joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14029ecc0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, reloc.WLDAP32.dll_Ordinal_200
call fcn.140130e70
sub rsp, rax
mov rax, qword [0x1403f80a0]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov r12, qword [rsp + 0x130]
xor r14d, r14d
mov rax, qword [rcx]
mov rbp, r9
movsxd rdi, r8d
mov rsi, rdx
mov rbx, rcx
mov r15d, r14d
lea r13d, [r14 + 1]
test r9, r9
je 0x14029ed29
cmp r9, rax
je 0x14029ed21
test rdx, rdx
je 0x14029ed9a
test r8d, r8d
js 0x14029ed9a
mov r15d, r13d
mov qword [rcx], r9
jmp 0x14029ed31
test rax, rax
je 0x14029ed9a
mov rbp, rax
mov rcx, rbp
call fcn.140109e00
test al, 2
jne 0x14029ed9a
test rsi, rsi
je 0x14029ee02
mov rcx, rbp
mov r15d, r13d
call fcn.1400e5cc0
cmp eax, 0x90
jg 0x14029ed9a
cmp eax, edi
jge 0x14029edc0
mov rcx, qword [rbx + 8]
mov r8, r12
mov rdx, rbp
call fcn.1401df950
test eax, eax
je 0x14029ed9a
mov rcx, qword [rbx + 8]
mov r8, rdi
mov rdx, rsi
call fcn.1401dfba0
test eax, eax
je 0x14029ed9a
mov rcx, qword [rbx + 8]
lea rsi, [rbx + 0x20]
mov r8, rsi
lea rdx, [rbx + 0x24]
call fcn.1401df870
test eax, eax
jne 0x14029eddd
xor eax, eax
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.1401304f0
add rsp, 0xc8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
cmp edi, 0x90
ja 0x14029ed9a
mov r8, rdi
lea rcx, [rbx + 0x24]
mov rdx, rsi
call fcn.1401329d0
lea rsi, [rbx + 0x20]
mov dword [rsi], edi
mov ecx, dword [rsi]
cmp ecx, 0x90
je 0x14029ee0b
mov eax, ecx
mov r8d, 0x90
sub r8d, ecx
xor edx, edx
lea rcx, [rbx + 0x24]
add rcx, rax
call fcn.140133080
jmp 0x14029ee0b
test r15d, r15d
je 0x14029eee6
lea rcx, [rsp + 0x20]
mov rax, rbx
sub rax, rcx
mov rdx, r14
lea rdi, [rax + 0x24]
lea rsi, [rax + 0x25]
nop dword [rax]
nop word [rax + rax]
lea rcx, [rsp + 0x20]
add rcx, rdx
add rdx, 2
movzx eax, byte [rdi + rcx]
xor al, 0x36
mov byte [rcx], al
movzx eax, byte [rsi + rcx]
xor al, 0x36
mov byte [rcx + 1], al
cmp rdx, 0x90
jl 0x14029ee30
mov rcx, qword [rbx + 0x10]
mov r8, r12
mov rdx, rbp
call fcn.1401df950
test eax, eax
je 0x14029eef9
mov rcx, rbp
call fcn.1400e5cc0
mov rcx, qword [rbx + 0x10]
lea rdx, [rsp + 0x20]
movsxd r8, eax
call fcn.1401dfba0
test eax, eax
je 0x14029eef9
mov rdx, r14
nop dword [rax]
lea rcx, [rsp + 0x20]
add rcx, rdx
add rdx, 2
movzx eax, byte [rdi + rcx]
xor al, 0x5c
mov byte [rcx], al
movzx eax, byte [rsi + rcx]
xor al, 0x5c
mov byte [rcx + 1], al
cmp rdx, 0x90
jl 0x14029ee90
mov rcx, qword [rbx + 0x18]
mov r8, r12
mov rdx, rbp
call fcn.1401df950
test eax, eax
je 0x14029eef9
mov rcx, rbp
call fcn.1400e5cc0
mov rcx, qword [rbx + 0x18]
lea rdx, [rsp + 0x20]
movsxd r8, eax
call fcn.1401dfba0
test eax, eax
je 0x14029eef9
mov rdx, qword [rbx + 0x10]
mov rcx, qword [rbx + 8]
call fcn.1401dfc10
test eax, eax
cmovne r14d, r13d
test r15d, r15d
je 0x14029ef0d
mov edx, 0x90
lea rcx, [rsp + 0x20]
call fcn.140001240
mov eax, r14d
jmp 0x14029ed9c
Function at 0x140b0aee0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x140b0aeed
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x140b0aefd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x140b0aee5
lea eax, [rcx + 1]
jmp 0x140b0af0b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x140b0af1e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x140b0af04
sub eax, 3
jb 0x140b0af3e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x140b0af8d
sar eax, 1
movsxd rbp, eax
jb 0x140b0af74
jmp 0x140b0af4c
add ebx, ebx
jne 0x140b0af4a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140b0af74
inc ecx
add ebx, ebx
jne 0x140b0af5a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140b0af74
call r11
adc ecx, ecx
add ebx, ebx
jne 0x140b0af6d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x140b0af5c
add ecx, 2
jmp 0x140b0af79
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.140b0aea2
jmp 0x140b0aeed
pop rsi
pop rdi
pop rax
mov dword [rdi], eax
sub rsp, 0x28
lea rdi, [rsi + 0xb02000]
mov eax, dword [rdi]
or eax, eax
je 0x140b0afed
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0xb10cec]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x140b0af9d
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x140b0afe7
mov qword [rbx], rax
add rbx, 8
jmp 0x140b0afbd
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x140b0b031
cmp al, 0xef
ja 0x140b0b019
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x140b0aff9
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0x140b0b008
mov eax, dword [rdi]
add rdi, 4
jmp 0x140b0b008
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
mov byte [fcn.140b0b0b0], 0xfc
lea rcx, [rsi - 0x1000]
push 1
pop rdx
xor r8, r8
push rax
call fcn.140b0b0b0
pop rax
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x140b0b0a0
sub rsp, 0xffffffffffffff80
jmp 0x1400014d0
Function at 0x140003ee0
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x40
mov qword [rsp + 0x58], rdx
mov rbx, r8
xor edx, edx
test rcx, rcx
je 0x140003f14
cmp word [rcx], 0x5a4d
jne 0x140003f14
movsxd rax, dword [rcx + 0x3c]
cmp eax, 0x400
jg 0x140003f14
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140003f14
mov edx, dword [rcx + 0x28]
add rdx, qword [rsp + 0x58]
mov rcx, rbx
call fcn.140003e20
test eax, eax
jne 0x140003f30
xor eax, eax
add rsp, 0x40
pop rbx
ret
mov rcx, rbx
call fcn.140003e90
test rax, rax
je 0x140003f25
lea rdx, [rax + 0x10]
lea rax, [rsp + 0x38]
mov rcx, qword [rbx]
mov r9d, 8
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x58]
mov qword [rsp + 0x38], 0
call fcn.1400046dc
not eax
shr eax, 0x1f
add rsp, 0x40
pop rbx
ret

