joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000638d
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x20], r9d
bsr rax, rsp
push rsi
push rdi
test r13w, r15w
push r14
movzx r14, r8w
sub rsp, 0x20
lea rax, [rcx - 1]
mov dword [rsp + 0x58], 0
sub r14w, r15w
mov r14, rdx
mov sil, 0x5a
mov rsi, rcx
cmp rax, 0xfffffffffffffffd
jmp 0x1400063c8
ja 0x1400065f1
mov eax, 0x5a4d
test r12b, 0xa1
cmp eax, 0x6670761f
jmp 0x1400063e1
cmp word [rcx], ax
jmp 0x1400063e9
jne 0x1400065f1
mov edi, dword [rcx + 0x3c]
add rdi, rcx
cmp r9b, 0xc5
jmp 0x1400063fe
cmp dword [rdi], 0x4550
jne 0x1400065f1
test rdi, rdi
jmp 0x140006412
je 0x1400065f1
movzx eax, word [rdi + 0x18]
sar cx, cl
xor cl, 0xfe
bsf cx, r9w
mov ecx, 0x10b
mov qword [rsp + 0x48], rbp
clc
cmp r12b, r14b
cmp r13b, 0xdd
cmp ax, cx
jmp 0x140006441
je 0x14000649f
mov ecx, 0x20b
cmc
cmp ax, cx
jmp 0x140006455
je 0x140006486
mov rbp, qword [rsp + 0x48]
bt ax, 0x92
xchg di, r14w
mov eax, 0xfffffffe
cmp r12d, ebp
xadd sil, dil
add rsp, 0x20
movzx r14, r12w
pop r14
cmovs di, di
pop rdi
pop rsi
ret
mov rbp, qword [rdi + 0x30]
jmp 0x14000649a
jmp 0x1400064a9
mov ebp, dword [rdi + 0x34]
movsx r9, r15w
bswap rcx
mov r8d, 5
cmovs r9w, r11w
movsxd rcx, r15d
movsx r9w, dl
mov qword [rsp + 0x40], rbx
movzx rcx, dx
xchg rcx, rcx
lea r9, [rsp + 0x58]
mov rcx, rsi
jmp 0x1400064d5
call section..code0
test rax, rax
jmp 0x1400064e2
je 0x1400065dc
mov ebx, dword [rsp + 0x58]
stc
cmp r10b, r15b
jmp 0x1400064f5
test ebx, ebx
jmp 0x1400064fc
je 0x1400065dc
mov rdi, rsi
movzx ecx, bp
sub rdi, rbp
add r8b, r11b
add rdi, r14
cdq
rol r9b, 0x20
nop dword [rax]
test bpl, r13b
cmc
sal edx, cl
mov edx, dword [rax + 4]
lea r8, [rax + 8]
dec r9b
sub r9b, dl
sar r9, 0x88
mov ecx, dword [rax]
sub ebx, edx
add edx, 0xfffffff8
add r9, 0x127fdd
sar r9b, 0xbc
lea rcx, [rcx + rsi]
sal r9b, cl
movsx r9w, r10b
shr edx, 1
movzx r9w, dl
jmp 0x14000655e
mov r9, rdi
jmp 0x140006566
call fcn.14000661a
test rax, rax
jmp 0x140006573
je 0x1400065cd
test ebx, ebx
jmp 0x140006580
jne 0x140006523
xor eax, eax
sar bx, 0x15
mov rdi, 0x3d401286
mov rbx, qword [rsp + 0x40]
and r14b, 0x22
mov rbp, qword [rsp + 0x48]
bsf r14d, edx
or sil, 0x1c
stc
add rsp, 0x20
jmp 0x1400065ba
pop r14
movzx si, bpl
pop rdi
movsx rsi, bp
pop rsi
jmp 0x1400065cc
ret
mov eax, 0xfffffffe
jmp 0x1400065d7
jmp 0x140006593
movzx eax, byte [rdi + 0x16]
cmc
and al, 1
neg al
jmp 0x1400065ea
sbb eax, eax
jmp 0x140006593
mov eax, 0xfffffffe
stc
xor r14b, sil
add rsp, 0x20
movzx r14, r14w
pop r14
movzx edi, si
mov sil, r13b
pop rdi
movsx rsi, si
setb sil
pop rsi
jmp 0x140006619
ret
Function at 0x140006dc4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
and r9w, 0x2cc7
adc r9w, 0x46aa
mov qword [rsp + 0x18], rbp
movzx r8d, r9w
btc r9w, cx
shl ebp, 0x57
mov qword [rsp + 0x20], rsi
rcr r9d, cl
and bp, cx
push rdi
sal r8d, 0x69
or r9b, al
rol r9w, cl
sub rsp, 0x20
setae bpl
mov r8b, sil
movzx bp, cl
mov r8d, 1
setb r9b
movsx bp, al
lea r9, [rsp + 0x38]
movzx ebp, sp
mov bpl, bpl
mov rbp, rcx
jmp 0x140006e2d
call section..code0
mov rsi, rax
cmp al, 0x3b
test rax, rax
jmp 0x140006e3f
je 0x140006f56
cmp dword [rax + 0xc], 0
jmp 0x140006e4e
je 0x140006f47
nop dword [rax]
cmp dword [rsi], 0
jmp 0x140006e63
