joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1406a9acb
Capabilities:
Get common file path
Set registry value

Disassembly:
push rdi
shl dl, 0xf7
setne byte [rsp + 0x48]
push rsi
add qword [rsp + 0x48], 0xffffffffffdbeca7
mov rdi, rbp
push rdx
push rdx
call fcn.1404f4f6f
lea r15, [r15 + r15*8 - 0x62eeb6e8]
pushfq
and r15b, 0xb3
jbe 0x1408a295a
not r15b
mov r15, qword [rsp + 0x10]
mov qword [rsp + 0x10], 0xffffffffed5d0734
push qword [rsp]
popfq
lea rsp, [rsp + 0x10]
call fcn.1407789a2
call 0x1406a9ae8
push rbp
push r11
pushfq
movabs r11, 0x76b153ab52929d02
add r11w, 0x9a30
neg r11
call fcn.140351fc5
mov qword [rsp + 8], rbx
btr rbx, r14
mov qword [rsp + 0x10], rdi
bts bx, r10w
xor r10d, r10d
shr bl, 0x9f
test r11w, 0x5a2f
movzx bx, r15b
mov rbx, rdx
jmp 0x1408a29ab
test rdx, rdx
jmp 0x1408a29b3
je 0x1408a2b3a
mov edi, 5
cwde
bts rdx, rdx
mov r11w, 0x1702
sub rdi, rcx
rcl edx, cl
rol al, 0xb8
rdtsc
lea r11, [r10 + rcx]
lea rdx, [rdi + r11]
mov ax, 0x24bd
sets al
lea rax, [rdx + 4]
test spl, r8b
jmp 0x1408a29ed
cmp rax, rbx
jae 0x1408a2a6f
mov eax, dword [r11]
cmp r14w, 0x93c
clc
jmp 0x1408a2a05
xor eax, r8d
cmp r12b, 0xb4
jmp 0x1408a2a11
cmp eax, dword [r9 + 0x1c]
jmp 0x1408a2a1a
jne 0x1408a2a6f
mov eax, dword [r10 + rcx + 4]
cmc
cmp r11d, edx
xor eax, r8d
jmp 0x1408a2a31
cmp eax, dword [r9 + 0x20]
jmp 0x1408a2a3a
jne 0x1408a2a6f
movzx eax, word [r10 + rcx + 8]
cmp r8w, 0xbf9d
cmp r13b, sil
test ax, 0x719
xor eax, r8d
cmp sil, 0x3e
test r14b, bpl
cmp bl, sil
cmp eax, dword [r9 + 0x24]
jmp 0x1408a2a69
je 0x1408a2b5c
cmp rdx, rbx
jmp 0x1408a2a77
jae 0x1408a2aad
mov eax, dword [r11]
test r12b, 0xa7
xor eax, r8d
cmp ax, ax
stc
cmp eax, dword [r9 + 0x28]
jne 0x1408a2aad
movzx eax, word [r10 + rcx + 4]
jmp 0x1408a2aa0
xor eax, r8d
cmp eax, dword [r9 + 0x2c]
je 0x1408a2b5c
lea rax, [rdx + 3]
cmp rax, rbx
jmp 0x1408a2ab9
jae 0x1408a2b25
mov eax, dword [r11]
cmp r13w, 0x6e06
test ebx, 0x1e9a1ebc
xor eax, r8d
cmp r11w, 0xfeb8
jmp 0x1408a2adc
cmp eax, dword [r9 + 0x30]
jne 0x1408a2b25
mov eax, dword [r10 + rcx + 4]
xor eax, r8d
clc
cmp r15w, bx
cmp eax, dword [r9 + 0x34]
jmp 0x1408a2afc
jne 0x1408a2b25
movzx eax, byte [r10 + rcx + 8]
test r14b, 0x81
cmp ch, 0x9f
xor eax, r8d
jmp 0x1408a2b1b
cmp eax, dword [r9 + 0x38]
je 0x1408a2b5c
inc r10
test sp, 0x8e9a
cmp ax, 0xa2be
cmp r10, rbx
jb 0x1408a29d2
xor al, al
jmp 0x1408a2b41
mov rbx, qword [rsp + 8]
movsx di, r11b
xchg edi, edi
movzx rdi, r12w
mov rdi, qword [rsp + 0x10]
jmp 0x1408a2b5b
ret
mov rbx, qword [rsp + 8]
mov al, spl
mov rdi, qword [rsp + 0x10]
mov al, 0x1a
mov al, 1
jmp 0x1408a2b72
ret
Function at 0x1406a9ae8
Capabilities:
Get common file path
Set registry value

