword [rsp + rdx - 0xae96], r13
inc rdx
mov r9, qword [rsp + rdx - 0xae87]
mov qword [rsp + rdx*2 - 0x15d46], rdx
mov qword [rsp + rdx - 0xaebf], 0x45855cac
jge 0x14074e531

Function at 0x14085ead7
Capabilities:
Encode data using base64

Disassembly:
pop r8
rol r10d, 2
pop r8
shr qword [rsp + rcx - 0x296656a9], 0xde
not r10d
movzx eax, byte [rsp + rcx - 0x296656a5]
xor r10d, 0x297e09b
and byte [rsp + rcx - 0x296656a4], cl
sbb al, byte [rsp + r9 - 0x518346a6]
setae cl
mov qword [rsp + rax*2 - 0x15c], rbx
xor dword [rsp + rcx*2 - 0x52ccac00], r10d
dec cl
movsx ebx, cl
pop rbx
jle 0x140733c45
Function at 0x413fe0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41416b
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.004315a0
xorps xmm15, xmm15
mov r14, qword [0x005bbd28]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x414045
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x414054
add rsp, 0x48
pop rbp
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x414073
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x414083
cmp rbx, 0x1000
jae 0x41404b
jmp 0x4140ed
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x414095
xor edx, edx
jmp 0x4140e4
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.004315a0
xorps xmm15, xmm15
mov r14, qword [0x005bbd28]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x414079
jmp 0x414068
call fcn.004608e0
xorps xmm15, xmm15
mov r14, qword [0x005bbd28]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.00435900
lea rax, [0x0049b9b6]
mov ebx, 0x18
nop dword [rax]
call fcn.00436180
mov rax, qword [rsp + 0x38]
call fcn.00435ec0
lea rax, [0x0049be6c]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.00436180
mov rax, qword [rsp + 0x30]
call fcn.00435ec0
call fcn.00435b40
call fcn.00435960
lea rax, [0x0049defc]
mov ebx, 0x21
call fcn.00433f60
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045d240
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00413fe0
Function at 0x4141a0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4143c6
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.00431620
xorps xmm15, xmm15
mov r14, qword [0x005bbd28]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x414213
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x414222
add rsp, 0x50
pop rbp
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x414245
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x414255
cmp rbx, 0x1000
jae 0x414219
nop
jmp 0x4142d8
add rsp, 0x50
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop word [rax + rax]
cmp rbx, 0x1000
jae 0x41426d
xor esi, esi
jmp 0x4142ca
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.00431620
xorps xmm15, xmm15
mov r14, qword [0x005bbd28]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x41424b
jmp 0x414236
call fcn.004608e0
xorps xmm15, xmm15
mov r14, qword [0x005bbd28]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x414360
nop dword [rax + rax]
call fcn.00435900
lea rax, [0x0049be85]
mov ebx, 0x19
call fcn.00436180
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
call fcn.00435ec0
lea rax, [0x0049be6c]
mov ebx, 0x19
call fcn.00436180
mov eax, dword [rsp + 0x34]
call fcn.00435ec0
nop
call fcn.00435b40
call fcn.00435960
lea rax, [0x00498964]
mov ebx, 0xd
call fcn.00433f60
nop dword [rax + rax]
cmp eax, 0x5af
je 0x414300
call fcn.00435900
lea rax, [0x0049be85]
mov ebx, 0x19
call fcn.00436180
mov rax, qword [rsp + 0x38]
call fcn.00435ec0
lea rax, [0x0049be6c]
mov ebx, 0x19
call fcn.00436180
mov eax, dword [rsp + 0x34]
nop dword [rax]
call fcn.00435ec0
call fcn.00435b40
call fcn.00435960
lea rax, [0x0049d7fb]
mov ebx, 0x1f
nop dword [rax + rax]
call fcn.00433f60
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045d240
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.004141a0
Function at 0x41d8a0
Capabilities:
Hash data using murmur3

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
cmp byte [0x005bbaf1], 0
jne 0x41d987
sub rbx, qword [rax + 0x18]
mov rdx, qword [rax + 0x50]
test byte [rdx], al
mov esi, dword [rax + 0x64]
imul rbx, rsi
mov rsi, rbx
shr rbx, 0x20
shr rsi, 0x23
and ebx, 7
mov rdi, rcx
mov rcx, rbx
mov r8d, 1
shl r8d, cl
add rdx, rsi
nop
nop
nop
nop
lock or byte [rdx], r8b
mov rcx, qword [rax + 0x18]
movabs rdx, 0x800000000000
lea rax, [rdx + rcx]
mov rdx, rax
shr rdx, 0x2a
nop
nop
nop
cmp rdx, 0x40
jae 0x41d97a
lea rbx, [0x0058ded8]
mov rdx, qword [rbx + rdx*8]
test byte [rdx], al
mov rbx, rcx
shr rbx, 0x10
and ebx, 0x3f
shr rcx, 0xd
and ecx, 7
mov esi, 1
shl esi, cl
shr rax, 0x16
and eax, 0xfffff
mov rax, qword [rdx + rax*8]
test byte [rax], al
movzx edx, byte [rax + rbx + 0x11440]
lea rax, [rax + rbx]
lea rax, [rax + 0x11440]
test sil, dl
jne 0x41d960
lock or byte [rax], sil
mov rax, qword [r14 + 0x30]
mov rax, qword [rax + 0xa0]
test byte [rax], al
add qword [rax + 0x1250], rdi
add rsp, 0x10
pop rbp
ret
mov rax, rdx
mov ecx, 0x40
call fcn.0045f4c0
lea rax, [0x0049f82e]
mov ebx, 0x2c
call fcn.00433f60
nop
int3

Function at 0x41fc60
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41fd66
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x70], rcx
mov byte [rsp + 0x17], dil
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x18], 0
jmp 0x41fca3
mov rax, qword [rsp + 0x60]
mov rcx, rdx
mov rbx, qword [rsp + 0x68]
movzx edi, byte [rsp + 0x17]
cmp qword [rsp + 0x18], rbx
jae 0x41fd5b
test byte [rax], al
lea rcx, [rax + 0x100b8]
mov ebx, edi
mov rax, rcx
nop dword [rax]
call fcn.00420a40
test rax, rax
je 0x41fd5b
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x30], xmm15
movups xmmword [rsp + 0x40], xmm15
lea rcx, [0x0041fda0]
mov qword [rsp + 0x20], rcx
lea rdx, [rsp + 0x18]
mov qword [rsp + 0x28], rdx
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x48], rax
lea rbx, [rsp + 0x20]
mov qword [rsp], rbx
nop dword [rax]
call fcn.0045d100
xorps xmm15, xmm15
mov r14, qword [0x005bbd28]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x70]
nop dword [rax]
test rdx, rdx
jne 0x41fd49
xor eax, eax
jmp 0x41fd53
mov rax, qword [rdx]
call rax
mov rdx, qword [rsp + 0x70]
test al, al
je 0x41fc91
mov rax, qword [rsp + 0x18]
add rsp, 0x50
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov byte [rsp + 0x20], dil
call fcn.0045d240
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movzx edi, byte [rsp + 0x20]
jmp fcn.0041fc60