joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140108700
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x50
mov rbx, r9
mov r14, r8
mov rdi, rdx
mov edi, edx

Function at 0x14010edac
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14010edf6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14010edf6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14010edf6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14010edf6
cmp dword [rcx + 0x84], 0xe
jbe 0x14010edf6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14010edf8
xor al, al
add rsp, 0x28
ret
Function at 0x1401145a0
Capabilities:
Link many functions at runtime

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rcx, str.api_ms_win_core_synch_l1_2_0.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x14011460c
mov rdi, rax
lea rdx, str.WaitOnAddress
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14011460c
mov rsi, rax
lea rdx, str.WakeByAddressSingle
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14011460c
mov rbx, rax
xor edi, edi
movzx eax, byte [0x14018af58]
mov rcx, qword [0x14018aea8]
test rcx, rcx
jne 0x1401146c0
jmp 0x1401146ab
lea rcx, [0x140148a38]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x140114723
mov rsi, rax
lea rdx, str.NtCreateKeyedEvent
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140114723
mov rbx, rax
lea rdx, str.NtReleaseKeyedEvent
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140114723
mov rdi, rax
lea rdx, str.NtWaitForKeyedEvent
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140114723
mov rsi, rax
lea rcx, [rsp + 0x20]
mov edx, 0xc0000000
xor r8d, r8d
xor r9d, r9d
call rbx
test eax, eax
jne 0x140114723
mov rbx, qword [rsp + 0x20]
movzx eax, byte [0x14018af58]
mov rcx, qword [0x14018aea8]
test rcx, rcx
jne 0x1401146c0
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
test rax, rax
je 0x14011472a
mov rcx, rax
mov qword [0x14018aea8], rax
mov r8d, 0x18
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
je 0x14011472a
mov r14, rax
mov qword [rax], rdi
mov qword [rax + 8], rsi
mov qword [rax + 0x10], rbx
xor eax, eax
lock cmpxchg qword [0x14018adc0], r14
je 0x140114716
mov rsi, rax
cmp qword [r14], 0
je 0x140114701
mov rcx, qword [r14 + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x14018aea8]
xor edx, edx
mov r8, r14
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r14, rsi
mov rax, r14
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.140114740
ud2
mov ecx, 8
mov edx, 0x18
call fcn.14010fbd0
ud2
Function at 0x14000f810
Capabilities:
Enumerate pe sections
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x10
mov eax, dword [rcx + 0x3c]
