joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800484b8
Capabilities:
Connect pipe

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov esi, dword [rsp + 0x60]
lea r15d, [rcx - 0xd99]
mov r14d, r9d
lea eax, [r15 + 0x373]
mov ebx, r8d
lea r12d, [rdx - 0x1b30]
mov ebp, ecx
xor ebx, 0x12b5
xor ebp, 0x1a7
add esi, 0xfffffb30
xor r14d, 0xe4a
cmp r14d, eax
je 0x180048734
mov rdx, qword [section..data]
mov eax, esi
xor eax, 0x3ad2
cmp ebx, eax
je 0x1800486ab
mov r8, qword [rsp + 0x68]
lea rax, [0x1800e7010]
mov qword [0x1800e70f0], rax
cmp dword [rdx + 0x80], 0xf10
jb 0x18004856a
mov eax, dword [rdx + 0xc0]
add eax, dword [r8 + 8]
add eax, dword [0x1800e7010]
xor eax, 0x528abce8
mov dword [0x1800e7110], eax
jmp 0x180048574
add dword [0x1800e7078], 0x6461
xor r9d, r9d
mov eax, dword [rdx + 0x4c]
mov rcx, qword [rdx + 0x78]
xor dword [rcx + r9], eax
add r9, 4
mov rcx, qword [section..data]
mov eax, dword [rcx + 0xac]
add dword [rcx + 0x4c], eax
mov eax, 0x29030
mov rcx, qword [section..data]
sub eax, dword [rcx + 0xe8]
sub eax, dword [r8 + 0x58]
add dword [rcx + 0x40], eax
mov eax, dword [0x1800e70e4]
mov rdx, qword [section..data]
add eax, 0xfee8cd05
mov ecx, dword [rdx + 0x58]
imul ecx, eax
mov dword [rdx + 0x58], ecx
mov rax, qword [section..data]
mov ecx, dword [rax + 0x9c]
mov eax, dword [r8 + 4]
sub ecx, 0x1375eb
imul eax, ecx
mov dword [r8 + 4], eax
mov eax, 0x1386c3
sub eax, dword [r8 + 0x104]
add dword [r8 + 0xbc], eax
mov eax, dword [0x1800e70f8]
add eax, 0xfffd6fd0
or dword [r8 + 0xe8], eax
mov rax, qword [section..data]
mov ecx, dword [rax + 0x80]
sub ecx, dword [0x1800e7014]
xor ecx, 0xa005c9e3
sub dword [r8 + 0xa4], ecx
mov rax, qword [section..data]
mov ecx, dword [rax + 0x58]
xor ecx, dword [0x1800e711c]
mov eax, dword [r8 + 0x104]
sub ecx, 0x11f2ab
imul eax, ecx
mov dword [r8 + 0x104], eax
cmp r9, 0xdb364
jge 0x180048669
mov rdx, qword [section..data]
jmp 0x180048577
cmp dword [r8 + 4], 0x17c8
ja 0x18004869b
mov rdx, qword [section..data]
mov ecx, dword [r8 + 0xe8]
sub ecx, 0x1bdaa
mov eax, dword [rdx + 0xbc]
imul eax, ecx
mov dword [rdx + 0xbc], eax
jmp 0x180048734
mov rax, qword [0x1800e7088]
mov qword [r8 + 0x50], rax
jmp 0x180048734
mov r9d, dword [0x1800e70ec]
mov edi, r9d
mov eax, dword [rdx + 0x5c]
mov r8d, dword [0x1800e70e8]
and eax, r8d
xor eax, 0x11b3
cmp r9d, eax
jne 0x180048734
mov ecx, dword [0x1800e70b8]
cmp ebx, esi
jne 0x180048722
mov edx, dword [rdx + 0x68]
sub ecx, r9d
or ecx, 0x19a6
mov eax, r14d
sub esi, ecx
sub edx, r15d
mov rcx, qword [0x1800e70b0]
and ecx, 0xbf3
xor rcx, rax
call qword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
mov ecx, dword [0x1800e70b8]
mov eax, ecx
mov r9d, dword [0x1800e70ec]
and eax, r12d
mov r8d, dword [0x1800e70e8]
xor ebx, eax
mov rdx, qword [section..data]
mov eax, dword [rdx + 0x5c]
add edi, 2
and eax, r8d
xor eax, 0x11b3
cmp edi, eax
je 0x1800486d2
mov rbx, qword [rsp + 0x40]
lea eax, [rbp + 0x4a6]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x18004875c
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov eax, dword [rsp + 0x60]
mov r10, rdx
mov r9d, dword [rsp + 0x58]
add r9d, 0xfffff10a
lea edx, [rax - 0x110a]
lea ebx, [rax + 0x6b8]
mov eax, dword [rsp + 0x50]
xor eax, 0x985
add eax, 0x893
cmp edx, eax
jg 0x1800487ae
mov eax, dword [0x1800e70dc]
