joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400082c4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbp
push rdi
push rsi
push rbx
movsxd rax, dword [rcx + 0x3c]
mov eax, dword [rcx + rax + 0x88]
add rax, rcx
mov ebx, dword [rax + 0x18]
mov r9d, dword [rax + 0x20]
mov edi, dword [rax + 0x1c]
mov ebp, dword [rax + 0x24]
test ebx, ebx
je 0x140008328
lea rsi, [rcx + r9]
lea r10d, [r8 + 0x60]
xor r11d, r11d
nop
mov eax, dword [rsi + r11*4]
xor r8d, r8d
add rax, rcx
cmp byte [rax], 0
je 0x14000831a
nop
movzx r9d, byte [rax]
add rax, 1
or r9d, r10d
add r8d, r9d
add r8d, r8d
cmp byte [rax], 0
jne 0x140008304
cmp edx, r8d
je 0x14000832f
add r11, 1
cmp ebx, r11d
ja 0x1400082f4
xor eax, eax
pop rbx
pop rsi
pop rdi
pop rbp
ret
invalid

Function at 0x140008354
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x6e8
mov ecx, 0x6d97a
jp 0x14000833b
invalid
add byte [rbp + rcx*4 + 0x44], cl
and al, 0x70
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
mov byte [rsp + 0x50], 0x70
lea rdx, [r8 + 0x648]
mov byte [rsp + 0x51], 0x67
mov byte [rsp + 0x52], 0x4d
mov byte [rsp + 0x53], 0x77
mov byte [rsp + 0x54], 0x4e
mov byte [rsp + 0x55], 0x55
mov byte [rsp + 0x56], 0x4f
mov byte [rsp + 0x57], 0x55
mov byte [rsp + 0x58], 0x4c
mov byte [rsp + 0x59], 0x24
mov byte [rsp + 0x5a], 0x70
mov byte [rsp + 0x5b], 0x52
mov byte [rsp + 0x5c], 0x21
mov byte [rsp + 0x5d], 0x36
mov byte [rsp + 0x5e], 0x48
mov byte [rsp + 0x5f], 0x55
mov byte [rsp + 0x60], 0x36
mov byte [rsp + 0x61], 0x25
mov byte [rsp + 0x62], 0x5f
mov byte [rsp + 0x63], 0x44
mov byte [rsp + 0x64], 0x75
mov byte [rsp + 0x65], 0x67
mov byte [rsp + 0x66], 0x58
mov byte [rsp + 0x67], 0x43
mov byte [rsp + 0x68], 0
lea rax, [r8 + 0xb0]
nop dword [rax + rax]
mov qword [rax], 0xffffffffc8a18dde
add rax, 8
cmp rax, rdx
jne 0x140008414
sub ecx, 1
jne 0x140008408
cmp qword [rsp + 0x490], 0xffffffffc8a18dde
je 0x140008458
call fcn.1400085a4
xor r8d, r8d
mov rbx, rax
mov edx, 0x6d92a5e2
mov rcx, rax
lea rsi, [rsp + 0x40]
call fcn.1400082c4
mov rcx, rbx
lea rbx, [rsp + 0x38]
xor r8d, r8d
mov edx, 0x3803e5e2
mov rbp, rax
call fcn.1400082c4
xor r8d, r8d
mov rdi, rax
mov qword [rsp + 0x40], 0x4b003
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0x3000
mov r9, rsi
mov rdx, rbx
mov edx, ebx
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x140055294]
xor ecx, ecx
call qword [0x1400582cc]
xor eax, eax
add rsp, 0x6e8
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x1400083b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x6e8
mov ecx, 0x6d97a
jp 0x14000833b
invalid
add byte [rbp + rcx*4 + 0x44], cl
and al, 0x70
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
mov byte [rsp + 0x50], 0x70
lea rdx, [r8 + 0x648]
mov byte [rsp + 0x51], 0x67
mov byte [rsp + 0x52], 0x4d
mov byte [rsp + 0x53], 0x77
mov byte [rsp + 0x54], 0x4e
mov byte [rsp + 0x55], 0x55
mov byte [rsp + 0x56], 0x4f
mov byte [rsp + 0x57], 0x55
mov byte [rsp + 0x58], 0x4c
mov byte [rsp + 0x59], 0x24
mov byte [rsp + 0x5a], 0x70
