joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18001c508
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Resume thread
Suspend thread

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x510
and qword [rsp + 0x40], 0
mov r14, rcx
mov r13d, r8d
mov rbp, rdx
lea rcx, [rsp + 0x48]
mov r8d, 0x4c8
xor edx, edx
mov rdi, r9
call sub.ntdll.dll_memset
mov rsi, qword [rbp]
xor ecx, ecx
mov rdx, rsi
mov dword [rsp + 0x558], 0xccccfeeb
call fcn.1800168c8
xor r12d, r12d
mov dword [rsp + 0x70], 0x10000b
test eax, eax
lea ecx, [r12 + 0x10]
cmovne r12d, ecx
test rdi, rdi
jne 0x18001c586
mov rcx, qword [rbp]
mov edx, r12d
call fcn.18001bce0
mov rdi, rax
lea rax, [rsp + 0x30]
mov r15d, 4
lea r8, [rsp + 0x568]
mov rdx, rdi
mov rcx, rsi
mov r9d, r15d
mov qword [rsp + 0x20], rax
call fcn.1800176ec
test eax, eax
je 0x18001c6e0
cmp qword [rsp + 0x30], r15
jne 0x18001c6e0
lea rax, [rsp + 0x560]
lea r9d, [r15 + 0x3c]
mov r8, r15
mov rdx, rdi
mov rcx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x18001c600
lea r9, [rsp + 0x560]
lea r8, [rsp + 0x558]
mov rdx, rdi
mov rcx, rsi
call fcn.18001bc6c
jmp 0x18001c602
xor eax, eax
test eax, eax
je 0x18001c6e0
mov ebx, 0xbb8
mov r15d, 0x64
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, qword [0x1800309f0]
mov edx, r15d
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp + 8]
cmp eax, 0x102
cmovne ebx, r15d
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov rax, qword [0x18002f5e0]
sub ebx, r15d
test rax, rax
je 0x18001c664
mov rcx, qword [rbp + 8]
lea rdx, [rsp + 0x40]
call rax
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
test ebx, ebx
jle 0x18001c672
cmp qword [rsp + 0x138], rdi
jne 0x18001c615
cmp qword [rsp + 0x138], rdi
je 0x18001c683
mov ebx, 0x261
jmp 0x18001c696
xor r9d, r9d
mov r8d, r12d
mov rdx, r14
mov rcx, rbp
call fcn.18001bec4
mov ebx, eax
mov r9d, 0x40
lea rax, [rsp + 0x560]
mov rdx, rdi
lea r15d, [r9 - 0x3c]
mov rcx, rsi
mov qword [rsp + 0x20], rax
mov r8, r15
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x18001c6db
lea r9, [rsp + 0x560]
lea r8, [rsp + 0x568]
mov rdx, rdi
mov rcx, rsi
call fcn.18001bc6c
cmp ebx, 0xffffffff
jne 0x18001c6e8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test r15b, r13b
jne 0x18001c6f7
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, ebx
mov rbx, qword [rsp + 0x550]
add rsp, 0x510
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x18001c830
Capabilities:
Get process image filename
Resume thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x20
mov rbp, qword [rcx]
mov rdi, rcx
mov rcx, qword [0x1800307d8]
mov esi, edx
xor edx, edx
mov r8d, 0x1000
lea r12d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r13d, r13d
cmp rax, r13
mov rbx, rax
je 0x18001c8ef
mov r8d, 0x800
mov rdx, rax
mov rcx, rbp
call sub.PSAPI.DLL_GetProcessImageFileNameW
cmp eax, r13d
je 0x18001c8c6
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
cmp rax, r13
mov rbp, rax
je 0x18001c8c6
mov rcx, rax
call qword [sym.imp.ntdll.dll__wcsupr]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, rbp
mov edx, eax
call fcn.180023f18
xor eax, dword [0x1800309f8]
cmp eax, 0x93c01765
cmove r12d, r13d
mov rcx, qword [0x1800307d8]
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp r12d, r13d
jne 0x18001c8ef
test sil, 4
jne 0x18001c904
