joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400019d0
Capabilities:
Get hostname
Get session user name

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x60
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x58], rax
movzx ebp, r8b
mov rdi, rdx
mov qword [rsp + 0x28], rdx
xor eax, eax
mov dword [rsp + 0x20], eax
xorps xmm0, xmm0
movups xmmword [rdx], xmm0
mov qword [rdx + 0x10], rax
mov qword [rdx + 0x18], rax
xor r8d, r8d
lea rdx, [0x1400043c0]
mov rcx, rdi
call fcn.1400022c0
mov dword [rsp + 0x20], 1
mov dword [rsp + 0x30], 0x10
mov dword [rsp + 0x34], 0x10
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetComputerNameA]
test eax, eax
je 0x140001b18
lea rax, [rsp + 0x38]
mov rbx, 0xffffffffffffffff
mov rsi, rbx
inc rsi
cmp byte [rax + rsi], 0
jne 0x140001a62
mov rax, qword [rdi + 0x18]
cmp rsi, rax
ja 0x140001a9b
mov r14, rdi
cmp rax, 0xf
jbe 0x140001a80
mov r14, qword [rdi]
mov qword [rdi + 0x10], rsi
mov r8, rsi
lea rdx, [rsp + 0x38]
mov rcx, r14
call sub.VCRUNTIME140.dll_memmove
mov byte [r14 + rsi], 0
jmp 0x140001aab
lea r9, [rsp + 0x38]
mov rdx, rsi
mov rcx, rdi
call fcn.140002550
test bpl, bpl
je 0x140001b18
lea rdx, [rsp + 0x34]
lea rcx, [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x140001b18
lea rax, [rsp + 0x48]
nop dword [rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x140001ad0
mov rax, qword [rdi + 0x18]
cmp rbx, rax
ja 0x140001b08
mov rsi, rdi
cmp rax, 0xf
jbe 0x140001aee
mov rsi, qword [rdi]
mov qword [rdi + 0x10], rbx
mov r8, rbx
lea rdx, [rsp + 0x48]
mov rcx, rsi
call sub.VCRUNTIME140.dll_memmove
mov byte [rsi + rbx], 0
jmp 0x140001b18
lea r9, [rsp + 0x48]
mov rdx, rbx
mov rcx, rdi
call fcn.140002550
mov rax, rdi
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140002a50
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x140001b40
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x60
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rdi, r8
mov rbx, rdx
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x48], r8
xor r15d, r15d
mov dword [rsp + 0x20], r15d
movdqa xmm0, xmmword [str.Eutwv]
movdqu xmmword [rsp + 0x28], xmm0
mov word [rsp + 0x38], 4
mov ecx, r15d
nop
movzx eax, byte [rsp + 0x28]
xor byte [rsp + rcx + 0x29], al
inc rcx
cmp rcx, 0x10
jb 0x140001b90
mov byte [rsp + 0x39], 0
mov r14, qword [r8 + 0x10]
xorps xmm0, xmm0
movups xmmword [rdx], xmm0
mov qword [rdx + 0x10], r15
mov qword [rdx + 0x18], r15
xor r8d, r8d
lea rdx, [0x1400043c0]
mov rcx, rbx
call fcn.1400022c0
mov dword [rsp + 0x20], 1
lea rax, [r14 + r14]
mov rbp, qword [rbx + 0x10]
cmp rbp, rax
ja 0x140001c55
mov rcx, qword [rbx + 0x18]
cmp rcx, rax
je 0x140001c55
jae 0x140001bff
sub rax, rbp
mov rdx, rax
mov rcx, rbx
call fcn.140002010
mov qword [rbx + 0x10], rbp
jmp 0x140001c55
cmp rax, 0xf
ja 0x140001c55
cmp rcx, 0xf
jbe 0x140001c55
mov rsi, qword [rbx]
lea r8, [rbp + 1]
mov rdx, rsi
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov rdx, qword [rbx + 0x18]
inc rdx
cmp rdx, 0x1000
jb 0x140001c45
add rdx, 0x27
mov rcx, qword [rsi - 8]
sub rsi, rcx
lea rax, [rsi - 8]
cmp rax, 0x1f
ja 0x140001caa
mov rsi, rcx
mov rcx, rsi
call fcn.140002aac
mov qword [rbx + 0x18], 0xf
mov rsi, r15
test r14, r14
je 0x140001d02
mov rax, rdi
cmp qword [rdi + 0x18], 0xf
jbe 0x140001c6e
mov rax, qword [rdi]
movzx ebp, byte [rax + rsi]
mov eax, ebp
shr rax, 4
movzx r9d, byte [rsp + rax + 0x29]
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
cmp rcx, rdx
jae 0x140001cb1
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0xf
jbe 0x140001c9f
mov rax, qword [rbx]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x140001cb9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.140002160
and ebp, 0xf
movzx r9d, byte [rsp + rbp + 0x29]
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
cmp rcx, rdx
jae 0x140001cee
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0xf
jbe 0x140001ce3
mov rax, qword [rbx]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x140001cf6
mov rcx, rbx
