joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401037b0
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
lea rbp, [0x140109b68]
mov rsi, rcx
mov rcx, rbp
mov rdi, rdx
call dbg.pthread_mutex_lock
mov rcx, rsi
call dbg.__pthread_get_pointer
mov rbx, rax
test rax, rax
je 0x1401038d0
mov rcx, qword [rax + 0x28]
test rcx, rcx
je 0x1401038d0
lea rdx, [rsp + 0x2c]
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x1401038d0
test byte [rbx + 0x44], 4
jne 0x1401038f0
call sym._pthread_once_raw.constprop.0.isra.0
mov ecx, dword [0x140109b78]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140103930
mov rdx, qword [rax + 0x1d8]
cmp rsi, rdx
je 0x140103970
mov edx, dword [rbx + 0xbc]
test edx, edx
jne 0x140103853
xor edx, edx
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x140103910
mov rcx, qword [rbx + 0x28]
mov rsi, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rsi
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x14010386b
call rsi
mov qword [rbx + 0x30], 0
test rdi, rdi
je 0x140103948
mov rax, qword [rbx + 8]
lea rcx, [rbx + 0x38]
mov qword [rdi], rax
call dbg.pthread_mutex_destroy
lea rcx, [rbx + 0x68]
call dbg.pthread_spin_destroy
cmp eax, 1
je 0x140103982
cmp qword [rbx + 0x1d0], 0
mov qword [rbx + 0x68], 0xffffffffffffffff
je 0x140103960
mov rcx, rbp
call dbg.pthread_mutex_unlock
xor eax, eax
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov rcx, rbp
call dbg.pthread_mutex_unlock
mov eax, 3
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov rcx, rbp
call dbg.pthread_mutex_unlock
mov eax, 0x16
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov eax, dword [rbx + 0xbc]
test eax, eax
jne 0x140103853
mov rcx, rbp
call dbg.pthread_mutex_unlock
mov eax, 0x10
jmp 0x1401038be
call sym.__pthread_self_lite.part.0
xor edx, edx
test rax, rax
je 0x14010382c
jmp 0x140103825
lea rcx, [rbx + 0x38]
call dbg.pthread_mutex_destroy
lea rcx, [rbx + 0x68]
jmp 0x140103890
mov rcx, rbx
call sym.push_pthread_mem.part.0
jmp 0x1401038b4
mov rcx, rbp
call dbg.pthread_mutex_unlock
mov eax, 0x24
jmp 0x1401038be
call sym.replace_spin_keys.part.0
nop
nop dword [rax + rax]

Function at 0x1401041a0
Capabilities:
Terminate process

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x30
lea rdi, [0x140109b88]
mov rbx, rcx
mov rcx, rdi
mov esi, edx
call dbg.pthread_spin_lock
mov rax, qword [rbx]
cmp dword [rax], 0xbab1f0ed
jne 0x1401041e9
mov rax, qword [rbx]
mov eax, dword [rax + 4]
test eax, eax
jle 0x1401041e9
mov rax, qword [rbx]
mov rcx, rdi
sub dword [rax + 4], 1
call dbg.pthread_spin_unlock
mov eax, esi
add rsp, 0x30
pop rbx
pop rsi
pop rdi
ret
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov dword [rsp + 0x20], 0x28
lea r9, str..._src_rwlock.c
lea r8, str.___rwlock_t__rwl___valid__LIFE_RWLOCK______rwlock_t__rwl___busy___0_
mov rcx, rax
lea rdx, str.Assertion_failed:___s___file__s__line__d_n
call dbg.fprintf
mov ecx, 1
call sym.exit
nop
nop word cs:[rax + rax]
nop
Function at 0x140104620
Capabilities:
Terminate process

