joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800533cc
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rax, qword [0x1800d13c0]
mov rcx, qword [rax]
test rcx, rcx
je 0x18005353b
mov rcx, qword [rcx + 8]
test rcx, rcx
je 0x18005353b
mov eax, dword [0x1800d13f8]
mov rdx, qword [rax + rcx]
test rdx, rdx
je 0x18005353b
cmp qword [rcx + 0x30], 0
je 0x18005353b
mov rax, qword [0x1800d13c8]
mov r8, qword [rax]
test r8, r8
je 0x18005353b
cmp qword [r8 + 0x10], 0
je 0x18005353b
cmp byte [0x1800d18dc], 0
je 0x180053463
cmp byte [0x1800d1421], 0
movss xmm0, dword [0x1800d0710]
je 0x18005345b
movss dword [rdx + 0xd40], xmm0
jmp 0x180053463
movss dword [rdx + 0xcf0], xmm0
mov eax, dword [0x1800d1418]
cmp byte [rax + rcx], 0x40
je 0x18005353b
movss xmm0, dword [0x18005b8a8]
comiss xmm0, dword [rcx + 0x280]
ja 0x18005353b
mov rax, qword [0x1800d2060]
test rax, rax
jne 0x18005352d
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov r11, qword [rax]
mov rdx, r11
mov r8, qword [rdx + 0x30]
movsxd rax, dword [r8 + 0x3c]
mov r9d, dword [rax + r8 + 0x88]
add r9, r8
cmp r9, r8
je 0x180053512
mov ecx, dword [r9 + 0x18]
test ecx, ecx
je 0x180053512
mov esi, dword [r9 + 0x20]
dec ecx
mov ebx, 0x811c9dc5
mov edi, ecx
lea rax, [rsi + rcx*4]
mov r10d, dword [rax + r8]
add r10, r8
mov al, byte [r10]
inc r10
test al, al
je 0x18005350e
movsx eax, al
xor eax, ebx
imul ebx, eax, 0x1000193
mov al, byte [r10]
inc r10
test al, al
jne 0x1800534f1
cmp ebx, 0x95466b05
je 0x18005354b
test ecx, ecx
jne 0x1800534d3
mov rax, qword [rdx]
mov rdx, rax
cmp rax, r11
je 0x180053524
cmp qword [rax + 0x30], 0
jne 0x1800534af
xor eax, eax
mov qword [0x1800d2060], rax
mov ecx, 0xa0
call rax
mov byte [0x1800d1900], 1
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov ecx, dword [r9 + 0x24]
add rcx, r8
movzx edx, word [rcx + rdi*2]
mov ecx, dword [r9 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
add rax, r8
jmp 0x180053526
Function at 0x1800560f0
Capabilities:
Enumerate gui resources
Get graphical window text

Disassembly:
sub rsp, 0xd8
mov rax, qword [0x1800d07c0]
xor rax, rsp
mov qword [rsp + 0xc0], rax
and qword [rsp + 0x30], 0
lea rdx, [rsp + 0x30]
lea rcx, [0x180056058]
call qword [sym.imp.USER32.dll_EnumWindows]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
jne 0x180056167
mov qword [rsp + 0x20], 0xc8
lea rdx, [rsp + 0x30]
lea rcx, [0x180056058]
call qword [sym.imp.USER32.dll_EnumWindows]
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x28]
call fcn.180047e2c
mov rcx, rax
call fcn.180048098
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x180056134
mov r8d, 0x80
lea rdx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_GetWindowTextA]
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.180056720
add rsp, 0xd8
ret
Function at 0x14001122b
Capabilities:
Execute syscall

Disassembly:
jmp 0x140013060
mov r10, rcx
mov eax, 0xbd
syscall
ret

Function at 0x140011244
Capabilities:
Terminate process

Disassembly:
jmp 0x1400145b0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x1400112d5
Capabilities:
Parse pe header

Disassembly:
jmp 0x140015900
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140015920
xor al, al
jmp 0x1400159a1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140015933
xor al, al
jmp 0x1400159a1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001595d
xor al, al
jmp 0x1400159a1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140015971
xor al, al
jmp 0x1400159a1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140015983
xor al, al
jmp 0x1400159a1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001599f
xor al, al
jmp 0x1400159a1
mov al, 1
add rsp, 0x38
ret
Function at 0x1400113c5
Capabilities:
Enumerate processes