je 0x140006f47
mov ebx, dword [rsi + 0xc]
add rbx, rbp
mov ch, 0xd4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdi, rax
stc
test rax, rax
jne 0x140006ea2
mov rcx, rbx
jmp 0x140006e90
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
je 0x140006f56
mov ebx, dword [rsi + 0x10]
xor ax, bx
xadd al, al
add rbx, rbp
shl ax, 0x55
mov rax, qword [rbx]
cmc
cmp spl, al
clc
test rax, rax
jmp 0x140006ec2
je 0x140006f39
jns 0x140006edb
movzx edx, ax
jmp 0x140006ed6
jmp 0x140006eff
lea rdx, [rax + rbp]
jmp 0x140006eeb
test rdx, rdx
jmp 0x140006ef3
je 0x140006f56
add rdx, 2
xchg ch, cl
mov rcx, rdi
jmp 0x140006f07
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jmp 0x140006f15
je 0x140006f56
mov qword [rbx], rax
rcr ax, cl
add rbx, 8
cdqe
rcl ax, 0xa8
inc al
mov rax, qword [rbx]
test rax, rax
jne 0x140006ec8
add rsi, 0x14
cmp dword [rsi + 0xc], 0
jne 0x140006e5b
mov eax, 1
jmp 0x140006f51
jmp 0x140006f5f
sub eax, eax
and sil, dil
sbb sil, 0xc2
mov rbx, qword [rsp + 0x30]
shr dil, cl
mov rbp, qword [rsp + 0x40]
movzx si, bl
bsf si, r13w
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
movsxd rdi, esi
pop rdi
jmp 0x140006f87
ret
Function at 0x140006f88
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
movsx ax, r13b
btr bp, di
cwde
push rsi
dec bpl
jmp 0x140006fa8
sub rsp, 0x20
adc ebp, ebp
stc
movsx bx, r15b
mov rbx, rcx
bt rbp, rsi
xor esi, esi
ror rbp, 0xb9
adc bp, 0x6014
mov ecx, esi
movsx rbp, cx
sal bpl, cl
mov ebp, 0x5a4d
add rax, 0x43c15e2e
stc
shrd eax, ebp, 0x29
lea rax, [rbx - 1]
cmp rax, 0xfffffffffffffffd
jmp 0x140006fed
ja 0x140007022
cmp word [rbx], bp
jmp 0x140006ffb
jne 0x140007022
mov eax, dword [rbx + 0x3c]
clc
cmc
lea rax, [rax + rbx]
cmc
cmp dword [rax], 0x4550
jmp 0x140007016
cmove rcx, rax
movsx rax, r11w
cmc
movsxd rax, r14d
mov eax, 0x2000
stc
cmp ax, si
test word [rcx + 0x16], ax
je 0x1400070ae
lea rax, [rbx - 1]
cmc
cmp rax, 0xfffffffffffffffd
ja 0x140007073
cmp word [rbx], bp
jmp 0x14000704c
jne 0x140007073
mov eax, dword [rbx + 0x3c]
and cx, 0x4116
lea rax, [rax + rbx]
cmp dword [rax], 0x4550
cmova cx, bx
not ch
cmove rsi, rax
clc
movzx rdx, sp
mov eax, dword [rsi + 0x28]
xor r8d, r8d
lea rax, [rax + rbx]
movsx rdx, si
sub cl, r10b
mov rcx, rbx
sar rbp, 0xc5
cmp di, 0x4cc4
lea edx, [r8 + 1]
rol bh, 0x47
mov rbx, qword [rsp + 0x40]
sbb esi, 0x5ae33dd5
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
push rax
ret
mov r8d, 9
mov r9w, 0x5500
lea r9, [rsp + 0x38]
mov rcx, rbx
jmp 0x1400070c6
call section..code0
test rax, rax
jmp 0x1400070d3
je 0x140007165
mov qword [rsp + 0x30], rdi
btc di, 0x30
mov rdi, qword [rax + 0x18]
clc
test rdi, rdi
jmp 0x1400070f0
je 0x140007159
mov rax, qword [rdi]
jmp 0x140007106
test rax, rax
jmp 0x14000710e
je 0x140007159
nop dword [rax]
sub dx, r11w
nop dword [rax + rax]
btc rcx, r15
sar ch, cl
jmp 0x14000712f
sub r8d, r8d
movzx edx, sp
movsx rcx, r15w
lea rdi, [rdi + 8]
cqo
mov rcx, rbx
lea edx, [r8 + 1]
jmp 0x14000714b
call rax
mov rax, qword [rdi]
test rax, rax
jne 0x14000712f
mov rdi, qword [rsp + 0x30]
shld rax, rdx, 0xe9
add al, 0x41
lea rax, [rbx - 1]
cmp rax, 0xfffffffffffffffd
jmp 0x140007172
ja 0x1400071a2
cmp word [rbx], bp
jmp 0x140007180
jne 0x1400071a2
mov eax, dword [rbx + 0x3c]