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, rcx
call sym.rwl_ref.isra.0
test eax, eax
je 0x140104648
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rsi, qword [rbx]
lea rdi, [rsi + 0x18]
mov rcx, rdi
call dbg.pthread_mutex_lock
test eax, eax
jne 0x140104671
lock add dword [rsi + 0xc], 1
cmp dword [rsi + 0xc], 0x7fffffff
je 0x140104688
mov rcx, rdi
call dbg.pthread_mutex_unlock
mov edx, eax
mov rcx, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp dbg.rwl_unref
lea r12, [rsi + 0x20]
mov rcx, r12
call dbg.pthread_mutex_lock
mov ebp, eax
test eax, eax
je 0x1401046b0
mov rcx, rdi
call dbg.pthread_mutex_unlock
mov edx, ebp
jmp 0x140104673
mov eax, dword [rsi + 0x10]
sub dword [rsi + 0xc], eax
mov rcx, r12
mov dword [rsi + 0x10], 0
call dbg.pthread_mutex_unlock
mov rcx, rdi
mov esi, eax
call dbg.pthread_mutex_unlock
test esi, esi
mov edx, esi
cmove edx, eax
jmp 0x140104673

Function at 0x1401046e0
Capabilities:
Terminate process

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rdi, rdx
call sym.rwl_ref.isra.0
test eax, eax
je 0x140104708
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rsi, qword [rbx]
mov rdx, rdi
lea rbp, [rsi + 0x18]
mov rcx, rbp
call dbg.pthread_mutex_timedlock
test eax, eax
jne 0x140104734
lock add dword [rsi + 0xc], 1
cmp dword [rsi + 0xc], 0x7fffffff
je 0x140104750
mov rcx, rbp
call dbg.pthread_mutex_unlock
mov edx, eax
mov rcx, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp dbg.rwl_unref
lea r12, [rsi + 0x20]
mov rdx, rdi
mov rcx, r12
call dbg.pthread_mutex_timedlock
mov edi, eax
test eax, eax
je 0x140104780
cmp eax, 0x8a
je 0x1401047b0
mov rcx, rbp
call dbg.pthread_mutex_unlock
mov edx, edi
jmp 0x140104736
mov eax, dword [rsi + 0x10]
sub dword [rsi + 0xc], eax
mov rcx, r12
mov dword [rsi + 0x10], 0
call dbg.pthread_mutex_unlock
mov rcx, rbp
mov esi, eax
call dbg.pthread_mutex_unlock
test esi, esi
cmove esi, eax
mov edx, esi
jmp 0x140104736
lock add dword [rsi + 0x10], 1
jmp 0x14010476c

Function at 0x1401047c0
Capabilities:
Terminate process

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, rcx
call sym.rwl_ref.isra.0
test eax, eax
je 0x1401047e8
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rsi, qword [rbx]
lea rdi, [rsi + 0x18]
mov rcx, rdi
call dbg.pthread_mutex_trylock
test eax, eax
jne 0x140104811
lock add dword [rsi + 0xc], 1
cmp dword [rsi + 0xc], 0x7fffffff
je 0x140104828
mov rcx, rdi
call dbg.pthread_mutex_unlock
mov edx, eax
mov rcx, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp dbg.rwl_unref
lea r12, [rsi + 0x20]
mov rcx, r12
call dbg.pthread_mutex_lock
mov ebp, eax
test eax, eax
je 0x140104850
mov rcx, rdi
call dbg.pthread_mutex_unlock
mov edx, ebp
jmp 0x140104813
mov eax, dword [rsi + 0x10]
sub dword [rsi + 0xc], eax
mov rcx, r12
mov dword [rsi + 0x10], 0
call dbg.pthread_mutex_unlock
mov rcx, rdi
mov esi, eax
call dbg.pthread_mutex_unlock
test esi, esi
mov edx, esi
cmove edx, eax
jmp 0x140104813
Function at 0x140104880
Capabilities:
Terminate process