Disassembly:
push rdi
shl dl, 0xf7
setne byte [rsp + 0x48]
push rsi
add qword [rsp + 0x48], 0xffffffffffdbeca7
mov rdi, rbp
push rdx
push rdx
call fcn.1404f4f6f
lea r15, [r15 + r15*8 - 0x62eeb6e8]
pushfq
and r15b, 0xb3
jbe 0x1408a295a
not r15b
mov r15, qword [rsp + 0x10]
mov qword [rsp + 0x10], 0xffffffffed5d0734
push qword [rsp]
popfq
lea rsp, [rsp + 0x10]
call fcn.1407789a2
call 0x1406a9ae8
push rbp
push r11
pushfq
movabs r11, 0x76b153ab52929d02
add r11w, 0x9a30
neg r11
call fcn.140351fc5
mov qword [rsp + 8], rbx
btr rbx, r14
mov qword [rsp + 0x10], rdi
bts bx, r10w
xor r10d, r10d
shr bl, 0x9f
test r11w, 0x5a2f
movzx bx, r15b
mov rbx, rdx
jmp 0x1408a29ab
test rdx, rdx
jmp 0x1408a29b3
je 0x1408a2b3a
mov edi, 5
cwde
bts rdx, rdx
mov r11w, 0x1702
sub rdi, rcx
rcl edx, cl
rol al, 0xb8
rdtsc
lea r11, [r10 + rcx]
lea rdx, [rdi + r11]
mov ax, 0x24bd
sets al
lea rax, [rdx + 4]
test spl, r8b
jmp 0x1408a29ed
cmp rax, rbx
jae 0x1408a2a6f
mov eax, dword [r11]
cmp r14w, 0x93c
clc
jmp 0x1408a2a05
xor eax, r8d
cmp r12b, 0xb4
jmp 0x1408a2a11
cmp eax, dword [r9 + 0x1c]
jmp 0x1408a2a1a
jne 0x1408a2a6f
mov eax, dword [r10 + rcx + 4]
cmc
cmp r11d, edx
xor eax, r8d
jmp 0x1408a2a31
cmp eax, dword [r9 + 0x20]
jmp 0x1408a2a3a
jne 0x1408a2a6f
movzx eax, word [r10 + rcx + 8]
cmp r8w, 0xbf9d
cmp r13b, sil
test ax, 0x719
xor eax, r8d
cmp sil, 0x3e
test r14b, bpl
cmp bl, sil
cmp eax, dword [r9 + 0x24]
jmp 0x1408a2a69
je 0x1408a2b5c
cmp rdx, rbx
jmp 0x1408a2a77
jae 0x1408a2aad
mov eax, dword [r11]
test r12b, 0xa7
xor eax, r8d
cmp ax, ax
stc
cmp eax, dword [r9 + 0x28]
jne 0x1408a2aad
movzx eax, word [r10 + rcx + 4]
jmp 0x1408a2aa0
xor eax, r8d
cmp eax, dword [r9 + 0x2c]
je 0x1408a2b5c
lea rax, [rdx + 3]
cmp rax, rbx
jmp 0x1408a2ab9
jae 0x1408a2b25
mov eax, dword [r11]
cmp r13w, 0x6e06
test ebx, 0x1e9a1ebc
xor eax, r8d
cmp r11w, 0xfeb8
jmp 0x1408a2adc
cmp eax, dword [r9 + 0x30]
jne 0x1408a2b25
mov eax, dword [r10 + rcx + 4]
xor eax, r8d
clc
cmp r15w, bx
cmp eax, dword [r9 + 0x34]
jmp 0x1408a2afc
jne 0x1408a2b25
movzx eax, byte [r10 + rcx + 8]
test r14b, 0x81
cmp ch, 0x9f
xor eax, r8d
jmp 0x1408a2b1b
cmp eax, dword [r9 + 0x38]
je 0x1408a2b5c
inc r10
test sp, 0x8e9a
cmp ax, 0xa2be
cmp r10, rbx
jb 0x1408a29d2
xor al, al
jmp 0x1408a2b41
mov rbx, qword [rsp + 8]
movsx di, r11b
xchg edi, edi
movzx rdi, r12w
mov rdi, qword [rsp + 0x10]
jmp 0x1408a2b5b
ret
mov rbx, qword [rsp + 8]
mov al, spl
mov rdi, qword [rsp + 0x10]
mov al, 0x1a
mov al, 1
jmp 0x1408a2b72
ret