btr rbp, 0xe5
lea rax, [rax + rbx]
adc bp, cx
cmp dword [rax], 0x4550
movsx ebp, cx
cmove rsi, rax
mov eax, dword [rsi + 0x28]
sub rsi, r13
bt rsi, 0x87
btr esi, 0x5d
add rax, rbx
movzx si, r9b
mov rbx, rdx
btr bx, r11w
mov rbx, qword [rsp + 0x40]
shl sil, cl
rcl sil, 0x69
movzx rbp, r14w
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
jmp 0x1400071e0
push rax
ret
Function at 0x14000822a
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
cmp r10d, ebx
push rdi
clc
test r10b, r9b
sub rsp, 0x90
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rbx, rax
cmovae ecx, eax
btc ecx, eax
mov cl, 0x68
movzx ecx, word [rax]
test cx, 0x2751
cmp cx, 0x22
jmp 0x140008260
jne 0x1400082b7
nop
movzx edx, cx
cmp cx, 0x22
je 0x14000828a
movzx ecx, word [rbx + 2]
cdq
clc
add rbx, 2
movzx edx, cx
test cx, cx
jne 0x140008267
lea rax, [rbx + 2]
cmp dx, 0x22
not cl
cmovne rax, rbx
not bx
xchg bh, ch
movzx ecx, r15w
mov rbx, rax
mov cx, di
cmovne cx, sp
movsx ecx, r14w
movzx ecx, word [rax]
jmp 0x1400082fc
cmp cx, 0x20
jbe 0x1400082fc
nop dword [rax]
nop word [rax + rax]
shl cx, cl
movsx rcx, r14w
and ecx, 0x497d0a04
movzx ecx, word [rbx + 2]
test sil, r8b
add rbx, 2
cmp esi, 0x64b41719
clc
cmp cx, 0x20
jmp 0x1400082f6
ja 0x1400082db
test cx, cx
je 0x140008330
cmp cx, 0x20
jmp 0x14000830e
ja 0x140008330
movzx ecx, word [rbx + 2]
cmp r13w, 0x4575
add rbx, 2
test cx, cx
jmp 0x14000832a
jne 0x140008305
lea rcx, [rsp + 0x20]
jmp 0x14000833a
mov dword [rsp + 0x5c], 0
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
call fcn.140008527
test byte [rsp + 0x5c], 1
movzx di, bl
bswap di
movsxd rdi, edx
movzx edi, word [rsp + 0x60]
jmp 0x140008366
jne 0x140008371
mov edi, 0xa
xor ecx, ecx
jmp 0x140008378
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov r9d, edi
bswap r8w
bts ecx, ebx
test rbx, r12
mov r8, rbx
neg cx
cmp sil, sil
mov rcx, rax
clc
xor edx, edx
jmp 0x14000839f
call fcn.140007947
mov ebx, eax
call fcn.1400083b8
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x180002ac0
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
cmp edx, 1
jne 0x180002ae8
xor eax, eax
lea r8, [0x180002990]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
add rsp, 0x38
ret

Function at 0x180004040
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [rsp + 0x78]
sub rax, 0x10000
mov rcx, rax
call fcn.180004260
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x70]
cmp qword [rsp + 0x20], rax
jbe 0x180004147
mov rax, qword [section..data]
cmp qword [rsp + 0x20], rax
jb 0x1800040a4
mov rax, qword [0x18000c008]
cmp qword [rsp + 0x20], rax
ja 0x1800040a4
mov rax, qword [rsp + 0x20]
sub rax, 0x8000000
mov qword [rsp + 0x20], rax
jmp 0x180004066
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x30
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x1800040d3
jmp 0x180004147
cmp dword [rsp + 0x50], 0x10000
jne 0x18000412a
cmp qword [rsp + 0x48], 0x10000
jb 0x18000412a
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x180004118
mov rax, qword [rsp + 0x28]
jmp 0x180004149
mov rax, qword [rsp + 0x20]
sub rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x180004142
mov rax, qword [rsp + 0x38]
sub rax, 0x10000
mov rcx, rax
call fcn.180004260
mov qword [rsp + 0x20], rax
jmp 0x180004066