Function at 0x1400045e0
Capabilities:
Execute syscall

Disassembly:
pop rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov rcx, r10
call fcn.140004580
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x140005190
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x1400051b3
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
jne 0x1400051b3
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret

Function at 0x140005261
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r9, qword [0x14055e4b0]
mov r8, rcx
mov rcx, r9
call fcn.140005190
test eax, eax
je 0x14000528d
mov rdx, r8
mov rcx, r9
sub rdx, r9
add rsp, 0x28
jmp fcn.1400051b4
xor eax, eax
add rsp, 0x28
ret
Function at 0x14000f3d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov ebx, ecx
mov r14, r8
xor ecx, ecx
mov qword [r8], 0
mov rdi, rdx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
movzx edx, bx
mov r8, rdi
mov rcx, rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
je 0x14000f4e1
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rdx, rbx
mov rcx, rsi
mov ebp, eax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rdi, rax
test rax, rax
je 0x14000f4e1
mov edx, ebp
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rcx, rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov r8d, ebp
mov rdx, rdi
mov rcx, rax
call fcn.140062260
lea r8, [rsp + 0x58]
mov edx, 1
mov rcx, rsi
call qword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
mov rbp, qword [rsp + 0x58]
mov ecx, 0x18
call qword [sym.imp.gdiplus.dll_GdipAlloc]
mov rbx, rax
test rax, rax
je 0x14000f4bb
lea rax, vtable.Gdiplus::Bitmap.0
mov qword [rsp + 0x50], 0
lea rdx, [rsp + 0x50]
mov qword [rbx], rax
mov rcx, rbp
call qword [sym.imp.gdiplus.dll_GdipCreateBitmapFromStream]
mov rcx, qword [rsp + 0x50]
mov qword [rbx + 8], rcx
mov dword [rbx + 0x10], eax
jmp 0x14000f4bd
xor ebx, ebx
mov rcx, rsi
mov qword [r14], rbx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov al, 1
jmp 0x14000f4e3
xor al, al
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x14000f980
Capabilities:
Get common file path
Get startup folder

