joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002c7a0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov dword [rsp + 0x10], edx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov rbx, r9
mov rbp, r8
mov r15, rcx
mov dword [rsp + 0x70], 0x78563412
cmp dword [rcx + 0x58], 1
jbe 0x14002c994
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x20], xmm0
xor esi, esi
mov qword [rsp + 0x30], rsi
mov byte [rsp + 0x78], sil
movzx eax, byte [rcx + 0x5c]
neg al
sbb rdx, rdx
and edx, 4
mov eax, esi
mov ecx, 2
cmp r8, 0x7e
cmovae eax, ecx
add rdx, rax
mov eax, 8
cmp r8, 0x10000
cmovae ecx, eax
add rdx, rcx
lea r8, [rsp + 0x78]
lea rcx, [rsp + 0x20]
call fcn.14002ca20
mov rdi, qword [rsp + 0x20]
mov byte [rdi], 0x82
movzx edx, byte [r15 + 0x5c]
cmp rbp, 0x7e
jae 0x14002c857
neg dl
sbb al, al
and al, 0x80
or al, bpl
mov byte [rdi + 1], al
cmp byte [r15 + 0x5c], sil
je 0x14002c8f7
mov dword [rdi + 2], 0x78563412
jmp 0x14002c8f7
mov rcx, rbp
shr rcx, 8
cmp rbp, 0x10000
jae 0x14002c892
mov eax, 0x7e
mov r8d, 0xfe
test dl, dl
cmovne eax, r8d
mov byte [rdi + 1], al
mov byte [rdi + 2], cl
mov byte [rdi + 3], bpl
cmp byte [r15 + 0x5c], 0
je 0x14002c8f7
mov dword [rdi + 4], 0x78563412
jmp 0x14002c8f7
mov eax, 0x7f
mov r8d, 0xff
test dl, dl
cmovne eax, r8d
mov byte [rdi + 1], al
mov rax, rbp
shr rax, 0x38
mov byte [rdi + 2], al
mov rax, rbp
shr rax, 0x30
mov byte [rdi + 3], al
mov rax, rbp
shr rax, 0x28
mov byte [rdi + 4], al
mov rax, rbp
shr rax, 0x20
mov byte [rdi + 5], al
mov rax, rbp
shr rax, 0x18
mov byte [rdi + 6], al
mov rax, rbp
shr rax, 0x10
mov byte [rdi + 7], al
mov byte [rdi + 8], cl
mov byte [rdi + 9], bpl
cmp byte [r15 + 0x5c], 0
je 0x14002c8f7
mov dword [rdi + 0xa], 0x78563412
mov r9, qword [rsp + 0x28]
sub r9, rdi
mov rdx, qword [r15 + 0x28]
mov r8, rdi
lea rcx, [r15 + 0x20]
call fcn.14002cbb0
mov r9, qword [rsp + 0x90]
sub r9, rbx
mov rdx, qword [r15 + 0x28]
mov r8, rbx
lea rcx, [r15 + 0x20]
call fcn.14002cbb0
cmp byte [r15 + 0x5c], 0
je 0x14002c963
mov r8, qword [r15 + 0x28]
sub r8, qword [r15 + 0x20]
sub r8, rbp
test rbp, rbp
je 0x14002c963
mov rdx, qword [r15 + 0x20]
add rdx, rsi
movzx ecx, byte [rdx + r8]
mov rax, rsi
and eax, 3
xor cl, byte [rsp + rax + 0x70]
mov byte [rdx + r8], cl
inc rsi
cmp rsi, rbp
jne 0x14002c941
mov rdx, qword [rsp + 0x30]
sub rdx, rdi
mov rax, rdi
cmp rdx, 0x1000
jb 0x14002c98c
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002c9a8
mov rcx, rdi
call fcn.140054120
mov rbx, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call fcn.14006a6c0
int3

Function at 0x1400494b0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
lea r9, [rdx + rdx]
movabs r8, 0xcbf29ce484222325
xor edx, edx
test r9, r9
je 0x140035f46
movzx eax, byte [rcx + rdx]
movabs r10, 0x100000001b3
xor r8, rax
inc rdx
imul r8, r10
cmp rdx, r9
jb 0x140035f29
mov rax, r8
ret
sub r8, rdx
mov rcx, rdx
sar r8, 1
mov rdx, r8
jmp 0x140035f14
Function at 0x140054e18
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140054e62
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140054e62
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140054e62
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140054e62
cmp dword [rcx + 0x84], 0xe
jbe 0x140054e62
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140054e64
xor al, al
add rsp, 0x28
ret

Function at 0x14006d880
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14006d5e4

Function at 0x140074750
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
mov rbp, rsp
sub rsp, 0x20
test rcx, rcx
jne 0x1400745f0
call fcn.140066edc
mov dword [rax], socket
call fcn.14006a6a0
or eax, 0xffffffff
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop rbp
ret
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x1400745d8