xor eax, eax
add rsp, 0x68
ret

Function at 0x180004150
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rcx, qword [rsp + 0x70]
call fcn.1800042a0
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x78]
cmp qword [rsp + 0x20], rax
jae 0x180004253
mov rax, qword [section..data]
cmp qword [rsp + 0x20], rax
jb 0x1800041ab
mov rax, qword [0x18000c008]
cmp qword [rsp + 0x20], rax
ja 0x1800041ab
mov rax, qword [rsp + 0x20]
add rax, 0x8000000
mov qword [rsp + 0x20], rax
jmp 0x18000416d
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x30
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x1800041da
jmp 0x180004253
cmp dword [rsp + 0x50], 0x10000
jne 0x180004231
cmp qword [rsp + 0x48], 0x10000
jb 0x180004231
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x18000421f
mov rax, qword [rsp + 0x28]
jmp 0x180004255
mov rax, qword [rsp + 0x20]
add rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x18000424e
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
mov rcx, rax
call fcn.1800042a0
mov qword [rsp + 0x20], rax
jmp 0x18000416d
xor eax, eax
add rsp, 0x68
ret
Function at 0x1800042f0
Capabilities:
Hook routines via microsoft detours

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
call fcn.180004880
mov qword [rsp + 0x28], 0
cmp qword [0x18000c318], 0
jne 0x180004338
cmp qword [0x18000c310], 0
je 0x180004338
mov rax, qword [0x18000c310]
mov qword [0x18000c318], rax
cmp qword [0x18000c318], 0
je 0x1800043de
mov rax, qword [0x18000c318]
cmp qword [rax + 0x10], 0
je 0x1800043de
mov rax, qword [0x18000c318]
mov rcx, qword [rsp + 0x38]
cmp qword [rax + 0x10], rcx
jb 0x1800043de
mov rax, qword [0x18000c318]
mov rcx, qword [rsp + 0x30]
cmp qword [rax + 0x10], rcx
ja 0x1800043de
mov rax, qword [0x18000c318]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x38]
cmp qword [rsp + 0x28], rax
jb 0x1800043a4
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x28], rax
jbe 0x1800043ab
xor eax, eax
jmp 0x180004559
mov rax, qword [0x18000c318]
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 0x48]
mov qword [rax + 0x10], rcx
mov r8d, 0x60
mov edx, 0xcc
mov rcx, qword [rsp + 0x28]
call sub.VCRUNTIME140.dll_memset
mov rax, qword [rsp + 0x28]
jmp 0x180004559
mov rax, qword [0x18000c310]
mov qword [0x18000c318], rax
jmp 0x180004400
mov rax, qword [0x18000c318]
mov rax, qword [rax + 8]
mov qword [0x18000c318], rax
cmp qword [0x18000c318], 0
je 0x18000444d
cmp qword [0x18000c318], 0
je 0x18000444b
mov rax, qword [0x18000c318]
cmp qword [rax + 0x10], 0
je 0x18000444b
mov rax, qword [0x18000c318]
mov rcx, qword [rsp + 0x38]
cmp qword [rax + 0x10], rcx
jb 0x18000444b
mov rax, qword [0x18000c318]
mov rcx, qword [rsp + 0x30]
cmp qword [rax + 0x10], rcx
ja 0x18000444b
jmp 0x18000437c
jmp 0x1800043ee
mov rcx, qword [rsp + 0x60]
call fcn.1800064b0
and eax, 0xffff
mov eax, eax
mov rcx, qword [rsp + 0x60]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov r8, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
call fcn.180004560
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
je 0x180004557
mov rax, qword [rsp + 0x48]
mov qword [0x18000c318], rax
mov rax, qword [0x18000c318]
mov dword [rax], 0x52727464
mov rax, qword [0x18000c318]
mov qword [rax + 0x10], 0
