joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140002350
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140009740]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x14000236f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x140002378
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret

Function at 0x140002390
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x140009740]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x1400023b0
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x1400023b8
ret
cmp word [r8 + 0x18], 0x20b
jne 0x1400023b0
sub rcx, rdx
movzx r9d, word [r8 + 6]
movzx edx, word [r8 + 0x14]
lea rdx, [r8 + rdx + 0x18]
test r9w, r9w
je 0x1400023b0
lea eax, [r9 - 1]
lea rax, [rax + rax*4]
lea r9, [rdx + rax*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rdx + 0xc]
mov rax, r8
cmp rcx, r8
jb 0x140002404
add eax, dword [rdx + 8]
cmp rcx, rax
jb 0x140002410
add rdx, 0x28
cmp r9, rdx
jne 0x1400023f0
xor eax, eax
ret
mov eax, dword [rdx + 0x24]
not eax
shr eax, 0x1f
ret

Function at 0x140002420
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov r11, qword [0x140009740]
xor r9d, r9d
cmp word [r11], 0x5a4d
jne 0x140002442
movsxd r8, dword [r11 + 0x3c]
add r8, r11
cmp dword [r8], 0x4550
je 0x140002450
mov rax, r9
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140002442
mov eax, dword [r8 + 0x90]
test eax, eax
je 0x140002442
movzx edx, word [r8 + 0x14]
movzx r10d, word [r8 + 6]
lea rdx, [r8 + rdx + 0x18]
test r10w, r10w
je 0x140002442
lea r8d, [r10 - 1]
lea r8, [r8 + r8*4]
lea r10, [rdx + r8*8 + 0x28]
nop word cs:[rax + rax]
mov r9d, dword [rdx + 0xc]
mov r8, r9
cmp rax, r9
jb 0x1400024a5
add r8d, dword [rdx + 8]
cmp rax, r8
jb 0x1400024b8
add rdx, 0x28
cmp rdx, r10
jne 0x140002490
xor r9d, r9d
mov rax, r9
ret
add rax, r11
jmp 0x1400024c7
sub ecx, 1
add rax, 0x14
mov r8d, dword [rax + 4]
test r8d, r8d
jne 0x1400024d7
mov edx, dword [rax + 0xc]
test edx, edx
je 0x1400024ae
test ecx, ecx
jg 0x1400024c0
mov r9d, dword [rax + 0xc]
add r9, r11
mov rax, r9
ret
Function at 0x1400658de
Capabilities:
Allocate thread local storage

Disassembly:
jmp 0x1400f4990
mov qword [rsp + 8], rcx
sub rsp, 0x38
call fcn.1400f39e0
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1400f49c7
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x28]
call qword [0x14017d020]
jmp 0x1400f49cd
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
add rsp, 0x38
ret
Function at 0x14006630b
Capabilities:
Clear file content