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 0xc
test cl, 1
jne 0x1400745d8
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
mov rax, qword [rbp + 0x10]
shr ecx, 1
test cl, 1
je 0x140074622
lock or dword [rax + 0x14], 0x10
jmp 0x1400745d8
lock or dword [rax + 0x14], 1
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
test ecx, 0x4c0
jne 0x14007463f
mov rcx, qword [rbp + 0x10]
call fcn.14007583c
mov rax, qword [rbp + 0x10]
mov rcx, qword [rax + 8]
mov qword [rax], rcx
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.14006fe5c
mov rdx, qword [rbp + 0x10]
mov ecx, eax
mov r8d, dword [rdx + 0x20]
mov rdx, qword [rdx + 8]
call fcn.140075dd0
mov dword [rbx + 0x10], eax
mov rax, qword [rbp + 0x10]
mov edx, dword [rax + 0x10]
lea ecx, [rdx + 1]
cmp ecx, 1
ja 0x140074696
neg edx
sbb ecx, ecx
and ecx, 8
add ecx, 8
lock or dword [rax + 0x14], ecx
mov rax, qword [rbp + 0x10]
and dword [rax + 0x10], 0
jmp 0x1400745d8
mov ecx, dword [rax + 0x14]
test cl, 6
jne 0x140074702
mov rcx, qword [rbp + 0x10]
call fcn.14006fe5c
cmp eax, 0xffffffff
je 0x1400746e9
mov rcx, qword [rbp + 0x10]
call fcn.14006fe5c
cmp eax, 0xfffffffe
je 0x1400746e9
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.14006fe5c
movsxd rdi, eax
lea rsi, [0x1400a5900]
mov rcx, rbx
sar rdi, 6
call fcn.14006fe5c
and eax, 0x3f
shl rax, 6
add rax, qword [rsi + rdi*8]
jmp 0x1400746f0
lea rax, [0x1400a2330]
mov al, byte [rax + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x140074702
mov rax, qword [rbp + 0x10]
lock or dword [rax + 0x14], 0x20
mov rax, qword [rbp + 0x10]
cmp dword [rax + 0x20], 0x200
jne 0x140074738
mov ecx, dword [rax + 0x14]
shr ecx, 6
test cl, 1
je 0x140074734
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 8
test cl, 1
jne 0x140074734
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x20], 0x1000
mov rax, qword [rbp + 0x10]
dec dword [rax + 0x10]
mov rcx, qword [rax]
movzx edx, byte [rcx]
inc rcx
mov qword [rax], rcx
mov eax, edx
jmp 0x1400745db
jmp 0x1400745a8
Function at 0x140080380
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400803a8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1400803a8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x14003ca00
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x14003ca0d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14003ca1d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x14003ca05
lea eax, [rcx + 1]
call r11
adc eax, eax
add ebx, ebx
jne 0x14003ca35
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x14003ca22
sub eax, 3
jb 0x14003ca4f
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x14003ca86
movsxd rbp, eax
lea eax, [rcx + 1]
call r11
adc ecx, ecx
call r11
adc ecx, ecx
jne 0x14003ca76
mov ecx, eax
add eax, 2
call r11
adc ecx, ecx
add ebx, ebx
jne 0x14003ca74
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x14003ca63
cmp rbp, 0xfffffffffffff300
adc ecx, eax
call fcn.14003c9c2
jmp 0x14003ca0d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x23e00
mov dl, reloc.COMCTL32.dll_InitCommonControls
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x14003cad2
cmp rsi, rcx
jae 0x14003cada
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x14003cab9
cmp al, 0x8f
ja 0x14003cab9
cmp byte [rsi - 2], 0xf
je 0x14003cabf
sub al, 0xe8
cmp al, 1
ja 0x14003caa3
cmp rsi, rcx
jae 0x14003cada
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x14003caa9
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x14003cada
lodsb al, byte [rsi]
jmp 0x14003cab9
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x39000]
mov eax, dword [rdi]
or eax, eax
je 0x14003cb43
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x40d58]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x14003cae7
jns 0x14003cb1c
movzx rdx, word [rdi]
add rdi, 2