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, rcx
call sym.rwl_ref.isra.0
test eax, eax
je 0x1401048a8
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rsi, qword [rbx]
lea rbp, [rsi + 0x18]
mov rcx, rbp
call dbg.pthread_mutex_trylock
mov edx, eax
test eax, eax
jne 0x1401048fe
lea r12, [rsi + 0x20]
mov rcx, r12
call dbg.pthread_mutex_trylock
mov edi, eax
test eax, eax
jne 0x140104938
mov eax, dword [rsi + 8]
mov edx, 0x10
test eax, eax
jne 0x1401048fe
mov edx, dword [rsi + 0x10]
mov eax, dword [rsi + 0xc]
test edx, edx
jle 0x1401048f1
sub eax, edx
mov dword [rsi + 0x10], 0
mov dword [rsi + 0xc], eax
test eax, eax
jg 0x140104910
mov dword [rsi + 8], 1
xor edx, edx
mov rcx, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp dbg.rwl_unref
mov rcx, r12
call dbg.pthread_mutex_unlock
mov rcx, rbp
mov esi, eax
call dbg.pthread_mutex_unlock
test esi, esi
jne 0x14010492f
test eax, eax
jne 0x140104949
mov esi, 0x10
mov edx, esi
jmp 0x1401048fe
mov rcx, rbp
call dbg.pthread_mutex_unlock
mov edx, eax
test eax, eax
cmove edx, edi
jmp 0x1401048fe
mov esi, eax
mov edx, esi
jmp 0x1401048fe

Function at 0x140104950
Capabilities:
Terminate process

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x30
mov rbx, rcx
call dbg.rwl_ref_unlock
test eax, eax
jne 0x1401049d0
mov rsi, qword [rbx]
mov edx, dword [rsi + 8]
test edx, edx
je 0x1401049a0
lock sub dword [rsi + 8], 1
lea rcx, [rsi + 0x20]
call dbg.pthread_mutex_unlock
lea rcx, [rsi + 0x18]
mov edi, eax
call dbg.pthread_mutex_unlock
test edi, edi
cmove edi, eax
mov edx, edi
mov rcx, rbx
add rsp, 0x30
pop rbx
pop rsi
pop rdi
jmp dbg.rwl_unref
lea rdi, [rsi + 0x20]
mov rcx, rdi
call dbg.pthread_mutex_lock
mov edx, eax
test eax, eax
jne 0x14010498d
lock add dword [rsi + 0x10], 1
mov eax, dword [rsi + 0x10]
test eax, eax
je 0x1401049e0
mov rcx, rdi
call dbg.pthread_mutex_unlock
mov edx, eax
jmp 0x14010498d
add rsp, 0x30
pop rbx
pop rsi
pop rdi
ret
lea rcx, [rsi + 0x28]
call dbg.pthread_cond_signal
mov rcx, rdi
mov dword [rsp + 0x2c], eax
call dbg.pthread_mutex_unlock
mov edx, dword [rsp + 0x2c]
test edx, edx
cmove edx, eax
jmp 0x14010498d
Function at 0x140104a00
Capabilities:
Terminate process

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rbx, rcx
call sym.rwl_ref.isra.0
test eax, eax
je 0x140104a28
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov rsi, qword [rbx]
lea rdi, [rsi + 0x18]
mov rcx, rdi
call dbg.pthread_mutex_lock
mov ebp, eax
test eax, eax
jne 0x140104a79
lea r12, [rsi + 0x20]
mov rcx, r12
call dbg.pthread_mutex_lock
mov ebp, eax
test eax, eax
jne 0x140104b10
mov edx, dword [rsi + 8]
test edx, edx
jne 0x140104a74
mov edx, dword [rsi + 0x10]
mov eax, dword [rsi + 0xc]
test edx, edx
jle 0x140104a70
sub eax, edx
mov dword [rsi + 0x10], 0
mov dword [rsi + 0xc], eax
test eax, eax
jg 0x140104a90
lock add dword [rsi + 8], 1
mov edx, ebp
mov rcx, rbx
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp dbg.rwl_unref
neg eax
mov qword [rsp + 0x28], rsi
lea r13, [rsi + 0x28]
mov dword [rsi + 0x10], eax
lea rax, [dbg.st_cancelwrite]
mov qword [rsp + 0x20], rax
call sym.pthread_getclean
mov rax, qword [rax]
mov qword [rsp + 0x30], rax
lock or qword [rsp], 0
call sym.pthread_getclean
lea rdx, [rsp + 0x20]
mov qword [rax], rdx
lock or qword [rsp], 0
jmp 0x140104adf
mov eax, dword [rsi + 0x10]
test eax, eax
jns 0x140104b20
mov rdx, r12
mov rcx, r13
call dbg.pthread_cond_wait
mov edi, eax
test eax, eax
je 0x140104ad8
call sym.pthread_getclean
mov rdx, qword [rsp + 0x30]
mov ebp, edi
mov qword [rax], rdx
mov rcx, qword [rsp + 0x28]
call qword [rsp + 0x20]
jmp 0x140104a79
mov rcx, rdi
call dbg.pthread_mutex_unlock
jmp 0x140104a79
call sym.pthread_getclean
mov rdx, qword [rsp + 0x30]
mov qword [rax], rdx
mov dword [rsi + 0xc], 0
jmp 0x140104a74
Function at 0x140104b40
Capabilities:
Terminate process