Disassembly:
push rdi
sub rsp, 0x270
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x288], rbx
mov rax, qword [0x1400ba080]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rbx, rcx
mov qword [rsp + 0x40], rcx
xor edi, edi
mov dword [rsp + 0x30], edi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [rdi + 5]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], 7
mov word [rbx], di
lea rax, [rsp + 0x50]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], di
jne 0x14000f9f0
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.140002490
mov dword [rsp + 0x30], 1
mov r8d, 0xd
lea rdx, str.FLiNGTrainer
mov rcx, rbx
call fcn.140001450
mov rax, rbx
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140043d60
mov rbx, qword [rsp + 0x288]
add rsp, 0x270
pop rdi
ret
Function at 0x14001f5a0
Capabilities:
Resume thread

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x90
mov qword [r11 - 0x58], 0xfffffffffffffffe
mov qword [r11 + 0x20], rbx
mov rax, qword [0x1400ba080]
xor rax, rsp
mov qword [rsp + 0x88], rax
xor edi, edi
mov qword [r11 - 0x68], rdi
mov dword [rsp + 0x28], 4
mov qword [r11 - 0x78], r8
mov r9, rdx
xor r8d, r8d
xor edx, edx
mov rcx, qword [rcx + 0x80]
call qword [0x1400bf6f8]
mov rbx, rax
test rax, rax
jne 0x14001f722
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rsp + 0x68]
call fcn.1400093d0
nop
lea r8, [0x1400bfae0]
cmp qword [0x1400bfaf8], 8
cmovae r8, qword [0x1400bfae0]
mov r9, qword [0x1400bfaf0]
mov rcx, rax
call fcn.14000b590
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x48], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x58], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 7
mov word [rax], di
lea r8, [0x1400bf8c0]
cmp qword [0x1400bf8d8], 8
cmovae r8, qword [0x1400bf8c0]
lea rdx, [rsp + 0x48]
cmp qword [rsp + 0x60], 8
cmovae rdx, qword [rsp + 0x48]
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x14001f6ca
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001f6c5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001f76b
call fcn.140043d84
movdqa xmm0, xmmword [0x1400a4b30]
movdqu xmmword [rsp + 0x58], xmm0
mov word [rsp + 0x48], di
mov rdx, qword [rsp + 0x80]
cmp rdx, 8
jb 0x14001f71e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001f719
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001f765
call fcn.140043d84
xor al, al
jmp 0x14001f744
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov edx, 0xffffffff
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.140043d60
mov rbx, qword [rsp + 0xb8]
add rsp, 0x90
pop rdi
ret
call fcn.1400652fc
nop
call fcn.1400652fc
nop
int3
Function at 0x140020100
Capabilities:
Check if file exists
Get file attributes
Read .ini file

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x78
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov rax, qword [0x1400ba080]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov r12, r9
mov r13, r8
mov r15, rdx
mov qword [rsp + 0x30], rdx
mov r14, rcx
mov qword [rsp + 0x40], rdx
mov rbx, qword [rsp + 0xe0]
cmp qword [rcx + 0x18], 8
jb 0x140020151
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140020186
xor eax, eax
mov qword [r15 + 0x10], rax
mov qword [r15 + 0x18], 7
mov word [r15], ax
lea r8d, [rax + 0x19]
lea rdx, str.Error:_Ini_File_Not_Exist
mov rcx, r15
call fcn.140002490
jmp 0x1400202a5
mov ecx, 0x208
mov r15d, 1
call fcn.1400443f0
mov rsi, rax
movdqa xmm0, xmmword [0x1400a4b30]
movdqu xmmword [rsp + 0x58], xmm0
xor eax, eax
mov word [rsp + 0x48], ax
mov ebp, 0x104
lea rdi, [rax - 1]
nop word [rax + rax]
mov rax, r14
cmp qword [r14 + 0x18], 8
jb 0x1400201cd
mov rax, qword [r14]
mov r8, rbx
cmp qword [rbx + 0x18], 8
jb 0x1400201da
mov r8, qword [rbx]
mov rdx, r12
cmp qword [r12 + 0x18], 8
jb 0x1400201e9
mov rdx, qword [r12]
mov rcx, r13
cmp qword [r13 + 0x18], 8
jb 0x1400201f7
mov rcx, qword [r13]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebp
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [rbp - 1]
cmp eax, ecx
jb 0x14002026b
mov r8, rbx
cmp qword [rbx + 0x18], 8
jb 0x14002021d
mov r8, qword [rbx]
mov rax, rsi
sub r8, rsi
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x140020237
add rax, 2
test ecx, ecx
jne 0x140020223
test edx, edx
je 0x14002026b
mov rcx, rsi
call fcn.140043d84
inc r15d
imul ebp, r15d, 0x104
mov ecx, ebp
mov eax, 2
mul rcx
cmovo rax, rdi
mov rcx, rax
call fcn.1400443f0
mov rsi, rax
jmp 0x1400201c0
mov r15, qword [rsp + 0x30]
inc rdi
cmp word [rsi + rdi*2], 0
jne 0x140020270
mov r8, rdi
mov rdx, rsi
lea rcx, [rsp + 0x48]
call fcn.140002490
mov rcx, rsi
call fcn.140043d84
movups xmm0, xmmword [rsp + 0x48]
movups xmmword [r15], xmm0
movups xmm1, xmmword [rsp + 0x58]
movups xmmword [r15 + 0x10], xmm1
mov rax, r15
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140043d60
add rsp, 0x78
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14004784c
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x48
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x14004785f
add rsp, 0x48
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edx, ax
lea rcx, [rsp + 0x20]
or edx, 0x80070000
test eax, eax
cmovle edx, eax
call fcn.140047e6c
lea rdx, [0x1400b7aa8]
lea rcx, [rsp + 0x20]
call fcn.140062860
int3

