joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140003680
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rdx
mov rdi, rcx
test rcx, rcx
je 0x1400036a5
test rdx, rdx
je 0x1400036b7
cmp rdx, 0x40
jae 0x1400036c5
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov edx, 0x40
call fcn.140004c40
test al, al
jne 0x1400036a5
mov eax, 0x5a4d
cmp word [rdi], ax
jne 0x1400036a5
movsxd rax, dword [rdi + 0x3c]
cmp eax, 0x400
jg 0x1400036a5
lea rbx, [rax + rdi]
mov rcx, rax
test rsi, rsi
je 0x14000370a
test rbx, rbx
je 0x1400036a5
cmp rbx, rdi
jb 0x1400036a5
add rax, 0xf8
cmp rax, rsi
ja 0x1400036a5
cmp rax, 0xf8
jb 0x1400036a5
cmp rax, rcx
jb 0x1400036a5
jmp 0x14000371b
mov edx, 0xf8
mov rcx, rbx
call fcn.140004c40
test al, al
jne 0x1400036a5
mov rsi, qword [rsp + 0x38]
xor eax, eax
cmp dword [rbx], 0x4550
cmovne rbx, rax
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140003740
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x140003830
mov edx, 0x40
call fcn.140004c40
test al, al
jne 0x140003830
mov edi, 0x5a4d
cmp word [rbx], di
jne 0x140003830
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x140003830
lea rsi, [rbx + rax]
mov edx, 0xf8
mov rcx, rsi
call fcn.140004c40
test al, al
jne 0x140003830
cmp dword [rsi], 0x4550
jne 0x140003830
mov edx, 0x40
mov rcx, rbx
call fcn.140004c40
test al, al
jne 0x14000381d
cmp word [rbx], di
jne 0x14000381d
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x14000381d
lea rdi, [rbx + rax]
mov edx, 0xf8
mov rcx, rdi
call fcn.140004c40
test al, al
jne 0x14000381d
cmp dword [rdi], 0x4550
jne 0x14000381d
mov edx, 0xf8
mov rcx, rdi
call fcn.140004c40
test al, al
jne 0x14000381d
xor eax, eax
mov ecx, 0x20b
cmp word [rdi + 0x18], cx
cmovne rax, rsi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rax, rsi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
xor eax, eax
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140003850
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x140003925
mov edx, 0x40
call fcn.140004c40
test al, al
jne 0x140003925
mov edi, 0x5a4d
cmp word [rbx], di
jne 0x140003925
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x140003925
lea rsi, [rbx + rax]
mov edx, 0xf8
mov rcx, rsi
call fcn.140004c40
test al, al
jne 0x140003925
cmp dword [rsi], 0x4550
jne 0x140003925
mov edx, 0x40
mov rcx, rbx
call fcn.140004c40
test al, al
jne 0x140003925
cmp word [rbx], di
jne 0x140003925
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x140003925
lea rdi, [rbx + rax]
mov edx, 0xf8
mov rcx, rdi
call fcn.140004c40
test al, al
jne 0x140003925
cmp dword [rdi], 0x4550
jne 0x140003925
mov edx, 0xf8
mov rcx, rdi