Disassembly:
jmp 0x140103bf0
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x98
mov r8, qword [rsp + 0xa8]
mov edx, dword [rsp + 0xa0]
lea rcx, [rsp + 0x68]
call fcn.140065154
cmp qword [rsp + 0x68], 0xffffffffffffffff
je 0x140103c29
cmp qword [rsp + 0x70], 0xffffffffffffffff
jne 0x140103c47
call fcn.1400661bc
mov eax, dword [rax]
mov dword [rsp + 0x40], eax
lea rcx, [rsp + 0x68]
call fcn.140065db1
mov eax, dword [rsp + 0x40]
jmp 0x140103e63
cmp qword [rsp + 0x78], 0
jle 0x140103da8
mov dword [rsp + 0x20], 0x4a
lea r9, str.minkernelcrtsucrt_src_appcrtlowiochsize.cpp
mov r8d, 2
mov edx, 1
mov ecx, 0x1000
call fcn.14006831d
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.1400666a8
lea rcx, [rsp + 0x38]
call fcn.140066388
movzx eax, al
test eax, eax
jne 0x140103cc8
call fcn.1400661bc
mov dword [rax], 0xc
call fcn.1400661bc
mov eax, dword [rax]
mov dword [rsp + 0x44], eax
lea rcx, [rsp + 0x38]
call fcn.14006573f
lea rcx, [rsp + 0x68]
call fcn.140065db1
mov eax, dword [rsp + 0x44]
jmp 0x140103e63
mov edx, 0x8000
mov ecx, dword [rsp + 0xa0]
call fcn.1400671cf
mov dword [rsp + 0x50], eax
cmp qword [rsp + 0x78], 0x1000
jl 0x140103cf2
mov dword [rsp + 0x30], 0x1000
jmp 0x140103cfa
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x30]
mov dword [rsp + 0x48], eax
lea rcx, [rsp + 0x38]
call fcn.140066c98
mov r8d, dword [rsp + 0x48]
mov rdx, rax
mov ecx, dword [rsp + 0xa0]
call fcn.1400677d3
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0xffffffff
jne 0x140103d68
call fcn.140066e78
cmp dword [rax], 5
jne 0x140103d40
call fcn.1400661bc
mov dword [rax], 0xd
call fcn.1400661bc
mov eax, dword [rax]
mov dword [rsp + 0x4c], eax
lea rcx, [rsp + 0x38]
call fcn.14006573f
lea rcx, [rsp + 0x68]
call fcn.140065db1
mov eax, dword [rsp + 0x4c]
jmp 0x140103e63
movsxd rax, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x78]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x78], rax
cmp qword [rsp + 0x78], 0
jg 0x140103cdd
mov edx, dword [rsp + 0x50]
mov ecx, dword [rsp + 0xa0]
call fcn.1400671cf
lea rcx, [rsp + 0x38]
call fcn.14006573f
jmp 0x140103e4d
cmp qword [rsp + 0x78], 0
jge 0x140103e4d
xor r8d, r8d
mov rdx, qword [rsp + 0xa8]
mov ecx, dword [rsp + 0xa0]
call fcn.1400657ad
mov qword [rsp + 0x88], rax
cmp qword [rsp + 0x88], 0xffffffffffffffff
jne 0x140103df9
call fcn.1400661bc
mov eax, dword [rax]
mov dword [rsp + 0x54], eax
lea rcx, [rsp + 0x68]
call fcn.140065db1
mov eax, dword [rsp + 0x54]
jmp 0x140103e63
mov ecx, dword [rsp + 0xa0]
call fcn.140068106
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x140103e4d
call fcn.1400661bc
mov dword [rax], 0xd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x58], eax
call fcn.140066e78
mov ecx, dword [rsp + 0x58]
mov dword [rax], ecx
call fcn.1400661bc
mov eax, dword [rax]
mov dword [rsp + 0x5c], eax
lea rcx, [rsp + 0x68]
call fcn.140065db1
mov eax, dword [rsp + 0x5c]
jmp 0x140103e63
mov dword [rsp + 0x60], 0
lea rcx, [rsp + 0x68]
call fcn.140065db1
mov eax, dword [rsp + 0x60]
add rsp, 0x98
ret
Function at 0x14006659f
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1400f0c60
mov rax, rcx
neg rcx
test rax, 7
je 0x1400f0c7d
nop
mov dl, byte [rax]
inc rax
test dl, dl
je 0x1400f0cd8
test al, 7
jne 0x1400f0c70
movabs r8, 0x7efefefefefefeff
movabs r11, 0x8101010101010100
mov rdx, qword [rax]
mov r9, r8
add rax, 8
add r9, rdx
not rdx
xor rdx, r9
and rdx, r11
je 0x1400f0c91
mov rdx, qword [rax - 8]
test dl, dl
je 0x1400f0d02
test dh, dh
je 0x1400f0cfc
shr rdx, 0x10
test dl, dl
je 0x1400f0cf6
test dh, dh
je 0x1400f0cf0
shr rdx, 0x10
test dl, dl
je 0x1400f0cea
test dh, dh
je 0x1400f0ce4
shr edx, 0x10
test dl, dl
je 0x1400f0cde
test dh, dh
jne 0x1400f0c91
lea rax, [rax + rcx - 1]
ret
lea rax, [rax + rcx - 2]
ret
lea rax, [rax + rcx - 3]
ret
lea rax, [rax + rcx - 4]
ret
lea rax, [rax + rcx - 5]
ret
lea rax, [rax + rcx - 6]
ret
lea rax, [rax + rcx - 7]
ret
lea rax, [rax + rcx - 8]
ret

