joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14055ca80
Capabilities:
Packed with generic packer
Resolve function by parsing pe exports

Disassembly:
movabs r12, 0xa3a73fb5ac83f283
test r10d, 0x5090ca95
push rbx
push r9
bswap r12
js 0x1403077ad
retf 0x5090
push rdx
call fcn.14039a31e
js 0x1404640ab
push qword [rsp + 8]
popfq
lea rsp, [rsp + 0x18]
call fcn.14071281a
lahf
in al, 0x20
or ecx, 0xffffffb9
jns 0x1402ad67d
jl 0x1402ad72b
mov cl, 0xe8
jl 0x1402ad6ce
retf 0xd6f9
adc dword [rsi], 0x5b
invalid
je 0x1402ad76e
ret
mov edi, 0xea4039c8
invalid
test dword [rsp + 0x40], r13d
not word [rsp + 0x40]
bswap r9d
not r13
bswap rcx
mov r13, qword [rsp + r9 - 0x2393c4c7]
mov r15, qword [rsp + 0x28]
mov rcx, qword [rsp + 8]
lea rsp, [rsp + r9 - 0x2393c4af]
ret 0x18
pushfq
shr edx, 0x10
je 0x1405bb46a
mov rbx, qword [rbx + rdx*8 - 0x16160]
neg dl
jne 0x14037ce3c
or ebx, ebx
lea rbx, [rbx*2 - 0x66e1c076]
neg dx
sub edx, 0x793b3a98
shr dl, 0xcf
cmp edx, 0x55986d1a
lea rbx, [rbx + rdx - 0x17a1a675]
lea rdx, [rdx + rdx - 0x5996915c]
call fcn.14036533a
add dh, ah
ret 0x3e6
popfq
lea rsp, [rsp + 0x38]
ret
js 0x140349330
shr r14b, 0xbc
push r14
je 0x140545c71
movabs rdi, 0xc9156987563a7fb0
shl dil, 0x1a
mov qword [rsp + 0x10], 0x63a503
mov rdi, qword [rsp + 8]
call 0x1402ad692
mov r10, qword [rsp + 0x38]
test r13d, 0x2cb76398
call fcn.140493b88
idiv ebx
mov bh, 0x41
push rdx
push r10
shr esi, 0x5e
je 0x14030ae07
jbe 0x140409e7d
neg si
lea rbp, [rbp + rsi*8 - 0x7fff7]
jo 0x1403e4754
not si
movabs r10, 0x6328973a469d2b9c
add r10b, 0x9d
not r10
mov qword [rsp + rsi + 0x20], rbp
bswap esi
test sil, sil
call fcn.1405406a6
mov rbp, qword [rsp + 0x58]
jg 0x1402ad66f
call fcn.140269585
mov rbx, qword [rsp + rbx*2 - 0x705b6f8c]
neg word [rsp + 0x10]
call int.140527fc0
xchg ebx, eax
imul esp, dword [rbx], 0xec4061de
push rdx
mov byte [rdi - 0x7f], bl
jg 0x1404b13a1
nop
movsb byte [rdi], byte [rsi]
invalid
jne 0x1404b1341
in al, dx
cmp bpl, byte [r9 - 0x1804abdf]
or ecx, dword [rax]
movabs dword [0x83f78836b55076fe], eax
xor ebx, dword [rcx + 0x32591053]
add al, 1
sbb qword [r14 + 0x5b], 0xffffffff9a74b37d
ret
mov r14, qword [rsp + r14 - 0x2e192ee8]
mov qword [rsp + 0x18], rax
shl dword [rsp], 0x70
call fcn.14034ac49
jns 0x1404b1344
cmp dil, 0x86
jns 0x140293188
mov r15w, 0xd812
call fcn.14037f019
invalid

