joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e6de0
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4e6f10
push rbp
mov rbp, rsp
sub rsp, 0x68
mov qword [rsp + 0x80], rbx
mov rcx, qword [rax]
mov qword [rsp + 0x18], rcx
movups xmm0, xmmword [rax + 8]
movups xmmword [rsp + 0x20], xmm0
movups xmm0, xmmword [rax + 0x18]
movups xmmword [rsp + 0x30], xmm0
lea rax, [rsp + 0x18]
call fcn.004e6ae0
movups xmmword [rsp + 0x40], xmm15
movups xmmword [rsp + 0x48], xmm15
movups xmmword [rsp + 0x58], xmm15
mov rcx, qword [rsp + 0x18]
mov qword [rsp + 0x40], rcx
mov rcx, qword [rsp + 0x20]
mov qword [rsp + 0x48], rcx
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x50], rcx
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x58], rcx
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x60], rcx
mov rcx, qword [rsp + 0x80]
xor eax, eax
jmp 0x4e6e74
inc rax
mov rcx, rbx
cmp rax, 5
jge 0x4e6eb7
mov rdx, qword [rsp + rax*8 + 0x40]
imul rsi, rax, 0x33
mov rdi, rsi
sar rsi, 0x3f
shr rsi, 0x3d
add rsi, rdi
mov r8, rsi
and rsi, 0xfffffffffffffff8
sub rdi, rsi
mov rbx, rcx
mov rcx, rdi
shl rdx, cl
cmp rcx, 0x40
sbb rsi, rsi
and rdx, rsi
mov qword [rsp + 0x10], rdx
xor ecx, ecx
jmp 0x4e6ee3
test byte [rcx], al
mov rax, rcx
mov ebx, 0x20
mov rcx, rbx
add rsp, 0x68
pop rbp
ret
test byte [rbx], al
movzx edi, byte [rbx + rsi]
movzx r9d, byte [rsp + rcx + 0x10]
or edi, r9d
mov byte [rbx + rsi], dil
inc rcx
mov r8, rdx
cmp rcx, 8
jge 0x4e6e6e
mov rdx, r8
sar r8, 3
lea rsi, [r8 + rcx]
cmp rsi, 0x20
jge 0x4e6e6e
nop
jb 0x4e6eca
mov rax, rsi
mov ecx, 0x20
call fcn.00463e40
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00461bc0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004e6de0
Function at 0x4e82a0
Capabilities:
Hash data using sha384
Hash data using sha512

Disassembly:
mov rcx, qword [rax + 0xd0]
cmp rcx, 6
jne 0x4e8325
movabs rcx, 0xcbbb9d5dc1059ed8
mov qword [rax], rcx
movabs rcx, 0x629a292a367cd507
mov qword [rax + 8], rcx
movabs rcx, 0x9159015a3070dd17
mov qword [rax + 0x10], rcx
movabs rcx, 0x152fecd8f70e5939
mov qword [rax + 0x18], rcx
movabs rcx, 0x67332667ffc00b31
mov qword [rax + 0x20], rcx
movabs rcx, 0x8eb44a8768581511
mov qword [rax + 0x28], rcx
movabs rcx, 0xdb0c2e0d64f98fa7
mov qword [rax + 0x30], rcx
movabs rcx, 0x47b5481dbefa4fa4
mov qword [rax + 0x38], rcx
nop dword [rax]
jmp 0x4e8486
cmp rcx, 0xe
jne 0x4e83a0
movabs rcx, 0x8c3d37c819544da2
mov qword [rax], rcx
movabs rcx, 0x73e1996689dcd4d6
mov qword [rax + 8], rcx
movabs rcx, 0x1dfab7ae32ff9c82
mov qword [rax + 0x10], rcx
movabs rcx, 0x679dd514582f9fcf
mov qword [rax + 0x18], rcx
movabs rcx, 0xf6d2b697bd44da8
mov qword [rax + 0x20], rcx
movabs rcx, 0x77e36f7304c48942
mov qword [rax + 0x28], rcx
movabs rcx, 0x3f9d85a86a1d36c8
mov qword [rax + 0x30], rcx
movabs rcx, 0x1112e6ad91d692a1
mov qword [rax + 0x38], rcx
jmp 0x4e8486
cmp rcx, 0xf
jne 0x4e8417
movabs rcx, 0x22312194fc2bf72c
mov qword [rax], rcx
movabs rcx, 0x9f555fa3c84c64c2
mov qword [rax + 8], rcx
movabs rcx, 0x2393b86b6f53b151
mov qword [rax + 0x10], rcx
movabs rcx, 0x963877195940eabd
mov qword [rax + 0x18], rcx
movabs rcx, 0x96283ee2a88effe3
mov qword [rax + 0x20], rcx
movabs rcx, 0xbe5e1e2553863992