call fcn.140002160
inc rsi
cmp rsi, r14
jb 0x140001c61
mov rdx, qword [rdi + 0x18]
cmp rdx, 0xf
jbe 0x140001d38
inc rdx
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x140001d33
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140001d6b
mov rcx, r8
call fcn.140002aac
mov qword [rdi + 0x10], r15
mov qword [rdi + 0x18], 0xf
mov byte [rdi], 0
mov rax, rbx
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140002a50
mov rbx, qword [rsp + 0x90]
add rsp, 0x60
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x140a81058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x140a811df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140a81089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140a8106f
add dl, dl
jne 0x140a81096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140a810f6
xor eax, eax
add dl, dl
jne 0x140a810a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140a811ad
add dl, dl
jne 0x140a810b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140a810c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140a810d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140a810dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140a810ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140a8107e
mov eax, 1
add dl, dl
jne 0x140a81106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140a81113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140a810fb
sub eax, ebx
mov ebx, 1
jne 0x140a8114c
mov ecx, 1
add dl, dl
jne 0x140a8112e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140a8113b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140a81123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140a8107e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140a81168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140a81175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140a8115d
cmp eax, 0x7d00
jae 0x140a8119b
cmp eax, 0x500
jb 0x140a81196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140a8107e
cmp eax, 0x7f
ja 0x140a8119e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140a8107e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140a811d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140a8107e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20

Function at 0x100403a20
Capabilities:
Encode data using xor

Disassembly:
xor al, 0x6c
xor al, 0x64
xor al, 0x67
xor al, 0x41
xor al, 0x3e
xor al, 0x7d
xor al, 0xa2
xor al, 0x9a
xor al, 0xa3
xor al, 0x88
xor al, 0x9d
xor al, 0xa4
xor al, 0x71
xor al, 0x74
xor al, 0x59
xor al, 0x87
xchg dword [rbp*4 - 0x57cb58cc], esi
xor al, 0x99
xor al, 0xa1
xor al, 0x86
xor al, 0xa3
xor al, 0xa3
movabs dword [0xa73490345934a834], eax
xor al, 0xad
xor al, 0xa7
xor al, 0xa8
xor al, 0x99
cdq
xor al, 0xa1
xor al, 0x67
xor al, 0x66
xor al, 0x90
xor al, 0xa7
xor al, 0x9c
xor al, 0x99
xor al, 0xa0
xor al, 0xa0
xor al, 0x67
xor al, 0x66
xor al, 0x62
Function at 0x140004020
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x30
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
jg 0x140004042
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rdi
je 0x1400040bc
mov rdi, r14
mov rcx, rbx
call fcn.140005190
test rax, rax
jle 0x140004094
mov rdx, qword [rbx + 0x38]
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov r8, rbp
mov rdx, qword [rdx]
call fcn.14000bfb0
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x1400040ac
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x1400040b4
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x140004056
sub r14, rdi
jmp 0x1400041a9
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x1400040d3
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x1400040d5
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x14000410a
cmp rax, r14
mov rdi, r14
mov rcx, rsi
cmovb rdi, rax
mov r8, rdi
call fcn.14000bfb0
mov rax, qword [rbx + 0x50]
sub rbp, rdi
add rsi, rdi
mov r8, rbp
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x1400041a6