mov byte [rsp + 0x5b], 0x52
mov byte [rsp + 0x5c], 0x21
mov byte [rsp + 0x5d], 0x36
mov byte [rsp + 0x5e], 0x48
mov byte [rsp + 0x5f], 0x55
mov byte [rsp + 0x60], 0x36
mov byte [rsp + 0x61], 0x25
mov byte [rsp + 0x62], 0x5f
mov byte [rsp + 0x63], 0x44
mov byte [rsp + 0x64], 0x75
mov byte [rsp + 0x65], 0x67
mov byte [rsp + 0x66], 0x58
mov byte [rsp + 0x67], 0x43
mov byte [rsp + 0x68], 0
lea rax, [r8 + 0xb0]
nop dword [rax + rax]
mov qword [rax], 0xffffffffc8a18dde
add rax, 8
cmp rax, rdx
jne 0x140008414
sub ecx, 1
jne 0x140008408
cmp qword [rsp + 0x490], 0xffffffffc8a18dde
je 0x140008458
call fcn.1400085a4
xor r8d, r8d
mov rbx, rax
mov edx, 0x6d92a5e2
mov rcx, rax
lea rsi, [rsp + 0x40]
call fcn.1400082c4
mov rcx, rbx
lea rbx, [rsp + 0x38]
xor r8d, r8d
mov edx, 0x3803e5e2
mov rbp, rax
call fcn.1400082c4
xor r8d, r8d
mov rdi, rax
mov qword [rsp + 0x40], 0x4b003
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0x3000
mov r9, rsi
mov rdx, rbx
mov edx, ebx
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x140055294]
xor ecx, ecx
call qword [0x1400582cc]
xor eax, eax
add rsp, 0x6e8
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x1400085a4
Capabilities:
Access peb ldr_data

Disassembly:
xor rax, rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x20]
mov rax, qword [rax]
mov rax, qword [rax + 0x20]
ret
Function at 0x14000a160
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 8], rcx
push rbp
push rdi
push r14
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x140117240]
xor rax, rsp
mov qword [rbp + 0x28], rax
mov rsi, qword [rbp + 0x50]
xor r14d, r14d
mov dword [rbp], 0x560041
mov dword [rbp + 4], 0x530041
mov dword [rbp + 8], 0x5f0054
mov dword [rbp + 0xc], 0x520050
mov dword [rbp + 0x10], 0x47004f
mov dword [rbp + 0x14], 0x450052
mov dword [rbp + 0x18], 0x530053
mov dword [rbp + 0x1c], 0x57005f
mov dword [rbp + 0x20], 0x44004e
mov word [rbp + 0x24], r14w
mov qword [rbp - 0x70], 0x50
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], r14
mov qword [rbp - 0x38], r14
mov qword [rbp - 0x28], r14
lea rax, [rbp]
mov qword [rbp - 0x30], rax
lea rax, [0x14000a3b0]
mov qword [rbp - 0x68], rax
mov edx, 0x7f00
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorW]
mov qword [rbp - 0x48], rax
xor ecx, ecx
call qword [sym.imp.GDI32.dll_GetStockObject]
mov qword [rbp - 0x40], rax
lea rcx, [rbp - 0x70]
call qword [sym.imp.USER32.dll_RegisterClassExW]
test ax, ax
je 0x14000a373
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov ebx, eax
lea ecx, [r14 + 1]
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, eax
lea eax, [rbx - 0x12c]
cdq
sub eax, edx
sar eax, 1
mov ebx, eax
lea eax, [rcx - 0x64]
cdq
sub eax, edx
sar eax, 1
mov edi, eax
call fcn.1400511a0
lea r9, [rax + 0x90]
mov rdx, qword [r9 + 0x10]
movabs rcx, 0x7ffffffffffffffe
sub rcx, rdx
cmp rcx, 0x18
jb 0x14000a39b
cmp qword [r9 + 0x18], 7
jbe 0x14000a295
mov r9, qword [r9]
mov qword [rsp + 0x30], 0x18
lea rax, str._Antivirus_is_loading...