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x18001c904
lea rcx, [0x180030aa8]
xor r9d, r9d
mov r8d, esi
mov rdx, rdi
call fcn.18001c508
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r13
pop r12
pop rdi
ret

Function at 0x18001cefc
Capabilities:
Allocate or change rwx memory
Map section object

Disassembly:
mov r11, rsp
sub rsp, 0x68
xor r9d, r9d
mov dword [rsp + 0x48], 0x40
xor eax, eax
mov dword [r11 - 0x28], r9d
mov dword [r11 + 0x24], eax
lea rax, [r11 - 0x18]
mov dword [rsp + 0x38], 2
mov qword [r11 - 0x38], rax
lea rax, [r11 + 0x20]
mov qword [r11 - 0x40], rax
mov qword [r11 - 0x18], r9
mov dword [r11 + 0x20], r9d
mov qword [r11 - 0x48], r9
call qword [sym.imp.ntdll.dll_NtMapViewOfSection]
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
add rsp, 0x68
ret
Function at 0x18001d284
Capabilities:
Decompress data using aplib

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov al, byte [rcx]
xor r10d, r10d
xor r11d, r11d
and dword [rsp + 0x34], r10d
mov byte [rdx], al
lea rax, [rdx + 1]
mov qword [rsp + 0x28], rax
lea rax, [rcx + 1]
xor edi, edi
mov qword [rsp + 0x20], rax
mov rbx, rdx
lea esi, [rdi + 1]
lea rcx, [rsp + 0x20]
call fcn.18001d248
test eax, eax
je 0x18001d47e
lea rcx, [rsp + 0x20]
call fcn.18001d248
test eax, eax
je 0x18001d37b
lea rcx, [rsp + 0x20]
call fcn.18001d248
test eax, eax
je 0x18001d32e
xor r9d, r9d
lea r11d, [r9 + 4]
lea rcx, [rsp + 0x20]
call fcn.18001d248
sub r11d, esi
lea r9d, [rax + r9*2]
jne 0x18001d2f5
test r9d, r9d
mov r8, qword [rsp + 0x28]
je 0x18001d325
mov ecx, r9d
mov rax, r8
sub rax, rcx
mov al, byte [rax]
mov byte [r8], al
jmp 0x18001d495
mov byte [r8], 0
jmp 0x18001d495
mov rax, qword [rsp + 0x20]
mov r8, qword [rsp + 0x28]
movzx r10d, byte [rax]
add rax, rsi
mov ecx, r10d
mov qword [rsp + 0x20], rax
and ecx, esi
add ecx, 2
shr r10d, 1
je 0x18001d374
test ecx, ecx
mov edx, r10d
je 0x18001d479
mov rax, r8
sub rax, rdx
mov al, byte [rax]
mov byte [r8], al
add r8, rsi
add ecx, 0xffffffff
jne 0x18001d35c
jmp 0x18001d474
mov edi, esi
jmp 0x18001d479
mov r9d, esi
lea rcx, [rsp + 0x20]
call fcn.18001d248
lea rcx, [rsp + 0x20]
lea r9d, [rax + r9*2]
call fcn.18001d248
test eax, eax
jne 0x18001d37e
test r11d, r11d
jne 0x18001d3f4
cmp r9d, 2
jne 0x18001d3ee
mov r9d, esi
lea rcx, [rsp + 0x20]
call fcn.18001d248
lea rcx, [rsp + 0x20]
lea r9d, [rax + r9*2]
call fcn.18001d248
test eax, eax
jne 0x18001d3a8
test r9d, r9d
mov r8, qword [rsp + 0x28]
movsxd rcx, r10d
je 0x18001d479
mov rax, r8
sub rax, rcx
mov al, byte [rax]
mov byte [r8], al
add r8, rsi
add r9d, 0xffffffff
jne 0x18001d3d5
jmp 0x18001d474
lea r10d, [r9 - 3]
jmp 0x18001d3f8
lea r10d, [r9 - 2]
mov rcx, qword [rsp + 0x20]
shl r10d, 8
mov r9d, esi
movzx eax, byte [rcx]
add r10d, eax
add rcx, rsi
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x20]
call fcn.18001d248
lea rcx, [rsp + 0x20]
lea r9d, [rax + r9*2]
call fcn.18001d248
test eax, eax
jne 0x18001d412
cmp r10d, 0x7d00
jb 0x18001d43a
add r9d, esi
cmp r10d, 0x500
jb 0x18001d446
add r9d, esi
cmp r10d, 0x80
jae 0x18001d453
add r9d, 2
test r9d, r9d
mov r8, qword [rsp + 0x28]
movsxd rcx, r10d
je 0x18001d479
mov rax, r8
sub rax, rcx
mov al, byte [rax]
mov byte [r8], al
add r8, rsi
add r9d, 0xffffffff
jne 0x18001d460
mov qword [rsp + 0x28], r8
mov r11d, esi
jmp 0x18001d4a0
