joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000eda0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
xor ebx, ebx
mov rsi, rdx
mov dword [rsp + 0x48], ebx
test rdx, rdx
je 0x14000ee31
cmp byte [rdx], bl
je 0x14000ee31
mov rdx, rcx
mov rcx, qword [0x1400184f0]
call fcn.140011144
mov r11, rax
test rax, rax
je 0x14000ee2d
or rcx, 0xffffffffffffffff
mov rdi, rsi
mov rdx, rsi
cmp qword [rax + 8], rbx
je 0x14000ee0f
xor eax, eax
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
mov rcx, r11
call fcn.14000efd0
mov ebx, eax
cdqe
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
xor eax, eax
lea r9, [rsp + 0x48]
mov qword [rsp + 0x20], rbx
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
mov rcx, qword [r11]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ebx, dword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
movsxd rax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x14000ee50
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
xor ebx, ebx
mov edi, r8d
mov rsi, rdx
mov dword [rsp + 0x48], ebx
test rdx, rdx
je 0x14000eec8
test r8d, r8d
je 0x14000eec8
mov rdx, rcx
mov rcx, qword [0x1400184f0]
call fcn.140011144
test rax, rax
je 0x14000eec4
mov r8d, edi
mov rdx, rsi
cmp qword [rax + 8], rbx
je 0x14000eeb1
mov rcx, rax
call fcn.14000efd0
mov ebx, eax
cdqe
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov rcx, qword [rax]
lea r9, [rsp + 0x48]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ebx, dword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
movsxd rax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x14000eee0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rbp
push rsi
sub rsp, 0x30
mov rsi, rdx
mov rdx, rcx
mov rcx, qword [0x1400184f0]
xor ebp, ebp
mov dword [rsp + 0x60], ebp
mov dword [rsp + 0x68], ebp
call fcn.140011144
mov rbx, rax
test rax, rax
je 0x14000efc0
test rsi, rsi
je 0x14000ef6b
cmp byte [rsi], bpl
je 0x14000ef6b
or rcx, 0xffffffffffffffff
mov qword [rsp + 0x50], rdi
mov rdx, rsi
mov rdi, rsi
cmp qword [rax + 8], rbp
je 0x14000ef48
xor eax, eax
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
mov rcx, rbx
call fcn.14000efd0
mov dword [rsp + 0x60], eax
jmp 0x14000ef66
xor eax, eax
lea r9, [rsp + 0x60]
mov qword [rsp + 0x20], rbp
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rdi, qword [rsp + 0x50]
mov r8d, 2
lea rdx, [0x140015aa0]
cmp qword [rbx + 8], rbp
je 0x14000ef99
mov rcx, rbx
call fcn.14000efd0
mov rdx, rax
mov eax, dword [rsp + 0x60]
add eax, edx
cdqe
add rsp, 0x30
pop rsi
pop rbp
pop rbx
ret
mov rcx, qword [rbx]
lea r9, [rsp + 0x68]
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [rsp + 0x60]
mov edx, dword [rsp + 0x68]
add eax, edx
cdqe
add rsp, 0x30
pop rsi
pop rbp
pop rbx
ret
movsxd rax, dword [rsp + 0x60]
add rsp, 0x30
pop rsi
pop rbp
pop rbx
ret
Function at 0x14000efd0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp dword [rcx + 0x1c], 1
movsxd rdi, r8d
mov rsi, rdx
mov rbx, rcx
mov dword [rsp + 0x50], 0
jne 0x14000f01a
mov edx, dword [rcx + 0x14]
mov rcx, qword [rcx]
mov r9d, 1
neg edx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [rbx + 0x10]
mov dword [rbx + 0x1c], 0
mov dword [rbx + 0x14], eax
mov ecx, dword [rbx + 0x14]
cmp ecx, edi
jle 0x14000f056
mov eax, dword [rbx + 0x10]