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdx
lea rcx, [rbp - 0x20]
call fcn.140006510
nop
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea r8, [rbp - 0x20]
cmp qword [rbp - 8], 7
cmova r8, qword [rbp - 0x20]
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], r14
mov dword [rsp + 0x38], 0x64
mov dword [rsp + 0x30], 0x12c
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], ebx
xor r9d, r9d
lea rdx, [rbp]
xor ecx, ecx
call qword [sym.imp.USER32.dll_CreateWindowExW]
test rax, rax
je 0x14000a34b
mov edx, 5
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
nop
lea rcx, [rbp - 0x20]
call fcn.140008760
mov rcx, qword [rbp + 0x28]
xor rcx, rsp
call fcn.1400827b0
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
lea r8, str.Could_not_create_window_
mov edx, 0x428
lea rcx, [rsp + 0x68]
call fcn.140007b20
lea rdx, [0x140114310]
lea rcx, [rsp + 0x68]
call fcn.1400850a4
nop
lea r8, str.Could_not_register_class_
mov edx, 0x428
lea rcx, [rsp + 0x68]
call fcn.140007b20
lea rdx, [0x140114310]
lea rcx, [rsp + 0x68]
call fcn.1400850a4
int3
call fcn.1400082a0
int3
Function at 0x14000ad30
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov word [rsp + 8], cx
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0x90
mov rax, qword [0x140117240]
xor rax, rsp
mov qword [rbp + 0x27], rax
movzx r13d, word [rbp + 0x67]
xor ebx, ebx
mov dword [rbp - 0x35], ebx
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x31], xmm1
mov qword [rbp - 0x21], rbx
mov dword [rbp - 0x35], 1
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov rsi, qword [rbp - 0x29]
bt edi, ebx
jae 0x14000adc7
lea ecx, [rbx + 0x41]
mov word [rbp - 0x39], cx
cmp rsi, qword [rbp - 0x21]
je 0x14000adb3
mov word [rsi], cx
mov rsi, qword [rbp - 0x29]
add rsi, 2
mov qword [rbp - 0x29], rsi
jmp 0x14000adc7
lea r8, [rbp - 0x39]
mov rdx, rsi
lea rcx, [rbp - 0x31]
call fcn.14002e300
mov rsi, qword [rbp - 0x29]
inc ebx
cmp ebx, 0x1a
jl 0x14000ad90
lea r14, str.CDEFGHIJKLMNOPQRSTUVWXYZ
nop word [rax + rax]
movzx r12d, word [r14]
mov rbx, qword [rbp - 0x31]
cmp rbx, rsi
je 0x14000ae2a
nop dword [rax]
movzx ecx, word [rbx]
call fcn.140092168
mov edi, eax
mov ecx, r12d
call fcn.140092168
cmp eax, edi
je 0x14000ae0f
add rbx, 2
cmp rbx, rsi
jne 0x14000adf0
mov rsi, qword [rbp - 0x29]
cmp rbx, rsi
je 0x14000ae2a
add r14, 2
lea rax, [0x1400f330a]
cmp r14, rax
jne 0x14000ade0
jmp 0x14000ae96
movzx r8d, r13w
mov edx, 1
lea rcx, [rbp - 0x19]
call fcn.1400080a0
nop
mov r8d, 2
lea rdx, [0x1400ee904]
lea rcx, [rbp - 0x19]
call fcn.140008660
lea rdx, [rbp - 0x19]
cmp qword [rbp - 1], 7
cmova rdx, qword [rbp - 0x19]
lea rcx, [rbp + 7]
call fcn.140065710
nop
movzx ecx, r13w
call fcn.14000aed0
movzx edx, r12w
lea rcx, [rbp + 7]
call fcn.14000abf0
nop
lea rcx, [rbp + 7]
call fcn.140008760
nop
lea rcx, [rbp - 0x19]
call fcn.140008760
nop
lea rcx, [rbp - 0x31]
call fcn.14000afd0
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.1400827b0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x14002cfb0
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xa0
mov rax, qword [0x140117240]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov rbx, qword [rbp + 0x67]
mov qword [rbp - 1], rbx
mov rdi, qword [rbp + 0x6f]
xor esi, esi
mov dword [rbp - 0x29], esi
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx], rsi
mov qword [rbx + 8], rsi
mov qword [rbx + 0x10], rsi
mov dword [rbp - 0x29], 1
mov qword [rbp + 0xf], rsi