jmp 0x14003cb26
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x14003cb3d
mov qword [rbx], rax
add rbx, 8
jmp 0x14003cb07
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x18f]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x14003cb9b
sub rsp, 0xffffffffffffff80
jmp 0x1400242ac
Function at 0x140001090
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x140001108
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x140001108
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
add rcx, rbx
and edi, 0xf
jbe 0x1400010f5
nop
cmp rbx, rcx
jae 0x140001108
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
add edi, 0xffffffff
jne 0x1400010e0
cmp rbx, rcx
jae 0x140001108
xor eax, eax
cmp word [rbx], ax
cmove rbx, rax
mov rax, rbx
jmp 0x14000110a
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400046c0
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rbp, rcx
mov r8d, 0xe
lea rdx, str.128
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
je 0x1400048f0
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x1400048f0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rsi, rax
test rax, rax
je 0x1400048f0
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
test eax, eax
je 0x1400048f0
movzx r15d, word [rsi + 4]
lea ebx, [r15 - 1]
shl ebx, 4
add ebx, 0x16
mov ecx, ebx
call fcn.14000689c
mov rdi, rax
xor r13d, r13d
mov dword [rax], 0x10000
lea r10d, [r13 + 1]
mov word [rax + 4], r15w
mov r8d, ebx
test r15d, r15d
je 0x1400047c2
lea rcx, [rax + 7]
lea rdx, [rsi + 7]
mov r9d, r15d
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rdx - 1]
mov byte [rcx - 1], al
movzx eax, byte [rdx]
mov byte [rcx], al
movzx eax, byte [rdx + 1]
mov byte [rcx + 1], al
mov byte [rcx + 2], r13b
movzx eax, word [rdx + 3]
mov word [rcx + 3], ax
movzx eax, word [rdx + 5]
mov word [rcx + 5], ax
mov eax, dword [rdx + 7]
mov dword [rcx + 7], eax
mov dword [rcx + 0xb], r8d
add r8d, dword [rdx + 7]
lea rcx, [rcx + 0x10]
lea rdx, [rdx + 0xe]
sub r9, r10
jne 0x140004780
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, r10d
mov edx, 0x40000000
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r12, rax
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x88]
mov r8d, ebx
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, r13d
test r15d, r15d
je 0x1400048e7
add rsi, 0x12
call fcn.1400011f0
mov rcx, rax
test rax, rax
je 0x14000490a
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x90], rax
movzx r8d, word [rsi]
lea rdx, [0x140027478]
lea rcx, [rsp + 0x90]
call fcn.140005f10
mov r8d, 3
mov rbx, qword [rsp + 0x90]
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov r14, rax
test rax, rax
je 0x1400048bc
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x1400048bc
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbp, rax
test rax, rax
je 0x1400048bc
mov rdx, r14
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x88]
mov r8d, eax
mov rdx, rbp
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
nop
lea rdx, [rbx - 0x18]
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400048d8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
inc edi
add rsi, 0xe
cmp edi, r15d
jl 0x140004817
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rbx, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x80004005
call fcn.140001050
int3
Function at 0x140006cdc
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140006d26
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140006d26
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140006d26
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140006d26
cmp dword [rcx + 0x84], 0xe
jbe 0x140006d26
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140006d28
xor al, al
add rsp, 0x28
ret

Function at 0x14000f058
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14000ee84
