joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002a750
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x14003c504]
mov rbx, rcx
test esi, esi
jle 0x14002a880
mov rax, qword [0x14003c508]
xor r9d, r9d
add rax, 0x18
nop word [rax + rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x14002a79b
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x14002a825
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x14002a780
mov rcx, rbx
call dbg.__mingw_GetSectionForAddress
mov rdi, rax
test rax, rax
je 0x14002a8a2
mov rax, qword [0x14003c508]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call dbg._GetPEImageBase
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x14003c508]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x14002a887
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x14002a81e
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x14002a830
add dword [0x14003c504], 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x14003c508]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x14002a81e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call dbg.__report_error
nop dword [rax]
xor esi, esi
jmp 0x14002a7a8
mov rax, qword [0x14003c508]
mov edx, dword [rdi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call dbg.__report_error
mov rdx, rbx
lea rcx, str.Address__p_has_no_image_section
call dbg.__report_error
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x14002ae10
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x14003c560]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x14003c540]
test rbx, rbx
je 0x14002ae6c
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x14002ae63
test rsi, rsi
je 0x14002ae63
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x14002ae48
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x14002b080
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x14002b098
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
je 0x14002b0a0
ret
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret
Function at 0x14002b0b0
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
movzx r8d, word [rcx + 6]
lea rax, [rcx + rax + 0x18]
test r8w, r8w
je 0x14002b0fd
lea ecx, [r8 - 1]
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
mov rcx, r8
cmp rdx, r8
jb 0x14002b0f4
add ecx, dword [rax + 8]
cmp rdx, rcx
jb 0x14002b0ff
add rax, 0x28
cmp rax, r9
jne 0x14002b0e0
xor eax, eax
ret

Function at 0x14002b100
Capabilities:
Parse pe header

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rsi, rcx
call sym.strlen
cmp rax, 8
ja 0x14002b190
mov rdx, qword [0x140036e50]
xor ebx, ebx
cmp word [rdx], 0x5a4d
jne 0x14002b17e
movsxd rax, dword [rdx + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
jne 0x14002b17e
cmp word [rax + 0x18], 0x20b
jne 0x14002b17e
movzx edx, word [rax + 0x14]
lea rbx, [rax + rdx + 0x18]
movzx edx, word [rax + 6]
test dx, dx
je 0x14002b190
lea eax, [rdx - 1]
lea rax, [rax + rax*4]
lea rdi, [rbx + rax*8 + 0x28]
jmp 0x14002b169
add rbx, 0x28
cmp rbx, rdi
je 0x14002b190
mov r8d, 8
mov rdx, rsi
mov rcx, rbx
call sym.strncmp
test eax, eax
jne 0x14002b160
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
xor ebx, ebx
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret

Function at 0x14002b1a0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x140036e50]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x14002b1c0
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x14002b1c8
ret
cmp word [r8 + 0x18], 0x20b
jne 0x14002b1c0
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x14002b21d
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x14002b214
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x14002b1c0
add rax, 0x28
cmp rax, r9
jne 0x14002b200
xor eax, eax
ret

Function at 0x14002b220
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140036e50]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x14002b23f
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x14002b248
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x14002b23f
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x14002b260
Capabilities:
Parse pe header

Disassembly:
mov r8, qword [0x140036e50]
xor eax, eax
cmp word [r8], 0x5a4d
jne 0x14002b280
movsxd rdx, dword [r8 + 0x3c]
add rdx, r8
cmp dword [rdx], 0x4550
je 0x14002b288
ret
cmp word [rdx + 0x18], 0x20b
jne 0x14002b280
movzx eax, word [rdx + 0x14]
movzx r8d, word [rdx + 6]
lea rax, [rdx + rax + 0x18]
test r8w, r8w
je 0x14002b2d0
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea rdx, [rax + rdx*8 + 0x28]
nop dword [rax]
test byte [rax + 0x27], 0x20
je 0x14002b2c7
test rcx, rcx
je 0x14002b280
sub rcx, 1
add rax, 0x28
cmp rax, rdx
jne 0x14002b2b8
xor eax, eax
ret
Function at 0x14002b2e0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140036e50]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x14002b2ff
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x14002b308
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret

Function at 0x14002b320
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x140036e50]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x14002b340
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x14002b348
ret
cmp word [r8 + 0x18], 0x20b
jne 0x14002b340
sub rcx, rdx
movzx r9d, word [r8 + 6]
movzx edx, word [r8 + 0x14]
lea rdx, [r8 + rdx + 0x18]
test r9w, r9w
je 0x14002b340
lea eax, [r9 - 1]
lea rax, [rax + rax*4]
lea r9, [rdx + rax*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rdx + 0xc]
mov rax, r8
cmp rcx, r8
jb 0x14002b394
add eax, dword [rdx + 8]
cmp rcx, rax
jb 0x14002b3a0
add rdx, 0x28
cmp r9, rdx
jne 0x14002b380
xor eax, eax
ret
mov eax, dword [rdx + 0x24]
not eax
shr eax, 0x1f
ret

Function at 0x14002b3b0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov r11, qword [0x140036e50]
xor r9d, r9d
cmp word [r11], 0x5a4d
jne 0x14002b3d2
movsxd r8, dword [r11 + 0x3c]
add r8, r11
cmp dword [r8], 0x4550
je 0x14002b3e0
mov rax, r9
ret
cmp word [r8 + 0x18], 0x20b
jne 0x14002b3d2
mov eax, dword [r8 + 0x90]
test eax, eax
je 0x14002b3d2
movzx edx, word [r8 + 0x14]
movzx r10d, word [r8 + 6]
lea rdx, [r8 + rdx + 0x18]
test r10w, r10w
je 0x14002b3d2
lea r8d, [r10 - 1]
lea r8, [r8 + r8*4]
lea r10, [rdx + r8*8 + 0x28]
nop word cs:[rax + rax]
mov r9d, dword [rdx + 0xc]
mov r8, r9
cmp rax, r9
jb 0x14002b435
add r8d, dword [rdx + 8]
cmp rax, r8
jb 0x14002b448
add rdx, 0x28
cmp rdx, r10
jne 0x14002b420
xor r9d, r9d
mov rax, r9
ret
add rax, r11
jmp 0x14002b457
sub ecx, 1
add rax, 0x14
mov r8d, dword [rax + 4]
test r8d, r8d
jne 0x14002b467
mov edx, dword [rax + 0xc]
test edx, edx
je 0x14002b43e
test ecx, ecx
jg 0x14002b450
mov r9d, dword [rax + 0xc]
add r9, r11
mov rax, r9
ret