mov r9, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r9], rax
jne 0x140004145
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r9], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rdi, r8
cmp r8, 0xfff
jbe 0x140004181
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call fcn.140011548
sub rbp, rax
add rsi, rax
mov rdi, rbp
cmp rax, 0xfff
jne 0x1400041bf
cmp rbp, rax
ja 0x140004151
mov r8, rdi
test rdi, rdi
je 0x1400041a6
mov r9, qword [rbx + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call fcn.140011548
mov r8, rdi
sub r8, rax
sub r14, r8
mov rbp, qword [rsp + 0x28]
mov rax, r14
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
sub r14, rbp
jmp 0x1400041a9
Function at 0x1400045c0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x14003c060]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x1400045ed
xor eax, eax
jmp 0x140004733
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x140004627
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x140004627
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x140004733
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x140004726
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14000466a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140004679
movsx ecx, dil
jmp 0x1400046cd
lea r8, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov rax, qword [rcx]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x38], r8
lea r9, [rsp + 0x51]
lea r8, [rsp + 0x78]
mov qword [rsp + 0x30], r8
lea r8, [rsp + 0x58]
mov qword [rsp + 0x28], r8
lea r8, [rsp + 0x48]
mov qword [rsp + 0x20], r8
lea r8, [rsp + 0x50]
call qword [rax + 0x38]
test eax, eax
je 0x1400046e7
sub eax, 1
je 0x1400046e7
cmp eax, 2
jne 0x140004726
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call fcn.1400102e0
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x14000472b
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x140004714
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call fcn.140010e8c
cmp rsi, rax
jne 0x140004726
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov eax, edi
jne 0x14000472b
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14000a140
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x140008ab8
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0x90
mov rax, qword [0x14003c060]
xor rax, rsp
mov qword [rbp + 0x3f], rax
mov edi, 0xffff
xor r14d, r14d
movzx esi, dx
mov rbx, rcx
cmp di, dx
jne 0x140008afc
movzx eax, r14w
jmp 0x140008c32
mov rax, qword [rcx + 0x40]
mov r8, qword [rax]
test r8, r8
je 0x140008b38
mov rax, qword [rcx + 0x58]
movsxd r9, dword [rax]
lea rdx, [r8 + r9*2]
cmp r8, rdx
jae 0x140008b38
lea ecx, [r9 - 1]
mov dword [rax], ecx
movzx eax, si
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 2]
mov qword [rdx], rcx
mov word [r8], si
jmp 0x140008c32
cmp qword [rcx + 0x80], r14
je 0x140008c2f
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x140008b76
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub rdx, rcx
mov rax, qword [rbx + 0x38]
sar rdx, 1
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140008b9f
movzx ecx, si
mov rdx, qword [rbx + 0x80]
call fcn.140012338
cmp ax, di
je 0x140008c2f
movzx edi, si
jmp 0x140008c2f
lea r8, [rbp + 0xf]
mov word [rbp + 7], si
mov rax, qword [rcx]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x38], r8
lea r9, [rbp + 9]
lea r8, [rbp + 0x3f]
mov qword [rsp + 0x30], r8
lea r8, [rbp + 0x1f]
mov rax, qword [rax + 0x38]
mov qword [rsp + 0x28], r8
lea r8, [rbp + 0x17]
mov qword [rsp + 0x20], r8
lea r8, [rbp + 7]
call qword [0x1400292c8]
test eax, eax
je 0x140008bf4
sub eax, 1
je 0x140008bf4
cmp eax, 2
jne 0x140008c2f
movzx ecx, word [rbp + 7]
jmp 0x140008b82
mov r14, qword [rbp + 0xf]
lea rax, [rbp + 0x1f]
sub r14, rax
je 0x140008c1e
mov r9, qword [rbx + 0x80]
lea rcx, [rbp + 0x1f]
mov r8, r14
mov edx, 1
call fcn.140010e8c
cmp r14, rax
jne 0x140008c2f
lea rax, [rbp + 7]
mov byte [rbx + 0x72], 1
cmp qword [rbp + 0x17], rax
movzx eax, si
jne 0x140008c32
movzx eax, di