mov edx, edi
sub eax, ecx
movsxd rcx, eax
add rcx, qword [rbx + 8]
dec edx
je 0x14000f04f
dec edx
je 0x14000f047
cmp edx, 2
je 0x14000f041
mov rdx, rsi
jmp 0x14000f0a4
mov eax, dword [rsi]
mov dword [rcx], eax
jmp 0x14000f0ac
movzx eax, word [rsi]
mov word [rcx], ax
jmp 0x14000f0ac
movzx eax, byte [rsi]
mov byte [rcx], al
jmp 0x14000f0ac
mov rcx, rbx
call fcn.14000e650
mov r11d, dword [rbx + 0x10]
mov rdx, rsi
cmp edi, r11d
jl 0x14000f099
mov rcx, qword [rbx]
lea r9, [rsp + 0x50]
mov r8d, edi
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
movsxd rax, dword [rsp + 0x50]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
sub r11d, dword [rbx + 0x14]
movsxd rcx, r11d
add rcx, qword [rbx + 8]
mov r8, rdi
call sub.msvcrt.dll_memcpy
sub dword [rbx + 0x14], edi
mov rsi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov rax, rdi
add rsp, 0x30
pop rdi
ret
Function at 0x1400102a0
Capabilities:
Hash data with crc32
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
push rbx
push rdi
push r12
push r14
sub rsp, 0x58
or ebx, 0xffffffff
xor r12d, r12d
mov r14, r8
mov edi, 0x80000
test rcx, rcx
je 0x14001050b
mov qword [rsp + 0x30], r12
lea r8d, [r12 + 1]
xor r9d, r9d
mov edx, 0x80000000
mov dword [rsp + 0x28], pe_nt_image_headers64
mov qword [rsp + 0x40], r15
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r15, rax
cmp rax, 0xffffffffffffffff
je 0x140010506
mov rcx, qword [0x140017a28]
xor edx, edx
mov r8d, edi
mov qword [rsp + 0x48], r13
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r13, rax
test rax, rax
je 0x1400104f8
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x90], rbp
mov qword [rsp + 0x50], rsi
test rax, rax
jle 0x140010353
lea r8, [rsp + 0x8c]
xor r9d, r9d
mov edx, eax
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
lea ebp, [r14 + 0x80000]
lea rsi, [0x140015b00]
add r12d, 0x80000
sub ebp, 0x80000
cmp r14, 0xffffffffffffffff
je 0x14001037d
movsxd rax, r12d
cmp rax, r14
cmovg edi, ebp
lea r9, [rsp + 0x80]
mov r8d, edi
mov rdx, r13
mov rcx, r15
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov r10d, dword [rsp + 0x80]
mov r11, r13
mov r9d, r10d
cmp r10d, 8
jb 0x1400104ab
mov esi, r10d
lea r10, [0x140015b00]
shr rsi, 3
nop word [rax + rax]
movzx ecx, byte [r11]
mov eax, ebx
shr ebx, 8
xor rcx, rax
add r11, 8
add r9d, 0xfffffff8
movzx eax, cl
movzx ecx, byte [r11 - 7]
mov edx, dword [r10 + rax*4]
xor edx, ebx
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r11 - 6]
mov r8d, dword [r10 + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r11 - 5]
mov edx, dword [r10 + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r11 - 4]
mov r8d, dword [r10 + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r11 - 3]
mov edx, dword [r10 + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r11 - 2]
mov r8d, dword [r10 + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r11 - 1]
mov edx, dword [r10 + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
mov ebx, dword [r10 + rax*4]
xor ebx, edx
dec rsi
jne 0x1400103d0
mov r10d, dword [rsp + 0x80]
lea rsi, [0x140015b00]
test r9d, r9d
je 0x1400104cc
movzx ecx, byte [r11]
mov eax, ebx
inc r11
xor rcx, rax
shr eax, 8
movzx edx, cl
mov ebx, dword [rsi + rdx*4]
xor ebx, eax
dec r9d
jne 0x1400104b0
cmp r10d, 0x80000
je 0x140010361