call fcn.140004c40
test al, al
jne 0x140003925
xor eax, eax
mov ecx, 0x20b
cmp word [rdi + 0x18], cx
cmove rax, rsi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
xor eax, eax
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x140003940
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov esi, edx
mov rbx, rcx
cmp edx, 0x10
jae 0x140003a34
test rcx, rcx
je 0x140003a34
mov edx, 0x40
call fcn.140004c40
test al, al
jne 0x140003a34
mov edi, 0x5a4d
cmp word [rbx], di
jne 0x140003a34
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x140003a34
lea r14, [rbx + rax]
mov edx, 0xf8
mov rcx, r14
call fcn.140004c40
test al, al
jne 0x140003a34
cmp dword [r14], 0x4550
jne 0x140003a34
mov edx, 0x40
mov rcx, rbx
call fcn.140004c40
test al, al
jne 0x140003a1f
cmp word [rbx], di
jne 0x140003a1f
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x140003a1f
lea rdi, [rbx + rax]
mov edx, 0xf8
mov rcx, rdi
call fcn.140004c40
test al, al
jne 0x140003a1f
cmp dword [rdi], 0x4550
jne 0x140003a1f
mov edx, 0xf8
mov rcx, rdi
call fcn.140004c40
test al, al
jne 0x140003a1f
mov eax, 0x20b
cmp word [rdi + 0x18], ax
lea rax, [rsi*8 + 0x88]
je 0x140003a27
lea rax, [rsi*8 + 0x78]
add rax, r14
xor ecx, ecx
cmp dword [rax], ecx
cmove rax, rcx
jmp 0x140003a36
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x140003a50
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
mov ebp, 0x5a4d
test rcx, rcx
je 0x140003acb
mov edx, 0x40
call fcn.140004c40
test al, al
jne 0x140003acb
cmp word [rbx], bp
jne 0x140003acb
movsxd rax, dword [rbx + 0x3c]
lea rdi, [rbx + 0x3c]
cmp eax, 0x400
jg 0x140003acb
lea rsi, [rbx + rax]
mov edx, 0xf8
mov rcx, rsi
call fcn.140004c40
test al, al
jne 0x140003acb
cmp dword [rsi], 0x4550
jne 0x140003acb
mov edx, 0xf8
mov rcx, rsi
call fcn.140004c40
test al, al
je 0x140003ac5
xor esi, esi
jmp 0x140003ad6
movzx esi, word [rsi + 0x18]
jmp 0x140003ad6
xor esi, esi
lea rdi, [rbx + 0x3c]
test rbx, rbx
je 0x140003b28
mov edx, 0x40
mov rcx, rbx
call fcn.140004c40
test al, al
jne 0x140003b28
cmp word [rbx], bp
jne 0x140003b28
movsxd rax, dword [rdi]
cmp eax, 0x400
jg 0x140003b28
lea rdi, [rbx + rax]
mov edx, 0xf8
mov rcx, rdi
call fcn.140004c40
test al, al
jne 0x140003b28
cmp dword [rdi], 0x4550
jne 0x140003b28
mov eax, 0x20b
cmp si, ax
jne 0x140003b23
mov rax, qword [rdi + 0x30]
jmp 0x140003b2a
mov eax, dword [rdi + 0x34]
jmp 0x140003b2a
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140003b40
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x140003c3f
mov edx, 0x40
call fcn.140004c40
test al, al
jne 0x140003c3f
mov esi, 0x5a4d
cmp word [rbx], si
jne 0x140003c3f
