joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140004e60
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r11d, r11d
lea rsi, str.Oneadmin_tdomain_tboiterose_tworkplace_tdon_tbidding_tvitcnf_thumanresources_tsearchusers_tbgt_tescape_tide_tizle_temailthis_tkontakty_tcalendarevents_tmusicas_tsmilies_tcache_tgrappelli_tlobby_tadvert_tservices_tcalendar_tmoda_tqr_telong_tadjuntos_trechtliches_tevenement_tmazda_tmystic_tprojectincludes_tinterestonlycalc_tactualiza_tinception_tmentionslegales_tlargerphoto_tclientapi_tlangda_tTest_tpqa_twow_ttabid_ttravels
mov r10, rax
sub rbx, rax
movabs rdi, 0x55c7b4f141ace689
lea r9, [rax + 2]
nop dword [rax + rax]
movsxd r8, r11d
lea r9, [r9 + 0xc]
mov rax, rdi
mov rcx, r8
mul r8
add r11d, 6
shr rdx, 7
imul rax, rdx, 0x17e
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 1]
xor al, byte [rbx + r9 - 0xe]
movsx eax, al
mov word [r9 - 0xe], ax
mov rax, rdi
mul rcx
shr rdx, 7
imul rax, rdx, 0x17e
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 2]
xor al, byte [r9 + rbx - 0xc]
movsx eax, al
mov word [r9 - 0xc], ax
mov rax, rdi
mul rcx
shr rdx, 7
imul rax, rdx, 0x17e
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 3]
xor al, byte [rbx + r9 - 0xa]
movsx eax, al
mov word [r9 - 0xa], ax
mov rax, rdi
mul rcx
shr rdx, 7
imul rax, rdx, 0x17e
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 4]
xor al, byte [rbx + r9 - 8]
movsx eax, al
mov word [r9 - 8], ax
mov rax, rdi
mul rcx
shr rdx, 7
imul rax, rdx, 0x17e
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 5]
xor al, byte [rbx + r9 - 6]
movsx eax, al
mov word [r9 - 6], ax
mov rax, rdi
mul rcx
shr rdx, 7
imul rax, rdx, 0x17e
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 - 4]
movsx eax, al
mov word [r9 - 4], ax
cmp r11d, 6
jb 0x140004eb0
mov rbx, qword [rsp + 0x30]
mov rax, r10
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140004fd0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 0xe]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r11d, r11d
lea rsi, str.Oneadmin_tdomain_tboiterose_tworkplace_tdon_tbidding_tvitcnf_thumanresources_tsearchusers_tbgt_tescape_tide_tizle_temailthis_tkontakty_tcalendarevents_tmusicas_tsmilies_tcache_tgrappelli_tlobby_tadvert_tservices_tcalendar_tmoda_tqr_telong_tadjuntos_trechtliches_tevenement_tmazda_tmystic_tprojectincludes_tinterestonlycalc_tactualiza_tinception_tmentionslegales_tlargerphoto_tclientapi_tlangda_tTest_tpqa_twow_ttabid_ttravels
mov r10, rax
sub rbx, rax
movabs rdi, 0x55c7b4f141ace689
lea r9, [rax + 2]
nop dword [rax + rax]
movsxd r8, r11d
mov rax, rdi
mul r8
mov rcx, r8
shr rdx, 7
imul rax, rdx, 0x17e
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 1]
xor al, byte [rbx + r9 - 2]
movsx eax, al
mov word [r9 - 2], ax
mov rax, rdi
mul rcx
shr rdx, 7
imul rax, rdx, 0x17e
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 2]
xor al, byte [rbx + r9]
movsx eax, al
mov word [r9], ax
mov rax, rdi
mul rcx
shr rdx, 7
imul rax, rdx, 0x17e
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 3]
xor al, byte [rbx + r9 + 2]
movsx eax, al
mov word [r9 + 2], ax
mov rax, rdi
mul rcx
shr rdx, 7
imul rax, rdx, 0x17e
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 4]
xor al, byte [rbx + r9 + 4]
movsx eax, al
mov word [r9 + 4], ax
mov rax, rdi
mul rcx
shr rdx, 7
imul rax, rdx, 0x17e
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 5]
xor al, byte [rbx + r9 + 6]
movsx eax, al
mov word [r9 + 6], ax
mov rax, rdi
mul rcx
shr rdx, 7
imul rax, rdx, 0x17e
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 6]
xor al, byte [rbx + r9 + 8]
movsx eax, al
mov word [r9 + 8], ax
mov rax, rdi
mul rcx
shr rdx, 7
imul rax, rdx, 0x17e
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 7]
xor al, byte [rbx + r9 + 0xa]
movsx eax, al
mov word [r9 + 0xa], ax
mov rax, rdi
mul rcx
shr rdx, 7
imul rax, rdx, 0x17e
