joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400020b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
mov eax, dword [rcx + 0x48]
lea rbx, [rcx + 0x28]
mov rsi, qword [rcx]
lea r11, [rcx + 0x28]
add rbx, rax
mov rdi, rcx
movabs rbp, 0x9e3779b185ebca87
movabs r15, 0x27d4eb2f165667c5
movabs r14, 0xc2b2ae3d27d4eb4f
movabs r12, 0x7a1435883d4d519d
cmp rsi, 0x20
jb 0x1400021ab
mov rcx, qword [rcx + 8]
mov r8, qword [rdi + 0x18]
mov r9, qword [rdi + 0x20]
mov rax, r8
mov rdx, qword [rdi + 0x10]
mov r10, r9
rol r10, 0x12
rol rax, 0xc
add r10, rax
mov rax, rdx
rol rax, 7
add r10, rax
mov rax, rcx
rol rax, 1
add r10, rax
movabs rax, 0x85ebca77c2b2ae63
imul rcx, r14
imul rdx, r14
imul r8, r14
imul r9, r14
rol rcx, 0x1f
imul rcx, rbp
rol rdx, 0x1f
xor r10, rcx
rol r8, 0x1f
imul r10, rbp
imul rdx, rbp
imul r8, rbp
sub r10, r12
rol r9, 0x1f
xor r10, rdx
imul r10, rbp
imul r9, rbp
sub r10, r12
xor r10, r8
imul r10, rbp
sub r10, r12
xor r10, r9
imul r10, rbp
add rax, r10
add rax, rsi
jmp 0x1400021b3
lea rax, [rsi + r15]
add rax, qword [rcx + 0x18]
lea rdx, [rdi + 0x30]
cmp rdx, rbx
ja 0x1400021ea
nop dword [rax]
mov rcx, qword [r11]
add rdx, 8
imul rcx, r14
add r11, 8
rol rcx, 0x1f
imul rcx, rbp
xor rax, rcx
rol rax, 0x1b
imul rax, rbp
sub rax, r12
cmp rdx, rbx
jbe 0x1400021c0
lea rdx, [r11 + 4]
movabs r8, 0x165667b19e3779f9
cmp rdx, rbx
ja 0x140002215
mov ecx, dword [r11]
mov r11, rdx
imul rcx, rbp
xor rax, rcx
rol rax, 0x17
imul rax, r14
add rax, r8
cmp r11, rbx
jae 0x14000223b
nop word [rax + rax]
movzx ecx, byte [r11]
inc r11
imul rcx, r15
xor rax, rcx
rol rax, 0xb
imul rax, rbp
cmp r11, rbx
jb 0x140002220
mov rbx, qword [rsp + 0x20]
mov rcx, rax
mov rbp, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
shr rcx, 0x21
xor rcx, rax
imul rcx, r14
mov rdx, rcx
shr rdx, 0x1d
xor rdx, rcx
imul rdx, r8
mov rax, rdx
shr rax, 0x20
xor rax, rdx
pop r15
pop r14
pop r12
ret

Function at 0x14000a350
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x250
mov rax, qword [0x14002a008]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rdi, r8
lea rax, [rsp + 0x30]
mov rbx, rcx
mov qword [rsp + 0x20], rax
xor r8d, r8d
xor ecx, ecx
xor r9d, r9d
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
je 0x14000a395
xor al, al
jmp 0x14000a3e2
cmp word [rbx], 0
je 0x14000a3ad
nop dword [rax + rax]
add rbx, 2
dec rdi
cmp word [rbx], 0
jne 0x14000a3a0
cmp word [rsp + 0x30], 0
je 0x14000a3db
lea rcx, [rsp + 0x30]
sub rcx, rbx
nop dword [rax]
cmp rdi, 1
jb 0x14000a403
movzx eax, word [rcx + rbx]
dec rdi
mov word [rbx], ax
add rbx, 2
cmp word [rcx + rbx], 0
jne 0x14000a3c0
xor eax, eax
mov word [rbx], ax
mov al, 1
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.14000b560
mov rbx, qword [rsp + 0x270]
add rsp, 0x250
pop rdi
ret
call fcn.14000d7c0
int3
Function at 0x14000aba0
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x2030
call fcn.14001c7f0
sub rsp, rax
mov rax, qword [0x14002a008]
xor rax, rsp
mov qword [rsp + 0x2020], rax
mov r11d, dword [0x14002bd10]
lea rsi, [0x140030d50]
mov rdi, rcx
test r11d, r11d
jne 0x14000ac19
mov r8d, 0x1000
lea rdx, str._HOME_
lea rcx, [rsp + 0x20]
call fcn.14000a410
test al, al
je 0x14000acff
lea rcx, [rsp + 0x20]
call fcn.1400111d8
