joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2c63e2080
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
movzx r8d, word [rcx + 6]
lea rax, [rcx + rax + 0x18]
test r8w, r8w
je 0x2c63e20cd
lea ecx, [r8 - 1]
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
mov rcx, r8
cmp rdx, r8
jb 0x2c63e20c4
add ecx, dword [rax + 8]
cmp rdx, rcx
jb 0x2c63e20cf
add rax, 0x28
cmp rax, r9
jne 0x2c63e20b0
xor eax, eax
ret

Function at 0x2c63e20d0
Capabilities:
Parse pe header

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rsi, rcx
call sym.strlen
cmp rax, 8
ja 0x2c63e2160
mov rdx, qword [0x2c6402c50]
xor ebx, ebx
cmp word [rdx], 0x5a4d
jne 0x2c63e214e
movsxd rax, dword [rdx + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
jne 0x2c63e214e
cmp word [rax + 0x18], 0x20b
jne 0x2c63e214e
movzx edx, word [rax + 0x14]
lea rbx, [rax + rdx + 0x18]
movzx edx, word [rax + 6]
test dx, dx
je 0x2c63e2160
lea eax, [rdx - 1]
lea rax, [rax + rax*4]
lea rdi, [rbx + rax*8 + 0x28]
jmp 0x2c63e2139
add rbx, 0x28
cmp rbx, rdi
je 0x2c63e2160
mov r8d, 8
mov rdx, rsi
mov rcx, rbx
call sym.strncmp
test eax, eax
jne 0x2c63e2130
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
xor ebx, ebx
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret

Function at 0x2c63e2170
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x2c6402c50]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x2c63e2190
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x2c63e2198
ret
cmp word [r8 + 0x18], 0x20b
jne 0x2c63e2190
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x2c63e21ed
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x2c63e21e4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x2c63e2190
add rax, 0x28
cmp rax, r9
jne 0x2c63e21d0
xor eax, eax
ret

Function at 0x2c63e21f0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x2c6402c50]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x2c63e220f
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x2c63e2218
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x2c63e220f
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x2c63e2230
Capabilities:
Parse pe header

Disassembly:
mov r8, qword [0x2c6402c50]
xor eax, eax
cmp word [r8], 0x5a4d
jne 0x2c63e2250
movsxd rdx, dword [r8 + 0x3c]
add rdx, r8
cmp dword [rdx], 0x4550
je 0x2c63e2258
ret
cmp word [rdx + 0x18], 0x20b
jne 0x2c63e2250
movzx eax, word [rdx + 0x14]
movzx r8d, word [rdx + 6]
lea rax, [rdx + rax + 0x18]
test r8w, r8w
je 0x2c63e22a0
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea rdx, [rax + rdx*8 + 0x28]
nop dword [rax]
test byte [rax + 0x27], 0x20
je 0x2c63e2297
test rcx, rcx
je 0x2c63e2250
sub rcx, 1
add rax, 0x28
cmp rax, rdx
jne 0x2c63e2288
xor eax, eax
ret
Function at 0x2c63e22b0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x2c6402c50]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x2c63e22cf
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x2c63e22d8
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret

Function at 0x2c63e22f0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x2c6402c50]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x2c63e2310
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x2c63e2318
ret
cmp word [r8 + 0x18], 0x20b
jne 0x2c63e2310
sub rcx, rdx
movzx r9d, word [r8 + 6]
movzx edx, word [r8 + 0x14]
lea rdx, [r8 + rdx + 0x18]
test r9w, r9w
je 0x2c63e2310
lea eax, [r9 - 1]
lea rax, [rax + rax*4]
lea r9, [rdx + rax*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rdx + 0xc]
mov rax, r8
cmp rcx, r8
jb 0x2c63e2364
add eax, dword [rdx + 8]
cmp rcx, rax
jb 0x2c63e2370
add rdx, 0x28
cmp r9, rdx
jne 0x2c63e2350
xor eax, eax
ret
mov eax, dword [rdx + 0x24]
not eax
shr eax, 0x1f
ret

