joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003c9a8
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x280]
sub rsp, 0x380
mov rax, qword [0x140163470]
xor rax, rsp
mov qword [rbp + 0x270], rax
mov esi, edx
mov rdi, rcx
mov r8d, 0x2bd2cd90
mov edx, 0x36fc0c95
mov ecx, 0x4645e0cd
call fcn.140001db4
mov edx, 0xe3d38621
mov ecx, 0x936a699f
mov r8d, 0xfefd4705
mov rbx, rax
call fcn.140001db4
lea rcx, [rbp - 0x20]
mov r9, rbx
mov rdx, rax
mov r8, rdi
call qword [sym.imp.USER32.dll_wsprintfW]
and qword [rsp + 0x50], 0
xor eax, eax
lea r8d, [rax + 0x60]
lea rcx, [rsp + 0x78]
xor edx, edx
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
call fcn.1400ebf40
and dword [rbp - 0x54], 0
mov eax, 1
lea rdx, [rbp - 0x20]
mov word [rbp - 0x50], ax
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
and qword [rsp + 0x30], 0
xor ecx, ecx
mov dword [rsp + 0x28], 0x8000000
and dword [rsp + 0x20], 0
mov dword [rsp + 0x70], 0x68
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ebx, eax
test eax, eax
je 0x14003cab7
test esi, esi
je 0x14003caa1
mov rcx, qword [rsp + 0x50]
mov edx, esi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov rcx, qword [rbp + 0x270]
xor rcx, rsp
call fcn.1400e8bc0
mov rbx, qword [rsp + 0x3b0]
add rsp, 0x380
pop rdi
pop rsi
pop rbp
ret

Function at 0x14003cc70
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xe0
and qword [rbp - 0x39], 0
xor eax, eax
mov rbx, r8
mov rsi, rcx
mov rdi, rdx
lea r8d, [rax + 0x60]
lea rcx, [rbp - 0x11]
xor edx, edx
mov r14d, r9d
mov qword [rbp - 0x31], rax
mov qword [rbp - 0x29], rax
call fcn.1400ebf40
and qword [rbp + 0x37], 0
lea rax, [rbp - 0x39]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x19]
xor r8d, r8d
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
and qword [rsp + 0x30], 0
mov rdx, rsi
xor ecx, ecx
mov dword [rsp + 0x28], 0x8000000
mov dword [rbp - 0x19], 0x68
mov dword [rbp + 0x23], 0x100
mov qword [rbp + 0x3f], rbx
mov dword [rsp + 0x20], 1
mov qword [rbp + 0x47], rbx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ebx, eax
test eax, eax
je 0x14003cd3e
test r14d, r14d
je 0x14003cd2a
mov rcx, qword [rbp - 0x39]
mov edx, r14d
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp - 0x39]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x31]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r11, [rsp + 0xe0]
mov eax, ebx
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x1400580cc
Capabilities:
Get disk information via ioctl

Disassembly:
mov r11, rsp
sub rsp, 0x68
mov rax, qword [0x140163470]
xor rax, rsp
mov qword [rsp + 0x58], rax
and qword [r11 - 0x30], 0
mov rcx, qword [rcx + 8]
and dword [rsp + 0x40], 0
lea rax, [r11 - 0x28]
xor r9d, r9d
xor r8d, r8d
mov qword [r11 - 0x38], rax
lea rax, [r11 - 0x20]
mov edx, 0x2d1080
mov dword [rsp + 0x28], InitCommonControls
mov qword [r11 - 0x48], rax
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov eax, dword [rsp + 0x4c]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400e8bc0
add rsp, 0x68
ret

Function at 0x140058130
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0xc0
mov rax, qword [0x140163470]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov ebx, ecx
lea rcx, [0x14015868a]
mov edx, 0xe0d67a75