cmp dword [rcx + rax + 0x8c], 0
je 0x14000fa43
add rax, rcx
movzx r8d, word [rax + 6]
test r8, r8
je 0x14000fa43
mov r9d, dword [rax + 0x88]
movzx r10d, word [rax + 0x14]
add rax, r10
add rax, 0x18
shl r8, 3
lea r11, [r8 + r8*4]
mov r10, rax
jmp 0x14000f87e
add r10, 0x28
add r11, 0xffffffffffffffd8
je 0x14000fa43
mov edi, dword [r10 + 0xc]
mov esi, r9d
sub esi, edi
jb 0x14000f870
add edi, dword [r10 + 8]
cmp edi, r9d
jbe 0x14000f870
add esi, dword [r10 + 0x14]
mov r9d, dword [rcx + rsi + 0x18]
mov r11d, dword [rcx + rsi + 0x1c]
lea rdi, [r8 + r8*4]
xor r15d, r15d
mov rbx, rax
jmp 0x14000f8ba
add rbx, 0x28
add rdi, 0xffffffffffffffd8
je 0x14000f8d4
mov ebp, dword [rbx + 0xc]
mov r10d, r11d
sub r10d, ebp
jb 0x14000f8b0
add ebp, dword [rbx + 8]
cmp ebp, r11d
jbe 0x14000f8b0
add r10d, dword [rbx + 0x14]
mov r15, r10
add r15, rcx
mov edi, dword [rcx + rsi + 0x24]
lea rbx, [r8 + r8*4]
xor r12d, r12d
mov r14, rax
jmp 0x14000f8fa
add r14, 0x28
add rbx, 0xffffffffffffffd8
je 0x14000f916
mov r11d, dword [r14 + 0xc]
mov r10d, edi
sub r10d, r11d
jb 0x14000f8f0
add r11d, dword [r14 + 8]
cmp r11d, edi
jbe 0x14000f8f0
add r10d, dword [r14 + 0x14]
mov r12, r10
add r12, rcx
mov edi, dword [rcx + rsi + 0x20]
lea rbx, [r8 + r8*4]
xor esi, esi
mov r14, rax
jmp 0x14000f93a
add r14, 0x28
add rbx, 0xffffffffffffffd8
je 0x14000f956
mov r11d, dword [r14 + 0xc]
mov r10d, edi
sub r10d, r11d
jb 0x14000f930
add r11d, dword [r14 + 8]
cmp r11d, edi
jbe 0x14000f930
add r10d, dword [r14 + 0x14]
mov rsi, r10
test r9d, r9d
je 0x14000fa43
mov qword [rsp], r12
mov qword [rsp + 8], r15
add rsi, rcx
lea r10, [r8 + r8*4]
xor edi, edi
movabs r14, 0x6f72507465477350
jmp 0x14000f98c
inc rdi
cmp rdi, r9
je 0x14000fa43
mov r11d, dword [rsi + rdi*4]
mov rbx, r10
mov r12, rax
jmp 0x14000f9aa
add r12, 0x28
add rbx, 0xffffffffffffffd8
je 0x14000f9c9
mov r15d, dword [r12 + 0xc]
mov r13d, r11d
sub r13d, r15d
jb 0x14000f9a0
add r15d, dword [r12 + 8]
cmp r15d, r11d
jbe 0x14000f9a0
add r13d, dword [r12 + 0x14]
mov ebp, r13d
mov r11d, ebp
lea r12, [rcx + r11]
cmp byte [rcx + r11], 0
mov r11, r12
je 0x14000f9ed
mov rbx, r12
nop dword [rax]
lea r11, [rbx + 1]
cmp byte [rbx + 1], 0
mov rbx, r11
jne 0x14000f9e0
sub r11, r12
cmp r11, 0x15
jne 0x14000f980
cmp qword [r12], r14
jne 0x14000f980
movabs r11, 0x7562654473736563
cmp qword [r12 + 8], r11
jne 0x14000f980
cmp dword [r12 + 0x10], 0x726f5067
jne 0x14000f980
cmp byte [r12 + 0x14], 0x74
jne 0x14000f980
mov rcx, qword [rsp]
movzx ecx, word [rcx + rdi*2]
mov r9, qword [rsp + 8]
mov r9d, dword [r9 + rcx*4]
lea r8, [r8 + r8*4]
jmp 0x14000fa65
xor ecx, ecx
mov byte [rdx + 4], cl
add rsp, 0x10
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