sub eax, dword [0x1800e711c]
add eax, 0x154a70
mov dword [r10 + 0x24], eax
add ebx, 0x36e
lea eax, [rdx + 0x1dcc]
cmp r8d, eax
je 0x18004897b
cmp dword [0x1800e7090], 0x14817
je 0x1800487dd
mov rax, qword [section..data]
mov ecx, dword [rax + 0x40]
sub ecx, 0x7515b5be
xor dword [r10 + 0x24], ecx
lea rax, [0x1800eb100]
xor r11d, r11d
mov qword [0x1800e7070], rax
mov rcx, qword [section..data]
mov rax, qword [rcx + 0x60]
mov r9d, dword [r11 + rax]
add r11, 4
mov eax, dword [rcx + 0x80]
mov ecx, dword [0x1800e7094]
add eax, 0x5fea1b75
imul r9d, dword [0x1800e7034]
imul ecx, eax
mov edx, r9d
mov dword [0x1800e7094], ecx
mov rax, qword [r10 + 0x70]
movsxd rcx, dword [0x1800e7058]
shr edx, 0x10
mov byte [rcx + rax], dl
inc dword [0x1800e7058]
mov eax, dword [r10 + 0xd4]
sub eax, dword [0x1800e7094]
sub eax, 0x1058602
add dword [r10 + 0x9c], eax
mov ecx, dword [0x1800e7090]
mov eax, dword [0x1800e70f8]
add ecx, 0xfff76e4a
mov edx, dword [0x1800e70cc]
add eax, 0xffddf2ab
mov r8, qword [section..data]
add edx, ecx
mov dword [0x1800e7090], edx
mov ecx, dword [r8 + 4]
add ecx, dword [r10 + 0x10c]
add ecx, eax
mov eax, dword [0x1800e7014]
mov dword [0x1800e70f8], ecx
mov ecx, dword [r8 + 0x58]
sub ecx, dword [0x1800e70e4]
add ecx, 0x11732fd
imul eax, ecx
mov dword [0x1800e7014], eax
mov eax, 0xa0041620
mov ecx, dword [r10 + 0x10c]
xor ecx, edx
mov edx, r9d
sub eax, ecx
shr edx, 8
add dword [r8 + 0x68], eax
mov rax, qword [section..data]
mov ecx, dword [0x1800e70ec]
sub ecx, dword [rax + 0xd4]
add ecx, 0x11732fc
xor dword [r10 + 0x104], ecx
movsxd rcx, dword [0x1800e7058]
mov rax, qword [0x1800e7080]
mov byte [rcx + rax], dl
mov eax, dword [0x1800e7058]
inc eax
mov dword [0x1800e7058], eax
movsxd rdx, eax
mov rax, qword [section..data]
mov rcx, qword [rax + 0x70]
mov byte [rdx + rcx], r9b
mov rcx, qword [section..data]
inc dword [0x1800e7058]
mov eax, dword [rcx + 0xa4]
xor eax, 0x103963
add dword [rcx + 0xe8], eax
mov eax, 0x1386c3
sub eax, dword [0x1800e7114]
mov rcx, qword [section..data]
add dword [rcx + 0x40], eax
cmp r11, 0x5db0
jl 0x1800487ee
mov rax, qword [section..data]
mov ecx, dword [rax + 0xe8]
sub ecx, dword [rax + 0x40]
xor ecx, 0xfff0b04c
mov dword [r10 + 0x24], ecx
jmp 0x1800489b5
mov rcx, qword [section..data]
mov eax, dword [rcx + 0x80]
and eax, edx
add dword [0x1800e7098], eax
mov eax, dword [rcx + 0xd8]
or eax, dword [rcx + 0x58]
xor dword [0x1800e7078], eax
mov ecx, dword [rcx + 0xec]
imul ecx, r9d
sub ecx, 0x21e2
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea eax, [rbx + 0x4d0]
add rsp, 0x20
pop rbx
ret
Function at 0x180049ccc
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov eax, dword [rsp + 0x30]
xor edx, 0x2bf3
mov ecx, edx
mov r10d, r8d
xor ecx, 0x3fd6
add r9d, 0x15ef
xor r10d, 0xa3a
add eax, 0xfffff843
cmp eax, ecx
jge 0x180049eee
xor r8d, 0x3031
cmp edx, r8d
je 0x180049e8e
mov r11, qword [rsp + 0x28]
add r10d, 0x3a7
mov rdx, qword [section..data]
xor ebx, ebx
mov rax, qword [rdx + 0x60]
mov ecx, dword [r11 + 0x2c]
add ecx, dword [0x1800e70b4]
mov r9d, dword [rax + rbx]
add rbx, 4
imul r9d, dword [r11 + 0x24]
mov eax, dword [0x1800e7090]
add eax, 0x935fb
add ecx, eax
mov eax, 0xb21e6
mov dword [0x1800e7090], ecx
sub eax, dword [rdx + 0xbc]
mov dword [rdx + 0xe8], eax
mov edx, r9d
mov eax, dword [0x1800e711c]