mov rcx, qword [0x140017a28]
mov r8, r13
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x90]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r13, qword [rsp + 0x48]
mov r15, qword [rsp + 0x40]
not ebx
movsxd rax, ebx
add rsp, 0x58
pop r14
pop r12
pop rdi
pop rbx
ret
or r8, 0xffffffffffffffff
xor edx, edx
jmp 0x1400102a0
Function at 0x140010520
Capabilities:
Encode data using xor
Hash data with crc32
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
push rbx
push rdi
push r12
push r14
sub rsp, 0x58
or ebx, 0xffffffff
xor r12d, r12d
mov r14, r8
mov edi, 0x80000
test rcx, rcx
je 0x14001050b
mov qword [rsp + 0x30], r12
lea r8d, [r12 + 1]
xor r9d, r9d
mov edx, 0x80000000
mov dword [rsp + 0x28], pe_nt_image_headers64
mov qword [rsp + 0x40], r15
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r15, rax
cmp rax, 0xffffffffffffffff
je 0x140010506
mov rcx, qword [0x140017a28]
xor edx, edx
mov r8d, edi
mov qword [rsp + 0x48], r13
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r13, rax
test rax, rax
je 0x1400104f8
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x90], rbp
mov qword [rsp + 0x50], rsi
test rax, rax
jle 0x140010353
lea r8, [rsp + 0x8c]
xor r9d, r9d
mov edx, eax
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
lea ebp, [r14 + 0x80000]
lea rsi, [0x140015b00]
add r12d, 0x80000
sub ebp, 0x80000
cmp r14, 0xffffffffffffffff
je 0x14001037d
movsxd rax, r12d
cmp rax, r14
cmovg edi, ebp
lea r9, [rsp + 0x80]
mov r8d, edi
mov rdx, r13
mov rcx, r15
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov r10d, dword [rsp + 0x80]
mov r11, r13
mov r9d, r10d
cmp r10d, 8
jb 0x1400104ab
mov esi, r10d
lea r10, [0x140015b00]
shr rsi, 3
nop word [rax + rax]
movzx ecx, byte [r11]
mov eax, ebx
shr ebx, 8
xor rcx, rax
add r11, 8
add r9d, 0xfffffff8
movzx eax, cl
movzx ecx, byte [r11 - 7]
mov edx, dword [r10 + rax*4]
xor edx, ebx
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r11 - 6]
mov r8d, dword [r10 + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r11 - 5]
mov edx, dword [r10 + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r11 - 4]
mov r8d, dword [r10 + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r11 - 3]
mov edx, dword [r10 + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r11 - 2]
mov r8d, dword [r10 + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r11 - 1]
mov edx, dword [r10 + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
mov ebx, dword [r10 + rax*4]
xor ebx, edx
dec rsi
jne 0x1400103d0
mov r10d, dword [rsp + 0x80]
lea rsi, [0x140015b00]
test r9d, r9d
je 0x1400104cc
movzx ecx, byte [r11]
mov eax, ebx
inc r11
xor rcx, rax
shr eax, 8
movzx edx, cl
mov ebx, dword [rsi + rdx*4]
xor ebx, eax
dec r9d
jne 0x1400104b0
cmp r10d, 0x80000
je 0x140010361
mov rcx, qword [0x140017a28]
mov r8, r13
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x90]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r13, qword [rsp + 0x48]
mov r15, qword [rsp + 0x40]
not ebx
movsxd rax, ebx
add rsp, 0x58
pop r14
pop r12
pop rdi
pop rbx
ret
or r8, 0xffffffffffffffff
xor edx, edx
jmp 0x1400102a0
Function at 0x140006140
Capabilities:
Get geographical location

Disassembly:
cmp rsp, qword [r14 + 0x18]
jbe 0x140006313
sub rsp, 0x78
mov qword [rsp + 0x70], rbp
lea rbp, [rsp + 0x70]