Function at 0x1400668ba
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x140086780
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.140086100
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1400867bf
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x14017d020]
jmp 0x1400867c9
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add rsp, 0x48
ret

Function at 0x1400669f0
Capabilities:
Query environment variable

Disassembly:
jmp 0x14010e58c
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor r14d, r14d
mov rbx, rax
test rax, rax
je 0x14010e674
mov rsi, rax
cmp word [rax], r14w
je 0x14010e5df
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], r14w
jne 0x14010e5c7
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], r14w
jne 0x14010e5c3
mov qword [rsp + 0x38], r14
sub rsi, rbx
mov qword [rsp + 0x30], r14
add rsi, 2
sar rsi, 1
mov r8, rbx
mov r9d, esi
mov dword [rsp + 0x28], r14d
xor edx, edx
mov qword [rsp + 0x20], r14
xor ecx, ecx
call fcn.140067387
movsxd rbp, eax
test eax, eax
je 0x14010e674
mov r9d, 0x66
lea r8, str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
mov rcx, rbp
lea edx, [r9 - 0x64]
call fcn.1400667bb
mov rdi, rax
test rax, rax
je 0x14010e662
mov qword [rsp + 0x38], r14
mov r9d, esi
mov qword [rsp + 0x30], r14
mov r8, rbx
mov dword [rsp + 0x28], ebp
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rax
call fcn.140067387
test eax, eax
je 0x14010e662
mov rsi, rdi
mov rdi, r14
jmp 0x14010e665
mov rsi, r14
mov edx, 2
mov rcx, rdi
call fcn.140065857
jmp 0x14010e677
mov rsi, r14
test rbx, rbx
je 0x14010e685
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rbx, qword [rsp + 0x50]
mov rax, rsi
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x1400669ff
Capabilities:
Allocate thread local storage

Disassembly:
jmp 0x1400866b0
mov qword [rsp + 8], rcx
sub rsp, 0x48
call fcn.140086080
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1400866f1
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x14017d020]
jmp 0x1400866f7
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
add rsp, 0x48
ret

Function at 0x140066a72
Capabilities:
Get geographical location

Disassembly:
jmp 0x1400f4c60
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x48
call fcn.1400f3be0
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x1400f4cb3
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x38], rax
mov r9d, dword [rsp + 0x68]
mov r8, qword [rsp + 0x60]
mov edx, dword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x38]
call qword [0x14017d020]
jmp 0x1400f4cd5
xor edx, edx
mov rcx, qword [rsp + 0x50]
call fcn.140066329
mov r9d, dword [rsp + 0x68]
mov r8, qword [rsp + 0x60]
mov edx, dword [rsp + 0x58]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
add rsp, 0x48
ret

Function at 0x140066a7c
Capabilities:
Terminate process

Disassembly:
jmp 0x14006cf50
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x140066c52
Capabilities:
Print debug messages

Disassembly:
jmp 0x1401239f0
mov qword [rsp + 8], rcx
push rbp
sub rsp, 0x50
lea rbp, [rsp + 0x30]
mov rax, qword [0x14016c008]
xor rax, rbp
mov qword [rbp + 0x18], rax
cmp qword [rbp + 0x30], 0
jne 0x140123a16
jmp 0x140123a93
mov rcx, qword [rbp + 0x30]
call fcn.14006659f
inc rax
mov qword [rbp], rax
cmp qword [rbp], 0
jne 0x140123a2f
jmp 0x140123a93
mov rax, qword [rbp]
shl rax, 1
mov rcx, rax
add rcx, 0xf
cmp rcx, rax
ja 0x140123a4c
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.14006587f
sub rsp, rax
lea rax, [rsp + 0x30]
mov qword [rbp + 8], rax
mov rax, qword [rbp]
dec rax
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0x30]
mov r8, qword [rbp]
mov rdx, qword [rbp + 8]
lea rcx, [rbp + 0x10]
call fcn.140065c3f
test eax, eax
jne 0x140123a93
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [rbp + 0x18]
xor rcx, rbp
call fcn.140066748
lea rsp, [rbp + 0x20]
pop rbp
ret

