joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400962b0
Capabilities:
Allocate thread local storage

Disassembly:
push rbx
sub rsp, 0xb0
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov rax, qword [0x140120c80]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov dword [rsp + 0x30], 0xc15730e2
mov dword [rsp + 0x34], 0x7f0725e3
mov byte [rsp + 0x38], 0
and qword [rsp + 0x40], 0
mov byte [rsp + 0x48], 0
mov eax, dword [0x140122030]
cmp eax, dword [rsp + 0x30]
je 0x140096427
mov ecx, dword [rsp + 0x34]
xor eax, eax
lock cmpxchg dword [0x140122030], ecx
jne 0x14009645f
mov rbx, qword [rsp + 0x40]
test rbx, rbx
jne 0x140096372
cmp byte [rsp + 0x48], bl
jne 0x140096332
lea rcx, [rsp + 0x48]
call fcn.140096180
lea r8, [rsp + 0x48]
xor edx, edx
mov ecx, 0x100002
call qword [sym.imp.KERNEL32.dll_OpenEventA]
nop dword [rax + rax]
mov rbx, rax
mov rcx, qword [rsp + 0x40]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140096368
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
mov qword [rsp + 0x40], rbx
test rbx, rbx
je 0x140096382
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ResetEvent]
nop dword [rax + rax]
nop
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
nop dword [rax + rax]
mov dword [0x140120e00], eax
cmp byte [rsp + 0x38], 0
jne 0x1400963a7
lock inc dword [0x140122034]
mov byte [rsp + 0x38], 1
mov eax, dword [rsp + 0x30]
xchg dword [0x140122030], eax
mov rbx, qword [rsp + 0x40]
test rbx, rbx
jne 0x140096418
mov eax, dword [0x140122034]
cmp eax, 1
jle 0x140096427
cmp byte [rsp + 0x48], bl
jne 0x1400963d6
lea rcx, [rsp + 0x48]
call fcn.140096180
lea r9, [rsp + 0x48]
xor r8d, r8d
lea edx, [r8 + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
nop dword [rax + rax]
mov rbx, rax
mov rcx, qword [rsp + 0x40]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14009640e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
mov qword [rsp + 0x40], rbx
test rbx, rbx
je 0x14009642c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetEvent]
nop dword [rax + rax]
mov rbx, qword [rsp + 0x40]
lea rax, [rbx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140096445
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.1400be470
add rsp, 0xb0
pop rbx
ret
cmp byte [rsp + 0x38], 0
jne 0x1400964da
lock inc dword [0x140122034]
mov byte [rsp + 0x38], 1
mov eax, dword [0x140122030]
cmp eax, dword [rsp + 0x30]
je 0x140096427
mov rcx, qword [rsp + 0x40]
test rcx, rcx
jne 0x1400964df
cmp byte [rsp + 0x48], cl
jne 0x140096498
lea rcx, [rsp + 0x48]
call fcn.140096180
lea r9, [rsp + 0x48]
xor r8d, r8d
lea edx, [r8 + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
nop dword [rax + rax]
mov rbx, rax
mov rcx, qword [rsp + 0x40]
lea rdx, [rcx - 1]
cmp rdx, 0xfffffffffffffffd
ja 0x1400964d0
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
mov qword [rsp + 0x40], rbx
jmp 0x1400962f4
mov rcx, qword [rsp + 0x40]
xor r8d, r8d
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
nop dword [rax + rax]
jmp 0x1400962f4
Function at 0x14009d0b0
Capabilities:
Compare security identifiers

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rsi, r9
mov rcx, rdi
mov rdx, r8
call qword [sym.imp.ADVAPI32.dll_EqualSid]
nop dword [rax + rax]
xor ebx, ebx
test eax, eax
jne 0x14009d0f3
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_EqualSid]
nop dword [rax + rax]
test eax, eax
je 0x14009d0f5
mov bl, 1
mov rsi, qword [rsp + 0x38]
mov al, bl
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1400bae30
Capabilities:
Get geographical location

Disassembly:
push rbx
sub rsp, 0x20
and dword [rsp + 0x30], 0
mov ecx, 5
call fcn.1400a1c58
mov ebx, 2
lea r8, [rsp + 0x30]
mov rcx, rax
mov r9d, ebx
lea edx, [rbx + 0x20]
call sub.KERNEL32.dll_GetLocaleInfoW
mov eax, dword [rsp + 0x30]
cmp ax, 0x30
