joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401f4f89
Capabilities:
Encode data using xor

Disassembly:
test r8, r8
je 0x1401f517a
push rbx
mov eax, 0xd0
call fcn.140221db0
sub rsp, rax
mov rax, qword [0x140329490]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xe8], rbp
mov rbx, rdx
mov qword [rsp + 0xf0], rsi
lea rbp, [r8 - 1]
mov qword [rsp + 0xf8], rdi
mov qword [rsp + 0xc8], r14
lea r14, [rcx + 0xc]
shr rbp, 3
mov qword [rsp + 0xc0], r15
inc rbp
lea r15, [rcx + 0x14]
nop word [rax + rax]
movzx eax, byte [rbx + 1]
mov rcx, r14
movzx edi, byte [rbx]
movzx esi, byte [rbx + 4]
lea rbx, [rbx + 8]
shl eax, 8
or edi, eax
movzx eax, byte [rbx - 6]
shl eax, 0x10
or edi, eax
movzx eax, byte [rbx - 5]
shl eax, 0x18
or edi, eax
movzx eax, byte [rbx - 3]
shl eax, 8
or esi, eax
mov dword [rsp + 0x20], edi
movzx eax, byte [rbx - 2]
shl eax, 0x10
or esi, eax
mov dword [rsp + 0x28], edi
movzx eax, byte [rbx - 1]
and byte [r14], 0xdf
and byte [r15], 0xbf
or byte [r14], 0x40
or byte [r15], 0x20
shl eax, 0x18
or esi, eax
mov dword [rsp + 0x24], esi
mov dword [rsp + 0x2c], esi
call fcn.1401867b0
lea rdx, [rsp + 0x30]
mov rcx, r14
call fcn.140186150
mov r8d, 1
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x28]
call fcn.140182e90
mov rcx, r15
call fcn.1401867b0
lea rdx, [rsp + 0x30]
mov rcx, r15
call fcn.140186150
mov r8d, 1
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
call fcn.140182e90
mov r8d, dword [rsp + 0x20]
mov edx, dword [rsp + 0x24]
xor r8d, edi
xor edi, dword [rsp + 0x28]
xor edx, esi
xor esi, dword [rsp + 0x2c]
mov eax, edi
mov byte [r14], dil
shr eax, 8
mov byte [r14 + 1], al
mov eax, edi
shr eax, 0x10
mov byte [r14 + 2], al
mov eax, edx
shr eax, 8
shr edi, 0x18
mov byte [r14 + 3], dil
mov byte [r14 + 4], dl
mov byte [r14 + 5], al
mov eax, edx
shr eax, 0x10
mov byte [r14 + 6], al
mov eax, r8d
shr eax, 8
shr edx, 0x18
mov byte [r14 + 7], dl
mov byte [r15], r8b
mov byte [r15 + 1], al
mov eax, r8d
shr eax, 0x10
mov byte [r15 + 2], al
shr r8d, 0x18
mov byte [r15 + 3], r8b
mov byte [r15 + 4], sil
mov eax, esi
shr eax, 8
mov byte [r15 + 5], al
mov eax, esi
shr eax, 0x10
shr esi, 0x18
mov byte [r15 + 6], al
mov byte [r15 + 7], sil
sub rbp, 1
jne 0x1401f4ff0
mov r15, qword [rsp + 0xc0]
mov r14, qword [rsp + 0xc8]
mov rdi, qword [rsp + 0xf8]
mov rsi, qword [rsp + 0xf0]
mov rbp, qword [rsp + 0xe8]
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.140220f90
add rsp, 0xd0
pop rbx
ret
Function at 0x1402076c0
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x90
mov rax, qword [0x140329490]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov edi, dword [rcx]
mov ecx, dword [0x140337550]
mov rax, qword gs:[0x58]
mov esi, 0x1008
mov r14d, 0x1000
add rsi, qword [rax + rcx*8]
add r14, qword [rax + rcx*8]
movups xmm1, xmmword [rsi]
mov ebx, dword [r14]
movups xmm0, xmmword [rsi + 0x10]
movd ecx, xmm1
movups xmmword [rsp + 0x60], xmm1
movups xmmword [rsp + 0x70], xmm0
cmp ecx, edi
je 0x1402077d3
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x20]
call fcn.1402090f0