add rax, 0x28
xor ecx, ecx
add r8, 0xffffffffffffffd8
je 0x14000fa45
mov r10d, dword [rax + 0xc]
mov ecx, r9d
sub ecx, r10d
jb 0x14000fa59
add r10d, dword [rax + 8]
cmp r10d, r9d
jbe 0x14000fa59
add ecx, dword [rax + 0x14]
mov dword [rdx], ecx
mov cl, 1
jmp 0x14000fa45
Function at 0x14000fd10
Capabilities:
Enumerate pe sections
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x10
mov eax, dword [rcx + 0x3c]
cmp dword [rcx + rax + 0x8c], 0
je 0x14000ff33
add rax, rcx
movzx r8d, word [rax + 6]
test r8, r8
je 0x14000ff33
mov r9d, dword [rax + 0x88]
movzx r10d, word [rax + 0x14]
add rax, r10
add rax, 0x18
shl r8, 3
lea r11, [r8 + r8*4]
mov r10, rax
jmp 0x14000fd7e
add r10, 0x28
add r11, 0xffffffffffffffd8
je 0x14000ff33
mov edi, dword [r10 + 0xc]
mov esi, r9d
sub esi, edi
jb 0x14000fd70
add edi, dword [r10 + 8]
cmp edi, r9d
jbe 0x14000fd70
add esi, dword [r10 + 0x14]
mov r9d, dword [rcx + rsi + 0x18]
mov r11d, dword [rcx + rsi + 0x1c]
lea rdi, [r8 + r8*4]
xor r12d, r12d
mov rbx, rax
jmp 0x14000fdba
add rbx, 0x28
add rdi, 0xffffffffffffffd8
je 0x14000fdd6
mov r10d, dword [rbx + 0xc]
mov r14d, r11d
sub r14d, r10d
jb 0x14000fdb0
add r10d, dword [rbx + 8]
cmp r10d, r11d
jbe 0x14000fdb0
add r14d, dword [rbx + 0x14]
mov r12, r14
add r12, rcx
mov edi, dword [rcx + rsi + 0x24]
lea rbx, [r8 + r8*4]
xor r11d, r11d
mov r14, rax
jmp 0x14000fdfa
add r14, 0x28
add rbx, 0xffffffffffffffd8
je 0x14000fe16
mov r10d, dword [r14 + 0xc]
mov r15d, edi
sub r15d, r10d
jb 0x14000fdf0
add r10d, dword [r14 + 8]
cmp r10d, edi
jbe 0x14000fdf0
add r15d, dword [r14 + 0x14]
mov r11, r15
add r11, rcx
mov edi, dword [rcx + rsi + 0x20]
lea rbx, [r8 + r8*4]
xor esi, esi
mov r14, rax
jmp 0x14000fe3a
add r14, 0x28
add rbx, 0xffffffffffffffd8
je 0x14000fe56
mov r10d, dword [r14 + 0xc]
mov r15d, edi
sub r15d, r10d
jb 0x14000fe30
add r10d, dword [r14 + 8]
cmp r10d, edi
jbe 0x14000fe30
add r15d, dword [r14 + 0x14]
mov rsi, r15
test r9d, r9d
je 0x14000ff33
mov qword [rsp], r11
mov qword [rsp + 8], r12
add rsi, rcx
lea rbx, [r8 + r8*4]
xor edi, edi
movabs r14, 0x6f72507465477350
jmp 0x14000fe8c
inc rdi
cmp rdi, r9
je 0x14000ff33
mov r10d, dword [rsi + rdi*4]
mov r13, rbx
mov r15, rax
jmp 0x14000feaa
add r15, 0x28
add r13, 0xffffffffffffffd8
je 0x14000fec6
mov r11d, dword [r15 + 0xc]
mov r12d, r10d
sub r12d, r11d
jb 0x14000fea0
add r11d, dword [r15 + 8]
cmp r11d, r10d
jbe 0x14000fea0
add r12d, dword [r15 + 0x14]
mov ebp, r12d
mov r10d, ebp
lea r15, [rcx + r10]
cmp byte [rcx + r10], 0
mov r10, r15
je 0x14000feee
mov r11, r15
nop word [rax + rax]
lea r10, [r11 + 1]
cmp byte [r11 + 1], 0
mov r11, r10
jne 0x14000fee0
sub r10, r15
cmp r10, 0xe
jne 0x14000fe80