je 0x1400bae80
cmp ax, 0x31
jne 0x1400bae74
mov ebx, 1
jmp 0x1400bae80
xor ebx, ebx
cmp ax, 0x32
lea ecx, [rbx + 3]
cmove ebx, ecx
mov eax, ebx
add rsp, 0x20
pop rbx
ret
Function at 0x1400bc478
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rbx, rcx
mov ebp, 0x7ff
movzx ecx, word [rcx + 6]
mov esi, edx
shr cx, 4
and cx, bp
cmp cx, bp
jne 0x1400bc4d9
test byte [rbx + 6], 0xf
jne 0x1400bc4cc
xor edi, edi
cmp word [rbx + 4], di
jne 0x1400bc4cc
cmp word [rbx + 2], di
jne 0x1400bc4cc
cmp word [rbx], di
jne 0x1400bc4cc
lea esi, [rdi + 1]
jmp 0x1400bc4d1
mov esi, 2
movzx eax, si
jmp 0x1400bc6d6
xor edi, edi
test cx, cx
jne 0x1400bc4f4
mov rcx, rbx
call fcn.1400bdd58
movzx ecx, ax
cmp di, ax
jl 0x1400bc6d3
movsx edx, cx
test esi, esi
jle 0x1400bc524
sub ebp, edx
cmp ebp, esi
jg 0x1400bc524
movsd xmm0, qword [0x140120c40]
cmp word [rbx + 6], di
jge 0x1400bc516
xorps xmm0, xmmword [0x1400e6fe0]
movsd qword [rbx], xmm0
mov eax, 1
jmp 0x1400bc6d6
movzx r11d, word [rbx + 6]
mov eax, edx
neg eax
cmp eax, esi
jge 0x1400bc551
add si, cx
mov eax, 0x800f
shl si, 4
and r11w, ax
or si, r11w
mov word [rbx + 6], si
or eax, 0xffffffff
jmp 0x1400bc6d6
movzx r15d, r11w
lea ebp, [rsi - 1]
and r11w, 0xf
mov r13d, 0x8000
mov r12d, 0x10
and r15w, r13w
or r11w, r12w
add ebp, edx
cmp ebp, 0xffffffcb
jl 0x1400bc6c8
test ebp, ebp
jns 0x1400bc6c8
lea esi, [r12 - 0xf]
movzx r14d, di
cmp bp, 0xfff0
jg 0x1400bc5ec
movzx ecx, word [rbx + 4]
mov eax, 0xfff0
movzx edx, word [rbx + 2]
sub ax, bp
shr ax, 4
movzx r9d, r11w
add ax, si
movzx r8d, ax
movzx eax, r8w
shl ax, 4
add bp, ax
test r14w, r14w
mov eax, edi
setne al
movzx r14d, ax
or r14w, word [rbx]
mov word [rbx], dx
movzx edx, cx
movzx ecx, r9w
mov r9d, edi
sub r8, rsi
jne 0x1400bc5bd
mov word [rbx + 4], cx
movzx r11d, di
mov word [rbx + 2], dx
neg bp
je 0x1400bc66b
movzx r8d, word [rbx]
mov eax, edi
movzx r9d, word [rbx + 2]
movzx edx, r8w
movsx r10d, bp
sub r12d, r10d
mov ecx, r12d
shl dx, cl
test r14w, r14w
movzx r14d, dx
movzx edx, word [rbx + 4]
setne al
or r14w, ax
movzx eax, r9w
shl ax, cl
movzx ecx, bp
shr r8w, cl
mov ecx, r12d
or ax, r8w
mov word [rbx], ax
movzx eax, dx
shl ax, cl
movzx ecx, bp
shr r9w, cl
mov ecx, r12d
or ax, r9w
mov word [rbx + 2], ax
movzx eax, r11w
shl ax, cl
movzx ecx, bp
shr dx, cl
mov ecx, r10d
or ax, dx
mov word [rbx + 4], ax
shr r11w, cl
or r11w, r15w
mov word [rbx + 6], r11w
cmp r13w, r14w
jb 0x1400bc681
jne 0x1400bc6a0
test byte [rbx], sil
je 0x1400bc6a0
add word [rbx], si
jne 0x1400bc6a0
add word [rbx + 2], si
jne 0x1400bc6a0
add word [rbx + 4], si
jne 0x1400bc6a0
add r11w, si
mov word [rbx + 6], r11w
jmp 0x1400bc549
cmp r11w, r15w
jne 0x1400bc549
cmp word [rbx + 4], di
jne 0x1400bc549
cmp word [rbx + 2], di
jne 0x1400bc549
cmp word [rbx], di
je 0x1400bc6d3
jmp 0x1400bc549
mov word [rbx + 6], r15w
mov dword [rbx + 2], edi
mov word [rbx], di
movzx eax, di
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1400be260
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r15
sub rsp, 0x30
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
xor esi, esi
xor eax, eax
lock cmpxchg qword [0x140122a28], rbx
je 0x1400be2ac
cmp rax, rbx
jne 0x1400be29f
mov ebx, 1
mov esi, ebx
jmp 0x1400be2b1
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400be284
mov ebx, 1
mov eax, dword [0x140122a30]
cmp eax, ebx
jne 0x1400be2c7
mov ecx, 0x1f
call fcn.1401ba000
jmp 0x1400be32c
mov eax, dword [0x140122a30]
test eax, eax
jne 0x1400be326
mov dword [0x140122a30], ebx
lea r15, [0x1400d18e8]
lea rdi, [0x1400d18d0]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], eax
cmp rdi, r15
jae 0x1400be318
test eax, eax
jne 0x1400be31c
cmp qword [rdi], 0
je 0x1400be30d
mov rax, qword [rdi]
mov rcx, qword [0x1400d12d8]
call rcx
mov dword [rsp + 0x20], eax
add rdi, 8
mov qword [rsp + 0x28], rdi
