joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400b5000
Capabilities:
Encode data using xor

Disassembly:
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
push rbp
mov rbp, rsp
sub rsp, 0x20
and rsp, 0xfffffffffffffff0
lea rax, [0x140028800]
push 0
pop rdi
push rax
xor dword [rax + 0x22c], 0x66a7218
xor dword [rax + 0x33c], 0xbc146b8
sub dword [rax + 0x280], 0x70774a66
add dword [rax + 0x3e0], 0x23cb18d4
not dword [rax + 0x80]
not dword [rax + 0x2c]
sub dword [rax + 0xd8], 0x66d31b98
add dword [rax + 0x31c], 0x1b2e1fda
add dword [rax + 0x370], 0x84f3a62
sub dword [rax + 0x15c], 0x26443bd9
not dword [rax + 0x2d8]
not dword [rax + 0x8c]
sub dword [rax + 0x12c], 0x4a6562f2
xor dword [rax + 0xcc], 0x65b77fde
not dword [rax + 0x274]
add dword [rax + 8], 0x6e892495
sub dword [rax + 0x3c0], 0x6f5c45d3
sub dword [rax + 0x1a0], 0x3f521574
add dword [rax + 0x338], 0x252b0ac9
sub dword [rax + 0x380], 0x4108120c
not dword [rax + 0x284]
xor dword [rax + 0x3e8], 0x62ca4801
xor dword [rax + 0x138], 0x3a771d08
not dword [rax + 0x1c8]
sub dword [rax + 0x100], 0x291c6ae3
add dword [rax + 0x1f0], 0xa116113
not dword [rax + 0x210]
sub dword [rax + 0x2ac], 0x224211d9
add dword [rax + 0x364], 0x242f4263
sub dword [rax + 0xf8], 0x796314c7
xor dword [rax + 0x3d0], 0x14e20100
not dword [rax + 0x1b4]
not dword [rax + 0x90]
not dword [rax + 0x3f0]
xor dword [rax + 0x39c], 0x2587512
not dword [rax + 0x18]
add dword [rax + 0x24], 0x3fe3443a
not dword [rax + 0x2d0]
add dword [rax + 0x104], 0x611e02a3
xor dword [rax + 0x3f8], 0x7d98409b
not dword [rax + 0x29c]
add dword [rax + 0x294], 0x3b866b18
not dword [rax + 0x2c8]
sub dword [rax + 0x390], 0x3d456b80
xor dword [rax + 0x3ac], 0xbd63a50
add dword [rax + 0x174], 0x7afb179a
sub dword [rax + 0x2dc], 0x68d64bdc
add dword [rax + 0x2a0], 0xfd92453
add dword [rax + 0x240], 0x173050cb
sub dword [rax + 0x27c], 0x77491b17
not dword [rax + 0x2b0]
xor dword [rax + 0x350], 0x1efe0753
xor dword [rax + 0x108], 0x3a53572b
add dword [rax + 0x1cc], 0x67a83f95
add dword [rax + 0x3a0], 0x147548f
add dword [rax + 0x134], 0x38a66201
not dword [rax + 0x2a8]
add dword [rax + 0x7c], 0x1c336599
sub dword [rax + 0xf0], 0x1a5f2692
xor dword [rax + 0x2e4], 0x231f3506
sub dword [rax + 0xa4], 0x2ab90ae0
sub dword [rax + 0x300], 0x504d74d4
sub dword [rax + 0x1c], 0x12054f00
xor dword [rax + 0x60], 0x34075d6c
add dword [rax + 0x194], 0x6d4634c3
not dword [rax + 0x190]
not dword [rax + 0x314]
xor dword [rax + 4], 0x1bfa30ca
sub dword [rax + 0x64], 0x584705f7
xor dword [rax + 0x10c], 0x3c8a2ed2
add dword [rax + 0x38c], 0x61972836
add dword [rax + 0xc0], 0x11544c12
not dword [rax + 0x180]
not dword [rax + 0x214]
add dword [rax + 0x1f8], 0x69e06f5c
sub dword [rax + 0xc], 0x71e850ea
sub dword [rax + 0x1d0], 0x686e166f
add dword [rax + 0x248], 0x42d45367
invalid
invalid
invalid
add dword [rax], eax
Function at 0x1400111e5
Capabilities:
Create thread