Function at 0x14055cd62
Capabilities:
Encode data using xor

Disassembly:
lea r14, [r14 + riz + 0x4e8f308e]
or r14, 0x4628270d
lea r14, [r14 + r14 - 0x59e2a5d9]
mov qword [rsp + 0x20], rax
mov r14d, 0x503c3f1b
ja 0x1405861fb
push qword [rsp + 0x20]
test r14, 0x6bb795ab
jae 0x1402748d1
popfq
sbb al, 0x3c
push rbx
mov al, 0x78
adc eax, 0xcec27031
push rbx
insb byte [rdi], dx
lea ebp, [rbx - 0x5d]
invalid

Function at 0x14055f423
Capabilities:
Encode data using base64

Disassembly:
lea rsp, [rsp + 0x18]
call fcn.1406af0c2

Function at 0x14055f42d
Capabilities:
Encode data using base64

Disassembly:
jne 0x140271fbd
adc al, 0x12
push rcx
invalid
jno 0x1402d11b2
Function at 0x140561094
Capabilities:
Packed with generic packer
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x28], rax
xor r8d, 0x9b39632d
xor r8, 0xfffffffff496d983
test r8w, cx
jbe 0x1404c7d61
xchg esi, eax
stc
mov eax, 0xb6f981dc
mov edi, 0x87485141
push r9
invalid
invalid
xchg esp, eax
sbb al, 0x74
pop rax
invalid
add qword [rsp + 0x10], 0xe29af
shr word [rsp], 0x61
test qword [rsp], 0xffffffffe0129692
not cx
mov rax, r8
movsxd rcx, dword [rsp]
jg 0x140322f50
not cx
mov cx, 0x71b3
shr rcx, 0xf7
xchg qword [rsp + rcx + 0x20], rax
push r8
push 0x1ba6d496
mov r8, qword [rsp + rcx*2]
ja 0x1404eb616
and cl, 0x80
je 0x1404bd2e8
wait
and eax, 0xc5ae104
mov al, 0x7c
invalid

Function at 0x14056ec61
Capabilities:
Terminate process

Disassembly:
call qword [sym.imp.USER32.dll_MessageBoxW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
and r15d, r15d
mov word [rsp + r9 + 0x48], 0x3685
test word [rsp + r15 - 0x7f1e2e48], 0x7f02
js 0x14028500d
jb 0x14002a7e4
js 0x140006a1c
mov r15, qword [rsp + r9*2 + 0x40]
test dword [rsp + r9 + 0x10], r9d
js fcn.140218996
mov r14, r9
not dword [rsp + r9 + 0x48]
mov r14w, 0x81b6
sub r9, r14
mov r9, qword [rsp + r9*8 + 0x40e08]
cmp qword [rsp + r14 - 0x81a6], 0x2f12638b
pop r14
mov dword [rsp], 0xe800c80
sets byte [rsp + 0x70]
jne 0x140569c9a
lea rsp, [rsp + 0x18]
ret
push qword [rsp + 0x60]
popfq
lea rsp, [rsp + 0x80]
ret
mov rax, qword [rsp + r9 + 0x58]
movabs r15, 0xe30802049a1eee00
mov rax, qword [rsp + r9 + 0x28]
mov rax, qword [rax]
mov qword [rsp + r9 + 0x28], r9
shr word [rsp + r9*8 + 0x28], 0x33
push rbx
push r9
mov rbx, qword [rsp + 0x38]
lea rax, [rax + rbx - 0x50580afd]
neg word [rsp + r9]
push rbx
lea r15, [rbx + rbx*8 + 0x7f1e19aa]
mov r15w, 0x2e90
push r14
xchg qword [rsp + r9*4 + 0x88], rax
mov rbx, qword [rsp + rbx*2 + 0x18]
jbe 0x140203972
xchg esi, eax
invalid

Function at 0x140578816
Capabilities:
Delete registry key

Disassembly:
jb 0x1402750eb
not bpl
sets byte [rsp + 0x10]
setno bpl
and qword [rsp + 0x18], 0xffffffffd32cf02d
xor dword [rsp + 0x10], 0x60beff23
mov rbp, qword [rsp + 0x28]
call fcn.14056647d
Function at 0x140591c42
Capabilities:
Packed with generic packer