mov r8d, InitCommonControls
call fcn.140001f7c
lea rcx, [rsp + 0x30]
mov r8d, ebx
mov rdx, rax
call fcn.1400e9c20
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
xor ebx, ebx
mov edi, eax
bt edi, ebx
jae 0x1400581c8
xor eax, eax
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x20]
mov byte [rsp + 0x23], al
lea eax, [rbx + 0x41]
mov r8d, 0x40
mov byte [rsp + 0x20], al
mov word [rsp + 0x21], 0x3a
call qword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
test eax, eax
je 0x1400581c8
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x70]
call fcn.1400edbf4
test eax, eax
je 0x1400581f2
inc ebx
cmp ebx, 0x20
jl 0x140058182
mov al, 0x41
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.1400e8bc0
mov rbx, qword [rsp + 0xd8]
add rsp, 0xc0
pop rdi
ret
lea eax, [rbx + 0x41]
jmp 0x1400581d1

Function at 0x14005c5f8
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x140
mov rax, qword [0x140163470]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov rsi, r8
mov rbx, rdx
test r8, r8
jne 0x14005c62b
mov al, 1
jmp 0x14005c6a3
cmp qword [rdx + 0x18], 0x10
jb 0x14005c637
mov rdi, qword [rdx]
jmp 0x14005c63a
mov rdi, rdx
lea rcx, [0x140159504]
mov edx, 0x228b5dd5
mov r8d, 5
call fcn.140002104
lea rcx, [rsp + 0x20]
mov r9, rsi
mov rdx, rax
mov r8, rdi
call fcn.1400e9c20
lea rcx, [rsp + 0x20]
mov esi, 0x2f
add rcx, qword [rbx + 0x10]
jmp 0x14005c68a
mov bl, byte [rdi + 1]
xor edx, edx
mov byte [rdi + 1], 0
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov byte [rdi + 1], bl
lea rcx, [rdi + 1]
mov edx, esi
call fcn.1400ea9bc
lea rcx, [rsp + 0x20]
mov rdi, rax
test rax, rax
jne 0x14005c674
call fcn.1400228f8
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.1400e8bc0
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14005fe9c
Capabilities:
Get file size
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x170
mov rax, qword [0x140163470]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov r12, qword [rsp + 0x1d0]
lea rbx, [rcx + 0x10]
xor edi, edi
cmp qword [rbx + 0x18], 0x10
mov r15, r9
mov r14, r8
mov rsi, rdx
mov rbp, rcx
jb 0x14005fee4
mov rbx, qword [rbx]
lea rcx, [0x1401594e8]
mov edx, 0xa80f5fe2
mov r8d, 7
call fcn.140002104
lea rcx, [rsp + 0x50]
mov r9, rsi
mov r8, rbx
mov rdx, rax
mov qword [rsp + 0x20], r14
call fcn.1400e9c20
xor r9d, r9d
mov qword [rsp + 0x30], rdi
lea rcx, [rsp + 0x50]
lea r8d, [r9 + 1]
mov edx, 0x80000000
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r14, rax
cmp rax, 0xffffffffffffffff
jne 0x14005ff4f
xor al, al
jmp 0x14005ffe5
lea rdx, [rsp + 0x44]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp eax, 0xffffffff
jne 0x14005ff79
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x14005ff79
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14005ff48
cmp dword [rsp + 0x44], edi
jne 0x14005ffd9
cmp esi, dword [rbp + 0x58]
ja 0x14005ff8a
mov rbx, qword [rbp + 0x60]
jmp 0x14005ffac
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rbp + 0x60]
mov r9, rsi
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov dword [rbp + 0x58], esi
mov rbx, rax
mov qword [rbp + 0x60], rax
lea r9, [rsp + 0x40]
mov r8d, esi
mov rdx, rbx
mov rcx, r14
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14005ffd9
cmp dword [rsp + 0x40], esi