Disassembly:
jmp 0x140011a20
mov dword [rsp + 8], ecx
push rbp
push rdi
sub rsp, 0x448
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0xaa
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x468]
mov rax, qword [0x140022008]
xor rax, rbp
mov qword [rbp + 0x418], rax
lea rcx, [0x14002811b]
call fcn.14001141a
mov dword [rbp + 4], 0
lea rax, [rbp + 0x30]
mov rdi, rax
xor eax, eax
mov ecx, 0x238
rep stosb byte [rdi], al
mov dword [rbp + 0x30], 0x238
xor edx, edx
mov ecx, 2
call fcn.1400111d6
mov qword [rbp + 0x288], rax
lea rdx, [rbp + 0x30]
mov rcx, qword [rbp + 0x288]
call fcn.140011276
test eax, eax
je 0x140011ad3
mov eax, dword [rbp + 0x440]
cmp dword [rbp + 0x38], eax
jne 0x140011abf
mov eax, dword [rbp + 0x50]
mov dword [rbp + 4], eax
jmp 0x140011ad3
lea rdx, [rbp + 0x30]
mov rcx, qword [rbp + 0x288]
call fcn.1400113bb
test eax, eax
jne 0x140011aac
mov rcx, qword [rbp + 0x288]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rbp + 4]
mov edi, eax
lea rcx, [rbp - 0x20]
lea rdx, [0x14001bdb0]
call fcn.140011389
mov eax, edi
mov rcx, qword [rbp + 0x418]
xor rcx, rbp
call fcn.1400111ea
lea rsp, [rbp + 0x428]
pop rdi
pop rbp
ret
Function at 0x14000b9ac
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_IsDebuggerPresent]
mov ecx, 1
mov dword [0x140016950], eax
call fcn.14000b730
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_UnhandledExceptionFilter]
cmp dword [0x140016950], 0
jne case.default.0x14000ba02
mov ecx, 1
call fcn.14000b730
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateProcess]
and edx, ebx
invalid

Function at 0x1802905c0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1802905e8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1802905e8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x1a6e058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.01a6e1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, pe_nt_image_headers64
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1a6e089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1a6e06f
add dl, dl
jne 0x1a6e096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1a6e0f6
xor eax, eax
add dl, dl
jne 0x1a6e0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1a6e1ad
add dl, dl
jne 0x1a6e0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1a6e0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1a6e0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1a6e0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1a6e0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1a6e07e
mov eax, 1
add dl, dl
jne 0x1a6e106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1a6e113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1a6e0fb
sub eax, ebx
mov ebx, 1
jne 0x1a6e14c
mov ecx, 1
add dl, dl
jne 0x1a6e12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1a6e13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1a6e123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1a6e07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1a6e168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1a6e175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1a6e15d
cmp eax, 0x7d00
jae 0x1a6e19b
cmp eax, 0x500
jb 0x1a6e196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1a6e07e
cmp eax, 0x7f
ja 0x1a6e19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1a6e07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1a6e1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1a6e07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x14016896f
Capabilities:
Encode data using xor

Disassembly:
test rdx, rdx
push 0x3ba5ffa0
lea rsp, [rsp + 0x18]
je 0x1401689f6
mov esi, 0xaabc371e
add esi, esi
adc rsi, 0x2db54bab
push r8
rol esi, 0x99
lea r8, [0x140146858]
mov esi, 0x4d054d83
sub sil, sil
neg esi
movzx esi, byte [r10]
push 0x2c81edb8
xor esi, r11d
and esi, 0xff
mov esi, dword [r8 + rsi*4]
shr r11d, 8
xor r11d, esi
push 0x7a90de09
inc r10
push 0x4abdbab5
not dword [rsp + 0xf]
xor r11d, 0xb63c7618
dec rdx
push 0x4d860991
lea rsp, [rsp + 0x20]
jne 0x14016899c
mov r8d, 0xe626eb9f
pop r8
push 0xffffffff9d1a4ebd
not r11d
mov dword [rbp + riz], r11d
lea rsp, [rsp + 8]
jmp fcn.14013377b
Function at 0x140029bcc
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.14001d2a4
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.14001d2a4
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x140029d1c
cmp rax, 0xffffffffffffffff
je 0x140029d1c
xor edi, edi
test rbp, rbp
jle 0x140029cc7
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.14001fbd0
mov rbx, rax
test rax, rax
jne 0x140029c54
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x140029cbd
mov edx, 0x8000
mov ecx, r14d
call fcn.14001ac0c
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14001df80
cmp eax, 0xffffffff
je 0x140029c9d
cdqe
sub rbp, rax
test rbp, rbp
jg 0x140029c64
mov edx, r15d
mov ecx, r14d
call fcn.14001ac0c
jmp 0x140029cbd
cmp byte [rsi + 0x38], dil
je 0x140029cb4
cmp dword [rsi + 0x34], 5
jne 0x140029cb4
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x140029cbd
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.14001b970
jmp 0x140029d30
jns 0x140029d30
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.14001d2a4
cmp rax, 0xffffffffffffffff
jne 0x140029ce8
cmp byte [rsi + 0x30], dil
je 0x140029d30
mov edi, dword [rsi + 0x2c]
jmp 0x140029d30
mov ecx, r14d
call fcn.1400190c8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x140029d30
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x140029d30
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x140029d29
mov eax, dword [rsi + 0x2c]
jmp 0x140029d2e
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.14001d2a4
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x14002ae20
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14002ae48
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14002ae48
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x140329644
Capabilities:
Encode data using xor

