joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140009580
Capabilities:
Set console window title

Disassembly:
push rbx
sub rsp, 0x1e0
mov rax, qword [0x140018028]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
mov ecx, 0x4e3
call qword [sym.imp.KERNEL32.dll_SetConsoleOutputCP]
lea rcx, str.Aceid.cc_Launcher___v2.0__
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
nop
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x80], xmm0
mov qword [rsp + 0x90], rax
lea rcx, [rsp + 0x80]
call fcn.140005200
nop
xor edx, edx
mov r8d, 0x108
lea rcx, [rsp + 0xc8]
call sub.VCRUNTIME140.dll_memset
lea rax, str.65341
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 5
lea rax, str.176.113.81.61
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], select
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x60], xmm0
movaps xmm1, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x70], xmm1
lea r9, [rsp + 0x60]
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0xc8]
call fcn.1400091b0
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x98], xmm0
mov qword [rsp + 0xa8], 0
lea rdx, [rsp + 0x98]
mov rcx, qword [rsp + 0x90]
call fcn.140004770
lea rax, str.C:UsersAdminDesktop_async_interface_assets_boost.asio_boost_asiodetail_throw_error.hpp
mov qword [rsp + 0x20], rax
lea rax, [0x1400119e4]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x30], 0x27
mov dword [rsp + 0x34], 5
mov rax, qword [rsp + 0xa8]
test al, 1
je 0x1400096c9
cmp rax, 1
jne 0x140009748
cmp dword [rsp + 0x98], 0
setne al
test al, al
jne 0x140009748
lea rcx, [rsp + 0x168]
call fcn.140009b70
lea rcx, [rsp + 0xc8]
call fcn.14000a8c0
nop
mov rax, qword [rsp + 0x80]
mov rbx, qword [rax + 0x30]
test rbx, rbx
je 0x140009707
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + ioctlsocket]
mov rbx, qword [rbx + 0x20]
test rbx, rbx
jne 0x1400096f5
mov eax, 0xffffffff
lock xadd dword [0x140019530], eax
cmp eax, 1
jne 0x14000971f
call qword [sym.imp.WS2_32.dll_WSACleanup]
lea rcx, [rsp + 0x80]
call fcn.140003a50
nop
xor eax, eax
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.14000e680
add rsp, 0x1e0
pop rbx
ret
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x98]
call fcn.1400037c0
int3
Function at 0x1400099b0
Capabilities:
Initialize winsock library

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x200
mov rax, qword [0x140018028]
xor rax, rsp
mov qword [rsp + 0x1f0], rax
movzx ebx, dl
mov rdi, rcx
mov eax, 1
lock xadd dword [0x140019530], eax
inc eax
cmp eax, 1
jne 0x1400099fd
lea ecx, [rax + 1]
lea rdx, [rsp + 0x50]
call qword [sym.imp.WS2_32.dll_WSAStartup]
xchg dword [0x140019534], eax
test bl, bl
je 0x140009aa1
xor ebx, ebx
lock xadd dword [0x140019534], ebx
test ebx, ebx
je 0x140009aa1
movabs rcx, 0x4d54ee85da812030
mov qword [rsp + 0x210], rsi
add rcx, qword [0x1400180c0]
lea rsi, [0x1400180b8]
mov dword [rsp + 0x3c], 0
cmp rcx, 1
jbe 0x140009a56
mov rax, qword [0x1400180b8]
mov edx, ebx
mov rcx, rsi
call qword [rax + 0x30]
jmp 0x140009a58
mov al, 1