Disassembly:
jmp 0x1400156f0
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x148
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x16
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x168]
mov rax, qword [0x140030040]
xor rax, rbp
mov qword [rbp + 0x100], rax
lea rcx, [0x1400370fe]
call fcn.140011988
mov edx, 8
lea rcx, [rbp + 8]
call fcn.1400112b2
mov rdx, qword [rbp + 0x138]
lea rcx, [rbp + 8]
call fcn.1400114ce
nop
lea rax, [0x140011695]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x130]
add rax, 8
mov qword [rbp + 0xf8], rax
lea rcx, [rbp + 8]
call fcn.1400116b8
mov rcx, qword [rbp + 0xf8]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rbp + 0x28]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll__beginthreadex]
mov rcx, qword [rbp + 0x130]
mov qword [rcx], rax
mov rax, qword [rbp + 0x130]
cmp qword [rax], 0
je 0x1400157ca
lea rcx, [rbp + 8]
call fcn.1400113ed
jmp 0x1400157e3
mov rax, qword [rbp + 0x130]
mov dword [rax + 8], 0
mov ecx, 6
call fcn.14001122b
nop
lea rcx, [rbp + 8]
call fcn.1400113c5
lea rcx, [rbp - 0x30]
lea rdx, [0x14002a090]
call fcn.140011825
mov rcx, qword [rbp + 0x100]
xor rcx, rbp
call fcn.140011492
lea rsp, [rbp + 0x118]
pop rdi
pop rbp
ret

Function at 0x14001153c
Capabilities:
Enumerate processes

Disassembly:
jmp 0x14001ab30
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x428
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0xa2
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x448]
mov rax, qword [0x140030040]
xor rax, rbp
mov qword [rbp + 0x3f8], rax
lea rcx, [0x140037105]
call fcn.140011988
xor edx, edx
mov ecx, 2
call fcn.140011479
mov qword [rbp + 8], rax
mov dword [rbp + 0x30], 0x238
cmp qword [rbp + 8], 0xffffffffffffffff
jne 0x14001ab9b
xor al, al
jmp 0x14001abfa
lea rdx, [rbp + 0x30]
mov rcx, qword [rbp + 8]
call fcn.1400115ff
test eax, eax
jne 0x14001abba
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x14001abfa
mov rdx, qword [rbp + 0x420]
lea rcx, [rbp + 0x5c]
call qword [sym.imp.ucrtbased.dll__wcsicmp]
test eax, eax
jne 0x14001abdd
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x14001abfa
lea rdx, [rbp + 0x30]
mov rcx, qword [rbp + 8]
call fcn.14001188e
test eax, eax
jne 0x14001abba
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x140029080]
call fcn.140011825
mov rax, rdi
mov rcx, qword [rbp + 0x3f8]
xor rcx, rbp
call fcn.140011492
lea rsp, [rbp + 0x408]
pop rdi
pop rbp
ret

Function at 0x140011569
Capabilities:
Terminate process

Disassembly:
jmp 0x1400210c0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x1400116bd
Capabilities:
Create process on windows
Terminate process

