joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400016a0
Capabilities:
Encode data using xor
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov rcx, qword [0x140066be0]
mov r15, rdx
cmp rcx, 0xffffffffffffffff
je 0x1400018b3
mov edx, 8
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
test rax, rax
je 0x1400018b3
mov rcx, qword [0x140066be0]
cmp rcx, 0xffffffffffffffff
je 0x1400018b3
mov edx, 8
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
je 0x1400018b3
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call fcn.140009ce0
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call fcn.140009ce0
mov r8, rsi
call fcn.140001550
xor edi, edi
lea rcx, str.LOG:C:UsersPubliclllllog
mov dword [rsp + 0x28], edi
xor r9d, r9d
mov edx, 0xc0010000
mov dword [rsp + 0x20], 4
mov ebp, eax
lea r8d, [rdi + 3]
call qword [sym.imp.clfsw32.dll_CreateLogFile]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x1400018b3
mov r8, rbx
call fcn.140001550
mov ecx, eax
mov edx, eax
sub ecx, ebp
cmp ecx, 1
je 0x1400017ef
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call fcn.140009ce0
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call fcn.140009ce0
mov r8, rsi
call fcn.140001550
xor r9d, r9d
mov dword [rsp + 0x28], edi
mov edx, 0xc0010000
mov dword [rsp + 0x20], 4
lea rcx, str.LOG:C:UsersPubliclllllog
mov ebp, eax
lea r8d, [r9 + 3]
call qword [sym.imp.clfsw32.dll_CreateLogFile]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x1400018b3
jmp 0x140001775
mov r8d, edi
test edx, edx
je 0x140001894
cmp edx, 4
jb 0x14000186b
and eax, 3
mov ecx, edx
sub ecx, eax
xorps xmm3, xmm3
sub rbx, rsi
lea rax, [rsi + 0x10]
xorps xmm2, xmm2
nop dword [rax]
nop word [rax + rax]
movdqu xmm0, xmmword [rax - 0x10]
add r8d, 4
movdqu xmm1, xmmword [rbx + rax - 0x10]
lea rax, [rax + 0x20]
pxor xmm1, xmm0
pxor xmm3, xmm1
movdqu xmm1, xmmword [rbx + rax - 0x20]
movdqu xmm0, xmmword [rax - 0x20]
pxor xmm1, xmm0
pxor xmm2, xmm1
cmp r8d, ecx
jb 0x140001820
pxor xmm2, xmm3
movdqa xmm0, xmm2
psrldq xmm0, 8
pxor xmm2, xmm0
movq rdi, xmm2
jmp 0x14000186e
sub rbx, rsi
cmp r8d, edx
jae 0x140001894
movsxd rax, r8d
sub edx, r8d
lea rcx, [rsi + rax*8]
mov eax, edx
nop
mov rdx, qword [rbx + rcx]
xor rdx, qword [rcx]
lea rcx, [rcx + 8]
xor rdi, rdx
sub rax, 1
jne 0x140001880
mov rbx, qword [rsp + 0x50]
mov rax, rdi
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov qword [r15], r14
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
mov ecx, 1
call fcn.14000a970
int3
Function at 0x140002ac0
Capabilities:
Accept command line arguments
Delete file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rax, qword [0x140066008]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rbx, rdx
mov edi, ecx
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rsp + 0x20]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
cmp edi, 1
jne 0x140002b13
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [0x140078508], eax
lea rax, [0x14006270c]
mov qword [0x140078510], rax
jmp 0x140002b6e
jle 0x140002b6e
mov rax, qword [rbx + 8]
cmp byte [rax], 0x2d
jne 0x140002b6e
cmp byte [rax + 1], 0x63
jne 0x140002b43
cmp byte [rax + 2], 0
jne 0x140002b43
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [0x140078508], eax
mov rax, qword [rbx + 0x10]
mov qword [0x140078510], rax
jmp 0x140002b6e
cmp byte [rax], 0x2d
jne 0x140002b6e
cmp byte [rax + 1], 0x70
jne 0x140002b6e
cmp byte [rax + 2], 0
jne 0x140002b6e
mov rcx, qword [rbx + 0x10]
call fcn.14001de70