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
mov rbx, rcx
mov rsi, rdx
test rcx, rcx
je 0x140104bf0
test rdx, rdx
je 0x140104bf0
call sym.rwl_ref.isra.0
test eax, eax
je 0x140104b80
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov rdi, qword [rbx]
mov rdx, rsi
lea rbp, [rdi + 0x18]
mov rcx, rbp
call dbg.pthread_mutex_timedlock
mov edx, eax
test eax, eax
jne 0x140104bd7
lea r13, [rdi + 0x20]
mov rdx, rsi
mov rcx, r13
call dbg.pthread_mutex_timedlock
mov r12d, eax
test eax, eax
jne 0x140104c08
mov edx, dword [rdi + 8]
test edx, edx
jne 0x140104bcf
mov edx, dword [rdi + 0x10]
mov eax, dword [rdi + 0xc]
test edx, edx
jle 0x140104bcb
sub eax, edx
mov dword [rdi + 0x10], 0
mov dword [rdi + 0xc], eax
test eax, eax
jg 0x140104c18
lock add dword [rdi + 8], 1
mov edx, r12d
mov rcx, rbx
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
jmp dbg.rwl_unref
mov eax, 0x16
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov rcx, rbp
call dbg.pthread_mutex_unlock
jmp 0x140104bd4
neg eax
mov qword [rsp + 0x28], rdi
lea r14, [rdi + 0x28]
mov dword [rdi + 0x10], eax
lea rax, [dbg.st_cancelwrite]
mov qword [rsp + 0x20], rax
call sym.pthread_getclean
mov rax, qword [rax]
mov qword [rsp + 0x30], rax
lock or qword [rsp], 0
call sym.pthread_getclean
lea rdx, [rsp + 0x20]
mov qword [rax], rdx
lock or qword [rsp], 0
jmp 0x140104c64
test ebp, ebp
jne 0x140104c7b
mov r8, rsi
mov rdx, r13
mov rcx, r14
call dbg.pthread_cond_timedwait
mov ebp, eax
mov eax, dword [rdi + 0x10]
test eax, eax
js 0x140104c60
call sym.pthread_getclean
mov rdx, qword [rsp + 0x30]
mov qword [rax], rdx
test ebp, ebp
jne 0x140104ca0
mov dword [rdi + 0xc], 0
jmp 0x140104bcf
mov rcx, qword [rsp + 0x28]
mov r12d, ebp
call qword [rsp + 0x20]
jmp 0x140104bd4
Function at 0x14001abe0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x14001ad6b
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [0x1404c9be0]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.140038b40
xorps xmm15, xmm15
mov r14, qword [0x140a71fa0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x14001ac45
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x14001ac54
add rsp, 0x48
pop rbp
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x14001ac73
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x14001ac83
cmp rbx, 0x1000
jae 0x14001ac4b
jmp 0x14001aced
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x14001ac95
xor edx, edx
jmp 0x14001ace4
mov rcx, qword [0x1404c9be0]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.140038b40
xorps xmm15, xmm15
mov r14, qword [0x140a71fa0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x14001ac79
jmp 0x14001ac68
call fcn.14006d240
xorps xmm15, xmm15
mov r14, qword [0x140a71fa0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.14003d2c0
lea rax, [0x1405e3b0a]
mov ebx, 0x18
nop dword [rax]
call fcn.14003db40
mov rax, qword [rsp + 0x38]
call fcn.14003d880
lea rax, [0x1405e49bd]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.14003db40
mov rax, qword [rsp + 0x30]
call fcn.14003d880
call fcn.14003d500
call fcn.14003d320
lea rax, [0x1405eb6ca]
mov ebx, 0x21
call fcn.14003b920
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.140069ae0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.14001abe0
Function at 0x14001ada0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x14001afc6
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [0x1404c9bd8]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.140038bc0
xorps xmm15, xmm15
mov r14, qword [0x140a71fa0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x14001ae13
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x14001ae22
add rsp, 0x50
pop rbp
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x14001ae45
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x14001ae55
cmp rbx, 0x1000
jae 0x14001ae19
nop
jmp 0x14001aed8
add rsp, 0x50
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop word [rax + rax]
cmp rbx, 0x1000
jae 0x14001ae6d
xor esi, esi
jmp 0x14001aeca
mov rax, qword [0x1404c9bd8]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.140038bc0
xorps xmm15, xmm15
mov r14, qword [0x140a71fa0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x14001ae4b
jmp 0x14001ae36
call fcn.14006d240
xorps xmm15, xmm15
mov r14, qword [0x140a71fa0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x14001af60
nop dword [rax + rax]
call fcn.14003d2c0
lea rax, [0x1405e49d6]
mov ebx, 0x19
call fcn.14003db40
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
call fcn.14003d880
lea rax, [0x1405e49bd]
mov ebx, 0x19
call fcn.14003db40
mov eax, dword [rsp + 0x34]
call fcn.14003d880
nop
call fcn.14003d500
call fcn.14003d320
lea rax, [0x1405da395]
mov ebx, 0xd
call fcn.14003b920
nop dword [rax + rax]
cmp eax, 0x5af
je 0x14001af00
call fcn.14003d2c0
lea rax, [0x1405e49d6]
mov ebx, 0x19
call fcn.14003db40
mov rax, qword [rsp + 0x38]
call fcn.14003d880
lea rax, [0x1405e49bd]
mov ebx, 0x19
call fcn.14003db40
mov eax, dword [rsp + 0x34]
nop dword [rax]
call fcn.14003d880
call fcn.14003d500
call fcn.14003d320
lea rax, [0x1405e9ceb]
mov ebx, 0x1f
nop dword [rax + rax]
call fcn.14003b920
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.140069ae0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.14001ada0
Function at 0x1400246a0
Capabilities:
Hash data using murmur3