Disassembly:
jmp 0x14001ee30
push rbp
push rdi
sub rsp, 0x5d8
lea rbp, [rsp + 0x50]
lea rdi, [rsp + 0x50]
mov ecx, 0x102
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x140030040]
xor rax, rbp
mov qword [rbp + 0x578], rax
lea rcx, [0x140037106]
call fcn.140011988
xor ecx, ecx
call fcn.14001f1c0
mov ecx, eax
call qword [sym.imp.ucrtbased.dll_srand]
lea rdx, [0x140011217]
lea rcx, [rbp + 8]
call fcn.140011415
nop
call fcn.1400115d7
movzx eax, al
test eax, eax
jne 0x14001eea5
call fcn.14001155a
movzx eax, al
test eax, eax
je 0x14001eeb0
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.1400114ba
movzx eax, al
test eax, eax
je 0x14001eec7
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
lea rax, [rbp + 0x40]
mov rdi, rax
xor eax, eax
mov ecx, 0x68
rep stosb byte [rdi], al
lea rax, [rbp + 0xc8]
mov rdi, rax
xor eax, eax
mov ecx, 0x18
rep stosb byte [rdi], al
mov dword [rbp + 0x40], 0x68
mov dword [rbp + 0x7c], 1
xor eax, eax
mov word [rbp + 0x80], ax
lea rdx, [rbp + 0x340]
lea rcx, [rbp + 0x314]
call fcn.140018dc0
mov rcx, rax
call fcn.14001114f
mov qword [rbp + 0xf8], rax
lea rax, [rbp + 0xc8]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x40]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbp + 0xf8]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x14001efa1
mov edx, 0xffffffff
mov rcx, qword [rbp + 0xc8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp + 0xc8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0xd0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14001efac
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov qword [rbp + 0x118], 0
lea rdx, [rbp + 0x3e4]
lea rcx, [rbp + 0x3c4]
call fcn.140019500
mov rcx, rax
call fcn.14001110e
mov r8, rax
lea rdx, [rbp + 0x138]
lea rcx, [rbp + 0x118]
call qword [sym.imp.ucrtbased.dll__dupenv_s]
test eax, eax
jne 0x14001f0b9
mov rdx, qword [rbp + 0x118]
lea rcx, [rbp + 0x158]
call fcn.14001142e
nop
lea rdx, [rbp + 0x428]
lea rcx, [rbp + 0x404]
call fcn.1400195d0
mov rcx, rax
call fcn.14001193d
mov rdx, rax
lea rcx, [rbp + 0x158]
call fcn.1400110b9
lea rcx, [rbp + 0x158]
call fcn.1400110d2
mov qword [rbp + 0x568], rax
lea rdx, [rbp + 0x480]
lea rcx, [rbp + 0x454]
call fcn.1400196e0
mov rcx, rax
call fcn.14001171c
mov qword [rbp + 0x570], rax
mov rdx, qword [rbp + 0x568]
mov rcx, qword [rbp + 0x570]
call fcn.14001192e
lea rcx, [rbp + 0x158]
call fcn.1400110d2
mov rcx, rax
call fcn.1400115e1
mov rcx, qword [rbp + 0x118]
call qword [sym.imp.ucrtbased.dll_free]
lea rcx, [rbp + 0x158]
call fcn.1400110d2
mov rcx, rax
call fcn.1400111cc
nop
lea rcx, [rbp + 0x158]
call fcn.1400111b3
mov dword [rbp + 0x554], 0
lea rcx, [rbp + 8]
call fcn.140011424
mov eax, dword [rbp + 0x554]
mov rdi, rax
lea rcx, [rbp - 0x50]
lea rdx, [0x1400294d0]
call fcn.140011825
mov rax, rdi
mov rcx, qword [rbp + 0x578]
xor rcx, rbp
call fcn.140011492
lea rsp, [rbp + 0x588]
pop rdi
pop rbp
ret
Function at 0x1400116d6
Capabilities:
Parse pe header