jne 0x14005ffd9
mov dword [r12], esi
mov dil, 1
mov qword [r15], rbx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, dil
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1400e8bc0
add rsp, 0x170
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140060710
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x50]
sub rsp, 0x150
mov rax, qword [0x140163470]
xor rax, rsp
mov qword [rbp + 0x40], rax
cmp qword [rcx + 0x30], 0
mov rdi, r9
mov r14, r8
mov rbx, rdx
mov rsi, rcx
je 0x140060795
lea rcx, [rsp + 0x40]
sub rcx, rdx
mov al, byte [rbx]
mov byte [rcx + rbx], al
inc rbx
test al, al
jne 0x14006074c
lea rcx, [rsp + 0x40]
dec rcx
inc rcx
cmp byte [rcx], 0
jne 0x140060760
xor edx, edx
mov al, byte [r8 + rdx]
mov byte [rcx + rdx], al
inc rdx
test al, al
jne 0x14006076a
mov r9d, dword [rbp + 0xa0]
mov rcx, qword [rsi + 0x30]
lea rdx, [rsp + 0x40]
mov r8, rdi
call fcn.1400278e4
jmp 0x140060833
lea rdx, [rcx + 0x38]
mov r8, rbx
call fcn.14005c5f8
lea rdx, [rsp + 0x20]
mov r9, r14
mov r8, rbx
mov rcx, rsi
call fcn.14005cd60
lea rcx, [0x14015950c]
mov edx, 0x5034cc27
mov r8d, 3
call fcn.140002104
cmp qword [rsp + 0x38], 0x10
lea rcx, [rsp + 0x20]
cmovae rcx, qword [rsp + 0x20]
mov rdx, rax
call fcn.1400eb53c
mov rbx, rax
test rax, rax
jne 0x140060802
cmp qword [rsp + 0x38], 0x10
jb 0x1400607fe
mov rcx, qword [rsp + 0x20]
call fcn.1400e92ec
xor al, al
jmp 0x140060835
mov r8d, dword [rbp + 0xa0]
mov r9, rax
mov edx, 1
mov rcx, rdi
call fcn.1400eb6d8
mov rcx, rbx
call fcn.1400eae14
cmp qword [rsp + 0x38], 0x10
jb 0x140060833
mov rcx, qword [rsp + 0x20]
call fcn.1400e92ec
mov al, 1
mov rcx, qword [rbp + 0x40]
xor rcx, rsp
call fcn.1400e8bc0
add rsp, 0x150
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140061edc
Capabilities:
Encode data using base64

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp - 0x10], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov r12d, r9d
mov r14, r8
mov rsi, rdx
and dword [rbp - 0x1c], 0
mov edx, 0x23232af1
mov ecx, 0xa9a04491
mov r8d, 0x9be2e357
call fcn.1400021ac
mov r13, rax
mov qword [rbp - 0x18], rax
mov qword [rsi + 0x18], InitCommonControls
and qword [rsi + 0x10], 0
mov byte [rsi], 0
mov dword [rbp - 0x1c], 1
xor edi, edi
test r12d, r12d
je 0x1400620a2
xor ecx, ecx
lea ebx, [rdi + 3]
jmp 0x140061f57
mov r14, qword [rbp + 0x50]
dec r12d
mov al, byte [r14]
mov byte [rbp + rcx + 0x58], al
inc edi
inc rcx
inc r14
mov qword [rbp + 0x50], r14
mov r13b, byte [rbp + 0x5a]
mov r14b, byte [rbp + 0x59]
mov r15b, byte [rbp + 0x58]
cmp rcx, rbx
jne 0x140061fe2
mov al, r15b
shr al, 2
mov byte [rbp - 0x20], al
mov cl, r15b
and cl, bl
shl cl, 4
mov al, r14b
shr al, 4
add cl, al
mov byte [rbp - 0x1f], cl
mov cl, r14b
and cl, 0xf
shl cl, 2
mov al, r13b
shr al, 6
add cl, al
mov byte [rbp - 0x1e], cl
mov al, r13b
and al, 0x3f
mov byte [rbp - 0x1d], al
xor edi, edi
mov rbx, qword [rbp - 0x18]
movzx eax, byte [rbp + rdi - 0x20]
mov r8b, byte [rax + rbx]
mov edx, 1
mov rcx, rsi
call fcn.140062dd4
inc rdi
cmp rdi, 4
jl 0x140061fbc
xor edi, edi
xor ecx, ecx
lea ebx, [rdi + 3]
test r12d, r12d
jne 0x140061f53
test edi, edi
je 0x1400620a2
movsxd rax, edi
cmp rax, rbx
jge 0x14006201e
jae 0x140062018
mov byte [rbp + rax + 0x58], 0
inc rax
