joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14007b94d
Capabilities:
Terminate process

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x50
mov rdi, rcx
call fcn.140001066
mov rsi, rax
movups xmm0, xmmword [rdi + 0x20]
lea rcx, [rsp + 0x30]
movaps xmmword [rcx], xmm0
call fcn.14001854b
test al, al
je 0x14007b989
cmp byte [rsi], 0
jne 0x14007bad8
jmp 0x14007bb1f
mov qword [rsp + 0x28], 0
mov rcx, qword [rdi + 0x28]
call qword [rdi + 0x20]
mov r12b, 1
cmp byte [rsi], 0
jne 0x14007babe
mov rbx, rax
mov qword [rsp + 0x28], rax
test rax, rax
je 0x14007ba55
lea rbp, [rdi + 0x20]
lea r14, [rsp + 0x28]
lea r15, [rsp + 0x30]
mov cl, byte [rbx + 0x20]
call fcn.14001296a
test al, al
je 0x14007ba18
mov rcx, qword [rdi + 0x28]
call qword [rdi + 0x20]
cmp byte [rsi], 0
jne 0x14007babe
mov rcx, r14
mov rdx, rax
call fcn.1400106b1
cmp byte [rsi], 0
jne 0x14007babe
movups xmm0, xmmword [rbp]
movaps xmmword [rsp + 0x30], xmm0
mov rcx, r15
call fcn.14001854b
mov rbx, qword [rsp + 0x28]
test al, al
jne 0x14007ba13
test rbx, rbx
jne 0x14007b9c4
test rbx, rbx
je 0x14007ba55
lea r14, [rsp + 0x30]
mov edx, 0x10
mov rcx, r14
call fcn.1400018bc
lea rax, [fcn.14007b94d]
mov qword [r14], rax
mov qword [r14 + 8], rdi
mov rax, qword [r14]
mov rcx, qword [r14 + 8]
lea rdx, [rsp + 0x40]
mov qword [rdx], rax
mov qword [rdx + 8], rcx
mov rcx, rbx
call fcn.140013427
jmp 0x14007babb
mov rax, qword [rdi + 0x18]
mov cl, byte [rax + 0x20]
call fcn.14001296a
test al, al
je 0x14007ba6a
xor r12d, r12d
jmp 0x14007babe
mov ecx, 0x40
call fcn.14000ed36
lea rcx, [0x1400a8228]
mov qword [rax], rcx
lea rdx, [0x1400a8260]
mov qword [rax + 0x10], rdx
movups xmm0, xmmword [0x140095320]
movups xmmword [rax + 0x18], xmm0
mov qword [rax + 8], 0
mov qword [rsp + 0x20], 0x2a
lea r8, [0x1400a8280]
lea r9, str.mVedrBkx34YrVf
mov rcx, rax
call fcn.14000ed74
mov r12b, byte [rsi]
mov byte [rsi], 0
mov rcx, qword [rsp + 0x28]
call fcn.1400106dc
cmp byte [rsi], 0
jne 0x14007bad8
mov byte [rsi], r12b
test r12b, r12b
je 0x14007bb1f
mov byte [rsi], 0
mov rax, qword [rdi + 0x18]
mov cl, byte [rax + 0x20]
call fcn.14001296a
test al, al
je 0x14007bafe
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
jmp fcn.140018558
call fcn.1400130f9
mov rbx, rax
mov rcx, qword [rdi + 0x18]
mov rdx, rax
call fcn.140011d4b
mov rcx, rbx
call fcn.14000ebe5
cmp byte [rsi], 0
je 0x14007bb2e
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
jmp fcn.140013124
Function at 0x14007d81e
Capabilities:
Terminate process

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x50
mov rdi, rcx
call fcn.140001066
mov rsi, rax
movups xmm0, xmmword [rdi + 0x20]
lea rcx, [rsp + 0x30]
movaps xmmword [rcx], xmm0
call fcn.14001854b
test al, al
je 0x14007d85a
cmp byte [rsi], 0
jne 0x14007d9a9
jmp 0x14007d9f0
mov qword [rsp + 0x28], 0
mov rcx, qword [rdi + 0x28]
call qword [rdi + 0x20]
mov r12b, 1
cmp byte [rsi], 0
jne 0x14007d98f
mov rbx, rax
mov qword [rsp + 0x28], rax
test rax, rax
je 0x14007d926
lea rbp, [rdi + 0x20]
lea r14, [rsp + 0x28]
lea r15, [rsp + 0x30]
mov cl, byte [rbx + 0x20]
call fcn.14001296a
test al, al
je 0x14007d8e9
mov rcx, qword [rdi + 0x28]
call qword [rdi + 0x20]
cmp byte [rsi], 0
jne 0x14007d98f
mov rcx, r14
mov rdx, rax
call fcn.1400106b1
cmp byte [rsi], 0
jne 0x14007d98f