mov rdx, qword [rsp + 0x20]
mov r8, qword [rsp + 0x28]
mov cl, byte [rdx]
add rdx, rsi
mov byte [r8], cl
mov qword [rsp + 0x20], rdx
add r8, rsi
xor r11d, r11d
mov qword [rsp + 0x28], r8
test edi, edi
je 0x18001d2bc
mov rsi, qword [rsp + 0x58]
sub r8, rbx
mov rbx, qword [rsp + 0x50]
mov eax, r8d
add rsp, 0x40
pop rdi
ret
Function at 0x18001de08
Capabilities:
Set socket configuration

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x70
and dword [rax + 0x20], 0
mov rsi, rcx
mov rcx, qword [0x1800307d8]
mov rbp, rdx
mov edi, 8
xor edx, edx
lea r8d, [rdi + 0x50]
mov dword [rax - 0x20], 1
mov dword [rax - 0x1c], 0x2710
mov dword [rax - 0x18], 0x3e8
mov dword [rax - 0x28], 0x493e0
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
mov rbx, rax
je 0x18001df87
lea r8d, [rdi + 0x50]
xor edx, edx
mov rcx, rax
call sub.ntdll.dll_memset
and qword [rsp + 0x40], 0
and qword [rsp + 0x38], 0
or rax, 0xffffffffffffffff
lea r9d, [rdi + 4]
lea r8, [rsp + 0x58]
mov qword [rbx + 0x30], rax
mov qword [rbx + 0x38], rax
lea rax, [rsp + 0x98]
mov qword [rsp + 0x30], rax
and dword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
mov edx, 0x98000004
mov rcx, rbp
mov qword [rbx + 8], rbx
mov qword [rbx], rbx
mov qword [rbx + 0x18], rsi
call qword [sym.imp.WS2_32.dll_WSAIoctl]
test eax, eax
jne 0x18001df7f
cmp dword [rsi + 0x54], eax
je 0x18001defc
lea r9, [rsp + 0x50]
mov edx, 0xffff
mov r8d, 0x1006
mov rcx, rbp
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jne 0x18001df7f
mov rdx, rbp
mov rcx, rbx
call qword [rsi + 0x40]
test eax, eax
mov edi, eax
jne 0x18001df7f
lea rcx, [rsi + 0x10]
mov qword [rbx + 0x30], rbp
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [rsi + 8]
mov qword [rbx], rsi
mov qword [rbx + 8], rax
mov qword [rax], rbx
lea rcx, [rsi + 0x10]
mov qword [rsi + 8], rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea r8d, [rdi + 0x10]
lea rcx, [0x18001d9dc]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_QueueUserWorkItem]
test eax, eax
jne 0x18001df79
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [rsi + 0x10]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [rbx + 8]
mov r11, qword [rbx]
lea rcx, [rsi + 0x10]
mov qword [rax], r11
mov qword [r11 + 8], rax
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x18001df7b
xor edi, edi
test edi, edi
je 0x18001df87
mov rcx, rbx
call fcn.18001d978
lea r11, [rsp + 0x70]
mov eax, edi
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x18001e1f8
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
xor ebx, ebx
xor r9d, r9d
mov r8d, edi
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_recv]
test eax, eax
je 0x18001e25d
cmp eax, 0xffffffff
jne 0x18001e250
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x2733
mov ebx, eax
jne 0x18001e262
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ebx, ebx
jmp 0x18001e257
sub edi, eax
cdqe
add rsi, rax
test edi, edi
je 0x18001e262
jmp 0x18001e217
mov ebx, 0x4d4
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x18001e27c
Capabilities:
Create thread
Initialize winsock library

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x1d0
xor esi, esi
test r9, r9
mov r12, r9
mov rbp, r8
mov r13, rdx
jne 0x18001e2af
lea edi, [rsi + 0x57]
jmp 0x18001e411
lea rdx, [rsp + 0x30]
mov cx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
