joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140043b90
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [rcx + 0x60]
movzx r8d, byte [rcx + 0x5c]
test eax, eax
jle 0x140043bcc
mov edx, dword [rcx + 0x288]
lea r11, [0x1400697d0]
mov r9d, eax
nop dword [rax]
mov eax, edx
shr rax, 0x18
xor rax, r8
shl edx, 8
xor edx, dword [r11 + rax*4]
mov dword [rcx + 0x288], edx
sub r9, 1
jne 0x140043bb0
mov eax, dword [rcx + 0x5c]
mov byte [rax + rcx + 0x80], 1
movsxd r9, dword [rcx + 0x60]
mov edx, r9d
sub edx, 1
je 0x140043cae
sub edx, 1
je 0x140043ca0
cmp edx, 1
je 0x140043c60
mov byte [r9 + rcx + 0x7c], 1
mov rax, qword [rcx + 0x40]
movsxd rdx, dword [rcx + 0x6c]
mov byte [rdx + rax], r8b
movsxd rdx, dword [rcx + 0x6c]
lea eax, [rdx + 1]
mov dword [rcx + 0x6c], eax
mov rax, qword [rcx + 0x40]
mov byte [rdx + rax + 1], r8b
movsxd rdx, dword [rcx + 0x6c]
lea eax, [rdx + 1]
mov dword [rcx + 0x6c], eax
mov rax, qword [rcx + 0x40]
mov byte [rdx + rax + 1], r8b
movsxd rdx, dword [rcx + 0x6c]
lea eax, [rdx + 1]
mov dword [rcx + 0x6c], eax
mov rax, qword [rcx + 0x40]
mov byte [rdx + rax + 1], r8b
movsxd rdx, dword [rcx + 0x6c]
lea eax, [rdx + 1]
mov dword [rcx + 0x6c], eax
movzx r8d, byte [rcx + 0x60]
mov rax, qword [rcx + 0x40]
sub r8b, 4
mov byte [rdx + rax + 1], r8b
inc dword [rcx + 0x6c]
ret
movsxd rdx, dword [rcx + 0x6c]
mov rax, qword [rcx + 0x40]
mov byte [rdx + rax], r8b
movsxd rdx, dword [rcx + 0x6c]
lea eax, [rdx + 1]
mov dword [rcx + 0x6c], eax
mov rax, qword [rcx + 0x40]
mov byte [rdx + rax + 1], r8b
movsxd rdx, dword [rcx + 0x6c]
lea eax, [rdx + 1]
mov dword [rcx + 0x6c], eax
mov rax, qword [rcx + 0x40]
mov byte [rdx + rax + 1], r8b
inc dword [rcx + 0x6c]
ret
movsxd rdx, dword [rcx + 0x6c]
mov rax, qword [rcx + 0x40]
mov byte [rdx + rax], r8b
jmp 0x140043c7f
movsxd rdx, dword [rcx + 0x6c]
mov rax, qword [rcx + 0x40]
mov byte [rdx + rax], r8b
inc dword [rcx + 0x6c]
ret
Function at 0x140010b50
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov ebx, ecx
mov r14, r8
xor ecx, ecx
mov qword [r8], 0
mov rdi, rdx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
movzx edx, bx
mov r8, rdi
mov rcx, rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
je 0x140010c61
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rdx, rbx
mov rcx, rsi
mov ebp, eax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rdi, rax
test rax, rax
je 0x140010c61
mov edx, ebp
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rcx, rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov r8d, ebp
mov rdx, rdi
mov rcx, rax
call fcn.140049eb0
lea r8, [rsp + 0x58]
mov edx, 1
mov rcx, rsi
call qword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
mov rbp, qword [rsp + 0x58]
mov ecx, 0x18
call qword [sym.imp.gdiplus.dll_GdipAlloc]
mov rbx, rax
test rax, rax
je 0x140010c3b
lea rax, vtable.Gdiplus::Bitmap.0
mov qword [rsp + 0x50], 0
lea rdx, [rsp + 0x50]
mov qword [rbx], rax
mov rcx, rbp
call qword [sym.imp.gdiplus.dll_GdipCreateBitmapFromStream]
mov rcx, qword [rsp + 0x50]
mov qword [rbx + 8], rcx
mov dword [rbx + 0x10], eax
jmp 0x140010c3d
xor ebx, ebx
mov rcx, rsi
mov qword [r14], rbx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov al, 1
jmp 0x140010c63
xor al, al
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x140011110
Capabilities:
Get file version info

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x270
mov rax, qword [0x14008e030]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rdi, rcx
mov qword [rsp + 0x38], rcx
xor r14d, r14d
mov dword [rsp + 0x24], r14d
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov qword [rcx + 0x10], r14
mov qword [rcx + 0x18], r14
xor r8d, r8d
lea rdx, [0x14007e430]
call fcn.140002880
mov dword [rsp + 0x24], 1
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x50]
call fcn.14004a550
mov r8d, 0x104
lea rdx, [rsp + 0x50]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x14001127e