Function at 0x14002b5b0
Capabilities:
Allocate thread local storage

Disassembly:
sub rsp, 0x28
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov dword [0x14003c5e0], 0xffffffff
mov r8d, 0xffff
call qword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
mov qword [0x14003c5e8], rax
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x14002b600
lea rdx, [0x14002b4c0]
mov ecx, eax
mov dword [0x14003c5d8], eax
call dbg.__mingwthr_key_dtor
test eax, eax
jne 0x14002b608
add rsp, 0x28
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x14002b5f7
call sym.abort
nop
nop
Function at 0x14002b610
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rsi, qword [0x140036dc0]
mov r11d, dword [rsi]
mov rbx, rcx
test r11d, r11d
jne 0x14002b648
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x14002b6b0
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov r12, qword [rcx + 0x10]
test r12, r12
je 0x14002b6c0
mov esi, dword [0x14003c5d8]
mov r13, qword [sym.imp.KERNEL32.dll_GetLastError]
call r13
mov edi, eax
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, edi
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_SetLastError]
test rsi, rsi
je 0x14002b730
mov rbp, qword [rsi]
cmp rbp, r12
jb 0x14002b778
sub r12, 1
mov rax, qword [rsi + r12*8 + 8]
test rax, rax
jne 0x14002b637
mov rcx, rbx
call fcn.14002b510
mov qword [rsi + r12*8 + 8], rax
jmp 0x14002b637
call fcn.14002b510
mov qword [rbx + 0x10], rax
jmp 0x14002b637
mov r10d, dword [rsi]
test r10d, r10d
je 0x14002b7da
mov r9d, dword [0x1400315b0]
test r9d, r9d
je 0x14002b808
lock add dword [0x14003c5e0], 1
jne 0x14002b83c
mov r12, qword [rbx + 0x10]
test r12, r12
je 0x14002b7e7
mov eax, dword [rsi]
test eax, eax
je 0x14002b651
lock sub dword [0x14003c5e0], 1
js 0x14002b651
mov rcx, qword [0x14003c5e8]
xor r8d, r8d
mov edx, 1
call qword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
jmp 0x14002b651
lea rcx, [r12 + 0x21]
mov edx, 8
lea rdi, [r12 + 0x20]
call sym.calloc
mov rsi, rax
test rax, rax
je 0x14002b863
mov qword [rax], rdi
mov ecx, dword [0x14003c5d8]
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x14002b68b
call r13
jmp 0x14002b68b
lea rdi, [rbp + rbp]
lea rax, [r12 + 0x20]
mov rcx, rsi
cmp rdi, r12
cmovb rdi, rax
lea rdx, [rdi*8 + 8]
call sym.realloc
mov rsi, rax
test rax, rax
je 0x14002b863
mov qword [rax], rdi
sub rdi, rbp
lea rcx, [rax + rbp*8 + 8]
xor edx, edx
lea r8, [rdi*8]
call sym.memset
jmp 0x14002b753
call fcn.14002b5b0
mov dword [0x1400315b0], 1
mov edx, dword [rsi]
test edx, edx
jne 0x14002b6dc
mov r12, qword [rbx + 0x10]
test r12, r12
jne 0x14002b651
mov rax, qword [0x14003c5d0]
lea r12, [rax + 1]
mov qword [0x14003c5d0], r12
mov qword [rbx + 0x10], r12
jmp 0x14002b6f7
lock add dword [0x1400315b4], 1
je 0x14002b7c1
mov r8d, dword [0x1400315b0]
mov rbp, qword [sym.imp.KERNEL32.dll_Sleep]
lea rdi, [0x1400315b0]
test r8d, r8d
jne 0x14002b7d0
nop dword [rax]
xor ecx, ecx
call rbp
mov ecx, dword [rdi]
test ecx, ecx
je 0x14002b830
jmp 0x14002b7d0
mov rcx, qword [0x14003c5e8]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x14002b6ea
lock sub dword [0x14003c5e0], 1
jmp 0x14002b6ea
call sym.abort
nop
nop dword [rax]
Function at 0x416f20
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4170c6
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.004332a0
xorps xmm15, xmm15
mov r14, qword [0x00707598]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x416f8b
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x416fa0
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
nop
test rbx, rbx
jbe 0x416fc5
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x416fd9
cmp rbx, 0x1000
jae 0x416f95
nop dword [rax]
jmp 0x417049
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop
cmp rbx, 0x1000
jae 0x416fed
xor edx, edx
jmp 0x417040
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.004332a0
xorps xmm15, xmm15
mov r14, qword [0x00707598]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
nop dword [rax]
test dl, dl
jne 0x416fcf
jmp 0x416fb4
call fcn.004656a0
xorps xmm15, xmm15
mov r14, qword [0x00707598]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.00437a20
lea rax, [0x0057c07f]
mov ebx, 0x18
call fcn.00438320
mov rax, qword [rsp + 0x38]
call fcn.00438020
lea rax, [0x0057c16f]
mov ebx, 0x19
call fcn.00438320
mov rax, qword [rsp + 0x30]
nop
call fcn.00438020
call fcn.00437c80
call fcn.00437aa0
lea rax, [0x0057f490]
mov ebx, 0x21
nop dword [rax + rax]
call fcn.004360e0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00461ac0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.00416f20
Function at 0x417100
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41732a
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.00433320
xorps xmm15, xmm15
mov r14, qword [0x00707598]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x417179
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x41718c
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x4171b0
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
nop
jmp 0x4171c4
cmp rbx, 0x1000
jae 0x417183
jmp 0x417245
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x4171d6
xor esi, esi
jmp 0x417236
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
nop dword [rax]
call fcn.00433320
xorps xmm15, xmm15
mov r14, qword [0x00707598]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x4171ba
nop
jmp 0x4171a2
call fcn.004656a0
xorps xmm15, xmm15
mov r14, qword [0x00707598]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x4172c5
call fcn.00437a20
lea rax, [0x0057c7fa]
mov ebx, 0x19
call fcn.00438320
mov rax, qword [rsp + 0x68]
call fcn.00438020
lea rax, [0x0057c16f]
mov ebx, 0x19
call fcn.00438320
mov eax, dword [rsp + 0x34]
nop dword [rax]
call fcn.00438020
call fcn.00437c80
call fcn.00437aa0
lea rax, [0x00577c3f]
mov ebx, 0xd
nop dword [rax + rax]
call fcn.004360e0
cmp eax, 0x5af
je 0x417268
call fcn.00437a20
lea rax, [0x0057c7fa]
mov ebx, 0x19
nop dword [rax]
call fcn.00438320
mov rax, qword [rsp + 0x38]
call fcn.00438020
lea rax, [0x0057c16f]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.00438320
mov eax, dword [rsp + 0x34]
call fcn.00438020
call fcn.00437c80
call fcn.00437aa0
lea rax, [0x0057ea40]
mov ebx, 0x1f
call fcn.004360e0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00461ac0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00417100
Function at 0x41f5e0
Capabilities:
Hash data using murmur3