mov dword [0x140078508], eax
mov qword [0x140078510], 0
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea rcx, str.C:UsersPublicMyLog.blf
mov qword [0x140066be0], rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, str.C:UsersPubliclllllog.blf
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, str.C:UsersPubliccontain1
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
call fcn.1400018c0
xor ecx, ecx
call fcn.14001d7a0
mov rcx, rax
call fcn.14001caa0
call fcn.1400020f0
xor eax, eax
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140002bf0
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x1400060c0
Capabilities:
Get thread local storage value

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.140005ba0
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1400060ff
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x14004e350]
jmp 0x140006109
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add rsp, 0x48
ret
Function at 0x1400322e0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
add rsp, 0x28
ret
Function at 0x1400354d0
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0xb8
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140004d10
lea rcx, [rsp + 0x40]
call fcn.140035490
movzx eax, al
test eax, eax
jne 0x140035518
mov qword [rsp + 0x70], 0
lea rcx, [rsp + 0x40]
call fcn.1400353c0
mov rax, qword [rsp + 0x70]
jmp 0x1400356e9
lea rcx, [rsp + 0x40]
call fcn.140004da0
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
call fcn.140035440
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x78]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x40]
call fcn.140004da0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, dword [rsp + 0x68]
mov r8, rax
xor edx, edx
xor ecx, ecx
call fcn.140035290
cdqe
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
jne 0x1400355be
mov qword [rsp + 0x80], 0
lea rcx, [rsp + 0x40]
call fcn.1400353c0
mov rax, qword [rsp + 0x80]
jmp 0x1400356e9
mov r9d, 0x66
lea r8, str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
mov edx, 2
mov rcx, qword [rsp + 0x58]
call fcn.140023c30
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.140004d10
lea rcx, [rsp + 0x48]
call fcn.140004d50
movzx eax, al
test eax, eax
jne 0x140035625
mov qword [rsp + 0x88], 0
lea rcx, [rsp + 0x48]
call fcn.140005150
lea rcx, [rsp + 0x40]
call fcn.1400353c0
mov rax, qword [rsp + 0x88]
jmp 0x1400356e9
lea rcx, [rsp + 0x48]
call fcn.140004da0
mov qword [rsp + 0x90], rax
lea rcx, [rsp + 0x40]
call fcn.140004da0
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x68]
mov r8, qword [rsp + 0x98]
xor edx, edx
xor ecx, ecx
call fcn.140035290
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jne 0x1400356bb
mov qword [rsp + 0xa0], 0
lea rcx, [rsp + 0x48]
call fcn.140005150
lea rcx, [rsp + 0x40]
call fcn.1400353c0
mov rax, qword [rsp + 0xa0]
jmp 0x1400356e9
lea rcx, [rsp + 0x48]
call fcn.140004d70
mov qword [rsp + 0xa8], rax
lea rcx, [rsp + 0x48]
call fcn.140005150
lea rcx, [rsp + 0x40]
call fcn.1400353c0
mov rax, qword [rsp + 0xa8]
add rsp, 0xb8
ret
Function at 0x14003b890
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x1498
call fcn.14004c600
sub rsp, rax
mov rax, qword [0x140066008]
xor rax, rsp
mov qword [rsp + 0x1480], rax
mov eax, dword [rsp + 0x14b8]
sar eax, 6
cdqe
lea rcx, [0x140068040]
mov edx, dword [rsp + 0x14b8]
and edx, 0x3f
movsxd rdx, edx
imul rdx, rdx, 0x48
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + rdx + 0x28]