mov edi, eax
jne 0x18001e3e6
mov rcx, qword [0x1800307d8]
mov edi, 0x90
xor edx, edx
mov r8, rdi
lea esi, [rax + 1]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
mov rbx, rax
jne 0x18001e2f2
lea edi, [rsi + 7]
jmp 0x18001e403
mov r8, rdi
xor edx, edx
mov rcx, rax
call sub.ntdll.dll_memset
lea rcx, [rbx + 0x50]
mov r8d, 0x10
mov rdx, r13
call sub.ntdll.dll_memcpy
lea rcx, [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
or qword [rbx + 0x60], 0xffffffffffffffff
xor r9d, r9d
xor r8d, r8d
mov edx, esi
xor ecx, ecx
mov qword [rbx + 8], rbx
mov qword [rbx], rbx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
test rax, rax
mov qword [rbx + 0x68], rax
je 0x18001e3f3
test rbp, rbp
mov qword [rbx + 0x70], rbp
jne 0x18001e36b
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
test rax, rax
mov qword [rbx + 0x78], rax
mov qword [rbx + 0x70], rax
je 0x18001e3f3
mov rcx, r12
call qword [sym.imp.SHLWAPI.dll_StrDupA]
mov r8d, 6
mov edx, esi
mov qword [rbx + 0x38], rax
lea rax, [fcn.18001d788]
lea ecx, [r8 - 4]
mov qword [rbx + 0x40], rax
lea rax, [0x18001d7d0]
mov qword [rbx + 0x48], rax
call qword [sym.imp.WS2_32.dll_socket]
cmp rax, 0xffffffffffffffff
mov qword [rbx + 0x60], rax
je 0x18001e3f3
lea rax, [rbx + 0x88]
lea r8, [0x18001dfa0]
mov r9, rbx
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
mov qword [rbx + 0x80], rax
je 0x18001e3f3
mov qword [0x1800307e8], rbx
xor edi, edi
jmp 0x18001e3ee
mov rbx, qword [rsp + 0x208]
cmp edi, 0xffffffff
jne 0x18001e3fb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
je 0x18001e411
test esi, esi
je 0x18001e411
mov rcx, rbx
call fcn.18001e430
call qword [sym.imp.WS2_32.dll_WSACleanup]
lea r11, [rsp + 0x1d0]
mov eax, edi
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r13
pop r12
pop rdi
ret

Function at 0x18001e9b8
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov rcx, qword [rcx]
mov ebx, r8d
test rcx, rcx
je 0x18001e9fe
test rdx, rdx
je 0x18001e9fe
test ebx, ebx
je 0x18001e9fe
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x18001e9ef
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x18001ea03
mov eax, dword [rsp + 0x40]
sub eax, ebx
neg eax
sbb eax, eax
and eax, 0x1d
jmp 0x18001ea03
mov eax, 0x57
add rsp, 0x30
pop rbx
ret
Function at 0x18001ea0c
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov rcx, qword [rcx]
mov ebx, r8d
test rcx, rcx
je 0x18001ea52
test rdx, rdx
je 0x18001ea52
test ebx, ebx
je 0x18001ea52
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x18001ea43
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x18001ea57
mov eax, dword [rsp + 0x40]
sub eax, ebx
neg eax
sbb eax, eax
and eax, 0x1e
jmp 0x18001ea57
mov eax, 0x57
add rsp, 0x30
pop rbx
ret
Function at 0x180022de0
Capabilities:
Check if file exists
Delete file
Get file attributes

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x90
mov rdi, r8
mov rsi, rcx
mov rbx, rdx
xor ebp, ebp
lea rcx, [rax - 0x68]
xor edx, edx
lea r8d, [rbp + 0x60]
call sub.ntdll.dll_memset
test rsi, rsi
je 0x180022e29
test rbx, rbx
je 0x180022e29
test rdi, rdi
je 0x180022e29
mov al, byte [rbx]
mov rcx, rbx
cmp al, 0x2f
jne 0x180022e52
xor eax, eax
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
cmp al, 0x5c
je 0x180022e29
cmp al, 0x3a
je 0x180022e29
add rcx, 1