mov qword [rax + 0x28], rcx
movabs rcx, 0x2b0199fc2c85b8aa
mov qword [rax + 0x30], rcx
movabs rcx, 0xeb72ddc81c52ca2
mov qword [rax + 0x38], rcx
jmp 0x4e8486
movabs rcx, 0x6a09e667f3bcc908
mov qword [rax], rcx
movabs rcx, 0xbb67ae8584caa73b
mov qword [rax + 8], rcx
movabs rcx, 0x3c6ef372fe94f82b
mov qword [rax + 0x10], rcx
movabs rcx, 0xa54ff53a5f1d36f1
mov qword [rax + 0x18], rcx
movabs rcx, 0x510e527fade682d1
mov qword [rax + 0x20], rcx
movabs rcx, 0x9b05688c2b3e6c1f
mov qword [rax + 0x28], rcx
movabs rcx, 0x1f83d9abfb41bd6b
mov qword [rax + 0x30], rcx
movabs rcx, 0x5be0cd19137e2179
mov qword [rax + 0x38], rcx
movups xmmword [rax + 0xc0], xmm15
ret
Function at 0x4f4860
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f4a9b
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rax
nop
call fcn.004e6a40
xorps xmm15, xmm15
mov r14, qword [0x00818868]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
add qword [rcx + 0x68], rax
mov rdx, qword [rcx + 0x60]
test rdx, rdx
jle 0x4f49aa
nop dword [rax]
cmp rdx, 0x40
ja 0x4f4a8d
lea rsi, [rdx - 0x40]
mov rdi, rsi
neg rsi
sar rdi, 0x3f
and rdi, rdx
lea rdx, [rcx + rdi]
lea rdx, [rdx + 0x20]
cmp rax, rsi
cmovl rsi, rax
mov qword [rsp + 0x28], rsi
mov rbx, qword [rsp + 0x60]
cmp rbx, rdx
je 0x4f4919
mov rax, rdx
mov rcx, rsi
nop
call fcn.004647e0
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdx, qword [rcx + 0x60]
add rdx, rsi
mov qword [rcx + 0x60], rdx
cmp rdx, 0x40
jne 0x4f4981
mov qword [rsp], rcx
lea rax, [rcx + 0x20]
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], 0x40
mov qword [rsp + 0x18], 0x40
call fcn.004f5000
xorps xmm15, xmm15
mov r14, qword [0x00818868]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov qword [rax + 0x60], 0
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
cmp rax, rsi
jb 0x4f4a82
mov rdi, qword [rsp + 0x70]
sub rdi, rsi
mov rdx, rdi
neg rdx
sar rdx, 0x3f
and rdx, rsi
mov r8, rax
sub r8, rsi
add rbx, rdx
jmp 0x4f49b7
mov r8, rax
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x70]
cmp r8, 0x40
jl 0x4f4a35
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x40], rbx
mov qword [rsp], rcx
mov qword [rsp + 8], rbx
and r8, 0xffffffffffffffc0
mov qword [rsp + 0x20], r8
mov qword [rsp + 0x10], r8
mov qword [rsp + 0x18], rdi
call fcn.004f5000
xorps xmm15, xmm15
mov r14, qword [0x00818868]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x38]
mov rdx, rax
sub rax, rcx
sar rax, 0x3f
mov r8, qword [rsp + 0x30]
and rax, r8
and rax, 0xffffffffffffffc0
mov rcx, qword [rsp + 0x40]
lea rbx, [rcx + rax]
sub r8, rdx
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
test r8, r8
je 0x4f4a78
lea rdx, [rcx + 0x20]
cmp r8, 0x40
mov esi, 0x40
cmovl rsi, r8
cmp rbx, rdx
je 0x4f4a74
mov qword [rsp + 0x38], rsi
mov rax, rdx
mov rcx, rsi
nop dword [rax + rax]
call fcn.004647e0
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x38]
mov qword [rcx + 0x60], rsi
xor ebx, ebx
xor ecx, ecx
add rsp, 0x48
pop rbp
ret
mov rcx, rax
mov rax, rsi
call fcn.00463f00
mov rax, rdx
mov ecx, 0x40
call fcn.00463f00
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00461bc0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.004f4860