Function at 0x2c63e2380
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov r11, qword [0x2c6402c50]
xor r9d, r9d
cmp word [r11], 0x5a4d
jne 0x2c63e23a2
movsxd r8, dword [r11 + 0x3c]
add r8, r11
cmp dword [r8], 0x4550
je 0x2c63e23b0
mov rax, r9
ret
cmp word [r8 + 0x18], 0x20b
jne 0x2c63e23a2
mov eax, dword [r8 + 0x90]
test eax, eax
je 0x2c63e23a2
movzx edx, word [r8 + 0x14]
movzx r10d, word [r8 + 6]
lea rdx, [r8 + rdx + 0x18]
test r10w, r10w
je 0x2c63e23a2
lea r8d, [r10 - 1]
lea r8, [r8 + r8*4]
lea r10, [rdx + r8*8 + 0x28]
nop word cs:[rax + rax]
mov r9d, dword [rdx + 0xc]
mov r8, r9
cmp rax, r9
jb 0x2c63e2405
add r8d, dword [rdx + 8]
cmp rax, r8
jb 0x2c63e2418
add rdx, 0x28
cmp rdx, r10
jne 0x2c63e23f0
xor r9d, r9d
mov rax, r9
ret
add rax, r11
jmp 0x2c63e2427
sub ecx, 1
add rax, 0x14
mov r8d, dword [rax + 4]
test r8d, r8d
jne 0x2c63e2437
mov edx, dword [rax + 0xc]
test edx, edx
je 0x2c63e240e
test ecx, ecx
jg 0x2c63e2420
mov r9d, dword [rax + 0xc]
add r9, r11
mov rax, r9
ret
Function at 0x1400bd728
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x20], r9
push rdi
sub rsp, 0x40
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
call fcn.1400bbd50
test al, al
je 0x1400bd752
xor eax, eax
jmp 0x1400bd7a4
lea r8, [rsp + 0x30]
mov rdx, rbx
mov rcx, rdi
call fcn.1400bc268
mov rdi, rax
test rax, rax
je 0x1400bd79e
lea rax, [rsp + 0x68]
mov dword [rsp + 0x28], 8
mov r9d, 0xb
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1400bd7a2
mov ebx, dword [rsp + 0x30]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov r9, r8
mov r8, rdx
mov rdx, rcx
mov rcx, 0xffffffff80000001
jmp 0x1400bd728

Function at 0x1400bd7cc
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
mov rbx, r9
mov rbp, r8
mov rdi, rdx
mov rsi, rcx
call fcn.1400bbc20
xor r14d, r14d
test al, al
je 0x1400bd801
xor eax, eax
jmp 0x1400bd85f
lea r8, [rsp + 0x30]
mov rdx, rdi
mov rcx, rsi
call fcn.1400bc268
mov rdi, rax
test rax, rax
je 0x1400bd859
or rcx, 0xffffffffffffffff
inc rcx
cmp word [rbx + rcx*2], r14w
jne 0x1400bd81d
lea eax, [rcx*2 + 2]
mov r9d, 1
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov rdx, rbp
mov qword [rsp + 0x20], rbx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1400bd85d
mov ebx, dword [rsp + 0x30]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x1400bd87c
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov dword [rsp + 0x20], r9d
push rdi
sub rsp, 0x40
mov r9d, r9d
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
call fcn.1400bbd50
test al, al
je 0x1400bd8a9
xor eax, eax
jmp 0x1400bd8f8
lea r8, [rsp + 0x30]
mov rdx, rbx
mov rcx, rdi
call fcn.1400bc268
mov rdi, rax
test rax, rax
je 0x1400bd8f2
mov r9d, 4
lea rax, [rsp + 0x68]
mov dword [rsp + 0x28], r9d
xor r8d, r8d
mov rdx, rsi
mov qword [rsp + 0x20], rax
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1400bd8f6
mov ebx, dword [rsp + 0x30]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov r9d, r8d
mov r8, rdx
mov rdx, rcx
mov rcx, 0xffffffff80000001
jmp 0x1400bd87c
Function at 0x1400bd908
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
mov r14, qword [rsp + 0x70]
mov rsi, r9
mov qword [rax - 0x28], r14
mov rbp, r8
mov rbx, rdx
mov rdi, rcx
call fcn.1400bbc90
test al, al
je 0x1400bd943
xor eax, eax
jmp 0x1400bd98d
lea r8, [rsp + 0x30]
mov rdx, rbx
mov rcx, rdi
call fcn.1400bc268
mov rdi, rax
test rax, rax
je 0x1400bd987
mov dword [rsp + 0x28], r14d
mov r9d, 3
xor r8d, r8d
mov qword [rsp + 0x20], rsi
mov rdx, rbp
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1400bd98b
mov ebx, dword [rsp + 0x30]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x1400bd9a8
Capabilities:
Set registry value

