joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140041210
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x90
mov rax, qword [0x14007f480]
xor rax, rsp
mov qword [rsp + 0x80], rax
movzx eax, byte [rcx]
lea rbx, [rsp + 0x30]
xor r14d, r14d
mov rbp, rdx
mov word [rsp + 0x30], r14w
mov rsi, rcx
mov edi, 0x28
test al, al
je 0x1400412c1
nop word [rax + rax]
mov r8d, 2
mov byte [rsp + 0x20], al
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x21], r14b
lea rcx, [rsp + 0x24]
call fcn.1400504e4
cmp rax, 1
jne 0x1400412f7
mov rcx, rdi
mov rax, rbx
cmp word [rbx], r14w
je 0x14004129d
add rax, 2
dec rcx
cmp word [rax], r14w
jne 0x140041290
cmp rcx, 1
jb 0x1400412f7
movzx ecx, word [rsp + 0x24]
inc rsi
mov word [rax], cx
add rbx, 2
mov word [rax + 2], r14w
dec rdi
movzx eax, byte [rsi]
test al, al
jne 0x140041260
mov rdx, rbp
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1400416e0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
call fcn.140044ea0
int3
Function at 0x140041420
Capabilities:
Set environment variable

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0xb0
mov rax, qword [0x14007f480]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rax, qword [0x140081cb0]
mov rbx, r8
mov rdi, rdx
mov r15, rcx
test rax, rax
jne 0x140041470
lea rcx, [0x1400611d4]
call qword [sym.imp.python312.dll_PyImport_ImportModule]
mov qword [0x140081cb0], rax
test rax, rax
je 0x14004164d
mov qword [rsp + 0xa8], rbp
lea rdx, str.environ
mov qword [rsp + 0xa0], rsi
mov rcx, rax
mov qword [rsp + 0x98], r12
mov qword [rsp + 0x90], r14
call qword [sym.imp.python312.dll_PyObject_GetAttrString]
mov rcx, rdi
mov rbp, rax
call qword [sym.imp.python312.dll_PyUnicode_FromString]
mov r14, rax
test rbx, rbx
je 0x140041517
mov rdx, rbx
mov rcx, rdi
call fcn.140041210
mov rdx, 0xffffffffffffffff
mov rcx, rbx
call qword [sym.imp.python312.dll_PyUnicode_FromWideChar]
mov rdx, r14
mov rcx, rbp
mov r8, rax
mov rbx, rax
call qword [sym.imp.python312.dll_PyObject_SetItem]
test eax, eax
je 0x1400414fc
mov ecx, 1
call qword [sym.imp.python312.dll_PyErr_PrintEx]
mov ecx, 1
call qword [sym.imp.python312.dll_Py_Exit]
int3
cmp dword [rbx], 0
jl 0x1400415e0
sub qword [rbx], 1
jne 0x1400415e0
mov rcx, rbx
jmp 0x1400415da
movzx eax, byte [rdi]
lea rbx, [rsp + 0x30]
xor r12d, r12d
mov esi, 0x28
mov word [rsp + 0x30], r12w
test al, al
je 0x1400415a5
mov r8d, 2
mov byte [rsp + 0x20], al
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x21], r12b
lea rcx, [rsp + 0x24]
call fcn.1400504e4
cmp rax, 1
jne 0x140041647
mov rcx, rsi
mov rax, rbx
cmp word [rbx], r12w
je 0x14004157d
nop word [rax + rax]
add rax, 2
dec rcx
cmp word [rax], r12w
jne 0x140041570
cmp rcx, 1
jb 0x140041647
movzx ecx, word [rsp + 0x24]
inc rdi
mov word [rax], cx
add rbx, 2
mov word [rax + 2], r12w
dec rsi
movzx eax, byte [rdi]
test al, al
jne 0x140041531
xor edx, edx
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rdx, r14
mov rcx, rbp
call qword [sym.imp.python312.dll_PyObject_DelItem]
test eax, eax
je 0x1400415e0
mov rcx, qword [r15 + 0x60]
mov qword [r15 + 0x60], r12
test rcx, rcx
je 0x1400415e0
cmp dword [rcx], r12d
jl 0x1400415e0
sub qword [rcx], 1
jne 0x1400415e0
call qword [sym.imp.python312.dll__Py_Dealloc]
cmp dword [r14], 0
jl 0x1400415f5
sub qword [r14], 1
jne 0x1400415f5
mov rcx, r14
call qword [sym.imp.python312.dll__Py_Dealloc]
cmp dword [rbp], 0
jl 0x14004160b
sub qword [rbp], 1
jne 0x14004160b