Function at 0x4fbdc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x58
mov qword [rsp + 0xb0], rax
movups xmmword [rsp + 0x68], xmm15
movups xmmword [rsp + 0x6c], xmm15
movups xmmword [rsp + 0x7c], xmm15
movups xmmword [rsp + 0x8c], xmm15
movups xmmword [rsp + 0x9c], xmm15
jmp 0x4fbe0c
dec rcx
mov rdx, rcx
neg rdx
sar rdx, 0x3f
and edx, 1
add rax, rdx
dec rbx
test rbx, rbx
je 0x4fbe16
cmp byte [rax], 0
je 0x4fbdf6
movups xmmword [rsp + 0x14], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rdx, [rbx - 1]
xor ecx, ecx
jmp 0x4fbe54
mov byte [rsp + rdx + 0x15], dil
and r10d, esi
mov byte [rsp + rdx + 0x38], r10b
dec rdx
shr r8w, 8
mov ecx, r8d
test rdx, rdx
jl 0x4fbe9a
movzx esi, byte [rax + rdx]
movzx edi, cl
add esi, edi
test rdx, rdx
jle 0x4fbe6e
movzx edi, byte [rdx + rax - 1]
jmp 0x4fbe70
xor edi, edi
mov r8d, esi
shr si, 1
shl edi, 7
movzx edi, dil
or esi, edi
lea edi, [rsi + r8]
mov r8d, edi
xor edi, esi
lea r9, [rdx + 1]
mov r10d, edi
and edi, r8d
cmp r9, 0x21
jb 0x4fbe3c
jmp 0x4fbeec
mov byte [rsp + 0x14], cl
lea rax, [rbx + 1]
dec ecx
neg ecx
mov byte [rsp + 0x35], cl
mov byte [rsp + 0x36], al
mov rax, qword [rsp + 0x14]
mov qword [rsp + 0x68], rax
movups xmm0, xmmword [rsp + 0x18]
movups xmmword [rsp + 0x6c], xmm0
movups xmm0, xmmword [rsp + 0x28]
movups xmmword [rsp + 0x7c], xmm0
movups xmm0, xmmword [rsp + 0x38]
movups xmmword [rsp + 0x8c], xmm0
movups xmm0, xmmword [rsp + 0x48]
movups xmmword [rsp + 0x9c], xmm0
add rsp, 0x58
pop rbp
ret
mov rax, r9
mov ecx, 0x21
call fcn.00463e40
nop
int3
Function at 0x515b20
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x515d2b
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x58], rax
add qword [rax + 0x58], rcx
mov rdx, qword [rax + 0x50]
test rdx, rdx
jle 0x515c44
cmp rdx, 0x40
ja 0x515d1d
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x60], rbx
lea rsi, [rdx - 0x40]
mov r8, rsi
neg rsi
sar r8, 0x3f
and r8, rdx
lea rdx, [rax + r8]
lea rdx, [rdx + 0x10]
cmp rcx, rsi
cmovl rsi, rcx
mov qword [rsp + 0x28], rsi
cmp rbx, rdx
je 0x515bb4
mov rax, rdx
mov rcx, rsi
call fcn.004647e0
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x70]
mov rdx, qword [rax + 0x50]
add rdx, rsi
mov qword [rax + 0x50], rdx
nop
cmp rdx, 0x40
jne 0x515c20
mov qword [rsp], rax
lea rcx, [rax + 0x10]
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], 0x40
mov qword [rsp + 0x18], 0x40
call fcn.00515f80
xorps xmm15, xmm15
mov r14, qword [0x00818868]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov qword [rax + 0x50], 0
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x70]
nop dword [rax]
cmp rcx, rsi
jb 0x515d15
sub rdi, rsi
mov rdx, rdi
neg rdx
sar rdx, 0x3f
and rdx, rsi
mov r8, rcx
sub r8, rsi
add rbx, rdx
jmp 0x515c47
mov r8, rcx
cmp r8, 0x40
jl 0x515cc5
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x40], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
and r8, 0xffffffffffffffc0
mov qword [rsp + 0x20], r8
mov qword [rsp + 0x10], r8
mov qword [rsp + 0x18], rdi
call fcn.00515f80
xorps xmm15, xmm15
mov r14, qword [0x00818868]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x38]
mov rdx, rax
sub rax, rcx
sar rax, 0x3f
mov r8, qword [rsp + 0x30]
and rax, r8