Function at 0x1406b4846
Capabilities:
Authenticate hmac
Get local ipv4 addresses

Disassembly:
xor dx, word [rsp + rdx - 0x3a77ca18]
mov rbp, qword [rsp + rdx*2 - 0x74eff5a8]
jo fcn.14053e1a6
xor edx, dword [rsp + rdx - 0x3a77faac]
Function at 0x1406b9202
Capabilities:
Encode data using xor

Disassembly:
push r12
add bl, 0x1b
movabs r12, 0x13b87c917dae800e
mov rdx, qword [rsp + rsi - 0x42123a40]

Function at 0x1406b9664
Capabilities:
Packed with generic packer

Disassembly:
push qword [rsp + 8]
popfq
lea rsp, [rsp + 0x20]
call fcn.14083af6d
movabs rcx, 0xbb359411ed3b6f16
pushfq
neg cl
push r12
mov r12, rcx
mov rcx, qword [rsp + 0x20]
mov qword [rsp + 0x20], 0xffffffffc6a2a9c0
mov r12, qword [rsp]
jg fcn.140721bed
jno 0x14040038a

Function at 0x1406bcd48
Capabilities:
Set registry value

Disassembly:
test edx, 0xd1b84533
jns 0x1406e4f0c
mov qword [rsp + 0x30], rax
setg dl
call fcn.14056a5d0
shr si, 0xc2
jns 0x1404d473a

Function at 0x1406d1bf6
Capabilities:
Packed with generic packer

Disassembly:
push r9
mov rax, qword [rsp + r11 + 0x28]
mov rax, qword [rax]
js 0x140703b18
sete r10b
cmp r10b, byte [rsp + r12 - 0x5862a6e6]
jle 0x140460164
imul byte [rdx + 0x2e]
mov r13b, 0xb7
jrcxz 0x140703b80
push rbp
insd dword [rdi], dx
mov dh, 0x99
outsb dx, byte [rsi]
mov bl, 0x4a
movsb byte [rdi], byte [rsi]
invalid
xor eax, 0xcf901b25
mov bh, 0x6a
sub ch, byte [rdi + 0x2e]
mov al, 0xc5
mov edi, 0xbfa83992
jbe 0x140703b36
cdq
mov edx, 0x3b7ff6bc
invalid