movups xmm0, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm0
cmp dword [rax], edi
jne 0x140207760
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
lea eax, [rbx + 1]
movups xmmword [rsi], xmm0
mov dword [r14], eax
movups xmmword [rsi + 0x10], xmm1
jmp 0x1402077d5
xor eax, eax
mov qword [rsp + 0x20], rax
xor ebx, ebx
mov qword [rsp + 0x28], rax
movups xmm0, xmmword [rsp + 0x20]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
movups xmm1, xmmword [rsp + 0x30]
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm1
nop dword [rax]
movd eax, xmm0
cmp eax, edi
je 0x1402077c9
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x40]
call fcn.1402090f0
inc ebx
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x60], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x70], xmm1
cmp ebx, 0x7530
jl 0x140207790
mov eax, 0xffffffff
jmp 0x1402077d5
movups xmmword [rsi], xmm0
mov dword [r14], ebx
movups xmmword [rsi + 0x10], xmm1
mov eax, ebx
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140220f90
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop r14
ret
Function at 0x1402090f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x110
mov rax, qword [0x140329490]
xor rax, rsp
mov qword [rsp + 0x100], rax
mov rbx, rdx
mov qword [rsp + 0x20], 0
mov rdi, rcx
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0xc8
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x30]
mov edx, 4
nop word [rax + rax]
mov r8, qword [rbx]
lea rbx, [rbx + 8]
xor qword [rax], r8
lea rax, [rax + 8]
sub rdx, 1
jne 0x140209140
mov byte [rsp + 0x20], 1
mov rcx, qword [rsp + 0x20]
xor qword [rax], rcx
movabs rax, 0x8000000000000000
xor qword [rsp + 0xb0], rax
lea rcx, [rsp + 0x30]
call fcn.140209c80
mov rax, qword [rsp + 0x30]
mov qword [rdi], rax
mov rax, qword [rsp + 0x38]
mov qword [rdi + 8], rax
mov rax, qword [rsp + 0x40]
mov qword [rdi + 0x10], rax
mov rax, qword [rsp + 0x48]
mov qword [rdi + 0x18], rax
mov rax, rdi
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.140220f90
mov rbx, qword [rsp + 0x120]
add rsp, 0x110
pop rdi
ret
Function at 0x1402091d0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x10]
sub rsp, 0x110
mov rax, qword [0x140329490]
xor rax, rsp
mov qword [rbp], rax
mov rsi, r8
mov qword [rsp + 0x20], 0
mov rbx, rdx
lea r15, [rsp + 0x20]
mov r14, rcx
xor edx, edx
mov r8d, 0xc8
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memset
cmp rsi, 0x48
jb 0x1402092a9
movabs rax, 0xe38e38e38e38e38f
mul rsi
mov rdi, rdx
shr rdi, 6
mov rax, qword [rbx]
lea rcx, [rsp + 0x30]
xor qword [rsp + 0x30], rax
mov rax, qword [rbx + 8]
xor qword [rsp + 0x38], rax
mov rax, qword [rbx + 0x10]
xor qword [rsp + 0x40], rax
mov rax, qword [rbx + 0x18]
xor qword [rsp + 0x48], rax
mov rax, qword [rbx + 0x20]
xor qword [rsp + 0x50], rax
mov rax, qword [rbx + 0x28]
xor qword [rsp + 0x58], rax
mov rax, qword [rbx + 0x30]
xor qword [rsp + 0x60], rax
mov rax, qword [rbx + 0x38]
xor qword [rsp + 0x68], rax
mov rax, qword [rbx + 0x40]
add rbx, 0x48
xor qword [rsp + 0x70], rax
call fcn.140209c80
sub rsi, 0x48