and rax, 0xffffffffffffffc0
mov rcx, qword [rsp + 0x40]
lea rbx, [rcx + rax]
sub r8, rdx
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
test r8, r8
je 0x515d08
lea rdx, [rax + 0x10]
cmp r8, 0x40
mov esi, 0x40
cmovl rsi, r8
nop dword [rax + rax]
cmp rbx, rdx
je 0x515d04
mov qword [rsp + 0x38], rsi
mov rax, rdx
mov rcx, rsi
call fcn.004647e0
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x38]
mov qword [rax + 0x50], rsi
mov rax, rcx
xor ebx, ebx
xor ecx, ecx
add rsp, 0x48
pop rbp
ret
mov rax, rsi
call fcn.00463f00
mov rax, rdx
mov ecx, 0x40
call fcn.00463f00
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
nop
call fcn.00461bc0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00515b20
Function at 0x140001434
Capabilities:
Get file size
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rax - 0x5f]
sub rsp, 0x90
movaps xmmword [rax - 0x28], xmm6
mov rax, qword [0x1401d1030]
xor rax, rsp
mov qword [rbp + 0x2f], rax
mov rsi, rdx
mov rbx, rcx
xorps xmm6, xmm6
movups xmmword [rbp - 9], xmm6
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x17], xmm0
and qword [rbp + 0x27], 0
mov ecx, 0x10
call fcn.1400a7520
and qword [rax + 8], 0
mov qword [rbp + 0xf], rax
lea rcx, [rbp + 0xf]
mov qword [rax], rcx
and dword [rbp + 7], 0
and qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x1400014ec
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
mov rdx, rsi
lea rcx, str.Failed_to_open_the_file__ls__error_code:__u_n
call fcn.140001040
movdqu xmmword [rbx], xmm6
jmp 0x1400015a2
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov r14d, eax
cmp eax, 0xffffffff
jne 0x140001522
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
mov rdx, rsi
lea rcx, str.Failed_to_get_the_size_of_the_file__ls__error_code:__u_n
call fcn.140001040
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400014e3
mov rcx, r14
call fcn.1400beb70
mov rsi, rax
test rax, rax
jne 0x140001540
lea rcx, str.Failed_to_allocate_memory_for_the_file_content_n
call fcn.140001040
jmp 0x140001517
and qword [rsp + 0x20], 0
lea r9, [rbp + 7]
mov r8d, r14d
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140001587
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_to_read_the_file_content__error_code:__u_n
call fcn.140001040
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call fcn.1400beb40
jmp 0x1400014e3
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp - 9], rsi
mov eax, dword [rbp + 7]
mov dword [rbp - 1], eax
movups xmm0, xmmword [rbp - 9]
movdqu xmmword [rbx], xmm0
lea rcx, [rbp + 0xf]
call fcn.1400a4bf4
mov rax, rbx
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.1400a7500
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x1400015d8
Capabilities:
Check for time delay via gettickcount
Check for unmoving mouse cursor

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x1401d1030]
xor rax, rsp
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x28]
call qword [sym.imp.USER32.dll_GetCursorPos]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea rcx, [rsp + 0x20]
mov ebx, eax
call qword [sym.imp.USER32.dll_GetCursorPos]
mov ecx, dword [rsp + 0x28]
cmp dword [rsp + 0x20], ecx
jne 0x14000164e
mov ecx, dword [rsp + 0x2c]