Function at 0x40ee20
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x40ef99
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.00426f40
xorps xmm15, xmm15
mov r14, qword [0x0053e508]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x40ee90
mov rbx, qword [rsp + 0x60]
jmp 0x40eea0
add rsp, 0x48
pop rbp
ret
sub rax, rbx
add rcx, rbx
mov rbx, rax
nop
test rbx, rbx
jbe 0x40eec5
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rcx
mov rax, rbx
jmp 0x40eed5
cmp rbx, 0x1000
jae 0x40ee96
nop dword [rax]
jmp 0x40ef49
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
cmp rbx, 0x1000
jae 0x40eee2
xor edx, edx
jmp 0x40ef40
mov qword [rsp + 0x30], rbx
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.00426f40
xorps xmm15, xmm15
mov r14, qword [0x0053e508]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
mov edx, eax
mov rax, qword [rsp + 0x38]
nop
test dl, dl
jne 0x40eecb
jmp 0x40eeb4
call fcn.0044de00
xorps xmm15, xmm15
mov r14, qword [0x0053e508]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
cmp eax, 8
jne 0x40ef80
lea rax, [0x0046231b]
mov ebx, 0xd
call fcn.00428f20
nop dword [rax]
cmp eax, 0x5af
je 0x40ef68
lea rax, [0x00463b47]
mov ebx, 0x1f
call fcn.00428f20
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0044a780
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0040ee20
Function at 0x4153e0
Capabilities:
Hash data using murmur3

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4155fa
push rbp
mov rbp, rsp
sub rsp, 0x30
test rax, 7
jne 0x4155e8
mov qword [rsp + 0x40], rax
mov rdx, qword [rdi + 0x48]
test byte [rdx], al
mov r9, r8
shr r9, 3
mov r10, r8
and r10d, 7
nop
mov r11, rcx
mov rcx, r10
mov r12d, 1
shl r12d, cl
lea r10, [rdx + r9]
cmp byte [0x0053e34f], 0
jne 0x415521
cmp dword [0x0053e814], 0
nop
jle 0x415469
movzx r13d, word [rdi + 0x34]
cmp r8, r13
jb 0x415469
mov r8, qword [rdi + 0x40]
test byte [r8], al
movzx r8d, byte [r9 + r8]
nop
nop dword [rax]
test r12b, r8b
je 0x415598
movzx edx, byte [r9 + rdx]
test r12b, dl
jne 0x41551b
nop
lock or byte [r10], r12b
mov rcx, qword [rdi + 0x18]
movabs rdx, 0x800000000000
add rdx, rcx
mov r8, rdx
shr rdx, 0x2a
nop
nop
nop
nop word [rax + rax]
cmp rdx, 0x40
jae 0x41558b
lea r9, [0x004d0458]
mov rdx, qword [r9 + rdx*8]
test byte [rdx], al
mov r9, rcx
shr r9, 0x10
and r9d, 0x3f
shr rcx, 0xd
and ecx, 7
mov r10d, 1
shl r10d, cl
shr r8, 0x16
and r8d, 0xfffff
mov rdx, qword [rdx + r8*8]
test byte [rdx], al
movzx r8d, byte [rdx + r9 + 0x1040]
lea rdx, [rdx + r9]
lea rdx, [rdx + 0x1040]
test r10b, r8b
jne 0x415500
lock or byte [rdx], r10b
movzx edx, byte [rdi + 0x62]
test dl, 1
je 0x415542
mov rax, qword [rsi + 0x10]
add rax, qword [rdi + 0x68]
mov qword [rsi + 0x10], rax
add rsp, 0x30
pop rbp
ret
add rsp, 0x30
pop rbp
ret
mov qword [rsp + 0x60], rsi
mov rcx, r11
mov rdi, r10
mov esi, r12d
call fcn.0040ea40
test al, al
jne 0x415578
mov rax, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x60]
prefetcht0 byte [rax]
mov rdx, qword [rsi]
test rdx, rdx
je 0x415567
mov rdi, qword [rdx + 0x10]
cmp rdi, 0xfd
je 0x415567
jae 0x41557e
mov qword [rdx + rdi*8 + 0x18], rax
inc qword [rdx + 0x10]
jmp 0x415572
mov rbx, rax
mov rax, rsi
call fcn.0041ac40
add rsp, 0x30
pop rbp
ret
add rsp, 0x30
pop rbp
ret
mov rax, rdi
mov ecx, 0xfd
call fcn.0044c9e0
mov rax, rdx
mov ecx, 0x40
call fcn.0044ca00
lea rax, [0x0046210c]
mov rcx, rbx
mov rdi, r11
mov ebx, 4
call fcn.00415660
lea rax, [0x004620fa]
mov ebx, 3
mov rcx, qword [rsp + 0x40]
mov rdi, 0xffffffffffffffff
call fcn.00415660
mov rdx, qword [r14 + 0x30]
mov byte [rdx + 0xf1], 2
lea rax, [0x004627d9]
mov ebx, 0x13
call fcn.00428f20
lea rax, [0x004640c2]
mov ebx, 0x23
call fcn.00428f20
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
call fcn.0044a780