sub rdi, 1
jne 0x140209241
lea rdi, [rsp + 0x30]
cmp rsi, 8
jb 0x1402092d6
mov rcx, rsi
shr rcx, 3
imul rax, rcx, 0xfffffffffffffff8
add rsi, rax
mov rax, qword [rbx]
add rbx, 8
xor qword [rdi], rax
add rdi, 8
sub rcx, 1
jne 0x1402092c2
test rsi, rsi
je 0x1402092f3
mov r8, rsi
lea rcx, [rsp + 0x20]
mov rdx, rbx
call sub.VCRUNTIME140.dll_memcpy
lea r15, [rsp + 0x20]
add r15, rsi
mov byte [r15], 1
lea rcx, [rsp + 0x30]
mov rax, qword [rsp + 0x20]
xor qword [rdi], rax
movabs rax, 0x8000000000000000
xor qword [rsp + 0x70], rax
call fcn.140209c80
mov rax, qword [rsp + 0x30]
mov qword [r14], rax
mov rax, qword [rsp + 0x38]
mov qword [r14 + 8], rax
mov rax, qword [rsp + 0x40]
mov qword [r14 + 0x10], rax
mov rax, qword [rsp + 0x48]
mov qword [r14 + 0x18], rax
mov rax, qword [rsp + 0x50]
mov qword [r14 + 0x20], rax
mov rax, qword [rsp + 0x58]
mov qword [r14 + 0x28], rax
mov rax, qword [rsp + 0x60]
mov qword [r14 + 0x30], rax
mov rax, qword [rsp + 0x68]
mov qword [r14 + 0x38], rax
mov rax, r14
mov rcx, qword [rbp]
xor rcx, rsp
call fcn.140220f90
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x140209390
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x110
mov rax, qword [0x140329490]
xor rax, rsp
mov qword [rsp + 0x100], rax
mov rbx, rdx
mov qword [rsp + 0x20], 0
mov rdi, rcx
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0xc8
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x30]
mov edx, 8
nop word [rax + rax]
mov r8, qword [rbx]
lea rbx, [rbx + 8]
xor qword [rax], r8
lea rax, [rax + 8]
sub rdx, 1
jne 0x1402093e0
mov byte [rsp + 0x20], 1
mov rcx, qword [rsp + 0x20]
xor qword [rax], rcx
movabs rax, 0x8000000000000000
xor qword [rsp + 0x70], rax
lea rcx, [rsp + 0x30]
call fcn.140209c80
mov rax, qword [rsp + 0x30]
mov qword [rdi], rax
mov rax, qword [rsp + 0x38]
mov qword [rdi + 8], rax
mov rax, qword [rsp + 0x40]
mov qword [rdi + 0x10], rax
mov rax, qword [rsp + 0x48]
mov qword [rdi + 0x18], rax
mov rax, qword [rsp + 0x50]
mov qword [rdi + 0x20], rax
mov rax, qword [rsp + 0x58]
mov qword [rdi + 0x28], rax
mov rax, qword [rsp + 0x60]
mov qword [rdi + 0x30], rax
mov rax, qword [rsp + 0x68]
mov qword [rdi + 0x38], rax
mov rax, rdi
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.140220f90
mov rbx, qword [rsp + 0x120]
add rsp, 0x110
pop rdi
ret
Function at 0x14020b580
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rsi
mov ecx, dword [0x140329410]
cmp ecx, 0xffffffff
jne 0x14020b5a8
xor esi, esi
jmp 0x14020b5b1
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
mov qword [rsp + 0x40], rsi
test rsi, rsi
je 0x14020b5f5
mov rcx, qword [rsi + 0x30]
nop
mov rdi, qword [rsi + 0x18]
test rcx, rcx
jne 0x14020b637
test rdi, rdi
jne 0x14020b640
lea rdx, [0x14020ab60]
lea rcx, [0x140335200]
call fcn.14020a940
mov ecx, dword [0x140329410]
cmp ecx, 0xffffffff
je 0x14020b5f5
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
test rsi, rsi
je 0x14020b627
mov eax, 0xffffffff
lock xadd dword [rsi + 8], eax
cmp eax, 1
jne 0x14020b627
mov rax, qword [rsi]
xor edx, edx
mov rcx, rsi