cmp rax, rbx
jl 0x140061ffb
mov r13b, byte [rbp + 0x5a]
mov r14b, byte [rbp + 0x59]
mov r15b, byte [rbp + 0x58]
jmp 0x14006201e
call fcn.1400e9480
int3
mov al, r15b
shr al, 2
mov byte [rbp - 0x20], al
and r15b, bl
shl r15b, 4
mov al, r14b
shr al, 4
add r15b, al
mov byte [rbp - 0x1f], r15b
and r14b, 0xf
shl r14b, 2
mov al, r13b
shr al, 6
add r14b, al
mov byte [rbp - 0x1e], r14b
and r13b, 0x3f
mov byte [rbp - 0x1d], r13b
lea eax, [rdi + 1]
test eax, eax
jle 0x140062087
lea r14, [rbp - 0x20]
mov r15d, eax
mov r13, qword [rbp - 0x18]
movzx eax, byte [r14]
mov r8b, byte [rax + r13]
mov edx, 1
mov rcx, rsi
call fcn.140062dd4
inc r14
dec r15
jne 0x14006206a
cmp edi, ebx
jge 0x1400620a2
sub ebx, edi
mov r8b, 0x3d
mov edx, 1
mov rcx, rsi
call fcn.140062dd4
dec rbx
jne 0x14006208d
mov rax, rsi
mov rbx, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140347c4a
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
not esi
call fcn.14035fdae
push rbp
movsxd rdx, edx
mov qword [rsp + rcx - 0x7d00256a], r11
adc r8, rdx
or rcx, rsi
inc r11w
and ebp, dword [rsp + r11 - 0x75185435]
pop rbp
pop rcx
pop rbp
pop r11
pop rbx
jns fcn.140366999
mov ebp, 0x7a94bfab
mov edx, dword [rbp + rdi - 0x7a94bfab]
lea rdi, [rdi + rbp - 0x7a94bfa7]
call fcn.14033c29d
not esi
movzx edx, ax
add r8, r11
movzx ecx, bpl
jmp fcn.140366999
mov qword [rsp + rdx*4 - 0x15a70], r10
xor dword [rsp + rdx - 0x569c], eax
pop r10
btc edx, esi
rol r11, 0xb3
movsxd rax, eax
btr si, bx
lea r11, [r11 + rdx - 0x5b6e626f]
call fcn.1403479ac
push r10
movsx r10d, bp
xor dword [rsp + rax*4 - 0xd3f8], esi
idiv bp
lea rax, [rax + rbp*4 - 0x39ef7dec]
shr r10w, 0xa6
pop r10
movsxd rsi, esi
add r8, rsi
inc r11d
lea rax, [rsp + r11 + 0xc7]
mov rcx, qword [r11 + rax - 1]
mov qword [r9 + r11*2 - 8], rcx
movsx esi, bp
setle bl
lea r9, [r9 + r11*4 - 0xa]
jg fcn.140366999
mov ebx, 0x7f98b3a8
jmp 0x140365dee
movzx r11d, bl
sal ecx, cl
not eax
js 0x140341691
bt r11d, ebp
bt rsi, rbp
push r10
jae 0x140376e1b
push rsi
or sil, sil
mov r10, qword [rsp + r11 - 0x75185432]
js 0x14033a4a1
mov ebx, 0x952fdd26
movsx ecx, bl
movsx ebp, bx
mov si, word [r9 + rcx - 0x26]
movzx ebp, byte [rdi + rcx*8 - 0x130]
movsx eax, cx
mul eax
imul rbx
xor bpl, r10b
dec ax
cwde
dec bpl
and ax, bx
cwd
not bpl
inc rdx
neg ecx
xchg bx, dx
xor bpl, 0x16
movzx r11d, cx
cdqe
add bpl, bl
xor r10b, bpl
shl ecx, 2
add rbp, rsp
bts r11w, r11w
mov byte [rbp + rax*2 - 0x900c], sil
mov eax, dword [rdi + rax - 0x4805]
neg r11
xor eax, r10d
sar r11d, 0x3f
adc r11w, cx
lea eax, [rax + rbx + 0x55f94db0]
sub r11d, 0x191e730a
not r11w
mov esi, r11d
not eax
sbb dx, 0x868b
mov ebp, edx
bswap eax
neg ebp
bswap r11
jl 0x14036f264
mov ebp, 0x1d0231b2
jmp 0x140345e74
mov ebp, edx
sub dx, bx
mov eax, dword [rbx + rdi - 0x7f98b308]
mov esi, dword [rsp + rbp - 0x7d32378a]
lea rdi, [rdi + rbp - 0x7d323787]
adc ebx, edx
xor eax, r10d
pop rbp
sub eax, 0x5fbdbc84
shl qword [rsp], 0x3b
rol eax, 1
xor eax, 0xd605fb36
pop rdx
movzx ecx, si
xadd cl, dl
rol eax, 1
jmp 0x1403405f3
movsx ecx, bl
mov r11d, dword [r9 + rbx - 0x7f98b3a8]
lea rdx, [rcx*2 + 0x7d32383b]
mov cl, byte [rbx + r9 - 0x7f98b3a4]
sub bl, 0xa0
push rdx
lea r9, [r9 + rbx - 0x7f98b306]
push rbx
sal r11d, cl
shl dword [rsp + rbx - 0x7f98b2ff], 0x47