Disassembly:
push 0xffffffffc233dc84
pushfq
xor word [rsp + 8], 0xef98
jb 0x140329649
push rbx
add word [rsp + 0x10], 0x3727
movabs rbx, 0x8babbeb876178a8b
movsx bx, bl
mov qword [rsp + 0x10], 0x3bd7c7c2
mov rbx, qword [rsp]
jl 0x14032967b
push qword [rsp + 8]
popfq
lea rsp, [rsp + 0x10]
call fcn.1404788ac
popfq
sub dword [rax], edx
mov ah, 0x6d
push rcx
invalid
Function at 0x415ee0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x416059
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.004315c0
xorps xmm15, xmm15
mov r14, qword [0x0071ba10]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x415f50
mov rbx, qword [rsp + 0x60]
jmp 0x415f60
add rsp, 0x48
pop rbp
ret
sub rax, rbx
add rcx, rbx
mov rbx, rax
nop
test rbx, rbx
jbe 0x415f85
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rcx
mov rax, rbx
jmp 0x415f95
cmp rbx, 0x1000
jae 0x415f56
nop dword [rax]
jmp 0x416009
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
cmp rbx, 0x1000
jae 0x415fa2
xor edx, edx
jmp 0x416000
mov qword [rsp + 0x30], rbx
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.004315c0
xorps xmm15, xmm15
mov r14, qword [0x0071ba10]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
mov edx, eax
mov rax, qword [rsp + 0x38]
nop
test dl, dl
jne 0x415f8b
jmp 0x415f74
call fcn.0045fde0
xorps xmm15, xmm15
mov r14, qword [0x0071ba10]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
cmp eax, 8
jne 0x416040
lea rax, [0x00568a1f]
mov ebx, 0xd
call fcn.00433b80
nop dword [rax]
cmp eax, 0x5af
je 0x416028
lea rax, [0x0056ed84]
mov ebx, 0x1f
call fcn.00433b80
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045c680
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00415ee0
Function at 0x41ea20
Capabilities:
Hash data using murmur3