movups xmm0, xmmword [rbp]
movaps xmmword [rsp + 0x30], xmm0
mov rcx, r15
call fcn.14001854b
mov rbx, qword [rsp + 0x28]
test al, al
jne 0x14007d8e4
test rbx, rbx
jne 0x14007d895
test rbx, rbx
je 0x14007d926
lea r14, [rsp + 0x30]
mov edx, 0x10
mov rcx, r14
call fcn.1400018bc
lea rax, [fcn.14007d81e]
mov qword [r14], rax
mov qword [r14 + 8], rdi
mov rax, qword [r14]
mov rcx, qword [r14 + 8]
lea rdx, [rsp + 0x40]
mov qword [rdx], rax
mov qword [rdx + 8], rcx
mov rcx, rbx
call fcn.140013427
jmp 0x14007d98c
mov rax, qword [rdi + 0x18]
mov cl, byte [rax + 0x20]
call fcn.14001296a
test al, al
je 0x14007d93b
xor r12d, r12d
jmp 0x14007d98f
mov ecx, 0x40
call fcn.14000ed36
lea rcx, [0x1400a8228]
mov qword [rax], rcx
lea rdx, [0x1400a8260]
mov qword [rax + 0x10], rdx
movups xmm0, xmmword [0x140095240]
movups xmmword [rax + 0x18], xmm0
mov qword [rax + 8], 0
mov qword [rsp + 0x20], 0x2a
lea r8, [0x1400a8280]
lea r9, str.mVedrBkx34YrVf
mov rcx, rax
call fcn.14000ed74
mov r12b, byte [rsi]
mov byte [rsi], 0
mov rcx, qword [rsp + 0x28]
call fcn.1400106dc
cmp byte [rsi], 0
jne 0x14007d9a9
mov byte [rsi], r12b
test r12b, r12b
je 0x14007d9f0
mov byte [rsi], 0
mov rax, qword [rdi + 0x18]
mov cl, byte [rax + 0x20]
call fcn.14001296a
test al, al
je 0x14007d9cf
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
jmp fcn.140018558
call fcn.1400130f9
mov rbx, rax
mov rcx, qword [rdi + 0x18]
mov rdx, rax
call fcn.140011d4b
mov rcx, rbx
call fcn.14000ebe5
cmp byte [rsi], 0
je 0x14007d9ff
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
jmp fcn.140013124
Function at 0x14007f174
Capabilities:
Terminate process

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x50
mov rdi, rcx
call fcn.140001066
mov rsi, rax
movups xmm0, xmmword [rdi + 0x28]
lea rcx, [rsp + 0x30]
movaps xmmword [rcx], xmm0
call fcn.14001854b
test al, al
je 0x14007f1b0
cmp byte [rsi], 0
jne 0x14007f2ff
jmp 0x14007f346
mov qword [rsp + 0x28], 0
mov rcx, qword [rdi + 0x30]
call qword [rdi + 0x28]
mov r12b, 1
cmp byte [rsi], 0
jne 0x14007f2e5
mov rbx, rax
mov qword [rsp + 0x28], rax
test rax, rax
je 0x14007f27c
lea rbp, [rdi + 0x28]
lea r14, [rsp + 0x28]
lea r15, [rsp + 0x30]
mov cl, byte [rbx + 0x20]
call fcn.14001296a
test al, al
je 0x14007f23f
mov rcx, qword [rdi + 0x30]
call qword [rdi + 0x28]
cmp byte [rsi], 0
jne 0x14007f2e5
mov rcx, r14
mov rdx, rax
call fcn.1400106b1
cmp byte [rsi], 0
jne 0x14007f2e5
movups xmm0, xmmword [rbp]
movaps xmmword [rsp + 0x30], xmm0
mov rcx, r15
call fcn.14001854b
mov rbx, qword [rsp + 0x28]
test al, al
jne 0x14007f23a
test rbx, rbx
jne 0x14007f1eb
test rbx, rbx
je 0x14007f27c
lea r14, [rsp + 0x30]
mov edx, 0x10
mov rcx, r14
call fcn.1400018bc
lea rax, [fcn.14007f174]
mov qword [r14], rax
mov qword [r14 + 8], rdi
mov rax, qword [r14]
mov rcx, qword [r14 + 8]
lea rdx, [rsp + 0x40]
mov qword [rdx], rax
mov qword [rdx + 8], rcx
mov rcx, rbx
call fcn.140013427
jmp 0x14007f2e2
mov rax, qword [rdi + 0x10]
mov cl, byte [rax + 0x20]
call fcn.14001296a
test al, al
je 0x14007f291
xor r12d, r12d
jmp 0x14007f2e5
mov ecx, 0x40
call fcn.14000ed36
lea rcx, [0x1400a8228]
mov qword [rax], rcx
lea rdx, [0x1400a8260]
mov qword [rax + 0x10], rdx
movups xmm0, xmmword [0x140095fa0]
movups xmmword [rax + 0x18], xmm0
mov qword [rax + 8], 0
mov qword [rsp + 0x20], 0x2a
lea r8, [0x1400a8280]