Disassembly:
mov r9, r8
mov r8, rdx
mov rdx, rcx
mov rcx, 0xffffffff80000001
jmp fcn.1400bd7cc

Function at 0x1400bd9c0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov dword [rsp + 0x20], r9d
push rdi
sub rsp, 0x40
mov r9d, r9d
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
call fcn.1400bbd50
test al, al
je 0x1400bd8a9
xor eax, eax
jmp 0x1400bd8f8
lea r8, [rsp + 0x30]
mov rdx, rbx
mov rcx, rdi
call fcn.1400bc268
mov rdi, rax
test rax, rax
je 0x1400bd8f2
mov r9d, 4
lea rax, [rsp + 0x68]
mov dword [rsp + 0x28], r9d
xor r8d, r8d
mov rdx, rsi
mov qword [rsp + 0x20], rax
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1400bd8f6
mov ebx, dword [rsp + 0x30]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov r9d, r8d
mov r8, rdx
mov rdx, rcx
mov rcx, 0xffffffff80000001
jmp 0x1400bd87c
Function at 0x1400e7d38
Capabilities:
Check if file exists
Get common file path
Get file attributes
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
mov eax, 0x1040
call fcn.140119910
sub rsp, rax
mov rax, qword [0x140182c48]
xor rax, rsp
mov qword [rsp + 0x1030], rax
xor ebp, ebp
mov sil, r8b
cmp word [0x14018bce8], bp
mov rdi, rdx
mov rbx, rcx
je 0x1400e7d7f
lea rdx, [0x14018bce8]
jmp 0x1400e7e0f
lea r9, [0x14013ff10]
mov dword [rsp + 0x20], edi
mov r8, rbx
lea rdx, str.TempFolder
lea rcx, [0x1401401d8]
call fcn.1400bcf40
mov r8d, 0x800
mov word [rsp + 0x30], bp
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp word [rbx], bp
je 0x1400e7ddc
dec eax
cmp eax, 0x7fe
ja 0x1400e7dd7
mov r8, rdi
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.1400ac228
cmp word [rbx], bp
jne 0x1400e7de3
test sil, sil
je 0x1400e7df1
jmp 0x1400e7e17
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1400e7e17
mov rdx, rbx
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x1400e7e05
cmp word [rbx], bp
jne 0x1400e7e17
lea rdx, str._rartemp
mov rcx, rbx
mov r8, rdi
call fcn.1400ac228
mov rdx, rdi
mov rcx, rbx
call fcn.140094d10
mov rcx, qword [rsp + 0x1030]
xor rcx, rsp
call fcn.140119970
mov rbx, qword [rsp + 0x1070]
add rsp, 0x1040
pop rdi
pop rsi
pop rbp
ret