call qword [rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
test rdi, rdi
je 0x14020b698
nop dword [rax]
mov rax, qword [rdi + 8]
mov qword [rsi + 0x18], rax
mov rcx, qword [rdi]
test rcx, rcx
je 0x14020b677
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov rbx, qword [rdi]
mov rax, qword [rbx]
xor edx, edx
mov rcx, rbx
call qword [rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rdi, qword [rsi + 0x18]
test rdi, rdi
jne 0x14020b640
mov rcx, qword [rsi + 0x30]
test rcx, rcx
je 0x14020b5c0
nop dword [rax]
nop word [rax + rax]
mov rbx, qword [rsi + 0x28]
mov rbx, qword [rbx]
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x14020b6cc
mov rdx, qword [rbx + 0x38]
test rdx, rdx
je 0x14020b6cc
call qword [rbx + 0x28]
mov rax, rbx
mov rcx, qword [rbx + 0x10]
cmp byte [rcx + 0x19], 0
je 0x14020b6f8
mov rcx, qword [rbx + 8]
cmp byte [rcx + 0x19], 0
jne 0x14020b70d
cmp rax, qword [rcx + 0x10]
jne 0x14020b70d
mov rax, rcx
mov rcx, qword [rcx + 8]
cmp byte [rcx + 0x19], 0
je 0x14020b6e3
jmp 0x14020b70d
mov rcx, qword [rcx]
cmp byte [rcx + 0x19], 0
jne 0x14020b70d
mov rax, qword [rcx]
mov rcx, rax
cmp byte [rax + 0x19], 0
je 0x14020b701
mov rdx, rbx
lea rcx, [rsi + 0x28]
call fcn.1400370b0
mov edx, 0x40
mov rcx, rax
call fcn.1402216cc
mov rcx, qword [rsi + 0x30]
test rcx, rcx
jne 0x14020b6b0
jmp 0x14020b5c0
Function at 0x14020b740
Capabilities:
Create thread
Resume thread

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov r9, qword [rcx]
lea r8, [0x14020b7d0]
mov rdi, rcx
xor edx, edx
xor ecx, ecx
lea rax, [r9 + 0x20]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov rsi, rax
test rax, rax
jne 0x14020b785
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov rax, qword [rdi]
mov qword [rsp + 0x40], rbx
lock inc dword [rax + 8]
mov rbx, qword [rdi]
mov rcx, qword [rbx + 0x10]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14020b7a8
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x10], rsi
mov rcx, qword [rdi]
mov rcx, qword [rcx + 0x10]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rbx, qword [rsp + 0x40]
mov al, 1
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x14020dfd0
Capabilities:
Hash data using fnv

Disassembly:
sub rsp, 0x18
mov rax, qword [0x140329490]
xor rax, rsp
mov qword [rsp + 8], rax
mov r10, r9
mov r9d, edx
mov r11, rcx
test edx, edx
jne 0x14020e004
xor eax, eax
mov rcx, qword [rsp + 8]
xor rcx, rsp
call fcn.140220f90
add rsp, 0x18
ret
mov rcx, qword [r8]
mov qword [rsp], rcx
movzx eax, cl
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [rsp + 1]
xor edx, eax
movzx eax, byte [rsp + 2]
imul r8d, edx, 0x1000193
xor r8d, eax
movzx eax, byte [rsp + 3]
imul edx, r8d, 0x1000193
xor edx, eax
movzx eax, byte [rsp + 4]
imul r8d, edx, 0x1000193
xor r8d, eax
movzx eax, byte [rsp + 5]
imul edx, r8d, 0x1000193
xor edx, eax
movzx eax, byte [rsp + 6]
imul r8d, edx, 0x1000193
xor r8d, eax
movzx eax, byte [rsp + 7]
imul edx, r8d, 0x1000193
xor edx, eax
imul r8d, edx, 0x1000193
xor edx, edx
mov eax, r8d
div r9d
mov rax, qword [r11 + rdx*8]