lea rcx, str.C:UsersAdminDesktop_async_interface_assets_boost.asio_boost_asiodetail_throw_error.hpp
movzx eax, al
add rax, 2
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x40], rsi
lea rcx, str.throw_on_error
mov rsi, qword [rsp + 0x210]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], 0x30
mov dword [rsp + 0x34], 5
test al, 1
jne 0x140009ac5
mov rax, rdi
mov rcx, qword [rsp + 0x1f0]
xor rcx, rsp
call fcn.14000e680
mov rbx, qword [rsp + 0x218]
add rsp, 0x200
pop rdi
ret
lea r8, [rsp + 0x20]
lea rdx, str.winsock
lea rcx, [rsp + 0x38]
call fcn.140003800
int3
Function at 0x14000f280
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000f2ca
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000f2ca
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000f2ca
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000f2ca
cmp dword [rcx + 0x84], 0xe
jbe 0x14000f2ca
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000f2cc
xor al, al
add rsp, 0x28
ret
Function at 0x40349d
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push rdi
sub rsp, 0x3d0
mov rax, qword gs:[0x60]
xor r9d, r9d
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rdi, qword [rax + 0x30]
Function at 0x408763
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
push rbp
sub rsp, 0x228
mov r9, r8
movsxd rax, dword [rcx + 0x3c]
mov r8d, edx
mov rdi, rcx
mov r12d, r8d
mov r13, r9
mov r10d, dword [rax + rcx + 0x88]
mov edx, dword [r10 + rcx + 0x20]
mov eax, dword [r10 + rcx + 0x1c]
add rdx, rcx
mov r11d, dword [r10 + rcx + 0x24]
add rax, rcx
add r11, rcx
xor r10d, r10d
mov rbp, rax
mov rsi, rdx
mov rbx, r10
mov r14, r11
jmp 0x4087bd
inc rbx
mov r15d, dword [rsi + rbx*4]
add r15, rdi
cmp byte [r15], 0
je 0x40896d
mov edx, 0x208
lea rcx, [rsp + 0x20]
call fcn.00409343
mov rcx, r15
call fcn.0040871c
mov r10d, eax
test eax, eax
je 0x4088de
cmp eax, 6
jbe 0x40887b
mov r9d, eax
lea r8, [rsp + r9*2 + 0x20]
lea rdx, [r15 + r9]
sub r8, rdx
lea rcx, [r9 + r9]
cmp r8, rcx
jg 0x408819
neg r8
cmp r8, r9
jle 0x40887b
mov r9d, eax
xor r8d, r8d
mov ecx, 1
xor edx, edx
shr r9d, 1
je 0x408859
inc r8d
lea ecx, [rax + rdx]
movsx r10d, byte [rcx + r15]
lea r11d, [rax + rdx - 1]
mov word [rsp + rcx*2 + 0x20], r10w
add edx, 0xfffffffe
movsx ecx, byte [r11 + r15]
mov word [rsp + r11*2 + 0x20], cx
cmp r8d, r9d
jb 0x40882b
lea ecx, [r8 + r8 + 1]
lea edx, [rcx - 1]
cmp edx, eax
jae 0x408870
neg ecx
add ecx, eax
inc ecx
movsx edx, byte [rcx + r15]
mov word [rsp + rcx*2 + 0x20], dx
lea edx, [rax + 1]
sub eax, edx
lea r10d, [rax + 1]
jmp 0x4088de
mov r9d, eax
xor r8d, r8d
mov ecx, 1
xor edx, edx
shr r9d, 1
je 0x4088c5
inc r8d
lea ecx, [rax + rdx]
movsx r10d, byte [rcx + r15]
lea r11d, [rax + rdx - 1]
mov word [rsp + rcx*2 + 0x20], r10w
add edx, 0xfffffffe
movsx ecx, byte [r11 + r15]
mov word [rsp + r11*2 + 0x20], cx
cmp r8d, r9d
jb 0x40888d
lea r10d, [r8 + r8]
neg r10d
lea ecx, [r8 + r8 + 1]
add r10d, eax
lea edx, [rcx - 1]
cmp edx, eax
jae 0x4088de
sub eax, ecx
mov r10d, eax
lea edx, [rax + 1]
movsx ecx, byte [rdx + r15]
mov word [rsp + rdx*2 + 0x20], cx
lea rcx, [rsp + 0x20]