mov rcx, rbp
call qword [sym.imp.python312.dll__Py_Dealloc]
mov r12, qword [rsp + 0x98]
mov rsi, qword [rsp + 0xa0]
mov rbp, qword [rsp + 0xa8]
mov r14, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1400416e0
add rsp, 0xb0
pop r15
pop rdi
pop rbx
ret
call fcn.140044ea0
int3
call fcn.140044ea0
int3
Function at 0x140042148
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140042192
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140042192
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140042192
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140042192
cmp dword [rcx + 0x84], 0xe
jbe 0x140042192
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140042194
xor al, al
add rsp, 0x28
ret

Function at 0x1400460fc
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14004616b
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14004616b
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14004616b
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14004616b
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14004616b
cmp dword [rcx + 0x84], 0xe
jbe 0x14004616b
cmp dword [rcx + 0xf8], 0
je 0x14004616b
mov ecx, ebx
call fcn.14004621c
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.140045ff8
nop
cmp dword [rbp + 0x20], 0
je 0x1400461b9
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.1400461c4
int3
xor r8d, r8d
xor edx, edx
jmp 0x1400460fc

Function at 0x140046300
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14004616b
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14004616b
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14004616b
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14004616b
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14004616b
cmp dword [rcx + 0x84], 0xe
jbe 0x14004616b
cmp dword [rcx + 0xf8], 0
je 0x14004616b
mov ecx, ebx
call fcn.14004621c
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.140045ff8
nop
cmp dword [rbp + 0x20], 0
je 0x1400461b9
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.1400461c4
int3
xor r8d, r8d
xor edx, edx
jmp 0x1400460fc
Function at 0x140057d20
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x140057da7
mov rsi, rbx
cmp word [rax], bp
je 0x140057d66
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x140057d50
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x140057d4c
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.1400534bc
mov rdi, rax
test rax, rax
je 0x140057d94
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.14005d9e0
mov rbp, rdi
xor ecx, ecx
call fcn.140053ecc
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14005a050
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x14005a066
mov al, 1
jmp 0x14005a0c6
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x14005a077
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x14005a0c4
mov ecx, dword [rcx + 0x18]
nop
call fcn.140058068
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14005a0c4
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x14005a0c4
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x14005a0c4
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x14005a0c6
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x14005d830
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14005d858
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14005d858
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140131927
Capabilities:
Execute anti-debugging instructions