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 + 0xc]
movsx eax, al
mov word [r9 + 0xc], ax
lea rcx, [r8 + 8]
mov rax, rdi
mul rcx
add r11d, 0xb
lea r9, [r9 + 0x16]
shr rdx, 7
imul rax, rdx, 0x17e
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 9]
xor al, byte [rbx + r9 - 8]
movsx eax, al
mov word [r9 - 8], ax
mov rax, rdi
mul rcx
shr rdx, 7
imul rax, rdx, 0x17e
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 0xa]
xor al, byte [rbx + r9 - 6]
movsx eax, al
mov word [r9 - 6], ax
mov rax, rdi
mul rcx
shr rdx, 7
imul rax, rdx, 0x17e
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 - 4]
movsx eax, al
mov word [r9 - 4], ax
cmp r11d, 0xb
jb 0x140005020
mov rbx, qword [rsp + 0x30]
mov rax, r10
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140009030
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov rbx, qword [0x1400171c0]
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x20], 0x6001c
mov dword [rbp - 0x1c], 0xd0000
mov dword [rbp - 0x18], 0x5e0008
mov dword [rbp - 0x14], 0x40005b
mov dword [rbp - 0x10], 0x8006d
mov dword [rbp - 0xc], 0x6d0003
call fcn.1400029c0
mov rcx, rax
call rbx
mov rbx, qword [0x1400171c0]
lea rcx, [rbp - 0x20]
mov qword [0x1400171a0], rax
mov dword [rbp - 0x20], 0x70018
mov dword [rbp - 0x1c], 0x8000b
mov dword [rbp - 0x18], 0x8000a
mov dword [rbp - 0x14], 0x40001d
mov dword [rbp - 0x10], 0x8006d
mov dword [rbp - 0xc], 0x6d0003
call fcn.1400029c0
mov rcx, rax
call rbx
movdqa xmm0, xmmword [0x1400165b0]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140017130]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x1400171b0], rax
mov word [rbp - 0x10], 0x3814
mov byte [rbp - 0xe], 0x69
call fcn.140004620
mov rcx, qword [0x1400171a0]
mov rdx, rax
call rbx
mov rbx, qword [0x140017130]
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x20], 0xd00061c
mov dword [rbp - 0x1c], 0xb112808
mov dword [rbp - 0x18], 0x81b116a
mov word [rbp - 0x14], 0x6936
call fcn.140001180
mov rcx, qword [0x1400171a0]
mov rdx, rax
call rbx
mov rbx, qword [0x140017130]
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x20], 0x4110006
mov dword [rbp - 0x1c], 0x1a0c0316
mov dword [rbp - 0x18], 0x30a1446
mov word [rbp - 0x14], 0x6920
call fcn.140001180
mov rcx, qword [0x1400171b0]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x140016490]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140017130]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x1400170e8], rax
mov byte [rbp - 0x10], 0x62
call fcn.140004330
mov rcx, qword [0x1400171b0]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x140016540]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140017130]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x1400170f0], rax
mov dword [rbp - 0x10], 0x740c0306
call fcn.140002660
mov rcx, qword [0x1400171b0]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x140016570]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140017130]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x1400170e0], rax
mov byte [rbp - 0x10], 0x62
call fcn.140004330
mov rcx, qword [0x1400171b0]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x1400165d0]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140017130]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x1400170d8], rax
mov dword [rbp - 0x10], 0x3507000b
mov byte [rbp - 0xc], 0x65
call fcn.140003130
mov rcx, qword [0x1400171b0]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x140016520]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140017130]
movdqu xmmword [rbp - 0x20], xmm0
mov word [rbp - 0x10], 0x2e0c
mov byte [rbp - 0xe], 0x69
call fcn.140004620
mov rcx, qword [0x1400171b0]
mov rdx, rax
mov rax, rbx
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rbp
jmp rax
Function at 0x14000b5e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
movsxd rax, dword [rcx + 0x3c]
mov r12, rdx
mov rdx, rcx
