joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140007990
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push rbx
push rbp
push r14
sub rsp, 0x50
mov rax, qword [0x140012040]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, r8
mov dword [rsp + 0x30], 0x208
lea rax, [rsp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov qword [rsp + 0x20], rbx
mov r14, rdx
mov rbp, rcx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140007ab3
mov qword [rsp + 0x48], rdi
mov rax, 0xffffffffffffffff
xor edi, edi
nop word [rax + rax]
inc rax
cmp word [rbx + rax*2], di
jne 0x1400079f0
test rax, rax
je 0x140007a8c
mov qword [rsp + 0x88], rsi
mov rcx, rdi
mov qword [rsp + 0x40], r15
lea r15, [0x1400120c8]
nop dword [rax]
lea rsi, [rbx + rcx*2]
mov edx, 0x80
movzx ecx, word [rsi]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_iswctype]
test eax, eax
je 0x140007a5d
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdqe
mov rcx, 0xffffffffffffffff
inc rcx
cmp word [r15 + rcx*2], 0
jne 0x140007a45
xor edx, edx
div rcx
movzx eax, word [r15 + rdx*2]
mov word [rsi], ax
inc edi
mov rax, 0xffffffffffffffff
mov ecx, edi
nop dword [rax + rax]
inc rax
cmp word [rbx + rax*2], 0
jne 0x140007a70
cmp rcx, rax
jb 0x140007a20
mov r15, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x88]
mov eax, dword [rsp + 0x30]
mov r9d, 1
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov rdx, r14
mov qword [rsp + 0x20], rbx
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rdi, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140008050
add rsp, 0x50
pop r14
pop rbp
pop rbx
ret
Function at 0x140007ad0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push rbx
mov eax, 0x2050
call fcn.140009090
sub rsp, rax
mov rax, qword [0x140012040]
xor rax, rsp
mov qword [rsp + 0x2040], rax
lea rax, [rsp + 0x30]
xor ebx, ebx
mov r9d, 0xf003f
mov qword [rsp + 0x30], rbx
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SYSTEMCurrentControlSetControlSystemInformation
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140007c4d
mov qword [rsp + 0x2060], rsi
lea rcx, [rsp + 0x40]
mov rsi, qword [rsp + 0x30]
xor edx, edx
mov r8d, 0x1ffe
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x38]
mov dword [rsp + 0x38], 0x1ffe
mov qword [rsp + 0x28], rax
lea rdx, str.ComputerHardwareIds
lea rax, [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140007c3c
mov eax, dword [rsp + 0x38]
test eax, eax
je 0x140007c15
mov qword [rsp + 0x2068], rdi
mov qword [rsp + 0x2070], r14
lea r14, [0x1400120c8]
nop dword [rax]
nop word [rax + rax]
mov eax, ebx
lea rdi, [rsp + 0x40]
movzx ecx, word [rdi + rax*2]
lea rdi, [rdi + rax*2]
mov edx, 0x80
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_iswctype]
test eax, eax
je 0x140007bfb
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdqe
mov rcx, 0xffffffffffffffff
nop dword [rax]
inc rcx
cmp word [r14 + rcx*2], 0
jne 0x140007be0
dec rcx
xor edx, edx
div rcx
movzx eax, word [r14 + rdx*2]
mov word [rdi], ax
mov eax, dword [rsp + 0x38]
inc ebx
cmp ebx, eax
jb 0x140007bb0
mov r14, qword [rsp + 0x2070]
mov rdi, qword [rsp + 0x2068]
mov dword [rsp + 0x28], eax
lea rdx, str.ComputerHardwareIds
lea rax, [rsp + 0x40]
mov r9d, 7
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rsi, qword [rsp + 0x2060]
mov rcx, qword [rsp + 0x2040]
xor rcx, rsp
call fcn.140008050
add rsp, 0x2050
pop rbx
ret
Function at 0x140007eb0
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x6a0
mov rax, qword [0x140012040]
xor rax, rsp
mov qword [rsp + 0x690], rax
mov rdi, rcx
xor edx, edx
lea rcx, [rsp + 0x480]
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
mov r8, rdi
lea rdx, str._ws
lea rcx, [rsp + 0x480]
call qword [sym.imp.USER32.dll_wsprintfW]