Function at 0x1406d9ce8
Capabilities:
Encode data using xor

Disassembly:
pop rcx
int 0x7a
cmp ebx, dword [rbx - 0x4d02cd3a]
add cl, ch
shl byte cs:[rbx - 0x43f632be], 0xde
shl byte cs:[rbx - 0x43f632be], 0xde
xor bl, byte [rax]
push 0xffffffffcd3cb5dd
out dx, al
lodsb al, byte [rsi]
sub cl, bpl
mov cl, 0x91
ja 0x1406d9cb9
xor ch, byte [rax - 0x32c9c95d]
wait
test al, 0xf
pop rsp
xchg qword [rsp + 0x40], rdi
mov r12, qword [rsp + 0x18]
add qword [rsp + 0x20], 0xffffffffbf953fd4
shr dword [rsp + 0x30], 0xfb
not word [rsp + 8]
xor r10d, 0xae180523
not r10w
call fcn.140486868
ror esp, 0xa9
shl byte [rdi + 0x68], cl
pop rax
cwde
loop 0x1406d9cc6
or edx, eax
mov dh, 0xff
pop rcx
shl byte [rdi + 0x72], 1
invalid

Function at 0x1406e53a5
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 8], 0xffffffff8e8f7e47
lea rsp, [rsp + 8]
call fcn.140755750

Function at 0x1406e88f4
Capabilities:
Get common file path
Packed with generic packer
Set registry value

Disassembly:
mov qword [rsp + 8], r10
not r12b
call fcn.1404d72d2
sub r14d, 0xed8cd51a
shr r14, 0x1e
cmovs r12, r10
and r10b, 0xb6
sub r14w, r12w
add qword [rsp], 0x15fec2
and r10, r14
movabs rdi, 0xf69f8fa74ea73087
and r14d, r10d
shl di, 4
movabs rsi, 0x22842987a21d0e3c
push r14
mov rdi, qword [rsp + 8]
mov rdi, qword [rdi]
jbe 0x140546bc1

Function at 0x1406e8942
Capabilities:
Get common file path
Packed with generic packer
Set registry value

Disassembly:
shr r10d, 0x90
lea r10, [r10*8 - 0x4440048]
and r15b, 8
shr r15w, 0x17
cmp r10d, 0xd2288f14
jns 0x1405da2b5
add r10w, 0xfe9c
mov rax, r15
test rax, r10
push r9
mov rax, qword [rsp + r10 - 0x673c4635]
mov rax, qword [rax + r15 - 0x673c47b9]
jae 0x14063f494

Function at 0x1406fa98a
Capabilities:
Encode data using xor

Disassembly:
push qword [rsp + 0x18]
popfq
lea rsp, [rsp + 0x30]
call fcn.14073186f
Function at 0x1407064b7
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
not dil
push r12
js 0x14045547c
mov byte [rsp + 0x18], 0x29
lea rbp, [rbp + 0x6782f1b4]
call fcn.140439bf7

Function at 0x1407064d3
Capabilities:
Packed with generic packer

Disassembly:
js 0x1405d04bf
add word [rsp + rdx - 0x7797abd5], dx
mov rdx, qword [rsp + rdx - 0x7797abfd]
jl 0x14061760c
mov esi, 0x2eaaaa43
invalid

Function at 0x14070e23e
Capabilities:
Set registry value

Disassembly:
mov rcx, qword [rsp + rdx*2 - 0x6818e5a8]
mov rcx, qword [rcx + rbp*2 - 0x6818e600]
ja 0x140629905

Function at 0x14070f4a5
Capabilities:
Encode data using xor

Disassembly:
neg byte [rsp + rcx - 0x615edc44]
setbe byte [rsp + rcx - 0x615edc4c]
sub cl, 5
lea rax, [rax + rcx - 0x3b4c8e33]
setge byte [rsp + rcx - 0x615edc47]
add word [rsp + rcx - 0x615edc47], 0x510e
jo 0x140552e94
shr word [rsp + rcx - 0x615edc47], cl
call fcn.140613fe4
neg dword [rsp + 0x68]
jg 0x1406554d2
mov rcx, qword [rsp + 0x10]
call fcn.1406beda4
push rbx
call fcn.140427407
push rbp
push rbx
movabs rbx, 0x6b1f200ac986a295
pushfq
sub rbx, rbx
push rsi
movabs rsi, 0xb49acc9b0d1c0c97