mov ecx, dword [rax + rcx + 0x88]
xor eax, eax
add rcx, rdx
mov dword [rbp - 0x2c], eax
mov qword [rbp - 0x28], rcx
mov r8d, dword [rcx + 0x1c]
mov r9d, dword [rcx + 0x20]
add r8, rdx
mov r10d, dword [rcx + 0x24]
add r9, rdx
add r10, rdx
mov qword [rbp - 0x20], r8
mov qword [rbp - 0x18], r9
mov qword [rbp - 0x10], r10
cmp dword [rcx + 0x18], eax
jbe 0x14000b80e
mov word [rbp + 0x50], 0x6e4f
mov word [rbp + 0x58], 0x6e4f
nop
mov esi, dword [r9 + rax*4]
lea rcx, [rbp + 0x50]
movzx eax, word [r10 + rax*2]
add rsi, rdx
xor edi, edi
mov r15d, dword [r8 + rax*4]
add r15, rdx
mov qword [rbp - 8], r15
call fcn.140001770
movzx ecx, byte [rax]
cmp byte [rsi], cl
je 0x14000b694
nop dword [rax]
lea rcx, [rbp + 0x50]
inc rdi
call fcn.140001770
movzx ecx, byte [rax]
cmp byte [rdi + rsi], cl
jne 0x14000b680
lea rcx, [rbp + 0x58]
xor ebx, ebx
call fcn.140001770
movzx ecx, byte [rax]
cmp byte [r12], cl
je 0x14000b6c5
nop dword [rax + rax]
lea rcx, [rbp + 0x58]
inc rbx
call fcn.140001770
movzx ecx, byte [rax]
cmp byte [rbx + r12], cl
jne 0x14000b6b0
cmp rdi, rbx
jne 0x14000b7e2
mov r13, rsi
mov word [rbp - 0x50], 0x6e4f
sub r13, r12
mov r14, r12
nop dword [rax]
lea rcx, [rbp - 0x50]
xor ebx, ebx
call fcn.140001770
movzx ecx, byte [rax]
cmp byte [rsi], cl
je 0x14000b706
lea rcx, [rbp - 0x50]
inc rbx
call fcn.140001770
movzx ecx, byte [rax]
cmp byte [rbx + rsi], cl
jne 0x14000b6f2
mov rax, r14
sub rax, r12
dec rbx
cmp rax, rbx
jae 0x14000b808
movsx r15d, byte [r14 + r13]
lea rcx, [rbp - 0x4e]
mov dword [rbp - 0x4e], 0x6e002e
call fcn.140002490
movzx eax, word [rax]
cmp r15d, eax
jl 0x14000b778
lea rcx, [rbp - 0x4a]
mov dword [rbp - 0x4a], 0x6e0035
call fcn.140002490
movzx ecx, word [rax]
cmp r15d, ecx
jg 0x14000b778
lea rcx, [rbp - 0x46]
mov dword [rbp - 0x46], 0x6e002e
mov dword [rbp - 0x42], 0x6e000e
call fcn.140002490
lea rcx, [rbp - 0x42]
movzx ebx, byte [rax]
call fcn.140002490
movzx ecx, byte [rax]
sub cl, bl
add r15b, cl
movsx edi, byte [r14]
lea rcx, [rbp - 0x3e]
mov dword [rbp - 0x3e], 0x6e002e
call fcn.140002490
movzx eax, word [rax]
cmp edi, eax
jl 0x14000b7d5
lea rcx, [rbp - 0x3a]
mov dword [rbp - 0x3a], 0x6e0035
call fcn.140002490
movzx ecx, word [rax]
cmp edi, ecx
jg 0x14000b7d5
lea rcx, [rbp - 0x36]
mov dword [rbp - 0x36], 0x6e002e
mov dword [rbp - 0x32], 0x6e000e
call fcn.140002490
lea rcx, [rbp - 0x32]
movzx ebx, byte [rax]
call fcn.140002490
movzx ecx, byte [rax]
sub cl, bl
add dil, cl
cmp r15b, dil
jne 0x14000b7e2
inc r14
jmp 0x14000b6e0
mov eax, dword [rbp - 0x2c]
mov rcx, qword [rbp - 0x28]
inc eax
mov dword [rbp - 0x2c], eax
cmp eax, dword [rcx + 0x18]
jae 0x14000b80e
mov rdx, qword [rbp + 0x40]
mov r8, qword [rbp - 0x20]
mov r9, qword [rbp - 0x18]
mov r10, qword [rbp - 0x10]
jmp 0x14000b650
mov rax, qword [rbp - 8]
jmp 0x14000b810
xor eax, eax
mov rbx, qword [rsp + 0xb8]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000da30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov eax, 0x6f
mov dword [rbp - 0x20], 0x2b0004
lea rcx, [rbp - 0x20]
mov word [rbp - 0xc], ax
mov dword [rbp - 0x1c], 0x2f0037
mov dword [rbp - 0x18], 0x210021
mov dword [rbp - 0x14], 0x2f002b
mov dword [rbp - 0x10], 0x21005a
call fcn.140004fd0
mov rcx, rax
call 0x14000ee80
mov qword [0x1400171b8], rax
lea rcx, [rbp - 0x20]
mov eax, 9
mov dword [rbp - 0x20], 0x2b0004
mov word [rbp - 0x10], ax
mov dword [rbp - 0x1c], 0x2f0037
mov dword [rbp - 0x18], 0x210021
mov dword [rbp - 0x14], 0x5c005a
call fcn.1400022a0
mov rcx, rax
call 0x14000ee80
lea rcx, [rbp - 0x20]
mov qword [0x1400171a8], rax
mov dword [rbp - 0x20], 0x1a0021
mov dword [rbp - 0x1c], 0xd0001
mov dword [rbp - 0x18], 0x6d0008
call fcn.140004e60
mov rcx, rax
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov r12, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rbp
jmp 0x14000ee80
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov rsi, rcx