jmp 0x1400be2ee
test eax, eax
je 0x1400be32c
mov eax, 0xff
jmp 0x1400be408
mov dword [0x140121618], ebx
mov eax, dword [0x140122a30]
cmp eax, ebx
jne 0x1400be353
lea rdx, [0x1400d18c8]
lea rcx, [0x1400d12e0]
call sub.msvcrt.dll__initterm
mov dword [0x140122a30], 2
test esi, esi
jne 0x1400be360
xor eax, eax
xchg qword [0x140122a28], rax
cmp qword [0x140122a48], 0
je 0x1400be394
lea rcx, [0x140122a48]
call fcn.1400bea30
test eax, eax
je 0x1400be394
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x140122a48]
mov r9, qword [0x1400d12d8]
call r9
mov r8, qword [0x140121630]
mov rdx, qword [0x140121628]
mov ecx, dword [0x140121620]
call fcn.140003a70
mov dword [0x140121614], eax
cmp dword [0x140121638], 0
jne 0x1400be3c4
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x140121618], 0
jne 0x1400be3d9
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x140121614]
jmp 0x1400be408
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r15
ret
sub rsp, 0x28
call fcn.1400beac4
add rsp, 0x28
jmp 0x1400be260

Function at 0x1400be92c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x1400be978
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400be970
cmp dword [rcx + 0x3c], edx
jl 0x1400be970
cmp dword [rcx + 0x3c], 0x10000000
jae 0x1400be970
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x1400be978
mov rax, rdx
add rsp, 0x18
ret
Function at 0x140002d30
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.140003e90
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.140003e90
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop dword [rax]

Function at 0x140002da0
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x1400090a4]
mov rbx, rcx
test esi, esi
jle 0x140002ed0
mov rax, qword [0x1400090a8]
xor r9d, r9d
add rax, 0x18
nop word [rax + rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x140002deb
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x140002e75
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x140002dd0
mov rcx, rbx
call fcn.1400037f0
mov rdi, rax
test rax, rax
je 0x140002ef2
mov rax, qword [0x1400090a8]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call fcn.140003930
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x1400090a8]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x140002ed7
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x140002e6e
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x140002e80
add dword [0x1400090a4], 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x1400090a8]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140002e6e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.140002d30
nop dword [rax]
xor esi, esi
jmp 0x140002df8
mov rax, qword [0x1400090a8]
mov edx, dword [rdi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.140002d30
mov rdx, rbx
lea rcx, str.Address__p_has_no_image_section
call fcn.140002d30
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x140003460
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x140009100]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1400090e0]
test rbx, rbx
je 0x1400034bc
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x1400034b3
test rsi, rsi
je 0x1400034b3
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x140003498
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x1400037f0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x140006a20]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x140003810
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x140003818
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140003810
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x14000386d
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x140003864
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x140003810
add rax, 0x28
cmp rax, r9