Function at 0x14070fe15
Capabilities:
Encode data using xor

Disassembly:
mov r8, qword [rsp + 0x20]
xor r8d, r8d
push rsi
or r12, qword [rsp + 0x28]
movabs rsi, 0xbc178fae26a501bc
lea rax, [rax - 0x46d864fd]
or dword [rsp + r8*2 + 0x28], r12d
seta r10b
add r12w, word [rsp + 0x29]
setle r8b
cmovns r8w, r12w
xchg qword [rsp + 0x58], rax
mov r12, qword [rsp + 0x48]
not r8d
jge 0x14061a970

Function at 0x1407153bd
Capabilities:
Get common file path
Set registry value

Disassembly:
mov rax, qword [rsp + 8]
mov rax, qword [rax]
je 0x14000976f
xor rdx, 0xffffffffa7bce3b9
shl edx, 5
cmp dx, 0x30ad
call fcn.14064dd99

Function at 0x140719bec
Capabilities:
Encode data using xor

Disassembly:
call fcn.140408326
adc ecx, edi
mov bh, 0x32
shl dword gs:[rax + rbx*4], 0x10
jl 0x140719c34
and al, 0x98
adc byte [rax + rdi + 0x42], bh
movabs eax, dword [0xe0edec67bb830567]
movabs eax, dword [0xe0edec67bb830567]
xor ebx, dword [rax + 0x33b2e594]
cwde
jo 0x140719bf7
invalid
invalid
push rcx
cwde
lodsd eax, dword [rsi]
in al, 0x4b
cwde
add ch, bl
xchg ebx, eax
fsub qword [ebp + 0x2067c3d5]
cmp byte [rdi], al
movabs dword [0x667bd7f9f5267aa], eax
and ebx, ebp
pop rcx
cwde
div dword [rdx + 0x47ebd23]
test byte [rcx + 0x27af5f6f], cl
xor cl, dh
mov edi, dword [rdx]
jmp 0x140719c2f
Function at 0x14072862e
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
jno 0x140506057
jb 0x140619394
push 0xffffffffdaa1302c
and ebp, edi
add edi, 0xfc27be1f
mov rbp, qword [rsp + 0x30]
mov qword [rsp + 0x30], rax
call fcn.140417699
lea r14, [r14*2 - 0x2ef70f63]
not word [rsp + 0x48]
add qword [rsp], 0xffffffffbf91b8fa
mov r14, qword [rsp + 0x58]
or qword [rsp + 0x48], 0xd2a348b
xor dword [rsp + 0x48], 0x30320726
call fcn.1403de0ad
or edx, r10d
jb fcn.1405ddb0a
xchg qword [rsp + 0x50], rdi
mov rdx, qword [rsp + 0x38]
neg byte [rsp + 0x48]
test dword [rsp + 0x4c], r10d
not r10d
bswap r10
not word [rsp + 0x48]
mov r10, qword [rsp + 0x28]
jo fcn.140662bf3
jne 0x1404c5a04
mov byte [rsp + 0x48], 0x88
call fcn.1405231a2
test r10b, 0x86
jno 0x140691cdc
push rcx
mov ebx, dword cs:[rdi + 0x6fa9980]
mov esp, ss
sub dword [rbx - 0x5b7c7609], esi
or ebx, dword [rcx - 0x474b0e51]
loop 0x1407286b3
invalid
Function at 0x14006c9c0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x14006c9cd
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14006c9dd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x14006c9c5
lea eax, [rcx + 1]
call r11
adc eax, eax
add ebx, ebx
jne 0x14006c9f5
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x14006c9e2
sub eax, 3
jb 0x14006ca0f
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x14006ca46
movsxd rbp, eax
lea eax, [rcx + 1]
call r11
adc ecx, ecx
call r11
adc ecx, ecx
jne 0x14006ca36
mov ecx, eax
add eax, 2
call r11
adc ecx, ecx
add ebx, ebx
jne 0x14006ca34
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x14006ca23
cmp rbp, 0xfffffffffffff300
adc ecx, eax
call fcn.14006c982
jmp 0x14006c9cd
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x7800
mov dl, 5
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x14006ca92
cmp rsi, rcx
jae 0x14006ca9a
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x14006ca79
cmp al, 0x8f
ja 0x14006ca79
cmp byte [rsi - 2], 0xf
je 0x14006ca7f
sub al, 0xe8
cmp al, 1
ja 0x14006ca63
cmp rsi, rcx
jae 0x14006ca9a
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x14006ca69
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x14006ca9a
lodsb al, byte [rsi]
jmp 0x14006ca79
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x69000]
mov eax, dword [rdi]
or eax, eax
je 0x14006caf7
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x6c4ec]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x14006caa7
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x14006caf1
mov qword [rbx], rax