mov qword [rsp + 0x60], rax
mov eax, dword [rsp + 0x14c8]
mov rcx, qword [rsp + 0x14c0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x68]
mov rdi, rax
xor eax, eax
mov ecx, 0xc
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x14c0]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x50]
cmp qword [rsp + 0x48], rax
jae 0x14003ba82
lea rax, [rsp + 0x147f]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x38], rax
jae 0x14003b9d6
mov rax, qword [rsp + 0x50]
cmp qword [rsp + 0x48], rax
jae 0x14003b9d6
mov rax, qword [rsp + 0x48]
movzx eax, byte [rax]
mov byte [rsp + 0x31], al
mov rax, qword [rsp + 0x48]
inc rax
mov qword [rsp + 0x48], rax
movzx eax, byte [rsp + 0x31]
mov byte [rsp + 0x30], al
movsx eax, byte [rsp + 0x30]
cmp eax, 0xa
jne 0x14003b9bb
mov eax, dword [rsp + 0x70]
inc eax
mov dword [rsp + 0x70], eax
mov rax, qword [rsp + 0x38]
mov byte [rax], 0xd
mov rax, qword [rsp + 0x38]
inc rax
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movzx ecx, byte [rsp + 0x30]
mov byte [rax], cl
mov rax, qword [rsp + 0x38]
inc rax
mov qword [rsp + 0x38], rax
jmp 0x14003b958
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
sub rcx, rax
mov rax, rcx
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
mov r8d, dword [rsp + 0x40]
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x14003ba42
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x68], eax
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x14003baa1
mov eax, dword [rsp + 0x44]
mov ecx, dword [rsp + 0x6c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x6c], eax
mov eax, dword [rsp + 0x40]
cmp dword [rsp + 0x44], eax
jae 0x14003ba7d
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x14003baa1
jmp 0x14003b92e
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
mov rcx, qword [rsp + 0x1480]
xor rcx, rsp
call fcn.140002bf0
add rsp, 0x1498
pop rdi
pop rsi
ret
Function at 0x14003bac0
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x1498
call fcn.14004c600
sub rsp, rax
mov rax, qword [0x140066008]
xor rax, rsp
mov qword [rsp + 0x1480], rax
mov eax, dword [rsp + 0x14b8]
sar eax, 6
cdqe
lea rcx, [0x140068040]
mov edx, dword [rsp + 0x14b8]
and edx, 0x3f
movsxd rdx, edx
imul rdx, rdx, 0x48
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + rdx + 0x28]
mov qword [rsp + 0x68], rax
mov eax, dword [rsp + 0x14c8]
mov rcx, qword [rsp + 0x14c0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x70]
mov rdi, rax
xor eax, eax
mov ecx, 0xc
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x14c0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x50], rax
jae 0x14003bccd
lea rax, [rsp + 0x147e]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x60]
cmp qword [rsp + 0x38], rax
jae 0x14003bc19
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x50], rax
jae 0x14003bc19
mov rax, qword [rsp + 0x50]
movzx eax, word [rax]
mov word [rsp + 0x40], ax
mov rax, qword [rsp + 0x50]
add rax, 2
mov qword [rsp + 0x50], rax
movzx eax, word [rsp + 0x40]
mov word [rsp + 0x30], ax
movzx eax, word [rsp + 0x30]
cmp eax, 0xa
jne 0x14003bbf9
mov eax, dword [rsp + 0x78]
add eax, 2
mov dword [rsp + 0x78], eax
mov eax, 0xd
mov rcx, qword [rsp + 0x38]
mov word [rcx], ax
mov rax, qword [rsp + 0x38]
add rax, 2
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movzx ecx, word [rsp + 0x30]
mov word [rax], cx
mov rax, qword [rsp + 0x38]
add rax, 2
mov qword [rsp + 0x38], rax
jmp 0x14003bb88
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov eax, eax