movsxd r11, dword [0x14002bd10]
mov qword [rsi + r11*8], rax
inc r11d
mov dword [0x14002bd10], r11d
xor r9d, r9d
test r11d, r11d
jle 0x14000ac54
mov r10, rsi
mov r8, qword [r10]
mov rax, rdi
sub r8, rdi
nop dword [rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x14000ac44
add rax, 2
test ecx, ecx
jne 0x14000ac30
test edx, edx
je 0x14000ac77
inc r9d
add r10, 8
cmp r9d, r11d
jl 0x14000ac24
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rdi + rax*2], 0
jne 0x14000ac60
cmp rax, 2
jne 0x14000ac7b
cmp word [rdi + 2], 0x3a
jne 0x14000ac7b
mov al, 1
jmp 0x14000acde
xor edx, edx
mov qword [rsp + 0x2048], rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
setne bl
test eax, eax
jne 0x14000aca8
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x14000aca8
mov bl, 1
jmp 0x14000acac
test bl, bl
je 0x14000acd3
cmp dword [0x14002bd10], 0x400
jge 0x14000acd3
mov rcx, rdi
call fcn.1400111d8
movsxd rdx, dword [0x14002bd10]
mov qword [rsi + rdx*8], rax
inc edx
mov dword [0x14002bd10], edx
movzx eax, bl
mov rbx, qword [rsp + 0x2048]
mov rcx, qword [rsp + 0x2020]
xor rcx, rsp
call fcn.14000b560
mov rsi, qword [rsp + 0x2050]
add rsp, 0x2030
pop rdi
ret
lea rcx, str._HOME_
call fcn.14000aa40
int3
Function at 0x14000ae20
Capabilities:
Check if file exists
Delete file
Get file attributes
Terminate process

Disassembly:
sub rsp, 0x68
mov rcx, qword [0x14002bd18]
test rcx, rcx
je 0x14000ae5b
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x14000ae4e
mov rcx, qword [0x14002bd18]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [0x14002bd18]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [0x140032d68], 0
je 0x14000af4e
mov qword [rsp + 0x70], rbx
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x78], rbp
lea rbp, [0x140025998]
mov qword [rsp + 0x80], rsi
lea rsi, [0x14002e550]
mov qword [rsp + 0x88], rdi
xor edi, edi
mov qword [rsp + 0x60], r14
mov r14d, 0x414
mov word [rsp + 0x40], r14w
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rbp
mov dword [rsp + 0x44], edi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], rbp
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
mov ebx, edi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14000af2f
test al, 0x10
je 0x14000af2f
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rbp
mov word [rsp + 0x40], r14w
mov dword [rsp + 0x44], edi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], rbp
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
inc ebx
cmp ebx, 0x14
jl 0x14000aed5
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
mov r14, qword [rsp + 0x60]
add rsp, 0x68
ret
Function at 0x140011190
Capabilities:
Enumerate process modules

Disassembly:
jmp 0x140011bd0
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rbp
push rsi
push rdi
sub rsp, 0x430
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0xa4
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x458]
mov rax, qword [0x14001e008]
xor rax, rbp
mov qword [rbp + 0x408], rax
lea rcx, [0x14002401d]
call fcn.140011429
lea rax, [rbp + 0x10]
lea rcx, str._unknown_
mov rdi, rax
mov rsi, rcx
mov ecx, 0x14
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x24]
mov rdi, rax
xor eax, eax
mov ecx, 0x1f4
rep stosb byte [rdi], al