mov rdi, qword [rax + 0x18]
add rdi, 0x20
mov rbx, qword [rdi]
cmp rbx, rdi
je 0x14000eee2
nop dword [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
mov r8d, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, qword [rbx + 0x40]
mov rdx, rsi
mov r8, rax
call fcn.14000bf60
test al, al
jne 0x14000eef4
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x14000eeb0
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rax, qword [rbx + 0x20]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14000ee80
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov eax, 0x6f
mov dword [rbp - 0x20], 0x2b0004
lea rcx, [rbp - 0x20]
mov word [rbp - 0xc], ax
mov dword [rbp - 0x1c], 0x2f0037
mov dword [rbp - 0x18], 0x210021
mov dword [rbp - 0x14], 0x2f002b
mov dword [rbp - 0x10], 0x21005a
call fcn.140004fd0
mov rcx, rax
call 0x14000ee80
mov qword [0x1400171b8], rax
lea rcx, [rbp - 0x20]
mov eax, 9
mov dword [rbp - 0x20], 0x2b0004
mov word [rbp - 0x10], ax
mov dword [rbp - 0x1c], 0x2f0037
mov dword [rbp - 0x18], 0x210021
mov dword [rbp - 0x14], 0x5c005a
call fcn.1400022a0
mov rcx, rax
call 0x14000ee80
lea rcx, [rbp - 0x20]
mov qword [0x1400171a8], rax
mov dword [rbp - 0x20], 0x1a0021
mov dword [rbp - 0x1c], 0xd0001
mov dword [rbp - 0x18], 0x6d0008
call fcn.140004e60
mov rcx, rax
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov r12, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rbp
jmp 0x14000ee80
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov rsi, rcx
mov rdi, qword [rax + 0x18]
add rdi, 0x20
mov rbx, qword [rdi]
cmp rbx, rdi
je 0x14000eee2
nop dword [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
mov r8d, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, qword [rbx + 0x40]
mov rdx, rsi
mov r8, rax
call fcn.14000bf60
test al, al
jne 0x14000eef4
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x14000eeb0
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rax, qword [rbx + 0x20]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x416300
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41648b
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00433c40
xorps xmm15, xmm15
mov r14, qword [0x0072a448]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x416365
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x416374
add rsp, 0x48
pop rbp
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x416393
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x4163a3
cmp rbx, 0x1000
jae 0x41636b
jmp 0x41640d
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x4163b5
xor edx, edx
jmp 0x416404
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00433c40
xorps xmm15, xmm15
mov r14, qword [0x0072a448]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x416399
jmp 0x416388
call fcn.00467380
xorps xmm15, xmm15
mov r14, qword [0x0072a448]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.004382a0
lea rax, [0x00567558]
mov ebx, 0x18
nop dword [rax]
call fcn.00438b20
mov rax, qword [rsp + 0x38]
call fcn.00438860
lea rax, [0x00567bdc]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.00438b20
mov rax, qword [rsp + 0x30]
call fcn.00438860
call fcn.004384e0
call fcn.00438300
lea rax, [0x0056a5dd]
mov ebx, 0x21
call fcn.00436900
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00463c80
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00416300
Function at 0x4164c0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4166e6
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.00433cc0
xorps xmm15, xmm15
mov r14, qword [0x0072a448]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x416533
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x416542
add rsp, 0x50
pop rbp
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x416565
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x416575
cmp rbx, 0x1000
jae 0x416539
nop
jmp 0x4165f8