Disassembly:
call 0x140488ad9
cld
pop rcx
jle 0x140343adb
lodsd eax, dword [rsi]
cmp al, 0x82
and ecx, esi
stosb byte [rdi], al
sahf
invalid
add dword [rax + rsi], ebp
sub bl, bh
mov byte [rdx - 0x80], dh
mov bl, 0xa5
movabs eax, dword [0x4f4fb603f4eebd7b]
or bl, dh
scasb al, byte [rdi]
mov edi, 0x10000ff
invalid
and edx, dword [rsp + rdi*4 + 0x22]
mov rdx, qword [rsp + rdi*4 + 0x10]
shl edi, 0x3c
jae 0x14046e32d
shr dword [rax + riz*4 + 0xec96d7], 1
fadd qword [rdi + 7]
xchg esp, eax
outsd dx, dword [rsi]
pop rdi
mov byte [rcx + 0x7d], ah
or byte [rax + 0x41aac6ff], ah
fucompi st(7)
push 0xffffffffc7d3c4f3
mov cl, 0xea
invalid
mov word [rsp + rdi + 0x20], di
xor dword [rsp + rdi + 0x20], edi
or dword [rsp + rdi*2 + 0x20], 0x9b2a5f9f
mov rdi, qword [rsp + rdi + 8]
add byte [rcx], dh
mov esp, 0x203c
add byte [rcx + 0x207c8c], al
add byte [rax], al
lahf
pop rdi
sub bl, byte [rbx + 0x3cbc8b48]
or byte [rax], al
add byte [rax], al
js 0x140343a71
jbe 0x14046e334
add dword [rbx + 0x40], 0xefc676e0
mov ah, byte [rcx + 0x7edeeee7]
mov ebp, 0x544ce8b4
add dword [rsi + riz], ebp
invalid
lea rsp, [rsp + 0x48]
ret
mov qword [rsp + 0x48], rax
shl r11d, 0xc4
jae 0x14050965b
retf
add qword [rsp], 0xffffffffffb3814c
push r13
movabs rax, 0xaa0b62a8691aee83
cmp sil, 0x92
cmova r11, rsi
jl 0x1404e411b
jns 0x140472fc4
mov r13, r11
mov rax, qword [rsp + 8]
mov rax, qword [rax]
shr rsi, 0xbf
shl r13, 0xd8
shr si, 0xc2
jns 0x1402b6ae9
movabs r13, 0xb61d3e392e3aea95
cmp r13w, 0x7cb9
jl 0x1402d0464
shr sil, 0xef
or rsi, 0x2b8c0027
lea r11, [r11 + rsi*4 + 0x3fa67d22]
jae 0x1404db7f5
cmp r8w, r12w
mov rdx, r14
mov qword [rsp + 0x38], r12
jle 0x140455daf
neg r14w
lea rbp, [rbp + r14*2 + 0x2d04d6ba]
mov word [rsp + rdx + 0x2ebbdea8], 0x3026
not r8b
sub byte [rsp + r8*2 + 0x5d77bd5a], 5
and r12d, 0xa0156016
xor r14d, dword [rsp + r14 + 0x2ebb21cb]
or r8, r8
xchg qword [rsp + rdx + 0x2ebbdeb0], rbp
mov r12, qword [rsp + 0x18]
or r8b, 0x9a
call fcn.140287b04
test byte [rsp + 0x78], 0xb9
setg byte [rsp + 0x78]
or byte [rsp + 0x78], 0x9c
push qword [rsp + 0x68]
popfq
lea rsp, [rsp + 0x80]
ret
movabs r11, 0x8abfc136d4aab598
setns r11b
jo 0x14056164a
lea r11, [r11 + riz - 0x4e559dff]
or si, 0xd93f
jae 0x14048f39e
call fcn.1403c2360
or eax, 0xcde55b25
invalid