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x140003c3f
lea rdi, [rbx + rax]
mov edx, 0xf8
mov rcx, rdi
call fcn.140004c40
test al, al
jne 0x140003c3f
cmp dword [rdi], 0x4550
jne 0x140003c3f
mov edx, 0x40
mov rcx, rbx
call fcn.140004c40
test al, al
jne 0x140003c24
cmp word [rbx], si
jne 0x140003c24
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x140003c24
lea rdi, [rbx + rax]
mov edx, 0xf8
mov rcx, rdi
call fcn.140004c40
test al, al
jne 0x140003c24
cmp dword [rdi], 0x4550
jne 0x140003c24
mov edx, 0xf8
mov rcx, rdi
call fcn.140004c40
test al, al
jne 0x140003c24
mov eax, 0x20b
cmp word [rdi + 0x18], ax
jne 0x140003c24
mov rcx, rbx
call fcn.140003850
mov eax, dword [rax + 0x50]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rcx, rbx
call fcn.140003740
mov eax, dword [rax + 0x50]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
xor eax, eax
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140003c60
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
sub rsp, 0x20
mov rbp, rdx
mov rbx, rcx
test rcx, rcx
je 0x140003d2c
call fcn.140003680
mov rsi, rax
test rax, rax
je 0x140003d2c
mov edx, 0x40
mov qword [rsp + 0x30], rdi
mov rcx, rbx
call fcn.140004c40
test al, al
jne 0x140003ced
mov eax, 0x5a4d
cmp word [rbx], ax
jne 0x140003ced
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x140003ced
lea rdi, [rbx + rax]
mov edx, 0xf8
mov rcx, rdi
call fcn.140004c40
test al, al
jne 0x140003ced
cmp dword [rdi], 0x4550
jne 0x140003ced
mov edx, 0xf8
mov rcx, rdi
call fcn.140004c40
test al, al
jne 0x140003ced
mov eax, 0x20b
lea rax, [rsi + 4]
test rax, rax
je 0x140003d15
cmp rax, rbx
jb 0x140003d15
mov rcx, rax
sub rcx, rbx
lea rdx, [rcx + 0x14]
cmp rdx, rbp
ja 0x140003d15
cmp rdx, 0x14
jb 0x140003d15
cmp rdx, rcx
jae 0x140003d17
xor eax, eax
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
mov rbx, qword [rsp + 0x38]
xor eax, eax
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
Function at 0x140004010
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov rbp, r9
mov r13, r8
mov r15, rdx
mov rdi, rcx
test rcx, rcx
je 0x14000404d
test r8, r8
je 0x14000404d
test rdx, rdx
je 0x14000406c
cmp rdx, 0x40
jae 0x14000407a
xor al, al
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov edx, 0x40
call fcn.140004c40
test al, al
jne 0x14000404d
mov esi, 0x5a4d
cmp word [rdi], si
jne 0x14000404d
movsxd rax, dword [rdi + 0x3c]
cmp eax, 0x400
jg 0x14000404d
lea rbx, [rax + rdi]
mov rcx, rax
test r15, r15
je 0x1400040bf
test rbx, rbx
je 0x14000404d
cmp rbx, rdi
jb 0x14000404d
add rax, 0xf8
cmp rax, r15
ja 0x14000404d
cmp rax, 0xf8
jb 0x14000404d
cmp rax, rcx
jb 0x14000404d