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
cmp byte [0x140a71bf5], 0
jne 0x140024787
sub rbx, qword [rax + 0x18]
mov rdx, qword [rax + 0x50]
test byte [rdx], al
mov esi, dword [rax + 0x64]
imul rbx, rsi
mov rsi, rbx
shr rbx, 0x20
shr rsi, 0x23
and ebx, 7
mov rdi, rcx
mov rcx, rbx
mov r8d, 1
shl r8d, cl
add rdx, rsi
nop
nop
nop
nop
lock or byte [rdx], r8b
mov rcx, qword [rax + 0x18]
movabs rdx, 0x800000000000
lea rax, [rdx + rcx]
mov rdx, rax
shr rdx, 0x2a
nop
nop
nop
cmp rdx, 0x40
jae 0x14002477a
lea rbx, [0x140a43fd8]
mov rdx, qword [rbx + rdx*8]
test byte [rdx], al
mov rbx, rcx
shr rbx, 0x10
and ebx, 0x3f
shr rcx, 0xd
and ecx, 7
mov esi, 1
shl esi, cl
shr rax, 0x16
and eax, 0xfffff
mov rax, qword [rdx + rax*8]
test byte [rax], al
movzx edx, byte [rax + rbx + 0x11440]
lea rax, [rax + rbx]
lea rax, [rax + 0x11440]
test sil, dl
jne 0x140024760
lock or byte [rax], sil
mov rax, qword [r14 + 0x30]
mov rax, qword [rax + 0xa0]
test byte [rax], al
add qword [rax + 0x1250], rdi
add rsp, 0x10
pop rbp
ret
mov rax, rdx
mov ecx, 0x40
call fcn.14006bde0
lea rax, [0x1405f2017]
mov ebx, 0x2c
call fcn.14003b920
nop
int3