movsx r15d, byte [r10 + r15]
mov word [rsp + r10*2 + 0x20], r15w
call fcn.00408383
mov ecx, eax
xor r9d, r9d
test ecx, ecx
jbe 0x408956
mov eax, ecx
mov r10d, 1
mov r8d, dword [r13 + 0x104]
xor edx, edx
shr eax, 1
je 0x40893d
imul r9d, r8d
lea r15d, [rdx + rdx]
movsxd r15, r15d
inc edx
movzx r10d, word [rsp + r15*2 + 0x20]
add r9d, r10d
imul r9d, r8d
movzx r15d, word [rsp + r15*2 + 0x22]
add r9d, r15d
cmp edx, eax
jb 0x408911
lea r10d, [rdx + rdx + 1]
lea r15d, [r10 - 1]
cmp r15d, ecx
jae 0x408956
imul r8d, r9d
movsxd r10, r10d
movzx r9d, word [rsp + r10*2 + 0x1e]
add r9d, r8d
movzx r15d, word [r14 + rbx*2]
mov eax, dword [rbp + r15*4]
add rax, rdi
cmp r12d, r9d
je 0x408983
jmp 0x4087ba
xor eax, eax
add rsp, 0x228
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
add rsp, 0x228
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x4093c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x178
mov eax, 0x60
mov r14, qword [rcx + 0x10]
mov edx, dword [r14 + 0x54]
mov rax, qword gs:[rax]
mov rax, qword [rax + 0x18]
xor esi, esi
add rax, 0x10
xor edi, edi
mov rax, qword [rax]
mov rbp, qword [rax + 0x60]
test rbp, rbp
je 0x4093e3
test edx, edx
je 0x40943f
movzx r9d, word [rbp]
mov ebx, edi
mov rcx, rsi
test r9d, r9d
je 0x40942f
movzx r10d, word [rbp + rcx*2]
cmp r10d, 0x41
jl 0x40941a
cmp r10d, 0x5a
lea r9d, [r10 + 0x20]
cmovle r10d, r9d
inc rcx
movzx r9d, r10w
add ebx, r9d
movzx r10d, word [rbp + rcx*2]
test r10d, r10d
jne 0x409402
nop dword [rax + rax]
nop dword [rax]
cmp edx, ebx
jne 0x4093e3
mov rdi, qword [rax + 0x30]
mov eax, 0x60
mov edx, dword [r14 + 0x5c]
mov rax, qword gs:[rax]
mov rax, qword [rax + 0x18]
xor r9d, r9d
add rax, 0x10
xor r10d, r10d
mov rax, qword [rax]
mov rsi, qword [rax + 0x60]
test rsi, rsi
je 0x40945e
test edx, edx
je 0x4094b9
movzx r11d, word [rsi]
mov ebp, r10d
mov rbx, r9
test r11d, r11d
je 0x4094a9
movzx r12d, word [rsi + rbx*2]
cmp r12d, 0x41
jl 0x409495
cmp r12d, 0x5a
lea r11d, [r12 + 0x20]
cmovle r12d, r11d
inc rbx
movzx r11d, r12w
add ebp, r11d
movzx r12d, word [rsi + rbx*2]
test r12d, r12d
jne 0x40947d
nop dword [rax + rax]
nop dword [rax]
cmp edx, ebp
jne 0x40945e
mov rbp, qword [rax + 0x30]
mov rcx, rdi
mov r8, r14
mov edx, dword [r14 + 0x1c]
call fcn.00408763
mov rbx, rax
mov edx, 0x616
mov ecx, dword [r14 + 0xbc]
call rbx
mov r15, rax
mov rcx, rdi
mov r8, r14
mov qword [r15], r14
mov edx, dword [r14 + 0xa0]
call fcn.00408763
mov qword [r15 + 0xd0], rax
mov rcx, rdi
mov r8, r14
mov edx, dword [r14 + 0x64]
call fcn.00408763
mov qword [r15 + 0x88], rax
mov rcx, rdi
mov r8, r14
mov edx, dword [r14]
call fcn.00408763
mov qword [r15 + 0x90], rax
mov rcx, rdi
mov r8, r14
mov edx, dword [r14 + 0xe4]
call fcn.00408763
mov qword [r15 + 0xd8], rax
mov rcx, rdi
mov r8, r14
mov edx, dword [r14 + 0x118]
call fcn.00408763
mov qword [r15 + 0x38], rax
mov rcx, rdi
mov qword [r15 + 0x10], rbx
mov r8, r14
mov edx, dword [r14 + 0xfc]
call fcn.00408763
mov qword [r15 + 0xb8], rax
mov rcx, rbp
mov r8, r14
mov edx, dword [r14 + 0xf4]
Function at 0x409580
Capabilities:
Resolve function by parsing pe exports

Disassembly:
call fcn.00408763
mov qword [r15 + 0xa8], rax
mov rcx, rdi
mov r8, r14
mov edx, dword [r14 + 0x40]
call fcn.00408763
mov qword [r15 + 0x18], rax
mov rcx, rdi
mov qword [r15 + 0x70], rbp
mov r8, r14
mov edx, dword [r14 + 0x128]
call fcn.00408763
mov qword [r15 + 0x80], rax
mov rcx, rdi
mov r8, r14
mov edx, dword [r14 + 0x80]
call fcn.00408763
mov qword [r15 + 0x60], rax
mov rcx, rbp
mov r8, r14
mov edx, dword [r14 + 8]
call fcn.00408763
mov qword [r15 + 8], rax
mov rcx, rdi
mov qword [r15 + 0x58], rdi
mov r8, r14
mov edx, dword [r14 + 0x88]
call fcn.00408763
mov qword [r15 + 0x50], rax
mov rcx, rbp
mov r8, r14
mov edx, dword [r14 + 0xe8]
call fcn.00408763
mov qword [r15 + 0x30], rax
mov rcx, rdi
mov r8, r14
mov edx, dword [r14 + 0xa4]
call fcn.00408763
mov qword [r15 + 0x68], rax
mov rcx, rbp
mov r8, r14
mov edx, dword [r14 + 0x114]
call fcn.00408763
mov qword [r15 + 0x28], rax
mov rcx, rdi
mov r8, r14
mov edx, dword [r14 + 0xf8]
call fcn.00408763
mov qword [r15 + 0x78], rax
mov rcx, rdi
mov r8, r14
mov edx, dword [r14 + 0x10c]
call fcn.00408763
mov qword [r15 + 0x48], rax
mov rax, qword [r15]
mov edx, dword [rax + 0xf0]
mov ecx, dword [rax + 0xbc]
call qword [r15 + 0x10]
mov rbp, rax
mov rax, qword [r15]
mov edx, 0x1b
mov ecx, dword [rax + 0xbc]
call qword [r15 + 0x10]
mov rbx, rax
mov rcx, rbx
lea rdx, [r14 + 0xd8]
mov r8d, 3
call fcn.004086b3
mov rcx, rbx
call fcn.0040871c
mov sil, byte [r14 + 0xb8]
mov rcx, rbx
mov eax, eax
mov byte [rax + rbx], sil
mov r10b, byte [r14 + 0xb9]
mov byte [rax + rbx + 1], r10b
mov r11b, byte [r14 + 0xba]
mov byte [rax + rbx + 2], r11b
mov r12b, byte [r14 + 0xbb]
mov byte [rax + rbx + 3], r12b
call fcn.0040871c
mov sil, byte [r14 + 0x24]
mov rcx, rbx
mov eax, eax
mov byte [rax + rbx], sil
mov r10b, byte [r14 + 0x25]
mov byte [rax + rbx + 1], r10b
mov r11b, byte [r14 + 0x26]
mov byte [rax + rbx + 2], r11b
mov r12b, byte [r14 + 0x27]
mov byte [rax + rbx + 3], r12b
call fcn.0040871c
mov r12d, eax
mov eax, r12d
test r12d, r12d
je 0x40982a
cmp r12d, 6
jbe 0x4097c2
mov r13d, r12d
lea r11, [rbp + r13*2]
lea rsi, [rbx + r13]
sub r11, rsi
lea r10, [r13 + r13]
cmp r11, r10
jg 0x409755
neg r11
cmp r11, r13
jle 0x4097c2
xor r10d, r10d
mov eax, r12d
mov r11d, 1
xor esi, esi
shr eax, 1
je 0x409796
inc r10d
lea r11d, [r12 + rsi]
movsx r13d, byte [r11 + rbx]
mov word [rbp + r11*2], r13w
lea r11d, [r12 + rsi - 1]
movsx r13d, byte [r11 + rbx]
add esi, 0xfffffffe
mov word [rbp + r11*2], r13w
cmp r10d, eax
jb 0x409767
lea r11d, [r10 + r10 + 1]
lea eax, [r11 - 1]
cmp eax, r12d
jae 0x4097b3
neg r11d
add r11d, r12d
inc r11d
movsx eax, byte [r11 + rbx]
mov word [rbp + r11*2], ax
lea eax, [r12 + 1]
sub r12d, eax
lea eax, [r12 + 1]
jmp 0x40982a
xor r11d, r11d
mov r10d, r12d
mov r13d, 1
xor esi, esi
shr r10d, 1
je 0x40980d
Function at 0x4167a0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41694b
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00431960
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
nop
jne 0x41680e