jmp 0x1400040d4
mov edx, 0xf8
mov rcx, rbx
call fcn.140004c40
test al, al
jne 0x14000404d
cmp dword [rbx], 0x4550
jne 0x14000404d
mov edx, 0x40
mov rcx, rdi
call fcn.140004c40
test al, al
jne 0x140004134
cmp word [rdi], si
jne 0x140004134
movsxd rax, dword [rdi + 0x3c]
cmp eax, 0x400
jg 0x140004134
lea rsi, [rdi + rax]
mov edx, 0xf8
mov rcx, rsi
call fcn.140004c40
test al, al
jne 0x140004134
cmp dword [rsi], 0x4550
jne 0x140004134
mov edx, 0xf8
mov rcx, rsi
call fcn.140004c40
test al, al
jne 0x140004134
mov eax, 0x20b
xor r11d, r11d
lea r12, [rbx + 4]
mov eax, 0x10
mov rcx, r12
mov r14d, r11d
movzx esi, r11w
movzx edx, word [rax + rcx]
mov eax, dword [rbx + 0x54]
add rdx, 0x18
add rdx, rbx
mov dword [rsp + 0x60], eax
mov qword [rsp + 0x20], rdx
cmp r11w, word [r12 + 2]
jae 0x140004280
nop dword [rax]
movzx eax, si
lea rcx, [rax + rax*4]
lea rbx, [rdx + rcx*8]
test rbx, rbx
je 0x14000404d
cmp rbx, rdi
jb 0x14000404d
mov rcx, rbx
sub rcx, rdi
lea rax, [rcx + 0x28]
cmp rax, r15
ja 0x14000404d
cmp rax, 0x28
jb 0x14000404d
cmp rax, rcx
jb 0x14000404d
cmp rax, rbp
ja 0x14000404d
mov ecx, dword [rbx + 0x14]
test ecx, ecx
je 0x14000426d
mov eax, dword [rbx + 0x10]
test eax, eax
je 0x14000426d
mov r9d, dword [rbx + 0xc]
mov edx, ecx
mov r8d, eax
add rcx, rdi
add rax, r9
lea r10, [r9 + r13]
cmp rax, rbp
jbe 0x1400041fa
mov rax, rbp
mov r8, r11
sub rax, r9
cmp rbp, r9
cmova r8, rax
cmp r9, rbp
jb 0x140004208
test r8, r8
jne 0x14000404d
lea rax, [rdx + r8]
cmp rax, rbp
ja 0x14000404d
test rcx, rcx
je 0x140004268
cmp rcx, rdi
jb 0x140004268
cmp rax, r15
ja 0x140004268
cmp rax, r8
jb 0x140004268
cmp rax, rdx
jb 0x140004268
test r10, r10
je 0x140004268
cmp r10, r13
jb 0x140004268
lea rax, [r9 + r8]
cmp rax, rbp
ja 0x140004268
cmp rax, r8
jb 0x140004268
cmp rax, r9
jb 0x140004268
mov rdx, rcx
mov rcx, r10
call fcn.14002f3f0
test r14d, r14d
je 0x140004261
cmp dword [rbx + 0x14], r14d
jae 0x140004265
mov r14d, dword [rbx + 0x14]
xor r11d, r11d
mov rdx, qword [rsp + 0x20]
inc si
cmp si, word [r12 + 2]
jb 0x140004170
mov eax, dword [rsp + 0x60]
test eax, eax
cmovne r14d, eax
mov r8d, r14d
cmp r8, rbp
ja 0x14000404d
mov rdx, rdi
mov rcx, r13
call fcn.14002f3f0
mov al, 1
jmp 0x14000404f
Function at 0x1400042d0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r14, rdx
mov r12, r8
mov edx, 5
mov rsi, rcx
call fcn.140003940
test rax, rax
je 0x140004542
test rsi, rsi
je 0x140004542
cmp rax, rsi
jb 0x140004542
mov rcx, rax
sub rcx, rsi
lea rdx, [rcx + 8]
cmp rdx, r14
ja 0x140004542
cmp rdx, 8
jb 0x140004542
cmp rdx, rcx
jb 0x140004542
mov ecx, dword [rax + 4]
mov edx, 0x40
mov ebx, dword [rax]