Function at 0x140591f04
Capabilities:
Get storage device properties

Disassembly:
push r14
push r9
xchg qword [rsp + 0x18], rdx
pushfq
movabs r9, 0x8c99a62eb68fcaa7
movabs r14, 0xdf900804e127a739
xor r14w, 0x7abf
sub r14d, 0xc2901f24
mov qword [rsp + 0x18], rdx
shr r14, 0x47
jae 0x1404e200b
not r9w
sub r9w, r9w
test r9w, 0xe32f
lea r9, [r14 + r14*8 - 0x73fa4b63]
call fcn.1403d565b

Function at 0x14059a612
Capabilities:
Encode data using xor

Disassembly:
shl word [rsp + rbp*2 - 0x1000030], 0x8f
jbe 0x140450907
jb 0x1403b10c3
test qword [rsp + rbp*2 - 0x1000030], 0xffffffffe5a57fb7

Function at 0x1405a5205
Capabilities:
Encode data using xor

Disassembly:
sub r13, r10
test r10w, r13w
mov r10, qword [rsp + 0x50]
call fcn.14030087b
Function at 0x1405b711e
Capabilities:
Encode data using xor

Disassembly:
mov rcx, qword [rsp + rcx + 0x21]
jne 0x140527c9e
sub dword [rsp + 0x28], 0xe223843c
neg dword [rsp + 0x28]
push qword [rsp + 0x18]
popfq
lea rsp, [rsp + 0x30]
ret

Function at 0x1405bcdbc
Capabilities:
Encode data using xor

Disassembly:
or word [rsp + 0x20], 0xb28e
push qword [rsp + 0x28]
popfq
lea rsp, [rsp + 0x48]
ret
push r12
push rbx
push r8
push r10
pushfq
movabs r12, 0xd4ad51bcdb1c25a3
movabs r8, 0xa1bda19121156a3
call fcn.1402f1d17
add dword [rsp], 0xffc6e927
cmp r9b, r14b
movsx r14d, r14b
mov r14w, 0xf6a0
js 0x14035c604
call fcn.14038ab55
or qword [rsp + r11 - 0x727ca6a], r11
xor word [rsp + r11*8 - 0x393e54a0], 0x20ab
mov r11, qword [rsp + r11 - 0x727ca92]
or qword [rsp + 0x30], 0xffffffffcfb0e49a
not word [rsp + 0x30]
cmp byte [rsp + 0x30], 9
call fcn.1402f6ac2
add qword [rsp + 0x10], 0xffffffffbfaa4767
or word [rsp + 0x20], 0xbf05
shr word [rsp + 0x20], 0x3b
jns 0x14021971a
mov qword [rsp], 0x27834d88
call fcn.140697f63
jp 0x1403d565c
invalid
jns 0x1403d567b
Function at 0x1408aa058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1408aa1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1408aa089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1408aa06f
add dl, dl
jne 0x1408aa096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1408aa0f6
xor eax, eax
add dl, dl
jne 0x1408aa0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1408aa1ad
add dl, dl
jne 0x1408aa0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1408aa0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1408aa0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1408aa0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1408aa0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1408aa07e
mov eax, 1
add dl, dl
jne 0x1408aa106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1408aa113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1408aa0fb
sub eax, ebx
mov ebx, 1
jne 0x1408aa14c
mov ecx, 1
add dl, dl
jne 0x1408aa12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1408aa13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1408aa123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1408aa07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1408aa168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1408aa175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1408aa15d
cmp eax, 0x7d00
jae 0x1408aa19b
cmp eax, 0x500
jb 0x1408aa196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1408aa07e
cmp eax, 0x7f
ja 0x1408aa19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1408aa07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1408aa1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1408aa07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x40efc0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x40f139
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [0x01349080]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.00426300
xorps xmm15, xmm15
mov r14, qword [0x013a2200]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x40f030
mov rbx, qword [rsp + 0x60]
jmp 0x40f040
add rsp, 0x48
pop rbp
ret
sub rax, rbx
add rcx, rbx
mov rbx, rax
nop
test rbx, rbx
jbe 0x40f065
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rcx
mov rax, rbx
jmp 0x40f075
cmp rbx, 0x1000
jae 0x40f036
nop dword [rax]
jmp 0x40f0e9
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
cmp rbx, 0x1000
jae 0x40f082
xor edx, edx
jmp 0x40f0e0
mov qword [rsp + 0x30], rbx
mov rax, qword [0x01349080]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.00426300
xorps xmm15, xmm15
mov r14, qword [0x013a2200]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
mov edx, eax
mov rax, qword [rsp + 0x38]
nop
test dl, dl
jne 0x40f06b
jmp 0x40f054
call fcn.0044af00
xorps xmm15, xmm15
mov r14, qword [0x013a2200]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
cmp eax, 8
jne 0x40f120
lea rax, [0x004665cd]
mov ebx, 0xd
call fcn.00428840
nop dword [rax]
cmp eax, 0x5af
je 0x40f108
lea rax, [0x00468c06]
mov ebx, 0x1f
call fcn.00428840
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00447860
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0040efc0
Function at 0x414dc0
Capabilities:
Hash data using murmur3

