joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e4d60
Capabilities:
Hash data using sha384
Hash data using sha512

Disassembly:
mov rcx, qword [rax + 0xd0]
cmp rcx, 6
jne 0x4e4de5
movabs rcx, 0xcbbb9d5dc1059ed8
mov qword [rax], rcx
movabs rcx, 0x629a292a367cd507
mov qword [rax + 8], rcx
movabs rcx, 0x9159015a3070dd17
mov qword [rax + 0x10], rcx
movabs rcx, 0x152fecd8f70e5939
mov qword [rax + 0x18], rcx
movabs rcx, 0x67332667ffc00b31
mov qword [rax + 0x20], rcx
movabs rcx, 0x8eb44a8768581511
mov qword [rax + 0x28], rcx
movabs rcx, 0xdb0c2e0d64f98fa7
mov qword [rax + 0x30], rcx
movabs rcx, 0x47b5481dbefa4fa4
mov qword [rax + 0x38], rcx
nop dword [rax]
jmp 0x4e4f46
cmp rcx, 0xe
jne 0x4e4e60
movabs rcx, 0x8c3d37c819544da2
mov qword [rax], rcx
movabs rcx, 0x73e1996689dcd4d6
mov qword [rax + 8], rcx
movabs rcx, 0x1dfab7ae32ff9c82
mov qword [rax + 0x10], rcx
movabs rcx, 0x679dd514582f9fcf
mov qword [rax + 0x18], rcx
movabs rcx, 0xf6d2b697bd44da8
mov qword [rax + 0x20], rcx
movabs rcx, 0x77e36f7304c48942
mov qword [rax + 0x28], rcx
movabs rcx, 0x3f9d85a86a1d36c8
mov qword [rax + 0x30], rcx
movabs rcx, 0x1112e6ad91d692a1
mov qword [rax + 0x38], rcx
jmp 0x4e4f46
cmp rcx, 0xf
jne 0x4e4ed7
movabs rcx, 0x22312194fc2bf72c
mov qword [rax], rcx
movabs rcx, 0x9f555fa3c84c64c2
mov qword [rax + 8], rcx
movabs rcx, 0x2393b86b6f53b151
mov qword [rax + 0x10], rcx
movabs rcx, 0x963877195940eabd
mov qword [rax + 0x18], rcx
movabs rcx, 0x96283ee2a88effe3
mov qword [rax + 0x20], rcx
movabs rcx, 0xbe5e1e2553863992
mov qword [rax + 0x28], rcx
movabs rcx, 0x2b0199fc2c85b8aa
mov qword [rax + 0x30], rcx
movabs rcx, 0xeb72ddc81c52ca2
mov qword [rax + 0x38], rcx
jmp 0x4e4f46
movabs rcx, 0x6a09e667f3bcc908
mov qword [rax], rcx
movabs rcx, 0xbb67ae8584caa73b
mov qword [rax + 8], rcx
movabs rcx, 0x3c6ef372fe94f82b
mov qword [rax + 0x10], rcx
movabs rcx, 0xa54ff53a5f1d36f1
mov qword [rax + 0x18], rcx
movabs rcx, 0x510e527fade682d1
mov qword [rax + 0x20], rcx
movabs rcx, 0x9b05688c2b3e6c1f
mov qword [rax + 0x28], rcx
movabs rcx, 0x1f83d9abfb41bd6b
mov qword [rax + 0x30], rcx
movabs rcx, 0x5be0cd19137e2179
mov qword [rax + 0x38], rcx
movups xmmword [rax + 0xc0], xmm15
ret
Function at 0x50c020
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50c25c
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x58], rax
call fcn.004b8900
xorps xmm15, xmm15
mov r14, qword [0x00769cf8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
add qword [rcx + 0x68], rax
mov rdx, qword [rcx + 0x60]
test rdx, rdx
jle 0x50c16a
nop
cmp rdx, 0x40
ja 0x50c24e
lea rsi, [rdx - 0x40]
mov rdi, rsi
neg rsi
cmp rax, rsi
cmovl rsi, rax
mov qword [rsp + 0x28], rsi
sar rdi, 0x3f
and rdi, rdx
lea rdx, [rcx + rdi]
lea rdx, [rdx + 0x20]
mov rbx, qword [rsp + 0x60]
cmp rbx, rdx
je 0x50c0d9
mov rax, rdx
mov rcx, rsi
nop
call fcn.00460b20
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdx, qword [rcx + 0x60]
add rdx, rsi
mov qword [rcx + 0x60], rdx
cmp rdx, 0x40
jne 0x50c141
mov qword [rsp], rcx
lea rax, [rcx + 0x20]
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], 0x40
mov qword [rsp + 0x18], 0x40
call fcn.0050c680
xorps xmm15, xmm15