lea rdx, [r11 + rdx*8]
test rax, rax
je 0x14020e0a4
cmp qword [rax + 8], rcx
je 0x14020e0a4
mov rdx, rax
mov rax, qword [rax]
test rax, rax
jne 0x14020e093
test r10, r10
je 0x14020e0ac
mov dword [r10], r8d
mov rax, rdx
mov rcx, qword [rsp + 8]
xor rcx, rsp
call fcn.140220f90
add rsp, 0x18
ret
Function at 0x14020e800
Capabilities:
Encode data using xor

Disassembly:
test r8, r8
je 0x14020e936
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
mov qword [rsp + 0x10], rbp
mov rdi, r8
lea rbp, str._.C
mov rsi, rdx
mov r11, rcx
xor ebx, ebx
nop dword [rax + rax]
movzx r8d, byte [rbx + rsi]
movzx r10d, byte [r11 + 0x40]
movzx eax, r8b
xor al, byte [r11 + r10]
lea r9, [r11 + r10]
mov byte [r9 + 0x20], al
mov ecx, r8d
mov byte [r9 + 0x10], r8b
movzx eax, byte [r11 + 0x41]
xor rcx, rax
movzx eax, byte [r9 + 0x30]
movzx edx, byte [rcx + rbp]
xor edx, eax
lea eax, [r10 + 1]
and eax, 0xf
mov byte [r9 + 0x30], dl
mov byte [r11 + 0x41], dl
mov byte [r11 + 0x40], al
test al, al
jne 0x14020e91a
xor dl, dl
xor r8b, r8b
nop dword [rax]
nop dword [rax + rax]
lea rax, [r11 + 1]
mov r9d, 8
nop word [rax + rax]
movzx ecx, dl
lea rax, [rax + 6]
movzx edx, byte [rcx + rbp]
movzx ecx, byte [rax - 7]
xor edx, ecx
movzx ecx, dl
mov byte [rax - 7], dl
movzx edx, byte [rcx + rbp]
movzx ecx, byte [rax - 6]
xor edx, ecx
movzx ecx, dl
mov byte [rax - 6], dl
movzx edx, byte [rcx + rbp]
movzx ecx, byte [rax - 5]
xor edx, ecx
movzx ecx, dl
mov byte [rax - 5], dl
movzx edx, byte [rcx + rbp]
movzx ecx, byte [rax - 4]
xor edx, ecx
movzx ecx, dl
mov byte [rax - 4], dl
movzx edx, byte [rcx + rbp]
movzx ecx, byte [rax - 3]
xor edx, ecx
movzx ecx, dl
mov byte [rax - 3], dl
movzx edx, byte [rcx + rbp]
movzx ecx, byte [rax - 2]
xor edx, ecx
mov byte [rax - 2], dl
sub r9, 1
jne 0x14020e8a0
add dl, r8b
inc r8b
cmp r8b, 0x12
jb 0x14020e890
inc rbx
cmp rbx, rdi
jb 0x14020e830
mov rbp, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
pop rdi
ret

Function at 0x14020e940
Capabilities:
Encode data using xor

Disassembly:
movzx r9d, byte [rcx + 0x40]
lea r11, str._.C
lea r8, [rcx + r9]
movzx eax, dl
mov byte [r8 + 0x10], dl
mov r10, rcx
xor al, byte [r8]
mov byte [r8 + 0x20], al
movzx eax, byte [rcx + 0x41]
movzx edx, dl
xor rdx, rax
movzx eax, byte [r8 + 0x30]
movzx ecx, byte [rdx + r11]
xor ecx, eax
lea eax, [r9 + 1]
and eax, 0xf
mov byte [r8 + 0x30], cl
mov byte [r10 + 0x41], cl
mov byte [r10 + 0x40], al
test al, al
jne 0x14020ea30
xor dl, dl
xor r8b, r8b
nop word [rax + rax]
lea rax, [r10 + 1]
mov r9d, 8
nop word [rax + rax]
movzx ecx, dl
lea rax, [rax + 6]
movzx edx, byte [rcx + r11]
movzx ecx, byte [rax - 7]
xor edx, ecx
movzx ecx, dl
mov byte [rax - 7], dl
movzx edx, byte [rcx + r11]
movzx ecx, byte [rax - 6]
xor edx, ecx
movzx ecx, dl
mov byte [rax - 6], dl
movzx edx, byte [rcx + r11]
movzx ecx, byte [rax - 5]
xor edx, ecx
movzx ecx, dl
mov byte [rax - 5], dl
movzx edx, byte [rcx + r11]
movzx ecx, byte [rax - 4]
xor edx, ecx
movzx ecx, dl
mov byte [rax - 4], dl
movzx edx, byte [rcx + r11]
movzx ecx, byte [rax - 3]
xor edx, ecx
movzx ecx, dl
