joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140005080
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x1400050b3
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rcx, rax
mov qword [rsp + 0x30], rbx
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x1400050f6
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r11d, eax
add r11, rbx
and edi, 0xf
jbe 0x1400050f1
cmp rbx, r11
jae 0x1400050f6
dec edi
movzx eax, word [rbx]
lea rbx, [rbx + rax*2 + 2]
jne 0x1400050e0
cmp rbx, r11
jb 0x1400050fa
xor eax, eax
jmp 0x140005106
xor eax, eax
cmp word [rbx], ax
cmove rbx, rax
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140005f93
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x140016060]
jne 0x14000549a
rol rcx, 0x10
test cx, 0xffff
jne 0x140005496
repz ret
ror rcx, 0x10
jmp 0x140005eec
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x140017620]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x140017718]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x140005f71
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x140017620]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x140005f93
mov rax, qword [rsp + 0x88]
mov qword [0x140017718], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x1400176b8], rax
mov rax, qword [0x140017718]
mov qword [0x140017590], rax
mov rax, qword [rsp + 0x90]
mov qword [0x1400176a0], rax
mov dword [0x140017580], 0xc0000409
mov dword [0x140017584], 1
mov rax, qword [0x140016060]
mov qword [rsp + 0x68], rax
mov rax, qword [0x140016068]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x140017618], eax
mov ecx, 1
call fcn.14000a7ec
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x140011588]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x140017618], 0
jne 0x14000601a
mov ecx, 1
call fcn.14000a7ec
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x14000ba18
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [0x140016060]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.140006dc0
xor ebx, ebx
cmp qword [0x140018578], rbx
mov rdi, rax
jne 0x14000bb2b
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x14000bc02
lea rdx, str.MessageBoxW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000bc02
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x140018578], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x140018580], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetUserObjectInformationW
mov rcx, rsi
mov qword [0x140018588], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov r11, rax
mov qword [0x140018598], rax
test rax, rax
je 0x14000bb22
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x140018590], rax
jmp 0x14000bb32
mov rax, qword [0x140018590]
jmp 0x14000bb39
mov rax, qword [0x140018590]
mov r11, qword [0x140018598]
cmp rax, rdi
je 0x14000bba0
cmp r11, rdi
je 0x14000bba0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rcx, qword [0x140018598]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov r12, rax
test rsi, rsi
je 0x14000bba0
test rax, rax
je 0x14000bba0
call rsi
test rax, rax
je 0x14000bb9a
lea rcx, [rsp + 0x30]
mov r9d, 0xc
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x14000bb9a
test byte [rsp + 0x40], 1
jne 0x14000bba0
bts ebp, 0x15
jmp 0x14000bbe0
mov rcx, qword [0x140018580]
cmp rcx, rdi
je 0x14000bbe0
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x14000bbe0
call rax
mov rbx, rax
test rax, rax
je 0x14000bbe0
mov rcx, qword [0x140018588]
cmp rcx, rdi
je 0x14000bbe0
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x14000bbe0
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x140018578]
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x14000bc02
mov r9d, ebp
mov r8, r14
mov rdx, r13
mov rcx, rbx
call rax
jmp 0x14000bc04
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140005480
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14000e12c
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x38
cmp dword [0x140018678], 0
je 0x14000e20a
cmp qword [0x140018650], 0
je 0x14000e14c