mov dword [rsp + 0x20], ecx
mov rcx, rsi
mov dword [rsp + 0x78], ebx
call fcn.140004c40
test al, al
jne 0x1400043a1
mov eax, 0x5a4d
cmp word [rsi], ax
jne 0x1400043a1
movsxd rax, dword [rsi + 0x3c]
cmp eax, 0x400
jg 0x1400043a1
lea rbx, [rsi + rax]
mov edx, 0xf8
mov rcx, rbx
call fcn.140004c40
test al, al
jne 0x14000439d
cmp dword [rbx], 0x4550
jne 0x14000439d
mov edx, 0xf8
mov rcx, rbx
call fcn.140004c40
mov ebx, dword [rsp + 0x78]
mov r10d, dword [rsp + 0x20]
xor r13d, r13d
test r10d, r10d
je 0x14000453e
mov r11d, 0x1000
nop dword [rax + rax]
lea eax, [rbx + r13]
lea r15, [rax + rsi]
mov ecx, eax
test r15, r15
je 0x140004542
cmp r15, rsi
jb 0x140004542
add rax, 8
cmp rax, r14
ja 0x140004542
cmp rax, 8
jb 0x140004542
cmp rax, rcx
jb 0x140004542
mov eax, dword [r15 + 4]
test eax, eax
je 0x14000453e
mov r9d, dword [r15]
lea rbp, [rax - 8]
shr rbp, 1
lea rax, [r15 + 8]
mov dword [rsp + 0x24], r9d
test rax, rax
je 0x140004542
cmp rax, rsi
jb 0x140004542
sub rax, rsi
lea rbx, [rax + 2]
cmp rbx, r14
ja 0x140004542
cmp rbx, 2
jb 0x140004542
cmp rbx, rax
jb 0x140004542
test rbp, rbp
je 0x14000452d
xor r8d, r8d
test rbp, rbp
je 0x14000452d
mov rax, rbx
nop dword [rax + rax]
lea rdx, [rsi - 2]
add rdx, rax
je 0x1400044a9
cmp rdx, rsi
jb 0x1400044a9
cmp rax, r14
ja 0x1400044a9
cmp rax, 2
jb 0x1400044a9
lea rcx, [rax - 2]
cmp rax, rcx
jb 0x1400044a9
cmp word [rdx], r11w
jae 0x1400044a9
add rax, 2
inc r8
cmp r8, rbp
jb 0x140004470
jmp 0x14000452d
xor edi, edi
nop dword [rax + rax]
lea rcx, [rsi - 2]
add rcx, rbx
je 0x14000451d
cmp rcx, rsi
jb 0x14000451d
cmp rbx, r14
ja 0x14000451d
cmp rbx, 2
jb 0x14000451d
lea rax, [rbx - 2]
cmp rbx, rax
jb 0x14000451d
movzx eax, word [rcx]
mov ecx, eax
shr eax, 0xc
and ecx, 0xfff
test eax, eax
je 0x14000451d
cmp eax, 3
je 0x1400044ee
cmp eax, 0xa
jne 0x140004542
add ecx, r9d
cmp rcx, r14
jae 0x140004542
test r12, r12
je 0x140004511
mov rax, qword [r12]
lea rdx, [rcx + rsi]
mov rcx, r12
call qword [rax]
test al, al
je 0x140004542
mov r9d, dword [rsp + 0x24]
add rbx, 2
inc rdi
cmp rdi, rbp
jb 0x1400044b0
test rdi, rdi
je 0x140004542
mov r10d, dword [rsp + 0x20]
mov r11d, 0x1000
add r13d, dword [r15 + 4]
mov ebx, dword [rsp + 0x78]
cmp r13d, r10d
jb 0x1400043c0
mov al, 1
jmp 0x140004544
xor al, al
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140004570
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rsi, r8
mov rbp, rdx
mov r14, rcx
call fcn.140003b40
test eax, eax
je 0x1400047f8
mov edi, eax
test rbp, rbp
jne 0x1400045a1
mov ebp, edi
mov edx, 9
mov rcx, r14
call fcn.140003940
test rax, rax
je 0x1400047f8
mov eax, dword [rax]
test eax, eax