add rbx, 8
jmp 0x14006cac7
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x14006cb31
cmp al, 0xef
ja 0x14006cb23
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x14006cb03
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x14006cb12
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
mov byte [fcn.14006cbb0], 0xfc
lea rcx, [rsi - 0x1000]
push 1
pop rdx
xor r8, r8
push rax
call fcn.14006cbb0
pop rax
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x14006cba0
sub rsp, 0xffffffffffffff80
jmp 0x1400013f0
Function at 0x411ae0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x411c6b
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.0042c220
xorps xmm15, xmm15
mov r14, qword [0x005d1a38]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x411b45
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x411b54
add rsp, 0x48
pop rbp
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x411b73
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x411b83
cmp rbx, 0x1000
jae 0x411b4b
jmp 0x411bed
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x411b95
xor edx, edx
jmp 0x411be4
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.0042c220
xorps xmm15, xmm15
mov r14, qword [0x005d1a38]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x411b79
jmp 0x411b68
call fcn.00458e00
xorps xmm15, xmm15
mov r14, qword [0x005d1a38]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.004305a0
lea rax, [0x004ce52a]
mov ebx, 0x18
nop dword [rax]
call fcn.00430e20
mov rax, qword [rsp + 0x38]
call fcn.00430b60
lea rax, [0x004ce70f]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.00430e20
mov rax, qword [rsp + 0x30]
call fcn.00430b60
call fcn.004307e0
call fcn.00430600
lea rax, [0x004cf9de]
mov ebx, 0x21
call fcn.0042ec00
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00455760
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00411ae0
Function at 0x411ca0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x411ec6
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.0042c2a0
xorps xmm15, xmm15
mov r14, qword [0x005d1a38]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x411d13
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x411d22
add rsp, 0x50
pop rbp
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x411d45
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x411d55
cmp rbx, 0x1000
jae 0x411d19
nop
jmp 0x411dd8
add rsp, 0x50
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop word [rax + rax]
cmp rbx, 0x1000
jae 0x411d6d
xor esi, esi
jmp 0x411dca
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.0042c2a0
xorps xmm15, xmm15
mov r14, qword [0x005d1a38]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x411d4b
jmp 0x411d36
call fcn.00458e00
xorps xmm15, xmm15
mov r14, qword [0x005d1a38]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x411e60
nop dword [rax + rax]
call fcn.004305a0
lea rax, [0x004ce728]
mov ebx, 0x19
call fcn.00430e20
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
call fcn.00430b60
lea rax, [0x004ce70f]
mov ebx, 0x19
call fcn.00430e20
mov eax, dword [rsp + 0x34]
call fcn.00430b60
nop
call fcn.004307e0
call fcn.00430600
lea rax, [0x004cd07b]
mov ebx, 0xd
call fcn.0042ec00
nop dword [rax + rax]
cmp eax, 0x5af
je 0x411e00
call fcn.004305a0
lea rax, [0x004ce728]
mov ebx, 0x19
call fcn.00430e20
mov rax, qword [rsp + 0x38]
call fcn.00430b60
lea rax, [0x004ce70f]
mov ebx, 0x19
call fcn.00430e20
mov eax, dword [rsp + 0x34]
nop dword [rax]
call fcn.00430b60
call fcn.004307e0
call fcn.00430600
lea rax, [0x004cf522]
mov ebx, 0x1f
nop dword [rax + rax]
call fcn.0042ec00
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00455760
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.00411ca0
Function at 0x418f20
Capabilities:
Hash data using murmur3