Function at 0x140026a60
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x140026b66
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x70], rcx
mov byte [rsp + 0x17], dil
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x18], 0
jmp 0x140026aa3
mov rax, qword [rsp + 0x60]
mov rcx, rdx
mov rbx, qword [rsp + 0x68]
movzx edi, byte [rsp + 0x17]
cmp qword [rsp + 0x18], rbx
jae 0x140026b5b
test byte [rax], al
lea rcx, [rax + 0x100b8]
mov ebx, edi
mov rax, rcx
nop dword [rax]
call fcn.140027840
test rax, rax
je 0x140026b5b
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x30], xmm15
movups xmmword [rsp + 0x40], xmm15
lea rcx, [0x140026ba0]
mov qword [rsp + 0x20], rcx
lea rdx, [rsp + 0x18]
mov qword [rsp + 0x28], rdx
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x48], rax
lea rbx, [rsp + 0x20]
mov qword [rsp], rbx
nop dword [rax]
call fcn.1400699a0
xorps xmm15, xmm15
mov r14, qword [0x140a71fa0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x70]
nop dword [rax]
test rdx, rdx
jne 0x140026b49
xor eax, eax
jmp 0x140026b53
mov rax, qword [rdx]
call rax
mov rdx, qword [rsp + 0x70]
test al, al
je 0x140026a91
mov rax, qword [rsp + 0x18]
add rsp, 0x50
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov byte [rsp + 0x20], dil
call fcn.140069ae0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movzx edi, byte [rsp + 0x20]
jmp fcn.140026a60
Function at 0x140034f00
Capabilities:
Hash data using murmur3