lea rdx, [rbp + 0xf]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x14002d0dd
cmp dword [rbp + 0x13], esi
jne 0x14002d0b7
mov edx, dword [rbp + 0xf]
mov rcx, rbx
call fcn.140029530
mov dword [rbp + 7], esi
xorps xmm0, xmm0
movups xmmword [rbp + 0x17], xmm0
movups xmmword [rbp + 0x27], xmm0
lea rax, [rbp + 0x17]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 7]
mov r8d, dword [rbp + 0xf]
mov rdx, qword [rbx]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14002d08e
mov edx, dword [rbp + 7]
mov rcx, rbx
call fcn.140029530
mov rax, rbx
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.1400827b0
mov rbx, qword [rsp + 0xd0]
add rsp, 0xa0
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea r8, str.get_file_content:_ReadFile
lea rcx, [rbp - 0x21]
call fcn.140007b20
lea rdx, [0x140114310]
lea rcx, [rbp - 0x21]
call fcn.1400850a4
int3
lea r8, str.get_file_content
mov edx, 0xdf
lea rcx, [rbp - 0x21]
call fcn.140007b20
lea rdx, [0x140114310]
lea rcx, [rbp - 0x21]
call fcn.1400850a4
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea r8, str.get_file_content:_GetFileSizeEx
lea rcx, [rbp - 0x21]
call fcn.140007b20
lea rdx, [0x140114310]
lea rcx, [rbp - 0x21]
call fcn.1400850a4
int3
Function at 0x140046800
Capabilities:
Compare security identifiers

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rbp
lea rbp, [rsp - 0x20]
sub rsp, 0x120
mov rax, qword [0x140117240]
xor rax, rsp
mov qword [rbp + 0x10], rax
mov rbx, qword [rbp + 0x30]
mov qword [rsp + 0x58], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x58]
mov edx, 0x20008
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x140046856
xor bl, bl
jmp 0x1400468fb
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x48], xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
movups xmmword [rbp - 8], xmm0
mov dword [rbp + 8], eax
mov dword [rsp + 0x50], eax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0x54
lea r8, [rbp - 0x48]
lea edx, [r9 - 0x53]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x140046957
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rbp - 0x80], xmm0
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rbp - 0x60], xmm0
mov dword [rbp - 0x50], eax
mov dword [rsp + 0x50], eax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0x54
lea r8, [rsp + 0x60]
lea edx, [r9 - 0x53]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x14004692b
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
setne bl
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x14004690b
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, bl
mov rcx, qword [rbp + 0x10]
xor rcx, rsp
call fcn.1400827b0
mov rbx, qword [rsp + 0x138]
add rsp, 0x120
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov edx, eax
lea r8, str.GetTokenInformation_TokenUser_failed
lea rcx, [rsp + 0x30]
call fcn.140007b20
lea rdx, [0x140114310]
lea rcx, [rsp + 0x30]
call fcn.1400850a4
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea r8, str.GetTokenInformation_TokenUser_failed
lea rcx, [rsp + 0x30]
call fcn.140007b20
lea rdx, [0x140114310]
lea rcx, [rsp + 0x30]
call fcn.1400850a4
int3

Function at 0x1400491b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x20], 0x33393930
mov dword [rsp + 0x24], 0x35364632
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x3c], rax
mov dword [rsp + 0x30], 0x6b736174
mov qword [rsp + 0x34], 0x73
mov dword [rsp + 0x44], 0xc
call fcn.14003c9d0
add rsp, 0x58
ret