xor eax, 0x11f2ac
shr edx, 0x10
sub dword [r11 + 0x58], eax
mov r8, qword [section..data]
mov ecx, dword [0x1800e70f8]
sub ecx, dword [0x1800e7090]
mov eax, dword [r8 + 0x40]
add eax, 0x5fd92e44
add eax, dword [0x1800e7090]
xor dword [0x1800e7114], eax
mov eax, dword [0x1800e70dc]
add eax, 0xa013545c
add ecx, eax
mov dword [0x1800e70dc], ecx
mov ecx, dword [r8 + 0xcc]
lea ecx, [rcx*2 - 0x8d2eb]
add ecx, dword [0x1800e70cc]
mov dword [r8 + 0xcc], ecx
mov rax, qword [section..data]
movsxd rcx, dword [rax + 0x48]
mov rax, qword [0x1800e7080]
mov byte [rcx + rax], dl
mov edx, r9d
mov rax, qword [section..data]
shr edx, 8
inc dword [rax + 0x48]
mov eax, 0x229a2a
mov rcx, qword [section..data]
sub eax, dword [rcx + 0x84]
sub eax, dword [0x1800e7050]
add dword [0x1800e7068], eax
movsxd rcx, dword [rcx + 0x48]
mov rax, qword [0x1800e7080]
mov byte [rcx + rax], dl
mov rax, qword [section..data]
inc dword [rax + 0x48]
movsxd rcx, dword [0x1800e7058]
mov rax, qword [0x1800e7080]
mov byte [rcx + rax], r9b
inc dword [0x1800e7058]
mov rdx, qword [section..data]
mov eax, dword [rdx + 4]
sub eax, dword [r11 + 0xe8]
xor eax, 0xd8a79
sub dword [0x1800e7094], eax
mov eax, 0x1375ec
sub eax, dword [0x1800e70ac]
add dword [0x1800e7050], eax
cmp rbx, 0x7c20
jl 0x180049d26
mov eax, dword [r11 + 0xa4]
xor eax, 0xb6cb42b6
mov dword [rdx + 0x24], eax
jmp 0x180049eee
and r9d, edx
mov rdx, qword [rsp + 0x28]
and r9d, 0x1b30
mov ecx, dword [rdx + 0xc4]
cmp ecx, r9d
je 0x180049eee
mov r11, qword [section..data]
mov r8d, dword [0x1800e70e8]
mov eax, dword [r11 + 0xec]
or eax, r10d
imul eax, dword [rdx + 0xd4]
cmp dword [r11 + 0xb8], eax
jbe 0x180049ee6
mov eax, dword [rdx + 0x114]
or eax, dword [0x1800e7098]
xor r8d, eax
mov dword [0x1800e70e8], r8d
add ecx, 4
cmp ecx, r9d
jne 0x180049eb6
mov rbx, qword [rsp + 8]
lea eax, [r10 - 0x504]
ret
Function at 0x14034e120
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x14034e12d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14034e13d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x14034e125
lea eax, [rcx + 1]
call r11
adc eax, eax
add ebx, ebx
jne 0x14034e155
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x14034e142
sub eax, 3
jb 0x14034e16f
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x14034e1a6
movsxd rbp, eax
lea eax, [rcx + 1]
call r11
adc ecx, ecx
call r11
adc ecx, ecx
jne 0x14034e196
mov ecx, eax
add eax, 2
call r11
adc ecx, ecx
add ebx, ebx
jne 0x14034e194
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x14034e183
cmp rbp, 0xfffffffffffff300
adc ecx, eax
call fcn.14034e0e2
jmp 0x14034e12d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0xde400
mov dl, 0x25
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x14034e1f2
cmp rsi, rcx
jae 0x14034e1fa
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x14034e1d9
cmp al, 0x8f
ja 0x14034e1d9
cmp byte [rsi - 2], 0xf
je 0x14034e1df
sub al, 0xe8
cmp al, 1
ja 0x14034e1c3
cmp rsi, rcx
jae 0x14034e1fa
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x14034e1c9
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x14034e1fa
lodsb al, byte [rsi]
jmp 0x14034e1d9
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x34b000]
mov eax, dword [rdi]
or eax, eax
je 0x14034e263
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x3621d0]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x14034e207