Disassembly:
jmp 0x140022410
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140022430
xor al, al
jmp 0x1400224b1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140022443
xor al, al
jmp 0x1400224b1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14002246d
xor al, al
jmp 0x1400224b1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140022481
xor al, al
jmp 0x1400224b1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140022493
xor al, al
jmp 0x1400224b1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x1400224af
xor al, al
jmp 0x1400224b1
mov al, 1
add rsp, 0x38
ret
Function at 0x140001000
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
lea rbp, [rsp - 0x4d0]
sub rsp, 0x5d0
mov rax, qword [0x140005008]
xor rax, rsp
mov qword [rbp + 0x4c0], rax
movdqa xmm0, xmmword [0x1400034e0]
lea rdx, [rbp - 0x20]
movdqa xmm1, xmmword [str.8fg_t]
lea rax, [0x140003270]
movdqu xmmword [rsp + 0x50], xmm0
mov ecx, 4
mov dword [rbp - 0x80], 0x39303d26
movdqa xmm0, xmmword [0x1400034d0]
movdqu xmmword [rsp + 0x70], xmm0
mov dword [rbp - 0x7c], 0x2d307b39
movdqu xmmword [rsp + 0x60], xmm1
mov word [rbp - 0x78], 0x5530
lea rdx, [rdx + 0x80]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
lea rax, [rax + 0x80]
movups xmmword [rdx - 0x80], xmm0
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rdx - 0x70], xmm1
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rdx - 0x60], xmm0
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rdx - 0x50], xmm1
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rdx - 0x40], xmm0
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rdx - 0x30], xmm1
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rdx - 0x20], xmm0
movups xmmword [rdx - 0x10], xmm1
sub rcx, 1
jne 0x140001070
mov rcx, qword [rax + 0x40]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rdx + 0x10], xmm1
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rdx + 0x20], xmm0
xorps xmm0, xmm0
movups xmmword [rdx + 0x30], xmm1
mov qword [rdx + 0x40], rcx
mov ecx, dword [rax + 0x48]
xor eax, eax
mov dword [rdx + 0x48], ecx
xor ecx, ecx
mov qword [rbp + 0x260], rax
mov word [rbp + 0x268], ax
movups xmmword [rbp + 0x230], xmm0
movups xmmword [rbp + 0x240], xmm0
movups xmmword [rbp + 0x250], xmm0
nop dword [rax]
movzx eax, byte [rsp + rcx + 0x50]
lea rcx, [rcx + 1]
xor al, 0x55
mov byte [rbp + rcx + 0x22f], al
jne 0x140001120
xor edx, edx
lea rcx, [rbp + 0x270]
mov r8d, 0x24c
call sub.VCRUNTIME140.dll_memset
xor ecx, ecx
nop word [rax + rax]
movzx eax, byte [rbp + rcx - 0x20]
lea rcx, [rcx + 1]
xor al, 0x55
mov byte [rbp + rcx + 0x26f], al
jne 0x140001150
xorps xmm0, xmm0
lea rdx, [rbp + 0x270]
xor eax, eax
lea rcx, [rbp + 0x230]
mov qword [rbp - 0x50], rax
xor r9d, r9d
mov qword [rbp - 0x30], rax
xor r8d, r8d
lea rax, [rbp - 0x40]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 1
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rbp - 0x80], xmm0
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x40], xmm0
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
xor eax, eax
mov rcx, qword [rbp + 0x4c0]
xor rcx, rsp
call fcn.140001240
add rsp, 0x5d0
pop rbp
ret
Function at 0x1400111f4
Capabilities:
Terminate process

Disassembly:
jmp 0x140013b30
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x14001127b
Capabilities:
Parse pe header