Function at 0x1400520e8
Capabilities:
Set thread local storage value

Disassembly:
mov ecx, dword [0x1400be5c0]
xor edx, edx
jmp fcn.14004784c

Function at 0x140052a80
Capabilities:
Set thread local storage value

Disassembly:
mov rdx, rcx
mov ecx, dword [0x1400be5c0]
jmp fcn.14004784c

Function at 0x14005e6f4
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rcx + 0x98], rdx
mov r8, rcx
mov r9, qword [rdx + 0x1a8]
add rcx, 0x40
lea rdx, [0x14005e7b0]
mov r9, qword [r9 + 8]
jmp fcn.14004faa0

Function at 0x14005e788
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rcx + 0x98], rdx
mov r8, rcx
mov r9, qword [rdx + 0x1a8]
add rcx, 0x40
lea rdx, [0x14005e7c0]
mov r9, qword [r9 + 8]
jmp fcn.14004faa0

Function at 0x140069040
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x140068ecb
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140068ecb
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140068ecb
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140068ecb
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140068ecb
cmp dword [rcx + 0x84], 0xe
jbe 0x140068ecb
cmp dword [rcx + 0xf8], 0
je 0x140068ecb
mov ecx, ebx
call fcn.140068f6c
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.140068d48
cmp dword [rbp + 0x20], 0
je 0x140068f18
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140068f20
int3
xor r8d, r8d
xor edx, edx
jmp 0x140068e64
Function at 0x412060
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4121eb
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.0042dea0
xorps xmm15, xmm15
mov r14, qword [0x00564580]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x4120c5
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x4120d4
add rsp, 0x48
pop rbp
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x4120f3
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x412103
cmp rbx, 0x1000
jae 0x4120cb
jmp 0x41216d
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x412115
xor edx, edx
jmp 0x412164
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.0042dea0
xorps xmm15, xmm15
mov r14, qword [0x00564580]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x4120f9
jmp 0x4120e8
call fcn.0045b800
xorps xmm15, xmm15
mov r14, qword [0x00564580]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.00432200
lea rax, [0x00490ce3]
mov ebx, 0x18
nop dword [rax]
call fcn.00432a80
mov rax, qword [rsp + 0x38]
call fcn.004327c0
lea rax, [0x00491107]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.00432a80
mov rax, qword [rsp + 0x30]
call fcn.004327c0
call fcn.00432440
call fcn.00432260
lea rax, [0x00492c9f]
mov ebx, 0x21
call fcn.00430860
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00458160
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00412060
Function at 0x412220
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x412446
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.0042df20
xorps xmm15, xmm15
mov r14, qword [0x00564580]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x412293
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x4122a2
add rsp, 0x50
pop rbp
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x4122c5
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x4122d5
cmp rbx, 0x1000
jae 0x412299
nop
jmp 0x412358
add rsp, 0x50
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop word [rax + rax]
cmp rbx, 0x1000
jae 0x4122ed
xor esi, esi
jmp 0x41234a
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.0042df20
xorps xmm15, xmm15
mov r14, qword [0x00564580]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x4122cb
jmp 0x4122b6
call fcn.0045b800
xorps xmm15, xmm15
mov r14, qword [0x00564580]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x4123e0
nop dword [rax + rax]
call fcn.00432200
lea rax, [0x00491120]
mov ebx, 0x19
call fcn.00432a80
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
call fcn.004327c0
lea rax, [0x00491107]
mov ebx, 0x19
call fcn.00432a80
mov eax, dword [rsp + 0x34]
call fcn.004327c0
nop
call fcn.00432440
call fcn.00432260
lea rax, [0x0048e319]
mov ebx, 0xd
call fcn.00430860
nop dword [rax + rax]
cmp eax, 0x5af
je 0x412380
call fcn.00432200
lea rax, [0x00491120]
mov ebx, 0x19
call fcn.00432a80
mov rax, qword [rsp + 0x38]
call fcn.004327c0
lea rax, [0x00491107]
mov ebx, 0x19
call fcn.00432a80
mov eax, dword [rsp + 0x34]
nop dword [rax]
call fcn.004327c0
call fcn.00432440
call fcn.00432260
lea rax, [0x004926c1]
mov ebx, 0x1f
nop dword [rax + rax]
call fcn.00430860
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00458160
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.00412220
Function at 0x41a160
Capabilities:
Hash data using murmur3