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
cmp byte [0x00707397], 0
jne 0x41f6cf
mov rdx, qword [rax + 0x50]
test byte [rdx], al
nop
nop
nop
sub rbx, qword [rax + 0x18]
mov esi, dword [rax + 0x5c]
imul rbx, rsi
mov rsi, rbx
shr rbx, 0x20
shr rsi, 0x23
and ebx, 7
mov rdi, rcx
mov rcx, rbx
mov r8d, 1
shl r8d, cl
add rdx, rsi
lock or byte [rdx], r8b
nop
nop
mov rcx, qword [rax + 0x18]
nop
movabs rdx, 0x800000000000
lea rax, [rdx + rcx]
mov rdx, rax
shr rax, 0x2a
cmp rax, 0x40
jae 0x41f6c5
lea rbx, [0x006d97d0]
mov rax, qword [rbx + rax*8]
shr rdx, 0x16
and edx, 0xfffff
mov rdx, qword [rax + rdx*8]
test byte [rdx], al
test byte [rax], al
mov rax, rcx
shr rcx, 0x10
and ecx, 0x3f
movzx ebx, byte [rdx + rcx + 0x11440]
lea rsi, [rcx + 0x11440]
add rdx, rsi
shr rax, 0xd
and eax, 7
mov rcx, rax
mov eax, 1
shl eax, cl
nop
test al, bl
jne 0x41f6a7
lock or byte [rdx], al
mov rax, qword [r14 + 0x30]
mov rax, qword [rax + 0xa0]
test byte [rax], al
add qword [rax + 0x1248], rdi
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov ecx, 0x40
call fcn.00464140
lea rax, [0x00581d77]
mov ebx, 0x2c
nop dword [rax + rax]
call fcn.004360e0
nop
int3

Function at 0x421ac0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x421bbe
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rbx
mov qword [rsp + 8], 0
jmp 0x421b00
mov rax, qword [rsp + 0x50]
mov rcx, rdx
mov rbx, qword [rsp + 0x58]
nop
cmp qword [rsp + 8], rbx
jae 0x421baf
test byte [rax], al
lea rcx, [rax + 0x100b8]
mov rax, rcx
call fcn.00422660
nop dword [rax]
test rax, rax
je 0x421baf
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x30], xmm15
lea rcx, [0x00421c00]
mov qword [rsp + 0x10], rcx
lea rdx, [rsp + 8]
mov qword [rsp + 0x18], rdx
mov rdx, qword [rsp + 0x50]
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rbx
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x38], rax
lea rbx, [rsp + 0x10]
mov qword [rsp], rbx
call fcn.00461980
xorps xmm15, xmm15
mov r14, qword [0x00707598]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x60]
test rdx, rdx
jne 0x421b9d
xor eax, eax
jmp 0x421ba7
mov rax, qword [rdx]
call rax
mov rdx, qword [rsp + 0x60]
test al, al
je 0x421af2
mov rax, qword [rsp + 8]
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.00461ac0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.00421ac0
Function at 0x42f720
Capabilities:
Hash data using murmur3