cmp qword [r15], r14
jne 0x14000fe80
cmp dword [r15 + 8], 0x73736563
jne 0x14000fe80
movzx r10d, word [r15 + 0xc]
cmp r10d, 0x6449
jne 0x14000fe80
mov rcx, qword [rsp]
movzx ecx, word [rcx + rdi*2]
mov r9, qword [rsp + 8]
mov r9d, dword [r9 + rcx*4]
lea r8, [r8 + r8*4]
jmp 0x14000ff55
xor ecx, ecx
mov byte [rdx + 4], cl
add rsp, 0x10
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
add rax, 0x28
xor ecx, ecx
add r8, 0xffffffffffffffd8
je 0x14000ff35
mov r10d, dword [rax + 0xc]
mov ecx, r9d
sub ecx, r10d
jb 0x14000ff49
add r10d, dword [rax + 8]
cmp r10d, r9d
jbe 0x14000ff49
add ecx, dword [rax + 0x14]
mov dword [rdx], ecx
mov cl, 1
jmp 0x14000ff35
Function at 0x140013f90
Capabilities:
Enumerate pe sections
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x10
mov eax, dword [rcx + 0x3c]
cmp dword [rcx + rax + 0x8c], 0
je 0x1400141bf
add rax, rcx
movzx r11d, word [rax + 6]
test r11, r11
je 0x1400141bf
mov r8d, dword [rax + 0x88]
movzx r9d, word [rax + 0x14]
add rax, r9
add rax, 0x18
shl r11, 3
lea r10, [r11 + r11*4]
mov r9, rax
jmp 0x140013ffe
add r9, 0x28
add r10, 0xffffffffffffffd8
je 0x1400141bf
mov edi, dword [r9 + 0xc]
mov esi, r8d
sub esi, edi
jb 0x140013ff0
add edi, dword [r9 + 8]
cmp edi, r8d
jbe 0x140013ff0
add esi, dword [r9 + 0x14]
mov r8d, dword [rcx + rsi + 0x18]
mov r10d, dword [rcx + rsi + 0x1c]
lea rdi, [r11 + r11*4]
xor r12d, r12d
mov rbx, rax
jmp 0x14001403a
add rbx, 0x28
add rdi, 0xffffffffffffffd8
je 0x140014056
mov r9d, dword [rbx + 0xc]
mov r14d, r10d
sub r14d, r9d
jb 0x140014030
add r9d, dword [rbx + 8]
cmp r9d, r10d
jbe 0x140014030
add r14d, dword [rbx + 0x14]
mov r12, r14
add r12, rcx
mov edi, dword [rcx + rsi + 0x24]
lea rbx, [r11 + r11*4]
xor r10d, r10d
mov r14, rax
jmp 0x14001407a
add r14, 0x28
add rbx, 0xffffffffffffffd8
je 0x140014096
mov r9d, dword [r14 + 0xc]
mov r15d, edi
sub r15d, r9d
jb 0x140014070
add r9d, dword [r14 + 8]
cmp r9d, edi
jbe 0x140014070
add r15d, dword [r14 + 0x14]
mov r10, r15
add r10, rcx
mov edi, dword [rcx + rsi + 0x20]
lea rbx, [r11 + r11*4]
xor esi, esi
mov r14, rax
jmp 0x1400140ba
add r14, 0x28
add rbx, 0xffffffffffffffd8
je 0x1400140d6
mov r9d, dword [r14 + 0xc]
mov r15d, edi
sub r15d, r9d
jb 0x1400140b0
add r9d, dword [r14 + 8]
cmp r9d, edi
jbe 0x1400140b0
add r15d, dword [r14 + 0x14]
mov rsi, r15
test r8d, r8d
je 0x1400141bf
mov qword [rsp], r10
mov qword [rsp + 8], r12
add rsi, rcx
lea rdi, [r11 + r11*4]
xor r11d, r11d
movabs rbx, 0x646564616f4c7350
movabs r14, 0x694c656c75646f4d
jmp 0x14001411c
inc r11
cmp r11, r8
je 0x1400141bf
mov r9d, dword [rsi + r11*4]
mov r13, rdi
mov r15, rax
jmp 0x14001413a
add r15, 0x28
add r13, 0xffffffffffffffd8
je 0x140014156