mov r8d, dword [rbp + 0x430]
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rbp + 0x238], rax
cmp qword [rbp + 0x238], 0
je 0x140011cab
lea r9, [rbp + 0x274]
mov r8d, 8
lea rdx, [rbp + 0x258]
mov rcx, qword [rbp + 0x238]
call fcn.140011073
test eax, eax
je 0x140011cab
mov r9d, 0x104
lea r8, [rbp + 0x10]
mov rdx, qword [rbp + 0x258]
mov rcx, qword [rbp + 0x238]
call fcn.14001146f
mov eax, 2
imul rax, rax, 0
movzx eax, word [rbp + rax + 0x10]
cmp eax, 0x53
jne 0x140011d2d
mov eax, 2
imul rax, rax, 6
movzx eax, word [rbp + rax + 0x10]
cmp eax, 0x44
jne 0x140011d2d
mov eax, 2
imul rax, rax, 7
movzx eax, word [rbp + rax + 0x10]
cmp eax, 0x2e
jne 0x140011d2d
cmp qword [rbp + 0x238], 0
je 0x140011cfb
mov rcx, qword [rbp + 0x238]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, dword [rbp + 0x430]
xor edx, edx
mov ecx, 0x43a
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rbp + 0x238], rax
cmp qword [rbp + 0x238], 0
jne 0x140011d24
xor eax, eax
jmp 0x140011d46
mov rax, qword [rbp + 0x238]
jmp 0x140011d46
cmp qword [rbp + 0x238], 0
je 0x140011d44
mov rcx, qword [rbp + 0x238]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x14001ad20]
call fcn.1400113a2
mov rax, rdi
mov rcx, qword [rbp + 0x408]
xor rcx, rbp
call fcn.140011212
lea rsp, [rbp + 0x410]
pop rdi
pop rsi
pop rbp
ret

Function at 0x14001125d
Capabilities:
Terminate process

Disassembly:
jmp 0x140013870
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x1400112fd
Capabilities:
Parse pe header

Disassembly:
jmp 0x140014bc0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140014be0
xor al, al
jmp 0x140014c61
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140014bf3
xor al, al
jmp 0x140014c61
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140014c1d
xor al, al
jmp 0x140014c61
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140014c31
xor al, al
jmp 0x140014c61
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140014c43
xor al, al
jmp 0x140014c61
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140014c5f
xor al, al
jmp 0x140014c61
mov al, 1
add rsp, 0x38
ret
Function at 0x140011307
Capabilities:
Enumerate process modules

Disassembly:
jmp 0x140011960
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x4b8
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0xc6
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x4d8]
mov rax, qword [0x14001e008]
xor rax, rbp
mov qword [rbp + 0x488], rax
lea rcx, [0x14002401d]
call fcn.140011429
mov qword [rbp + 8], 0
cmp qword [rbp + 0x4b0], 0
je 0x140011b1f
lea r9, [rbp + 0x64]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0x4b0]
call fcn.140011073
test eax, eax
je 0x140011b1f
cmp dword [rbp + 0x64], 0
je 0x140011b1f
mov eax, dword [rbp + 0x64]
mov edx, eax
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x48], 0
je 0x140011b1f
mov eax, dword [rbp + 0x64]
xor edx, edx
mov ecx, 8
div rcx
mov dword [rbp + 0x2b4], eax
mov rax, qword [rbp + 0x48]
mov qword [rbp + 0x28], rax
lea r9, [rbp + 0x64]
mov r8d, dword [rbp + 0x64]
mov rdx, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x4b0]
call fcn.140011073
test eax, eax
je 0x140011b15
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rbp + 0x28]
mov rax, qword [rcx + rax]