lea r9, str.mVedrBkx34YrVf
mov rcx, rax
call fcn.14000ed74
mov r12b, byte [rsi]
mov byte [rsi], 0
mov rcx, qword [rsp + 0x28]
call fcn.1400106dc
cmp byte [rsi], 0
jne 0x14007f2ff
mov byte [rsi], r12b
test r12b, r12b
je 0x14007f346
mov byte [rsi], 0
mov rax, qword [rdi + 0x10]
mov cl, byte [rax + 0x20]
call fcn.14001296a
test al, al
je 0x14007f325
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
jmp fcn.140018558
call fcn.1400130f9
mov rbx, rax
mov rcx, qword [rdi + 0x10]
mov rdx, rax
call fcn.140011d4b
mov rcx, rbx
call fcn.14000ebe5
cmp byte [rsi], 0
je 0x14007f355
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
jmp fcn.140013124
Function at 0x1400833cd
Capabilities:
Terminate process

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x50
mov rdi, rcx
call fcn.140001066
mov rsi, rax
movups xmm0, xmmword [rdi + 0x20]
lea rcx, [rsp + 0x30]
movaps xmmword [rcx], xmm0
call fcn.14001854b
test al, al
je 0x140083409
cmp byte [rsi], 0
jne 0x140083558
jmp 0x14008359f
mov qword [rsp + 0x28], 0
mov rcx, qword [rdi + 0x28]
call qword [rdi + 0x20]
mov r12b, 1
cmp byte [rsi], 0
jne 0x14008353e
mov rbx, rax
mov qword [rsp + 0x28], rax
test rax, rax
je 0x1400834d5
lea rbp, [rdi + 0x20]
lea r14, [rsp + 0x28]
lea r15, [rsp + 0x30]
mov cl, byte [rbx + 0x20]
call fcn.14001296a
test al, al
je 0x140083498
mov rcx, qword [rdi + 0x28]
call qword [rdi + 0x20]
cmp byte [rsi], 0
jne 0x14008353e
mov rcx, r14
mov rdx, rax
call fcn.1400106b1
cmp byte [rsi], 0
jne 0x14008353e
movups xmm0, xmmword [rbp]
movaps xmmword [rsp + 0x30], xmm0
mov rcx, r15
call fcn.14001854b
mov rbx, qword [rsp + 0x28]
test al, al
jne 0x140083493
test rbx, rbx
jne 0x140083444
test rbx, rbx
je 0x1400834d5
lea r14, [rsp + 0x30]
mov edx, 0x10
mov rcx, r14
call fcn.1400018bc
lea rax, [fcn.1400833cd]
mov qword [r14], rax
mov qword [r14 + 8], rdi
mov rax, qword [r14]
mov rcx, qword [r14 + 8]
lea rdx, [rsp + 0x40]
mov qword [rdx], rax
mov qword [rdx + 8], rcx
mov rcx, rbx
call fcn.140013427
jmp 0x14008353b
mov rax, qword [rdi + 0x18]
mov cl, byte [rax + 0x20]
call fcn.14001296a
test al, al
je 0x1400834ea
xor r12d, r12d
jmp 0x14008353e
mov ecx, 0x40
call fcn.14000ed36
lea rcx, [0x1400a8228]
mov qword [rax], rcx
lea rdx, [0x1400a8260]
mov qword [rax + 0x10], rdx
movups xmm0, xmmword [0x140094ff0]
movups xmmword [rax + 0x18], xmm0
mov qword [rax + 8], 0
mov qword [rsp + 0x20], 0x2a
lea r8, [0x1400a8280]
lea r9, str.mVedrBkx34YrVf
mov rcx, rax
call fcn.14000ed74
mov r12b, byte [rsi]
mov byte [rsi], 0
mov rcx, qword [rsp + 0x28]
call fcn.1400106dc
cmp byte [rsi], 0
jne 0x140083558
mov byte [rsi], r12b
test r12b, r12b
je 0x14008359f
mov byte [rsi], 0
mov rax, qword [rdi + 0x18]
mov cl, byte [rax + 0x20]
call fcn.14001296a
test al, al
je 0x14008357e
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
jmp fcn.140018558
call fcn.1400130f9
mov rbx, rax
mov rcx, qword [rdi + 0x18]
mov rdx, rax
call fcn.140011d4b
mov rcx, rbx
call fcn.14000ebe5
cmp byte [rsi], 0
je 0x1400835ae
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
jmp fcn.140013124
Function at 0x1400837ee
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rbx, rdx
mov rsi, rcx
call fcn.140001066
mov rdi, rax
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
movups xmm0, xmmword [0x140096620]