mov al, byte [rcx]
test al, al
jne 0x180022e44
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov rdx, rsi
lea rcx, [rsp + 0x30]
cmp eax, 0xffffffff
je 0x180022e98
mov r8d, 0x809
call fcn.180021b44
mov rdx, rsi
lea rcx, [rsp + 0x30]
test eax, eax
je 0x180022e98
call fcn.180021fa4
test eax, eax
jne 0x180022ea9
lea rcx, [rsp + 0x30]
call fcn.180021c10
jmp 0x180022e29
xor r8d, r8d
call fcn.180021f30
test eax, eax
je 0x180022e29
mov ebp, 1
lea rcx, [rsp + 0x30]
xor r9d, r9d
mov r8, rdi
mov rdx, rbx
mov dword [rsp + 0x28], 9
and word [rsp + 0x20], 0
call fcn.180022604
lea rcx, [rsp + 0x30]
mov ebx, eax
call fcn.180022b60
lea rcx, [rsp + 0x30]
neg eax
sbb edi, edi
and edi, ebx
call fcn.180022ccc
neg eax
sbb ebx, ebx
and ebx, edi
jne 0x180022f05
test ebp, ebp
je 0x180022f05
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x180022f05
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, ebx
jmp 0x180022e2b
Function at 0x415740
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4158cb
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00432380
xorps xmm15, xmm15
mov r14, qword [0x005d6510]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x4157a5
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x4157b4
add rsp, 0x48
pop rbp
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x4157d3
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x4157e3
cmp rbx, 0x1000
jae 0x4157ab
jmp 0x41584d
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x4157f5
xor edx, edx
jmp 0x415844
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00432380
xorps xmm15, xmm15
mov r14, qword [0x005d6510]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x4157d9
jmp 0x4157c8
call fcn.00463d60
xorps xmm15, xmm15
mov r14, qword [0x005d6510]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.00436420
lea rax, [0x004aa068]
mov ebx, 0x18
nop dword [rax]
call fcn.00436ca0
mov rax, qword [rsp + 0x38]
call fcn.004369e0
lea rax, [0x004aa370]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.00436ca0
mov rax, qword [rsp + 0x30]
call fcn.004369e0
call fcn.00436660
call fcn.00436480
lea rax, [0x004abf89]
mov ebx, 0x21
call fcn.00434980
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00460640
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00415740
Function at 0x415900
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x415b26
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.00432400
xorps xmm15, xmm15
mov r14, qword [0x005d6510]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x415973
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x415982
add rsp, 0x50
pop rbp
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x4159a5
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x4159b5
cmp rbx, 0x1000
jae 0x415979
nop
jmp 0x415a38
add rsp, 0x50
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop word [rax + rax]
cmp rbx, 0x1000
jae 0x4159cd
xor esi, esi
jmp 0x415a2a
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.00432400
xorps xmm15, xmm15
mov r14, qword [0x005d6510]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x4159ab
jmp 0x415996
call fcn.00463d60
xorps xmm15, xmm15
mov r14, qword [0x005d6510]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x415ac0
nop dword [rax + rax]
call fcn.00436420
lea rax, [0x004aa389]
mov ebx, 0x19