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
nop dword [rax + rax]
jmp fcn.004153e0
Function at 0x415760
Capabilities:
Hash data using murmur3

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
cmp byte [0x0053e34f], 0
jne 0x415850
sub rbx, qword [rax + 0x18]
mov rdx, qword [rax + 0x48]
test byte [rdx], al
mov ecx, dword [rax + 0x5c]
imul rcx, rbx
mov rbx, rcx
shr rbx, 0x20
shr rcx, 0x23
and ebx, 7
mov rsi, rcx
mov rcx, rbx
mov edi, 1
shl edi, cl
add rdx, rsi
nop
nop
nop
nop
lock or byte [rdx], dil
mov rcx, qword [rax + 0x18]
movabs rdx, 0x800000000000
add rdx, rcx
mov rbx, rdx
shr rdx, 0x2a
nop
nop
nop
cmp rdx, 0x40
jae 0x415843
lea rsi, [0x004d0458]
mov rdx, qword [rsi + rdx*8]
test byte [rdx], al
mov rsi, rcx
shr rsi, 0x10
and esi, 0x3f
shr rcx, 0xd
and ecx, 7
mov edi, 1
shl edi, cl
shr rbx, 0x16
and ebx, 0xfffff
mov rdx, qword [rdx + rbx*8]
test byte [rdx], al
movzx ebx, byte [rdx + rsi + 0x1040]
lea rdx, [rdx + rsi]
lea rdx, [rdx + 0x1040]
test dil, bl
jne 0x41581e
lock or byte [rdx], dil
mov rcx, qword [r14 + 0x30]
mov rcx, qword [rcx + 0xa0]
test byte [rcx], al
mov rdx, qword [rcx + 0x1270]
add rdx, qword [rax + 0x68]
mov qword [rcx + 0x1270], rdx
add rsp, 0x10
pop rbp
ret
mov rax, rdx
mov ecx, 0x40
call fcn.0044ca00
lea rax, [0x00464beb]
mov ebx, 0x2c
nop dword [rax]
call fcn.00428f20
nop
int3

Function at 0x4177a0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4178a6
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov byte [rsp + 0x70], dil
mov qword [rsp + 0x10], 0
jmp 0x4177e3
mov rax, qword [rsp + 0x58]
mov rcx, rdx
mov rbx, qword [rsp + 0x60]
movzx edi, byte [rsp + 0x70]
cmp qword [rsp + 0x10], rbx
jae 0x41789b
test byte [rax], al
lea rcx, [rax + 0x100b8]
mov ebx, edi
mov rax, rcx
nop dword [rax]
call fcn.00418340
test rax, rax
je 0x41789b
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
lea rcx, [0x004178e0]
mov qword [rsp + 0x18], rcx
lea rdx, [rsp + 0x10]
mov qword [rsp + 0x20], rdx
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x40], rax
lea rbx, [rsp + 0x18]
mov qword [rsp], rbx
nop dword [rax]
call fcn.0044a660
xorps xmm15, xmm15
mov r14, qword [0x0053e508]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x68]
nop dword [rax]
test rdx, rdx
jne 0x417889
xor eax, eax
jmp 0x417893
mov rax, qword [rdx]
call rax
mov rdx, qword [rsp + 0x68]
test al, al
je 0x4177d1
mov rax, qword [rsp + 0x10]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov byte [rsp + 0x20], dil
call fcn.0044a780
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movzx edi, byte [rsp + 0x20]
jmp fcn.004177a0
Function at 0x422ba0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x422c99
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rax + 0x108], 0
mov ecx, dword [0x0053e830]
test ecx, ecx
je 0x422c72
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x10], 0
lea rcx, [rsp + 0x60]
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x30], xmm15
movups xmmword [rsp + 0x40], xmm15
lea rdx, [0x00422cc0]
mov qword [rsp + 0x18], rdx
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], rcx
mov rcx, r14
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x10]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], 3
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x18]
mov qword [rsp], rcx
call fcn.0044a660
xorps xmm15, xmm15
mov r14, qword [0x0053e508]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x10]
cmp rax, 0x20
jge 0x422c6c
jae 0x422c8e
mov rcx, qword [rsp + 0x60]
mov qword [rcx + rax*8 + 8], 0
add rsp, 0x50
pop rbp
ret
lea rcx, [fcn.00434220]
inc rcx
mov qword [rax + 8], rcx
mov qword [rax + 0x10], 0
add rsp, 0x50
pop rbp
ret
mov ecx, 0x20
call fcn.0044c9e0
nop
mov qword [rsp + 8], rax
nop
call fcn.0044a780
mov rax, qword [rsp + 8]
jmp fcn.00422ba0