shl rax, 1
mov dword [rsp + 0x44], eax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x48]
mov r8d, dword [rsp + 0x44]
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x14003bc8d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x70], eax
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x14003bcec
mov eax, dword [rsp + 0x48]
mov ecx, dword [rsp + 0x74]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x74], eax
mov eax, dword [rsp + 0x44]
cmp dword [rsp + 0x48], eax
jae 0x14003bcc8
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x14003bcec
jmp 0x14003bb5e
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
mov rcx, qword [rsp + 0x1480]
xor rcx, rsp
call fcn.140002bf0
add rsp, 0x1498
pop rdi
pop rsi
ret
Function at 0x1400420a0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x128
lea rcx, [rsp + 0xe8]
call fcn.140030680
lea rcx, [rsp + 0xb8]
call fcn.140030680
lea rcx, [rsp + 0x88]
call fcn.140030680
call fcn.140030760
mov r8d, eax
lea rdx, [rsp + 0xe8]
mov rcx, qword [rsp + 0x130]
call fcn.140030630
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
je 0x140042142
mov dword [rsp + 0x54], 0
lea rcx, [rsp + 0x88]
call fcn.1400306e0
lea rcx, [rsp + 0xb8]
call fcn.1400306e0
lea rcx, [rsp + 0xe8]
call fcn.1400306e0
mov eax, dword [rsp + 0x54]
jmp 0x1400422e8
call fcn.140030760
mov r8d, eax
lea rdx, [rsp + 0xb8]
mov rcx, qword [rsp + 0x138]
call fcn.140030630
mov dword [rsp + 0x58], eax
cmp dword [rsp + 0x58], 0
je 0x1400421a2
mov dword [rsp + 0x5c], 0
lea rcx, [rsp + 0x88]
call fcn.1400306e0
lea rcx, [rsp + 0xb8]
call fcn.1400306e0
lea rcx, [rsp + 0xe8]
call fcn.1400306e0
mov eax, dword [rsp + 0x5c]
jmp 0x1400422e8
mov qword [rsp + 0x70], 0
cmp qword [rsp + 0x168], 0
je 0x140042228
call fcn.140030760
mov r8d, eax
lea rdx, [rsp + 0x88]
mov rcx, qword [rsp + 0x168]
call fcn.140030630
mov dword [rsp + 0x60], eax
cmp dword [rsp + 0x60], 0
je 0x140042216
mov dword [rsp + 0x64], 0
lea rcx, [rsp + 0x88]
call fcn.1400306e0
lea rcx, [rsp + 0xb8]
call fcn.1400306e0
lea rcx, [rsp + 0xe8]
call fcn.1400306e0
mov eax, dword [rsp + 0x64]
jmp 0x1400422e8
lea rcx, [rsp + 0x88]
call fcn.140030950
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0xb8]
call fcn.140030950
mov qword [rsp + 0x78], rax
lea rcx, [rsp + 0xe8]
call fcn.140030950
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x178]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x170]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x160]
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0x158]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x150]
mov dword [rsp + 0x20], eax
mov r9, qword [rsp + 0x148]
mov r8, qword [rsp + 0x140]
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [rsp + 0x68], eax
lea rcx, [rsp + 0x88]
call fcn.1400306e0
lea rcx, [rsp + 0xb8]
call fcn.1400306e0
lea rcx, [rsp + 0xe8]
call fcn.1400306e0
mov eax, dword [rsp + 0x68]
add rsp, 0x128
ret
Function at 0x140044a10
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xb8
lea rcx, [rsp + 0x78]
call fcn.140030680
lea rcx, [rsp + 0x48]
call fcn.140030680
call fcn.140030760
mov r8d, eax
lea rdx, [rsp + 0x78]
mov rcx, qword [rsp + 0xc0]
call fcn.140030630
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x140044a7f
mov dword [rsp + 0x24], 0
lea rcx, [rsp + 0x48]
call fcn.1400306e0
lea rcx, [rsp + 0x78]
call fcn.1400306e0
mov eax, dword [rsp + 0x24]
jmp 0x140044b10
call fcn.140030760
mov r8d, eax
lea rdx, [rsp + 0x48]
mov rcx, qword [rsp + 0xc8]