Function at 0x14006708a
Capabilities:
Parse pe header

Disassembly:
jmp 0x14006e2a0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x14006e2c0
xor al, al
jmp 0x14006e341
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x14006e2d3
xor al, al
jmp 0x14006e341
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14006e2fd
xor al, al
jmp 0x14006e341
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x14006e311
xor al, al
jmp 0x14006e341
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x14006e323
xor al, al
jmp 0x14006e341
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14006e33f
xor al, al
jmp 0x14006e341
mov al, 1
add rsp, 0x38
ret
Function at 0x1400674ea
Capabilities:
Terminate process

Disassembly:
jmp 0x1400f1440
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov ecx, 0x17
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x1400f146e
mov ecx, 5
int 0x29
mov r8d, 1
mov edx, 0xc0000417
mov ecx, 2
call fcn.140067bc5
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000417
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x140067599
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x1400f4a50
mov dword [rsp + 8], ecx
sub rsp, 0x38
call fcn.1400f3a60
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1400f4a85
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov ecx, dword [rsp + 0x40]
mov rax, qword [rsp + 0x28]
call qword [0x14017d020]
jmp 0x1400f4a8f
mov ecx, dword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add rsp, 0x38
ret

Function at 0x1400679b3
Capabilities:
Set thread local storage value

Disassembly:
jmp 0x1400f4ab0
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x38
call fcn.1400f3aa0
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1400f4aef
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rdx, qword [rsp + 0x48]
mov ecx, dword [rsp + 0x40]
mov rax, qword [rsp + 0x28]
call qword [0x14017d020]
jmp 0x1400f4afe
mov rdx, qword [rsp + 0x48]
mov ecx, dword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
add rsp, 0x38
ret

Function at 0x140067c24
Capabilities:
Print debug messages

Disassembly:
jmp 0x140107050
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
add rsp, 0x28
ret
Function at 0x140067cba
Capabilities:
Set thread local storage value

Disassembly:
jmp 0x1400867f0
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.140086140
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x140086839
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rdx, qword [rsp + 0x58]
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x14017d020]
jmp 0x140086848
mov rdx, qword [rsp + 0x58]
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
add rsp, 0x48
ret

