joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180073830
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x1800a9010]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x18007385d
xor eax, eax
jmp 0x1800739c9
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x180073897
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x180073897
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x1800739c9
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x1800739bc
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x1800738da
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x180073905
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x1800739c1
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x180073974
sub eax, 1
je 0x180073974
cmp eax, 2
jne 0x1800739bc
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x1800739c1
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x1800739a2
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x1800739bc
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x1800739c1
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.180083910
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x180073ee0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x1800a9010]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x180073fb3
cmp byte [rcx + 0x71], 0
je 0x180073fb3
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x180073faf
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x180073f74
sub eax, 1
je 0x180073f78
cmp eax, 2
jne 0x180073faf
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.180083910
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x180073fa6
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x180073faf
cmp byte [rbx + 0x71], 0
sete al
jmp 0x180073f5c
xor al, al
jmp 0x180073f5c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.180083910
add rsp, 0x60
pop rbx
ret
Function at 0x180076440
Capabilities:
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x20
mov rcx, qword [0x1800acc20]
xorps xmm0, xmm0
add rcx, 1
mov rbx, qword [0x1800acc48]
js 0x180076464
cvtsi2ss xmm0, rcx
jmp 0x180076479
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm0, dword [0x1800acc10]
call sub.api_ms_win_crt_math_l1_1_0.dll_ceilf
movss xmm1, dword [0x180098f88]
xor ecx, ecx
comiss xmm0, xmm1
jb 0x1800764ab
subss xmm0, xmm1
comiss xmm0, xmm1
jae 0x1800764ab
movabs rax, 0x8000000000000000
mov rcx, rax
cvttss2si rax, xmm0
add rax, rcx
mov ecx, 8
cmp rax, rcx
cmova rcx, rax
cmp rbx, rcx
jae 0x1800764dd
cmp rbx, 0x200
jae 0x1800764da
lea rbx, [rbx*8]
cmp rbx, rcx
jae 0x1800764dd
mov rbx, rcx
mov rdx, rbx
add rsp, 0x20
pop rbx
jmp 0x180076510
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov edi, 1
bsr rcx, rax
mov eax, edi
shl rax, cl
cmp rdx, rax
jbe 0x180076541
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x1800acc18]
or rax, rdi
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x1800acc28]
lea rdx, [rdi + rdi]
call fcn.180074340
mov rax, qword [0x1800acc18]
lea r9, [rdi - 1]
mov qword [0x1800acc40], r9
mov qword [0x1800acc48], rdi
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x1800766b4
mov qword [rsp + 0x40], rsi
movabs rdi, 0x100000001b3
movabs rsi, 0xcbf29ce484222325
movzx edx, byte [rax + 0x11]
movzx r11d, byte [rax + 0x10]
mov rcx, qword [rcx]
xor r11, rsi
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x12]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x13]
imul r11, rdi
xor r11, rdx
imul r11, rdi
and r11, r9
shl r11, 4
add r11, qword [0x1800acc28]
mov r9, qword [r11]
cmp r9, rbx
jne 0x180076600
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x180076675
mov rdx, qword [r11 + 8]
mov r8d, dword [rax + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x18007663d
mov r10, qword [rdx]
cmp r10, rax
je 0x180076637
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x180076675
cmp r9, rdx
je 0x180076651
mov rdx, qword [rdx + 8]
cmp r8d, dword [rdx + 0x10]
je 0x180076689
cmp r9, rdx
jne 0x180076642
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
je 0x1800766af
mov r9, qword [0x1800acc40]
jmp 0x1800765b1
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x180076675