mov byte [rax - 3], dl
movzx edx, byte [rcx + r11]
movzx ecx, byte [rax - 2]
xor edx, ecx
mov byte [rax - 2], dl
sub r9, 1
jne 0x14020e9b0
add dl, r8b
inc r8b
cmp r8b, 0x12
jb 0x14020e9a0
ret
Function at 0x14021ed30
Capabilities:
Query environment variable

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, r8
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov ecx, eax
test eax, eax
jne 0x14021ed4e
or eax, 0xffffffff
add rsp, 0x20
pop rbx
ret
xor edx, edx
cmp rcx, rbx
cmovb ecx, edx
mov eax, ecx
add rsp, 0x20
pop rbx
ret
Function at 0x415b80
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x415d26
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00431ca0
xorps xmm15, xmm15
mov r14, qword [0x00612858]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x415beb
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x415c00
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
nop
test rbx, rbx
jbe 0x415c25
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x415c39
cmp rbx, 0x1000
jae 0x415bf5
nop dword [rax]
jmp 0x415ca9
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop
cmp rbx, 0x1000
jae 0x415c4d
xor edx, edx
jmp 0x415ca0
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00431ca0
xorps xmm15, xmm15
mov r14, qword [0x00612858]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
nop dword [rax]
test dl, dl
jne 0x415c2f
jmp 0x415c14
call fcn.00461800
xorps xmm15, xmm15
mov r14, qword [0x00612858]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.004361e0
lea rax, [0x004f42dc]
mov ebx, 0x18
call fcn.00436ae0
mov rax, qword [rsp + 0x38]
call fcn.004367e0
lea rax, [0x004f43b4]
mov ebx, 0x19
call fcn.00436ae0
mov rax, qword [rsp + 0x30]
nop
call fcn.004367e0
call fcn.00436440
call fcn.00436260
lea rax, [0x004f714a]
mov ebx, 0x21
nop dword [rax + rax]
call fcn.004348a0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045dc60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.00415b80
Function at 0x415d60
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x415f8a
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.00431d20
xorps xmm15, xmm15
mov r14, qword [0x00612858]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x415dd9
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x415dec
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x415e10
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
nop
jmp 0x415e24
cmp rbx, 0x1000
jae 0x415de3
jmp 0x415ea5
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x415e36
xor esi, esi
jmp 0x415e96
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
nop dword [rax]
call fcn.00431d20
xorps xmm15, xmm15
mov r14, qword [0x00612858]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x415e1a
nop
jmp 0x415e02
call fcn.00461800
xorps xmm15, xmm15
mov r14, qword [0x00612858]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x415f25
call fcn.004361e0
lea rax, [0x004f49f4]
mov ebx, 0x19
call fcn.00436ae0
mov rax, qword [rsp + 0x68]
call fcn.004367e0
lea rax, [0x004f43b4]
mov ebx, 0x19
call fcn.00436ae0
mov eax, dword [rsp + 0x34]
