joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000fb80
Capabilities:
Hash data with crc32
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
push rbx
push rdi
push r12
push r14
sub rsp, 0x58
or ebx, 0xffffffff
xor r12d, r12d
mov r14, r8
mov edi, 0x80000
test rcx, rcx
je 0x14000fdeb
mov qword [rsp + 0x30], r12
lea r8d, [r12 + 1]
xor r9d, r9d
mov edx, 0x80000000
mov dword [rsp + 0x28], pe_nt_image_headers64
mov qword [rsp + 0x40], r15
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r15, rax
cmp rax, 0xffffffffffffffff
je 0x14000fde6
mov rcx, qword [0x14001791c]
xor edx, edx
mov r8d, edi
mov qword [rsp + 0x48], r13
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r13, rax
test rax, rax
je 0x14000fdd8
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x90], rbp
mov qword [rsp + 0x50], rsi
test rax, rax
jle 0x14000fc33
lea r8, [rsp + 0x8c]
xor r9d, r9d
mov edx, eax
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
lea ebp, [r14 + 0x80000]
lea rsi, [0x140015ab0]
add r12d, 0x80000
sub ebp, 0x80000
cmp r14, 0xffffffffffffffff
je 0x14000fc5d
movsxd rax, r12d
cmp rax, r14
cmovg edi, ebp
lea r9, [rsp + 0x80]
mov r8d, edi
mov rdx, r13
mov rcx, r15
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov r10d, dword [rsp + 0x80]
mov r11, r13
mov r9d, r10d
cmp r10d, 8
jb 0x14000fd8b
mov esi, r10d
lea r10, [0x140015ab0]
shr rsi, 3
nop word [rax + rax]
movzx ecx, byte [r11]
mov eax, ebx
shr ebx, 8
xor rcx, rax
add r11, 8
add r9d, 0xfffffff8
movzx eax, cl
movzx ecx, byte [r11 - 7]
mov edx, dword [r10 + rax*4]
xor edx, ebx
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r11 - 6]
mov r8d, dword [r10 + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r11 - 5]
mov edx, dword [r10 + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r11 - 4]
mov r8d, dword [r10 + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r11 - 3]
mov edx, dword [r10 + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r11 - 2]
mov r8d, dword [r10 + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r11 - 1]
mov edx, dword [r10 + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
mov ebx, dword [r10 + rax*4]
xor ebx, edx
dec rsi
jne 0x14000fcb0
mov r10d, dword [rsp + 0x80]
lea rsi, [0x140015ab0]
test r9d, r9d
je 0x14000fdac
movzx ecx, byte [r11]
mov eax, ebx
inc r11
xor rcx, rax
shr eax, 8
movzx edx, cl
mov ebx, dword [rsi + rdx*4]
xor ebx, eax
dec r9d
jne 0x14000fd90
cmp r10d, 0x80000
je 0x14000fc41
mov rcx, qword [0x14001791c]
mov r8, r13
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x90]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r13, qword [rsp + 0x48]
mov r15, qword [rsp + 0x40]
not ebx
movsxd rax, ebx
add rsp, 0x58
pop r14
pop r12
pop rdi
pop rbx
ret
or r8, 0xffffffffffffffff
xor edx, edx
jmp 0x14000fb80
Function at 0x14000fe00
Capabilities:
Encode data using xor
Hash data with crc32
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
push rbx
push rdi
push r12
push r14
sub rsp, 0x58
or ebx, 0xffffffff
xor r12d, r12d
mov r14, r8
mov edi, 0x80000
test rcx, rcx
je 0x14000fdeb
mov qword [rsp + 0x30], r12
lea r8d, [r12 + 1]
xor r9d, r9d
mov edx, 0x80000000
mov dword [rsp + 0x28], pe_nt_image_headers64
mov qword [rsp + 0x40], r15
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r15, rax
cmp rax, 0xffffffffffffffff
je 0x14000fde6