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x180076510
Capabilities:
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x20
mov rcx, qword [0x1800acc20]
xorps xmm0, xmm0
add rcx, 1
mov rbx, qword [0x1800acc48]
js 0x180076464
cvtsi2ss xmm0, rcx
jmp 0x180076479
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm0, dword [0x1800acc10]
call sub.api_ms_win_crt_math_l1_1_0.dll_ceilf
movss xmm1, dword [0x180098f88]
xor ecx, ecx
comiss xmm0, xmm1
jb 0x1800764ab
subss xmm0, xmm1
comiss xmm0, xmm1
jae 0x1800764ab
movabs rax, 0x8000000000000000
mov rcx, rax
cvttss2si rax, xmm0
add rax, rcx
mov ecx, 8
cmp rax, rcx
cmova rcx, rax
cmp rbx, rcx
jae 0x1800764dd
cmp rbx, 0x200
jae 0x1800764da
lea rbx, [rbx*8]
cmp rbx, rcx
jae 0x1800764dd
mov rbx, rcx
mov rdx, rbx
add rsp, 0x20
pop rbx
jmp 0x180076510
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov edi, 1
bsr rcx, rax
mov eax, edi
shl rax, cl
cmp rdx, rax
jbe 0x180076541
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x1800acc18]
or rax, rdi
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x1800acc28]
lea rdx, [rdi + rdi]
call fcn.180074340
mov rax, qword [0x1800acc18]
lea r9, [rdi - 1]
mov qword [0x1800acc40], r9
mov qword [0x1800acc48], rdi
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x1800766b4
mov qword [rsp + 0x40], rsi
movabs rdi, 0x100000001b3
movabs rsi, 0xcbf29ce484222325
movzx edx, byte [rax + 0x11]
movzx r11d, byte [rax + 0x10]
mov rcx, qword [rcx]
xor r11, rsi
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x12]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x13]
imul r11, rdi
xor r11, rdx
imul r11, rdi
and r11, r9
shl r11, 4
add r11, qword [0x1800acc28]
mov r9, qword [r11]
cmp r9, rbx
jne 0x180076600
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x180076675
mov rdx, qword [r11 + 8]
mov r8d, dword [rax + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x18007663d
mov r10, qword [rdx]
cmp r10, rax
je 0x180076637
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x180076675
cmp r9, rdx
je 0x180076651
mov rdx, qword [rdx + 8]
cmp r8d, dword [rdx + 0x10]
je 0x180076689
cmp r9, rdx
jne 0x180076642
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
je 0x1800766af
mov r9, qword [0x1800acc40]
jmp 0x1800765b1
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x180076675
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1800771f0
Capabilities:
Resume thread

Disassembly:
push rbx
sub rsp, 0x20
lea rcx, str.opengl32.dll
mov byte [0x1800ac7f8], 0
mov byte [0x1800ac610], 0
mov dword [0x1800ac814], 0x2d
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [0x180096558]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
lea r8, [0x1800ab668]
lea rdx, [0x18006a020]
mov rbx, rax
call fcn.1800694d0
mov edx, 1
mov rcx, rbx
call fcn.1800699d0
lea rcx, str.Ws2_32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x18007728e
lea rdx, str.WSASend
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18007728e
lea r8, [0x1800ab610]
mov rcx, rax
lea rdx, [0x18000bfc0]
call fcn.1800694d0
mov edx, 1
xor ecx, ecx
add rsp, 0x20
pop rbx
jmp fcn.1800699d0

Function at 0x180080ea0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x1800a9010]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 0x7a
mov ecx, dword [0x1800ab5a4]
mov rax, qword gs:[0x58]
mov edx, 4
mov rax, qword [rax + rcx*8]
mov ecx, dword [rdx + rax]
cmp dword [0x1800accc0], ecx
jle 0x180080fae
lea rcx, [0x1800accc0]
call fcn.1800839d8
cmp dword [0x1800accc0], 0xffffffff
jne 0x180080fae
xorps xmm0, xmm0
movups xmmword [0x1800acc80], xmm0
movups xmmword [0x1800acc90], xmm0
movups xmmword [0x1800acca0], xmm0
movups xmmword [0x1800accb0], xmm0
mov dword [0x1800acc80], 0
xor ebx, ebx
mov qword [0x1800acc88], rbx
mov qword [0x1800acc90], rbx
lea ecx, [rbx + 0x18]
call fcn.180083a50
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [0x1800acc88], rax
mov qword [0x1800acc98], rbx
xorps xmm0, xmm0
movdqa xmmword [0x1800acca0], xmm0
mov qword [0x1800accb0], 7
mov qword [0x1800accb8], 8
mov dword [0x1800acc80], 0x3f800000
mov r8, rax
lea edx, [rbx + 0x10]
lea rcx, [0x1800acc98]