Execute syscall
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
cmpsd dword [rsi], dword [rdi]
adc dword [rdi + 0x28c20000], esi
add ah, cl
cmp ebp, 0xf1b0b436
cmp rdx, rbp
cpuid
je 0x140131958
jne 0x140131958
mov r13d, 0x82251177
jmp fcn.1401309b5
jmp 0x140131a49
jns 0x140130b85
syscall
jp 0x140130e4e
lea r10d, [rbx - 0x92b0]
nop
jmp 0x140131afe
ror ebx, 0x25
sub r12d, 0xd4089fb6
cmp r9d, 0x5281c0d8
jmp rcx
Function at 0x140133660
Capabilities:
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
rcr byte [rax], 0xf
xor cl, byte [rax - 0x43]
adc byte [rdi], cl
invalid
and al, 0x48
add esp, 8
xchg r11, r9
mov qword [rsp + 0x20], r11
xchg r11, r9
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
xchg rsi, rcx
mov qword [rsp + 8], rsi
jne 0x1401336bb
je 0x1401336bb
and r10d, 0xd155ba48
lea r12d, [rbp - 0x7029]
lea r10d, [rdi + 0x9de2]
je 0x140132ed1
mul rdx
call rcx
jnp 0x1401326bb
or r15d, 0xeb875cf
or edi, 0xf86c3ce9
mul r10
bswap rdx
movabs r10, 0x55023f8758c72aeb
jnp 0x1401329f3
jmp 0x1401336e7
ret
xchg r15, rax
mov dword [rsp + 8], 0
xchg rdx, rax
mov rdx, qword [rsp + 0x30]
xchg rdx, rax
mov qword [rsp + 0x10], rax
jmp 0x140133767
xchg rsi, rcx
sub rsp, 0x28
lea rax, [0x1401339e0]
xchg r15, rax
mov qword [rsp + 0x18], r15
jne 0x140133738
je 0x140133738
ror ecx, 0x41
and r11d, 0x87d60f3d
jmp 0x140134650
jmp 0x1401336ca
mov rax, qword [rsp + 0x10]
inc rax
xchg rdi, rax
mov qword [rsp + 0x10], rdi
xchg rdi, rax
mov eax, dword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
je 0x1401337a0
jne 0x1401337a0
pushf
call rax
pushf
lea r15d, [rbx - 0x52e]
lea edi, [rdx - 0xacdf]
test rdx, rdx
test rcx, rdi
lea edx, [rcx - 0x37fb]
jmp rax
jmp 0x1401337bc
add rcx, rax
xchg rcx, rax
mov rcx, rax
jmp 0x1401337c9
xchg rcx, rax
cmp qword [rsp + 0x10], rax
jae 0x1401339d1
jmp 0x1401337db
mov byte [rsp], 0
mov dword [rsp + 4], 0
jmp 0x14013382d
mov eax, dword [rsp + 4]
inc eax
mov dword [rsp + 4], eax
jmp 0x14013382d
xchg rdi, rdx
mov rdi, qword [rsp + 0x40]
xchg rdi, rdx
add rcx, qword [rdx + rax*8]
xchg r15, rcx
jmp 0x140133852
cmp qword [rsp + 0x10], rax
jb 0x140133916
mov eax, dword [rsp + 4]
mov ecx, dword [rsp + 4]
xchg rdx, rbp
jmp 0x1401338ce
mov eax, dword [rsp + 0x50]
cmp dword [rsp + 4], eax
jae 0x14013391b
mov eax, dword [rsp + 4]
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx + rax*8]
jmp 0x140133812
jmp 0x14013391b
mov rax, r15
xchg rcx, r15
cmp qword [rsp + 0x10], rax
jae 0x140133916
mov byte [rsp], 1
jne 0x1401338a9
je 0x1401338a9
pushfq
mul rsi
lea r14d, [rdx + 0xe32d]
int3
jmp 0x14013384d
mov rbp, qword [rsp + 0x48]
xchg rbp, rdx
mov ecx, dword [rdx + rcx*4]
je 0x140133900
jne 0x140133900
sub r9d, 0xc5237c28
rcr ebx, 0x49
jmp loc.140133e23
jmp 0x1401337fb
jmp 0x1401337ec
movzx eax, byte [rsp]
test eax, eax
je 0x14013392c
jmp 0x140133756
xor edx, edx
mov eax, dword [rsp + 8]
mov ecx, 0x20
div ecx
mov eax, edx
jmp 0x14013396b
xchg rcx, r10
movzx ecx, byte [rcx]
xor ecx, eax
mov eax, ecx
xchg rcx, r9
mov r9, qword [rsp + 0x10]
jmp 0x140133957
xchg rcx, r9
mov byte [rcx], al
mov eax, dword [rsp + 8]
inc eax
mov dword [rsp + 8], eax
jmp 0x140133756
mov eax, eax
xchg r14, rcx
mov r14, qword [rsp + 0x18]
xchg r14, rcx
movzx eax, byte [rcx + rax]
xchg r10, rcx
mov r10, qword [rsp + 0x10]
jne 0x1401339a7
je 0x1401339a7
push r15
lea edi, [rbp + 0x4062]
test rdx, rdi
mov r8d, 0x54a7a7d7
lea r8d, [rcx + 0xe959]
inc r15
syscall