Function at 0x1400e8184
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
mov eax, 0x2030
call fcn.140119910
sub rsp, rax
mov rax, qword [0x140182c48]
xor rax, rsp
mov qword [rsp + 0x2020], rax
mov rdi, rdx
mov rsi, r8
mov rdx, rcx
mov r8d, 0x7ff
lea rcx, [rsp + 0x1020]
mov bl, r9b
call fcn.1400ac228
xor ebp, ebp
test bl, bl
je 0x1400e821e
cmp byte [0x1401baad0], bpl
jne 0x1400e81e6
cmp byte [0x1401baa1b], bpl
lea r9d, [rbp + 0x61]
je 0x1400e81ec
mov r9d, SHRestricted
lea rcx, [rsp + 0x1020]
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], bp
jne 0x1400e81f8
lea rcx, [rsp + 0x1020]
mov edx, 2
lea rcx, [rcx + rax*2]
lea r8, [0x1401557d0]
call fcn.140004dcc
mov ebx, 0x800
lea rcx, [rsp + 0x20]
mov edx, ebx
xor r8d, r8d
call fcn.1400e7d38
mov edx, ebx
lea rcx, [rsp + 0x20]
call fcn.140094d10
mov r8d, ebx
lea rdx, [rsp + 0x1020]
lea rcx, [rsp + 0x20]
call fcn.1400ac200
mov edx, ebx
lea rcx, [rsp + 0x20]
call fcn.140085a3c
test rax, rax
je 0x1400e8289
xor edx, edx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x1400e8289
mov r8, rsi
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.1400ac228
mov al, 1
jmp 0x1400e82ae
mov ecx, 0x1f7
call fcn.1400a617c
mov rcx, rax
lea rdx, [rsp + 0x20]
call fcn.1400ee128
lea rcx, [0x1401ca7d8]
call fcn.14007e310
xor al, al
mov rcx, qword [rsp + 0x2020]
xor rcx, rsp
call fcn.140119970
mov rbx, qword [rsp + 0x2068]
add rsp, 0x2030
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400e82d4
Capabilities:
Capture screenshot

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x80
mov rbx, rcx
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, rax
mov r12, rax
call qword [sym.imp.USER32.dll_GetDC]
mov rcx, rax
mov r15, rax
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov rcx, r15
mov r14, rax
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
lea r8, [rsp + 0x60]
mov edx, 0x20
mov rcx, rbx
mov rbp, rax
call qword [sym.imp.GDI32.dll_GetObjectW]
mov r8d, dword [rsp + 0x68]
mov rcx, r15
mov edx, dword [rsp + 0x64]
call qword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov rdx, rbx
mov rcx, r14
mov rsi, rax
call qword [sym.imp.GDI32.dll_SelectObject]
mov rdx, rsi
mov rcx, rbp
mov rdi, rax
call qword [sym.imp.GDI32.dll_SelectObject]
mov edx, dword [rsp + 0x68]
mov rbx, rax
mov r9d, dword [rsp + 0x64]
mov ecx, r9d
mov dword [rsp + 0x50], 0xcc0020
neg ecx
mov dword [rsp + 0x48], edx
mov dword [rsp + 0x40], ecx
mov rcx, rbp
and dword [rsp + 0x38], 0
lea r8d, [r9 - 1]
mov dword [rsp + 0x30], r8d
xor r8d, r8d
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], edx
xor edx, edx
call qword [sym.imp.GDI32.dll_StretchBlt]
mov eax, dword [rsp + 0x68]
xor r8d, r8d
mov r9d, dword [rsp + 0x64]
xor edx, edx
mov dword [rsp + 0x40], 0xcc0020
mov rcx, r14
and dword [rsp + 0x38], 0
and dword [rsp + 0x30], 0
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], eax
call qword [sym.imp.GDI32.dll_BitBlt]
mov rdx, rdi
mov rcx, r14
call qword [sym.imp.GDI32.dll_SelectObject]
mov rdx, rbx
mov rcx, rbp
call qword [sym.imp.GDI32.dll_SelectObject]
mov rcx, rsi
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, r14
call qword [sym.imp.GDI32.dll_DeleteDC]
mov rcx, rbp
call qword [sym.imp.GDI32.dll_DeleteDC]
mov rdx, r15
mov rcx, r12
call qword [sym.imp.USER32.dll_ReleaseDC]
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret

Function at 0x1400e9070
Capabilities:
Get common file path

Disassembly:
sub rsp, 0x28
mov rax, rdx
mov rdx, rcx
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
setne al
add rsp, 0x28
ret
Function at 0x417060
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4171eb
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00435520
xorps xmm15, xmm15
mov r14, qword [0x006c2050]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x4170c5
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x4170d4
add rsp, 0x48
pop rbp
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x4170f3
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x417103
cmp rbx, 0x1000
jae 0x4170cb
jmp 0x41716d
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x417115
xor edx, edx
jmp 0x417164
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00435520
xorps xmm15, xmm15
mov r14, qword [0x006c2050]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x4170f9
jmp 0x4170e8
call fcn.00469300
xorps xmm15, xmm15
mov r14, qword [0x006c2050]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.004395c0
lea rax, [0x00536476]
mov ebx, 0x18
nop dword [rax]
call fcn.00439e40
mov rax, qword [rsp + 0x38]
call fcn.00439b80
lea rax, [0x00536aa3]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.00439e40
mov rax, qword [rsp + 0x30]
call fcn.00439b80
call fcn.00439800
call fcn.00439620
lea rax, [0x00539691]
mov ebx, 0x21
call fcn.00437b20
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00465be0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00417060
Function at 0x417220
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x417446
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.004355a0
xorps xmm15, xmm15
mov r14, qword [0x006c2050]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x417293
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x4172a2
add rsp, 0x50
pop rbp
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x4172c5
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x4172d5
cmp rbx, 0x1000
jae 0x417299
nop
jmp 0x417358
add rsp, 0x50
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop word [rax + rax]
cmp rbx, 0x1000
jae 0x4172ed
xor esi, esi
jmp 0x41734a
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.004355a0
xorps xmm15, xmm15
mov r14, qword [0x006c2050]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x4172cb
jmp 0x4172b6
call fcn.00469300
xorps xmm15, xmm15
mov r14, qword [0x006c2050]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x4173e0
nop dword [rax + rax]
call fcn.004395c0
lea rax, [0x00536abc]
mov ebx, 0x19
call fcn.00439e40
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
call fcn.00439b80
lea rax, [0x00536aa3]
mov ebx, 0x19
call fcn.00439e40
mov eax, dword [rsp + 0x34]
call fcn.00439b80
nop
call fcn.00439800
call fcn.00439620
lea rax, [0x005323fe]
mov ebx, 0xd
call fcn.00437b20
nop dword [rax + rax]
cmp eax, 0x5af
je 0x417380
call fcn.004395c0
lea rax, [0x00536abc]
mov ebx, 0x19
call fcn.00439e40
mov rax, qword [rsp + 0x38]
call fcn.00439b80
lea rax, [0x00536aa3]
mov ebx, 0x19
call fcn.00439e40
mov eax, dword [rsp + 0x34]
nop dword [rax]
call fcn.00439b80
call fcn.00439800
call fcn.00439620
lea rax, [0x00538e98]
mov ebx, 0x1f
nop dword [rax + rax]
call fcn.00437b20
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00465be0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.00417220
Function at 0x421220
Capabilities:
Hash data using murmur3