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41ec3a
push rbp
mov rbp, rsp
sub rsp, 0x30
test rax, 7
jne 0x41ec28
mov qword [rsp + 0x40], rax
mov rdx, qword [rdi + 0x48]
test byte [rdx], al
mov r9, r8
shr r9, 3
mov r10, r8
and r10d, 7
nop
mov r11, rcx
mov rcx, r10
mov r12d, 1
shl r12d, cl
lea r10, [rdx + r9]
cmp byte [0x0071b7d2], 0
jne 0x41eb61
cmp dword [0x0071be94], 0
nop
jle 0x41eaa9
movzx r13d, word [rdi + 0x34]
cmp r8, r13
jb 0x41eaa9
mov r8, qword [rdi + 0x40]
test byte [r8], al
movzx r8d, byte [r9 + r8]
nop
nop dword [rax]
test r12b, r8b
je 0x41ebd8
movzx edx, byte [r9 + rdx]
test r12b, dl
jne 0x41eb5b
nop
lock or byte [r10], r12b
mov rcx, qword [rdi + 0x18]
movabs rdx, 0x800000000000
add rdx, rcx
mov r8, rdx
shr rdx, 0x2a
nop
nop
nop
nop word [rax + rax]
cmp rdx, 0x40
jae 0x41ebcb
lea r9, [0x006ad8d8]
mov rdx, qword [r9 + rdx*8]
test byte [rdx], al
mov r9, rcx
shr r9, 0x10
and r9d, 0x3f
shr rcx, 0xd
and ecx, 7
mov r10d, 1
shl r10d, cl
shr r8, 0x16
and r8d, 0xfffff
mov rdx, qword [rdx + r8*8]
test byte [rdx], al
movzx r8d, byte [rdx + r9 + 0x1040]
lea rdx, [rdx + r9]
lea rdx, [rdx + 0x1040]
test r10b, r8b
jne 0x41eb40
lock or byte [rdx], r10b
movzx edx, byte [rdi + 0x62]
test dl, 1
je 0x41eb82
mov rax, qword [rsi + 0x10]
add rax, qword [rdi + 0x68]
mov qword [rsi + 0x10], rax
add rsp, 0x30
pop rbp
ret
add rsp, 0x30
pop rbp
ret
mov qword [rsp + 0x60], rsi
mov rcx, r11
mov rdi, r10
mov esi, r12d
call fcn.00415b00
test al, al
jne 0x41ebb8
mov rax, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x60]
prefetcht0 byte [rax]
mov rdx, qword [rsi]
test rdx, rdx
je 0x41eba7
mov rdi, qword [rdx + 0x10]
cmp rdi, 0xfd
je 0x41eba7
jae 0x41ebbe
mov qword [rdx + rdi*8 + 0x18], rax
inc qword [rdx + 0x10]
jmp 0x41ebb2
mov rbx, rax
mov rax, rsi
call fcn.00424280
add rsp, 0x30
pop rbp
ret
add rsp, 0x30
pop rbp
ret
mov rax, rdi
mov ecx, 0xfd
call fcn.0045e960
mov rax, rdx
mov ecx, 0x40
call fcn.0045e980
lea rax, [0x00567355]
mov rcx, rbx
mov rdi, r11
mov ebx, 4
call fcn.0041eca0
lea rax, [0x0056724a]
mov ebx, 3
mov rcx, qword [rsp + 0x40]
mov rdi, 0xffffffffffffffff
call fcn.0041eca0
mov rdx, qword [r14 + 0x30]
mov byte [rdx + 0xf1], 2
lea rax, [0x0056a7ca]
mov ebx, 0x13
call fcn.00433b80
lea rax, [0x0056fca3]
mov ebx, 0x23
call fcn.00433b80
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
call fcn.0045c680
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
nop dword [rax + rax]
jmp fcn.0041ea20
Function at 0x41eda0
Capabilities:
Hash data using murmur3

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
cmp byte [0x0071b7d2], 0
jne 0x41ee90
sub rbx, qword [rax + 0x18]
mov rdx, qword [rax + 0x48]
test byte [rdx], al
mov ecx, dword [rax + 0x5c]
imul rcx, rbx
mov rbx, rcx
shr rbx, 0x20
shr rcx, 0x23
and ebx, 7
mov rsi, rcx
mov rcx, rbx
mov edi, 1
shl edi, cl
add rdx, rsi
nop
nop
nop
nop
lock or byte [rdx], dil
mov rcx, qword [rax + 0x18]
movabs rdx, 0x800000000000
add rdx, rcx
mov rbx, rdx
shr rdx, 0x2a
nop
nop
nop
cmp rdx, 0x40
jae 0x41ee83
lea rsi, [0x006ad8d8]
mov rdx, qword [rsi + rdx*8]
test byte [rdx], al
mov rsi, rcx
shr rsi, 0x10
and esi, 0x3f
shr rcx, 0xd
and ecx, 7
mov edi, 1
shl edi, cl
shr rbx, 0x16
and ebx, 0xfffff
mov rdx, qword [rdx + rbx*8]
test byte [rdx], al
movzx ebx, byte [rdx + rsi + 0x1040]
lea rdx, [rdx + rsi]
lea rdx, [rdx + 0x1040]
test dil, bl
jne 0x41ee5e
lock or byte [rdx], dil
mov rcx, qword [r14 + 0x30]
mov rcx, qword [rcx + 0xa0]
test byte [rcx], al
mov rdx, qword [rcx + 0x1270]
add rdx, qword [rax + 0x68]
mov qword [rcx + 0x1270], rdx
add rsp, 0x10
pop rbp
ret
mov rax, rdx
mov ecx, 0x40
call fcn.0045e980
lea rax, [0x0057171b]
mov ebx, 0x2c
nop dword [rax]
call fcn.00433b80
nop
int3