movaps xmmword [rsp + 0x20], xmm0
movups xmm1, xmmword [rbx]
lea rdx, [rsp + 0x50]
movaps xmmword [rdx], xmm1
lea r8, [rsp + 0x40]
movaps xmmword [r8], xmm0
lea rcx, [rsp + 0x30]
mov r9b, 0xe
call fcn.140026ac6
cmp byte [rdi], 0
jne 0x14008385d
lea rdx, [rsp + 0x30]
mov rax, qword [rdx]
mov rcx, qword [rdx + 8]
mov qword [rdx], rax
mov qword [rdx + 8], rcx
lea rcx, [rsp + 0x20]
call fcn.1400102f9
cmp byte [rdi], 0
je 0x1400838c6
mov byte [rdi], 0
movups xmm0, xmmword [0x1400965c0]
lea rdx, [rsp + 0x30]
movaps xmmword [rdx], xmm0
lea rcx, [rsp + 0x20]
call fcn.1400102f9
call fcn.140013124
movzx eax, byte [rdi]
test eax, eax
je 0x1400838c6
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x1400838f4
mov rdx, qword [rcx]
mov ebx, edx
not ebx
or ebx, eax
mov edi, eax
or edi, edx
mov esi, eax
not esi
add esi, esi
sub esi, edx
xor eax, edx
sub eax, ebx
add eax, edi
inc eax
xor eax, esi
shl rax, 0x3e
movabs rbx, 0x4000000000000000
add rbx, rax
test rdx, rbx
jne 0x1400838f4
jmp 0x1400838e8
lea rdi, [rsp + 0x20]
movaps xmm0, xmmword [rdi]
movups xmmword [rsi], xmm0
mov rcx, rdi
call fcn.14000ed6d
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x1400838f4
test byte [rcx + 7], 0x40
jne 0x1400838f4
add rsp, 0x60
pop rbx
pop rdi
pop rsi
jmp fcn.1400011e0
nop
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret
Function at 0x140086c2c
Capabilities:
Terminate process

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov r14d, 0xffffffff
mov rcx, qword [rcx + 8]
test rcx, rcx
je 0x140086c6d
mov rax, qword [rcx]
mov edx, eax
xor edx, r14d
lea edx, [rdx + rdx*2]
lea ebx, [rax + rax]
add edx, eax
inc edx
xor edx, ebx
not edx
shl rdx, 0x3e
test rax, rdx
jne 0x140086c6d
call fcn.1400011e0
mov rcx, qword [rsi + 0x18]
test rcx, rcx
je 0x140086cb3
mov rax, qword [rcx]
mov edx, eax
xor edx, r14d
lea edx, [rdx + rdx*2]
mov ebx, eax
not ebx
add ebx, r14d
lea edx, [rdx + rax*2]
inc edx
xor edx, ebx
movabs rbx, 0x65c27acf6f115f1a
add rbx, rdx
movabs rdx, 0x25c27acf6f115f1a
xor rdx, rbx
test rax, rdx
jne 0x140086cb3
call fcn.1400011e0
movabs r15, 0x4000000000000000
mov rcx, qword [rsi + 0x28]
test rcx, rcx
je 0x140086cd0
test qword [rcx], r15
jne 0x140086cd0
call fcn.1400011e0
mov rcx, qword [rsi + 0x48]
test rcx, rcx
je 0x140086d09
mov rax, qword [rcx]
mov edx, eax
or edx, 7
movzx edx, dl
imul edx, edx
imul edi, edx, 0x755
mov edx, edi
not edx
lea ebx, [rdx + rdx*2]
add edx, edx
add ebx, edi
inc ebx
xor ebx, edx
or rbx, r15
test rax, rbx
jne 0x140086d09
call fcn.1400011e0
mov rcx, qword [rsi + 0x68]
test rcx, rcx
je 0x140086d1c
test qword [rcx], r15
jne 0x140086d1c
call fcn.1400011e0
mov rcx, qword [rsi + 0x78]
test rcx, rcx
je 0x140086d7c
mov rdi, qword [rcx]
mov edx, edi
and edx, 0x4681754b
lea ebx, [r14 - 0x4681754b]
mov eax, edi
xor eax, ebx
add eax, edx
or ebx, edi
xor ebx, r14d
lea edx, [rbx + rbx*2]
mov ebx, 0xffffffff
sub ebx, edi
add ebx, 0x8d02ea97
add eax, edx
inc eax
xor eax, ebx
movabs rdx, 0x248a3dca4d95e9c2
add rdx, rax
movabs rax, 0x648a3dca4d95e9c2
xor rax, rdx
test rdi, rax
jne 0x140086d7c
call fcn.1400011e0
mov rcx, qword [rsi + 0x88]
test rcx, rcx
je 0x140086dc3
mov rax, qword [rcx]
mov edx, eax
xor edx, r14d
lea edx, [rdx + rdx*2]
mov ebx, eax
not ebx
add ebx, r14d
lea edx, [rdx + rax*2]
inc edx
xor edx, ebx
movabs rbx, 0x37875fe15332d7f0