mov r10d, dword [r15 + 0xc]
mov r12d, r9d
sub r12d, r10d
jb 0x140014130
add r10d, dword [r15 + 8]
cmp r10d, r9d
jbe 0x140014130
add r12d, dword [r15 + 0x14]
mov ebp, r12d
mov r9d, ebp
lea r15, [rcx + r9]
cmp byte [rcx + r9], 0
mov r9, r15
je 0x14001417e
mov r10, r15
nop word [rax + rax]
lea r9, [r10 + 1]
cmp byte [r10 + 1], 0
mov r10, r9
jne 0x140014170
sub r9, r15
cmp r9, 0x12
jne 0x140014110
cmp qword [r15], rbx
jne 0x140014110
cmp qword [r15 + 8], r14
jne 0x140014110
movzx r9d, word [r15 + 0x10]
cmp r9d, 0x7473
jne 0x140014110
mov rax, qword [rsp]
movzx eax, word [rax + r11*2]
mov rcx, qword [rsp + 8]
mov eax, dword [rcx + rax*4]
mov dword [rdx], eax
mov al, 1
jmp 0x1400141c1
xor eax, eax
mov byte [rdx + 4], al
add rsp, 0x10
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1400141e0
Capabilities:
Enumerate pe sections
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x10
mov eax, dword [rcx + 0x3c]
cmp dword [rcx + rax + 0x8c], 0
je 0x14001441d
add rax, rcx
movzx r11d, word [rax + 6]
test r11, r11
je 0x14001441d
mov r8d, dword [rax + 0x88]
movzx r9d, word [rax + 0x14]
add rax, r9
add rax, 0x18
shl r11, 3
lea r10, [r11 + r11*4]
mov r9, rax
jmp 0x14001424e
add r9, 0x28
add r10, 0xffffffffffffffd8
je 0x14001441d
mov edi, dword [r9 + 0xc]
mov esi, r8d
sub esi, edi
jb 0x140014240
add edi, dword [r9 + 8]
cmp edi, r8d
jbe 0x140014240
add esi, dword [r9 + 0x14]
mov r8d, dword [rcx + rsi + 0x18]
mov r10d, dword [rcx + rsi + 0x1c]
lea rdi, [r11 + r11*4]
xor r12d, r12d
mov rbx, rax
jmp 0x14001428a
add rbx, 0x28
add rdi, 0xffffffffffffffd8
je 0x1400142a6
mov r9d, dword [rbx + 0xc]
mov r14d, r10d
sub r14d, r9d
jb 0x140014280
add r9d, dword [rbx + 8]
cmp r9d, r10d
jbe 0x140014280
add r14d, dword [rbx + 0x14]
mov r12, r14
add r12, rcx
mov edi, dword [rcx + rsi + 0x24]
lea rbx, [r11 + r11*4]
xor r10d, r10d
mov r14, rax
jmp 0x1400142ca
add r14, 0x28
add rbx, 0xffffffffffffffd8
je 0x1400142e6
mov r9d, dword [r14 + 0xc]
mov r15d, edi
sub r15d, r9d
jb 0x1400142c0
add r9d, dword [r14 + 8]
cmp r9d, edi
jbe 0x1400142c0
add r15d, dword [r14 + 0x14]
mov r10, r15
add r10, rcx
mov edi, dword [rcx + rsi + 0x20]
lea rbx, [r11 + r11*4]
xor esi, esi
mov r14, rax
jmp 0x14001430a
add r14, 0x28
add rbx, 0xffffffffffffffd8
je 0x140014326
mov r9d, dword [r14 + 0xc]
mov r15d, edi
sub r15d, r9d
jb 0x140014300
add r9d, dword [r14 + 8]
cmp r9d, edi
jbe 0x140014300
add r15d, dword [r14 + 0x14]
mov rsi, r15
test r8d, r8d
je 0x14001441d
mov qword [rsp], r10
mov qword [rsp + 8], r12
add rsi, rcx
lea rdi, [r11 + r11*4]
xor r11d, r11d
movabs rbx, 0x616974696e497350
movabs r14, 0x506d65747379536c
jmp 0x14001436c
inc r11
cmp r11, r8
je 0x14001441d