mov r14, qword [0x00769cf8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov qword [rax + 0x60], 0
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
cmp rax, rsi
jb 0x50c243
mov rdi, qword [rsp + 0x70]
sub rdi, rsi
mov rdx, rax
sub rax, rsi
mov r8, rdi
neg rdi
sar rdi, 0x3f
and rsi, rdi
add rbx, rsi
jmp 0x50c177
mov rdx, rax
mov rbx, qword [rsp + 0x60]
mov r8, qword [rsp + 0x70]
cmp rax, 0x40
jl 0x50c1f7
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x40], rbx
mov qword [rsp], rcx
mov qword [rsp + 8], rbx
and rax, 0xffffffffffffffc0
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x10], rax
mov qword [rsp + 0x18], r8
call fcn.0050c680
xorps xmm15, xmm15
mov r14, qword [0x00769cf8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x38]
mov rdx, rax
sub rax, rcx
sar rax, 0x3f
mov rcx, qword [rsp + 0x30]
and rax, rcx
and rax, 0xffffffffffffffc0
mov rbx, qword [rsp + 0x40]
add rbx, rax
sub rcx, rdx
mov rdx, qword [rsp + 0x68]
mov rax, rcx
mov rcx, qword [rsp + 0x58]
test rax, rax
je 0x50c232
cmp rax, 0x40
mov esi, 0x40
cmovl rsi, rax
lea rax, [rcx + 0x20]
cmp rbx, rax
je 0x50c22e
mov qword [rsp + 0x38], rsi
mov rcx, rsi
call fcn.00460b20
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x38]
mov qword [rcx + 0x60], rsi
mov rax, rdx
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov rcx, rax
mov rax, rsi
call fcn.00460260
mov rax, rdx
mov ecx, 0x40
call fcn.00460260
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.0045db40
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.0050c020
Function at 0x513080
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov qword [rsp + 0xb0], rax
movups xmmword [rsp + 0x68], xmm15
movups xmmword [rsp + 0x6c], xmm15
movups xmmword [rsp + 0x7c], xmm15
movups xmmword [rsp + 0x8c], xmm15
movups xmmword [rsp + 0x9c], xmm15
jmp 0x5130d5
dec rcx
mov rdx, rcx
neg rcx
sar rcx, 0x3f
and ecx, 1
add rax, rcx
dec rbx
mov rcx, rdx
test rbx, rbx
je 0x5130df
cmp byte [rax], 0
je 0x5130bc
movups xmmword [rsp + 0x14], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rdx, [rbx - 1]
xor ecx, ecx
jmp 0x513120
mov byte [rsp + rdx + 0x15], dil
and r10d, esi
mov byte [rsp + rdx + 0x38], r10b
dec rdx
shr r8w, 8
mov ecx, r8d
nop dword [rax]
test rdx, rdx
jl 0x513168
movzx esi, byte [rax + rdx]
movzx edi, cl
add esi, edi
test rdx, rdx
jle 0x51313a
movzx edi, byte [rdx + rax - 1]
jmp 0x51313c
xor edi, edi
mov r8d, esi
shr si, 1
shl edi, 7
movzx edi, dil
or esi, edi
lea edi, [rsi + r8]
mov r8d, edi
xor edi, esi
lea r9, [rdx + 1]
mov r10d, edi
and edi, r8d
nop
cmp r9, 0x21
jb 0x513105
jmp 0x5131bf
mov byte [rsp + 0x14], cl
lea eax, [rcx - 1]
neg eax
mov byte [rsp + 0x35], al
lea rax, [rbx + 1]
mov byte [rsp + 0x36], al
mov rax, qword [rsp + 0x14]
mov qword [rsp + 0x68], rax
movups xmm0, xmmword [rsp + 0x18]
movups xmmword [rsp + 0x6c], xmm0
movups xmm0, xmmword [rsp + 0x28]
movups xmmword [rsp + 0x7c], xmm0
movups xmm0, xmmword [rsp + 0x38]
movups xmmword [rsp + 0x8c], xmm0
movups xmm0, xmmword [rsp + 0x48]
movups xmmword [rsp + 0x9c], xmm0
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov rax, r9
mov ecx, 0x21
call fcn.004601a0
nop
int3
Function at 0x51aa00
Capabilities:
Authenticate hmac