Function at 0x140049f00
Capabilities:
Create thread
Resume thread

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
mov dword [rsp + 0x10], edx
mov qword [r11 + 8], rcx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x90
mov rax, qword [0x140117240]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rdi, rcx
xor ebx, ebx
mov eax, dword [r11 + 0x10]
mov dword [rcx + 0xe0], eax
cmp byte [0x14012bb10], bl
je 0x140049f5e
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rcx, [0x140000000]
cmp rcx, rax
jne 0x14004a11b
call fcn.14003fca0
mov rcx, rax
call fcn.140062840
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov rdx, qword [rdi + 0x18]
test rdx, rdx
je 0x14004a115
mov eax, dword [rdx + 8]
test eax, eax
je 0x14004a115
nop dword [rax]
lea ecx, [rax + 1]
lock cmpxchg dword [rdx + 8], ecx
je 0x140049fa4
test eax, eax
je 0x14004a115
jmp 0x140049f90
mov rax, qword [rdi + 0x10]
mov qword [rsp + 0x30], rax
mov rax, qword [rdi + 0x18]
mov qword [rsp + 0x38], rax
lea rdx, [rsp + 0x30]
lea rcx, [rdi + 0x60]
call fcn.140047170
mov dword [rsp + 0x78], ebx
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 4
mov r9, rdi
lea r8, [0x14004b680]
xor edx, edx
xor ecx, ecx
call fcn.140099798
mov rbp, rax
test rax, rax
je 0x14004a0db
mov eax, dword [rsp + 0x78]
mov dword [rdi + 0xe4], eax
mov rdx, rbp
lea rcx, [rdi + 0xf0]
call fcn.14003f2d0
lea rcx, [rdi + 0x70]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [rdi + 0x58]
test rax, rax
je 0x14004a029
lock inc dword [rax + 8]
mov rbx, qword [rdi + 0x50]
mov qword [rsp + 0x40], rbx
mov rsi, qword [rdi + 0x58]
mov qword [rsp + 0x48], rsi
lea rcx, [rdi + 0x70]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
mov rax, qword [rbx]
lea r8, [rdi + 0xf0]
mov edx, dword [rdi + 0xe4]
mov rcx, rbx
mov rax, qword [rax + 0x28]
call qword [case.0x14006e76f.0]
nop
test rsi, rsi
je 0x14004a0a3
mov ebx, 0xffffffff
mov eax, ebx
lock xadd dword [rsi + 8], eax
cmp eax, 1
jne 0x14004a0a3
mov rax, qword [rsi]
mov rcx, rsi
mov rax, qword [rax]
call qword [case.0x14006e76f.0]
lock xadd dword [rsi + 0xc], ebx
cmp ebx, 1
jne 0x14004a0a3
mov rax, qword [rsi]
mov rcx, rsi
mov rax, qword [rax + 8]
call qword [case.0x14006e76f.0]
mov rcx, rdi
call fcn.14004b6b0
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1400827b0
mov rbx, qword [rsp + 0xd0]
add rsp, 0x90
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call fcn.140096a98
mov r9d, dword [rax]
mov rcx, rdi
call fcn.140009ad0
mov rdx, rax
mov r8d, ebx
lea rcx, [rsp + 0x50]
call fcn.14004cd10
lea rdx, [0x140114b18]
lea rcx, [rsp + 0x50]
call fcn.1400850a4
int3
call fcn.14002e590
int3
lea rcx, [0x14012baa0]
call fcn.14002e5b0
test al, al
jne 0x14004a137
lea rcx, str.Thread_started_at_dll_unload.
call fcn.14006fb50
mov rcx, rdi
call fcn.140009ad0
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.14004d0d0
lea rdx, [0x140114b90]
lea rcx, [rsp + 0x50]
call fcn.1400850a4
int3
Function at 0x14004a6f0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x140117240]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rdi, qword [rsp + 0x60]
mov qword [rsp + 0x28], rdi
xor ebp, ebp
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
call fcn.14004b9c0
mov rcx, rax
call fcn.140062840
mov rsi, rax
mov qword [rsp + 0x28], rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [rsp + 0x30], 1
call fcn.14004b9c0
mov rcx, rax
call fcn.140062840
mov r8, rax
mov r9d, dword [rsp + 0x68]
movzx edx, r9b