call fcn.180082920
nop
lea rcx, [0x180087c20]
call fcn.180083df4
nop
lea rcx, [0x1800accc0]
call fcn.18008396c
mov ecx, dword [rsp + 0x30]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
movzx edi, ax
shr edi, 0xf
not dil
and dil, 1
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x20]
call fcn.180082ca0
mov rcx, qword [rax]
movzx ebx, byte [rcx + 0x14]
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x20]
call fcn.180082ca0
mov rcx, qword [rax]
mov byte [rcx + 0x14], dil
test bl, bl
je 0x180080ffe
test dil, dil
jne 0x180080ffe
mov al, 1
jmp 0x180081000
xor al, al
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.180083910
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x180082fc0
Capabilities:
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov edi, 1
bsr rcx, rax
mov eax, edi
shl rax, cl
cmp rdx, rax
jbe 0x180082ff1
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x1800acc88]
or rax, rdi
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x1800acc98]
lea rdx, [rdi + rdi]
call fcn.180082920
mov rax, qword [0x1800acc88]
lea r9, [rdi - 1]
mov qword [0x1800accb0], r9
mov qword [0x1800accb8], rdi
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x180083164
mov qword [rsp + 0x40], rsi
movabs rdi, 0x100000001b3
movabs rsi, 0xcbf29ce484222325
movzx edx, byte [rax + 0x11]
movzx r11d, byte [rax + 0x10]
mov rcx, qword [rcx]
xor r11, rsi
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x12]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x13]
imul r11, rdi
xor r11, rdx
imul r11, rdi
and r11, r9
shl r11, 4
add r11, qword [0x1800acc98]
mov r9, qword [r11]
cmp r9, rbx
jne 0x1800830b0
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x180083125
mov rdx, qword [r11 + 8]
mov r8d, dword [rax + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x1800830ed
mov r10, qword [rdx]
cmp r10, rax
je 0x1800830e7
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x180083125
cmp r9, rdx
je 0x180083101
mov rdx, qword [rdx + 8]
cmp r8d, dword [rdx + 0x10]
je 0x180083139
cmp r9, rdx
jne 0x1800830f2
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
je 0x18008315f
mov r9, qword [0x1800accb0]
jmp 0x180083061
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x180083125
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x180083640
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
cmp edx, 1
jne 0x180083688
mov qword [0x1800accc8], rcx
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
xor eax, eax
lea r8, [0x1800835f0]
mov qword [rsp + 0x28], rax
mov r9, rbx
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x180083688
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
add rsp, 0x30
pop rbx
ret
Function at 0x414a20
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x414bc6
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00430b40
xorps xmm15, xmm15
mov r14, qword [0x005cb420]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x414a8b
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x414aa0
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
nop
test rbx, rbx
jbe 0x414ac5
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x414ad9
cmp rbx, 0x1000
jae 0x414a95
nop dword [rax]
jmp 0x414b49
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop
cmp rbx, 0x1000
jae 0x414aed
xor edx, edx
jmp 0x414b40
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00430b40
xorps xmm15, xmm15
mov r14, qword [0x005cb420]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
nop dword [rax]
test dl, dl
jne 0x414acf
jmp 0x414ab4
call fcn.0045fc20
xorps xmm15, xmm15
mov r14, qword [0x005cb420]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.00435120
lea rax, [0x004d8a10]
mov ebx, 0x18
call fcn.00435a20
mov rax, qword [rsp + 0x38]
call fcn.00435720
lea rax, [0x004d8ad0]
mov ebx, 0x19
call fcn.00435a20
mov rax, qword [rsp + 0x30]
nop
call fcn.00435720
call fcn.00435380
call fcn.004351a0
lea rax, [0x004dad11]
mov ebx, 0x21
nop dword [rax + rax]
call fcn.004337e0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045c060
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.00414a20
Function at 0x414c00