cmp eax, 0x104
je 0x14001127e
mov dword [rsp + 0x20], r14d
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x50]
call qword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov esi, eax
test eax, eax
je 0x14001127e
mov ecx, esi
call fcn.140048370
mov rbp, rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x30], r14
mov r8d, esi
xor edx, edx
mov rcx, rax
call fcn.14004a550
mov dword [rsp + 0x28], r14d
mov r9, rbp
mov r8d, esi
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x50]
call qword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x140011276
lea r9, [rsp + 0x28]
lea r8, [rsp + 0x30]
lea rdx, str.StringFileInfo000004b0ProductName
mov rcx, rbp
call qword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x140011276
mov r9, qword [rsp + 0x30]
mov rdx, 0xffffffffffffffff
nop dword [rax]
inc rdx
cmp word [r9 + rdx*2], 0
jne 0x140011230
mov rax, qword [rdi + 0x18]
cmp rdx, rax
ja 0x14001126d
mov rsi, rdi
cmp rax, 8
jb 0x140011250
mov rsi, qword [rdi]
mov qword [rdi + 0x10], rdx
lea rbx, [rdx + rdx]
mov r8, rbx
mov rdx, r9
mov rcx, rsi
call fcn.140049eb0
mov word [rbx + rsi], r14w
jmp 0x140011276
mov rcx, rdi
call fcn.1400065a0
nop
mov rcx, rbp
call fcn.140047f90
mov rax, rdi
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140047f70
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret

Function at 0x1400112b0
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x260
mov rax, qword [0x14008e030]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rbx, rcx
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], 0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 5]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 0
lea rax, [rsp + 0x40]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140011320
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.140002880
mov dword [rsp + 0x30], 1
lea rdx, str.FLiNGTrainer
mov rcx, rbx
call fcn.1400015a0
mov rax, rbx
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140047f70
add rsp, 0x260
pop rbx
ret
Function at 0x1400201b0
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x90
mov rax, qword [0x14008e030]
xor rax, rsp
mov qword [rsp + 0x88], rax
xor edi, edi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], r8
mov r9, rdx
xor r8d, r8d
xor edx, edx
mov rcx, qword [rcx + 0x80]
call qword [0x140091cc8]
mov rbx, rax
test rax, rax
jne 0x14002033b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rsp + 0x68]
call fcn.140009ca0
nop
lea r8, [0x1400920b0]
cmp qword [0x1400920c8], 8
cmovae r8, qword [0x1400920b0]
mov r9, qword [0x1400920c0]
mov rcx, rax
call fcn.14000c040
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x58], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x48], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x58], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 7
mov word [rax], di
lea r8, [0x140091e90]
cmp qword [0x140091ea8], 8
cmovae r8, qword [0x140091e90]
lea rdx, [rsp + 0x48]
cmp qword [rsp + 0x60], 8
cmovae rdx, qword [rsp + 0x48]
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x1400202e3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400202de
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140020384
call fcn.140047f90
movdqa xmm0, xmmword [0x140082170]
movdqu xmmword [rsp + 0x58], xmm0
mov word [rsp + 0x48], di
mov rdx, qword [rsp + 0x80]
cmp rdx, 8
jb 0x140020337
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140020332
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002037e
call fcn.140047f90
xor al, al
jmp 0x14002035d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov edx, 0xffffffff
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.140047f70
mov rbx, qword [rsp + 0xb8]
add rsp, 0x90
pop rdi
ret
call fcn.14004e904
nop
call fcn.14004e904
nop
int3
Function at 0x140020b10
Capabilities:
Check if file exists
Get file attributes
Read .ini file

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x78