call fcn.140030630
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0
je 0x140044ac6
mov dword [rsp + 0x2c], 0
lea rcx, [rsp + 0x48]
call fcn.1400306e0
lea rcx, [rsp + 0x78]
call fcn.1400306e0
mov eax, dword [rsp + 0x2c]
jmp 0x140044b10
lea rcx, [rsp + 0x48]
call fcn.140030950
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x78]
call fcn.140030950
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov dword [rsp + 0x30], eax
lea rcx, [rsp + 0x48]
call fcn.1400306e0
lea rcx, [rsp + 0x78]
call fcn.1400306e0
mov eax, dword [rsp + 0x30]
add rsp, 0xb8
ret
Function at 0x4143e0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x414559
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.0042e740
xorps xmm15, xmm15
mov r14, qword [0x005f9418]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x414450
mov rbx, qword [rsp + 0x60]
jmp 0x414460
add rsp, 0x48
pop rbp
ret
sub rax, rbx
add rcx, rbx
mov rbx, rax
nop
test rbx, rbx
jbe 0x414485
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rcx
mov rax, rbx
jmp 0x414495
cmp rbx, 0x1000
jae 0x414456
nop dword [rax]
jmp 0x414509
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
cmp rbx, 0x1000
jae 0x4144a2
xor edx, edx
jmp 0x414500
mov qword [rsp + 0x30], rbx
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.0042e740
xorps xmm15, xmm15
mov r14, qword [0x005f9418]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
mov edx, eax
mov rax, qword [rsp + 0x38]
nop
test dl, dl
jne 0x41448b
jmp 0x414474
call fcn.00459740
xorps xmm15, xmm15
mov r14, qword [0x005f9418]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
cmp eax, 8
jne 0x414540
lea rax, [0x004e99b7]
mov ebx, 0xd
call fcn.00430f00
nop dword [rax]
cmp eax, 0x5af
je 0x414528
lea rax, [0x004ee36b]
mov ebx, 0x1f
call fcn.00430f00
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00456060
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004143e0
Function at 0x41c580
Capabilities:
Hash data using murmur3

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41c79a
push rbp
mov rbp, rsp
sub rsp, 0x30
test rax, 7
jne 0x41c788
mov qword [rsp + 0x40], rax
mov rdx, qword [rdi + 0x50]
test byte [rdx], al
mov r9, r8
shr r9, 3
mov r10, r8
and r10d, 7
nop
mov r11, rcx
mov rcx, r10
mov r12d, 1
shl r12d, cl
lea r10, [rdx + r9]
cmp byte [0x005f9213], 0
jne 0x41c6c1
cmp dword [0x005f9750], 0
nop
jle 0x41c609
cmp qword [rdi + 0xa0], r8
ja 0x41c609
mov r8, qword [rdi + 0x48]
test byte [r8], al
movzx r8d, byte [r9 + r8]
nop
nop dword [rax + rax]
test r12b, r8b
je 0x41c738
movzx edx, byte [r9 + rdx]
test r12b, dl
jne 0x41c6bb
nop
lock or byte [r10], r12b
mov rcx, qword [rdi + 0x18]
movabs rdx, 0x800000000000
add rdx, rcx
mov r8, rdx
shr rdx, 0x2a
nop
nop
nop
nop word [rax + rax]
cmp rdx, 0x40
jae 0x41c72b
lea r9, [0x005cb5f8]
mov rdx, qword [r9 + rdx*8]
test byte [rdx], al
mov r9, rcx
shr r9, 0x10
and r9d, 0x3f
shr rcx, 0xd
and ecx, 7
mov r10d, 1
shl r10d, cl
shr r8, 0x16
and r8d, 0xfffff
mov rdx, qword [rdx + r8*8]
test byte [rdx], al
movzx r8d, byte [rdx + r9 + 0x11440]
lea rdx, [rdx + r9]
lea rdx, [rdx + 0x11440]
test r10b, r8b
jne 0x41c6a0
lock or byte [rdx], r10b
movzx edx, byte [rdi + 0x6a]
test dl, 1
je 0x41c6e2
mov rax, qword [rsi + 0x10]
add rax, qword [rdi + 0x70]
mov qword [rsi + 0x10], rax
add rsp, 0x30
pop rbp
ret
add rsp, 0x30
pop rbp
ret
mov qword [rsp + 0x60], rsi
mov rcx, r11
mov rdi, r10
mov esi, r12d
call fcn.00414000
test al, al
jne 0x41c718