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x414e2a
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.00430bc0
xorps xmm15, xmm15
mov r14, qword [0x005cb420]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x414c79
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x414c8c
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x414cb0
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
nop
jmp 0x414cc4
cmp rbx, 0x1000
jae 0x414c83
jmp 0x414d45
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x414cd6
xor esi, esi
jmp 0x414d36
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
nop dword [rax]
call fcn.00430bc0
xorps xmm15, xmm15
mov r14, qword [0x005cb420]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x414cba
nop
jmp 0x414ca2
call fcn.0045fc20
xorps xmm15, xmm15
mov r14, qword [0x005cb420]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x414dc5
call fcn.00435120
lea rax, [0x004d8e9f]
mov ebx, 0x19
call fcn.00435a20
mov rax, qword [rsp + 0x68]
call fcn.00435720
lea rax, [0x004d8ad0]
mov ebx, 0x19
call fcn.00435a20
mov eax, dword [rsp + 0x34]
nop dword [rax]
call fcn.00435720
call fcn.00435380
call fcn.004351a0
lea rax, [0x004d5aac]
mov ebx, 0xd
nop dword [rax + rax]
call fcn.004337e0
cmp eax, 0x5af
je 0x414d68
call fcn.00435120
lea rax, [0x004d8e9f]
mov ebx, 0x19
nop dword [rax]
call fcn.00435a20
mov rax, qword [rsp + 0x38]
call fcn.00435720
lea rax, [0x004d8ad0]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.00435a20
mov eax, dword [rsp + 0x34]
call fcn.00435720
call fcn.00435380
call fcn.004351a0
lea rax, [0x004da625]
mov ebx, 0x1f
call fcn.004337e0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045c060
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00414c00
Function at 0x41d0e0
Capabilities:
Hash data using murmur3

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
cmp byte [0x005cb250], 0
jne 0x41d1cf
mov rdx, qword [rax + 0x50]
test byte [rdx], al
nop
nop
nop
sub rbx, qword [rax + 0x18]
mov esi, dword [rax + 0x5c]
imul rbx, rsi
mov rsi, rbx
shr rbx, 0x20
shr rsi, 0x23
and ebx, 7
mov rdi, rcx
mov rcx, rbx
mov r8d, 1
shl r8d, cl
add rdx, rsi
lock or byte [rdx], r8b
nop
nop
mov rcx, qword [rax + 0x18]
nop
movabs rdx, 0x800000000000
lea rax, [rdx + rcx]
mov rdx, rax
shr rax, 0x2a
cmp rax, 0x40
jae 0x41d1c5
lea rbx, [0x0059d690]
mov rax, qword [rbx + rax*8]
shr rdx, 0x16
and edx, 0xfffff
mov rdx, qword [rax + rdx*8]
test byte [rdx], al
test byte [rax], al
mov rax, rcx
shr rcx, 0x10
and ecx, 0x3f
movzx ebx, byte [rdx + rcx + 0x11440]
lea rdx, [rdx + rcx]
lea rdx, [rdx + 0x11440]
shr rax, 0xd
and eax, 7
mov rcx, rax
mov eax, 1
shl eax, cl
test al, bl
jne 0x41d1a7
lock or byte [rdx], al
mov rax, qword [r14 + 0x30]
mov rax, qword [rax + 0xa0]
test byte [rax], al
add qword [rax + 0x1248], rdi
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov ecx, 0x40
call fcn.0045e6e0
lea rax, [0x004dc6a0]
mov ebx, 0x2c
nop dword [rax + rax]
call fcn.004337e0
nop
int3

Function at 0x41f5c0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41f6be
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rbx
mov qword [rsp + 8], 0
jmp 0x41f600
mov rax, qword [rsp + 0x50]
mov rcx, rdx
mov rbx, qword [rsp + 0x58]
nop
cmp qword [rsp + 8], rbx
jae 0x41f6af
test byte [rax], al
lea rcx, [rax + 0x100b8]
mov rax, rcx
call fcn.00420180
nop dword [rax]
test rax, rax
je 0x41f6af
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x30], xmm15
lea rcx, [0x0041f700]
mov qword [rsp + 0x10], rcx
lea rdx, [rsp + 8]
mov qword [rsp + 0x18], rdx
mov rdx, qword [rsp + 0x50]
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rbx
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x38], rax
lea rbx, [rsp + 0x10]
mov qword [rsp], rbx
call fcn.0045bf20
xorps xmm15, xmm15
mov r14, qword [0x005cb420]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x60]
test rdx, rdx
jne 0x41f69d
xor eax, eax
jmp 0x41f6a7
mov rax, qword [rdx]
call rax
mov rdx, qword [rsp + 0x60]
test al, al
je 0x41f5f2
mov rax, qword [rsp + 8]
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.0045c060
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0041f5c0