jne 0x140003850
xor eax, eax
ret

Function at 0x140003870
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140006a20]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x14000388f
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x140003898
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x14000388f
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x140003930
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140006a20]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x14000394f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x140003958
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret
Function at 0x416040
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4161eb
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00430620
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
nop
jne 0x4160ae
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x4160c1
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x4160e5
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x4160f9
cmp rbx, 0x1000
jae 0x4160b8
nop
jmp 0x416169
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop
cmp rbx, 0x1000
jae 0x41610d
xor edx, edx
jmp 0x416160
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00430620
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
nop
test dl, dl
jne 0x4160ef
jmp 0x4160d5
call fcn.00461160
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.00435780
lea rax, [0x004d47ac]
mov ebx, 0x18
nop dword [rax + rax]
call fcn.00436080
mov rax, qword [rsp + 0x38]
call fcn.00435d80
lea rax, [0x004d483c]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.00436080
mov rax, qword [rsp + 0x30]
call fcn.00435d80
call fcn.004359e0
call fcn.00435800
lea rax, [0x004d69ae]
mov ebx, 0x21
call fcn.00434000
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045d5c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00416040
Function at 0x416220
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41644a
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.004306a0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x41629b
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x4162ae
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x4162d0
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x4162e4
cmp rbx, 0x1000
jae 0x4162a5
jmp 0x41636e
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x4162f6
xor esi, esi
jmp 0x416360
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
nop dword [rax]
call fcn.004306a0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
test sil, sil
jne 0x4162da
jmp 0x4162c2
call fcn.00461160
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x4163e9
call fcn.00435780
lea rax, [0x004d4bd9]
mov ebx, 0x19
call fcn.00436080
mov rax, qword [rsp + 0x68]
call fcn.00435d80
lea rax, [0x004d483c]
mov ebx, 0x19
nop
call fcn.00436080
mov eax, dword [rsp + 0x34]
call fcn.00435d80
call fcn.004359e0
call fcn.00435800
lea rax, [0x004d16c3]
mov ebx, 0xd
call fcn.00434000
cmp eax, 0x5af
je 0x416393
call fcn.00435780
lea rax, [0x004d4bd9]
mov ebx, 0x19
call fcn.00436080
mov rax, qword [rsp + 0x38]
call fcn.00435d80
lea rax, [0x004d483c]
mov ebx, 0x19
nop dword [rax]
call fcn.00436080
mov eax, dword [rsp + 0x34]
call fcn.00435d80
call fcn.004359e0
call fcn.00435800
lea rax, [0x004d629f]
mov ebx, 0x1f
call fcn.00434000
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045d5c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00416220
Function at 0x41d900
Capabilities:
Hash data using murmur3

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
cmp byte [0x005e18d6], 0
jne 0x41d9f9
nop
nop
nop
nop
sub rbx, qword [rax + 0x18]
nop
mov edx, dword [rax + 0x5c]
imul rbx, rdx
mov rdx, rbx
shr rbx, 0x20
nop
shr rdx, 0x23
and rbx, 7
mov rsi, rcx
mov rcx, rbx
mov r8d, 1