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x51ab1a
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], rax
cmp rcx, 0x40
jle 0x51aa5e
mov rdx, qword [rax + 0x10]
mov rsi, qword [rax + 0x18]
mov rdx, qword [rdx + 0x38]
mov rax, rsi
call rdx
mov rdx, qword [rsp + 0x48]
mov rsi, qword [rdx + 0x10]
mov rax, qword [rdx + 0x18]
mov rsi, qword [rsi + 0x30]
xor ebx, ebx
xor ecx, ecx
mov rdi, rcx
call rsi
mov rcx, rbx
mov rbx, rax
mov rax, qword [rsp + 0x48]
test byte [rax], al
cmp rcx, 0x40
mov edi, 0x40
cmovl rdi, rcx
lea rdx, [rax + 0x20]
mov qword [rsp + 0x30], rdx
cmp rbx, rdx
je 0x51aaa4
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rdi
mov rax, rdx
mov rcx, rdi
call fcn.00460b20
mov rax, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x20]
lea rsi, [rax + 0x60]
cmp rbx, rsi
je 0x51aac2
mov rax, rsi
mov rcx, rdi
call fcn.00460b20
mov rax, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x30]
xor ecx, ecx
jmp 0x51aad6
movzx esi, byte [rax + rcx + 0x20]
xor esi, 0x36
mov byte [rax + rcx + 0x20], sil
inc rcx
cmp rcx, 0x40
jl 0x51aac6
xor ecx, ecx
nop
jmp 0x51aaf2
movzx esi, byte [rax + rcx + 0x60]
xor esi, 0x5c
mov byte [rax + rcx + 0x60], sil
inc rcx
cmp rcx, 0x40
jl 0x51aae2
mov rsi, qword [rax]
mov rax, qword [rax + 8]
mov rsi, qword [rsi + 0x38]
mov rbx, rdx
mov ecx, 0x40
mov rdi, rcx
call rsi
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.0045db40
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.0051aa00
Function at 0x140001790
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rsi, rdx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
test rax, rax
je 0x140001847
movsxd r13, dword [rax + 0x3c]
mov r12d, dword [r13 + rax + 0x88]
mov r15d, dword [r12 + rax + 0x1c]
mov r10d, dword [r12 + rax + 0x20]
add r15, rax
mov r11d, dword [r12 + rax + 0x24]
add r10, rax
add r11, rax
test esi, 0xffff0000
jne 0x1400017fe
movzx eax, si
sub eax, dword [r12 + rbx + 0x10]
mov eax, dword [r15 + rax*4]
add rax, rbx
jmp 0x140001849
mov edi, dword [r12 + rax + 0x18]
xor r14d, r14d
mov r9d, r14d
test edi, edi
je 0x140001847
nop dword [rax]
mov eax, dword [r10]
mov r8, rsi
movzx ebp, word [r11]
add rax, rbx
sub r8, rax
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140001833
inc rax
test ecx, ecx
jne 0x140001820
test edx, edx
je 0x140001866
inc r9d
add r11, 2
add r10, 4
cmp r9d, edi
jb 0x140001810
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov ecx, dword [r15 + rbp*4]
cmp r12, rcx
ja 0x14000191e
mov eax, dword [r13 + rbx + 0x8c]
add eax, r12d
cmp rcx, rax
jae 0x14000191e
lea rbp, [rcx + rbx]
mov rcx, rbp
lea rdx, [0x1400033c0]
call qword [sym.imp.VCRUNTIME140.dll_strstr]
mov rdi, rax
lea rsi, [rax + 1]
mov rax, 0xffffffffffffffff
sub rsi, rbp
mov rcx, rsi
add rcx, 4
lea edx, [rax + 2]
cmovb rcx, rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov rbx, rax
test rax, rax
je 0x140001847
mov r8, rsi
mov rdx, rbp
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
movzx ecx, word [0x1400033c4]
mov word [rbx + rsi], cx
movzx ecx, byte [0x1400033c6]
mov byte [rbx + rsi + 2], cl
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x14000190d
lea rdx, [rdi + 1]