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.14000a140
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret

Function at 0x1400167ac
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1400165d8
Function at 0x14001c230
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
jne 0x14001bf56
call fcn.140011b8c
mov dword [rax], 0x16
call fcn.140011a3c
jmp 0x14001c0a1
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x14001c0a1
mov eax, dword [rcx + 0x14]
shr eax, 0xc
test al, 1
jne 0x14001c0a1
mov eax, dword [rcx + 0x14]
shr eax, 1
test al, 1
je 0x14001bf85
lock or dword [rcx + 0x14], 0x10
jmp 0x14001c0a1
lock or dword [rcx + 0x14], 1
mov eax, dword [rcx + 0x14]
test eax, 0x4c0
jne 0x14001bf99
call fcn.14001c718
mov esi, dword [rbx + 0x10]
cmp esi, 1
jne 0x14001bfa9
mov rax, qword [rbx]
mov bpl, byte [rax]
jmp 0x14001bfac
xor bpl, bpl
mov rdi, qword [rbx + 8]
mov rcx, rbx
mov qword [rbx], rdi
call fcn.14001901c
mov r8d, dword [rbx + 0x20]
mov ecx, eax
mov rdx, rdi
call fcn.14001d150
mov dword [rbx + 0x10], eax
lea ecx, [rax + 1]
cmp ecx, 2
jbe 0x14001c08f
mov eax, dword [rbx + 0x14]
test al, 6
jne 0x14001c03d
mov rcx, rbx
call fcn.14001901c
cmp eax, 0xffffffff
je 0x14001c028
mov rcx, rbx
call fcn.14001901c
cmp eax, 0xfffffffe
je 0x14001c028
mov rcx, rbx
call fcn.14001901c
movsxd rdi, eax
lea r14, [0x14003e620]
mov rcx, rbx
sar rdi, 6
call fcn.14001901c
and eax, 0x3f
lea rcx, [rax + rax*8]
mov rax, qword [r14 + rdi*8]
lea rdx, [rax + rcx*8]
jmp 0x14001c02f
lea rdx, [0x14003c290]
mov al, byte [rdx + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x14001c03d
lock or dword [rbx + 0x14], 0x20
cmp dword [rbx + 0x20], 0x200
jne 0x14001c061
mov eax, dword [rbx + 0x14]
shr eax, 6
test al, 1
je 0x14001c061
mov eax, dword [rbx + 0x14]
shr eax, 8
test al, 1
jne 0x14001c061
mov dword [rbx + 0x20], 0x1000
mov rax, qword [rbx]
cmp esi, 1
jne 0x14001c07f
movzx ecx, byte [rax]
dec dword [rbx + 0x10]
shl cx, 8
movzx eax, bpl
or cx, ax
inc qword [rbx]
jmp 0x14001c08a
movzx ecx, word [rax]
add dword [rbx + 0x10], 0xfffffffe
add qword [rbx], 2
movzx eax, cx
jmp 0x14001c0a6
neg eax
sbb eax, eax
and eax, 8
add eax, 8
lock or dword [rbx + 0x14], eax
and dword [rbx + 0x10], 0
mov eax, 0xffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
jmp 0x14001bf20
Function at 0x415600
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41578b
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00433ac0
xorps xmm15, xmm15
mov r14, qword [0x005c04b8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x415665
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x415674
add rsp, 0x48
pop rbp
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x415693
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x4156a3
cmp rbx, 0x1000
jae 0x41566b
jmp 0x41570d
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x4156b5
xor edx, edx
jmp 0x415704
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00433ac0
xorps xmm15, xmm15
mov r14, qword [0x005c04b8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x415699
jmp 0x415688
call fcn.004664e0
xorps xmm15, xmm15
mov r14, qword [0x005c04b8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.00437ae0
lea rax, [0x004a4ec5]
mov ebx, 0x18
nop dword [rax]
call fcn.00438360
mov rax, qword [rsp + 0x38]
call fcn.004380a0
lea rax, [0x004a53ae]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.00438360
mov rax, qword [rsp + 0x30]
call fcn.004380a0
call fcn.00437d20
call fcn.00437b40
lea rax, [0x004a74d7]
mov ebx, 0x21
call fcn.00436040
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00462de0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00415600
Function at 0x4157c0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4159e6
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.00433b40
xorps xmm15, xmm15
mov r14, qword [0x005c04b8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x415833
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x415842
add rsp, 0x50
pop rbp