shl r8d, cl
nop
add rdx, qword [rax + 0x50]
lock or byte [rdx], r8b
nop
nop
mov rcx, qword [rax + 0x18]
nop
movabs rdx, 0x800000000000
lea rax, [rdx + rcx]
mov rdx, rax
shr rax, 0x2a
cmp rax, 0x40
jae 0x41d9ef
lea rbx, [0x005b3d38]
mov rax, qword [rbx + rax*8]
shr rdx, 0x16
and rdx, 0xfffff
mov rdx, qword [rax + rdx*8]
test byte [rdx], al
test byte [rax], al
mov rax, rcx
shr rcx, 0x10
and rcx, 0x3f
movzx ebx, byte [rdx + rcx + 0x21040]
lea rdx, [rdx + rcx]
lea rdx, [rdx + 0x21040]
shr rax, 0xd
and rax, 7
mov rcx, rax
mov eax, 1
shl eax, cl
test al, bl
jne 0x41d9ca
lock or byte [rdx], al
mov rax, qword [r14 + 0x30]
mov rax, qword [rax + 0xa0]
test byte [rax], al
add qword [rax + 0x16a8], rsi
add qword [rax + 0x16b0], rdi
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov ecx, 0x40
call fcn.0045fce0
lea rax, [0x004d830b]
mov ebx, 0x2c
call fcn.00434000
nop
int3
Function at 0x42ca80
Capabilities:
Hash data using murmur3

Disassembly:
cmp rsp, qword [r14 + 0x18]
jbe 0x42cd26
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
test byte [rax], al
lea rsi, [rax + 0x16d0]
mov rcx, qword [rax + 0x16c0]
sub rcx, rsi
shr rcx, 3
cmp rcx, 0x200
ja 0x42cd1a
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x30], rcx
mov qword [rax + 0x16c0], 0
cmp byte [0x005e18d6], 0
jne 0x42cae2
xor edx, edx
xor ebx, ebx
nop
jmp 0x42cb2b
xor edx, edx
jmp 0x42cb0e
mov qword [rsp + 0x28], rdx
mov rcx, qword [rax + rdx*8 + 0x16d0]
mov rax, rcx
call fcn.0041d120
mov rcx, qword [rsp + 0x28]
lea rdx, [rcx + 1]
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
cmp rdx, rcx
jl 0x42cae6
add rax, 0x16c0
call fcn.0042c940
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
inc rdx
cmp rdx, rcx
jge 0x42ccb2
mov rsi, qword [rax + rdx*8 + 0x16d0]
nop dword [rax]
cmp rsi, 0x1000
jb 0x42cb28
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rbx
mov rax, rsi
xor ebx, ebx
mov rcx, rbx
nop dword [rax + rax]
call fcn.00412080
test rax, rax
jne 0x42cb82
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
nop
jmp 0x42cb28
nop
mov rsi, rcx
shr rcx, 3
and rsi, 7
mov rdx, rcx
mov rcx, rsi
mov r8d, 1
shl r8d, cl
nop
add rdx, qword [rbx + 0x50]
movzx esi, byte [rdx]
test r8b, sil
je 0x42cbc5
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
nop
jmp 0x42cb28
nop
lock or byte [rdx], r8b
nop
nop
mov rcx, qword [rbx + 0x18]
nop
movabs rsi, 0x800000000000
lea r8, [rsi + rcx]
mov r9, r8
shr r8, 0x2a
cmp r8, 0x40
jae 0x42cd0d
lea r10, [0x005b3d38]
mov r8, qword [r10 + r8*8]
shr r9, 0x16
and r9, 0xfffff
mov r9, qword [r8 + r9*8]
test byte [r9], al
test byte [r8], al
mov r8, rcx
shr rcx, 0x10
and rcx, 0x3f
movzx r10d, byte [r9 + rcx + 0x21040]
lea r9, [r9 + rcx]
lea r9, [r9 + 0x21040]
shr r8, 0xd
and r8, 7
mov rcx, r8
mov r8d, 1
shl r8d, cl
test r8b, r10b
jne 0x42cc4c
lock or byte [r9], r8b
movzx r8d, byte [rbx + 0x62]
test r8b, 1
je 0x42cc85
mov r8, qword [rsp + 0x48]
mov r9, qword [r8 + 0x16a8]
add r9, qword [rbx + 0x68]
mov qword [r8 + 0x16a8], r9
mov rax, r8
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
jmp 0x42cb28
mov r8, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
cmp r8, rcx
jae 0x42cd05
mov r9, qword [rsp + 0x48]
mov qword [r9 + r8*8 + 0x16d0], rax
lea rbx, [r8 + 1]
mov rax, r9
mov rdx, qword [rsp + 0x28]
jmp 0x42cb28
cmp rbx, 0x200
ja 0x42ccf7
lea rdx, [rax + 0x16d0]
lea rsi, [rax + 0x1698]
mov rcx, rbx
mov edi, 0x200
mov rbx, rdx
mov rax, rsi
call fcn.004227e0
mov rdx, qword [rsp + 0x48]
lea rax, [rdx + 0x16c0]
call fcn.0042c940
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov rcx, rbx
mov edx, 0x200
nop
call fcn.0045fd40
mov rax, r8
call fcn.0045fcc0
mov rax, r8
mov ecx, 0x40
call fcn.0045fce0
mov edx, 0x200
nop
call fcn.0045fd20
nop
mov qword [rsp + 8], rax
call fcn.00461ce0
mov rax, qword [rsp + 8]
jmp fcn.0042ca80