add rsp, 0x50
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop word [rax + rax]
cmp rbx, 0x1000
jae 0x41658d
xor esi, esi
jmp 0x4165ea
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.00433cc0
xorps xmm15, xmm15
mov r14, qword [0x0072a448]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x41656b
jmp 0x416556
call fcn.00467380
xorps xmm15, xmm15
mov r14, qword [0x0072a448]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x416680
nop dword [rax + rax]
call fcn.004382a0
lea rax, [0x00567bf5]
mov ebx, 0x19
call fcn.00438b20
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
call fcn.00438860
lea rax, [0x00567bdc]
mov ebx, 0x19
call fcn.00438b20
mov eax, dword [rsp + 0x34]
call fcn.00438860
nop
call fcn.004384e0
call fcn.00438300
lea rax, [0x00563b1a]
mov ebx, 0xd
call fcn.00436900
nop dword [rax + rax]
cmp eax, 0x5af
je 0x416620
call fcn.004382a0
lea rax, [0x00567bf5]
mov ebx, 0x19
call fcn.00438b20
mov rax, qword [rsp + 0x38]
call fcn.00438860
lea rax, [0x00567bdc]
mov ebx, 0x19
call fcn.00438b20
mov eax, dword [rsp + 0x34]
nop dword [rax]
call fcn.00438860
call fcn.004384e0
call fcn.00438300
lea rax, [0x00569c59]
mov ebx, 0x1f
nop dword [rax + rax]
call fcn.00436900
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00463c80
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.004164c0
Function at 0x41fb60
Capabilities:
Hash data using murmur3

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
cmp byte [0x0072a212], 0
jne 0x41fc47
sub rbx, qword [rax + 0x18]
mov rdx, qword [rax + 0x50]
test byte [rdx], al
mov esi, dword [rax + 0x64]
imul rbx, rsi
mov rsi, rbx
shr rbx, 0x20
shr rsi, 0x23
and ebx, 7
mov rdi, rcx
mov rcx, rbx
mov r8d, 1
shl r8d, cl
add rdx, rsi
nop
nop
nop
nop
lock or byte [rdx], r8b
mov rcx, qword [rax + 0x18]
movabs rdx, 0x800000000000
lea rax, [rdx + rcx]
mov rdx, rax
shr rdx, 0x2a
nop
nop
nop
cmp rdx, 0x40
jae 0x41fc3a
lea rbx, [0x006fc5f8]
mov rdx, qword [rbx + rdx*8]
test byte [rdx], al
mov rbx, rcx
shr rbx, 0x10
and ebx, 0x3f
shr rcx, 0xd
and ecx, 7
mov esi, 1
shl esi, cl
shr rax, 0x16
and eax, 0xfffff
mov rax, qword [rdx + rax*8]
test byte [rax], al
movzx edx, byte [rax + rbx + 0x11440]
lea rax, [rax + rbx]
lea rax, [rax + 0x11440]
test sil, dl
jne 0x41fc20
lock or byte [rax], sil
mov rax, qword [r14 + 0x30]
mov rax, qword [rax + 0xa0]
test byte [rax], al
add qword [rax + 0x1250], rdi
add rsp, 0x10
pop rbp
ret
mov rax, rdx
mov ecx, 0x40
call fcn.00465f20
lea rax, [0x0056cd02]
mov ebx, 0x2c
call fcn.00436900
nop
int3

Function at 0x421f20
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x422026
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x70], rcx
mov byte [rsp + 0x17], dil
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x18], 0
jmp 0x421f63
mov rax, qword [rsp + 0x60]
mov rcx, rdx
mov rbx, qword [rsp + 0x68]
movzx edi, byte [rsp + 0x17]
cmp qword [rsp + 0x18], rbx
jae 0x42201b
test byte [rax], al
lea rcx, [rax + 0x100b8]
mov ebx, edi
mov rax, rcx
nop dword [rax]
call fcn.00422d00
test rax, rax
je 0x42201b
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x30], xmm15
movups xmmword [rsp + 0x40], xmm15
lea rcx, [0x00422060]
mov qword [rsp + 0x20], rcx
lea rdx, [rsp + 0x18]
mov qword [rsp + 0x28], rdx
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x48], rax
lea rbx, [rsp + 0x20]
mov qword [rsp], rbx
nop dword [rax]
call fcn.00463b40
xorps xmm15, xmm15
mov r14, qword [0x0072a448]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x70]
nop dword [rax]
test rdx, rdx
jne 0x422009
xor eax, eax
jmp 0x422013
mov rax, qword [rdx]
call rax
mov rdx, qword [rsp + 0x70]
test al, al
je 0x421f51
mov rax, qword [rsp + 0x18]
add rsp, 0x50
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov byte [rsp + 0x20], dil
call fcn.00463c80
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movzx edi, byte [rsp + 0x20]
jmp fcn.00421f20