jns 0x14034e23c
movzx rdx, word [rdi]
add rdi, 2
jmp 0x14034e246
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x14034e25d
mov qword [rbx], rax
add rbx, 8
jmp 0x14034e227
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x21f]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x14034e2bb
sub rsp, 0xffffffffffffff80
jmp 0x1400cdb30
Function at 0x1400198f0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x1400198fd
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14001990d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x1400198f5
lea eax, [rcx + 1]
jmp 0x14001991b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x14001992e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x140019914
sub eax, 3
jb 0x14001994e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x14001999d
sar eax, 1
movsxd rbp, eax
jb 0x140019984
jmp 0x14001995c
add ebx, ebx
jne 0x14001995a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140019984
inc ecx
add ebx, ebx
jne 0x14001996a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140019984
call r11
adc ecx, ecx
add ebx, ebx
jne 0x14001997d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x14001996c
add ecx, 2
jmp 0x140019989
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.1400198b2
jmp 0x1400198fd
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x3000
mov dl, 2
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x1400199e9
cmp rsi, rcx
jae 0x1400199f1
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x1400199d0
cmp al, 0x8f
ja 0x1400199d0
cmp byte [rsi - 2], 0xf
je 0x1400199d6
sub al, 0xe8
cmp al, 1
ja 0x1400199ba
cmp rsi, rcx
jae 0x1400199f1
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x1400199c0
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x1400199f1
lodsb al, byte [rsi]
jmp 0x1400199d0
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x17000]
mov eax, dword [rdi]
or eax, eax
je 0x140019a4e
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x19000]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x1400199fe
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x140019a48
mov qword [rbx], rax
add rbx, 8
jmp 0x140019a1e
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x140019a88
cmp al, 0xef
ja 0x140019a7a
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x140019a5a
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x140019a69
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
mov byte [fcn.140019b07], 0xfc
lea rcx, [rsi - 0x1000]
push 1
pop rdx
xor r8, r8
push rax
call fcn.140019b07
pop rax
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x140019af7
sub rsp, 0xffffffffffffff80
jmp 0x140001125
Function at 0x4136e0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41386b
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00433160
xorps xmm15, xmm15
mov r14, qword [0x00699a38]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x413745
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x413754
add rsp, 0x48
pop rbp
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x413773
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x413783
cmp rbx, 0x1000
jae 0x41374b
jmp 0x4137ed
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x413795
xor edx, edx
jmp 0x4137e4