mov rdx, qword [rax + 8]
nop dword [rax]
test rdx, rdx
je 0x1400061d1
cmp rcx, rdx
jae 0x1400061c7
sub rdx, rcx
cmp rdi, rdx
cmova rdi, rdx
movzx edx, byte [rax + 0x17]
test dl, 0x40
je 0x1400061ae
and edx, 0x1f
cmp dl, 0x11
jne 0x140006194
mov qword [rsp + 0x80], rax
xor edx, edx
jmp 0x1400062a0
cmp dl, 0x19
jne 0x14000627e
mov rdx, qword [rax + 0x38]
mov rsi, qword [rax + 0x40]
mov qword [rsp + 0x48], rsi
xor eax, eax
jmp 0x1400061eb
mov rdx, qword [rax + 0x20]
mov rax, rbx
mov rbx, rdx
call fcn.140006060
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
add rdx, 0x18
inc rax
sub rdi, r8
mov rcx, r9
mov rbx, r10
cmp rax, rsi
jge 0x140006274
mov r8, qword [rdx + 8]
cmp qword [r8], rcx
jbe 0x140006248
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x68], rdx
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x60], r8
mov rax, r8
nop
call fcn.140006140
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x38]
mov r8, qword [rsp + 0x60]
mov r8, qword [r8]
cmp rcx, r8
mov r9, rcx
cmova rcx, r8
mov r10, r8
sub r8, rcx
sub r9, rcx
add r10, rbx
cmp rdi, r8
ja 0x1400061db
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
lea rax, [0x1407d3170]
mov ebx, 0xc
call fcn.1400382c0
inc rdx
sub rdi, rsi
mov rcx, r8
mov rbx, r9
nop dword [rax + rax]
cmp qword [rax + 0x40], rdx
jbe 0x140006274
mov rsi, qword [rax + 0x30]
cmp qword [rsi], rcx
jbe 0x1400062e7
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x28], rcx
mov rax, rsi
call fcn.140006140
mov rax, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rax + 0x30]
mov rsi, qword [rsi]
cmp rcx, rsi
mov r8, rcx
cmova rcx, rsi
mov r9, rsi
sub rsi, rcx
sub r8, rcx
add r9, rbx
cmp rdi, rsi
ja 0x14000628f
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.14006a760
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.140006140
Function at 0x140015640
Capabilities:
Get geographical location

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x14001582f
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x30], rbx
call fcn.140039c00
call fcn.140039c00
lea rax, [0x1407d6ee3]
mov ebx, 0x11
call fcn.14003a500
mov rax, qword [rsp + 0x30]
call fcn.14003a360
call fcn.140039c80
mov rax, qword [rsp + 0x50]
nop dword [rax + rax]
test rax, rax
je 0x140015757
nop
nop
mov cl, byte [rax + 0x63]
mov byte [rsp + 0x27], cl
cmp cl, 1
je 0x14001580a
nop dword [rax + rax]
call fcn.140039c00
lea rax, [0x1407d8caf]
mov ebx, 0x14
call fcn.14003a500
call fcn.140039c80
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax + 0x70]
mov qword [rsp + 0x30], rcx
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x28], rax
call fcn.140039c00
lea rax, [0x1407d376b]
mov ebx, 0xd
call fcn.14003a500
mov rax, qword [rsp + 0x28]
call fcn.14003a360
lea rax, [0x1407d2b58]
mov ebx, 0xc
nop
call fcn.14003a500
mov rax, qword [rsp + 0x30]
call fcn.14003a360
lea rax, [0x1407d2b64]
mov ebx, 0xc
nop dword [rax + rax]
call fcn.14003a500
movzx eax, byte [rsp + 0x27]
movzx eax, al
call fcn.14003a200
call fcn.140039c80
call fcn.140039c00
nop dword [rax]
call fcn.140039e60
call fcn.140039c80
mov rax, qword [rsp + 0x60]
test rax, rax
jne 0x140015790
mov rcx, qword [r14 + 0x30]
mov byte [rcx + 0xf9], 2
lea rax, [0x1407f4542]
mov ebx, 0x3e
call fcn.1400382c0
call fcn.140039c00
lea rax, [0x1407e25ff]