mov rax, qword [0x18000c318]
mov rcx, qword [0x18000c310]
mov qword [rax + 8], rcx
mov rax, qword [0x18000c318]
mov qword [0x18000c310], rax
mov qword [rsp + 0x40], 0
mov rax, qword [0x18000c318]
add rax, 0x60
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x2a8
jmp 0x180004508
mov eax, dword [rsp + 0x20]
dec eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 1
jle 0x180004542
movsxd rax, dword [rsp + 0x20]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x40]
mov qword [rcx + rax + 0x48], rdx
movsxd rax, dword [rsp + 0x20]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
jmp 0x1800044fe
mov rax, qword [0x18000c318]
mov rcx, qword [rsp + 0x40]
mov qword [rax + 0x10], rcx
jmp 0x18000437c
xor eax, eax
add rsp, 0x58
ret
Function at 0x413fc0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41414b
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.0042fc40
xorps xmm15, xmm15
mov r14, qword [0x005834e8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x414025
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x414034
add rsp, 0x48
pop rbp
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x414053
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x414063
cmp rbx, 0x1000
jae 0x41402b
jmp 0x4140cd
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x414075
xor edx, edx
jmp 0x4140c4
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.0042fc40
xorps xmm15, xmm15
mov r14, qword [0x005834e8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x414059
jmp 0x414048
call fcn.0045e540
xorps xmm15, xmm15
mov r14, qword [0x005834e8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.00434040
lea rax, [0x004a2314]
mov ebx, 0x18
nop dword [rax]
call fcn.004348c0
mov rax, qword [rsp + 0x38]
call fcn.00434600
lea rax, [0x004a263c]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.004348c0
mov rax, qword [rsp + 0x30]
call fcn.00434600
call fcn.00434280
call fcn.004340a0
lea rax, [0x004a4115]
mov ebx, 0x21
call fcn.004326a0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045ae80
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00413fc0
Function at 0x414180
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4143a6
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.0042fcc0
xorps xmm15, xmm15
mov r14, qword [0x005834e8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x4141f3
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x414202
add rsp, 0x50
pop rbp
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x414225
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x414235
cmp rbx, 0x1000
jae 0x4141f9
nop
jmp 0x4142b8
add rsp, 0x50
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop word [rax + rax]
cmp rbx, 0x1000
jae 0x41424d
xor esi, esi
jmp 0x4142aa
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.0042fcc0
xorps xmm15, xmm15
mov r14, qword [0x005834e8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x41422b
jmp 0x414216
call fcn.0045e540
xorps xmm15, xmm15
mov r14, qword [0x005834e8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x414340
nop dword [rax + rax]
call fcn.00434040
lea rax, [0x004a2655]
mov ebx, 0x19
call fcn.004348c0
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
call fcn.00434600
lea rax, [0x004a263c]