call fcn.00436ca0
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
call fcn.004369e0
lea rax, [0x004aa370]
mov ebx, 0x19
call fcn.00436ca0
mov eax, dword [rsp + 0x34]
call fcn.004369e0
nop
call fcn.00436660
call fcn.00436480
lea rax, [0x004a7939]
mov ebx, 0xd
call fcn.00434980
nop dword [rax + rax]
cmp eax, 0x5af
je 0x415a60
call fcn.00436420
lea rax, [0x004aa389]
mov ebx, 0x19
call fcn.00436ca0
mov rax, qword [rsp + 0x38]
call fcn.004369e0
lea rax, [0x004aa370]
mov ebx, 0x19
call fcn.00436ca0
mov eax, dword [rsp + 0x34]
nop dword [rax]
call fcn.004369e0
call fcn.00436660
call fcn.00436480
lea rax, [0x004ab868]
mov ebx, 0x1f
nop dword [rax + rax]
call fcn.00434980
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00460640
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.00415900
Function at 0x41e080
Capabilities:
Hash data using murmur3

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
cmp byte [0x005d6312], 0
jne 0x41e170
sub rbx, qword [rax + 0x18]
mov rdx, qword [rax + 0x48]
test byte [rdx], al
mov ecx, dword [rax + 0x5c]
imul rcx, rbx
mov rbx, rcx
shr rbx, 0x20
shr rcx, 0x23
and ebx, 7
mov rsi, rcx
mov rcx, rbx
mov edi, 1
shl edi, cl
add rdx, rsi
nop
nop
nop
nop
lock or byte [rdx], dil
mov rcx, qword [rax + 0x18]
movabs rdx, 0x800000000000
add rdx, rcx
mov rbx, rdx
shr rdx, 0x2a
nop
nop
nop
cmp rdx, 0x40
jae 0x41e163
lea rsi, [0x00568418]
mov rdx, qword [rsi + rdx*8]
test byte [rdx], al
mov rsi, rcx
shr rsi, 0x10
and esi, 0x3f
shr rcx, 0xd
and ecx, 7
mov edi, 1
shl edi, cl
shr rbx, 0x16
and ebx, 0xfffff
mov rdx, qword [rdx + rbx*8]
test byte [rdx], al
movzx ebx, byte [rdx + rsi + 0x1040]
lea rdx, [rdx + rsi]
lea rdx, [rdx + 0x1040]
test dil, bl
jne 0x41e13e
lock or byte [rdx], dil
mov rcx, qword [r14 + 0x30]
mov rcx, qword [rcx + 0xa0]
test byte [rcx], al
mov rdx, qword [rcx + 0x1270]
add rdx, qword [rax + 0x68]
mov qword [rcx + 0x1270], rdx
add rsp, 0x10
pop rbp
ret
mov rax, rdx
mov ecx, 0x40
call fcn.00462940
lea rax, [0x004ad9fb]
mov ebx, 0x2c
nop dword [rax]
call fcn.00434980
nop
int3

Function at 0x4205c0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4206c6
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov byte [rsp + 0x70], dil
mov qword [rsp + 0x10], 0
jmp 0x420603
mov rax, qword [rsp + 0x58]
mov rcx, rdx
mov rbx, qword [rsp + 0x60]
movzx edi, byte [rsp + 0x70]
cmp qword [rsp + 0x10], rbx
jae 0x4206bb
test byte [rax], al
lea rcx, [rax + 0x100b8]
mov ebx, edi
mov rax, rcx
nop dword [rax]
call fcn.004213a0
test rax, rax
je 0x4206bb
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
lea rcx, [0x00420700]
mov qword [rsp + 0x18], rcx
lea rdx, [rsp + 0x10]
mov qword [rsp + 0x20], rdx
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x40], rax
lea rbx, [rsp + 0x18]
mov qword [rsp], rbx
nop dword [rax]
call fcn.00460520
xorps xmm15, xmm15
mov r14, qword [0x005d6510]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x68]
nop dword [rax]
test rdx, rdx
jne 0x4206a9
xor eax, eax
jmp 0x4206b3
mov rax, qword [rdx]
call rax
mov rdx, qword [rsp + 0x68]
test al, al
je 0x4205f1
mov rax, qword [rsp + 0x10]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov byte [rsp + 0x20], dil
call fcn.00460640
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movzx edi, byte [rsp + 0x20]
jmp fcn.004205c0