Function at 0x420de0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x420ee6
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov byte [rsp + 0x70], dil
mov qword [rsp + 0x10], 0
jmp 0x420e23
mov rax, qword [rsp + 0x58]
mov rcx, rdx
mov rbx, qword [rsp + 0x60]
movzx edi, byte [rsp + 0x70]
cmp qword [rsp + 0x10], rbx
jae 0x420edb
test byte [rax], al
lea rcx, [rax + 0x100b8]
mov ebx, edi
mov rax, rcx
nop dword [rax]
call fcn.00421980
test rax, rax
je 0x420edb
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
lea rcx, [0x00420f20]
mov qword [rsp + 0x18], rcx
lea rdx, [rsp + 0x10]
mov qword [rsp + 0x20], rdx
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x40], rax
lea rbx, [rsp + 0x18]
mov qword [rsp], rbx
nop dword [rax]
call fcn.0045c560
xorps xmm15, xmm15
mov r14, qword [0x0071ba10]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x68]
nop dword [rax]
test rdx, rdx
jne 0x420ec9
xor eax, eax
jmp 0x420ed3
mov rax, qword [rdx]
call rax
mov rdx, qword [rsp + 0x68]
test al, al
je 0x420e11
mov rax, qword [rsp + 0x10]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov byte [rsp + 0x20], dil
call fcn.0045c680
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movzx edi, byte [rsp + 0x20]
jmp fcn.00420de0
Function at 0x42c680
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x42c779
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rax + 0x108], 0
mov ecx, dword [0x0071beb0]
test ecx, ecx
je 0x42c752
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x10], 0
lea rcx, [rsp + 0x60]
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x30], xmm15
movups xmmword [rsp + 0x40], xmm15
lea rdx, [0x0042c7a0]
mov qword [rsp + 0x18], rdx
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], rcx
mov rcx, r14
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x10]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], 3
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x18]
mov qword [rsp], rcx
call fcn.0045c560
xorps xmm15, xmm15
mov r14, qword [0x0071ba10]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x10]
cmp rax, 0x20
jge 0x42c74c
jae 0x42c76e
mov rcx, qword [rsp + 0x60]
mov qword [rcx + rax*8 + 8], 0
add rsp, 0x50
pop rbp
ret
lea rcx, [fcn.0043f4c0]
inc rcx
mov qword [rax + 8], rcx
mov qword [rax + 0x10], 0
add rsp, 0x50
pop rbp
ret
mov ecx, 0x20
call fcn.0045e960
nop
mov qword [rsp + 8], rax
nop
call fcn.0045c680
mov rax, qword [rsp + 8]
jmp fcn.0042c680

Function at 0x42cf00
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x42d048
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rsp + 0x80], rax
mov byte [rsp + 0x98], dil
test dil, dil
jne 0x42cf2d
xor edx, edx
xor esi, esi
jmp 0x42cf74
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0x90], rcx
mov qword [rsp + 0x80], rax
mov eax, 6
call fcn.00437840
mov rcx, qword [rsp + 0x90]
movzx edi, byte [rsp + 0x98]
mov edx, eax
mov rsi, rbx
mov rax, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x88]
mov qword [rsp + 0x20], 0
nop dword [rax]
test rbx, rbx
jne 0x42cf8d
test dil, dil
jmp 0x42d031
mov qword [rsp + 0x18], rsi
mov byte [rsp + 0x17], dl
lea rdx, [rsp + 0x80]
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x30], xmm15
movups xmmword [rsp + 0x40], xmm15
movups xmmword [rsp + 0x50], xmm15
movups xmmword [rsp + 0x60], xmm15
lea rsi, [0x0042d080]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x30], rax
mov rax, r14
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rdx
mov byte [rsp + 0x60], dil
lea rax, [rsp + 0x20]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x28]
mov qword [rsp], rax
call fcn.0045c560
xorps xmm15, xmm15
mov r14, qword [0x0071ba10]
mov r14, qword gs:[r14]
mov r14, qword [r14]
movzx eax, byte [rsp + 0x98]
test al, al
movzx edx, byte [rsp + 0x17]
mov rsi, qword [rsp + 0x18]
je 0x42d03d
mov eax, edx
mov rbx, rsi
call fcn.004379e0
mov rax, qword [rsp + 0x20]
add rsp, 0x70
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov byte [rsp + 0x20], dil
nop dword [rax]
call fcn.0045c680
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movzx edi, byte [rsp + 0x20]
jmp fcn.0042cf00