Disassembly:
cmp rsp, qword [r14 + 0x18]
jbe 0x140035186
push rbp
mov rbp, rsp
sub rsp, 0x38
test byte [rax], al
mov rcx, qword [rax + 0x1268]
lea rsi, [rax + 0x1278]
sub rcx, rsi
shr rcx, 3
cmp rcx, 0x200
ja 0x14003517a
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x30], rcx
mov qword [rax + 0x1268], 0
cmp byte [0x140a71bf5], 0
jne 0x140034f5a
xor edx, edx
xor ebx, ebx
jmp 0x140034fa0
xor edx, edx
jmp 0x140034f85
mov qword [rsp + 0x28], rdx
mov rcx, qword [rax + rdx*8 + 0x1278]
mov rax, rcx
call fcn.140023f00
mov rdx, qword [rsp + 0x28]
inc rdx
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
cmp rdx, rcx
jl 0x140034f5e
add rax, 0x1268
call fcn.140034e80
add rsp, 0x38
pop rbp
ret
inc rdx
nop
cmp rdx, rcx
jge 0x140035114
mov rsi, qword [rax + rdx*8 + 0x1278]
cmp rsi, 0x1000
jb 0x140034f9b
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rbx
mov rax, rsi
xor ebx, ebx
mov rcx, rbx
call fcn.140017f00
test rax, rax
jne 0x140034fec
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
jmp 0x140034f9b
mov rsi, qword [rbx + 0x50]
test byte [rsi], al
mov r8, rcx
shr r8, 3
movzx r9d, byte [rsi + r8]
and ecx, 7
mov r10d, 1
shl r10d, cl
nop
add rsi, r8
test r10b, r9b
je 0x14003502c
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
jmp 0x140034f9b
nop
lock or byte [rsi], r10b
mov rcx, qword [rbx + 0x18]
movabs rsi, 0x800000000000
lea r8, [rsi + rcx]
mov r9, r8
shr r8, 0x2a
nop
nop
nop
cmp r8, 0x40
jae 0x14003516d
lea r10, [0x140a43fd8]
mov r8, qword [r10 + r8*8]
test byte [r8], al
mov r10, rcx
shr r10, 0x10
and r10d, 0x3f
shr rcx, 0xd
and ecx, 7
mov r11d, 1
shl r11d, cl
shr r9, 0x16
and r9d, 0xfffff
mov r8, qword [r8 + r9*8]
test byte [r8], al
movzx r9d, byte [r8 + r10 + 0x11440]
lea r8, [r8 + r10]
lea r8, [r8 + 0x11440]
test r11b, r9b
jne 0x1400350af
lock or byte [r8], r11b
movzx r8d, byte [rbx + 0x6a]
test r8b, 1
je 0x1400350e5
mov rax, qword [rsp + 0x48]
mov r8, qword [rax + 0x1250]
add r8, qword [rbx + 0x70]
mov qword [rax + 0x1250], r8
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
jmp 0x140034f9b
mov r8, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
cmp r8, rcx
jae 0x140035165
mov rbx, qword [rsp + 0x48]
mov qword [rbx + r8*8 + 0x1278], rax
inc r8
mov rax, rbx
mov rdx, qword [rsp + 0x28]
mov rbx, r8
jmp 0x140034f9b
cmp rbx, 0x200
ja 0x140035154
lea rdx, [rax + 0x1278]
lea rsi, [rax + 0x1240]
mov rcx, rbx
mov edi, 0x200
mov rbx, rdx
mov rax, rsi
call fcn.14002a740
mov rax, qword [rsp + 0x48]
add rax, 0x1268
call fcn.140034e80
add rsp, 0x38
pop rbp
ret
mov rcx, rbx
mov edx, 0x200
nop dword [rax]
call fcn.14006be40
mov rax, r8
call fcn.14006bdc0
mov rax, r8
mov ecx, 0x40
call fcn.14006bde0
mov edx, 0x200
nop
call fcn.14006be20
nop
mov qword [rsp + 8], rax
call fcn.140070800
mov rax, qword [rsp + 8]
jmp fcn.140034f00
Function at 0x14004a4c0
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x14004a627
push rbp
mov rbp, rsp
sub rsp, 0x18
mov ecx, dword [rax + 0x190]
mov edx, dword [rax + 0x194]
mov rsi, qword [rax + 0x998]
mov edi, dword [rax + 0x194]
cmp edi, edx
jne 0x14004a4d2
cmp edx, ecx
jne 0x14004a615
nop word [rax + rax]
test rsi, rsi
jne 0x14004a615
mov qword [rsp + 0x28], rax
test rbx, rbx
jne 0x14004a534
nop
call fcn.14006d660
xorps xmm15, xmm15
mov r14, qword [0x140a71fa0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rbx, qword [rsp]
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x10], rbx
call fcn.14004a3e0
mov rcx, qword [rsp + 0x28]
mov edx, dword [rcx]
mov ebx, edx
sar edx, 0x1f
shr edx, 0x1b
add edx, ebx
mov esi, edx
and edx, 0xffffffe0
sub ebx, edx
test ebx, ebx
jl 0x14004a610
mov rdx, qword [0x140a1b0a8]
sar esi, 5
mov rax, rcx
mov ecx, ebx
mov edi, 1
shl edi, cl
movsxd rsi, esi
cmp ecx, 0x20
sbb r8d, r8d
and edi, r8d
cmp rdx, rsi
jbe 0x14004a605
mov rcx, qword [0x140a1b0a0]
lea rcx, [rcx + rsi*4]
lock or dword [rcx], edi
mov rcx, qword [0x140a1df10]
mov qword [rax + 8], rcx
mov rcx, rax
nop
mov qword [0x140a1df10], rax
nop
mov edx, 1
lea rsi, [0x140a1df18]
lock xadd dword [rsi], edx
mov rdx, qword [rcx + 0x1228]
shr rdx, 0x3d
test dl, dl
jne 0x14004a5f3
mov rax, qword [rsp + 0x10]
movabs rdx, 0x1fffffffffffffff
and rdx, rax
bts rdx, 0x3f
nop
nop
xchg qword [rcx + 0x1228], rdx
add rsp, 0x18
pop rbp
ret
lea rax, [0x1405f0088]
mov ebx, 0x28
nop
call fcn.14003b920
mov rax, rsi
mov rcx, rdx
call fcn.14006bdc0
call fcn.140039e20
lea rax, [0x1405ecc52]
mov ebx, 0x23
call fcn.14003b920
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.140069ae0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.14004a4c0