rol qword [rsp + rbx - 0x7f98b308], 9
mov dword [r9 + rbx - 0x7f98b308], r11d
jns 0x14035ba41
ror eax, 3
inc rdx
push rbx
btr cx, 0x33
neg eax
bt r11w, 0xe
adc qword [rsp + rdx*2 - 0xad38], rcx
shr dword [rsp + rdx - 0x5699], 0xf9
lea eax, [rax + rdx*2 - 0x519b0ed2]
jbe 0x14033d880
or cl, r11b
xor dword [rsp + rcx - 0x6610008c], eax
sar esi, cl
call fcn.14036d03c
xor al, byte [rsp + rcx*8 - 0xb2]
inc esi
lea rbx, [rcx + rdx + 0xf387fb7]
mov byte [rsp + rbp - 0x2420e815], bpl
jmp 0x14032c838
Function at 0x14037a1af
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
lea r11d, [r11 + rbx*4 - 0x5395c90e]
cbw
imul rsi, qword [rsp + rbx*2 - 0xfdb39a]
mov qword [rsp + rdx*4 + 0x1c], r10
and dx, 0xbe9a
mov qword [rsp + rbx - 0x7ed9dd], rdx
xor dword [rsp + rbx*4 - 0x1fb6754], r11d
jmp 0x14034b1d5
Function at 0x4171a0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41732b
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00435920
xorps xmm15, xmm15
mov r14, qword [0x006b19b8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x417205
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x417214
add rsp, 0x48
pop rbp
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x417233
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x417243
cmp rbx, 0x1000
jae 0x41720b
jmp 0x4172ad
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x417255
xor edx, edx
jmp 0x4172a4
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00435920
xorps xmm15, xmm15
mov r14, qword [0x006b19b8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x417239
jmp 0x417228
call fcn.0046ad20
xorps xmm15, xmm15
mov r14, qword [0x006b19b8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.00439d60
lea rax, [0x0051b026]
mov ebx, 0x18
nop dword [rax]
call fcn.0043a5e0
mov rax, qword [rsp + 0x38]
call fcn.0043a320
lea rax, [0x0051b4cf]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.0043a5e0
mov rax, qword [rsp + 0x30]
call fcn.0043a320
call fcn.00439fa0
call fcn.00439dc0
lea rax, [0x0051d9a5]
mov ebx, 0x21
call fcn.004382c0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004675e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004171a0
Function at 0x417360
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x417586
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.004359a0
xorps xmm15, xmm15
mov r14, qword [0x006b19b8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x4173d3
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x4173e2
add rsp, 0x50
pop rbp
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x417405
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x417415
cmp rbx, 0x1000
jae 0x4173d9
nop
jmp 0x417498
add rsp, 0x50
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop word [rax + rax]
cmp rbx, 0x1000
jae 0x41742d
xor esi, esi
jmp 0x41748a
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.004359a0
xorps xmm15, xmm15
mov r14, qword [0x006b19b8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x41740b
jmp 0x4173f6
call fcn.0046ad20
xorps xmm15, xmm15
mov r14, qword [0x006b19b8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x417520
nop dword [rax + rax]
call fcn.00439d60
lea rax, [0x0051b4e8]
mov ebx, 0x19
call fcn.0043a5e0
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