movabs rax, 0xcbf29ce484222325
xor rdx, rax
movabs r10, 0x100000001b3
imul rdx, r10
movzx ecx, byte [rsp + 0x69]
xor rdx, rcx
imul rdx, r10
movzx eax, byte [rsp + 0x6a]
xor rdx, rax
imul rdx, r10
movzx eax, byte [rsp + 0x6b]
xor rdx, rax
imul rdx, r10
mov rcx, qword [r8 + 0x58]
and rcx, rdx
add rcx, rcx
mov rax, qword [r8 + 0x40]
mov rbx, qword [rax + rcx*8 + 8]
mov rdx, qword [r8 + 0x30]
cmp rbx, rdx
je 0x14004a7e1
mov rax, qword [rax + rcx*8]
cmp r9d, dword [rbx + 0x10]
je 0x14004a7e4
nop dword [rax]
cmp rbx, rax
je 0x14004a7e1
mov rbx, qword [rbx + 8]
cmp r9d, dword [rbx + 0x10]
jne 0x14004a7d0
jmp 0x14004a7e4
mov rbx, rbp
test rbx, rbx
cmove rbx, rdx
call fcn.14004b9c0
mov rcx, rax
call fcn.140062840
cmp rbx, qword [rax + 0x30]
jne 0x14004a807
mov qword [rdi], rbp
mov qword [rdi + 8], rbp
jmp 0x14004a844
mov r8, rbp
mov r9, rbp
mov rdx, qword [rbx + 0x28]
test rdx, rdx
je 0x14004a83d
mov eax, dword [rdx + 8]
test eax, eax
je 0x14004a838
nop dword [rax]
lea ecx, [rax + 1]
lock cmpxchg dword [rdx + 8], ecx
je 0x14004a830
test eax, eax
jne 0x14004a820
jmp 0x14004a838
mov r8, qword [rbx + 0x20]
mov r9, qword [rbx + 0x28]
mov rsi, qword [rsp + 0x28]
mov qword [rdi], r8
mov qword [rdi + 8], r9
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, rdi
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400827b0
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x14004b480
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov rax, qword [0x140117240]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rsi, qword [rsp + 0x50]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
call fcn.14004b9c0
mov rcx, rax
call fcn.140062840
mov rdi, rax
mov qword [rsp + 0x20], rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [rsp + 0x28], 1
call fcn.14004b9c0
mov rcx, rax
call fcn.140062840
mov r8, rax
movzx edx, byte [rsi]
movabs rax, 0xcbf29ce484222325
xor rdx, rax
movabs r9, 0x100000001b3
imul rdx, r9
movzx ecx, byte [rsi + 1]
xor rdx, rcx
imul rdx, r9
movzx eax, byte [rsi + 2]
xor rdx, rax
imul rdx, r9
movzx eax, byte [rsi + 3]
xor rdx, rax
imul rdx, r9
mov rcx, qword [r8 + 0x58]
and rcx, rdx
shl rcx, 4
mov rdx, qword [r8 + 0x40]
add rdx, rcx
mov rbx, qword [rdx + 8]
cmp rbx, qword [r8 + 0x30]
je 0x14004b558
mov rcx, qword [rdx]
mov eax, dword [rsi]
cmp eax, dword [rbx + 0x10]
je 0x14004b55a
cmp rbx, rcx
je 0x14004b558
mov rbx, qword [rbx + 8]
cmp eax, dword [rbx + 0x10]
jne 0x14004b548
jmp 0x14004b55a
xor ebx, ebx
test rbx, rbx
je 0x14004b5ea
mov rax, qword [rdx]
cmp qword [rdx + 8], rbx
jne 0x14004b588
cmp rax, rbx
jne 0x14004b57e
mov rax, qword [r8 + 0x30]
mov qword [rdx], rax
mov qword [rdx + 8], rax
jmp 0x14004b593
mov rax, qword [rbx + 8]
mov qword [rdx + 8], rax
jmp 0x14004b593
cmp rax, rbx
jne 0x14004b593
mov rax, qword [rbx]
mov qword [rdx], rax
mov rcx, qword [rbx]
dec qword [r8 + 0x38]
mov rax, qword [rbx + 8]
mov qword [rax], rcx
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
lea rcx, [rbx + 0x30]
call fcn.140009ae0
mov rcx, qword [rbx + 0x28]
test rcx, rcx
je 0x14004b5dc
mov eax, 0xffffffff
lock xadd dword [rcx + 0xc], eax
cmp eax, 1
jne 0x14004b5d7
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14006e76f.0]
mov rdi, qword [rsp + 0x20]
mov edx, 0x40
mov rcx, rbx
call fcn.1400827d0
nop
cmp byte [rsp + 0x28], 0
je 0x14004b5fa
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400827b0
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret