joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400bbf50
Capabilities:
Create thread

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rdi, r8
mov rbx, rdx
mov r14, rcx
movzx eax, byte [0x1401661f8]
mov ecx, 0x10
mov edx, 8
call fcn.140006580
test rax, rax
je 0x1400bc007
mov rsi, rax
mov qword [rax], rbx
mov qword [rax + 8], rdi
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x10000
lea r8, [0x1400bc060]
xor edi, edi
xor ecx, ecx
mov rdx, r14
mov r9, rax
call sub.KERNEL32.dll_CreateThread
mov rdx, rax
test rax, rax
jne 0x1400bbffa
mov rdi, qword [rsi]
mov rbx, qword [rsi + 8]
mov rcx, rdi
call qword [rbx]
cmp qword [rbx + 8], 0
je 0x1400bbfd9
mov rdx, qword [rbx + 0x10]
mov rcx, rdi
call fcn.140006610
mov edx, 8
mov rcx, rsi
call fcn.140006610
call sub.KERNEL32.dll_GetLastError
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov edi, 1
mov rax, rdi
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
ret
mov ecx, 8
mov edx, 0x10
call fcn.140006b60
ud2

Function at 0x1400bc130
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rsi
sub rsp, 0x80
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
lea rcx, [rsp + 0x30]
mov edx, 0x10
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x1400bc166
mov rax, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
add rsp, 0x80
pop rsi
ret
call sub.KERNEL32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x28]
mov qword [rsp + 0x40], rax
lea rax, [fcn.1400b7ee0]
mov qword [rsp + 0x48], rax
lea rax, str.fallback_RNG_broken:
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 1
mov qword [rsp + 0x70], 0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 1
lea rdx, str.library_std_src_syswindows_rand.rs
lea rcx, [rsp + 0x50]
call fcn.140009fc0
ud2
Function at 0x1400c1d90
Capabilities:
Generate random numbers via winapi
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
sub rsp, 0x30
mov ecx, dword [0x1400e31c8]
test ecx, ecx
je 0x1400c1e89
dec ecx
call fcn.1400e0e9c
cmp rax, 1
jbe 0x1400c1dc0
cmp qword [rax + 8], 0
je 0x1400c1dc0
add rax, 0x10
jmp 0x1400c1e83
mov ecx, dword [0x1400e31c8]
test ecx, ecx
je 0x1400c1e9c
dec ecx
call fcn.1400e0e9c
cmp rax, 1
je 0x1400c1e63
mov rsi, rax
test rax, rax
jne 0x1400c1e33
movzx eax, byte [0x1401661f8]
mov ecx, 0x20
mov edx, 8
call fcn.140006580
test rax, rax
je 0x1400c1ec2
mov rsi, rax
lea rax, [0x1400e31b0]
mov qword [rsi], rax
mov qword [rsi + 8], 0
mov ecx, dword [0x1400e31c8]
test ecx, ecx
je 0x1400c1eaf
dec ecx
mov rdx, rsi
call sub.KERNEL32.dll_TlsSetValue
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
xor ecx, ecx
mov r8d, 0x10
mov r9d, 2
call sub.bcrypt.dll_BCryptGenRandom
test eax, eax
js 0x1400c1e67
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
jmp 0x1400c1e6f
xor eax, eax
jmp 0x1400c1e83
call fcn.1400bc130
mov rcx, rax
mov qword [rsi + 8], 1
lea rax, [rsi + 0x10]
mov qword [rsi + 0x10], rcx
mov qword [rsi + 0x18], rdx
add rsp, 0x30
pop rsi
ret
lea rcx, [0x1400e31b0]
call fcn.140098ed0
mov ecx, eax
jmp 0x1400c1da5
lea rcx, [0x1400e31b0]
call fcn.140098ed0
mov ecx, eax
jmp 0x1400c1dd0
lea rcx, [0x1400e31b0]
call fcn.140098ed0
mov ecx, eax
jmp 0x1400c1e2b
mov ecx, 8
mov edx, 0x20
call fcn.140006b60
ud2
Function at 0x1400c4539
Capabilities:
Accept command line arguments

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rax, rdx
mov rsi, rcx
lea rdx, [rsp + 0x2c]
mov rcx, rax
call sub.SHELL32.dll_CommandLineToArgvW
test rax, rax
je 0x1400c45d2
mov rdi, rax
movsxd r12, dword [rsp + 0x2c]
lea rbx, [rsp + 0x30]
mov qword [rbx], 8
xorps xmm0, xmm0
movups xmmword [rbx + 8], xmm0
shl r12, 3
xor r13d, r13d
lea r14, [rsp + 0x48]
cmp r12, r13
je 0x1400c45b7
mov r15, qword [rdi + r13]
mov rcx, r15
call sub.msvcrt.dll_wcslen
mov rcx, r14
mov rdx, r15
mov r8, rax
call fcn.1400c3db0
mov rcx, rbx
mov rdx, r14
call fcn.1400c488e
add r13, 8
jmp 0x1400c4587
mov rcx, rdi
call sub.KERNEL32.dll_LocalFree
mov rax, qword [rsp + 0x40]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rsi], xmm0
jmp 0x1400c45e0
mov qword [rsi], 8
xorps xmm0, xmm0
movups xmmword [rsi + 8], xmm0
add rsp, 0x60
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1400cd8d8
Capabilities:
Reference wmi statements

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x40
and qword [rsp + 0x38], 0
mov rsi, rdx
mov rdi, rcx
cmp qword [rdx + 0x10], 0
je 0x1400cd99f
lea rcx, [0x14011e582]
call sub.OLEAUT32.dll_SysAllocString
mov rbx, rax
lea rcx, str.SELECT__FROM_MSAcpi_ThermalZoneTemperature
call sub.OLEAUT32.dll_SysAllocString
mov r14, rax
mov rcx, qword [rsi + 0x18]
mov rax, qword [rcx]
mov rax, qword [rax + 0xa0]
lea rdx, [rsp + 0x38]
mov qword [rsp + 0x28], rdx
and qword [rsp + 0x20], 0
mov rdx, rbx
mov r8, r14
mov r9d, 0x30
call rax
mov ebp, eax
mov rcx, rbx
call sub.OLEAUT32.dll_SysFreeString
mov rcx, r14
call sub.OLEAUT32.dll_SysFreeString
test ebp, ebp
js 0x1400cd99f
mov rbx, qword [rsp + 0x38]
mov rcx, qword [rsi + 0x20]
mov rdx, qword [rsi + 0x28]
call fcn.1400c81ca
mov qword [rsi + 0x20], 1
mov qword [rsi + 0x28], rbx
mov rax, qword [rsi + 0x30]
mov qword [rdi + 0x30], rax
movups xmm0, xmmword [rsi]
movups xmm1, xmmword [rsi + 0x10]
movups xmmword [rdi + 0x10], xmm1
movups xmmword [rdi], xmm0
mov rax, qword [rsi + 0x20]
mov qword [rdi + 0x20], rax
mov rax, qword [rsi + 0x28]
mov qword [rdi + 0x28], rax
jmp 0x1400cd9ae
mov qword [rdi], 2
mov rcx, rsi
call fcn.1400c8109
nop
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret

Function at 0x1400cf751
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov rax, rcx
mov ecx, dword [rcx + 0x18]
test ecx, ecx
je 0x1400cf76a
dec ecx
add rsp, 0x28
jmp fcn.1400e0e9c
mov rcx, rax
call fcn.140098ed0
mov ecx, eax
jmp 0x1400cf761

Function at 0x1400d348c
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov rax, qword [rcx]
mov rdx, rax
xor rdx, 3
lock cmpxchg qword [rcx], rdx
jne 0x1400d3493
test al, 1
je 0x1400d34b2
test al, 2
jne 0x1400d34c7
xor rax, 3
add rsp, 0x28
ret
lea rcx, str.assertion_failed:_prev.is_running__
lea r8, [0x140120d60]
mov edx, 0x23
jmp 0x1400d34da
lea rcx, str.assertion_failed:__prev.is_complete__
lea r8, [0x140120d20]
mov edx, 0x25
call fcn.14000ae60
ud2

Function at 0x1400d3ef6
Capabilities:
Set socket configuration

Disassembly:
push rbx
sub rsp, 0x30
mov ebx, edx
call fcn.1400d2f32
mov rcx, qword [rax]
movzx eax, bl
lea r9, [rsp + 0x2c]
mov dword [r9], eax
mov dword [rsp + 0x20], 4
mov edx, 6
mov r8d, 1
call sub.WS2_32.dll_setsockopt
cmp eax, 0xffffffff
je 0x1400d3f31
xor eax, eax
jmp 0x1400d3f3e
call sub.WS2_32.dll_WSAGetLastError
shl rax, 0x20
or rax, 2
add rsp, 0x30
pop rbx
ret
Function at 0x1400d3f44
Capabilities:
Send data
Send data on socket

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov rbp, r9
mov rbx, r8
mov r14, rdx
mov qword [rsp + 0x28], rcx
mov rax, qword [rsp + 0xc0]
lea rdi, [rsp + 0x3a]
lea r15, [rdx + 0x10]
xor ecx, ecx
cmp qword [rdx + 0x10], 0xffffffffffffffff
cmove r15, rcx
mov r12d, 0x7fffffff
cmp rax, r12
cmovb r12, rax
lea r13, [rsp + 0x52]
lea rsi, [rsp + 0x30]
mov qword [rsp + 0x40], r15
mov rdx, qword [r14 + 8]
mov rcx, rsi
mov r8, rbx
call fcn.1400d3eee
mov al, byte [rsp + 0x39]
cmp al, 3
je 0x1400d40c5
mov rcx, qword [rsp + 0x30]
cmp al, 2
je 0x1400d40d3
mov dl, byte [rsp + 0x38]
movzx r8d, word [rdi + 4]
mov word [r13 + 4], r8w
mov r8d, dword [rdi]
mov dword [r13], r8d
mov qword [rsp + 0x48], rcx
mov byte [rsp + 0x50], dl
mov byte [rsp + 0x51], al
mov rcx, r15
lea rdx, str._home_affix_.cargo_registry_src_index.crates.io_6f17d22bba15001f_tokio_1.38.0_src_io_poll_evented.rs
call fcn.1400d2f50
mov rcx, qword [r15]
mov rdx, rbp
mov r8d, r12d
xor r9d, r9d
call sub.WS2_32.dll_send
cmp eax, 0xffffffff
jne 0x1400d40e5
call sub.WS2_32.dll_WSAGetLastError
mov esi, eax
shl rsi, 0x20
or rsi, 2
mov rcx, rsi
call fcn.140019bd4
cmp al, 0xd
jne 0x1400d4095
mov rax, qword [r15 + 8]
test rax, rax
je 0x1400d4095
mov rcx, qword [rax]
mov rdx, qword [rax + 8]
lock inc qword [rdx]
jle 0x1400d4117
mov r15, r14
mov r14, rbx
mov rbx, r13
mov r13, rdi
mov rdi, rbp
add rcx, 0x10
mov r8, qword [rax + 0x10]
mov r9b, byte [rax + 0x18]
call fcn.140037f5b
mov rbp, rax
xor ecx, ecx
call fcn.140039499
test rbp, rbp
je 0x1400d4081
mov ecx, 1
mov rdx, rsi
call fcn.1400380f7
mov rsi, rbp
mov rbp, rdi
mov rdi, r13
mov r13, rbx
mov rbx, r14
mov r14, r15
mov r15, qword [rsp + 0x40]
mov rcx, rsi
call fcn.1400ce434
cmp al, 0xd
jne 0x1400d40f6
mov qword [rsp + 0x30], rsi
mov rcx, r14
lea rdx, [rsp + 0x48]
call fcn.1400d3bd0
lea rsi, [rsp + 0x30]
mov rcx, rsi
call fcn.1400ce1fc
jmp 0x1400d3f9a
mov rax, qword [rsp + 0x28]
mov qword [rax], 2
jmp 0x1400d4106
mov rax, qword [rsp + 0x28]
mov qword [rax], 1
mov qword [rax + 8], rcx
jmp 0x1400d4106
cdqe
mov rcx, qword [rsp + 0x28]
and qword [rcx], 0
mov qword [rcx + 8], rax
jmp 0x1400d4106
mov rax, qword [rsp + 0x28]
mov qword [rax], 1
mov qword [rax + 8], rsi
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
ud2

Function at 0x1400e1cd0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.1400e2a70
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.1400e2a70
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop dword [rax]
Function at 0x1400e1d40
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x140166284]
mov rbx, rcx
test esi, esi
jle 0x1400e1e70
mov rax, qword [0x140166288]
xor r9d, r9d
add rax, 0x18
nop word [rax + rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x1400e1d8b
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x1400e1e15
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x1400e1d70
mov rcx, rbx
call fcn.1400e2790
mov rdi, rax
test rax, rax
je 0x1400e1e92
mov rax, qword [0x140166288]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call fcn.1400e28d0
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x140166288]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1400e1e77
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x1400e1e0e
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x1400e1e20
add dword [0x140166284], 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x140166288]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1400e1e0e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.1400e1cd0
nop dword [rax]
xor esi, esi
jmp 0x1400e1d98
mov rax, qword [0x140166288]
mov edx, dword [rdi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.1400e1cd0
mov rdx, rbx
lea rcx, str.Address__p_has_no_image_section
call fcn.1400e1cd0
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x1400e2400
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x1401662e0]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1401662c0]
test rbx, rbx
je 0x1400e245c
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x1400e2453
test rsi, rsi
je 0x1400e2453
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x1400e2438
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x1400e2790
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x140146a90]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x1400e27b0
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x1400e27b8
ret
cmp word [r8 + 0x18], 0x20b
jne 0x1400e27b0
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x1400e280d
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x1400e2804
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x1400e27b0
add rax, 0x28
cmp rax, r9
jne 0x1400e27f0
xor eax, eax
ret

Function at 0x1400e2810
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140146a90]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x1400e282f
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400e2838
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x1400e282f
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x1400e28d0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140146a90]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x1400e28ef
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x1400e28f8
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret

Function at 0x403000
Capabilities:
Terminate process

Disassembly:
mov eax, 1
cpuid
and ecx, 0x18000000
cmp ecx, 0x18000000
jne 0x403128
xor ecx, ecx
xgetbv
and eax, 6
cmp eax, 6
jne 0x403128
vbroadcastsd ymm0, qword [0x00401033]
vsqrtpd ymm1, ymm0
vsubpd ymm2, ymm0, ymm1
vsubpd ymm3, ymm1, ymm2
vaddpd xmm4, xmm2, xmm3
vaddpd ymm5, ymm4, ymm0
vperm2f128 ymm6, ymm4, ymm5, 3
vshufpd ymm7, ymm6, ymm5, 0x93
vroundpd ymm8, ymm7, 3
vroundpd ymm9, ymm7, 0
sub rsp, 0x418
vmovups ymmword [rsp + 0x10], ymm0
vmovups ymmword [rsp + 0x30], ymm1
vmovups ymmword [rsp + 0x50], ymm2
vmovups ymmword [rsp + 0x70], ymm3
vmovups ymmword [rsp + 0x90], ymm4
vmovups ymmword [rsp + 0xb0], ymm5
vmovups ymmword [rsp + 0xd0], ymm6
vmovups ymmword [rsp + 0xf0], ymm7
vmovups ymmword [rsp + 0x110], ymm8
vmovups ymmword [rsp + 0x130], ymm9
vmovups ymmword [rsp + 0x150], ymm10
vmovups ymmword [rsp + 0x170], ymm11
vmovups ymmword [rsp + 0x190], ymm12
vmovups ymmword [rsp + 0x1b0], ymm13
vmovups ymmword [rsp + 0x1d0], ymm14
vmovups ymmword [rsp + 0x1f0], ymm15
mov r8, qword [rsp + 0x10]
mov r9, qword [rsp + 0x18]
lea rdx, [0x0040103b]
lea rcx, [0x00401172]
call qword [sym.imp.MSVCRT.DLL_sprintf]
xor ecx, ecx
lea rdx, [0x00401172]
lea r8, str.AVX_playground
xor r9d, r9d
call qword [sym.imp.USER32.DLL_MessageBoxA]
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_ExitProcess]
sub rsp, 0x28
xor ecx, ecx
lea rdx, str.AVX_instructions_are_not_supported.
lea r8, str.AVX_playground
mov r9d, 0x10
call qword [sym.imp.USER32.DLL_MessageBoxA]
mov ecx, 1
call qword [sym.imp.KERNEL32.DLL_ExitProcess]
Function at 0x416ce0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x416e6b
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [0x00cb36d8]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00434900
xorps xmm15, xmm15
mov r14, qword [0x00d7aa40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x416d45
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x416d54
add rsp, 0x48
pop rbp
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x416d73
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x416d83
cmp rbx, 0x1000
jae 0x416d4b
jmp 0x416ded
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x416d95
xor edx, edx
jmp 0x416de4
mov rcx, qword [0x00cb36d8]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00434900
xorps xmm15, xmm15
mov r14, qword [0x00d7aa40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x416d79
jmp 0x416d68
call fcn.00468c60
xorps xmm15, xmm15
mov r14, qword [0x00d7aa40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.00439060
lea rax, [0x0092a280]
mov ebx, 0x18
nop dword [rax]
call fcn.004398e0
mov rax, qword [rsp + 0x38]
call fcn.00439620
lea rax, [0x0092ace9]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.004398e0
mov rax, qword [rsp + 0x30]
call fcn.00439620
call fcn.004392a0
call fcn.004390c0
lea rax, [0x0092fd10]
mov ebx, 0x21
call fcn.004376c0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00465500
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00416ce0
Function at 0x416ea0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4170c6
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [0x00cb36e0]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.00434980
xorps xmm15, xmm15
mov r14, qword [0x00d7aa40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x416f13
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x416f22
add rsp, 0x50
pop rbp
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x416f45
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x416f55
cmp rbx, 0x1000
jae 0x416f19
nop
jmp 0x416fd8
add rsp, 0x50
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop word [rax + rax]
cmp rbx, 0x1000
jae 0x416f6d
xor esi, esi
jmp 0x416fca
mov rax, qword [0x00cb36e0]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.00434980
xorps xmm15, xmm15
mov r14, qword [0x00d7aa40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x416f4b
jmp 0x416f36
call fcn.00468c60
xorps xmm15, xmm15
mov r14, qword [0x00d7aa40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x417060
nop dword [rax + rax]
call fcn.00439060
lea rax, [0x0092ad02]
mov ebx, 0x19
call fcn.004398e0
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
call fcn.00439620
lea rax, [0x0092ace9]
mov ebx, 0x19
call fcn.004398e0
mov eax, dword [rsp + 0x34]
call fcn.00439620
nop
call fcn.004392a0
call fcn.004390c0
lea rax, [0x0092229f]
mov ebx, 0xd
call fcn.004376c0
nop dword [rax + rax]
cmp eax, 0x5af
je 0x417000
call fcn.00439060
lea rax, [0x0092ad02]
mov ebx, 0x19
call fcn.004398e0
mov rax, qword [rsp + 0x38]
call fcn.00439620
lea rax, [0x0092ace9]
mov ebx, 0x19
call fcn.004398e0
mov eax, dword [rsp + 0x34]
nop dword [rax]
call fcn.00439620
call fcn.004392a0
call fcn.004390c0
lea rax, [0x0092eb12]
mov ebx, 0x1f
nop dword [rax + rax]
call fcn.004376c0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00465500
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.00416ea0
Function at 0x4205a0
Capabilities:
Hash data using murmur3

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
cmp byte [0x00d7a5e0], 0
jne 0x420687
sub rbx, qword [rax + 0x18]
mov rdx, qword [rax + 0x50]
test byte [rdx], al
mov esi, dword [rax + 0x64]
imul rbx, rsi
mov rsi, rbx
shr rbx, 0x20
shr rsi, 0x23
and ebx, 7
mov rdi, rcx
mov rcx, rbx
mov r8d, 1
shl r8d, cl
add rdx, rsi
nop
nop
nop
nop
lock or byte [rdx], r8b
mov rcx, qword [rax + 0x18]
movabs rdx, 0x800000000000
lea rax, [rdx + rcx]
mov rdx, rax
shr rdx, 0x2a
nop
nop
nop
cmp rdx, 0x40
jae 0x42067a
lea rbx, [0x00d4c9b8]
mov rdx, qword [rbx + rdx*8]
test byte [rdx], al
mov rbx, rcx
shr rbx, 0x10
and ebx, 0x3f
shr rcx, 0xd
and ecx, 7
mov esi, 1
shl esi, cl
shr rax, 0x16
and eax, 0xfffff
mov rax, qword [rdx + rax*8]
test byte [rax], al
movzx edx, byte [rax + rbx + 0x11440]
lea rax, [rax + rbx]
lea rax, [rax + 0x11440]
test sil, dl
jne 0x420660
lock or byte [rax], sil
mov rax, qword [r14 + 0x30]
mov rax, qword [rax + 0xa0]
test byte [rax], al
add qword [rax + 0x1250], rdi
add rsp, 0x10
pop rbp
ret
mov rax, rdx
mov ecx, 0x40
call fcn.004677e0
lea rax, [0x00937824]
mov ebx, 0x2c
call fcn.004376c0
nop
int3

Function at 0x422960
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x422a66
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x70], rcx
mov byte [rsp + 0x17], dil
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x18], 0
jmp 0x4229a3
mov rax, qword [rsp + 0x60]
mov rcx, rdx
mov rbx, qword [rsp + 0x68]
movzx edi, byte [rsp + 0x17]
cmp qword [rsp + 0x18], rbx
jae 0x422a5b
test byte [rax], al
lea rcx, [rax + 0x100b8]
mov ebx, edi
mov rax, rcx
nop dword [rax]
call fcn.00423740
test rax, rax
je 0x422a5b
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x30], xmm15
movups xmmword [rsp + 0x40], xmm15
lea rcx, [0x00422aa0]
mov qword [rsp + 0x20], rcx
lea rdx, [rsp + 0x18]
mov qword [rsp + 0x28], rdx
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x48], rax
lea rbx, [rsp + 0x20]
mov qword [rsp], rbx
nop dword [rax]
call fcn.004653c0
xorps xmm15, xmm15
mov r14, qword [0x00d7aa40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x70]
nop dword [rax]
test rdx, rdx
jne 0x422a49
xor eax, eax
jmp 0x422a53
mov rax, qword [rdx]
call rax
mov rdx, qword [rsp + 0x70]
test al, al
je 0x422991
mov rax, qword [rsp + 0x18]
add rsp, 0x50
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov byte [rsp + 0x20], dil
call fcn.00465500
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movzx edi, byte [rsp + 0x20]
jmp fcn.00422960
Function at 0x42f220
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x42f330
push rbp
mov rbp, rsp
sub rsp, 0x58
mov qword [rsp + 0x68], rax
mov byte [rsp + 0x80], dil
nop
test dil, dil
je 0x42f275
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x78], rcx
mov eax, 6
call fcn.0043c4a0
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
movzx edi, byte [rsp + 0x80]
mov qword [rsp + 8], 0
nop
test rbx, rbx
jne 0x42f28d
test dil, dil
jmp 0x42f31b
lea rdx, [rsp + 0x68]
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rsi, [0x0042f380]
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x18], rax
mov rax, r14
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rdx
mov byte [rsp + 0x48], dil
lea rax, [rsp + 8]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.004653c0
xorps xmm15, xmm15
mov r14, qword [0x00d7aa40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
movzx eax, byte [rsp + 0x80]
test al, al
je 0x42f325
nop dword [rax]
call fcn.0043c620
mov rax, qword [rsp + 8]
add rsp, 0x58
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov byte [rsp + 0x20], dil
call fcn.00465500
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movzx edi, byte [rsp + 0x20]
nop dword [rax]
jmp fcn.0042f220