je 0x1400047f8
mov ebx, eax
add rbx, r14
je 0x1400047f8
mov rbx, qword [rbx + 0x18]
test rbx, rbx
je 0x1400047f8
cmp rbx, r14
jb 0x1400045fc
lea rax, [rdi + r14]
cmp rbx, rax
jae 0x1400045fc
mov rax, rbx
mov ecx, 0xffffffff
sub rax, r14
cmp rax, rcx
jae 0x140004610
sub ebx, r14d
jmp 0x140004612
cmp rbx, rdi
jae 0x1400047f8
mov ecx, 0xffffffff
cmp rbx, rcx
cmovb ecx, ebx
mov ebx, ecx
test r14, r14
je 0x140004758
mov edx, 0x40
mov rcx, r14
call fcn.140004c40
test al, al
jne 0x140004758
mov eax, 0x5a4d
cmp word [r14], ax
jne 0x140004758
movsxd rax, dword [r14 + 0x3c]
cmp eax, 0x400
jg 0x140004758
lea rdi, [r14 + rax]
mov edx, 0xf8
mov rcx, rdi
call fcn.140004c40
test al, al
jne 0x140004758
cmp dword [rdi], 0x4550
jne 0x140004758
mov edx, 0xf8
mov rcx, rdi
call fcn.140004c40
test al, al
mov eax, ebx
lea rcx, [rax + r14]
jne 0x140004767
mov edx, 0x20b
cmp word [rdi + 0x18], dx
jne 0x14000475e
test rcx, rcx
je 0x1400047f1
cmp rcx, r14
jb 0x1400047f1
lea rbx, [rax + 8]
cmp rbx, rbp
ja 0x1400047f1
cmp rbx, 8
jb 0x1400047f1
cmp rbx, rax
jb 0x1400047f1
mov rcx, r14
call fcn.140003b40
xor edi, edi
nop dword [rax]
lea rcx, [r14 - 8]
add rcx, rbx
je 0x1400047f3
cmp rcx, r14
jb 0x1400047f3
cmp rbx, rbp
ja 0x1400047f3
cmp rbx, 8
jb 0x1400047f3
lea rax, [rbx - 8]
cmp rbx, rax
jb 0x1400047f3
mov rax, qword [rcx]
mov qword [rsp + 0x40], rax
test rax, rax
je 0x1400047f3
mov rdx, qword [rsi + 8]
cmp rdx, qword [rsi + 0x10]
je 0x140004742
mov qword [rdx], rax
inc rdi
add qword [rsi + 8], 8
add rbx, 8
jmp 0x1400046e0
lea r8, [rsp + 0x40]
mov rcx, rsi
call fcn.140004a60
inc rdi
add rbx, 8
jmp 0x1400046e0
mov eax, ebx
lea rcx, [r14 + rax]
test r14, r14
je 0x1400047f1
test rcx, rcx
je 0x1400047f1
cmp rcx, r14
jb 0x1400047f1
lea rbx, [rax + 4]
cmp rbx, rbp
ja 0x1400047f1
cmp rbx, 4
jb 0x1400047f1
cmp rbx, rax
jb 0x1400047f1
mov rcx, r14
call fcn.140003b40
xor edi, edi
lea rcx, [r14 - 4]
add rcx, rbx
je 0x1400047f3
cmp rcx, r14
jb 0x1400047f3
cmp rbx, rbp
ja 0x1400047f3
cmp rbx, 4
jb 0x1400047f3
lea rax, [rbx - 4]
cmp rbx, rax
jb 0x1400047f3
mov eax, dword [rcx]
test eax, eax
je 0x1400047f3
mov rdx, qword [rsi + 8]
mov qword [rsp + 0x40], rax
cmp rdx, qword [rsi + 0x10]
je 0x1400047db
mov qword [rdx], rax
inc rdi
add qword [rsi + 8], 8
add rbx, 4
jmp 0x140004793
lea r8, [rsp + 0x40]
mov rcx, rsi
call fcn.140004a60
inc rdi
add rbx, 4
jmp 0x140004793
xor edi, edi
mov rax, rdi
jmp 0x1400047fa
xor eax, eax
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x140007330
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
movzx r14d, r8b
mov rsi, rdx
mov rdi, rcx
mov rbp, qword gs:[0x60]
test rbp, rbp
je 0x14000737a