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x416821
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x416845
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x416859
cmp rbx, 0x1000
jae 0x416818
nop
jmp 0x4168c9
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop
cmp rbx, 0x1000
jae 0x41686d
xor edx, edx
jmp 0x4168c0
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00431960
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
nop
test dl, dl
jne 0x41684f
jmp 0x416835
call fcn.0045ffe0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.00435cc0
lea rax, [0x004f9fa3]
mov ebx, 0x18
nop dword [rax + rax]
call fcn.004365c0
mov rax, qword [rsp + 0x38]
call fcn.004362c0
lea rax, [0x004fa04b]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.004365c0
mov rax, qword [rsp + 0x30]
call fcn.004362c0
call fcn.00435f20
call fcn.00435d40
lea rax, [0x004fcf12]
mov ebx, 0x21
call fcn.00434520
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045c480
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004167a0
Function at 0x416980
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x416baa
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.004319e0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x4169fb
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x416a0e
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x416a30
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x416a44
cmp rbx, 0x1000
jae 0x416a05
jmp 0x416ace
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x416a56
xor esi, esi
jmp 0x416ac0
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
nop dword [rax]
call fcn.004319e0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
test sil, sil
jne 0x416a3a
jmp 0x416a22
call fcn.0045ffe0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x416b49
call fcn.00435cc0
lea rax, [0x004fa68b]
mov ebx, 0x19
call fcn.004365c0
mov rax, qword [rsp + 0x68]
call fcn.004362c0
lea rax, [0x004fa04b]
mov ebx, 0x19
nop
call fcn.004365c0
mov eax, dword [rsp + 0x34]
call fcn.004362c0
call fcn.00435f20
call fcn.00435d40
lea rax, [0x004f6281]
mov ebx, 0xd
call fcn.00434520
cmp eax, 0x5af
je 0x416af3
call fcn.00435cc0
lea rax, [0x004fa68b]
mov ebx, 0x19
call fcn.004365c0
mov rax, qword [rsp + 0x38]
call fcn.004362c0
lea rax, [0x004fa04b]
mov ebx, 0x19
nop dword [rax]
call fcn.004365c0
mov eax, dword [rsp + 0x34]
call fcn.004362c0
call fcn.00435f20
call fcn.00435d40
lea rax, [0x004fc67e]
mov ebx, 0x1f
call fcn.00434520
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045c480
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00416980
Function at 0x41e860
Capabilities:
Hash data using murmur3

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
cmp byte [0x0061a031], 0
jne 0x41e94f
nop
nop
nop
nop
sub rbx, qword [rax + 0x18]
nop
mov edx, dword [rax + 0x5c]
imul rbx, rdx
mov rdx, rbx
shr rbx, 0x20
nop
shr rdx, 0x23
and ebx, 7
mov rsi, rcx
mov rcx, rbx
mov edi, 1
shl edi, cl
nop
add rdx, qword [rax + 0x50]
lock or byte [rdx], dil
nop
nop
mov rcx, qword [rax + 0x18]
nop