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x250
call sub.VCRUNTIME140.dll_memset
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x480]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
nop word [rax + rax]
xor edx, edx
lea rcx, [rsp + 0x270]
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
lea r9, [rsp + 0x4c]
mov r8, rdi
lea rdx, str._ws_ws
lea rcx, [rsp + 0x270]
call qword [sym.imp.USER32.dll_wsprintfW]
movzx ecx, word [rsp + 0x4c]
movzx eax, word [rsp + 0x4e]
cmp cx, 0x2e
jne 0x140007f89
test ax, ax
je 0x140007fc3
cmp cx, cx
jne 0x140007f89
cmp ax, cx
jne 0x140007f89
cmp word [rsp + 0x50], 0
je 0x140007fc3
test byte [rsp + 0x20], 0x10
lea rdx, str.desktop.ini
je 0x140007fa6
lea rcx, [rsp + 0x270]
call fcn.140007eb0
jmp 0x140007fc3
lea rcx, [rsp + 0x4c]
call qword [sym.imp.SHLWAPI.dll_StrStrW]
test rax, rax
je 0x140007fc3
lea rcx, [rsp + 0x270]
call fcn.140007c70
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x140007f30
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, qword [rsp + 0x690]
xor rcx, rsp
call fcn.140008050
mov rbx, qword [rsp + 0x6b8]
add rsp, 0x6a0
pop rdi
ret

Function at 0x140008c68
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140008cb2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140008cb2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140008cb2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140008cb2
cmp dword [rcx + 0x84], 0xe
jbe 0x140008cb2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140008cb4
xor al, al
add rsp, 0x28
ret
Function at 0x140005b70
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
sub rsp, 0x68
lea rdx, [rsp + 0x30]
lea rcx, [0x14003a1d0]
call fcn.140005d80
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x140005cc3
mov edx, 0xfffe
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
je 0x140005cb8
lea rax, str.ND140_Valorant
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x38]
lea r8, [0x1400260a0]
mov edx, 0x7fff
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.SHLWAPI.dll_wnsprintfW]
mov dword [rsp + 0x50], eax
cmp dword [0x14003c040], 1
jne 0x140005c48
lea r8, [rsp + 0x48]
lea rdx, [0x1400260b0]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x140005c48
mov eax, dword [rsp + 0x50]
inc eax
cdqe
shl rax, 1
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, [0x14003c114]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x14003c03c], 1
jne 0x140005cad
lea r8, [rsp + 0x48]
lea rdx, [0x140026110]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x140005cad
mov eax, dword [rsp + 0x50]
inc eax
cdqe
shl rax, 1
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, [0x14003c162]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, 1
add rsp, 0x68
ret

Function at 0x140005ce0
Capabilities:
Delete registry value
Persist via run registry key

Disassembly:
sub rsp, 0x38
cmp dword [0x14003c040], 1
jne 0x140005d27
lea r8, [rsp + 0x20]
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x140005d27
lea rdx, [0x14003c114]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x14003c03c], 1
jne 0x140005d6a
lea r8, [rsp + 0x20]
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x140005d6a
lea rdx, [0x14003c162]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
add rsp, 0x38
ret
Function at 0x140008740
Capabilities:
Create process on windows
Get common file path

Disassembly:
sub rsp, 0x118
lea rdx, [rsp + 0x50]
lea rcx, [0x14003a1d0]
call fcn.140005d80
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
je 0x140008932
mov edx, 0xfffe
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsp + 0x60], rax
cmp qword [rsp + 0x60], 0
je 0x140008927
mov rdx, qword [rsp + 0x60]
mov ecx, 0x7fff
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x140008927
mov edx, 0xfffe