mov r9d, dword [rsi + r11*4]
mov r13, rdi
mov r15, rax
jmp 0x14001438a
add r15, 0x28
add r13, 0xffffffffffffffd8
je 0x1400143a6
mov r10d, dword [r15 + 0xc]
mov r12d, r9d
sub r12d, r10d
jb 0x140014380
add r10d, dword [r15 + 8]
cmp r10d, r9d
jbe 0x140014380
add r12d, dword [r15 + 0x14]
mov ebp, r12d
mov r9d, ebp
lea r15, [rcx + r9]
cmp byte [rcx + r9], 0
mov r9, r15
je 0x1400143ce
mov r10, r15
nop word [rax + rax]
lea r9, [r10 + 1]
cmp byte [r10 + 1], 0
mov r10, r9
jne 0x1400143c0
sub r9, r15
cmp r9, 0x16
jne 0x140014360
cmp qword [r15], rbx
jne 0x140014360
cmp qword [r15 + 8], r14
jne 0x140014360
cmp dword [r15 + 0x10], 0x65636f72
jne 0x140014360
movzx r9d, word [r15 + 0x14]
cmp r9d, 0x7373
jne 0x140014360
mov rax, qword [rsp]
movzx eax, word [rax + r11*2]
mov rcx, qword [rsp + 8]
mov eax, dword [rcx + rax*4]
mov dword [rdx], eax
mov al, 1
jmp 0x14001441f
xor eax, eax
mov byte [rdx + 4], al
add rsp, 0x10
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1400155f0
Capabilities:
Enumerate pe sections
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x10
mov eax, dword [rcx + 0x3c]
cmp dword [rcx + rax + 0x8c], 0
je 0x14001581e
add rax, rcx
movzx r8d, word [rax + 6]
test r8, r8
je 0x14001581e
mov r9d, dword [rax + 0x88]
movzx r10d, word [rax + 0x14]
add rax, r10
add rax, 0x18
shl r8, 3
lea r11, [r8 + r8*4]
mov r10, rax
jmp 0x14001565e
add r10, 0x28
add r11, 0xffffffffffffffd8
je 0x14001581e
mov edi, dword [r10 + 0xc]
mov esi, r9d
sub esi, edi
jb 0x140015650
add edi, dword [r10 + 8]
cmp edi, r9d
jbe 0x140015650
add esi, dword [r10 + 0x14]
mov r9d, dword [rcx + rsi + 0x18]
mov r11d, dword [rcx + rsi + 0x1c]
lea rdi, [r8 + r8*4]
xor r12d, r12d
mov rbx, rax
jmp 0x14001569a
add rbx, 0x28
add rdi, 0xffffffffffffffd8
je 0x1400156b6
mov r10d, dword [rbx + 0xc]
mov r14d, r11d
sub r14d, r10d
jb 0x140015690
add r10d, dword [rbx + 8]
cmp r10d, r11d
jbe 0x140015690
add r14d, dword [rbx + 0x14]
mov r12, r14
add r12, rcx
mov edi, dword [rcx + rsi + 0x24]
lea rbx, [r8 + r8*4]
xor r11d, r11d
mov r14, rax
jmp 0x1400156da
add r14, 0x28
add rbx, 0xffffffffffffffd8
je 0x1400156f6
mov r10d, dword [r14 + 0xc]
mov r15d, edi
sub r15d, r10d
jb 0x1400156d0
add r10d, dword [r14 + 8]
cmp r10d, edi
jbe 0x1400156d0
add r15d, dword [r14 + 0x14]
mov r11, r15
add r11, rcx
mov edi, dword [rcx + rsi + 0x20]
lea rbx, [r8 + r8*4]
xor esi, esi
mov r14, rax
jmp 0x14001571a
add r14, 0x28
add rbx, 0xffffffffffffffd8
je 0x140015736
mov r10d, dword [r14 + 0xc]
mov r15d, edi
sub r15d, r10d
jb 0x140015710
add r10d, dword [r14 + 8]
cmp r10d, edi
jbe 0x140015710
add r15d, dword [r14 + 0x14]
mov rsi, r15
test r9d, r9d
je 0x14001581e
mov qword [rsp], r11
mov qword [rsp + 8], r12