mov qword [rbp + 8], rax
mov rdx, qword [rbp + 8]
lea rcx, str._016llx_n
call fcn.1400111f9
mov dword [rbp + 0x2d4], 0
jmp 0x140011a7f
mov eax, dword [rbp + 0x2d4]
inc eax
mov dword [rbp + 0x2d4], eax
mov eax, dword [rbp + 0x2b4]
cmp dword [rbp + 0x2d4], eax
jae 0x140011b15
movsxd rax, dword [rbp + 0x2d4]
mov r9d, 0x104
lea r8, [rbp + 0x90]
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rcx + rax*8]
mov rcx, qword [rbp + 0x4b0]
call fcn.1400111c2
test eax, eax
je 0x140011b10
lea rcx, [rbp + 0x90]
call qword [sym.imp.ucrtbased.dll_wcslen]
mov dword [rbp + 0x2f4], eax
mov eax, dword [rbp + 0x2f4]
sub eax, 5
cdqe
movzx eax, word [rbp + rax*2 + 0x90]
cmp eax, 0x44
jne 0x140011b10
mov eax, dword [rbp + 0x2f4]
dec eax
cdqe
movzx eax, word [rbp + rax*2 + 0x90]
cmp eax, 0x6c
jne 0x140011b10
movsxd rax, dword [rbp + 0x2d4]
mov rcx, qword [rbp + 0x28]
mov rax, qword [rcx + rax*8]
jmp 0x140011b23
jmp 0x140011a71
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rax, qword [rbp + 8]
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x14001ae10]
call fcn.1400113a2
mov rax, rdi
mov rcx, qword [rbp + 0x488]
xor rcx, rbp
call fcn.140011212
lea rsp, [rbp + 0x498]
pop rdi
pop rbp
ret
Function at 0x415b20
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x415cc6
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00431be0
xorps xmm15, xmm15
mov r14, qword [0x005de7b0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x415b8b
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x415ba0
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
nop
test rbx, rbx
jbe 0x415bc5
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x415bd9
cmp rbx, 0x1000
jae 0x415b95
nop dword [rax]
jmp 0x415c49
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop
cmp rbx, 0x1000
jae 0x415bed
xor edx, edx
jmp 0x415c40
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00431be0
xorps xmm15, xmm15
mov r14, qword [0x005de7b0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
nop dword [rax]
test dl, dl
jne 0x415bcf
jmp 0x415bb4
call fcn.004617e0
xorps xmm15, xmm15
mov r14, qword [0x005de7b0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.00436120
lea rax, [0x004d6f66]
mov ebx, 0x18
call fcn.00436a20
mov rax, qword [rsp + 0x38]
call fcn.00436720
lea rax, [0x004d7026]
mov ebx, 0x19
call fcn.00436a20
mov rax, qword [rsp + 0x30]
nop
call fcn.00436720
call fcn.00436380
call fcn.004361a0
lea rax, [0x004d9241]
mov ebx, 0x21
nop dword [rax + rax]
call fcn.004347e0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045dc40
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.00415b20
Function at 0x415d00
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x415f2a
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.00431c60
xorps xmm15, xmm15
mov r14, qword [0x005de7b0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x415d79
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x415d8c
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x415db0
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
nop
jmp 0x415dc4
cmp rbx, 0x1000
jae 0x415d83
jmp 0x415e45
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x415dd6
xor esi, esi
jmp 0x415e36
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