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
cmp byte [0x005d182f], 0
jne 0x419007
sub rbx, qword [rax + 0x18]
mov rdx, qword [rax + 0x50]
test byte [rdx], al
mov esi, dword [rax + 0x64]
imul rbx, rsi
mov rsi, rbx
shr rbx, 0x20
shr rsi, 0x23
and ebx, 7
mov rdi, rcx
mov rcx, rbx
mov r8d, 1
shl r8d, cl
add rdx, rsi
nop
nop
nop
nop
lock or byte [rdx], r8b
mov rcx, qword [rax + 0x18]
movabs rdx, 0x800000000000
lea rax, [rdx + rcx]
mov rdx, rax
shr rdx, 0x2a
nop
nop
nop
cmp rdx, 0x40
jae 0x418ffa
lea rbx, [0x005a3c18]
mov rdx, qword [rbx + rdx*8]
test byte [rdx], al
mov rbx, rcx
shr rbx, 0x10
and ebx, 0x3f
shr rcx, 0xd
and ecx, 7
mov esi, 1
shl esi, cl
shr rax, 0x16
and eax, 0xfffff
mov rax, qword [rdx + rax*8]
test byte [rax], al
movzx edx, byte [rax + rbx + 0x11440]
lea rax, [rax + rbx]
lea rax, [rax + 0x11440]
test sil, dl
jne 0x418fe0
lock or byte [rax], sil
mov rax, qword [r14 + 0x30]
mov rax, qword [rax + 0xa0]
test byte [rax], al
add qword [rax + 0x1250], rdi
add rsp, 0x10
pop rbp
ret
mov rax, rdx
mov ecx, 0x40
call fcn.004579e0
lea rax, [0x004d0ad3]
mov ebx, 0x2c
call fcn.0042ec00
nop
int3

Function at 0x41b2e0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41b3e6
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x70], rcx
mov byte [rsp + 0x17], dil
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x18], 0
jmp 0x41b323
mov rax, qword [rsp + 0x60]
mov rcx, rdx
mov rbx, qword [rsp + 0x68]
movzx edi, byte [rsp + 0x17]
cmp qword [rsp + 0x18], rbx
jae 0x41b3db
test byte [rax], al
lea rcx, [rax + 0x100b8]
mov ebx, edi
mov rax, rcx
nop dword [rax]
call fcn.0041c0e0
test rax, rax
je 0x41b3db
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x30], xmm15
movups xmmword [rsp + 0x40], xmm15
lea rcx, [0x0041b420]
mov qword [rsp + 0x20], rcx
lea rdx, [rsp + 0x18]
mov qword [rsp + 0x28], rdx
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x48], rax
lea rbx, [rsp + 0x20]
mov qword [rsp], rbx
nop dword [rax]
call fcn.00455620
xorps xmm15, xmm15
mov r14, qword [0x005d1a38]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x70]
nop dword [rax]
test rdx, rdx
jne 0x41b3c9
xor eax, eax
jmp 0x41b3d3
mov rax, qword [rdx]
call rax
mov rdx, qword [rsp + 0x70]
test al, al
je 0x41b311
mov rax, qword [rsp + 0x18]
add rsp, 0x50
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov byte [rsp + 0x20], dil
call fcn.00455760
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movzx edi, byte [rsp + 0x20]
jmp fcn.0041b2e0