mov rcx, rbx
call fcn.140001790
mov r14, rax
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rax, r14
jmp 0x140001849
lea rax, [rcx + rbx]
jmp 0x140001849
Function at 0x6d8eba60
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x6d90c5e4]
test esi, esi
mov rbx, rcx
mov rbp, rdx
mov rdi, r8
jle 0x6d8ebbe8
mov rax, qword [0x6d90c5e8]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp rbx, rdx
jb 0x6d8ebaac
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rbx, rdx
jb 0x6d8ebb35
add ecx, 1
add rax, 0x28
cmp ecx, esi
jne 0x6d8eba90
mov rcx, rbx
call sym.__mingw_GetSectionForAddress
test rax, rax
mov r12, rax
je 0x6d8ebc1d
mov rax, qword [0x6d90c5e8]
lea rsi, [rsi + rsi*4]
shl rsi, 3
add rax, rsi
mov qword [rax + 0x20], r12
mov dword [rax], 0
call sym._GetPEImageBase
mov ecx, dword [r12 + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x6d90c5e8]
mov qword [rax + rsi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x6d8ebc00
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x6d8ebb2e
sub eax, 0x40
and eax, 0xffffffbf
jne 0x6d8ebb90
add dword [0x6d90c5e4], 1
cmp edi, 8
jae 0x6d8ebb63
test dil, 4
jne 0x6d8ebbd4
test edi, edi
je 0x6d8ebb58
movzx eax, byte [rbp]
test dil, 2
mov byte [rbx], al
jne 0x6d8ebbef
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov eax, edi
sub edi, 1
mov rdx, qword [rbp + rax - 8]
cmp edi, 8
mov qword [rbx + rax - 8], rdx
jb 0x6d8ebb58
and edi, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov rcx, qword [rbp + rdx]
cmp eax, edi
mov qword [rbx + rdx], rcx
jb 0x6d8ebb7c
jmp 0x6d8ebb58
add rsi, qword [0x6d90c5e8]
mov r8d, 0x40
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r9, rsi
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x6d8ebb2e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call sym.__report_error
mov eax, dword [rbp]
mov edi, edi
mov dword [rbx], eax
mov eax, dword [rbp + rdi - 4]
mov dword [rbx + rdi - 4], eax
jmp 0x6d8ebb58
xor esi, esi
jmp 0x6d8ebab7
mov edi, edi
movzx eax, word [rbp + rdi - 2]
mov word [rbx + rdi - 2], ax
jmp 0x6d8ebb58
mov rax, qword [0x6d90c5e8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov edx, dword [r12 + 8]
mov r8, qword [rax + rsi + 0x18]
call sym.__report_error
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call sym.__report_error
nop
nop dword [rax]

Function at 0x6d8ec370
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x6d90c8c0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x6d90c8a0]
test rbx, rbx
je 0x6d8ec3c4
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x6d8ec3bb
test rsi, rsi
je 0x6d8ec3bb
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x6d8ec3a0
lea rcx, [0x6d90c8c0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x6d8ec600
Capabilities:
Parse pe header

Disassembly:
cmp word [rcx], 0x5a4d
je 0x6d8ec610
xor eax, eax
ret
jmp sym._ValidateImageBase.part.0

Function at 0x6d8ec620
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x6d8ec661
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
mov r8d, dword [rax + 0xc]
cmp r8, rdx
mov rcx, r8
ja 0x6d8ec658
add ecx, dword [rax + 8]
cmp rcx, rdx
ja 0x6d8ec663
add rax, 0x28
cmp rax, r9
jne 0x6d8ec644
xor eax, eax