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x414fda
push rbp
mov rbp, rsp
sub rsp, 0x30
test rax, 7
jne 0x414fc8
mov qword [rsp + 0x40], rax
mov rdx, qword [rdi + 0x50]
test byte [rdx], al
mov r9, r8
shr r9, 3
mov r10, r8
and r10d, 7
nop
mov r11, rcx
mov rcx, r10
mov r12d, 1
shl r12d, cl
lea r10, [rdx + r9]
cmp byte [0x013a200f], 0
jne 0x414f01
cmp dword [0x013a24f0], 0
nop
jle 0x414e49
cmp qword [rdi + 0xa0], r8
ja 0x414e49
mov r8, qword [rdi + 0x48]
test byte [r8], al
movzx r8d, byte [r9 + r8]
nop
nop dword [rax + rax]
test r12b, r8b
je 0x414f78
movzx edx, byte [r9 + rdx]
test r12b, dl
jne 0x414efb
nop
lock or byte [r10], r12b
mov rcx, qword [rdi + 0x18]
movabs rdx, 0x800000000000
add rdx, rcx
mov r8, rdx
shr rdx, 0x2a
nop
nop
nop
nop word [rax + rax]
cmp rdx, 0x40
jae 0x414f6b
lea r9, [0x013743f8]
mov rdx, qword [r9 + rdx*8]
test byte [rdx], al
mov r9, rcx
shr r9, 0x10
and r9d, 0x3f
shr rcx, 0xd
and ecx, 7
mov r10d, 1
shl r10d, cl
shr r8, 0x16
and r8d, 0xfffff
mov rdx, qword [rdx + r8*8]
test byte [rdx], al
movzx r8d, byte [rdx + r9 + 0x11440]
lea rdx, [rdx + r9]
lea rdx, [rdx + 0x11440]
test r10b, r8b
jne 0x414ee0
lock or byte [rdx], r10b
movzx edx, byte [rdi + 0x6a]
test dl, 1
je 0x414f22
mov rax, qword [rsi + 0x10]
add rax, qword [rdi + 0x70]
mov qword [rsi + 0x10], rax
add rsp, 0x30
pop rbp
ret
add rsp, 0x30
pop rbp
ret
mov qword [rsp + 0x60], rsi
mov rcx, r11
mov rdi, r10
mov esi, r12d
call fcn.0040ebe0
test al, al
jne 0x414f58
mov rax, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x60]
prefetcht0 byte [rax]
mov rdx, qword [rsi]
test rdx, rdx
je 0x414f47
mov rdi, qword [rdx + 0x10]
cmp rdi, 0xfd
je 0x414f47
jae 0x414f5e
mov qword [rdx + rdi*8 + 0x18], rax
inc qword [rdx + 0x10]
jmp 0x414f52
mov rbx, rax
mov rax, rsi
call fcn.0041a3a0
add rsp, 0x30
pop rbp
ret
add rsp, 0x30
pop rbp
ret
mov rax, rdi
mov ecx, 0xfd
call fcn.00449ac0
mov rax, rdx
mov ecx, 0x40
call fcn.00449ae0
lea rax, [0x0046603e]
mov rcx, rbx
mov rdi, r11
mov ebx, 4
call fcn.00415040
lea rax, [0x00466028]
mov ebx, 3
mov rcx, qword [rsp + 0x40]
mov rdi, 0xffffffffffffffff
call fcn.00415040
mov rdx, qword [r14 + 0x30]
mov byte [rdx + 0xf9], 2
lea rax, [0x0046701a]
mov ebx, 0x13
call fcn.00428840
lea rax, [0x004692ef]
mov ebx, 0x23
call fcn.00428840
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
call fcn.00447860
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
nop dword [rax + rax]
jmp fcn.00414dc0
Function at 0x415140
Capabilities:
Hash data using murmur3