nop dword [rax]
call fcn.00431c60
xorps xmm15, xmm15
mov r14, qword [0x005de7b0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x415dba
nop
jmp 0x415da2
call fcn.004617e0
xorps xmm15, xmm15
mov r14, qword [0x005de7b0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x415ec5
call fcn.00436120
lea rax, [0x004d73f5]
mov ebx, 0x19
call fcn.00436a20
mov rax, qword [rsp + 0x68]
call fcn.00436720
lea rax, [0x004d7026]
mov ebx, 0x19
call fcn.00436a20
mov eax, dword [rsp + 0x34]
nop dword [rax]
call fcn.00436720
call fcn.00436380
call fcn.004361a0
lea rax, [0x004d3e78]
mov ebx, 0xd
nop dword [rax + rax]
call fcn.004347e0
cmp eax, 0x5af
je 0x415e68
call fcn.00436120
lea rax, [0x004d73f5]
mov ebx, 0x19
nop dword [rax]
call fcn.00436a20
mov rax, qword [rsp + 0x38]
call fcn.00436720
lea rax, [0x004d7026]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.00436a20
mov eax, dword [rsp + 0x34]
call fcn.00436720
call fcn.00436380
call fcn.004361a0
lea rax, [0x004d8af3]
mov ebx, 0x1f
call fcn.004347e0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045dc40
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00415d00
Function at 0x41e1e0
Capabilities:
Hash data using murmur3

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
cmp byte [0x005de5d2], 0
jne 0x41e2cf
mov rdx, qword [rax + 0x50]
test byte [rdx], al
nop
nop
nop
sub rbx, qword [rax + 0x18]
mov esi, dword [rax + 0x5c]
imul rbx, rsi
mov rsi, rbx
shr rbx, 0x20
shr rsi, 0x23
and ebx, 7
mov rdi, rcx
mov rcx, rbx
mov r8d, 1
shl r8d, cl
add rdx, rsi
lock or byte [rdx], r8b
nop
nop
mov rcx, qword [rax + 0x18]
nop
movabs rdx, 0x800000000000
lea rax, [rdx + rcx]
mov rdx, rax
shr rax, 0x2a
cmp rax, 0x40
jae 0x41e2c5
lea rbx, [0x005b0a10]
mov rax, qword [rbx + rax*8]
shr rdx, 0x16
and edx, 0xfffff
mov rdx, qword [rax + rdx*8]
test byte [rdx], al
test byte [rax], al
mov rax, rcx
shr rcx, 0x10
and ecx, 0x3f
movzx ebx, byte [rdx + rcx + 0x11440]
lea rsi, [rcx + 0x11440]
add rdx, rsi
shr rax, 0xd
and eax, 7
mov rcx, rax
mov eax, 1
shl eax, cl
nop
test al, bl
jne 0x41e2a7
lock or byte [rdx], al
mov rax, qword [r14 + 0x30]
mov rax, qword [rax + 0xa0]
test byte [rax], al
add qword [rax + 0x1248], rdi
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov ecx, 0x40
call fcn.004602c0
lea rax, [0x004daca8]
mov ebx, 0x2c
nop dword [rax + rax]
call fcn.004347e0
nop
int3

Function at 0x4206c0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4207be
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rbx
mov qword [rsp + 8], 0
jmp 0x420700
mov rax, qword [rsp + 0x50]
mov rcx, rdx
mov rbx, qword [rsp + 0x58]
nop
cmp qword [rsp + 8], rbx
jae 0x4207af
test byte [rax], al
lea rcx, [rax + 0x100b8]
mov rax, rcx
call fcn.00421260
nop dword [rax]
test rax, rax
je 0x4207af
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x30], xmm15
lea rcx, [0x00420800]
mov qword [rsp + 0x10], rcx
lea rdx, [rsp + 8]
mov qword [rsp + 0x18], rdx
mov rdx, qword [rsp + 0x50]
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rbx
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x38], rax
lea rbx, [rsp + 0x10]
mov qword [rsp], rbx
call fcn.0045db00
xorps xmm15, xmm15
mov r14, qword [0x005de7b0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x60]