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00433160
xorps xmm15, xmm15
mov r14, qword [0x00699a38]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x413779
jmp 0x413768
call fcn.00472440
xorps xmm15, xmm15
mov r14, qword [0x00699a38]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.00437d60
lea rax, [0x0053535d]
mov ebx, 0x18
nop dword [rax]
call fcn.004385e0
mov rax, qword [rsp + 0x38]
call fcn.00438320
lea rax, [0x005358e7]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.004385e0
mov rax, qword [rsp + 0x30]
call fcn.00438320
call fcn.00437fa0
call fcn.00437dc0
lea rax, [0x00537e7e]
mov ebx, 0x21
call fcn.00469620
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0046ece0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004136e0
Function at 0x4138a0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x413ac6
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.004331e0
xorps xmm15, xmm15
mov r14, qword [0x00699a38]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x413913
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x413922
add rsp, 0x50
pop rbp
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x413945
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x413955
cmp rbx, 0x1000
jae 0x413919
nop
jmp 0x4139d8
add rsp, 0x50
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop word [rax + rax]
cmp rbx, 0x1000
jae 0x41396d
xor esi, esi
jmp 0x4139ca
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.004331e0
xorps xmm15, xmm15
mov r14, qword [0x00699a38]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x41394b
jmp 0x413936
call fcn.00472440
xorps xmm15, xmm15
mov r14, qword [0x00699a38]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x413a60
nop dword [rax + rax]
call fcn.00437d60
lea rax, [0x00535900]
mov ebx, 0x19
call fcn.004385e0
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
call fcn.00438320
lea rax, [0x005358e7]
mov ebx, 0x19
call fcn.004385e0
mov eax, dword [rsp + 0x34]
call fcn.00438320
nop
call fcn.00437fa0
call fcn.00437dc0
lea rax, [0x00531c54]
mov ebx, 0xd
call fcn.00469620
nop dword [rax + rax]
cmp eax, 0x5af
je 0x413a00
call fcn.00437d60
lea rax, [0x00535900]
mov ebx, 0x19
call fcn.004385e0
mov rax, qword [rsp + 0x38]
call fcn.00438320
lea rax, [0x005358e7]
mov ebx, 0x19
call fcn.004385e0
mov eax, dword [rsp + 0x34]
nop dword [rax]
call fcn.00438320
call fcn.00437fa0
call fcn.00437dc0
lea rax, [0x005375fd]
mov ebx, 0x1f
nop dword [rax + rax]
call fcn.00469620
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0046ece0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.004138a0
Function at 0x41db40
Capabilities:
Hash data using murmur3

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
cmp byte [0x006997f1], 0
jne 0x41dc30
sub rbx, qword [rax + 0x18]
mov rdx, qword [rax + 0x48]
test byte [rdx], al
mov ecx, dword [rax + 0x5c]
imul rcx, rbx
mov rbx, rcx
shr rbx, 0x20
shr rcx, 0x23
and ebx, 7
mov rsi, rcx
mov rcx, rbx
mov edi, 1
shl edi, cl
add rdx, rsi
nop
nop
nop
nop
lock or byte [rdx], dil
mov rcx, qword [rax + 0x18]
movabs rdx, 0x800000000000
add rdx, rcx
mov rbx, rdx
shr rdx, 0x2a
nop
nop
nop
cmp rdx, 0x40
jae 0x41dc23
lea rsi, [0x0066bb98]
mov rdx, qword [rsi + rdx*8]
test byte [rdx], al
mov rsi, rcx
shr rsi, 0x10
and esi, 0x3f
shr rcx, 0xd
and ecx, 7
mov edi, 1
shl edi, cl
shr rbx, 0x16