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsp + 0x68], rax
cmp qword [rsp + 0x68], 0
je 0x140008927
mov r8d, 0x7fff
mov rdx, qword [rsp + 0x68]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x14000891c
mov dx, 0x5c
mov rcx, qword [rsp + 0x68]
call fcn.140002100
mov qword [rsp + 0x70], rax
cmp qword [rsp + 0x70], 0
je 0x14000891c
xor eax, eax
mov rcx, qword [rsp + 0x70]
mov word [rcx + 2], ax
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x14000891c
mov edx, 0xfffe
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsp + 0x78], rax
cmp qword [rsp + 0x78], 0
je 0x14000891c
lea rax, str.5592B7EA_D311_4840_972F_79D284FE2011
mov qword [rsp + 0x28], rax
lea rax, str.ND140_Valorant
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x58]
lea r8, str.__s_s___s
mov edx, 0x7fff
mov rcx, qword [rsp + 0x78]
call fcn.140019c8c
mov r8d, 0x68
xor edx, edx
lea rcx, [rsp + 0xa0]
call fcn.140019ba0
mov dword [rsp + 0xa0], WSAGetLastError
lea rax, [rsp + 0x80]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x78]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, 1
jne 0x140008911
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, 1
jmp 0x140008934
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
add rsp, 0x118
ret

Function at 0x140008940
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
lea rax, [0x14003f3e0]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x140008a00]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x14003f3d0], rax
cmp qword [0x14003f3d0], 0
je 0x140008984
mov eax, 1
jmp 0x140008986
xor eax, eax
add rsp, 0x38
ret
Function at 0x140001070
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov edx, 0xa
lea rcx, [0x140003320]
call fcn.140001010
lea rcx, [rsp + 0x48]
mov dword [rsp + 0x48], 0x6c64746e
mov dword [rsp + 0x4c], 0x6c642e6c
mov word [rsp + 0x50], 0x6c
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
test rax, rax
jne 0x1400010ec
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.GetModuleHandleA_failed_with_error:__d_n
call fcn.140001010
mov eax, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140001290
add rsp, 0x60
pop rbx
ret
lea rdx, str.NtAllocateVirtualMemory
mov qword [rsp + 0x80], rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
jne 0x14000112a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.GetProcAddress_for_NtAllocateVirtualMemory_failed_with_error:__d_n
call fcn.140001010
mov eax, 1
jmp 0x140001262
lea rdx, str.NtProtectVirtualMemory
mov qword [rsp + 0x70], rbp
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbp, rax
test rax, rax
jne 0x140001165
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.GetProcAddress_for_NtProtectVirtualMemory_failed_with_error:__d_n
call fcn.140001010
mov eax, 1
jmp 0x14000125d
xor ebx, ebx
mov qword [rsp + 0x38], 0x1000
mov qword [rsp + 0x30], rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0x28], 4
lea r9, [rsp + 0x38]
mov rcx, rax
mov dword [rsp + 0x20], 0x3000
xor r8d, r8d
lea rdx, [rsp + 0x30]
call rdi
test eax, eax
je 0x1400011b9
mov edx, eax
lea rcx, str.NtAllocateVirtualMemory_failed:_0x_x_n
call fcn.140001010
mov eax, 1
jmp 0x14000125d
mov rdx, qword [rsp + 0x30]
lea rcx, str.Memory_allocated_at:__p_n
mov qword [rsp + 0x78], rsi
call fcn.140001010
mov rdi, qword [rsp + 0x30]
lea rsi, str.ff863fcc_48d5_d231_48ff_ca8b0e41ba08
nop dword [rax + rax]
mov rcx, qword [rsi]
mov rdx, rdi
call qword [sym.imp.RPCRT4.dll_UuidFromStringA]
test eax, eax
jne 0x140001245
add rdi, 0x10
inc ebx
add rsi, 8
cmp ebx, 4
jb 0x1400011e0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 0x20
lea r8, [rsp + 0x38]
mov rcx, rax
lea rdx, [rsp + 0x30]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
call rbp
test eax, eax
je 0x140001231