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
cmp byte [0x006c1e16], 0
jne 0x421310
sub rbx, qword [rax + 0x18]
mov rdx, qword [rax + 0x48]
test byte [rdx], al
mov ecx, dword [rax + 0x5c]
imul rcx, rbx
mov rbx, rcx
shr rbx, 0x20
shr rcx, 0x23
and ebx, 7
mov rsi, rcx
mov rcx, rbx
mov edi, 1
shl edi, cl
add rdx, rsi
nop
nop
nop
nop
lock or byte [rdx], dil
mov rcx, qword [rax + 0x18]
movabs rdx, 0x800000000000
add rdx, rcx
mov rbx, rdx
shr rdx, 0x2a
nop
nop
nop
cmp rdx, 0x40
jae 0x421303
lea rsi, [0x00653f18]
mov rdx, qword [rsi + rdx*8]
test byte [rdx], al
mov rsi, rcx
shr rsi, 0x10
and esi, 0x3f
shr rcx, 0xd
and ecx, 7
mov edi, 1
shl edi, cl
shr rbx, 0x16
and ebx, 0xfffff
mov rdx, qword [rdx + rbx*8]
test byte [rdx], al
movzx ebx, byte [rdx + rsi + 0x1040]
lea rdx, [rdx + rsi]
lea rdx, [rdx + 0x1040]
test dil, bl
jne 0x4212de
lock or byte [rdx], dil
mov rcx, qword [r14 + 0x30]
mov rcx, qword [rcx + 0xa0]
test byte [rcx], al
mov rdx, qword [rcx + 0x1270]
add rdx, qword [rax + 0x68]
mov qword [rcx + 0x1270], rdx
add rsp, 0x10
pop rbp
ret
mov rax, rdx
mov ecx, 0x40
call fcn.00467ee0
lea rax, [0x0053b9a8]
mov ebx, 0x2c
nop dword [rax]
call fcn.00437b20
nop
int3

Function at 0x423760
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x423866
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov byte [rsp + 0x70], dil
mov qword [rsp + 0x10], 0
jmp 0x4237a3
mov rax, qword [rsp + 0x58]
mov rcx, rdx
mov rbx, qword [rsp + 0x60]
movzx edi, byte [rsp + 0x70]
cmp qword [rsp + 0x10], rbx
jae 0x42385b
test byte [rax], al
lea rcx, [rax + 0x100b8]
mov ebx, edi
mov rax, rcx
nop dword [rax]
call fcn.00424540
test rax, rax
je 0x42385b
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
lea rcx, [0x004238a0]
mov qword [rsp + 0x18], rcx
lea rdx, [rsp + 0x10]
mov qword [rsp + 0x20], rdx
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x40], rax
lea rbx, [rsp + 0x18]
mov qword [rsp], rbx
nop dword [rax]
call fcn.00465ac0
xorps xmm15, xmm15
mov r14, qword [0x006c2050]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x68]
nop dword [rax]
test rdx, rdx
jne 0x423849
xor eax, eax
jmp 0x423853
mov rax, qword [rdx]
call rax
mov rdx, qword [rsp + 0x68]
test al, al
je 0x423791
mov rax, qword [rsp + 0x10]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov byte [rsp + 0x20], dil
call fcn.00465be0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movzx edi, byte [rsp + 0x20]
jmp fcn.00423760
Function at 0x430300
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4303f9
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rax + 0x108], 0
mov ecx, dword [0x006c2430]
test ecx, ecx
je 0x4303d2
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x10], 0
lea rcx, [rsp + 0x60]
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x30], xmm15
movups xmmword [rsp + 0x40], xmm15
lea rdx, [0x00430420]
mov qword [rsp + 0x18], rdx
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], rcx
mov rcx, r14
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x10]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], 3
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x18]
mov qword [rsp], rcx
call fcn.00465ac0
xorps xmm15, xmm15
mov r14, qword [0x006c2050]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x10]
cmp rax, 0x20
jge 0x4303cc
jae 0x4303ee
mov rcx, qword [rsp + 0x60]
mov qword [rcx + rax*8 + 8], 0
add rsp, 0x50
pop rbp
ret
lea rcx, [fcn.00444cc0]
inc rcx
mov qword [rax + 8], rcx
mov qword [rax + 0x10], 0
add rsp, 0x50
pop rbp
ret
mov ecx, 0x20
call fcn.00467ec0
nop
mov qword [rsp + 8], rax
nop
call fcn.00465be0
mov rax, qword [rsp + 8]
jmp fcn.00430300