call fcn.14000e0e4
lea rax, [rsp + 0x50]
lea rdx, str.Control_PanelDesktop
mov r9d, 1
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14000e20a
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x40]
lea rdx, [0x140017350]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x48]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x40], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14000e1ff
cmp dword [rsp + 0x48], eax
je 0x14000e1ff
lea rcx, [0x140017368]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x140018650], rax
test rax, rax
je 0x14000e1ff
lea rdx, [0x140017378]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140018658], rax
test rax, rax
je 0x14000e1fa
mov ecx, 1
call fcn.14000e090
jmp 0x14000e1ff
call fcn.14000e0e4
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x38
ret
Function at 0x14000e354
Capabilities:
Check for unmoving mouse cursor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
cmp dword [0x140018640], 0
mov rbp, r9
mov rdi, r8
mov ebx, edx
mov rsi, rcx
jne 0x14000e402
cmp dword [0x140018644], 0
jne 0x14000e402
cmp edx, 0x10
je 0x14000e51b
cmp edx, 0x8000
je 0x14000e4f5
cmp dword [0x140018648], 0
jne 0x14000e402
mov eax, 0x104
cmp edx, eax
ja 0x14000e428
je 0x14000e477
cmp edx, 0x18
je 0x14000e3f5
cmp edx, 0x1c
je 0x14000e3ed
cmp edx, 0x20
je 0x14000e3de
cmp edx, 0x48
je 0x14000e3d5
cmp edx, 0x100
jmp 0x14000e475
cmp r8, 3
jmp 0x14000e475
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetCursor]
mov eax, 1
jmp 0x14000e413
test r8, r8
jmp 0x14000e475
test r8d, r8d
je 0x14000e402
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetCursor]
mov r9, rbp
mov r8, rdi
mov edx, ebx
mov rcx, rsi
call qword [sym.imp.USER32.dll_DefWindowProcA]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov ecx, edx
sub ecx, 0x200
je 0x14000e48f
mov eax, 1
sub ecx, eax
je 0x14000e477
sub ecx, 3
je 0x14000e477
sub ecx, 3
je 0x14000e477
cmp ecx, 0x11
jne 0x14000e402
test r8, r8
je 0x14000e413
cmp r8, 5
jbe 0x14000e477
cmp r8, 8
jbe 0x14000e472
cmp r8, 0xa
je 0x14000e402
cmp r8, 0x12
je 0x14000e472
cmp r8, 0x8013
jne 0x14000e477
jmp 0x14000e402
test al, r9b
jne 0x14000e402
xor r9d, r9d
xor r8d, r8d
mov rcx, rsi
lea edx, [r9 + 0x10]
call qword [sym.imp.USER32.dll_PostMessageA]
jmp 0x14000e402
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov r11d, dword [rsp + 0x20]
sub r11d, dword [0x140019918]
je 0x14000e4b0
test r11d, r11d
jns 0x14000e4b0
neg r11d
mov eax, dword [rsp + 0x24]
sub eax, dword [0x14001991c]
je 0x14000e4c2
test eax, eax
jns 0x14000e4c2
neg eax
add eax, r11d
cmp eax, dword [0x14001738c]
jbe 0x14000e402
xor r9d, r9d
xor r8d, r8d
mov rcx, rsi
lea edx, [r9 + 0x10]
call qword [sym.imp.USER32.dll_PostMessageA]
mov r11, qword [rsp + 0x20]
mov qword [0x140019918], r11
jmp 0x14000e402
cmp dword [0x140018678], 0
je 0x14000e402
mov rax, qword [0x140018658]
test rax, rax
je 0x14000e3e6
call rax
cdqe
jmp 0x14000e413
cmp dword [0x140018678], 0
je 0x14000e402
call fcn.14000e210
test eax, eax
jne 0x14000e402
lea rcx, [0x140019918]
call qword [sym.imp.USER32.dll_GetCursorPos]
xor eax, eax
jmp 0x14000e413
Function at 0x416e60
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x416feb
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00435320
xorps xmm15, xmm15
mov r14, qword [0x006a8628]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x416ec5
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x416ed4
add rsp, 0x48
pop rbp
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x416ef3
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x416f03
cmp rbx, 0x1000
jae 0x416ecb
jmp 0x416f6d
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x416f15
xor edx, edx
jmp 0x416f64
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00435320
xorps xmm15, xmm15
mov r14, qword [0x006a8628]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x416ef9
jmp 0x416ee8
call fcn.004690a0
xorps xmm15, xmm15
mov r14, qword [0x006a8628]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.004395a0