mov rcx, qword [0x14001791c]
xor edx, edx
mov r8d, edi
mov qword [rsp + 0x48], r13
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r13, rax
test rax, rax
je 0x14000fdd8
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x90], rbp
mov qword [rsp + 0x50], rsi
test rax, rax
jle 0x14000fc33
lea r8, [rsp + 0x8c]
xor r9d, r9d
mov edx, eax
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
lea ebp, [r14 + 0x80000]
lea rsi, [0x140015ab0]
add r12d, 0x80000
sub ebp, 0x80000
cmp r14, 0xffffffffffffffff
je 0x14000fc5d
movsxd rax, r12d
cmp rax, r14
cmovg edi, ebp
lea r9, [rsp + 0x80]
mov r8d, edi
mov rdx, r13
mov rcx, r15
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov r10d, dword [rsp + 0x80]
mov r11, r13
mov r9d, r10d
cmp r10d, 8
jb 0x14000fd8b
mov esi, r10d
lea r10, [0x140015ab0]
shr rsi, 3
nop word [rax + rax]
movzx ecx, byte [r11]
mov eax, ebx
shr ebx, 8
xor rcx, rax
add r11, 8
add r9d, 0xfffffff8
movzx eax, cl
movzx ecx, byte [r11 - 7]
mov edx, dword [r10 + rax*4]
xor edx, ebx
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r11 - 6]
mov r8d, dword [r10 + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r11 - 5]
mov edx, dword [r10 + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r11 - 4]
mov r8d, dword [r10 + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r11 - 3]
mov edx, dword [r10 + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r11 - 2]
mov r8d, dword [r10 + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r11 - 1]
mov edx, dword [r10 + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
mov ebx, dword [r10 + rax*4]
xor ebx, edx
dec rsi
jne 0x14000fcb0
mov r10d, dword [rsp + 0x80]
lea rsi, [0x140015ab0]
test r9d, r9d
je 0x14000fdac
movzx ecx, byte [r11]
mov eax, ebx
inc r11
xor rcx, rax
shr eax, 8
movzx edx, cl
mov ebx, dword [rsi + rdx*4]
xor ebx, eax
dec r9d
jne 0x14000fd90
cmp r10d, 0x80000
je 0x14000fc41
mov rcx, qword [0x14001791c]
mov r8, r13
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x90]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r13, qword [rsp + 0x48]
mov r15, qword [rsp + 0x40]
not ebx
movsxd rax, ebx
add rsp, 0x58
pop r14
pop r12
pop rdi
pop rbx
ret
or r8, 0xffffffffffffffff
xor edx, edx
jmp 0x14000fb80
Function at 0x140001240
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
xor ebx, ebx
movzx r10d, r9b
mov rdi, r8
mov esi, ebx
movzx r8d, byte [rdx]
mov eax, ebx
mov rbp, rdx
mov r14, rcx
mov r9d, r8d
xor r9d, eax
cmp r9d, r10d
je 0x140001287
inc eax
cmp eax, 0xff
jb 0x140001271
jmp 0x140001289
mov esi, eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rdi, rdi
je 0x1400012c5
mov rdx, rbx
nop dword [rax + rax]
movzx ecx, sil
xor cl, byte [rdx + rbp]
sub cl, bl
inc ebx
mov byte [rdx + rax], cl
mov edx, ebx
cmp rdx, rdi
jb 0x1400012b0
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov qword [r14], rax
mov eax, 1
add rsp, 0x20
pop r14
ret

Function at 0x140001350
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov ebp, ecx
call fcn.140001fd0
mov rdx, qword [rax + 0x18]
mov rdi, qword [rdx + 0x20]
test rdi, rdi
je 0x1400013d7
cmp word [rdi + 0x48], 0
je 0x1400013d7
mov rsi, qword [rdi + 0x50]
xor ebx, ebx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
xor ecx, ecx
movsxd rdx, eax
test eax, eax
je 0x1400013bb
nop word [rax + rax]
movzx eax, word [rsi + rcx*2]
inc rcx
add eax, ebx
imul ebx, eax, 0x81
mov eax, ebx
shr eax, 6
xor ebx, eax
cmp rcx, rdx
jne 0x1400013a0
lea eax, [rbx + rbx*8]
mov ecx, eax
shr ecx, 0xb
xor ecx, eax
imul eax, ecx, 0x8001
cmp eax, ebp
je 0x1400013ee
mov rdi, qword [rdi]
test rdi, rdi
jne 0x140001378
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rax, qword [rdi + 0x20]
jmp 0x1400013d9
Function at 0x140001400
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x130
mov eax, 0x5a4d
mov esi, edx
mov r11, rcx
cmp word [rcx], ax
jne 0x140001557
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
cmp dword [rax], 0x4550
jne 0x140001557
movups xmm0, xmmword [rax + 0x18]
lea r8, [rsp + 0x20]
xor ebx, ebx
movups xmm1, xmmword [rax + 0x28]
movups xmmword [r8], xmm0
movups xmm0, xmmword [rax + 0x38]
movups xmmword [r8 + 0x10], xmm1
movups xmm1, xmmword [rax + 0x48]
movups xmmword [r8 + 0x20], xmm0
movups xmm0, xmmword [rax + 0x58]
movups xmmword [r8 + 0x30], xmm1
movups xmm1, xmmword [rax + 0x68]
movups xmmword [r8 + 0x40], xmm0
movups xmm0, xmmword [rax + 0x78]
movups xmmword [r8 + 0x50], xmm1
movups xmmword [r8 + 0x60], xmm0
lea r8, [r8 + 0x80]
movups xmm0, xmmword [rax + 0x88]
sub rax, 0xffffffffffffff68
movups xmmword [r8 - 0x10], xmm0
movups xmm1, xmmword [rax]
movups xmm0, xmmword [rax + 0x10]
movups xmmword [r8], xmm1
movups xmm1, xmmword [rax + 0x20]
movups xmmword [r8 + 0x10], xmm0
movups xmm0, xmmword [rax + 0x30]
movups xmmword [r8 + 0x20], xmm1
movups xmm1, xmmword [rax + 0x40]
movups xmmword [r8 + 0x30], xmm0
movups xmm0, xmmword [rax + 0x50]
movups xmmword [r8 + 0x40], xmm1
movups xmm1, xmmword [rax + 0x60]
movups xmmword [r8 + 0x50], xmm0
movups xmmword [r8 + 0x60], xmm1
mov r15d, dword [rsp + 0x90]
mov r8d, ebx
add r15, rcx
mov r14d, dword [r15 + 0x1c]
mov r9d, dword [r15 + 0x20]
add r14, rcx
mov r10d, dword [r15 + 0x24]
add r9, rcx
mov ebp, dword [r15 + 0x14]
add r10, rcx
test ebp, ebp
je 0x140001557
nop word [rax + rax]
movzx eax, word [r10]
mov ecx, dword [r9]
add rcx, r11
mov edi, dword [r14 + rax*4]
mov eax, 0x8c375
add rdi, r11
movsx edx, byte [rcx]
test edx, edx
je 0x140001543
nop dword [rax]
imul eax, eax, 0x81
lea rcx, [rcx + 1]
add eax, edx
movsx edx, byte [rcx]
test edx, edx
jne 0x140001530
cmp esi, eax
je 0x140001576
inc r8d
add r10, 2
add r9, 4
cmp r8d, ebp
jb 0x140001510
xor eax, eax
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
cmp rdi, r15
jb 0x14000160c
mov eax, dword [rsp + 0x94]
add rax, r15
cmp rdi, rax
jae 0x14000160c
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x104
call fcn.140001fa0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenA]
movsxd r8, eax
mov rdx, rdi
lea rcx, [rsp + 0x20]
call fcn.140001f50
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x1400015f2
nop dword [rax + rax]
lea rcx, [rsp + 0x20]
cmp byte [rcx + rbx], 0x2e
je 0x1400015ee
lea rcx, [rsp + 0x20]
inc ebx
call qword [sym.imp.KERNEL32.dll_lstrlenA]
cmp ebx, eax
jb 0x1400015d0
jmp 0x1400015f2
mov byte [rcx + rbx], 0
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
mov edx, esi
call fcn.140001400
jmp 0x140001559
mov rax, rdi
jmp 0x140001559
Function at 0x140001680
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
mov qword [rsp + 0x10], rdx
push rsi
push rdi
push r12
push r13
push r15
sub rsp, 0x110
xor ebx, ebx
mov eax, 0x5a4d
mov rsi, rcx