Disassembly:
cmp rsp, qword [r14 + 0x18]
jbe 0x42f9c6
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
test byte [rax], al
lea rsi, [rax + 0x1270]
mov rcx, qword [rax + 0x1260]
sub rcx, rsi
shr rcx, 3
cmp rcx, 0x200
ja 0x42f9ba
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x30], rcx
mov qword [rax + 0x1260], 0
cmp byte [0x00707397], 0
jne 0x42f782
xor edx, edx
xor ebx, ebx
nop
jmp 0x42f7ca
xor edx, edx
jmp 0x42f7ad
mov qword [rsp + 0x28], rdx
mov rcx, qword [rax + rdx*8 + 0x1270]
mov rax, rcx
call fcn.0041ee00
mov rdx, qword [rsp + 0x28]
inc rdx
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
cmp rdx, rcx
jl 0x42f786
add rax, 0x1260
call fcn.0042f5e0
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
inc rdx
cmp rdx, rcx
jge 0x42f954
mov rsi, qword [rax + rdx*8 + 0x1270]
nop dword [rax + rax]
cmp rsi, 0x1000
jb 0x42f7c7
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rbx
mov rax, rsi
xor ebx, ebx
mov rcx, rbx
nop dword [rax + rax]
call fcn.00413ea0
test rax, rax
jne 0x42f822
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
nop
jmp 0x42f7c7
mov rsi, qword [rbx + 0x50]
test byte [rsi], al
nop
mov r8, rcx
shr rcx, 3
movzx r9d, byte [rsi + rcx]
and r8d, 7
mov rdx, rcx
mov rcx, r8
mov r10d, 1
shl r10d, cl
add rsi, rdx
test r10b, r9b
je 0x42f869
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
jmp 0x42f7c7
nop
lock or byte [rsi], r10b
nop
nop
mov rcx, qword [rbx + 0x18]
nop
movabs rsi, 0x800000000000
lea r8, [rsi + rcx]
mov r9, r8
shr r8, 0x2a
cmp r8, 0x40
jae 0x42f9ad
lea r10, [0x006d97d0]
mov r8, qword [r10 + r8*8]
shr r9, 0x16
and r9d, 0xfffff
mov r9, qword [r8 + r9*8]
test byte [r9], al
test byte [r8], al
mov r8, rcx
shr rcx, 0x10
and ecx, 0x3f
movzx r10d, byte [r9 + rcx + 0x11440]
lea r11, [rcx + 0x11440]
add r9, r11
shr r8, 0xd
and r8d, 7
mov rcx, r8
mov r8d, 1
shl r8d, cl
test r8b, r10b
jne 0x42f8ee
lock or byte [r9], r8b
movzx r8d, byte [rbx + 0x62]
test r8b, 1
je 0x42f925
mov rax, qword [rsp + 0x48]
mov r8, qword [rax + 0x1248]
add r8, qword [rbx + 0x68]
mov qword [rax + 0x1248], r8
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
nop
jmp 0x42f7c7
mov r8, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
cmp r8, rcx
jae 0x42f9a5
mov rbx, qword [rsp + 0x48]
mov qword [rbx + r8*8 + 0x1270], rax
inc r8
mov rax, rbx
mov rdx, qword [rsp + 0x28]
mov rbx, r8
jmp 0x42f7c7
cmp rbx, 0x200
ja 0x42f998
lea rdx, [rax + 0x1270]
lea rsi, [rax + 0x1238]
mov rcx, rbx
mov edi, 0x200
mov rbx, rdx
mov rax, rsi
call fcn.00424f40
mov rax, qword [rsp + 0x48]
add rax, 0x1260
call fcn.0042f5e0
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov rcx, rbx
mov edx, 0x200
call fcn.004641a0
mov rax, r8
call fcn.00464120
mov rax, r8
mov ecx, 0x40
call fcn.00464140
mov edx, 0x200
nop
call fcn.00464180
nop
mov qword [rsp + 8], rax
call fcn.00466540
mov rax, qword [rsp + 8]
jmp fcn.0042f720
Function at 0x4448a0
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x444a0a
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov ecx, dword [rax + 0x190]
mov edx, dword [rax + 0x194]
mov rsi, qword [rax + 0x998]
mov edi, dword [rax + 0x194]
cmp edi, edx
jne 0x4448b8
cmp edx, ecx
jne 0x4449f8
nop dword [rax]
test rsi, rsi
jne 0x4449f8
mov qword [rsp + 0x28], rax
test rbx, rbx
jne 0x444914
nop
call fcn.00465b00
xorps xmm15, xmm15
mov r14, qword [0x00707598]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rbx, qword [rsp]
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x10], rbx
call fcn.004447a0
mov rcx, qword [0x006b3b68]
mov rdx, qword [0x006b3b60]
mov rbx, qword [rsp + 0x28]
mov esi, dword [rbx]
mov edi, esi
sar esi, 0x1f
shr esi, 0x1b
add esi, edi
mov r8d, esi
and esi, 0xffffffe0
sub edi, esi
test edi, edi
jl 0x4449f3
cmp edi, 0x20
sbb esi, esi
sar r8d, 5
mov rax, rcx
mov ecx, edi
mov r9d, 1
shl r9d, cl
and r9d, esi
movsxd rsi, r8d
cmp rax, rsi
jbe 0x4449e8
lea rcx, [rdx + rsi*4]
lock or dword [rcx], r9d
mov rcx, qword [0x006b4850]
mov qword [rbx + 8], rcx
nop
mov rcx, rbx
mov qword [0x006b4850], rbx
nop
mov edx, 1
lea rsi, [0x006b4858]
lock xadd dword [rsi], edx
mov rdx, qword [rcx + 0x1220]
shr rdx, 0x3d
test dl, dl
jne 0x4449d7
nop
nop
mov rax, qword [rsp + 0x10]
movabs rdx, 0x1fffffffffffffff
and rdx, rax
bts rdx, 0x3f
xchg qword [rcx + 0x1220], rdx
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x005811b5]
mov ebx, 0x28
call fcn.004360e0
mov rcx, rax
mov rax, rsi
call fcn.00464120
call fcn.00434600
lea rax, [0x0057fcf4]
mov ebx, 0x23
call fcn.004360e0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00461ac0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004448a0