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x415865
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x415875
cmp rbx, 0x1000
jae 0x415839
nop
jmp 0x4158f8
add rsp, 0x50
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop word [rax + rax]
cmp rbx, 0x1000
jae 0x41588d
xor esi, esi
jmp 0x4158ea
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.00433b40
xorps xmm15, xmm15
mov r14, qword [0x005c04b8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x41586b
jmp 0x415856
call fcn.004664e0
xorps xmm15, xmm15
mov r14, qword [0x005c04b8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x415980
nop dword [rax + rax]
call fcn.00437ae0
lea rax, [0x004a53c7]
mov ebx, 0x19
call fcn.00438360
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
call fcn.004380a0
lea rax, [0x004a53ae]
mov ebx, 0x19
call fcn.00438360
mov eax, dword [rsp + 0x34]
call fcn.004380a0
nop
call fcn.00437d20
call fcn.00437b40
lea rax, [0x004a1c24]
mov ebx, 0xd
call fcn.00436040
nop dword [rax + rax]
cmp eax, 0x5af
je 0x415920
call fcn.00437ae0
lea rax, [0x004a53c7]
mov ebx, 0x19
call fcn.00438360
mov rax, qword [rsp + 0x38]
call fcn.004380a0
lea rax, [0x004a53ae]
mov ebx, 0x19
call fcn.00438360
mov eax, dword [rsp + 0x34]
nop dword [rax]
call fcn.004380a0
call fcn.00437d20
call fcn.00437b40
lea rax, [0x004a6d75]
mov ebx, 0x1f
nop dword [rax + rax]
call fcn.00436040
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00462de0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.004157c0
Function at 0x41f7c0
Capabilities:
Hash data using murmur3

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
cmp byte [0x005c0291], 0
jne 0x41f8b0
sub rbx, qword [rax + 0x18]
mov rdx, qword [rax + 0x48]
test byte [rdx], al
mov ecx, dword [rax + 0x5c]
imul rcx, rbx
mov rbx, rcx
shr rbx, 0x20
shr rcx, 0x23
and ebx, 7
mov rsi, rcx
mov rcx, rbx
mov edi, 1
shl edi, cl
add rdx, rsi
nop
nop
nop
nop
lock or byte [rdx], dil
mov rcx, qword [rax + 0x18]
movabs rdx, 0x800000000000
add rdx, rcx
mov rbx, rdx
shr rdx, 0x2a
nop
nop
nop
cmp rdx, 0x40
jae 0x41f8a3
lea rsi, [0x00552398]
mov rdx, qword [rsi + rdx*8]
test byte [rdx], al
mov rsi, rcx
shr rsi, 0x10
and esi, 0x3f
shr rcx, 0xd
and ecx, 7
mov edi, 1
shl edi, cl
shr rbx, 0x16
and ebx, 0xfffff
mov rdx, qword [rdx + rbx*8]
test byte [rdx], al
movzx ebx, byte [rdx + rsi + 0x1040]
lea rdx, [rdx + rsi]
lea rdx, [rdx + 0x1040]
test dil, bl
jne 0x41f87e
lock or byte [rdx], dil
mov rcx, qword [r14 + 0x30]
mov rcx, qword [rcx + 0xa0]
test byte [rcx], al
mov rdx, qword [rcx + 0x1270]
add rdx, qword [rax + 0x68]
mov qword [rcx + 0x1270], rdx
add rsp, 0x10
pop rbp
ret
mov rax, rdx
mov ecx, 0x40
call fcn.004650c0
lea rax, [0x004a8ec2]
mov ebx, 0x2c
nop dword [rax]
call fcn.00436040
nop
int3

Function at 0x421d00
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x421e06
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov byte [rsp + 0x70], dil
mov qword [rsp + 0x10], 0
jmp 0x421d43
mov rax, qword [rsp + 0x58]
mov rcx, rdx
mov rbx, qword [rsp + 0x60]
movzx edi, byte [rsp + 0x70]
cmp qword [rsp + 0x10], rbx
jae 0x421dfb
test byte [rax], al
lea rcx, [rax + 0x100b8]
mov ebx, edi
mov rax, rcx
nop dword [rax]
call fcn.00422ae0
test rax, rax
je 0x421dfb
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
lea rcx, [0x00421e40]
mov qword [rsp + 0x18], rcx
lea rdx, [rsp + 0x10]
mov qword [rsp + 0x20], rdx
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x40], rax
lea rbx, [rsp + 0x18]
mov qword [rsp], rbx
nop dword [rax]
call fcn.00462cc0
xorps xmm15, xmm15
mov r14, qword [0x005c04b8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x68]
nop dword [rax]
test rdx, rdx
jne 0x421de9
xor eax, eax
jmp 0x421df3
mov rax, qword [rdx]
call rax
mov rdx, qword [rsp + 0x68]
test al, al
je 0x421d31
mov rax, qword [rsp + 0x10]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov byte [rsp + 0x20], dil
call fcn.00462de0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movzx edi, byte [rsp + 0x20]
jmp fcn.00421d00