call fcn.0043a320
lea rax, [0x0051b4cf]
mov ebx, 0x19
call fcn.0043a5e0
mov eax, dword [rsp + 0x34]
call fcn.0043a320
nop
call fcn.00439fa0
call fcn.00439dc0
lea rax, [0x00517bfc]
mov ebx, 0xd
call fcn.004382c0
nop dword [rax + rax]
cmp eax, 0x5af
je 0x4174c0
call fcn.00439d60
lea rax, [0x0051b4e8]
mov ebx, 0x19
call fcn.0043a5e0
mov rax, qword [rsp + 0x38]
call fcn.0043a320
lea rax, [0x0051b4cf]
mov ebx, 0x19
call fcn.0043a5e0
mov eax, dword [rsp + 0x34]
nop dword [rax]
call fcn.0043a320
call fcn.00439fa0
call fcn.00439dc0
lea rax, [0x0051d183]
mov ebx, 0x1f
nop dword [rax + rax]
call fcn.004382c0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004675e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.00417360
Function at 0x421360
Capabilities:
Hash data using murmur3

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
cmp byte [0x006b1794], 0
jne 0x421450
sub rbx, qword [rax + 0x18]
mov rdx, qword [rax + 0x48]
test byte [rdx], al
mov ecx, dword [rax + 0x5c]
imul rcx, rbx
mov rbx, rcx
shr rbx, 0x20
shr rcx, 0x23
and ebx, 7
mov rsi, rcx
mov rcx, rbx
mov edi, 1
shl edi, cl
add rdx, rsi
nop
nop
nop
nop
lock or byte [rdx], dil
mov rcx, qword [rax + 0x18]
movabs rdx, 0x800000000000
add rdx, rcx
mov rbx, rdx
shr rdx, 0x2a
nop
nop
nop
cmp rdx, 0x40
jae 0x421443
lea rsi, [0x00643898]
mov rdx, qword [rsi + rdx*8]
test byte [rdx], al
mov rsi, rcx
shr rsi, 0x10
and esi, 0x3f
shr rcx, 0xd
and ecx, 7
mov edi, 1
shl edi, cl
shr rbx, 0x16
and ebx, 0xfffff
mov rdx, qword [rdx + rbx*8]
test byte [rdx], al
movzx ebx, byte [rdx + rsi + 0x1040]
lea rdx, [rdx + rsi]
lea rdx, [rdx + 0x1040]
test dil, bl
jne 0x42141e
lock or byte [rdx], dil
mov rcx, qword [r14 + 0x30]
mov rcx, qword [rcx + 0xa0]
test byte [rcx], al
mov rdx, qword [rcx + 0x1270]
add rdx, qword [rax + 0x68]
mov qword [rcx + 0x1270], rdx
add rsp, 0x10
pop rbp
ret
mov rax, rdx
mov ecx, 0x40
call fcn.004698e0
lea rax, [0x0051fc02]
mov ebx, 0x2c
nop dword [rax]
call fcn.004382c0
nop
int3

Function at 0x4238a0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4239a6
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov byte [rsp + 0x70], dil
mov qword [rsp + 0x10], 0
jmp 0x4238e3
mov rax, qword [rsp + 0x58]
mov rcx, rdx
mov rbx, qword [rsp + 0x60]
movzx edi, byte [rsp + 0x70]
cmp qword [rsp + 0x10], rbx
jae 0x42399b
test byte [rax], al
lea rcx, [rax + 0x100b8]
mov ebx, edi
mov rax, rcx
nop dword [rax]
call fcn.00424680
test rax, rax
je 0x42399b
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
lea rcx, [0x004239e0]
mov qword [rsp + 0x18], rcx
lea rdx, [rsp + 0x10]
mov qword [rsp + 0x20], rdx
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x40], rax
lea rbx, [rsp + 0x18]
mov qword [rsp], rbx
nop dword [rax]
call fcn.004674c0
xorps xmm15, xmm15
mov r14, qword [0x006b19b8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x68]
nop dword [rax]
test rdx, rdx
jne 0x423989
xor eax, eax
jmp 0x423993
mov rax, qword [rdx]
call rax
mov rdx, qword [rsp + 0x68]
test al, al
je 0x4238d1
mov rax, qword [rsp + 0x10]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov byte [rsp + 0x20], dil
call fcn.004675e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movzx edi, byte [rsp + 0x20]
jmp fcn.004238a0