add rbx, rdx
movabs rdi, 0x77875fe15332d7f0
add rdi, rdx
xor rdi, rbx
test rax, rdi
je 0x140086dcf
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp fcn.1400011e0

Function at 0x140087042
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x1401021b8], eax
lea rdx, [0x1400fe0b0]
mov ecx, eax
add rsp, 0x28
jmp qword [sym.imp.KERNEL32.dll_TlsSetValue]

Function at 0x1400870c4
Capabilities:
Terminate process

Disassembly:
push rsi
sub rsp, 0x20
call fcn.140001208
cmp byte [rax], 0
je 0x14003249f
mov rsi, rax
mov rcx, qword [rax + 0x18]
test rcx, rcx
jne 0x1400324a5
add rsp, 0x20
pop rsi
ret
add rsi, 0x18
call fcn.14001feb2
mov rcx, rsi
xor edx, edx
call fcn.14000ef11
mov ecx, 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
int3
jmp 0x1400870bf
jmp 0x140032484
sub rsp, 0x28
call fcn.140086fcb
nop
add rsp, 0x28
jmp 0x1400870ba
Function at 0x416c00
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x416d8b
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.004344e0
xorps xmm15, xmm15
mov r14, qword [0x00910648]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x416c65
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x416c74
add rsp, 0x48
pop rbp
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x416c93
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x416ca3
cmp rbx, 0x1000
jae 0x416c6b
jmp 0x416d0d
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x416cb5
xor edx, edx
jmp 0x416d04
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.004344e0
xorps xmm15, xmm15
mov r14, qword [0x00910648]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x416c99
jmp 0x416c88
call fcn.00467da0
xorps xmm15, xmm15
mov r14, qword [0x00910648]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.00438ba0
lea rax, [0x006ae253]
mov ebx, 0x18
nop dword [rax]
call fcn.00439420
mov rax, qword [rsp + 0x38]
call fcn.00439160
lea rax, [0x006aea51]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.00439420
mov rax, qword [rsp + 0x30]
call fcn.00439160
call fcn.00438de0
call fcn.00438c00
lea rax, [0x006b250d]
mov ebx, 0x21
call fcn.00437200
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00464660
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00416c00
Function at 0x416dc0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x416fe6
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.00434560
xorps xmm15, xmm15
mov r14, qword [0x00910648]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x416e33
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x416e42
add rsp, 0x50
pop rbp
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x416e65
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x416e75
cmp rbx, 0x1000
jae 0x416e39
nop
jmp 0x416ef8
add rsp, 0x50
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop word [rax + rax]
cmp rbx, 0x1000
jae 0x416e8d
xor esi, esi
jmp 0x416eea
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.00434560
xorps xmm15, xmm15
mov r14, qword [0x00910648]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x416e6b
jmp 0x416e56
call fcn.00467da0
xorps xmm15, xmm15
mov r14, qword [0x00910648]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x416f80
nop dword [rax + rax]
call fcn.00438ba0
lea rax, [0x006aea6a]
mov ebx, 0x19
call fcn.00439420