mov rax, qword [0x14008e030]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov r12, r9
mov r13, r8
mov rbp, rdx
mov qword [rsp + 0x38], rdx
mov r14, rcx
mov qword [rsp + 0x40], rdx
mov rdi, qword [rsp + 0xe0]
xor ebx, ebx
cmp qword [rcx + 0x18], 8
jb 0x140020b5a
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140020b8e
xorps xmm0, xmm0
movups xmmword [rbp], xmm0
mov qword [rbp + 0x10], rbx
mov qword [rbp + 0x18], rbx
mov r8d, 0x19
lea rdx, str.Error:_Ini_File_Not_Exist
mov rcx, rbp
call fcn.140002880
jmp 0x140020cfd
mov ebp, 1
mov ecx, 0x208
call fcn.140048370
mov rsi, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], 7
mov word [rsp + 0x48], bx
mov rbx, 0xffffffffffffffff
mov r15d, 0x104
nop dword [rax + rax]
mov rax, r14
cmp qword [r14 + 0x18], 8
jb 0x140020bdd
mov rax, qword [r14]
mov r8, rdi
cmp qword [rdi + 0x18], 8
jb 0x140020bea
mov r8, qword [rdi]
mov rdx, r12
cmp qword [r12 + 0x18], 8
jb 0x140020bf9
mov rdx, qword [r12]
mov rcx, r13
cmp qword [r13 + 0x18], 8
jb 0x140020c07
mov rcx, qword [r13]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r15d
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [r15 - 1]
cmp eax, ecx
jb 0x140020c88
mov r8, rdi
cmp qword [rdi + 0x18], 8
jb 0x140020c2f
mov r8, qword [rdi]
mov rax, rsi
sub r8, rsi
nop word [rax + rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x140020c54
add rax, 2
test ecx, ecx
jne 0x140020c40
test edx, edx
je 0x140020c88
mov rcx, rsi
call fcn.140047f90
inc ebp
imul r15d, ebp, 0x104
mov ecx, r15d
mov eax, 2
mul rcx
cmovo rax, rbx
mov rcx, rax
call fcn.140048370
mov rsi, rax
jmp 0x140020bd0
mov rbp, qword [rsp + 0x38]
nop dword [rax]
inc rbx
cmp word [rsi + rbx*2], 0
jne 0x140020c90
mov rax, qword [rsp + 0x60]
cmp rbx, rax
ja 0x140020cd3
lea rdi, [rsp + 0x48]
cmp rax, 8
cmovae rdi, qword [rsp + 0x48]
mov qword [rsp + 0x58], rbx
add rbx, rbx
mov r8, rbx
mov rdx, rsi
mov rcx, rdi
call fcn.140049eb0
xor r14d, r14d
mov word [rbx + rdi], r14w
jmp 0x140020ce3
mov r9, rsi
mov rdx, rbx
lea rcx, [rsp + 0x48]
call fcn.1400065a0
mov rcx, rsi
call fcn.140047f90
movups xmm0, xmmword [rsp + 0x48]
movups xmmword [rbp], xmm0
movups xmm1, xmmword [rsp + 0x58]
movups xmmword [rbp + 0x10], xmm1
mov rax, rbp
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140047f70
add rsp, 0x78
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x14003e598
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
lea r9, [rdx + rdx]
movabs r8, 0xcbf29ce484222325
xor edx, edx
test r9, r9
je 0x14002abaa
movzx eax, byte [rdx + rcx]
movabs r10, 0x100000001b3
xor r8, rax
inc rdx
imul r8, r10
cmp rdx, r9
jb 0x14002ab8d
mov rax, r8
ret
sub r8, rdx
mov rcx, rdx
sar r8, 1
mov rdx, r8
jmp 0x14002ab78
Function at 0x140048d2c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140048d76
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140048d76
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140048d76
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140048d76
cmp dword [rcx + 0x84], 0xe
jbe 0x140048d76
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140048d78
xor al, al
add rsp, 0x28
ret

Function at 0x1400540e8
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
xor edi, edi
mov esi, edx
mov rbp, rcx
test r8, r8
jne 0x14005411f
call fcn.140054ac8
mov dword [rax], 0x16
call fcn.14004e8e4
xor eax, eax
jmp 0x1400541ad
mov rdx, r9
mov rcx, r8
call fcn.140054084
mov rbx, rax
test rax, rax
je 0x1400541aa
lea rax, [rsp + 0x50]
mov rdx, rsi
mov qword [rsp + 0x28], rax
lea r8, [0x140053fb0]
mov eax, dword [rsp + 0x60]
mov r9, rbx
mov rcx, rbp
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdx, rax
test rax, rax
jne 0x140054197
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140054a3c
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x14005417e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x14005418d