mov rbx, qword [rbp + 0x38]
mov qword [rsp + 0x50], rbx
mov rcx, rbx
call qword [sym.imp.ntdll.dll_RtlEnterCriticalSection]
nop
mov qword [rbp + 0x10], rdi
mov rcx, rbx
call qword [sym.imp.ntdll.dll_RtlLeaveCriticalSection]
mov rdx, rdi
mov rcx, rdi
call fcn.140001070
mov rbx, rsi
test rsi, rsi
jne 0x14000739f
mov rcx, rdi
call fcn.140003b40
test eax, eax
je 0x14000749a
mov ebx, eax
mov edx, 3
mov rcx, rdi
call fcn.140003940
test rax, rax
je 0x14000749a
mov ecx, dword [rax]
test ecx, ecx
je 0x14000749a
mov edx, dword [rax + 4]
test edx, edx
je 0x14000749a
lea rbp, [rcx + rdi]
test rdi, rdi
je 0x14000749a
test rbp, rbp
je 0x14000749a
cmp rbp, rdi
jae 0x140007400
mov rdx, rsi
mov rcx, rdi
call fcn.1400017d0
mov rdx, rsi
mov rcx, rdi
call fcn.140004810
jmp 0x1400074b9
lea rax, [rcx + rdx]
cmp rax, rbx
ja 0x1400073e5
cmp rax, rdx
jb 0x1400073e5
cmp rax, rcx
jb 0x1400073e5
movabs rax, 0xaaaaaaaaaaaaaaab
mul rdx
mov r11, rdx
shr r11, 3
xor edx, edx
test r11, r11
je 0x14000749a
mov r8, rbp
movsd xmm0, qword [r8]
movsd qword [rsp + 0x20], xmm0
mov eax, dword [r8 + 8]
mov dword [rsp + 0x28], eax
mov ecx, dword [rsp + 0x20]
mov r9d, ecx
lea r10, [rcx + rdi]
mov rax, qword [rsp + 0x20]
shr rax, 0x20
sub eax, ecx
mov ecx, eax
test r10, r10
je 0x140007484
cmp r10, rdi
jb 0x140007484
add rax, r9
cmp rax, rbx
ja 0x140007484
cmp rax, rcx
jb 0x140007484
cmp rax, r9
jb 0x140007484
inc rdx
add r8, 0xc
cmp rdx, r11
jb 0x140007431
test rdx, rdx
je 0x14000749a
mov r8, rdi
mov rcx, rbp
call qword [sym.imp.ntdll.dll_RtlAddFunctionTable]
jmp 0x1400073e5
mov rdx, rsi
mov rcx, rdi
call fcn.1400017d0
mov rdx, rsi
mov rcx, rdi
call fcn.140004810
test rdi, rdi
je 0x140007574
mov edx, 0x40
mov rcx, rdi
call fcn.140004c40
test al, al
jne 0x140007574
mov ebx, 0x5a4d
cmp word [rdi], bx
jne 0x140007574
movsxd rax, dword [rdi + 0x3c]
cmp eax, 0x400
jg 0x140007574
lea rsi, [rdi + rax]
mov edx, 0xf8
mov rcx, rsi
call fcn.140004c40
test al, al
jne 0x140007574
cmp dword [rsi], 0x4550
jne 0x140007574
mov edx, 0x40
mov rcx, rdi
call fcn.140004c40
test al, al
jne 0x140007553
cmp word [rdi], bx
jne 0x140007553
movsxd rax, dword [rdi + 0x3c]
cmp eax, 0x400
jg 0x140007553
lea rbx, [rdi + rax]
mov edx, 0xf8
mov rcx, rbx
call fcn.140004c40
test al, al
jne 0x140007553
cmp dword [rbx], 0x4550
jne 0x140007553
mov edx, 0xf8
mov rcx, rbx
call fcn.140004c40
mov eax, dword [rsi + 0x28]
test eax, eax
je 0x140007574
add rax, rdi
test r14b, r14b
je 0x140007570
xor r8d, r8d
lea edx, [r8 + 1]
mov rcx, rdi
call rax
jmp 0x140007579
call rax
jmp 0x140007579
mov eax, 0xfffffffe
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x14001c170