mov ebp, ebx
cmp word [rcx], ax
jne 0x14000175a
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
cmp dword [rax], 0x4550
jne 0x14000175a
movups xmm0, xmmword [rax + 0x18]
lea rcx, [rsp + 0x20]
movups xmm1, xmmword [rax + 0x28]
movups xmmword [rcx], xmm0
movups xmm0, xmmword [rax + 0x38]
movups xmmword [rcx + 0x10], xmm1
movups xmm1, xmmword [rax + 0x48]
movups xmmword [rcx + 0x20], xmm0
movups xmm0, xmmword [rax + 0x58]
movups xmmword [rcx + 0x30], xmm1
movups xmm1, xmmword [rax + 0x68]
movups xmmword [rcx + 0x40], xmm0
movups xmm0, xmmword [rax + 0x78]
movups xmmword [rcx + 0x50], xmm1
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rax + 0x88]
sub rax, 0xffffffffffffff68
movups xmmword [rcx - 0x10], xmm0
movups xmm1, xmmword [rax]
movups xmm0, xmmword [rax + 0x10]
movups xmmword [rcx], xmm1
movups xmm1, xmmword [rax + 0x20]
movups xmmword [rcx + 0x10], xmm0
movups xmm0, xmmword [rax + 0x30]
movups xmmword [rcx + 0x20], xmm1
movups xmm1, xmmword [rax + 0x40]
movups xmmword [rcx + 0x30], xmm0
movups xmm0, xmmword [rax + 0x50]
movups xmmword [rcx + 0x40], xmm1
movups xmm1, xmmword [rax + 0x60]
movups xmmword [rcx + 0x50], xmm0
movups xmmword [rcx + 0x60], xmm1
mov ebp, dword [rsp + 0x90]
add rbp, rsi
mov r15d, dword [rbp + 0x1c]
mov edi, ebx
mov r12d, dword [rbp + 0x20]
add r15, rsi
mov r13d, dword [rbp + 0x24]
add r12, rsi
add r13, rsi
mov qword [rsp + 0x140], r14
cmp dword [rbp + 0x14], ebx
jbe 0x1400017af
nop
mov ecx, edi
movzx eax, word [r13 + rcx*2]
mov ecx, dword [r12 + rcx*4]
add rcx, rsi
mov r14d, dword [r15 + rax*4]
add r14, rsi
call fcn.140001620
mov r8, qword [rsp + 0x148]
cmp dword [r8], eax
je 0x1400017d5
inc edi
cmp edi, dword [rbp + 0x14]
jb 0x140001780
xor eax, eax
mov r14, qword [rsp + 0x140]
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r13
pop r12
pop rdi
pop rsi
ret
mov qword [r8 + 8], r14
mov edx, dword [rbp + 0x14]
test edx, edx
je 0x1400017af
lea rax, [r14 + 1]
movzx ecx, byte [rax - 1]
cmp cl, 0xf
jne 0x1400017f4
cmp byte [rax], 5
je 0x1400017af
jmp 0x14000181b
cmp cl, 0xc3
je 0x1400017af
cmp cl, 0x4c
jne 0x14000181b
cmp byte [rax], 0x8b
jne 0x14000181b
cmp byte [rax + 1], 0xd1
jne 0x14000181b
cmp byte [rax + 2], 0xb8
jne 0x14000181b
cmp byte [rax + 5], 0
jne 0x14000181b
cmp byte [rax + 6], 0
je 0x140001826
inc ebx
inc rax
cmp ebx, edx
jb 0x1400017e4
jmp 0x1400017af
mov eax, ebx
movzx ecx, byte [rax + r14 + 5]
movzx eax, byte [rax + r14 + 4]
shl cx, 8
or cx, ax
mov eax, 1
mov word [r8 + 0x10], cx
jmp 0x1400017b1
Function at 0x140001850
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0xf8
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140001927
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
cmp dword [rax], 0x4550
jne 0x140001927
movups xmm0, xmmword [rax + 0x18]
lea r8, [rsp]
movups xmm1, xmmword [rax + 0x28]
movups xmmword [r8], xmm0
movups xmm0, xmmword [rax + 0x38]
movups xmmword [r8 + 0x10], xmm1
movups xmm1, xmmword [rax + 0x48]
movups xmmword [r8 + 0x20], xmm0
movups xmm0, xmmword [rax + 0x58]
movups xmmword [r8 + 0x30], xmm1
movups xmm1, xmmword [rax + 0x68]
movups xmmword [r8 + 0x40], xmm0
movups xmm0, xmmword [rax + 0x78]
movups xmmword [r8 + 0x50], xmm1
movups xmmword [r8 + 0x60], xmm0
lea r8, [r8 + 0x80]
movups xmm0, xmmword [rax + 0x88]
sub rax, 0xffffffffffffff68