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, rbx
call fcn.140060368
jmp 0x1400541aa
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1400541a7
mov eax, dword [rsp + 0x50]
mov dword [rcx], eax
mov rdi, rdx
mov rax, rdi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret

Function at 0x1400544d8
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x140054343
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140054343
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140054343
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140054343
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140054343
cmp dword [rcx + 0x84], 0xe
jbe 0x140054343
cmp dword [rcx + 0xf8], 0
je 0x140054343
mov ecx, ebx
call fcn.1400543f4
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.1400541d0
nop
cmp dword [rbp + 0x20], 0
je 0x140054391
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14005439c
int3
xor r8d, r8d
xor edx, edx
jmp 0x1400542d4
Function at 0x140066464
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x1400664eb
mov rsi, rbx
cmp word [rax], bp
je 0x1400664aa
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x140066494
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x140066490
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.14006141c
mov rdi, rax
test rax, rax
je 0x1400664d8
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.140049eb0
mov rbp, rdi
xor ecx, ecx
call fcn.140060368
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400693d4
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov ebx, ecx
call fcn.14005efa4
mov ecx, ebx
lea r8, [rsp + 0x30]
and ecx, 0x3ff
mov r9d, 2
bts ecx, 0xa
mov edx, 0x20000001
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor edx, edx
test eax, eax
je 0x140069475
cmp ebx, dword [rsp + 0x30]
je 0x14006946e
test esi, esi
je 0x14006946e
mov r10, qword [rdi + 0x98]
mov r9d, edx
movzx r8d, word [r10]
lea rcx, [r10 + 2]
lea eax, [r8 - 0x41]
cmp ax, 0x19
jbe 0x140069449
sub r8w, 0x61
cmp r8w, 0x19
ja 0x140069456
movzx r8d, word [rcx]
inc r9d
add rcx, 2
jmp 0x140069433
or rax, 0xffffffffffffffff
inc rax
cmp word [r10 + rax*2], dx
jne 0x14006945a
cmp r9d, eax
setne dl
mov eax, edx
jmp 0x140069477
mov eax, 1
jmp 0x140069477
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x414f60
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x415106
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00431080
xorps xmm15, xmm15
mov r14, qword [0x007a70f0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x414fcb
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x414fe0
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
nop
test rbx, rbx
jbe 0x415005
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x415019
cmp rbx, 0x1000
jae 0x414fd5
nop dword [rax]
jmp 0x415089
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop
cmp rbx, 0x1000
jae 0x41502d
xor edx, edx
jmp 0x415080
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00431080
xorps xmm15, xmm15
mov r14, qword [0x007a70f0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
nop dword [rax]
test dl, dl
jne 0x41500f
jmp 0x414ff4
call fcn.00460a40
xorps xmm15, xmm15
mov r14, qword [0x007a70f0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.004355c0
lea rax, [0x005eeedb]
mov ebx, 0x18
call fcn.00435ec0
mov rax, qword [rsp + 0x38]
call fcn.00435bc0
lea rax, [0x005eef83]
mov ebx, 0x19
call fcn.00435ec0
mov rax, qword [rsp + 0x30]
nop
call fcn.00435bc0
call fcn.00435820
call fcn.00435640
lea rax, [0x005f0321]
mov ebx, 0x21
nop dword [rax + rax]
call fcn.00433c80
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045cea0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.00414f60
Function at 0x415140
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41536a
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.00431100
xorps xmm15, xmm15
mov r14, qword [0x007a70f0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x4151b9