lea rcx, str.NtProtectVirtualMemory_failed:_0x_x_n
jmp 0x14000124c
lea rcx, str.Memory_protection_changed_n
call fcn.140001010
call qword [rsp + 0x30]
xor eax, eax
jmp 0x140001258
lea rcx, str.UuidFromStringA_failed:__d_n
mov edx, eax
call fcn.140001010
mov eax, 1
mov rsi, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140001290
add rsp, 0x60
pop rbx
ret
Function at 0x418720
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4188cb
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [0x00d79048]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.004336c0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
nop
jne 0x41878e
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x4187a1
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x4187c5
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x4187d9
cmp rbx, 0x1000
jae 0x418798
nop
jmp 0x418849
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop
cmp rbx, 0x1000
jae 0x4187ed
xor edx, edx
jmp 0x418840
mov rcx, qword [0x00d79048]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.004336c0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
nop
test dl, dl
jne 0x4187cf
jmp 0x4187b5
call fcn.004667c0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.00438920
lea rax, [0x00933e3c]
mov ebx, 0x18
nop dword [rax + rax]
call fcn.00439220
mov rax, qword [rsp + 0x38]
call fcn.00438f20
lea rax, [0x00934005]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.00439220
mov rax, qword [rsp + 0x30]
call fcn.00438f20
call fcn.00438b80
call fcn.004389a0
lea rax, [0x0093a8cb]
mov ebx, 0x21
call fcn.004371a0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00462c00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00418720
Function at 0x418900
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x418b2a
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [0x00d79050]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.00433740
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x41897b
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x41898e
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x4189b0
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x4189c4
cmp rbx, 0x1000
jae 0x418985
jmp 0x418a4e
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x4189d6
xor esi, esi
jmp 0x418a40
mov rax, qword [0x00d79050]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
nop dword [rax]
call fcn.00433740
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
test sil, sil
jne 0x4189ba
jmp 0x4189a2
call fcn.004667c0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x418ac9
call fcn.00438920
lea rax, [0x0093494c]
mov ebx, 0x19
call fcn.00439220
mov rax, qword [rsp + 0x68]
call fcn.00438f20
lea rax, [0x00934005]
mov ebx, 0x19
nop
call fcn.00439220
mov eax, dword [rsp + 0x34]
call fcn.00438f20
call fcn.00438b80
call fcn.004389a0
lea rax, [0x0092cf57]
mov ebx, 0xd
call fcn.004371a0
cmp eax, 0x5af
je 0x418a73
call fcn.00438920
lea rax, [0x0093494c]
mov ebx, 0x19
call fcn.00439220
mov rax, qword [rsp + 0x38]
call fcn.00438f20
lea rax, [0x00934005]
mov ebx, 0x19
nop dword [rax]
call fcn.00439220
mov eax, dword [rsp + 0x34]
call fcn.00438f20
call fcn.00438b80
call fcn.004389a0
lea rax, [0x009390f5]
mov ebx, 0x1f
call fcn.004371a0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00462c00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00418900
Function at 0x420200
Capabilities:
Hash data using murmur3

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
cmp byte [0x00e450d5], 0
jne 0x4202f9
nop
nop
nop
nop
sub rbx, qword [rax + 0x18]
nop
mov edx, dword [rax + 0x5c]
imul rbx, rdx
mov rdx, rbx
shr rbx, 0x20
nop
shr rdx, 0x23
and rbx, 7
mov rsi, rcx
mov rcx, rbx
mov r8d, 1
shl r8d, cl
nop
add rdx, qword [rax + 0x50]