movups xmmword [r8 - 0x10], xmm0
movups xmm1, xmmword [rax]
movups xmm0, xmmword [rax + 0x10]
movups xmmword [r8], xmm1
movups xmm1, xmmword [rax + 0x20]
movups xmmword [r8 + 0x10], xmm0
movups xmm0, xmmword [rax + 0x30]
movups xmmword [r8 + 0x20], xmm1
movups xmm1, xmmword [rax + 0x40]
movups xmmword [r8 + 0x30], xmm0
movups xmm0, xmmword [rax + 0x50]
movups xmmword [r8 + 0x40], xmm1
movups xmm1, xmmword [rax + 0x60]
movups xmmword [r8 + 0x50], xmm0
movups xmmword [r8 + 0x60], xmm1
mov eax, dword [rsp + 0x70]
add rax, rcx
mov qword [rdx], rax
mov eax, 1
add rsp, 0xf8
ret
xor eax, eax
add rsp, 0xf8
ret

Function at 0x140001feb
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, dword [0x1400031d0]
syscall
ret
Function at 0x416c20
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x416dab
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [0x008f34b8]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00434820
xorps xmm15, xmm15
mov r14, qword [0x0098f398]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x416c85
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x416c94
add rsp, 0x48
pop rbp
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x416cb3
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x416cc3
cmp rbx, 0x1000
jae 0x416c8b
jmp 0x416d2d
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x416cd5
xor edx, edx
jmp 0x416d24
mov rcx, qword [0x008f34b8]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00434820
xorps xmm15, xmm15
mov r14, qword [0x0098f398]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x416cb9
jmp 0x416ca8
call fcn.00468aa0
xorps xmm15, xmm15
mov r14, qword [0x0098f398]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.00438ee0
lea rax, [0x006e80a3]
mov ebx, 0x18
nop dword [rax]
call fcn.00439760
mov rax, qword [rsp + 0x38]
call fcn.004394a0
lea rax, [0x006e89f3]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.00439760
mov rax, qword [rsp + 0x30]
call fcn.004394a0
call fcn.00439120
call fcn.00438f40
lea rax, [0x006ed2b0]
mov ebx, 0x21
call fcn.00437540
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00465360
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00416c20
Function at 0x416de0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x417006
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [0x008f34c0]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.004348a0
xorps xmm15, xmm15
mov r14, qword [0x0098f398]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x416e53
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x416e62
add rsp, 0x50
pop rbp
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x416e85
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x416e95
cmp rbx, 0x1000
jae 0x416e59
nop
jmp 0x416f18
add rsp, 0x50
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop word [rax + rax]
cmp rbx, 0x1000
jae 0x416ead
xor esi, esi
jmp 0x416f0a
mov rax, qword [0x008f34c0]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.004348a0
xorps xmm15, xmm15
mov r14, qword [0x0098f398]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x416e8b
jmp 0x416e76
call fcn.00468aa0
xorps xmm15, xmm15
mov r14, qword [0x0098f398]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x416fa0
nop dword [rax + rax]
call fcn.00438ee0
lea rax, [0x006e8a0c]
mov ebx, 0x19
call fcn.00439760
