joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14004527c
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov qword [rsp + 0x28], 0x26f
mov qword [rsp + 0x30], 0xe3
mov qword [rsp], 0
jmp 0x1400452ac
mov rax, qword [rsp]
inc rax
mov qword [rsp], rax
cmp qword [rsp], 0xe3
jae 0x14004532e
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp]
mov eax, dword [rax + rcx*4 + 0x9c4]
and eax, 0x80000000
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp]
mov ecx, dword [rcx + rdx*4 + 0x9c8]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp + 0x10], eax
mov eax, dword [rsp + 0x10]
and eax, 1
test eax, eax
je 0x1400452fa
mov dword [rsp + 0x14], 0x9908b0df
jmp 0x140045302
mov dword [rsp + 0x14], 0
mov eax, dword [rsp + 0x10]
shr eax, 1
xor eax, dword [rsp + 0x14]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp]
xor eax, dword [rcx + rdx*4 + 0xff8]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp]
mov dword [rcx + rdx*4 + 4], eax
jmp 0x1400452a1
mov qword [rsp + 8], 0xe3
jmp 0x140045346
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
cmp qword [rsp + 8], 0x26f
jae 0x1400453cd
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 8]
mov eax, dword [rax + rcx*4 + 0x9c4]
and eax, 0x80000000
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 8]
mov ecx, dword [rcx + rdx*4 + 0x9c8]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp + 0x18], eax
mov eax, dword [rsp + 0x18]
and eax, 1
test eax, eax
je 0x140045397
mov dword [rsp + 0x1c], 0x9908b0df
jmp 0x14004539f
mov dword [rsp + 0x1c], 0
mov eax, dword [rsp + 0x18]
shr eax, 1
xor eax, dword [rsp + 0x1c]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 8]
xor eax, dword [rcx + rdx*4 - 0x388]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 8]
mov dword [rcx + rdx*4 + 4], eax
jmp 0x140045339
mov qword [rsp + 0x38], 0x26f
mov eax, 4
imul rax, rax, 0x4df
mov rcx, qword [rsp + 0x50]
mov eax, dword [rcx + rax + 4]
and eax, 0x80000000
mov ecx, 4
imul rcx, rcx, 0
mov rdx, qword [rsp + 0x50]
mov ecx, dword [rdx + rcx + 4]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
and eax, 1
test eax, eax
je 0x140045421
mov dword [rsp + 0x24], 0x9908b0df
jmp 0x140045429
mov dword [rsp + 0x24], 0
mov eax, dword [rsp + 0x20]
shr eax, 1
xor eax, dword [rsp + 0x24]
mov ecx, 4
imul rcx, rcx, 0x18c
mov rdx, qword [rsp + 0x50]
xor eax, dword [rdx + rcx + 4]
mov ecx, 4
imul rcx, rcx, 0x26f
mov rdx, qword [rsp + 0x50]
mov dword [rdx + rcx + 4], eax
mov rax, qword [rsp + 0x50]
mov dword [rax], 0
add rsp, 0x48
ret
Function at 0x140045470
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x18
mov qword [rsp + 8], 0x270
jmp 0x140045491
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
cmp qword [rsp + 8], 0x4e0
jae 0x140045515
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 8]
mov eax, dword [rax + rcx*4 - 0x9bc]
and eax, 0x80000000
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 8]
mov ecx, dword [rcx + rdx*4 - 0x9b8]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp], eax
mov eax, dword [rsp]
and eax, 1
test eax, eax
je 0x1400454e0
mov dword [rsp + 4], 0x9908b0df
jmp 0x1400454e8
mov dword [rsp + 4], 0
mov eax, dword [rsp]
shr eax, 1
xor eax, dword [rsp + 4]
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 8]
xor eax, dword [rcx + rdx*4 - 0x388]
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 8]
mov dword [rcx + rdx*4 + 4], eax
jmp 0x140045484
add rsp, 0x18
ret
Function at 0x14004cb6c
Capabilities:
Hash data using fnv

Disassembly:
mov byte [rsp + 0x10], dl
mov dword [rsp + 8], ecx
movsx eax, byte [rsp + 0x10]
mov ecx, dword [rsp + 8]
xor ecx, eax
mov eax, ecx
mov eax, eax
imul rax, rax, 0x1000193
ret

Function at 0x14004ce00
Capabilities:
Create thread
Hide graphical window

Disassembly:
push rdi
sub rsp, 0xc0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x1400443b0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rax, [rsp + 0x70]
mov rdi, rax
xor eax, eax
mov ecx, 0x48
rep stosb byte [rdi], al
xor ecx, ecx
call qword [sym.imp.GDI32.dll_GetStockObject]
mov qword [rsp + 0xa0], rax
mov edx, 0x7f00
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorA]
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x88], 0
lea rax, [0x140044868]
mov qword [rsp + 0x78], rax
lea rax, [0x140055fc8]
mov qword [rsp + 0xb0], rax
mov dword [rsp + 0x70], 3
lea rcx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_RegisterClassA]
movzx eax, ax
test eax, eax
jne 0x14004ceb8
lea rdx, str._n_n_Bluestacks
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140032f5c
mov ecx, 1
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [rsp + 0x60], eax
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [rsp + 0x64], eax
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x64]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0x80000000
xor r8d, r8d
lea rdx, str.Bluestacks_5
xor ecx, ecx
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov qword [0x140123eb8], rax
mov edx, 5
mov rcx, qword [0x140123eb8]
call qword [sym.imp.USER32.dll_ShowWindow]
lea rdx, [0x140055fb8]
mov rcx, qword [0x140123eb8]
call qword [sym.imp.dwmapi.dll_DwmExtendFrameIntoClientArea]
mov r8d, 0x800a0
mov edx, 0xffffffec
mov rcx, qword [0x140123eb8]
call qword [sym.imp.USER32.dll_SetWindowLongA]
mov rcx, qword [0x140123eb8]
call qword [sym.imp.USER32.dll_UpdateWindow]
add rsp, 0xc0
pop rdi
ret
Function at 0x14075e1c0
Capabilities:
Terminate process

Disassembly:
clc
iretd
jp 0x1406f14ae
enter 0xffffffffffffce20, 0x4f
mov eax, 0x320b1dce
dec esi
ja 0x1406f142a
enter 0x43b1, 0xffffffffffffff8e
invalid
invalid
cld
pop r11
jmp 0x14075e1cd
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14075e1dd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x14075e1c5
lea eax, [rcx + 1]
jmp 0x14075e1eb
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x14075e1fe
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x14075e1e4
sub eax, 3
jb 0x14075e21e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x14075e26d
sar eax, 1
movsxd rbp, eax
jb 0x14075e254
jmp 0x14075e22c
add ebx, ebx
jne 0x14075e22a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x14075e254
inc ecx
add ebx, ebx
jne 0x14075e23a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x14075e254
call r11
adc ecx, ecx
add ebx, ebx
jne 0x14075e24d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x14075e23c
add ecx, 2
jmp 0x14075e259
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.14075e182
jmp 0x14075e1cd
pop rsi
pop rdi
pop rax
mov dword [rdi], eax
sub rsp, 0x28
lea rdi, [rsi + 0x75b000]
mov eax, dword [rdi]
or eax, eax
je 0x14075e2d9
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x75e1e4]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x14075e27d
jns 0x14075e2b2
movzx rdx, word [rdi]
add rdi, 2
jmp 0x14075e2bc
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x14075e2d3
mov qword [rbx], rax
add rbx, 8
jmp 0x14075e29d
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x14075e31d
cmp al, 0xef
ja 0x14075e305
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x14075e2e5
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0x14075e2f4
mov eax, dword [rdi]
add rdi, 4
jmp 0x14075e2f4
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x247]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x14075e371
sub rsp, 0xffffffffffffff80
jmp 0x1406f1480
Function at 0x140011177
Capabilities:
Get file size

Disassembly:
jmp 0x140011ba0
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x108
lea rbp, [rsp + 0x40]
lea rcx, reloc.WS2_32.dll_accept
call fcn.140011438
mov rax, qword [rbp + 0xe0]
add rax, 0xc
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rcx, qword [rbp + 0xe0]
mov qword [rcx + 4], rax
mov rax, qword [rbp + 0xe0]
cmp qword [rax + 4], 0xffffffffffffffff
jne 0x140011c49
mov rax, qword [rbp + 0xe0]
add rax, 0x11e
lea rdx, str.404_File_can_not_found
mov rcx, rax
call fcn.140011163
mov rax, qword [rbp + 0xe0]
mov dword [rax + 0x11a], 0
mov eax, 1
jmp 0x140011c87
mov rax, qword [rbp + 0xe0]
add rax, 0x11e
lea rdx, str.200_OK
mov rcx, rax
call fcn.140011163
xor edx, edx
mov rax, qword [rbp + 0xe0]
mov rcx, qword [rax + 4]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov rcx, qword [rbp + 0xe0]
mov dword [rcx + 0x11a], eax
xor eax, eax
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret

Function at 0x14001127b
Capabilities:
Terminate process

Disassembly:
jmp 0x140014690
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x140011311
Capabilities:
Parse pe header

Disassembly:
jmp 0x1400159d0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1400159f0
xor al, al
jmp 0x140015a71
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140015a03
xor al, al
jmp 0x140015a71
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140015a2d
xor al, al
jmp 0x140015a71
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140015a41
xor al, al
jmp 0x140015a71
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140015a53
xor al, al
jmp 0x140015a71
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140015a6f
xor al, al
jmp 0x140015a71
mov al, 1
add rsp, 0x38
ret
Function at 0x140011451
Capabilities:
Read and send data from client to server
Read file on windows
Send data
Send data on socket

Disassembly:
jmp 0x1400121b0
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xf78
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x2b2
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0xf98]
mov rax, qword [0x140020608]
xor rax, rbp
mov qword [rbp + 0xf38], rax
lea rcx, reloc.WS2_32.dll_accept
call fcn.140011438
mov rcx, qword [rbp + 0xf60]
call fcn.140011177
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
je 0x140012218
jmp 0x14001232b
lea rax, [rbp + 0x30]
mov rdi, rax
xor eax, eax
mov ecx, 0x800
rep stosb byte [rdi], al
mov dword [rbp + 0x844], 0
mov dword [rbp + 0x864], 0
lea rax, [rbp + 0x890]
mov rdi, rax
xor eax, eax
mov ecx, 0x200
rep stosb byte [rdi], al
mov dword [rbp + 0xaa4], 1
xor eax, eax
cmp eax, 1
je 0x14001230b
mov qword [rsp + 0x20], 0
lea r9, [rbp + 0x844]
mov r8d, 0x800
lea rdx, [rbp + 0x30]
mov rax, qword [rbp + 0xf60]
mov rcx, qword [rax + 4]
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [rbp + 0x864], eax
cmp dword [rbp + 0x864], 0
jne 0x1400122e0
lea r8, str.500_Internal_Server_Error
lea rdx, [0x14001d010]
lea rcx, [rbp + 0x890]
call fcn.1400113f7
lea rcx, [rbp + 0x890]
call fcn.1400111d6
xor r9d, r9d
mov r8d, eax
lea rdx, [rbp + 0x890]
mov rcx, qword [rbp + 0xf68]
call qword [sym.imp.WS2_32.dll_send]
jmp 0x14001230b
cmp dword [rbp + 0x844], 0
jne 0x1400122eb
jmp 0x14001230b
xor r9d, r9d
mov r8d, dword [rbp + 0x844]
lea rdx, [rbp + 0x30]
mov rcx, qword [rbp + 0xf68]
call qword [sym.imp.WS2_32.dll_send]
jmp 0x140012259
mov rax, qword [rbp + 0xf60]
mov rcx, qword [rax + 4]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rbp + 0xf60]
mov qword [rax + 4], 0xffffffffffffffff
lea rcx, [rbp - 0x30]
lea rdx, reloc.WS2_32.dll_closesocket
call fcn.1400113b6
mov rcx, qword [rbp + 0xf38]
xor rcx, rbp
call fcn.14001122b
lea rsp, [rbp + 0xf48]
pop rdi
pop rbp
ret
Function at 0x413da0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x413f19
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.0042dee0
xorps xmm15, xmm15
mov r14, qword [0x005abe58]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x413e10
mov rbx, qword [rsp + 0x60]
jmp 0x413e20
add rsp, 0x48
pop rbp
ret
sub rax, rbx
add rcx, rbx
mov rbx, rax
nop
test rbx, rbx
jbe 0x413e45
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rcx
mov rax, rbx
jmp 0x413e55
cmp rbx, 0x1000
jae 0x413e16
nop dword [rax]
jmp 0x413ec9
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
cmp rbx, 0x1000
jae 0x413e62
xor edx, edx
jmp 0x413ec0
mov qword [rsp + 0x30], rbx
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.0042dee0
xorps xmm15, xmm15
mov r14, qword [0x005abe58]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
mov edx, eax
mov rax, qword [rsp + 0x38]
nop
test dl, dl
jne 0x413e4b
jmp 0x413e34
call fcn.00456ee0
xorps xmm15, xmm15
mov r14, qword [0x005abe58]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
cmp eax, 8
jne 0x413f00
lea rax, [0x004bdb56]
mov ebx, 0xd
call fcn.004304e0
nop dword [rax]
cmp eax, 0x5af
je 0x413ee8
lea rax, [0x004c1f2a]
mov ebx, 0x1f
call fcn.004304e0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00453820
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00413da0
Function at 0x41bf40
Capabilities:
Hash data using murmur3

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41c15a
push rbp
mov rbp, rsp
sub rsp, 0x30
test rax, 7
jne 0x41c148
mov qword [rsp + 0x40], rax
mov rdx, qword [rdi + 0x50]
test byte [rdx], al
mov r9, r8
shr r9, 3
mov r10, r8
and r10d, 7
nop
mov r11, rcx
mov rcx, r10
mov r12d, 1
shl r12d, cl
lea r10, [rdx + r9]
cmp byte [0x005abc52], 0
jne 0x41c081
cmp dword [0x005ac190], 0
nop
jle 0x41bfc9
cmp qword [rdi + 0xa0], r8
ja 0x41bfc9
mov r8, qword [rdi + 0x48]
test byte [r8], al
movzx r8d, byte [r9 + r8]
nop
nop dword [rax + rax]
test r12b, r8b
je 0x41c0f8
movzx edx, byte [r9 + rdx]
test r12b, dl
jne 0x41c07b
nop
lock or byte [r10], r12b
mov rcx, qword [rdi + 0x18]
movabs rdx, 0x800000000000
add rdx, rcx
mov r8, rdx
shr rdx, 0x2a
nop
nop
nop
nop word [rax + rax]
cmp rdx, 0x40
jae 0x41c0eb
lea r9, [0x0057e038]
mov rdx, qword [r9 + rdx*8]
test byte [rdx], al
mov r9, rcx
shr r9, 0x10
and r9d, 0x3f
shr rcx, 0xd
and ecx, 7
mov r10d, 1
shl r10d, cl
shr r8, 0x16
and r8d, 0xfffff
mov rdx, qword [rdx + r8*8]
test byte [rdx], al
movzx r8d, byte [rdx + r9 + 0x11440]
lea rdx, [rdx + r9]
lea rdx, [rdx + 0x11440]
test r10b, r8b
jne 0x41c060
lock or byte [rdx], r10b
movzx edx, byte [rdi + 0x6a]
test dl, 1
je 0x41c0a2
mov rax, qword [rsi + 0x10]
add rax, qword [rdi + 0x70]
mov qword [rsi + 0x10], rax
add rsp, 0x30
pop rbp
ret
add rsp, 0x30
pop rbp
ret
mov qword [rsp + 0x60], rsi
mov rcx, r11
mov rdi, r10
mov esi, r12d
call fcn.004139c0
test al, al
jne 0x41c0d8
mov rax, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x60]
prefetcht0 byte [rax]
mov rdx, qword [rsi]
test rdx, rdx
je 0x41c0c7
mov rdi, qword [rdx + 0x10]
cmp rdi, 0xfd
je 0x41c0c7
jae 0x41c0de
mov qword [rdx + rdi*8 + 0x18], rax
inc qword [rdx + 0x10]
jmp 0x41c0d2
mov rbx, rax
mov rax, rsi
call fcn.00421520
add rsp, 0x30
pop rbp
ret
add rsp, 0x30
pop rbp
ret
mov rax, rdi
mov ecx, 0xfd
call fcn.00455aa0
mov rax, rdx
mov ecx, 0x40
call fcn.00455ac0
lea rax, [0x004bcf01]
mov rcx, rbx
mov rdi, r11
mov ebx, 4
call fcn.0041c1c0
lea rax, [0x004bce6a]
mov ebx, 3
mov rcx, qword [rsp + 0x40]
mov rdi, 0xffffffffffffffff
call fcn.0041c1c0
mov rdx, qword [r14 + 0x30]
mov byte [rdx + 0xf9], 2
lea rax, [0x004bedad]
mov ebx, 0x13
call fcn.004304e0
lea rax, [0x004c2b17]
mov ebx, 0x23
call fcn.004304e0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
call fcn.00453820
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
nop dword [rax + rax]
jmp fcn.0041bf40
Function at 0x41c2c0
Capabilities:
Hash data using murmur3

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
cmp byte [0x005abc52], 0
jne 0x41c3a7
sub rbx, qword [rax + 0x18]
mov rdx, qword [rax + 0x50]
test byte [rdx], al
mov esi, dword [rax + 0x64]
imul rbx, rsi
mov rsi, rbx
shr rbx, 0x20
shr rsi, 0x23
and ebx, 7
mov rdi, rcx
mov rcx, rbx
mov r8d, 1
shl r8d, cl
add rdx, rsi
nop
nop
nop
nop
lock or byte [rdx], r8b
mov rcx, qword [rax + 0x18]
movabs rdx, 0x800000000000
lea rax, [rdx + rcx]
mov rdx, rax
shr rdx, 0x2a
nop
nop
nop
cmp rdx, 0x40
jae 0x41c39a
lea rbx, [0x0057e038]
mov rdx, qword [rbx + rdx*8]
test byte [rdx], al
mov rbx, rcx
shr rbx, 0x10
and ebx, 0x3f
shr rcx, 0xd
and ecx, 7
mov esi, 1
shl esi, cl
shr rax, 0x16
and eax, 0xfffff
mov rax, qword [rdx + rax*8]
test byte [rax], al
movzx edx, byte [rax + rbx + 0x11440]
lea rax, [rax + rbx]
lea rax, [rax + 0x11440]
test sil, dl
jne 0x41c380
lock or byte [rax], sil
mov rax, qword [r14 + 0x30]
mov rax, qword [rax + 0xa0]
test byte [rax], al
add qword [rax + 0x1250], rdi
add rsp, 0x10
pop rbp
ret
mov rax, rdx
mov ecx, 0x40
call fcn.00455ac0
lea rax, [0x004c409a]
mov ebx, 0x2c
call fcn.004304e0
nop
int3

Function at 0x41e180
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41e286
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x70], rcx
mov byte [rsp + 0x17], dil
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x18], 0
jmp 0x41e1c3
mov rax, qword [rsp + 0x60]
mov rcx, rdx
mov rbx, qword [rsp + 0x68]
movzx edi, byte [rsp + 0x17]
cmp qword [rsp + 0x18], rbx
jae 0x41e27b
test byte [rax], al
lea rcx, [rax + 0x100b8]
mov ebx, edi
mov rax, rcx
nop dword [rax]
call fcn.0041ed40
test rax, rax
je 0x41e27b
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x30], xmm15
movups xmmword [rsp + 0x40], xmm15
lea rcx, [0x0041e2c0]
mov qword [rsp + 0x20], rcx
lea rdx, [rsp + 0x18]
mov qword [rsp + 0x28], rdx
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x48], rax
lea rbx, [rsp + 0x20]
mov qword [rsp], rbx
nop dword [rax]
call fcn.004536e0
xorps xmm15, xmm15
mov r14, qword [0x005abe58]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x70]
nop dword [rax]
test rdx, rdx
jne 0x41e269
xor eax, eax
jmp 0x41e273
mov rax, qword [rdx]
call rax
mov rdx, qword [rsp + 0x70]
test al, al
je 0x41e1b1
mov rax, qword [rsp + 0x18]
add rsp, 0x50
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov byte [rsp + 0x20], dil
call fcn.00453820
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movzx edi, byte [rsp + 0x20]
jmp fcn.0041e180
Function at 0x42a860
Capabilities:
Hash data using murmur3

Disassembly:
cmp rsp, qword [r14 + 0x18]
jbe 0x42aae6
push rbp
mov rbp, rsp
sub rsp, 0x38
test byte [rax], al
mov rcx, qword [rax + 0x1268]
lea rsi, [rax + 0x1278]
sub rcx, rsi
shr rcx, 3
cmp rcx, 0x200
ja 0x42aada
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x30], rcx
mov qword [rax + 0x1268], 0
cmp byte [0x005abc52], 0
jne 0x42a8ba
xor edx, edx
xor ebx, ebx
jmp 0x42a900
xor edx, edx
jmp 0x42a8e5
mov qword [rsp + 0x28], rdx
mov rcx, qword [rax + rdx*8 + 0x1278]
mov rax, rcx
call fcn.0041bee0
mov rdx, qword [rsp + 0x28]
inc rdx
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
cmp rdx, rcx
jl 0x42a8be
add rax, 0x1268
call fcn.0042a7e0
add rsp, 0x38
pop rbp
ret
inc rdx
nop
cmp rdx, rcx
jge 0x42aa74
mov rsi, qword [rax + rdx*8 + 0x1278]
cmp rsi, 0x1000
jb 0x42a8fb
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rbx
mov rax, rsi
xor ebx, ebx
mov rcx, rbx
call fcn.00411100
test rax, rax
jne 0x42a94c
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
jmp 0x42a8fb
mov rsi, qword [rbx + 0x50]
test byte [rsi], al
mov r8, rcx
shr r8, 3
movzx r9d, byte [rsi + r8]
and ecx, 7
mov r10d, 1
shl r10d, cl
nop
add rsi, r8
test r10b, r9b
je 0x42a98c
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
jmp 0x42a8fb
nop
lock or byte [rsi], r10b
mov rcx, qword [rbx + 0x18]
movabs rsi, 0x800000000000
lea r8, [rsi + rcx]
mov r9, r8
shr r8, 0x2a
nop
nop
nop
cmp r8, 0x40
jae 0x42aacd
lea r10, [0x0057e038]
mov r8, qword [r10 + r8*8]
test byte [r8], al
mov r10, rcx
shr r10, 0x10
and r10d, 0x3f
shr rcx, 0xd
and ecx, 7
mov r11d, 1
shl r11d, cl
shr r9, 0x16
and r9d, 0xfffff
mov r8, qword [r8 + r9*8]
test byte [r8], al
movzx r9d, byte [r8 + r10 + 0x11440]
lea r8, [r8 + r10]
lea r8, [r8 + 0x11440]
test r11b, r9b
jne 0x42aa0f
lock or byte [r8], r11b
movzx r8d, byte [rbx + 0x6a]
test r8b, 1
je 0x42aa45
mov rax, qword [rsp + 0x48]
mov r8, qword [rax + 0x1250]
add r8, qword [rbx + 0x70]
mov qword [rax + 0x1250], r8
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
jmp 0x42a8fb
mov r8, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
cmp r8, rcx
jae 0x42aac5
mov rbx, qword [rsp + 0x48]
mov qword [rbx + r8*8 + 0x1278], rax
inc r8
mov rax, rbx
mov rdx, qword [rsp + 0x28]
mov rbx, r8
jmp 0x42a8fb
cmp rbx, 0x200
ja 0x42aab4
lea rdx, [rax + 0x1278]
lea rsi, [rax + 0x1240]
mov rcx, rbx
mov edi, 0x200
mov rbx, rdx
mov rax, rsi
call fcn.00421640
mov rax, qword [rsp + 0x48]
add rax, 0x1268
call fcn.0042a7e0
add rsp, 0x38
pop rbp
ret
mov rcx, rbx
mov edx, 0x200
nop dword [rax]
call fcn.00455b20
mov rax, r8
call fcn.00455aa0
mov rax, r8
mov ecx, 0x40
call fcn.00455ac0
mov edx, 0x200
nop
call fcn.00455b00
nop
mov qword [rsp + 8], rax
call fcn.0045a360
mov rax, qword [rsp + 8]
jmp fcn.0042a860