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
cmp byte [0x013a200f], 0
jne 0x415227
sub rbx, qword [rax + 0x18]
mov rdx, qword [rax + 0x50]
test byte [rdx], al
mov esi, dword [rax + 0x64]
imul rbx, rsi
mov rsi, rbx
shr rbx, 0x20
shr rsi, 0x23
and ebx, 7
mov rdi, rcx
mov rcx, rbx
mov r8d, 1
shl r8d, cl
add rdx, rsi
nop
nop
nop
nop
lock or byte [rdx], r8b
mov rcx, qword [rax + 0x18]
movabs rdx, 0x800000000000
lea rax, [rdx + rcx]
mov rdx, rax
shr rdx, 0x2a
nop
nop
nop
cmp rdx, 0x40
jae 0x41521a
lea rbx, [0x013743f8]
mov rdx, qword [rbx + rdx*8]
test byte [rdx], al
mov rbx, rcx
shr rbx, 0x10
and ebx, 0x3f
shr rcx, 0xd
and ecx, 7
mov esi, 1
shl esi, cl
shr rax, 0x16
and eax, 0xfffff
mov rax, qword [rdx + rax*8]
test byte [rax], al
movzx edx, byte [rax + rbx + 0x11440]
lea rax, [rax + rbx]
lea rax, [rax + 0x11440]
test sil, dl
jne 0x415200
lock or byte [rax], sil
mov rax, qword [r14 + 0x30]
mov rax, qword [rax + 0xa0]
test byte [rax], al
add qword [rax + 0x1250], rdi
add rsp, 0x10
pop rbp
ret
mov rax, rdx
mov ecx, 0x40
call fcn.00449ae0
lea rax, [0x00469f06]
mov ebx, 0x2c
call fcn.00428840
nop
int3

Function at 0x417000
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x417106
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x70], rcx
mov byte [rsp + 0x17], dil
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x18], 0
jmp 0x417043
mov rax, qword [rsp + 0x60]
mov rcx, rdx
mov rbx, qword [rsp + 0x68]
movzx edi, byte [rsp + 0x17]
cmp qword [rsp + 0x18], rbx
jae 0x4170fb
test byte [rax], al
lea rcx, [rax + 0x100b8]
mov ebx, edi
mov rax, rcx
nop dword [rax]
call fcn.00417bc0
test rax, rax
je 0x4170fb
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x30], xmm15
movups xmmword [rsp + 0x40], xmm15
lea rcx, [0x00417140]
mov qword [rsp + 0x20], rcx
lea rdx, [rsp + 0x18]
mov qword [rsp + 0x28], rdx
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x48], rax
lea rbx, [rsp + 0x20]
mov qword [rsp], rbx
nop dword [rax]
call fcn.00447720
xorps xmm15, xmm15
mov r14, qword [0x013a2200]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x70]
nop dword [rax]
test rdx, rdx
jne 0x4170e9
xor eax, eax
jmp 0x4170f3
mov rax, qword [rdx]
call rax
mov rdx, qword [rsp + 0x70]
test al, al
je 0x417031
mov rax, qword [rsp + 0x18]
add rsp, 0x50
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov byte [rsp + 0x20], dil
call fcn.00447860
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movzx edi, byte [rsp + 0x20]
jmp fcn.00417000
Function at 0x423220
Capabilities:
Hash data using murmur3