and ebx, 0xfffff
mov rdx, qword [rdx + rbx*8]
test byte [rdx], al
movzx ebx, byte [rdx + rsi + 0x1040]
lea rdx, [rdx + rsi]
lea rdx, [rdx + 0x1040]
test dil, bl
jne 0x41dbfe
lock or byte [rdx], dil
mov rcx, qword [r14 + 0x30]
mov rcx, qword [rcx + 0xa0]
test byte [rcx], al
mov rdx, qword [rcx + 0x1258]
add rdx, qword [rax + 0x68]
mov qword [rcx + 0x1258], rdx
add rsp, 0x10
pop rbp
ret
mov rax, rdx
mov ecx, 0x40
call fcn.00470fe0
lea rax, [0x0053a2e8]
mov ebx, 0x2c
nop dword [rax]
call fcn.00469620
nop
int3

Function at 0x420040
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x420146
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov byte [rsp + 0x70], dil
mov qword [rsp + 0x10], 0
jmp 0x420083
mov rax, qword [rsp + 0x58]
mov rcx, rdx
mov rbx, qword [rsp + 0x60]
movzx edi, byte [rsp + 0x70]
cmp qword [rsp + 0x10], rbx
jae 0x42013b
test byte [rax], al
lea rcx, [rax + 0x100b8]
mov ebx, edi
mov rax, rcx
nop dword [rax]
call fcn.00420e00
test rax, rax
je 0x42013b
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
lea rcx, [0x00420180]
mov qword [rsp + 0x18], rcx
lea rdx, [rsp + 0x10]
mov qword [rsp + 0x20], rdx
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x40], rax
lea rbx, [rsp + 0x18]
mov qword [rsp], rbx
nop dword [rax]
call fcn.0046ebc0
xorps xmm15, xmm15
mov r14, qword [0x00699a38]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x68]
nop dword [rax]
test rdx, rdx
jne 0x420129
xor eax, eax
jmp 0x420133
mov rax, qword [rdx]
call rax
mov rdx, qword [rsp + 0x68]
test al, al
je 0x420071
mov rax, qword [rsp + 0x10]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov byte [rsp + 0x20], dil
call fcn.0046ece0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movzx edi, byte [rsp + 0x20]
jmp fcn.00420040
Function at 0x42d620
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x42d770
push rbp
mov rbp, rsp
sub rsp, 0x50
cmp dword [0x00699e9c], 0
je 0x42d73e
mov qword [rax + 0x20], 0
cmp qword [rax + 0x10], 0
jbe 0x42d765
mov rdx, qword [rax + 8]
mov qword [rdx], 0xffffffffffffffff
mov edx, dword [0x00699e70]
test edx, edx
jne 0x42d6a7
mov rcx, qword [rax + 0x10]
cmp rcx, 1
jbe 0x42d756
mov rdx, qword [rax + 8]
lea rbx, [fcn.004434a0]
inc rbx
mov qword [rdx + 8], rbx
mov rcx, qword [rax + 0x10]
cmp rcx, 2
jbe 0x42d74c
mov rax, qword [rax + 8]
mov qword [rax + 0x10], 0
add rsp, 0x50
pop rbp
ret
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x10], 0
lea rcx, [rsp + 0x60]
lea rdx, [0x0042d7a0]
mov qword [rsp + 0x18], rdx
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], rcx
mov rcx, r14
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x10]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], 3
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x18]
mov qword [rsp], rcx
nop
call fcn.0046ebc0
xorps xmm15, xmm15
mov r14, qword [0x00699a38]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x60]
mov rdx, qword [rcx + 0x10]
cmp rdx, rax
jle 0x42d738
jbe 0x42d744
mov rcx, qword [rcx + 8]
mov qword [rcx + rax*8], 0
add rsp, 0x50
pop rbp
ret
add rsp, 0x50
pop rbp
ret
mov rcx, rdx
call fcn.00470fc0
mov eax, 2
call fcn.00470fc0
mov eax, 1
nop dword [rax + rax]
call fcn.00470fc0
xor eax, eax
mov rcx, rax
call fcn.00470fc0
nop
mov qword [rsp + 8], rax
call fcn.0046ece0
mov rax, qword [rsp + 8]
nop
jmp fcn.0042d620