lea rax, [0x005357ae]
mov ebx, 0x18
nop dword [rax]
call fcn.00439e20
mov rax, qword [rsp + 0x38]
call fcn.00439b60
lea rax, [0x00535c9d]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.00439e20
mov rax, qword [rsp + 0x30]
call fcn.00439b60
call fcn.004397e0
call fcn.00439600
lea rax, [0x0053837b]
mov ebx, 0x21
call fcn.00437b00
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00465920
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00416e60
Function at 0x417020
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x417246
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.004353a0
xorps xmm15, xmm15
mov r14, qword [0x006a8628]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x417093
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x4170a2
add rsp, 0x50
pop rbp
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x4170c5
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x4170d5
cmp rbx, 0x1000
jae 0x417099
nop
jmp 0x417158
add rsp, 0x50
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop word [rax + rax]
cmp rbx, 0x1000
jae 0x4170ed
xor esi, esi
jmp 0x41714a
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.004353a0
xorps xmm15, xmm15
mov r14, qword [0x006a8628]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x4170cb
jmp 0x4170b6
call fcn.004690a0
xorps xmm15, xmm15
mov r14, qword [0x006a8628]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x4171e0
nop dword [rax + rax]
call fcn.004395a0
lea rax, [0x00535cb6]
mov ebx, 0x19
call fcn.00439e20
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
call fcn.00439b60
lea rax, [0x00535c9d]
mov ebx, 0x19
call fcn.00439e20
mov eax, dword [rsp + 0x34]
call fcn.00439b60
nop
call fcn.004397e0
call fcn.00439600
lea rax, [0x005320ea]
mov ebx, 0xd
call fcn.00437b00
nop dword [rax + rax]
cmp eax, 0x5af
je 0x417180
call fcn.004395a0
lea rax, [0x00535cb6]
mov ebx, 0x19
call fcn.00439e20
mov rax, qword [rsp + 0x38]
call fcn.00439b60
lea rax, [0x00535c9d]
mov ebx, 0x19
call fcn.00439e20
mov eax, dword [rsp + 0x34]
nop dword [rax]
call fcn.00439b60
call fcn.004397e0
call fcn.00439600
lea rax, [0x00537b47]
mov ebx, 0x1f
nop dword [rax + rax]
call fcn.00437b00
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00465920
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.00417020
Function at 0x421020
Capabilities:
Hash data using murmur3

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
cmp byte [0x006a83f5], 0
jne 0x421110
sub rbx, qword [rax + 0x18]
mov rdx, qword [rax + 0x48]
test byte [rdx], al
mov ecx, dword [rax + 0x5c]
imul rcx, rbx
mov rbx, rcx
shr rbx, 0x20
shr rcx, 0x23
and ebx, 7
mov rsi, rcx
mov rcx, rbx
mov edi, 1
shl edi, cl
add rdx, rsi
nop
nop
nop
nop
lock or byte [rdx], dil
mov rcx, qword [rax + 0x18]
movabs rdx, 0x800000000000
add rdx, rcx
mov rbx, rdx
shr rdx, 0x2a
nop
nop
nop
cmp rdx, 0x40
jae 0x421103
lea rsi, [0x0063a4f8]
mov rdx, qword [rsi + rdx*8]
test byte [rdx], al
mov rsi, rcx
shr rsi, 0x10
and esi, 0x3f
shr rcx, 0xd
and ecx, 7
mov edi, 1
shl edi, cl
shr rbx, 0x16
and ebx, 0xfffff
mov rdx, qword [rdx + rbx*8]
test byte [rdx], al
movzx ebx, byte [rdx + rsi + 0x1040]
lea rdx, [rdx + rsi]
lea rdx, [rdx + 0x1040]
test dil, bl
jne 0x4210de
lock or byte [rdx], dil
mov rcx, qword [r14 + 0x30]
mov rcx, qword [rcx + 0xa0]
test byte [rcx], al
mov rdx, qword [rcx + 0x1270]
add rdx, qword [rax + 0x68]
mov qword [rcx + 0x1270], rdx
add rsp, 0x10
pop rbp
ret
mov rax, rdx
mov ecx, 0x40
call fcn.00467c20
lea rax, [0x0053a7ed]
mov ebx, 0x2c
nop dword [rax]
call fcn.00437b00
nop
int3

Function at 0x423560
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x423666
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov byte [rsp + 0x70], dil
mov qword [rsp + 0x10], 0
jmp 0x4235a3
mov rax, qword [rsp + 0x58]
mov rcx, rdx
mov rbx, qword [rsp + 0x60]
movzx edi, byte [rsp + 0x70]
cmp qword [rsp + 0x10], rbx
jae 0x42365b
test byte [rax], al
lea rcx, [rax + 0x100b8]
mov ebx, edi
mov rax, rcx
nop dword [rax]
call fcn.00424340
test rax, rax
je 0x42365b