Disassembly:
cmp rsp, qword [r14 + 0x18]
jbe 0x4234a6
push rbp
mov rbp, rsp
sub rsp, 0x38
test byte [rax], al
mov rcx, qword [rax + 0x1268]
lea rsi, [rax + 0x1278]
sub rcx, rsi
shr rcx, 3
cmp rcx, 0x200
ja 0x42349a
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x30], rcx
mov qword [rax + 0x1268], 0
cmp byte [0x013a200f], 0
jne 0x42327a
xor edx, edx
xor ebx, ebx
jmp 0x4232c0
xor edx, edx
jmp 0x4232a5
mov qword [rsp + 0x28], rdx
mov rcx, qword [rax + rdx*8 + 0x1278]
mov rax, rcx
call fcn.00414d60
mov rdx, qword [rsp + 0x28]
inc rdx
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
cmp rdx, rcx
jl 0x42327e
add rax, 0x1268
call fcn.004231a0
add rsp, 0x38
pop rbp
ret
inc rdx
nop
cmp rdx, rcx
jge 0x423434
mov rsi, qword [rax + rdx*8 + 0x1278]
cmp rsi, 0x1000
jb 0x4232bb
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rbx
mov rax, rsi
xor ebx, ebx
mov rcx, rbx
call fcn.0040c320
test rax, rax
jne 0x42330c
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
jmp 0x4232bb
mov rsi, qword [rbx + 0x50]
test byte [rsi], al
mov r8, rcx
shr r8, 3
movzx r9d, byte [rsi + r8]
and ecx, 7
mov r10d, 1
shl r10d, cl
nop
add rsi, r8
test r10b, r9b
je 0x42334c
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
jmp 0x4232bb
nop
lock or byte [rsi], r10b
mov rcx, qword [rbx + 0x18]
movabs rsi, 0x800000000000
lea r8, [rsi + rcx]
mov r9, r8
shr r8, 0x2a
nop
nop
nop
cmp r8, 0x40
jae 0x42348d
lea r10, [0x013743f8]
mov r8, qword [r10 + r8*8]
test byte [r8], al
mov r10, rcx
shr r10, 0x10
and r10d, 0x3f
shr rcx, 0xd
and ecx, 7
mov r11d, 1
shl r11d, cl
shr r9, 0x16
and r9d, 0xfffff
mov r8, qword [r8 + r9*8]
test byte [r8], al
movzx r9d, byte [r8 + r10 + 0x11440]
lea r8, [r8 + r10]
lea r8, [r8 + 0x11440]
test r11b, r9b
jne 0x4233cf
lock or byte [r8], r11b
movzx r8d, byte [rbx + 0x6a]
test r8b, 1
je 0x423405
mov rax, qword [rsp + 0x48]
mov r8, qword [rax + 0x1250]
add r8, qword [rbx + 0x70]
mov qword [rax + 0x1250], r8
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
jmp 0x4232bb
mov r8, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
cmp r8, rcx
jae 0x423485
mov rbx, qword [rsp + 0x48]
mov qword [rbx + r8*8 + 0x1278], rax
inc r8
mov rax, rbx
mov rdx, qword [rsp + 0x28]
mov rbx, r8
jmp 0x4232bb
cmp rbx, 0x200
ja 0x423474
lea rdx, [rax + 0x1278]
lea rsi, [rax + 0x1240]
mov rcx, rbx
mov edi, 0x200
mov rbx, rdx
mov rax, rsi
call fcn.0041a4c0
mov rax, qword [rsp + 0x48]
add rax, 0x1268
call fcn.004231a0
add rsp, 0x38
pop rbp
ret
mov rcx, rbx
mov edx, 0x200
nop dword [rax]
call fcn.00449b40
mov rax, r8
call fcn.00449ac0
mov rax, r8
mov ecx, 0x40
call fcn.00449ae0
mov edx, 0x200
nop
call fcn.00449b20
nop
mov qword [rsp + 8], rax
call fcn.0044e040
mov rax, qword [rsp + 8]
jmp fcn.00423220