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
cmp byte [0x00564371], 0
jne 0x41a247
sub rbx, qword [rax + 0x18]
mov rdx, qword [rax + 0x50]
test byte [rdx], al
mov esi, dword [rax + 0x64]
imul rbx, rsi
mov rsi, rbx
shr rbx, 0x20
shr rsi, 0x23
and ebx, 7
mov rdi, rcx
mov rcx, rbx
mov r8d, 1
shl r8d, cl
add rdx, rsi
nop
nop
nop
nop
lock or byte [rdx], r8b
mov rcx, qword [rax + 0x18]
movabs rdx, 0x800000000000
lea rax, [rdx + rcx]
mov rdx, rax
shr rdx, 0x2a
nop
nop
nop
cmp rdx, 0x40
jae 0x41a23a
lea rbx, [0x00536758]
mov rdx, qword [rbx + rdx*8]
test byte [rdx], al
mov rbx, rcx
shr rbx, 0x10
and ebx, 0x3f
shr rcx, 0xd
and ecx, 7
mov esi, 1
shl esi, cl
shr rax, 0x16
and eax, 0xfffff
mov rax, qword [rdx + rax*8]
test byte [rax], al
movzx edx, byte [rax + rbx + 0x11440]
lea rax, [rax + rbx]
lea rax, [rax + 0x11440]
test sil, dl
jne 0x41a220
lock or byte [rax], sil
mov rax, qword [r14 + 0x30]
mov rax, qword [rax + 0xa0]
test byte [rax], al
add qword [rax + 0x1250], rdi
add rsp, 0x10
pop rbp
ret
mov rax, rdx
mov ecx, 0x40
call fcn.0045a3e0
lea rax, [0x0049429c]
mov ebx, 0x2c
call fcn.00430860
nop
int3

Function at 0x41c520
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41c626
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x70], rcx
mov byte [rsp + 0x17], dil
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x18], 0
jmp 0x41c563
mov rax, qword [rsp + 0x60]
mov rcx, rdx
mov rbx, qword [rsp + 0x68]
movzx edi, byte [rsp + 0x17]
cmp qword [rsp + 0x18], rbx
jae 0x41c61b
test byte [rax], al
lea rcx, [rax + 0x100b8]
mov ebx, edi
mov rax, rcx
nop dword [rax]
call fcn.0041d300
test rax, rax
je 0x41c61b
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x30], xmm15
movups xmmword [rsp + 0x40], xmm15
lea rcx, [0x0041c660]
mov qword [rsp + 0x20], rcx
lea rdx, [rsp + 0x18]
mov qword [rsp + 0x28], rdx
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x48], rax
lea rbx, [rsp + 0x20]
mov qword [rsp], rbx
nop dword [rax]
call fcn.00458020
xorps xmm15, xmm15
mov r14, qword [0x00564580]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x70]
nop dword [rax]
test rdx, rdx
jne 0x41c609
xor eax, eax
jmp 0x41c613
mov rax, qword [rdx]
call rax
mov rdx, qword [rsp + 0x70]
test al, al
je 0x41c551
mov rax, qword [rsp + 0x18]
add rsp, 0x50
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov byte [rsp + 0x20], dil
call fcn.00458160
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movzx edi, byte [rsp + 0x20]
jmp fcn.0041c520