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
lea rcx, [0x004236a0]
mov qword [rsp + 0x18], rcx
lea rdx, [rsp + 0x10]
mov qword [rsp + 0x20], rdx
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x40], rax
lea rbx, [rsp + 0x18]
mov qword [rsp], rbx
nop dword [rax]
call fcn.00465800
xorps xmm15, xmm15
mov r14, qword [0x006a8628]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x68]
nop dword [rax]
test rdx, rdx
jne 0x423649
xor eax, eax
jmp 0x423653
mov rax, qword [rdx]
call rax
mov rdx, qword [rsp + 0x68]
test al, al
je 0x423591
mov rax, qword [rsp + 0x10]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov byte [rsp + 0x20], dil
call fcn.00465920
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movzx edi, byte [rsp + 0x20]
jmp fcn.00423560
Function at 0x430100
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4301f9
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rax + 0x108], 0
mov ecx, dword [0x006a8a30]
test ecx, ecx
je 0x4301d2
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x10], 0
lea rcx, [rsp + 0x60]
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x30], xmm15
movups xmmword [rsp + 0x40], xmm15
lea rdx, [0x00430220]
mov qword [rsp + 0x18], rdx
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], rcx
mov rcx, r14
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x10]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], 3
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x18]
mov qword [rsp], rcx
call fcn.00465800
xorps xmm15, xmm15
mov r14, qword [0x006a8628]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x10]
cmp rax, 0x20
jge 0x4301cc
jae 0x4301ee
mov rcx, qword [rsp + 0x60]
mov qword [rcx + rax*8 + 8], 0
add rsp, 0x50
pop rbp
ret
lea rcx, [fcn.00444ca0]
inc rcx
mov qword [rax + 8], rcx
mov qword [rax + 0x10], 0
add rsp, 0x50
pop rbp
ret
mov ecx, 0x20
call fcn.00467c00
nop
mov qword [rsp + 8], rax
nop
call fcn.00465920
mov rax, qword [rsp + 8]
jmp fcn.00430100
Function at 0x432180
Capabilities:
Hash data using murmur3

Disassembly:
cmp rsp, qword [r14 + 0x18]
jbe 0x432406
push rbp
mov rbp, rsp
sub rsp, 0x38
test byte [rax], al
lea rsi, [rax + 0x1298]
mov rcx, qword [rax + 0x1288]
sub rcx, rsi
shr rcx, 3
cmp rcx, 0x200
ja 0x4323fa
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x30], rcx
mov qword [rax + 0x1288], 0
cmp byte [0x006a83f5], 0
jne 0x4321da
xor edx, edx
xor ebx, ebx
jmp 0x432220
xor edx, edx
jmp 0x432205
mov qword [rsp + 0x28], rdx
mov rcx, qword [rax + rdx*8 + 0x1298]
mov rax, rcx
call fcn.00420880
mov rdx, qword [rsp + 0x28]
inc rdx
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
cmp rdx, rcx
jl 0x4321de
add rax, 0x1288
call fcn.00432100
add rsp, 0x38
pop rbp
ret
inc rdx
nop
cmp rdx, rcx
jge 0x432394
mov rsi, qword [rax + rdx*8 + 0x1298]
cmp rsi, 0x1000
jb 0x43221b
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rbx
mov rax, rsi
xor ebx, ebx
mov rcx, rbx
call fcn.00414140
test rax, rax
jne 0x43226c
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
jmp 0x43221b
mov rsi, qword [rbx + 0x48]
test byte [rsi], al
mov r8, rcx
shr r8, 3
movzx r9d, byte [rsi + r8]
and ecx, 7
mov r10d, 1
shl r10d, cl
nop
add rsi, r8
test r10b, r9b
je 0x4322ac
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
jmp 0x43221b
nop
lock or byte [rsi], r10b
mov rcx, qword [rbx + 0x18]
movabs rsi, 0x800000000000
lea r8, [rsi + rcx]
mov r9, r8
shr r8, 0x2a
nop
nop
nop
cmp r8, 0x40
jae 0x4323ed
lea r10, [0x0063a4f8]
mov r8, qword [r10 + r8*8]
test byte [r8], al
mov r10, rcx
shr r10, 0x10
and r10d, 0x3f
shr rcx, 0xd
and ecx, 7
mov r11d, 1
shl r11d, cl
shr r9, 0x16
and r9d, 0xfffff
mov r8, qword [r8 + r9*8]
test byte [r8], al
movzx r9d, byte [r8 + r10 + 0x1040]
lea r8, [r8 + r10]
lea r8, [r8 + 0x1040]
test r11b, r9b
jne 0x43232f
lock or byte [r8], r11b
movzx r8d, byte [rbx + 0x62]
test r8b, 1
je 0x432365
mov rax, qword [rsp + 0x48]
mov r8, qword [rax + 0x1270]
add r8, qword [rbx + 0x68]
mov qword [rax + 0x1270], r8
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