ret

Function at 0x6d8ec700
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x6d9091f0]
cmp word [r8], 0x5a4d
mov rdx, rcx
jne 0x6d8ec76d
mov rcx, r8
call sym._ValidateImageBase.part.0
test eax, eax
je 0x6d8ec76d
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x6d8ec76d
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x6d8ec764
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x6d8ec76f
add rax, 0x28
cmp rax, r9
jne 0x6d8ec750
xor eax, eax
add rsp, 0x28
ret

Function at 0x6d8ec870
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x6d9091f0]
xor eax, eax
cmp word [r8], 0x5a4d
mov rdx, rcx
je 0x6d8ec890
add rsp, 0x28
ret
mov rcx, r8
call sym._ValidateImageBase.part.0
test eax, eax
je 0x6d8ec888
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x6d8ec8ed
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x6d8ec8e4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x6d8ec8f4
add rax, 0x28
cmp rax, r9
jne 0x6d8ec8d0
xor eax, eax
add rsp, 0x28
ret
mov eax, dword [rax + 0x24]
not eax
shr eax, 0x1f
add rsp, 0x28
ret

Function at 0x6d8ec910
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r11, qword [0x6d9091f0]
cmp word [r11], 0x5a4d
mov r9d, ecx
jne 0x6d8ec97e
mov rcx, r11
call sym._ValidateImageBase.part.0
test eax, eax
je 0x6d8ec97e
movsxd rax, dword [r11 + 0x3c]
add rax, r11
mov edx, dword [rax + 0x90]
test edx, edx
je 0x6d8ec97e
movzx ecx, word [rax + 0x14]
lea rcx, [rax + rcx + 0x18]
movzx eax, word [rax + 6]
test eax, eax
je 0x6d8ec97e
sub eax, 1
lea rax, [rax + rax*4]
lea rax, [rcx + rax*8 + 0x28]
mov r10d, dword [rcx + 0xc]
cmp rdx, r10
mov r8, r10
jb 0x6d8ec975
add r8d, dword [rcx + 8]
cmp rdx, r8
jb 0x6d8ec985
add rcx, 0x28
cmp rcx, rax
jne 0x6d8ec960
xor eax, eax
add rsp, 0x28
ret
add rdx, r11
jne 0x6d8ec998
jmp 0x6d8ec97e
sub r9d, 1
add rdx, 0x14
mov ecx, dword [rdx + 4]
test ecx, ecx
jne 0x6d8ec9a6
mov eax, dword [rdx + 0xc]
test eax, eax
je 0x6d8ec97e
test r9d, r9d
jg 0x6d8ec990
mov eax, dword [rdx + 0xc]
add rax, r11
add rsp, 0x28
ret
Function at 0x6d8ecd10
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call sym.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call sym.__acrt_iob_func
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sym.vfprintf
call sym.abort
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x417bc0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x417d6b
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00432580
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
nop
jne 0x417c2e
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x417c41
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x417c65
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x417c79
cmp rbx, 0x1000
jae 0x417c38
nop
jmp 0x417ce9
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop
cmp rbx, 0x1000
jae 0x417c8d
xor edx, edx
jmp 0x417ce0
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00432580
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
nop
test dl, dl
jne 0x417c6f
jmp 0x417c55
call fcn.00464b80
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.00437740
lea rax, [0x00670bad]
mov ebx, 0x18
nop dword [rax + rax]
call fcn.00438040