movabs r8, 0x4f493a5e100197eb
lea edx, [rbx - 0xc9d9]
lea edx, [rdi + 0x43ed]
lea r9d, [rcx + 0x999c]
lea ebx, [rdx - 0x3b6b]
syscall
dec r12
div r12
ret
jmp 0x140133940
add rsp, 0x28
ret
Function at 0x1400181c0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x14001834b
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [0x140264fa8]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.140036fe0
xorps xmm15, xmm15
mov r14, qword [0x140675318]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x140018225
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x140018234
add rsp, 0x48
pop rbp
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x140018253
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x140018263
cmp rbx, 0x1000
jae 0x14001822b
jmp 0x1400182cd
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x140018275
xor edx, edx
jmp 0x1400182c4
mov rcx, qword [0x140264fa8]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.140036fe0
xorps xmm15, xmm15
mov r14, qword [0x140675318]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x140018259
jmp 0x140018248
call fcn.14006da00
xorps xmm15, xmm15
mov r14, qword [0x140675318]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.14003b520
lea rax, [0x140304ec6]
mov ebx, 0x18
nop dword [rax]
call fcn.14003bda0
mov rax, qword [rsp + 0x38]
call fcn.14003bae0
lea rax, [0x14030575b]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.14003bda0
mov rax, qword [rsp + 0x30]
call fcn.14003bae0
call fcn.14003b760
call fcn.14003b580
lea rax, [0x1403096ca]
mov ebx, 0x21
call fcn.140039a80
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.14006a2a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.1400181c0
Function at 0x140018380
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x1400185a6
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [0x140264fa0]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.140037060
xorps xmm15, xmm15
mov r14, qword [0x140675318]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x1400183f3
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x140018402
add rsp, 0x50
pop rbp
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x140018425
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x140018435
cmp rbx, 0x1000
jae 0x1400183f9
nop
jmp 0x1400184b8
add rsp, 0x50
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop word [rax + rax]
cmp rbx, 0x1000
jae 0x14001844d
xor esi, esi
jmp 0x1400184aa
mov rax, qword [0x140264fa0]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.140037060
xorps xmm15, xmm15
mov r14, qword [0x140675318]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x14001842b
jmp 0x140018416
call fcn.14006da00
xorps xmm15, xmm15
mov r14, qword [0x140675318]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x140018540
nop dword [rax + rax]
call fcn.14003b520
lea rax, [0x140305774]
mov ebx, 0x19
call fcn.14003bda0
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
call fcn.14003bae0
lea rax, [0x14030575b]
mov ebx, 0x19
call fcn.14003bda0
mov eax, dword [rsp + 0x34]
call fcn.14003bae0
nop
call fcn.14003b760
call fcn.14003b580
lea rax, [0x1402fe76f]
mov ebx, 0xd
call fcn.140039a80
nop dword [rax + rax]
cmp eax, 0x5af
je 0x1400184e0
call fcn.14003b520
lea rax, [0x140305774]
mov ebx, 0x19
call fcn.14003bda0
mov rax, qword [rsp + 0x38]
call fcn.14003bae0
lea rax, [0x14030575b]
mov ebx, 0x19
call fcn.14003bda0
mov eax, dword [rsp + 0x34]
nop dword [rax]