nop dword [rax]
call fcn.004367e0
call fcn.00436440
call fcn.00436260
lea rax, [0x004efe78]
mov ebx, 0xd
nop dword [rax + rax]
call fcn.004348a0
cmp eax, 0x5af
je 0x415ec8
call fcn.004361e0
lea rax, [0x004f49f4]
mov ebx, 0x19
nop dword [rax]
call fcn.00436ae0
mov rax, qword [rsp + 0x38]
call fcn.004367e0
lea rax, [0x004f43b4]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.00436ae0
mov eax, dword [rsp + 0x34]
call fcn.004367e0
call fcn.00436440
call fcn.00436260
lea rax, [0x004f691a]
mov ebx, 0x1f
call fcn.004348a0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045dc60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00415d60
Function at 0x41e240
Capabilities:
Hash data using murmur3

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
cmp byte [0x00612651], 0
jne 0x41e32f
mov rdx, qword [rax + 0x50]
test byte [rdx], al
nop
nop
nop
sub rbx, qword [rax + 0x18]
mov esi, dword [rax + 0x5c]
imul rbx, rsi
mov rsi, rbx
shr rbx, 0x20
shr rsi, 0x23
and ebx, 7
mov rdi, rcx
mov rcx, rbx
mov r8d, 1
shl r8d, cl
add rdx, rsi
lock or byte [rdx], r8b
nop
nop
mov rcx, qword [rax + 0x18]
nop
movabs rdx, 0x800000000000
lea rax, [rdx + rcx]
mov rdx, rax
shr rax, 0x2a
cmp rax, 0x40
jae 0x41e325
lea rbx, [0x005e4a90]
mov rax, qword [rbx + rax*8]
shr rdx, 0x16
and edx, 0xfffff
mov rdx, qword [rax + rdx*8]
test byte [rdx], al
test byte [rax], al
mov rax, rcx
shr rcx, 0x10
and ecx, 0x3f
movzx ebx, byte [rdx + rcx + 0x11440]
lea rdx, [rdx + rcx]
lea rdx, [rdx + 0x11440]
shr rax, 0xd
and eax, 7
mov rcx, rax
mov eax, 1
shl eax, cl
test al, bl
jne 0x41e307
lock or byte [rdx], al
mov rax, qword [r14 + 0x30]
mov rax, qword [rax + 0xa0]
test byte [rax], al
add qword [rax + 0x1248], rdi
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov ecx, 0x40
call fcn.004602e0
lea rax, [0x004f9170]
mov ebx, 0x2c
nop dword [rax + rax]
call fcn.004348a0
nop
int3

Function at 0x420720
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x42081e
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rbx
mov qword [rsp + 8], 0
jmp 0x420760
mov rax, qword [rsp + 0x50]
mov rcx, rdx
mov rbx, qword [rsp + 0x58]
nop
cmp qword [rsp + 8], rbx
jae 0x42080f
test byte [rax], al
lea rcx, [rax + 0x100b8]
mov rax, rcx
call fcn.004212e0
nop dword [rax]
test rax, rax
je 0x42080f
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x30], xmm15
lea rcx, [0x00420860]
mov qword [rsp + 0x10], rcx
lea rdx, [rsp + 8]
mov qword [rsp + 0x18], rdx
mov rdx, qword [rsp + 0x50]
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rbx
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x38], rax
lea rbx, [rsp + 0x10]
mov qword [rsp], rbx
call fcn.0045db20
xorps xmm15, xmm15
mov r14, qword [0x00612858]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x60]
test rdx, rdx
jne 0x4207fd
xor eax, eax
jmp 0x420807
mov rax, qword [rdx]
call rax
mov rdx, qword [rsp + 0x60]
test al, al
je 0x420752
mov rax, qword [rsp + 8]
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.0045dc60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.00420720