mov ebx, 0x1e
call fcn.14003a500
mov rax, qword [rsp + 0x60]
call fcn.14003a360
lea rax, [0x1408cbbd0]
mov ebx, 1
nop dword [rax]
call fcn.14003a500
mov rax, qword [rsp + 0x38]
call fcn.14003a360
lea rax, [0x1407c4d54]
mov ebx, 2
nop dword [rax + rax]
call fcn.14003a500
call fcn.140039c80
lea rax, [0x1407ce280]
mov ebx, 6
mov rcx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x38]
call fcn.140020d80
jmp 0x140015774
call fcn.140039c00
lea rax, [0x1407dd0dc]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.14003a500
call fcn.140039c80
jmp 0x1400156db
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.140065b80
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp fcn.140015640
Function at 0x140017cc0
Capabilities:
Get geographical location

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x140017d8a
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov ecx, dword [0x140e60d18]
mov edx, dword [rax + 0x488]
cmp edx, ecx
je 0x140017d21
lea ebx, [rcx - 2]
cmp edx, ebx
jne 0x140017d2b
mov qword [rsp + 0x28], rax
call fcn.140017ac0
mov rax, qword [rsp + 0x28]
nop
call fcn.14004cd80
mov ecx, dword [0x140e60d18]
mov rdx, qword [rsp + 0x28]
xchg dword [rdx + 0x488], ecx
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
nop
ret
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov dword [rsp + 0x14], ecx
mov dword [rsp + 0x10], edx
call fcn.140039c00
lea rax, [0x1407d3cb3]
mov ebx, 0xd
call fcn.14003a500
mov eax, dword [rsp + 0x10]
mov eax, eax
call fcn.14003a200
lea rax, [0x1407e1c27]
mov ebx, 0x1e
call fcn.14003a500
mov eax, dword [rsp + 0x14]
call fcn.14003a200
call fcn.140039e60
call fcn.140039c80
lea rax, [0x1407d3104]
mov ebx, 0xc
call fcn.1400382c0
nop
mov qword [rsp + 8], rax
call fcn.140065b80
mov rax, qword [rsp + 8]
jmp fcn.140017cc0
Function at 0x140018900
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x140018aa6
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [0x140681810]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.140035420
xorps xmm15, xmm15
mov r14, qword [0x140e8ec90]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x14001896b
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x140018980
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
nop
test rbx, rbx
jbe 0x1400189a5
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x1400189b9
cmp rbx, 0x1000
jae 0x140018975
nop dword [rax]
jmp 0x140018a29
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop
cmp rbx, 0x1000
jae 0x1400189cd
xor edx, edx
jmp 0x140018a20
mov rcx, qword [0x140681810]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.140035420
xorps xmm15, xmm15
mov r14, qword [0x140e8ec90]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
nop dword [rax]
test dl, dl
jne 0x1400189af
jmp 0x140018994
call fcn.140069760
xorps xmm15, xmm15
mov r14, qword [0x140e8ec90]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.140039c00
lea rax, [0x1407dcefb]
mov ebx, 0x18
call fcn.14003a500
mov rax, qword [rsp + 0x38]
call fcn.14003a200
lea rax, [0x1407dd0c3]
mov ebx, 0x19
call fcn.14003a500
mov rax, qword [rsp + 0x30]
nop
call fcn.14003a200
call fcn.140039e60
call fcn.140039c80
lea rax, [0x1407e4f76]
mov ebx, 0x21
nop dword [rax + rax]
call fcn.1400382c0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.140065b80