Disassembly:
jmp 0x140014e80
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140014ea0
xor al, al
jmp 0x140014f21
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140014eb3
xor al, al
jmp 0x140014f21
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140014edd
xor al, al
jmp 0x140014f21
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140014ef1
xor al, al
jmp 0x140014f21
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140014f03
xor al, al
jmp 0x140014f21
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140014f1f
xor al, al
jmp 0x140014f21
mov al, 1
add rsp, 0x38
ret
Function at 0x140016560
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x1400166eb
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [0x1400f2f90]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.140033d40
xorps xmm15, xmm15
mov r14, qword [0x1402b4b78]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x1400165c5
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x1400165d4
add rsp, 0x48
pop rbp
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x1400165f3
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x140016603
cmp rbx, 0x1000
jae 0x1400165cb
jmp 0x14001666d
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x140016615
xor edx, edx
jmp 0x140016664
mov rcx, qword [0x1400f2f90]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.140033d40
xorps xmm15, xmm15
mov r14, qword [0x1402b4b78]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x1400165f9
jmp 0x1400165e8
call fcn.140066aa0
xorps xmm15, xmm15
mov r14, qword [0x1402b4b78]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.140038320
lea rax, [0x140137a7d]
mov ebx, 0x18
nop dword [rax]
call fcn.140038ba0
mov rax, qword [rsp + 0x38]
call fcn.1400388e0
lea rax, [0x14013810d]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.140038ba0
mov rax, qword [rsp + 0x30]
call fcn.1400388e0
call fcn.140038560
call fcn.140038380
lea rax, [0x14013a951]
mov ebx, 0x21
call fcn.140036980
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.1400633c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.140016560
Function at 0x140016720
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x140016946
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [0x1400f2f88]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.140033dc0
xorps xmm15, xmm15
mov r14, qword [0x1402b4b78]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x140016793
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x1400167a2
add rsp, 0x50
pop rbp
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x1400167c5
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x1400167d5
cmp rbx, 0x1000
jae 0x140016799
nop
jmp 0x140016858
add rsp, 0x50
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop word [rax + rax]
cmp rbx, 0x1000
jae 0x1400167ed
xor esi, esi
jmp 0x14001684a
mov rax, qword [0x1400f2f88]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.140033dc0
xorps xmm15, xmm15
mov r14, qword [0x1402b4b78]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x1400167cb
jmp 0x1400167b6
call fcn.140066aa0
xorps xmm15, xmm15
mov r14, qword [0x1402b4b78]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x1400168e0
nop dword [rax + rax]
call fcn.140038320
lea rax, [0x140138126]
mov ebx, 0x19
call fcn.140038ba0
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
call fcn.1400388e0
lea rax, [0x14013810d]
mov ebx, 0x19
call fcn.140038ba0
mov eax, dword [rsp + 0x34]
call fcn.1400388e0
nop
call fcn.140038560
call fcn.140038380
lea rax, [0x140133c7c]
mov ebx, 0xd
call fcn.140036980
nop dword [rax + rax]
cmp eax, 0x5af
je 0x140016880
call fcn.140038320
lea rax, [0x140138126]
mov ebx, 0x19
call fcn.140038ba0
mov rax, qword [rsp + 0x38]
call fcn.1400388e0
lea rax, [0x14013810d]
mov ebx, 0x19
call fcn.140038ba0
mov eax, dword [rsp + 0x34]
nop dword [rax]
call fcn.1400388e0
call fcn.140038560
call fcn.140038380
lea rax, [0x14013a0c8]
mov ebx, 0x1f
nop dword [rax + rax]
call fcn.140036980
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.1400633c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.140016720
Function at 0x14001fd40
Capabilities:
Hash data using murmur3