lock or byte [rdx], r8b
nop
nop
mov rcx, qword [rax + 0x18]
nop
movabs rdx, 0x800000000000
lea rax, [rdx + rcx]
mov rdx, rax
shr rax, 0x2a
cmp rax, 0x40
jae 0x4202ef
lea rbx, [0x00e17518]
mov rax, qword [rbx + rax*8]
shr rdx, 0x16
and rdx, 0xfffff
mov rdx, qword [rax + rdx*8]
test byte [rdx], al
test byte [rax], al
mov rax, rcx
shr rcx, 0x10
and rcx, 0x3f
movzx ebx, byte [rdx + rcx + 0x21040]
lea rdx, [rdx + rcx]
lea rdx, [rdx + 0x21040]
shr rax, 0xd
and rax, 7
mov rcx, rax
mov eax, 1
shl eax, cl
test al, bl
jne 0x4202ca
lock or byte [rdx], al
mov rax, qword [r14 + 0x30]
mov rax, qword [rax + 0xa0]
test byte [rax], al
add qword [rax + 0x16a8], rsi
add qword [rax + 0x16b0], rdi
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov ecx, 0x40
call fcn.00465320
lea rax, [0x00941089]
mov ebx, 0x2c
call fcn.004371a0
nop
int3
Function at 0x42f740
Capabilities:
Hash data using murmur3

Disassembly:
cmp rsp, qword [r14 + 0x18]
jbe 0x42f9e6
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
test byte [rax], al
lea rsi, [rax + 0x16d0]
mov rcx, qword [rax + 0x16c0]
sub rcx, rsi
shr rcx, 3
cmp rcx, 0x200
ja 0x42f9da
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x30], rcx
mov qword [rax + 0x16c0], 0
cmp byte [0x00e450d5], 0
jne 0x42f7a2
xor edx, edx
xor ebx, ebx
nop
jmp 0x42f7eb
xor edx, edx
jmp 0x42f7ce
mov qword [rsp + 0x28], rdx
mov rcx, qword [rax + rdx*8 + 0x16d0]
mov rax, rcx
call fcn.0041fa20
mov rcx, qword [rsp + 0x28]
lea rdx, [rcx + 1]
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
cmp rdx, rcx
jl 0x42f7a6
add rax, 0x16c0
call fcn.0042f600
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
inc rdx
cmp rdx, rcx
jge 0x42f972
mov rsi, qword [rax + rdx*8 + 0x16d0]
nop dword [rax]
cmp rsi, 0x1000
jb 0x42f7e8
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rbx
mov rax, rsi
xor ebx, ebx
mov rcx, rbx
nop dword [rax + rax]
call fcn.00414760
test rax, rax
jne 0x42f842
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
nop
jmp 0x42f7e8
nop
mov rsi, rcx
shr rcx, 3
and rsi, 7
mov rdx, rcx
mov rcx, rsi
mov r8d, 1
shl r8d, cl
nop
add rdx, qword [rbx + 0x50]
movzx esi, byte [rdx]
test r8b, sil
je 0x42f885
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
nop
jmp 0x42f7e8
nop
lock or byte [rdx], r8b
nop
nop
mov rcx, qword [rbx + 0x18]
nop
movabs rsi, 0x800000000000
lea r8, [rsi + rcx]
mov r9, r8
shr r8, 0x2a
cmp r8, 0x40
jae 0x42f9cd
lea r10, [0x00e17518]
mov r8, qword [r10 + r8*8]
shr r9, 0x16
and r9, 0xfffff
mov r9, qword [r8 + r9*8]
test byte [r9], al
test byte [r8], al
mov r8, rcx
shr rcx, 0x10
and rcx, 0x3f
movzx r10d, byte [r9 + rcx + 0x21040]
lea r9, [r9 + rcx]
lea r9, [r9 + 0x21040]
shr r8, 0xd
and r8, 7
mov rcx, r8
mov r8d, 1
shl r8d, cl
test r8b, r10b
jne 0x42f90c
lock or byte [r9], r8b
movzx r8d, byte [rbx + 0x62]
test r8b, 1
je 0x42f945
mov r8, qword [rsp + 0x48]
mov r9, qword [r8 + 0x16a8]
add r9, qword [rbx + 0x68]
mov qword [r8 + 0x16a8], r9
mov rax, r8
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
jmp 0x42f7e8
mov r8, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
cmp r8, rcx
jae 0x42f9c5
mov r9, qword [rsp + 0x48]
mov qword [r9 + r8*8 + 0x16d0], rax
lea rbx, [r8 + 1]
mov rax, r9
mov rdx, qword [rsp + 0x28]
jmp 0x42f7e8
cmp rbx, 0x200
ja 0x42f9b7
lea rdx, [rax + 0x16d0]
lea rsi, [rax + 0x1698]
mov rcx, rbx
mov edi, 0x200
mov rbx, rdx
mov rax, rsi
call fcn.004250e0
mov rdx, qword [rsp + 0x48]
lea rax, [rdx + 0x16c0]
call fcn.0042f600
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov rcx, rbx
mov edx, 0x200
nop
call fcn.00465380
mov rax, r8
call fcn.00465300
mov rax, r8
mov ecx, 0x40
call fcn.00465320
mov edx, 0x200
nop
call fcn.00465360
nop
mov qword [rsp + 8], rax
call fcn.00467320
mov rax, qword [rsp + 8]
jmp fcn.0042f740