cmp dword [rsp + 0x24], ecx
jne 0x14000164e
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, ebx
cmp eax, 0xbb8
ja 0x140001663
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [rsp + 0x28]
cmp dword [rsp + 0x20], eax
je 0x140001615
mov al, 1
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400a7500
add rsp, 0x40
pop rbx
ret
xor al, al
jmp 0x140001650
Function at 0x1400b18c0
Capabilities:
Get thread local storage value

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.1400b13a0
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1400b18ff
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x1400ea300]
jmp 0x1400b1909
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add rsp, 0x48
ret

Function at 0x1400c9f80
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
add rsp, 0x28
ret
Function at 0x414ec0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x415066
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00430fe0
xorps xmm15, xmm15
mov r14, qword [0x005b79a8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x414f2b
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x414f40
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
nop
test rbx, rbx
jbe 0x414f65
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x414f79
cmp rbx, 0x1000
jae 0x414f35
nop dword [rax]
jmp 0x414fe9
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop
cmp rbx, 0x1000
jae 0x414f8d
xor edx, edx
jmp 0x414fe0
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00430fe0
xorps xmm15, xmm15
mov r14, qword [0x005b79a8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
nop dword [rax]
test dl, dl
jne 0x414f6f
jmp 0x414f54
call fcn.00460800
xorps xmm15, xmm15
mov r14, qword [0x005b79a8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.00435520
lea rax, [0x004c06e2]
mov ebx, 0x18
call fcn.00435e20
mov rax, qword [rsp + 0x38]
call fcn.00435b20
lea rax, [0x004c07a2]
mov ebx, 0x19
call fcn.00435e20
mov rax, qword [rsp + 0x30]
nop
call fcn.00435b20
call fcn.00435780
call fcn.004355a0
lea rax, [0x004c2a02]
mov ebx, 0x21
nop dword [rax + rax]
call fcn.00433be0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045cc60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.00414ec0
Function at 0x4150a0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4152ca
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.00431060
xorps xmm15, xmm15
mov r14, qword [0x005b79a8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x415119
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x41512c
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x415150
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
nop
jmp 0x415164
cmp rbx, 0x1000
jae 0x415123
jmp 0x4151e5
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x415176
xor esi, esi
jmp 0x4151d6
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
nop dword [rax]
call fcn.00431060
xorps xmm15, xmm15
mov r14, qword [0x005b79a8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x41515a
nop
jmp 0x415142
call fcn.00460800
xorps xmm15, xmm15
mov r14, qword [0x005b79a8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x415265
call fcn.00435520
lea rax, [0x004c0b8a]
mov ebx, 0x19