mov rax, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x60]
prefetcht0 byte [rax]
mov rdx, qword [rsi]
test rdx, rdx
je 0x41c707
mov rdi, qword [rdx + 0x10]
cmp rdi, 0xfd
je 0x41c707
jae 0x41c71e
mov qword [rdx + rdi*8 + 0x18], rax
inc qword [rdx + 0x10]
jmp 0x41c712
mov rbx, rax
mov rax, rsi
call fcn.00421b60
add rsp, 0x30
pop rbp
ret
add rsp, 0x30
pop rbp
ret
mov rax, rdi
mov ecx, 0xfd
call fcn.004582e0
mov rax, rdx
mov ecx, 0x40
call fcn.00458300
lea rax, [0x004e8752]
mov rcx, rbx
mov rdi, r11
mov ebx, 4
call fcn.0041c800
lea rax, [0x004e860f]
mov ebx, 3
mov rcx, qword [rsp + 0x40]
mov rdi, 0xffffffffffffffff
call fcn.0041c800
mov rdx, qword [r14 + 0x30]
mov byte [rdx + 0xf9], 2
lea rax, [0x004eae4e]
mov ebx, 0x13
call fcn.00430f00
lea rax, [0x004ef03c]
mov ebx, 0x23
call fcn.00430f00
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
call fcn.00456060
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
nop dword [rax + rax]
jmp fcn.0041c580
Function at 0x41c900
Capabilities:
Hash data using murmur3

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
cmp byte [0x005f9213], 0
jne 0x41c9e7
sub rbx, qword [rax + 0x18]
mov rdx, qword [rax + 0x50]
test byte [rdx], al
mov esi, dword [rax + 0x64]
imul rbx, rsi
mov rsi, rbx
shr rbx, 0x20
shr rsi, 0x23
and ebx, 7
mov rdi, rcx
mov rcx, rbx
mov r8d, 1
shl r8d, cl
add rdx, rsi
nop
nop
nop
nop
lock or byte [rdx], r8b
mov rcx, qword [rax + 0x18]
movabs rdx, 0x800000000000
lea rax, [rdx + rcx]
mov rdx, rax
shr rdx, 0x2a
nop
nop
nop
cmp rdx, 0x40
jae 0x41c9da
lea rbx, [0x005cb5f8]
mov rdx, qword [rbx + rdx*8]
test byte [rdx], al
mov rbx, rcx
shr rbx, 0x10
and ebx, 0x3f
shr rcx, 0xd
and ecx, 7
mov esi, 1
shl esi, cl
shr rax, 0x16
and eax, 0xfffff
mov rax, qword [rdx + rax*8]
test byte [rax], al
movzx edx, byte [rax + rbx + 0x11440]
lea rax, [rax + rbx]
lea rax, [rax + 0x11440]
test sil, dl
jne 0x41c9c0
lock or byte [rax], sil
mov rax, qword [r14 + 0x30]
mov rax, qword [rax + 0xa0]
test byte [rax], al
add qword [rax + 0x1250], rdi
add rsp, 0x10
pop rbp
ret
mov rax, rdx
mov ecx, 0x40
call fcn.00458300
lea rax, [0x004f074d]
mov ebx, 0x2c
call fcn.00430f00
nop
int3

Function at 0x41e7c0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41e8c6
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x70], rcx
mov byte [rsp + 0x17], dil
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x18], 0
jmp 0x41e803
mov rax, qword [rsp + 0x60]
mov rcx, rdx
mov rbx, qword [rsp + 0x68]
movzx edi, byte [rsp + 0x17]
cmp qword [rsp + 0x18], rbx
jae 0x41e8bb
test byte [rax], al
lea rcx, [rax + 0x100b8]
mov ebx, edi
mov rax, rcx
nop dword [rax]
call fcn.0041f380
test rax, rax
je 0x41e8bb
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x30], xmm15
movups xmmword [rsp + 0x40], xmm15
lea rcx, [0x0041e900]
mov qword [rsp + 0x20], rcx
lea rdx, [rsp + 0x18]
mov qword [rsp + 0x28], rdx
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x48], rax
lea rbx, [rsp + 0x20]
mov qword [rsp], rbx
nop dword [rax]
call fcn.00455f20
xorps xmm15, xmm15
mov r14, qword [0x005f9418]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x70]
nop dword [rax]
test rdx, rdx
jne 0x41e8a9
xor eax, eax
jmp 0x41e8b3
mov rax, qword [rdx]
call rax
mov rdx, qword [rsp + 0x70]
test al, al
je 0x41e7f1
mov rax, qword [rsp + 0x18]
add rsp, 0x50
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov byte [rsp + 0x20], dil
call fcn.00456060
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movzx edi, byte [rsp + 0x20]
jmp fcn.0041e7c0