mov ebx, 0x19
call fcn.004348c0
mov eax, dword [rsp + 0x34]
call fcn.00434600
nop
call fcn.00434280
call fcn.004340a0
lea rax, [0x0049fd05]
mov ebx, 0xd
call fcn.004326a0
nop dword [rax + rax]
cmp eax, 0x5af
je 0x4142e0
call fcn.00434040
lea rax, [0x004a2655]
mov ebx, 0x19
call fcn.004348c0
mov rax, qword [rsp + 0x38]
call fcn.00434600
lea rax, [0x004a263c]
mov ebx, 0x19
call fcn.004348c0
mov eax, dword [rsp + 0x34]
nop dword [rax]
call fcn.00434600
call fcn.00434280
call fcn.004340a0
lea rax, [0x004a3a16]
mov ebx, 0x1f
nop dword [rax + rax]
call fcn.004326a0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045ae80
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.00414180
Function at 0x41c0c0
Capabilities:
Hash data using murmur3

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
cmp byte [0x005832d1], 0
jne 0x41c1a7
sub rbx, qword [rax + 0x18]
mov rdx, qword [rax + 0x50]
test byte [rdx], al
mov esi, dword [rax + 0x64]
imul rbx, rsi
mov rsi, rbx
shr rbx, 0x20
shr rsi, 0x23
and ebx, 7
mov rdi, rcx
mov rcx, rbx
mov r8d, 1
shl r8d, cl
add rdx, rsi
nop
nop
nop
nop
lock or byte [rdx], r8b
mov rcx, qword [rax + 0x18]
movabs rdx, 0x800000000000
lea rax, [rdx + rcx]
mov rdx, rax
shr rdx, 0x2a
nop
nop
nop
cmp rdx, 0x40
jae 0x41c19a
lea rbx, [0x005556b8]
mov rdx, qword [rbx + rdx*8]
test byte [rdx], al
mov rbx, rcx
shr rbx, 0x10
and ebx, 0x3f
shr rcx, 0xd
and ecx, 7
mov esi, 1
shl esi, cl
shr rax, 0x16
and eax, 0xfffff
mov rax, qword [rdx + rax*8]
test byte [rax], al
movzx edx, byte [rax + rbx + 0x11440]
lea rax, [rax + rbx]
lea rax, [rax + 0x11440]
test sil, dl
jne 0x41c180
lock or byte [rax], sil
mov rax, qword [r14 + 0x30]
mov rax, qword [rax + 0xa0]
test byte [rax], al
add qword [rax + 0x1250], rdi
add rsp, 0x10
pop rbp
ret
mov rax, rdx
mov ecx, 0x40
call fcn.0045d120
lea rax, [0x004a5ac7]
mov ebx, 0x2c
call fcn.004326a0
nop
int3

Function at 0x41e480
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41e586
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x70], rcx
mov byte [rsp + 0x17], dil
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x18], 0
jmp 0x41e4c3
mov rax, qword [rsp + 0x60]
mov rcx, rdx
mov rbx, qword [rsp + 0x68]
movzx edi, byte [rsp + 0x17]
cmp qword [rsp + 0x18], rbx
jae 0x41e57b
test byte [rax], al
lea rcx, [rax + 0x100b8]
mov ebx, edi
mov rax, rcx
nop dword [rax]
call fcn.0041f260
test rax, rax
je 0x41e57b
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x30], xmm15
movups xmmword [rsp + 0x40], xmm15
lea rcx, [0x0041e5c0]
mov qword [rsp + 0x20], rcx
lea rdx, [rsp + 0x18]
mov qword [rsp + 0x28], rdx
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x48], rax
lea rbx, [rsp + 0x20]
mov qword [rsp], rbx
nop dword [rax]
call fcn.0045ad40
xorps xmm15, xmm15
mov r14, qword [0x005834e8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x70]
nop dword [rax]
test rdx, rdx
jne 0x41e569
xor eax, eax
jmp 0x41e573
mov rax, qword [rdx]
call rax
mov rdx, qword [rsp + 0x70]
test al, al
je 0x41e4b1
mov rax, qword [rsp + 0x18]
add rsp, 0x50
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov byte [rsp + 0x20], dil
call fcn.0045ae80
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movzx edi, byte [rsp + 0x20]
jmp fcn.0041e480