call fcn.14003bae0
call fcn.14003b760
call fcn.14003b580
lea rax, [0x140308868]
mov ebx, 0x1f
nop dword [rax + rax]
call fcn.140039a80
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.14006a2a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.140018380
Function at 0x140022580
Capabilities:
Hash data using murmur3

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
cmp byte [0x140675055], 0
jne 0x140022670
sub rbx, qword [rax + 0x18]
mov rdx, qword [rax + 0x48]
test byte [rdx], al
mov ecx, dword [rax + 0x5c]
imul rcx, rbx
mov rbx, rcx
shr rbx, 0x20
shr rcx, 0x23
and ebx, 7
mov rsi, rcx
mov rcx, rbx
mov edi, 1
shl edi, cl
add rdx, rsi
nop
nop
nop
nop
lock or byte [rdx], dil
mov rcx, qword [rax + 0x18]
movabs rdx, 0x800000000000
add rdx, rcx
mov rbx, rdx
shr rdx, 0x2a
nop
nop
nop
cmp rdx, 0x40
jae 0x140022663
lea rsi, [0x140607158]
mov rdx, qword [rsi + rdx*8]
test byte [rdx], al
mov rsi, rcx
shr rsi, 0x10
and esi, 0x3f
shr rcx, 0xd
and ecx, 7
mov edi, 1
shl edi, cl
shr rbx, 0x16
and ebx, 0xfffff
mov rdx, qword [rdx + rbx*8]
test byte [rdx], al
movzx ebx, byte [rdx + rsi + 0x1040]
lea rdx, [rdx + rsi]
lea rdx, [rdx + 0x1040]
test dil, bl
jne 0x14002263e
lock or byte [rdx], dil
mov rcx, qword [r14 + 0x30]
mov rcx, qword [rcx + 0xa0]
test byte [rcx], al
mov rdx, qword [rcx + 0x1270]
add rdx, qword [rax + 0x68]
mov qword [rcx + 0x1270], rdx
add rsp, 0x10
pop rbp
ret
mov rax, rdx
mov ecx, 0x40
call fcn.14006c5c0
lea rax, [0x14030d55a]
mov ebx, 0x2c
nop dword [rax]
call fcn.140039a80
nop
int3

Function at 0x140024ac0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x140024bc6
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov byte [rsp + 0x70], dil
mov qword [rsp + 0x10], 0
jmp 0x140024b03
mov rax, qword [rsp + 0x58]
mov rcx, rdx
mov rbx, qword [rsp + 0x60]
movzx edi, byte [rsp + 0x70]
cmp qword [rsp + 0x10], rbx
jae 0x140024bbb
test byte [rax], al
lea rcx, [rax + 0x100b8]
mov ebx, edi
mov rax, rcx
nop dword [rax]
call fcn.1400258a0
test rax, rax
je 0x140024bbb
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
lea rcx, [0x140024c00]
mov qword [rsp + 0x18], rcx
lea rdx, [rsp + 0x10]
mov qword [rsp + 0x20], rdx
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x40], rax
lea rbx, [rsp + 0x18]
mov qword [rsp], rbx
nop dword [rax]
call fcn.14006a180
xorps xmm15, xmm15
mov r14, qword [0x140675318]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x68]
nop dword [rax]
test rdx, rdx
jne 0x140024ba9
xor eax, eax
jmp 0x140024bb3
mov rax, qword [rdx]
call rax
mov rdx, qword [rsp + 0x68]
test al, al
je 0x140024af1
mov rax, qword [rsp + 0x10]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov byte [rsp + 0x20], dil
call fcn.14006a2a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movzx edi, byte [rsp + 0x20]
jmp fcn.140024ac0
Function at 0x140031720
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x140031819
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rax + 0x108], 0
mov ecx, dword [0x1406758f0]
test ecx, ecx
je 0x1400317f2
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x10], 0
lea rcx, [rsp + 0x60]
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x30], xmm15
movups xmmword [rsp + 0x40], xmm15
lea rdx, [0x140031840]
mov qword [rsp + 0x18], rdx
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], rcx
mov rcx, r14
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x10]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], 3