call fcn.00435e20
mov rax, qword [rsp + 0x68]
call fcn.00435b20
lea rax, [0x004c07a2]
mov ebx, 0x19
call fcn.00435e20
mov eax, dword [rsp + 0x34]
nop dword [rax]
call fcn.00435b20
call fcn.00435780
call fcn.004355a0
lea rax, [0x004bd71d]
mov ebx, 0xd
nop dword [rax + rax]
call fcn.00433be0
cmp eax, 0x5af
je 0x415208
call fcn.00435520
lea rax, [0x004c0b8a]
mov ebx, 0x19
nop dword [rax]
call fcn.00435e20
mov rax, qword [rsp + 0x38]
call fcn.00435b20
lea rax, [0x004c07a2]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.00435e20
mov eax, dword [rsp + 0x34]
call fcn.00435b20
call fcn.00435780
call fcn.004355a0
lea rax, [0x004c2316]
mov ebx, 0x1f
call fcn.00433be0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045cc60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004150a0
Function at 0x41d580
Capabilities:
Hash data using murmur3

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
cmp byte [0x005b77d0], 0
jne 0x41d66f
mov rdx, qword [rax + 0x50]
test byte [rdx], al
nop
nop
nop
sub rbx, qword [rax + 0x18]
mov esi, dword [rax + 0x5c]
imul rbx, rsi
mov rsi, rbx
shr rbx, 0x20
shr rsi, 0x23
and ebx, 7
mov rdi, rcx
mov rcx, rbx
mov r8d, 1
shl r8d, cl
add rdx, rsi
lock or byte [rdx], r8b
nop
nop
mov rcx, qword [rax + 0x18]
nop
movabs rdx, 0x800000000000
lea rax, [rdx + rcx]
mov rdx, rax
shr rax, 0x2a
cmp rax, 0x40
jae 0x41d665
lea rbx, [0x00589c10]
mov rax, qword [rbx + rax*8]
shr rdx, 0x16
and edx, 0xfffff
mov rdx, qword [rax + rdx*8]
test byte [rdx], al
test byte [rax], al
mov rax, rcx
shr rcx, 0x10
and ecx, 0x3f
movzx ebx, byte [rdx + rcx + 0x11440]
lea rdx, [rdx + rcx]
lea rdx, [rdx + 0x11440]
shr rax, 0xd
and eax, 7
mov rcx, rax
mov eax, 1
shl eax, cl
test al, bl
jne 0x41d647
lock or byte [rdx], al
mov rax, qword [r14 + 0x30]
mov rax, qword [rax + 0xa0]
test byte [rax], al
add qword [rax + 0x1248], rdi
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov ecx, 0x40
call fcn.0045f2e0
lea rax, [0x004c4446]
mov ebx, 0x2c
nop dword [rax + rax]
call fcn.00433be0
nop
int3

Function at 0x41fa60
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41fb5e
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rbx
mov qword [rsp + 8], 0
jmp 0x41faa0
mov rax, qword [rsp + 0x50]
mov rcx, rdx
mov rbx, qword [rsp + 0x58]
nop
cmp qword [rsp + 8], rbx
jae 0x41fb4f
test byte [rax], al
lea rcx, [rax + 0x100b8]
mov rax, rcx
call fcn.00420620
nop dword [rax]
test rax, rax
je 0x41fb4f
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x30], xmm15
lea rcx, [0x0041fba0]
mov qword [rsp + 0x10], rcx
lea rdx, [rsp + 8]
mov qword [rsp + 0x18], rdx
mov rdx, qword [rsp + 0x50]
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rbx
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x38], rax
lea rbx, [rsp + 0x10]
mov qword [rsp], rbx
call fcn.0045cb20
xorps xmm15, xmm15
mov r14, qword [0x005b79a8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x60]
test rdx, rdx
jne 0x41fb3d
xor eax, eax
jmp 0x41fb47
mov rax, qword [rdx]
call rax
mov rdx, qword [rsp + 0x60]
test al, al
je 0x41fa92
mov rax, qword [rsp + 8]
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.0045cc60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0041fa60