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
call fcn.00439160
lea rax, [0x006aea51]
mov ebx, 0x19
call fcn.00439420
mov eax, dword [rsp + 0x34]
call fcn.00439160
nop
call fcn.00438de0
call fcn.00438c00
lea rax, [0x006a9734]
mov ebx, 0xd
call fcn.00437200
nop dword [rax + rax]
cmp eax, 0x5af
je 0x416f20
call fcn.00438ba0
lea rax, [0x006aea6a]
mov ebx, 0x19
call fcn.00439420
mov rax, qword [rsp + 0x38]
call fcn.00439160
lea rax, [0x006aea51]
mov ebx, 0x19
call fcn.00439420
mov eax, dword [rsp + 0x34]
nop dword [rax]
call fcn.00439160
call fcn.00438de0
call fcn.00438c00
lea rax, [0x006b1760]
mov ebx, 0x1f
nop dword [rax + rax]
call fcn.00437200
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00464660
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.00416dc0
Function at 0x4203e0
Capabilities:
Hash data using murmur3

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
cmp byte [0x009103dd], 0
jne 0x4204c7
sub rbx, qword [rax + 0x18]
mov rdx, qword [rax + 0x50]
test byte [rdx], al
mov esi, dword [rax + 0x64]
imul rbx, rsi
mov rsi, rbx
shr rbx, 0x20
shr rsi, 0x23
and ebx, 7
mov rdi, rcx
mov rcx, rbx
mov r8d, 1
shl r8d, cl
add rdx, rsi
nop
nop
nop
nop
lock or byte [rdx], r8b
mov rcx, qword [rax + 0x18]
movabs rdx, 0x800000000000
lea rax, [rdx + rcx]
mov rdx, rax
shr rdx, 0x2a
nop
nop
nop
cmp rdx, 0x40
jae 0x4204ba
lea rbx, [0x008e27b8]
mov rdx, qword [rbx + rdx*8]
test byte [rdx], al
mov rbx, rcx
shr rbx, 0x10
and ebx, 0x3f
shr rcx, 0xd
and ecx, 7
mov esi, 1
shl esi, cl
shr rax, 0x16
and eax, 0xfffff
mov rax, qword [rdx + rax*8]
test byte [rax], al
movzx edx, byte [rax + rbx + 0x11440]
lea rax, [rax + rbx]
lea rax, [rax + 0x11440]
test sil, dl
jne 0x4204a0
lock or byte [rax], sil
mov rax, qword [r14 + 0x30]
mov rax, qword [rax + 0xa0]
test byte [rax], al
add qword [rax + 0x1250], rdi
add rsp, 0x10
pop rbp
ret
mov rax, rdx
mov ecx, 0x40
call fcn.00466940
lea rax, [0x006b677e]
mov ebx, 0x2c
call fcn.00437200
nop
int3

Function at 0x4227a0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4228a6
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x70], rcx
mov byte [rsp + 0x17], dil
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x18], 0
jmp 0x4227e3
mov rax, qword [rsp + 0x60]
mov rcx, rdx
mov rbx, qword [rsp + 0x68]
movzx edi, byte [rsp + 0x17]
cmp qword [rsp + 0x18], rbx
jae 0x42289b
test byte [rax], al
lea rcx, [rax + 0x100b8]
mov ebx, edi
mov rax, rcx
nop dword [rax]
call fcn.00423580
test rax, rax
je 0x42289b
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x30], xmm15
movups xmmword [rsp + 0x40], xmm15
lea rcx, [0x004228e0]
mov qword [rsp + 0x20], rcx
lea rdx, [rsp + 0x18]
mov qword [rsp + 0x28], rdx
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x48], rax
lea rbx, [rsp + 0x20]
mov qword [rsp], rbx
nop dword [rax]
call fcn.00464520
xorps xmm15, xmm15
mov r14, qword [0x00910648]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x70]
nop dword [rax]
test rdx, rdx
jne 0x422889
xor eax, eax
jmp 0x422893
mov rax, qword [rdx]
call rax
mov rdx, qword [rsp + 0x70]
test al, al
je 0x4227d1
mov rax, qword [rsp + 0x18]
add rsp, 0x50
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov byte [rsp + 0x20], dil
call fcn.00464660
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movzx edi, byte [rsp + 0x20]
jmp fcn.004227a0