jmp 0x43221b
mov r8, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
cmp r8, rcx
jae 0x4323e5
mov rbx, qword [rsp + 0x48]
mov qword [rbx + r8*8 + 0x1298], rax
inc r8
mov rax, rbx
mov rdx, qword [rsp + 0x28]
mov rbx, r8
jmp 0x43221b
cmp rbx, 0x200
ja 0x4323d4
lea rdx, [rax + 0x1298]
lea rsi, [rax + 0x1260]
mov rcx, rbx
mov edi, 0x200
mov rbx, rdx
mov rax, rsi
call fcn.00427360
mov rax, qword [rsp + 0x48]
add rax, 0x1288
call fcn.00432100
add rsp, 0x38
pop rbp
ret
mov rcx, rbx
mov edx, 0x200
nop dword [rax]
call fcn.00467c80
mov rax, r8
call fcn.00467c00
mov rax, r8
mov ecx, 0x40
call fcn.00467c20
mov edx, 0x200
nop
call fcn.00467c60
nop
mov qword [rsp + 8], rax
call fcn.0046c520
mov rax, qword [rsp + 8]
jmp fcn.00432180
Function at 0x4355a0
Capabilities:
Access peb ldr_data

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 8
mov qword [rsp + 0x60], 0
mov rcx, qword [0x006a8628]
mov rcx, qword gs:[rcx]
mov rcx, qword [rcx]
mov rcx, qword [rcx + 0x30]
mov qword [rcx + 0x3c0], 8
lea rdx, [rsp + 0x20]
mov qword [rcx + 0x3c8], rdx
mov rax, qword [rsp + 0x18]
xorps xmm15, xmm15
mov r14, qword [0x006a8628]
mov r14, qword gs:[r14]
mov r14, qword [r14]
call fcn.00435140
mov qword [rsp + 0x60], rax
add rsp, 8
pop rbp
ret
Function at 0x442bc0
Capabilities:
Access peb ldr_data

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [0x006a83b0]
test rcx, rcx
jne 0x442be4
xor ecx, ecx
xor edx, edx
jmp 0x442bf9
call fcn.00457b20
mov rcx, rbx
mov rdx, rax
mov rax, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rdx
mov qword [rsp + 0x20], r14
mov rsi, qword [r14 + 0x30]
inc dword [rsi + 0xd8]
mov qword [r14 + 0x10], 0xfffffffffffffade
mov byte [r14 + 0xb7], 1
call fcn.00442b60
mov rcx, qword [rsp + 0x68]
mov rax, qword [rsp + 0x20]
mov qword [rax + 0x70], rcx
mov rdx, qword [rsp + 0x60]
mov qword [rax + 0x78], rdx
mov ebx, 2
mov ecx, 3
call fcn.0043c480
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rcx + 0x70]
cmp qword [rcx], rdx
ja 0x442c66
nop dword [rax + rax]
cmp qword [rcx + 8], rdx
jae 0x442ca2
movups xmmword [rsp + 0x40], xmm15
lea rax, [0x00442ec0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rcx
lea rax, [rsp + 0x40]
mov qword [rsp], rax
call fcn.00465800
xorps xmm15, xmm15
mov r14, qword [0x006a8628]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rcx, qword [rsp + 0x20]
mov rax, qword [rsp + 0x10]
test rax, rax
je 0x442d0b
movups xmmword [rsp + 0x28], xmm15
mov qword [rsp + 0x38], 0
lea rcx, [0x00442e40]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x28]
mov qword [rsp], rax
nop
call fcn.00465800
xorps xmm15, xmm15
mov r14, qword [0x006a8628]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
call fcn.00442b60
mov rcx, qword [rsp + 0x20]
mov al, byte [0x00624a98]
test al, al
je 0x442d4b
lea rax, [0x0053da08]
mov qword [rsp], rax
call fcn.00465800
xorps xmm15, xmm15
mov r14, qword [0x006a8628]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
call fcn.00442b60
mov rcx, qword [rsp + 0x20]
mov rax, qword [rcx + 0x30]
mov rax, qword [rax + 0xa0]
test byte [rax], al
cmp dword [rax + 0x2298], 0
nop
je 0x442d98
lea rax, fcn.0043dd00
mov qword [rsp], rax
call fcn.00465800
xorps xmm15, xmm15
mov r14, qword [0x006a8628]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
call fcn.00442b60
mov rcx, qword [rsp + 0x20]
mov rax, qword [rcx + 0x30]
mov rdx, qword [rax + 0xa0]
mov edx, dword [rdx + 0x14]
mov dword [rax + 0x388], edx
mov rax, qword [rcx + 0x30]
mov rax, qword [rax + 0xa0]
mov qword [rax + 0x38], 0
mov rdx, qword [rcx + 0x30]
mov rbx, rax
mov qword [rdx + 0xb0], rax
mov rax, qword [rcx + 0x30]
mov qword [rax + 0xa0], 0
mov eax, 2
xchg dword [rbx + 4], eax
mov al, byte [0x00624a88]
test al, al
je 0x442e24
lea rax, [0x0053da00]
mov qword [rsp], rax
call fcn.00465800
xorps xmm15, xmm15
mov r14, qword [0x006a8628]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
call fcn.00442b60
mov rcx, qword [rsp + 0x20]
mov rax, qword [rcx + 0x30]
dec dword [rax + 0xd8]
add rsp, 0x50
pop rbp
ret