add rsi, rcx
lea rbx, [r8 + r8*4]
xor edi, edi
movabs r14, 0x6f72507465477350
jmp 0x14001576c
inc rdi
cmp rdi, r9
je 0x14001581e
mov r10d, dword [rsi + rdi*4]
mov r13, rbx
mov r15, rax
jmp 0x14001578a
add r15, 0x28
add r13, 0xffffffffffffffd8
je 0x1400157a6
mov r11d, dword [r15 + 0xc]
mov r12d, r10d
sub r12d, r11d
jb 0x140015780
add r11d, dword [r15 + 8]
cmp r11d, r10d
jbe 0x140015780
add r12d, dword [r15 + 0x14]
mov ebp, r12d
mov r10d, ebp
lea r15, [rcx + r10]
cmp byte [rcx + r10], 0
mov r10, r15
je 0x1400157ce
mov r11, r15
nop word [rax + rax]
lea r10, [r11 + 1]
cmp byte [r11 + 1], 0
mov r11, r10
jne 0x1400157c0
sub r10, r15
cmp r10, 0xf
jne 0x140015760
cmp qword [r15], r14
jne 0x140015760
cmp dword [r15 + 8], 0x73736563
jne 0x140015760
movzx r10d, word [r15 + 0xc]
cmp r10d, 0x6f4a
jne 0x140015760
cmp byte [r15 + 0xe], 0x62
jne 0x140015760
mov rcx, qword [rsp]
movzx ecx, word [rcx + rdi*2]
mov r9, qword [rsp + 8]
mov r9d, dword [r9 + rcx*4]
lea r8, [r8 + r8*4]
jmp 0x140015840
xor ecx, ecx
mov byte [rdx + 4], cl
add rsp, 0x10
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
add rax, 0x28
xor ecx, ecx
add r8, 0xffffffffffffffd8
je 0x140015820
mov r10d, dword [rax + 0xc]
mov ecx, r9d
sub ecx, r10d
jb 0x140015834
add r10d, dword [rax + 8]
cmp r10d, r9d
jbe 0x140015834
add ecx, dword [rax + 0x14]
mov dword [rdx], ecx
mov cl, 1
jmp 0x140015820
Function at 0x140021fc0
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, dword [rcx + 0x3c]
movzx r9d, word [rcx + rax + 6]
test r9, r9
je 0x14002201c
lea r10, [rcx + rax]
movzx eax, word [rcx + rax + 0x14]
add rax, r10
add rax, 0x18
shl r9, 3
lea rcx, [r9 + r9*4]
jmp 0x140021ffa
add rax, 0x28
add rcx, 0xffffffffffffffd8
je 0x14002201c
mov r10d, dword [rax + 0xc]
mov r9d, r8d
sub r9d, r10d
jb 0x140021ff0
add r10d, dword [rax + 8]
cmp r10d, r8d
jbe 0x140021ff0
add r9d, dword [rax + 0x14]
mov dword [rdx], r9d
mov al, 1
mov byte [rdx + 4], al
ret
xor eax, eax
mov byte [rdx + 4], al
ret
Function at 0x1400a16e0
Capabilities:
Hash data using fnv

Disassembly:
push rsi
mov r8d, edx
shr r8d, 0x10
mov eax, edx
shr eax, 0x18
movzx r9d, dl
movabs r10, 0xcbf29ce484222325
xor r10, r9
movabs r9, 0x100000001b3
imul r10, r9
movzx esi, dh
xor rsi, r10
imul rsi, r9
movzx r8d, r8b
xor r8, rsi
imul r8, r9
xor rax, r8
imul rax, r9
and rax, qword [0x140131228]
mov r10, qword [0x140131210]
mov r8, rax
shl r8, 4
mov r8, qword [r10 + r8 + 8]
mov r9, qword [0x140131200]
cmp r8, r9
je 0x1400a177f
cmp dword [r8 + 0x10], edx
je 0x1400a176f
add rax, rax
mov rax, qword [r10 + rax*8]
nop dword [rax + rax]
cmp r8, rax
je 0x1400a177f
mov r8, qword [r8 + 8]
cmp dword [r8 + 0x10], edx
jne 0x1400a1760