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
call fcn.004394a0
lea rax, [0x006e89f3]
mov ebx, 0x19
call fcn.00439760
mov eax, dword [rsp + 0x34]
call fcn.004394a0
nop
call fcn.00439120
call fcn.00438f40
lea rax, [0x006e244c]
mov ebx, 0xd
call fcn.00437540
nop dword [rax + rax]
cmp eax, 0x5af
je 0x416f40
call fcn.00438ee0
lea rax, [0x006e8a0c]
mov ebx, 0x19
call fcn.00439760
mov rax, qword [rsp + 0x38]
call fcn.004394a0
lea rax, [0x006e89f3]
mov ebx, 0x19
call fcn.00439760
mov eax, dword [rsp + 0x34]
nop dword [rax]
call fcn.004394a0
call fcn.00439120
call fcn.00438f40
lea rax, [0x006ec36e]
mov ebx, 0x1f
nop dword [rax + rax]
call fcn.00437540
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00465360
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.00416de0
Function at 0x420480
Capabilities:
Hash data using murmur3

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
cmp byte [0x0098f0f6], 0
jne 0x420567
sub rbx, qword [rax + 0x18]
mov rdx, qword [rax + 0x50]
test byte [rdx], al
mov esi, dword [rax + 0x64]
imul rbx, rsi
mov rsi, rbx
shr rbx, 0x20
shr rsi, 0x23
and ebx, 7
mov rdi, rcx
mov rcx, rbx
mov r8d, 1
shl r8d, cl
add rdx, rsi
nop
nop
nop
nop
lock or byte [rdx], r8b
mov rcx, qword [rax + 0x18]
movabs rdx, 0x800000000000
lea rax, [rdx + rcx]
mov rdx, rax
shr rdx, 0x2a
nop
nop
nop
cmp rdx, 0x40
jae 0x42055a
lea rbx, [0x009614d8]
mov rdx, qword [rbx + rdx*8]
test byte [rdx], al
mov rbx, rcx
shr rbx, 0x10
and ebx, 0x3f
shr rcx, 0xd
and ecx, 7
mov esi, 1
shl esi, cl
shr rax, 0x16
and eax, 0xfffff
mov rax, qword [rdx + rax*8]
test byte [rax], al
movzx edx, byte [rax + rbx + 0x11440]
lea rax, [rax + rbx]
lea rax, [rax + 0x11440]
test sil, dl
jne 0x420540
lock or byte [rax], sil
mov rax, qword [r14 + 0x30]
mov rax, qword [rax + 0xa0]
test byte [rax], al
add qword [rax + 0x1250], rdi
add rsp, 0x10
pop rbp
ret
mov rax, rdx
mov ecx, 0x40
call fcn.00467640
lea rax, [0x006f1e7b]
mov ebx, 0x2c
call fcn.00437540
nop
int3

Function at 0x422840
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x422946
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x70], rcx
mov byte [rsp + 0x17], dil
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x18], 0
jmp 0x422883
mov rax, qword [rsp + 0x60]
mov rcx, rdx
mov rbx, qword [rsp + 0x68]
movzx edi, byte [rsp + 0x17]
cmp qword [rsp + 0x18], rbx
jae 0x42293b
test byte [rax], al
lea rcx, [rax + 0x100b8]
mov ebx, edi
mov rax, rcx
nop dword [rax]
call fcn.00423620
test rax, rax
je 0x42293b
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x30], xmm15
movups xmmword [rsp + 0x40], xmm15
lea rcx, [0x00422980]
mov qword [rsp + 0x20], rcx
lea rdx, [rsp + 0x18]
mov qword [rsp + 0x28], rdx
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x48], rax
lea rbx, [rsp + 0x20]
mov qword [rsp], rbx
nop dword [rax]
call fcn.00465220
xorps xmm15, xmm15
mov r14, qword [0x0098f398]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x70]
nop dword [rax]
test rdx, rdx
jne 0x422929
xor eax, eax
jmp 0x422933
mov rax, qword [rdx]
call rax
mov rdx, qword [rsp + 0x70]
test al, al
je 0x422871
mov rax, qword [rsp + 0x18]
add rsp, 0x50
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov byte [rsp + 0x20], dil
call fcn.00465360
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movzx edi, byte [rsp + 0x20]
jmp fcn.00422840