Function at 0x140067d50
Capabilities:
Set environment variable

Disassembly:
jmp 0x1401269a0
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xa8
lea rcx, [rsp + 0x70]
call fcn.14006620c
lea rcx, [rsp + 0x40]
call fcn.14006620c
call fcn.1400669a5
mov r8d, eax
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0xb0]
call fcn.14006603b
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x140126a0f
mov dword [rsp + 0x24], 0
lea rcx, [rsp + 0x40]
call fcn.1400664d2
lea rcx, [rsp + 0x70]
call fcn.1400664d2
mov eax, dword [rsp + 0x24]
jmp 0x140126a9c
call fcn.1400669a5
mov r8d, eax
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0xb8]
call fcn.14006603b
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0
je 0x140126a56
mov dword [rsp + 0x2c], 0
lea rcx, [rsp + 0x40]
call fcn.1400664d2
lea rcx, [rsp + 0x70]
call fcn.1400664d2
mov eax, dword [rsp + 0x2c]
jmp 0x140126a9c
lea rcx, [rsp + 0x40]
call fcn.140066194
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x70]
call fcn.140066194
mov rcx, qword [rsp + 0x38]
mov rdx, rcx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov dword [rsp + 0x30], eax
lea rcx, [rsp + 0x40]
call fcn.1400664d2
lea rcx, [rsp + 0x70]
call fcn.1400664d2
mov eax, dword [rsp + 0x30]
add rsp, 0xa8
ret
Function at 0x413240
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4133eb
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.0042e280
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
nop
jne 0x4132ae
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x4132c1
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x4132e5
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x4132f9
cmp rbx, 0x1000
jae 0x4132b8
nop
jmp 0x413369
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop
cmp rbx, 0x1000
jae 0x41330d
xor edx, edx
jmp 0x413360
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.0042e280
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
nop
test dl, dl
jne 0x4132ef
jmp 0x4132d5
call fcn.00459c60
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.004324a0
lea rax, [0x0048b36e]
mov ebx, 0x18
nop dword [rax + rax]
call fcn.00432da0
mov rax, qword [rsp + 0x38]
call fcn.00432aa0
lea rax, [0x0048b416]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.00432da0
mov rax, qword [rsp + 0x30]
call fcn.00432aa0
call fcn.00432700
call fcn.00432520
lea rax, [0x0048d1bd]
mov ebx, 0x21
call fcn.00430d00
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00456140
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00413240
Function at 0x413420
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41364a
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.0042e300
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x41349b
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x4134ae
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x4134d0
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x4134e4
cmp rbx, 0x1000
jae 0x4134a5
jmp 0x41356e
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x4134f6
xor esi, esi
jmp 0x413560
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
nop dword [rax]
call fcn.0042e300
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
test sil, sil
jne 0x4134da
jmp 0x4134c2
call fcn.00459c60
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x4135e9
call fcn.004324a0
lea rax, [0x0048b79a]
mov ebx, 0x19
call fcn.00432da0
mov rax, qword [rsp + 0x68]
call fcn.00432aa0
lea rax, [0x0048b416]
mov ebx, 0x19
nop
call fcn.00432da0
mov eax, dword [rsp + 0x34]
call fcn.00432aa0
call fcn.00432700
call fcn.00432520
lea rax, [0x00488669]
mov ebx, 0xd
call fcn.00430d00
cmp eax, 0x5af
je 0x413593
call fcn.004324a0
lea rax, [0x0048b79a]
mov ebx, 0x19
call fcn.00432da0
mov rax, qword [rsp + 0x38]
call fcn.00432aa0
lea rax, [0x0048b416]
mov ebx, 0x19
nop dword [rax]
call fcn.00432da0
mov eax, dword [rsp + 0x34]
call fcn.00432aa0
call fcn.00432700
call fcn.00432520
lea rax, [0x0048cc56]
mov ebx, 0x1f
call fcn.00430d00
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00456140
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00413420
Function at 0x41b300
Capabilities:
Hash data using murmur3

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
cmp byte [0x0055b4d1], 0
jne 0x41b3ef
nop
nop
nop
nop
sub rbx, qword [rax + 0x18]
nop
mov edx, dword [rax + 0x5c]
imul rbx, rdx
mov rdx, rbx
shr rbx, 0x20
nop
shr rdx, 0x23
and ebx, 7
mov rsi, rcx
mov rcx, rbx
mov edi, 1
shl edi, cl
nop
add rdx, qword [rax + 0x50]
lock or byte [rdx], dil
nop
nop
mov rcx, qword [rax + 0x18]
nop
movabs rdx, 0x800000000000
lea rax, [rdx + rcx]
mov rdx, rax
shr rax, 0x2a
cmp rax, 0x40
jae 0x41b3e5
lea rbx, [0x0052d930]
mov rax, qword [rbx + rax*8]
shr rdx, 0x16
and edx, 0xfffff
mov rdx, qword [rax + rdx*8]
test byte [rdx], al
test byte [rax], al
mov rax, rcx
shr rcx, 0x10
and ecx, 0x3f
movzx ebx, byte [rdx + rcx + 0x21040]
lea rdx, [rdx + rcx]
lea rdx, [rdx + 0x21040]
shr rax, 0xd
and eax, 7
mov rcx, rax
mov eax, 1
shl eax, cl
nop dword [rax]
test al, bl
jne 0x41b3c7
lock or byte [rdx], al
mov rax, qword [r14 + 0x30]
mov rax, qword [rax + 0xa0]
test byte [rax], al
add qword [rax + 0x1248], rsi
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov ecx, 0x40
call fcn.00458820
lea rax, [0x0048e5e5]
mov ebx, 0x2c
nop dword [rax + rax]
call fcn.00430d00
nop
int3