movabs rdx, 0x800000000000
lea rax, [rdx + rcx]
mov rdx, rax
shr rax, 0x2a
cmp rax, 0x40
jae 0x41e945
lea rbx, [0x005ec490]
mov rax, qword [rbx + rax*8]
shr rdx, 0x16
and edx, 0xfffff
mov rdx, qword [rax + rdx*8]
test byte [rdx], al
test byte [rax], al
mov rax, rcx
shr rcx, 0x10
and ecx, 0x3f
movzx ebx, byte [rdx + rcx + 0x21040]
lea rdx, [rdx + rcx]
lea rdx, [rdx + 0x21040]
shr rax, 0xd
and eax, 7
mov rcx, rax
mov eax, 1
shl eax, cl
nop dword [rax]
test al, bl
jne 0x41e927
lock or byte [rdx], al
mov rax, qword [r14 + 0x30]
mov rax, qword [rax + 0xa0]
test byte [rax], al
add qword [rax + 0x1248], rsi
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov ecx, 0x40
call fcn.0045eb80
lea rax, [0x004feddb]
mov ebx, 0x2c
nop dword [rax + rax]
call fcn.00434520
nop
int3
Function at 0x42da80
Capabilities:
Hash data using murmur3

Disassembly:
cmp rsp, qword [r14 + 0x18]
jbe 0x42dd26
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
test byte [rax], al
lea rsi, [rax + 0x1270]
mov rcx, qword [rax + 0x1260]
sub rcx, rsi
shr rcx, 3
cmp rcx, 0x200
ja 0x42dd1a
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x30], rcx
mov qword [rax + 0x1260], 0
cmp byte [0x0061a031], 0
jne 0x42dae2
xor edx, edx
xor ebx, ebx
nop
jmp 0x42db2b
xor edx, edx
jmp 0x42db0e
mov qword [rsp + 0x28], rdx
mov rcx, qword [rax + rdx*8 + 0x1270]
mov rax, rcx
call fcn.0041e080
mov rcx, qword [rsp + 0x28]
lea rdx, [rcx + 1]
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
cmp rdx, rcx
jl 0x42dae6
add rax, 0x1260
call fcn.0042d900
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
inc rdx
cmp rdx, rcx
jge 0x42dcb2
mov rsi, qword [rax + rdx*8 + 0x1270]
nop dword [rax]
cmp rsi, 0x1000
jb 0x42db28
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rbx
mov rax, rsi
xor ebx, ebx
mov rcx, rbx
nop dword [rax + rax]
call fcn.00412c20
test rax, rax
jne 0x42db82
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
nop
jmp 0x42db28
nop
mov rsi, rcx
shr rcx, 3
and esi, 7
mov rdx, rcx
mov rcx, rsi
mov r8d, 1
shl r8d, cl
nop
add rdx, qword [rbx + 0x50]
movzx esi, byte [rdx]
test r8b, sil
je 0x42dbc5
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
nop dword [rax]
jmp 0x42db28
nop
lock or byte [rdx], r8b
nop
nop
mov rcx, qword [rbx + 0x18]
nop
movabs rsi, 0x800000000000
lea r8, [rsi + rcx]
mov r9, r8
shr r8, 0x2a
cmp r8, 0x40
jae 0x42dd0d
lea r10, [0x005ec490]
mov r8, qword [r10 + r8*8]
shr r9, 0x16
and r9d, 0xfffff
mov r9, qword [r8 + r9*8]
test byte [r9], al
test byte [r8], al
mov r8, rcx
shr rcx, 0x10
and ecx, 0x3f
movzx r10d, byte [r9 + rcx + 0x21040]
lea r9, [r9 + rcx]
lea r9, [r9 + 0x21040]
shr r8, 0xd
and r8d, 7
mov rcx, r8
mov r8d, 1
shl r8d, cl
test r8b, r10b
jne 0x42dc4b
lock or byte [r9], r8b
movzx r8d, byte [rbx + 0x62]
test r8b, 1
je 0x42dc85
mov r8, qword [rsp + 0x48]
mov r9, qword [r8 + 0x1248]
add r9, qword [rbx + 0x68]
mov qword [r8 + 0x1248], r9
mov rax, r8
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
nop
jmp 0x42db28
mov r8, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
cmp r8, rcx
jae 0x42dd05