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x18]
mov qword [rsp], rcx
call fcn.14006a180
xorps xmm15, xmm15
mov r14, qword [0x140675318]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x10]
cmp rax, 0x20
jge 0x1400317ec
jae 0x14003180e
mov rcx, qword [rsp + 0x60]
mov qword [rcx + rax*8 + 8], 0
add rsp, 0x50
pop rbp
ret
lea rcx, [fcn.140046c20]
inc rcx
mov qword [rax + 8], rcx
mov qword [rax + 0x10], 0
add rsp, 0x50
pop rbp
ret
mov ecx, 0x20
call fcn.14006c5a0
nop
mov qword [rsp + 8], rax
nop
call fcn.14006a2a0
mov rax, qword [rsp + 8]
jmp fcn.140031720
Function at 0x140033a60
Capabilities:
Hash data using murmur3

Disassembly:
cmp rsp, qword [r14 + 0x18]
jbe 0x140033ce6
push rbp
mov rbp, rsp
sub rsp, 0x38
test byte [rax], al
lea rsi, [rax + 0x1298]
mov rcx, qword [rax + 0x1288]
sub rcx, rsi
shr rcx, 3
cmp rcx, 0x200
ja 0x140033cda
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x30], rcx
mov qword [rax + 0x1288], 0
cmp byte [0x140675055], 0
jne 0x140033aba
xor edx, edx
xor ebx, ebx
jmp 0x140033b00
xor edx, edx
jmp 0x140033ae5
mov qword [rsp + 0x28], rdx
mov rcx, qword [rax + rdx*8 + 0x1298]
mov rax, rcx
call fcn.140021de0
mov rdx, qword [rsp + 0x28]
inc rdx
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
cmp rdx, rcx
jl 0x140033abe
add rax, 0x1288
call fcn.1400339e0
add rsp, 0x38
pop rbp
ret
inc rdx
nop
cmp rdx, rcx
jge 0x140033c74
mov rsi, qword [rax + rdx*8 + 0x1298]
cmp rsi, 0x1000
jb 0x140033afb
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rbx
mov rax, rsi
xor ebx, ebx
mov rcx, rbx
call fcn.1400154a0
test rax, rax
jne 0x140033b4c
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
jmp 0x140033afb
mov rsi, qword [rbx + 0x48]
test byte [rsi], al
mov r8, rcx
shr r8, 3
movzx r9d, byte [rsi + r8]
and ecx, 7
mov r10d, 1
shl r10d, cl
nop
add rsi, r8
test r10b, r9b
je 0x140033b8c
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
jmp 0x140033afb
nop
lock or byte [rsi], r10b
mov rcx, qword [rbx + 0x18]
movabs rsi, 0x800000000000
lea r8, [rsi + rcx]
mov r9, r8
shr r8, 0x2a
nop
nop
nop
cmp r8, 0x40
jae 0x140033ccd
lea r10, [0x140607158]
mov r8, qword [r10 + r8*8]
test byte [r8], al
mov r10, rcx
shr r10, 0x10
and r10d, 0x3f
shr rcx, 0xd
and ecx, 7
mov r11d, 1
shl r11d, cl
shr r9, 0x16
and r9d, 0xfffff
mov r8, qword [r8 + r9*8]
test byte [r8], al
movzx r9d, byte [r8 + r10 + 0x1040]
lea r8, [r8 + r10]
lea r8, [r8 + 0x1040]
test r11b, r9b
jne 0x140033c0f
lock or byte [r8], r11b
movzx r8d, byte [rbx + 0x62]
test r8b, 1
je 0x140033c45
mov rax, qword [rsp + 0x48]
mov r8, qword [rax + 0x1270]
add r8, qword [rbx + 0x68]
mov qword [rax + 0x1270], r8
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
jmp 0x140033afb
mov r8, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
cmp r8, rcx
jae 0x140033cc5
mov rbx, qword [rsp + 0x48]
mov qword [rbx + r8*8 + 0x1298], rax
inc r8
mov rax, rbx
mov rdx, qword [rsp + 0x28]
mov rbx, r8
jmp 0x140033afb
cmp rbx, 0x200
ja 0x140033cb4
lea rdx, [rax + 0x1298]
lea rsi, [rax + 0x1260]
mov rcx, rbx
mov edi, 0x200
mov rbx, rdx
mov rax, rsi
call fcn.1400288c0
mov rax, qword [rsp + 0x48]
add rax, 0x1288
call fcn.1400339e0
add rsp, 0x38
pop rbp
ret
mov rcx, rbx
mov edx, 0x200
nop dword [rax]
call fcn.14006c620
mov rax, r8
call fcn.14006c5a0
mov rax, r8
mov ecx, 0x40
call fcn.14006c5c0
mov edx, 0x200
nop
call fcn.14006c600
nop
mov qword [rsp + 8], rax
call fcn.140070e80
mov rax, qword [rsp + 8]
jmp fcn.140033a60