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x4151cc
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x4151f0
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
nop
jmp 0x415204
cmp rbx, 0x1000
jae 0x4151c3
jmp 0x415285
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x415216
xor esi, esi
jmp 0x415276
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
nop dword [rax]
call fcn.00431100
xorps xmm15, xmm15
mov r14, qword [0x007a70f0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x4151fa
nop
jmp 0x4151e2
call fcn.00460a40
xorps xmm15, xmm15
mov r14, qword [0x007a70f0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x415305
call fcn.004355c0
lea rax, [0x005ef0fa]
mov ebx, 0x19
call fcn.00435ec0
mov rax, qword [rsp + 0x68]
call fcn.00435bc0
lea rax, [0x005eef83]
mov ebx, 0x19
call fcn.00435ec0
mov eax, dword [rsp + 0x34]
nop dword [rax]
call fcn.00435bc0
call fcn.00435820
call fcn.00435640
lea rax, [0x005eda38]
mov ebx, 0xd
nop dword [rax + rax]
call fcn.00433c80
cmp eax, 0x5af
je 0x4152a8
call fcn.004355c0
lea rax, [0x005ef0fa]
mov ebx, 0x19
nop dword [rax]
call fcn.00435ec0
mov rax, qword [rsp + 0x38]
call fcn.00435bc0
lea rax, [0x005eef83]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.00435ec0
mov eax, dword [rsp + 0x34]
call fcn.00435bc0
call fcn.00435820
call fcn.00435640
lea rax, [0x005efe5d]
mov ebx, 0x1f
call fcn.00433c80
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045cea0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00415140
Function at 0x41d620
Capabilities:
Hash data using murmur3

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
cmp byte [0x007a6ecf], 0
jne 0x41d70f
mov rdx, qword [rax + 0x50]
test byte [rdx], al
nop
nop
nop
sub rbx, qword [rax + 0x18]
mov esi, dword [rax + 0x5c]
imul rbx, rsi
mov rsi, rbx
shr rbx, 0x20
shr rsi, 0x23
and ebx, 7
mov rdi, rcx
mov rcx, rbx
mov r8d, 1
shl r8d, cl
add rdx, rsi
lock or byte [rdx], r8b
nop
nop
mov rcx, qword [rax + 0x18]
nop
movabs rdx, 0x800000000000
lea rax, [rdx + rcx]
mov rdx, rax
shr rax, 0x2a
cmp rax, 0x40
jae 0x41d705
lea rbx, [0x00779310]
mov rax, qword [rbx + rax*8]
shr rdx, 0x16
and edx, 0xfffff
mov rdx, qword [rax + rdx*8]
test byte [rdx], al
test byte [rax], al
mov rax, rcx
shr rcx, 0x10
and ecx, 0x3f
movzx ebx, byte [rdx + rcx + 0x11440]
lea rdx, [rdx + rcx]
lea rdx, [rdx + 0x11440]
shr rax, 0xd
and eax, 7
mov rcx, rax
mov eax, 1
shl eax, cl
test al, bl
jne 0x41d6e7
lock or byte [rdx], al
mov rax, qword [r14 + 0x30]
mov rax, qword [rax + 0xa0]
test byte [rax], al
add qword [rax + 0x1248], rdi
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov ecx, 0x40
call fcn.0045f520
lea rax, [0x005f153e]
mov ebx, 0x2c
nop dword [rax + rax]
call fcn.00433c80
nop
int3

Function at 0x41fb00
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41fbfe
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rbx
mov qword [rsp + 8], 0
jmp 0x41fb40
mov rax, qword [rsp + 0x50]
mov rcx, rdx
mov rbx, qword [rsp + 0x58]
nop
cmp qword [rsp + 8], rbx
jae 0x41fbef
test byte [rax], al
lea rcx, [rax + 0x100b8]
mov rax, rcx
call fcn.004206c0
nop dword [rax]
test rax, rax
je 0x41fbef
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x30], xmm15
lea rcx, [0x0041fc40]
mov qword [rsp + 0x10], rcx
lea rdx, [rsp + 8]
mov qword [rsp + 0x18], rdx
mov rdx, qword [rsp + 0x50]
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rbx
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x38], rax
lea rbx, [rsp + 0x10]
mov qword [rsp], rbx
call fcn.0045cd60
xorps xmm15, xmm15
mov r14, qword [0x007a70f0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x60]
test rdx, rdx
jne 0x41fbdd
xor eax, eax
jmp 0x41fbe7
mov rax, qword [rdx]
call rax
mov rdx, qword [rsp + 0x60]
test al, al
je 0x41fb32
mov rax, qword [rsp + 8]
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.0045cea0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0041fb00