mov r9, qword [rsp + 0x48]
mov qword [r9 + r8*8 + 0x1270], rax
lea rbx, [r8 + 1]
mov rax, r9
mov rdx, qword [rsp + 0x28]
jmp 0x42db28
cmp rbx, 0x200
ja 0x42dcf7
lea rdx, [rax + 0x1270]
lea rsi, [rax + 0x1238]
mov rcx, rbx
mov edi, 0x200
mov rbx, rdx
mov rax, rsi
call fcn.00423ca0
mov rdx, qword [rsp + 0x48]
lea rax, [rdx + 0x1260]
call fcn.0042d900
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov rcx, rbx
mov edx, 0x200
nop
call fcn.0045ebe0
mov rax, r8
call fcn.0045eb60
mov rax, r8
mov ecx, 0x40
call fcn.0045eb80
mov edx, 0x200
nop
call fcn.0045ebc0
nop
mov qword [rsp + 8], rax
call fcn.00460b80
mov rax, qword [rsp + 8]
jmp fcn.0042da80
Function at 0x44d660
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov qword [rsp + 0x20], rax
test rbx, rbx
jbe 0x44d7d8
movzx edx, byte [rax]
nop
test edx, edx
jne 0x44d69c
test r8b, r8b
jne 0x44d69c
xor eax, eax
xor ebx, ebx
mov rcx, rbx
xor edi, edi
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
bt edx, 7
jae 0x44d6af
xor edx, edx
xor r8d, r8d
xor r9d, r9d
jmp 0x44d798
mov r8d, 1
mov r9d, edx
and edx, 1
neg edx
shr r9d, 1
xor edx, r9d
add dword [rsi], edx
cmp rbx, r8
jb 0x44d786
sub rbx, r8
sub rcx, r8
mov rdx, rcx
neg rcx
sar rcx, 0x3f
and r8, rcx
lea rsi, [rax + r8]
test rbx, rbx
jbe 0x44d77c
movzx r8d, byte [rax + r8]
bt r8d, 7
jae 0x44d703
xor eax, eax
xor ecx, ecx
xor r8d, r8d
jmp 0x44d746
mov eax, 1
cmp rax, rbx
ja 0x44d735
add qword [rdi], r8
sub rdx, rax
sub rbx, rax
mov rcx, rdx
neg rdx
sar rdx, 0x3f
and rax, rdx
add rax, rsi
mov edi, 1
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov rcx, rbx
call fcn.0045ec20
lea r8d, [rcx + 7]
mov ecx, eax
mov eax, r10d
cmp rax, rbx
jae 0x44d774
movzx r9d, byte [rax + rsi]
lea r10d, [rax + 1]
mov r11d, r9d
and r9d, 0x7f
mov eax, ecx
mov ecx, r8d
shl r9d, cl
or eax, r9d
test r11b, 0x80
jne 0x44d73d
mov r8d, eax
mov eax, r10d
jmp 0x44d708
mov rcx, rbx
call fcn.0045eb60
xor eax, eax
mov rcx, rbx
call fcn.0045eb60
mov eax, r8d
mov rcx, rbx
call fcn.0045ec20
lea r9d, [rcx + 7]
mov rcx, r12
cmp rbx, rdx
jbe 0x44d7ce
movzx r10d, byte [rdx + rax]
inc edx
mov r11d, r10d
and r10d, 0x7f
mov r12, rcx
mov ecx, r9d
shl r10d, cl
or r8d, r10d
test r11b, 0x80
jne 0x44d791
mov rcx, r12
mov r9d, edx
mov edx, r8d
mov r8d, r9d
jmp 0x44d6b5
mov eax, edx
mov rcx, rbx
call fcn.0045eb60
xor eax, eax
mov rcx, rbx
nop dword [rax]
call fcn.0045eb60
nop
int3
Function at 0x455020
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4550db
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov qword [rsp + 0x70], rbx
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rdx, [0x00455120]
mov qword [rsp + 0x10], rdx
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x18], rdx
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x20], rdx
mov rdx, r14
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rdi
lea rax, [rsp + 8]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.0045c340
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.0045c480
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00455020