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.140018900
Function at 0x140018ae0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x140018d0a
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [0x140681808]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.1400354a0
xorps xmm15, xmm15
mov r14, qword [0x140e8ec90]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x140018b59
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x140018b6c
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x140018b90
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
nop
jmp 0x140018ba4
cmp rbx, 0x1000
jae 0x140018b63
jmp 0x140018c25
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x140018bb6
xor esi, esi
jmp 0x140018c16
mov rax, qword [0x140681808]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
nop dword [rax]
call fcn.1400354a0
xorps xmm15, xmm15
mov r14, qword [0x140e8ec90]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x140018b9a
nop
jmp 0x140018b82
call fcn.140069760
xorps xmm15, xmm15
mov r14, qword [0x140e8ec90]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x140018ca5
call fcn.140039c00
lea rax, [0x1407ddd75]
mov ebx, 0x19
call fcn.14003a500
mov rax, qword [rsp + 0x68]
call fcn.14003a200
lea rax, [0x1407dd0c3]
mov ebx, 0x19
call fcn.14003a500
mov eax, dword [rsp + 0x34]
nop dword [rax]
call fcn.14003a200
call fcn.140039e60
call fcn.140039c80
lea rax, [0x1407d3efc]
mov ebx, 0xd
nop dword [rax + rax]
call fcn.1400382c0
cmp eax, 0x5af
je 0x140018c48
call fcn.140039c00
lea rax, [0x1407ddd75]
mov ebx, 0x19
nop dword [rax]
call fcn.14003a500
mov rax, qword [rsp + 0x38]
call fcn.14003a200
lea rax, [0x1407dd0c3]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.14003a500
mov eax, dword [rsp + 0x34]
call fcn.14003a200
call fcn.140039e60
call fcn.140039c80
lea rax, [0x1407e32bb]
mov ebx, 0x1f
call fcn.1400382c0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.140065b80
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.140018ae0
Function at 0x1400211c0
Capabilities:
Hash data using murmur3

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
cmp byte [0x140e8e956], 0
jne 0x1400212af
mov rdx, qword [rax + 0x50]
test byte [rdx], al
nop
nop
nop
sub rbx, qword [rax + 0x18]
mov esi, dword [rax + 0x5c]
imul rbx, rsi
mov rsi, rbx
shr rbx, 0x20
shr rsi, 0x23
and ebx, 7
mov rdi, rcx
mov rcx, rbx
mov r8d, 1
shl r8d, cl
add rdx, rsi
lock or byte [rdx], r8b
nop
nop
mov rcx, qword [rax + 0x18]
nop
movabs rdx, 0x800000000000
lea rax, [rdx + rcx]
mov rdx, rax
shr rax, 0x2a
cmp rax, 0x40
jae 0x1400212a5
lea rbx, [0x140e60d70]
mov rax, qword [rbx + rax*8]
shr rdx, 0x16
and edx, 0xfffff
mov rdx, qword [rax + rdx*8]
test byte [rdx], al
test byte [rax], al
mov rax, rcx
shr rcx, 0x10
and ecx, 0x3f
movzx ebx, byte [rdx + rcx + 0x11440]
lea rdx, [rdx + rcx]
lea rdx, [rdx + 0x11440]
shr rax, 0xd
and eax, 7
mov rcx, rax
mov eax, 1
shl eax, cl
test al, bl
jne 0x140021287
lock or byte [rdx], al
mov rax, qword [r14 + 0x30]
mov rax, qword [rax + 0xa0]
test byte [rax], al
add qword [rax + 0x1248], rdi
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov ecx, 0x40
call fcn.140068220
lea rax, [0x1407ec9c4]
mov ebx, 0x2c
nop dword [rax + rax]
call fcn.1400382c0
nop
int3