test rdx, rdx
jne 0x42079d
xor eax, eax
jmp 0x4207a7
mov rax, qword [rdx]
call rax
mov rdx, qword [rsp + 0x60]
test al, al
je 0x4206f2
mov rax, qword [rsp + 8]
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.0045dc40
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.004206c0
Function at 0x42e060
Capabilities:
Hash data using murmur3

Disassembly:
cmp rsp, qword [r14 + 0x18]
jbe 0x42e306
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
test byte [rax], al
lea rsi, [rax + 0x1270]
mov rcx, qword [rax + 0x1260]
sub rcx, rsi
shr rcx, 3
cmp rcx, 0x200
ja 0x42e2fa
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x30], rcx
mov qword [rax + 0x1260], 0
cmp byte [0x005de5d2], 0
jne 0x42e0c2
xor edx, edx
xor ebx, ebx
nop
jmp 0x42e10a
xor edx, edx
jmp 0x42e0ed
mov qword [rsp + 0x28], rdx
mov rcx, qword [rax + rdx*8 + 0x1270]
mov rax, rcx
call fcn.0041da00
mov rdx, qword [rsp + 0x28]
inc rdx
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
cmp rdx, rcx
jl 0x42e0c6
add rax, 0x1260
call fcn.0042df20
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
inc rdx
cmp rdx, rcx
jge 0x42e294
mov rsi, qword [rax + rdx*8 + 0x1270]
nop dword [rax + rax]
cmp rsi, 0x1000
jb 0x42e107
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rbx
mov rax, rsi
xor ebx, ebx
mov rcx, rbx
nop dword [rax + rax]
call fcn.00412aa0
test rax, rax
jne 0x42e162
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
nop
jmp 0x42e107
mov rsi, qword [rbx + 0x50]
test byte [rsi], al
nop
mov r8, rcx
shr rcx, 3
movzx r9d, byte [rsi + rcx]
and r8d, 7
mov rdx, rcx
mov rcx, r8
mov r10d, 1
shl r10d, cl
add rsi, rdx
test r10b, r9b
je 0x42e1a9
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
jmp 0x42e107
nop
lock or byte [rsi], r10b
nop
nop
mov rcx, qword [rbx + 0x18]
nop
movabs rsi, 0x800000000000
lea r8, [rsi + rcx]
mov r9, r8
shr r8, 0x2a
cmp r8, 0x40
jae 0x42e2ed
lea r10, [0x005b0a10]
mov r8, qword [r10 + r8*8]
shr r9, 0x16
and r9d, 0xfffff
mov r9, qword [r8 + r9*8]
test byte [r9], al
test byte [r8], al
mov r8, rcx
shr rcx, 0x10
and ecx, 0x3f
movzx r10d, byte [r9 + rcx + 0x11440]
lea r11, [rcx + 0x11440]
add r9, r11
shr r8, 0xd
and r8d, 7
mov rcx, r8
mov r8d, 1
shl r8d, cl
test r8b, r10b
jne 0x42e22e
lock or byte [r9], r8b
movzx r8d, byte [rbx + 0x62]
test r8b, 1
je 0x42e265
mov rax, qword [rsp + 0x48]
mov r8, qword [rax + 0x1248]
add r8, qword [rbx + 0x68]
mov qword [rax + 0x1248], r8
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
nop
jmp 0x42e107
mov r8, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
cmp r8, rcx
jae 0x42e2e5
mov rbx, qword [rsp + 0x48]
mov qword [rbx + r8*8 + 0x1270], rax
inc r8
mov rax, rbx
mov rdx, qword [rsp + 0x28]
mov rbx, r8
jmp 0x42e107
cmp rbx, 0x200
ja 0x42e2d8
lea rdx, [rax + 0x1270]
lea rsi, [rax + 0x1238]
mov rcx, rbx
mov edi, 0x200
mov rbx, rdx
mov rax, rsi
call fcn.00423b20
mov rax, qword [rsp + 0x48]
add rax, 0x1260
call fcn.0042df20
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov rcx, rbx
mov edx, 0x200
call fcn.00460320
mov rax, r8
call fcn.004602a0
mov rax, r8
mov ecx, 0x40
call fcn.004602c0
mov edx, 0x200
nop
call fcn.00460300
nop
mov qword [rsp + 8], rax
call fcn.00462680
mov rax, qword [rsp + 8]
jmp fcn.0042e060