Capabilities:
Compute adler32 checksum

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
movaps xmmword [rsp + 0x40], xmm6
mov ebx, ecx
movaps xmmword [rsp + 0x30], xmm7
mov r10, rdx
movdqa xmm7, xmmword [0x140043f10]
mov edi, 0x15b0
movaps xmmword [rsp + 0x20], xmm8
movdqa xmm8, xmmword [0x140043f20]
movaps xmmword [rsp + 0x10], xmm9
movaps xmmword [rsp], xmm10
movdqa xmm10, xmmword [0x140043f30]
shr ebx, 0x10
movzx r11d, cx
cmp r9, 0x10
jb 0x14001c345
xorps xmm5, xmm5
nop dword [rax]
cmp r9, rdi
movd xmm3, r11d
mov rax, r9
movd xmm9, ebx
cmova rax, rdi
movdqa xmm6, xmm5
and rax, 0xfffffffffffffff0
movdqa xmm4, xmm5
sub r9, rax
cmp rax, 0x20
jb 0x14001c26d
mov rdx, rax
shr rdx, 5
imul rcx, rdx, 0xffffffffffffffe0
add rax, rcx
nop word [rax + rax]
movdqu xmm1, xmmword [r8]
movdqu xmm2, xmmword [r8 + 0x10]
add r8, 0x20
movdqa xmm0, xmm1
paddd xmm6, xmm3
psadbw xmm0, xmm5
movdqu xmmword [r10], xmm1
movdqu xmmword [r10 + 0x10], xmm2
add r10, 0x20
pmaddubsw xmm1, xmm10
paddd xmm3, xmm0
movdqa xmm0, xmm2
pmaddubsw xmm2, xmm8
psadbw xmm0, xmm5
pmaddwd xmm1, xmm7
pmaddwd xmm2, xmm7
paddd xmm3, xmm0
paddd xmm9, xmm1
paddd xmm4, xmm2
sub rdx, 1
jne 0x14001c210
pslld xmm6, 5
paddd xmm4, xmm9
paddd xmm4, xmm6
movdqa xmm6, xmm5
cmp rax, 0x10
jb 0x14001c2ce
movdqa xmm2, xmm3
shr rax, 4
nop dword [rax]
movdqu xmm1, xmmword [r8]
add r8, 0x10
paddd xmm6, xmm2
movdqa xmm0, xmm1
psadbw xmm0, xmm5
movdqu xmmword [r10], xmm1
add r10, 0x10
paddd xmm3, xmm0
movdqa xmm0, xmm1
pmaddubsw xmm0, xmm8
movdqa xmm2, xmm3
pmaddwd xmm0, xmm7
paddd xmm4, xmm0
sub rax, 1
jne 0x14001c290
movdqa xmm0, xmm3
pslld xmm6, 4
psrldq xmm0, 8
paddd xmm6, xmm4
paddd xmm0, xmm3
mov eax, 0x80078071
movd r11d, xmm0
movdqa xmm1, xmm6
punpckhqdq xmm1, xmm6
paddd xmm1, xmm6
mul r11d
pshufd xmm0, xmm1, 1
paddd xmm0, xmm1
movd ebx, xmm0
shr edx, 0xf
imul eax, edx, 0xfff1
sub r11d, eax
mov eax, 0x80078071
mul ebx
shr edx, 0xf
imul eax, edx, 0xfff1
sub ebx, eax
cmp r9, 0x10
jae 0x14001c1d0
test r9, r9
jne 0x14001c1c0
shl ebx, 0x10
or ebx, r11d
mov eax, ebx
jmp 0x14001c391
test r9, r9
je 0x14001c368
sub r8, r10
nop dword [rax]
movzx eax, byte [r8 + r10]
mov byte [r10], al
lea r10, [r10 + 1]
add r11d, eax
add ebx, r11d
sub r9, 1
jne 0x14001c350
mov eax, 0x80078071
mul r11d
mov eax, 0x80078071
shr edx, 0xf
imul ecx, edx, 0xfff1
mul ebx
sub r11d, ecx
shr edx, 0xf
imul eax, edx, 0xf
add eax, ebx
shl eax, 0x10
or eax, r11d
mov rbx, qword [rsp + 0x60]
movaps xmm6, xmmword [rsp + 0x40]
movaps xmm7, xmmword [rsp + 0x30]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x10]
movaps xmm10, xmmword [rsp]
add rsp, 0x50
pop rdi
ret