cmp r8, r9
je 0x1400a177f
mov rax, qword [r8 + 0x18]
mov qword [rcx], rax
mov al, 1
jmp 0x1400a1781
xor eax, eax
mov byte [rcx + 8], al
pop rsi
ret
Function at 0x1400cc370
Capabilities:
Hash data using fnv

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rbx, rdx
mov rsi, rcx
call fcn.1400d2bd0
test al, al
je 0x1400cc4a4
lea rcx, [rsi + 0x20]
mov rdx, qword [rsi + 0x18]
call fcn.1400d25e0
test al, al
je 0x1400cc4a4
movzx eax, word [0x14012fb5e]
lea rdi, [rax + rbx]
mov rdx, qword [0x14012f520]
add rax, rbx
add rax, 4
mov qword [rsp + 0x40], rax
mov r14, qword [0x14012f4d8]
mov eax, dword [0x14012f4e0]
mov rcx, qword [0x14012f4f0]
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], rax
shl rax, 3
lea rbx, [rax + rax*2]
lea rax, [rsp + 0x34]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x48]
lea rcx, [0x14012f448]
lea r9, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r15, rdx
mov r8, rdi
mov rbp, r9
call fcn.14000c5d0
test al, al
je 0x1400cc4a4
mov r13, qword [rsp + 0x48]
mov r12, qword [rsp + 0x40]
cmp r13, r12
cmovb r12, r13
sub r12, rdi
mov rdx, qword [rsp + 0x60]
mov rax, r12
add rax, rdx
jb 0x1400cc4a4
cmp dword [rsp + 0x58], 0
je 0x1400cc4a4
xor ecx, ecx
jmp 0x1400cc459
add rcx, 0x18
cmp rbx, rcx
je 0x1400cc4a4
cmp qword [r14 + rcx], rdx
ja 0x1400cc450
cmp rax, qword [r14 + rcx + 8]
ja 0x1400cc450
add rdx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x38]
mov rcx, rdi
mov r8, r12
call fcn.1400224e0
cmp qword [rsp + 0x40], r13
jbe 0x1400cc4b7
add rdi, r12
mov qword [rsp + 0x38], rdi
mov rdi, r13
mov rdx, r15
lea rax, [rsp + 0x48]
lea rcx, [0x14012f448]
mov r9, rbp
jmp 0x1400cc407
xor eax, eax
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov eax, dword [rsp + 0x34]
mov ecx, eax
shr ecx, 0x10
mov edx, eax
shr edx, 0x18
movzx r8d, al
movabs r9, 0xcbf29ce484222325
xor r9, r8
movabs r8, 0x100000001b3
imul r9, r8
movzx edi, ah
xor rdi, r9
imul rdi, r8
movzx ecx, cl
xor rcx, rdi
imul rcx, r8
xor rcx, rdx
imul rcx, r8
and rcx, qword [0x140131228]
mov r9, qword [0x140131210]
mov rdx, rcx
shl rdx, 4
mov rdx, qword [r9 + rdx + 8]
mov r8, qword [0x140131200]
cmp rdx, r8
je 0x1400cc579
cmp dword [rdx + 0x10], eax
je 0x1400cc541
add rcx, rcx
mov r9, qword [r9 + rcx*8]
xor ecx, ecx
cmp rdx, r9
je 0x1400cc57b
mov rdx, qword [rdx + 8]
cmp dword [rdx + 0x10], eax
jne 0x1400cc533
cmp rdx, r8
je 0x1400cc579
mov r8, qword [0x140131538]
test r8, r8
je 0x1400cc579
mov rax, qword [rdx + 0x18]
mov rcx, qword [0x140131530]
imul rdx, r8, 0x298
cmp qword [rcx], rax
je 0x1400cc57b
add rcx, 0x298
add rdx, 0xfffffffffffffd68
jne 0x1400cc564
xor ecx, ecx
mov qword [rsi + 0x78], rcx
mov al, 1
jmp 0x1400cc4a6