mov rax, qword [rsp + 0x38]
call fcn.00437d40
lea rax, [0x00670c9d]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.00438040
mov rax, qword [rsp + 0x30]
call fcn.00437d40
call fcn.004379a0
call fcn.004377c0
lea rax, [0x00674e58]
mov ebx, 0x21
call fcn.00435fc0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00460fe0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00417bc0
Function at 0x417da0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x417fca
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.00432600
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x417e1b
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x417e2e
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x417e50
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x417e64
cmp rbx, 0x1000
jae 0x417e25
jmp 0x417eee
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x417e76
xor esi, esi
jmp 0x417ee0
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
nop dword [rax]
call fcn.00432600
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
test sil, sil
jne 0x417e5a
jmp 0x417e42
call fcn.00464b80
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x417f69
call fcn.00437740
lea rax, [0x00671341]
mov ebx, 0x19
call fcn.00438040
mov rax, qword [rsp + 0x68]
call fcn.00437d40
lea rax, [0x00670c9d]
mov ebx, 0x19
nop
call fcn.00438040
mov eax, dword [rsp + 0x34]
call fcn.00437d40
call fcn.004379a0
call fcn.004377c0
lea rax, [0x0066bbff]
mov ebx, 0xd
call fcn.00435fc0
cmp eax, 0x5af
je 0x417f13
call fcn.00437740
lea rax, [0x00671341]
mov ebx, 0x19
call fcn.00438040
mov rax, qword [rsp + 0x38]
call fcn.00437d40
lea rax, [0x00670c9d]
mov ebx, 0x19
nop dword [rax]
call fcn.00438040
mov eax, dword [rsp + 0x34]
call fcn.00437d40
call fcn.004379a0
call fcn.004377c0
lea rax, [0x00673ffd]
mov ebx, 0x1f
call fcn.00435fc0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00460fe0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00417da0
Function at 0x41f480
Capabilities:
Hash data using murmur3

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
cmp byte [0x008b41e5], 0
jne 0x41f579
nop
nop
nop
nop
sub rbx, qword [rax + 0x18]
nop
mov edx, dword [rax + 0x5c]
imul rbx, rdx
mov rdx, rbx
shr rbx, 0x20
nop
shr rdx, 0x23
and rbx, 7
mov rsi, rcx
mov rcx, rbx
mov r8d, 1
shl r8d, cl
nop
add rdx, qword [rax + 0x50]
lock or byte [rdx], r8b
nop
nop
mov rcx, qword [rax + 0x18]
nop
movabs rdx, 0x800000000000
lea rax, [rdx + rcx]
mov rdx, rax
shr rax, 0x2a
cmp rax, 0x40
jae 0x41f56f
lea rbx, [0x00886638]
mov rax, qword [rbx + rax*8]
shr rdx, 0x16
and rdx, 0xfffff
mov rdx, qword [rax + rdx*8]
test byte [rdx], al
test byte [rax], al
mov rax, rcx
shr rcx, 0x10
and rcx, 0x3f
movzx ebx, byte [rdx + rcx + 0x21040]
lea rdx, [rdx + rcx]
lea rdx, [rdx + 0x21040]
shr rax, 0xd
and rax, 7
mov rcx, rax
mov eax, 1
shl eax, cl
test al, bl
jne 0x41f54a
lock or byte [rdx], al
mov rax, qword [r14 + 0x30]
mov rax, qword [rax + 0xa0]
test byte [rax], al
add qword [rax + 0x16a8], rsi
add qword [rax + 0x16b0], rdi
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov ecx, 0x40
call fcn.00463700
lea rax, [0x00678909]
mov ebx, 0x2c
call fcn.00435fc0
nop
int3