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
cmp byte [0x1402b4934], 0
jne 0x14001fe27
sub rbx, qword [rax + 0x18]
mov rdx, qword [rax + 0x50]
test byte [rdx], al
mov esi, dword [rax + 0x64]
imul rbx, rsi
mov rsi, rbx
shr rbx, 0x20
shr rsi, 0x23
and ebx, 7
mov rdi, rcx
mov rcx, rbx
mov r8d, 1
shl r8d, cl
add rdx, rsi
nop
nop
nop
nop
lock or byte [rdx], r8b
mov rcx, qword [rax + 0x18]
movabs rdx, 0x800000000000
lea rax, [rdx + rcx]
mov rdx, rax
shr rdx, 0x2a
nop
nop
nop
cmp rdx, 0x40
jae 0x14001fe1a
lea rbx, [0x140286d18]
mov rdx, qword [rbx + rdx*8]
test byte [rdx], al
mov rbx, rcx
shr rbx, 0x10
and ebx, 0x3f
shr rcx, 0xd
and ecx, 7
mov esi, 1
shl esi, cl
shr rax, 0x16
and eax, 0xfffff
mov rax, qword [rdx + rax*8]
test byte [rax], al
movzx edx, byte [rax + rbx + 0x11440]
lea rax, [rax + rbx]
lea rax, [rax + 0x11440]
test sil, dl
jne 0x14001fe00
lock or byte [rax], sil
mov rax, qword [r14 + 0x30]
mov rax, qword [rax + 0xa0]
test byte [rax], al
add qword [rax + 0x1250], rdi
add rsp, 0x10
pop rbp
ret
mov rax, rdx
mov ecx, 0x40
call fcn.140065680
lea rax, [0x14013cb7d]
mov ebx, 0x2c
call fcn.140036980
nop
int3

Function at 0x140022100
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x140022206
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x70], rcx
mov byte [rsp + 0x17], dil
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x18], 0
jmp 0x140022143
mov rax, qword [rsp + 0x60]
mov rcx, rdx
mov rbx, qword [rsp + 0x68]
movzx edi, byte [rsp + 0x17]
cmp qword [rsp + 0x18], rbx
jae 0x1400221fb
test byte [rax], al
lea rcx, [rax + 0x100b8]
mov ebx, edi
mov rax, rcx
nop dword [rax]
call fcn.140022f00
test rax, rax
je 0x1400221fb
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x30], xmm15
movups xmmword [rsp + 0x40], xmm15
lea rcx, [0x140022240]
mov qword [rsp + 0x20], rcx
lea rdx, [rsp + 0x18]
mov qword [rsp + 0x28], rdx
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x48], rax
lea rbx, [rsp + 0x20]
mov qword [rsp], rbx
nop dword [rax]
call fcn.140063280
xorps xmm15, xmm15
mov r14, qword [0x1402b4b78]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x70]
nop dword [rax]
test rdx, rdx
jne 0x1400221e9
xor eax, eax
jmp 0x1400221f3
mov rax, qword [rdx]
call rax
mov rdx, qword [rsp + 0x70]
test al, al
je 0x140022131
mov rax, qword [rsp + 0x18]
add rsp, 0x50
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov byte [rsp + 0x20], dil
call fcn.1400633c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movzx edi, byte [rsp + 0x20]
jmp fcn.140022100
Function at 0x14002ea00
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x14002eb10
push rbp
mov rbp, rsp
sub rsp, 0x58
mov qword [rsp + 0x68], rax
mov byte [rsp + 0x80], dil
nop
test dil, dil
je 0x14002ea55
mov qword [rsp + 0x78], rcx
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rbx
mov eax, 6
call fcn.14003b760
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
movzx edi, byte [rsp + 0x80]
mov qword [rsp + 8], 0
nop
test rbx, rbx
jne 0x14002ea6d
test dil, dil
jmp 0x14002eafb
lea rdx, [rsp + 0x68]
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rsi, [0x14002eb60]
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x28], rcx
mov rax, r14
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rdx
mov byte [rsp + 0x48], dil
lea rax, [rsp + 8]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.140063280
xorps xmm15, xmm15
mov r14, qword [0x1402b4b78]
mov r14, qword gs:[r14]
mov r14, qword [r14]
movzx eax, byte [rsp + 0x80]
test al, al
je 0x14002eb05
nop dword [rax]
call fcn.14003b8e0
mov rax, qword [rsp + 8]
add rsp, 0x58
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov byte [rsp + 0x20], dil
call fcn.1400633c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movzx edi, byte [rsp + 0x20]
nop dword [rax]
jmp fcn.14002ea00