joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4665c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
test rbx, rbx
jbe 0x466737
movzx edx, byte [rax]
test edx, edx
jne 0x4665f4
nop dword [rax]
test r8b, r8b
jne 0x4665f4
xor eax, eax
xor ebx, ebx
mov rcx, rbx
xor edi, edi
add rsp, 0x10
pop rbp
ret
bt edx, 7
jae 0x466607
xor edx, edx
xor r8d, r8d
xor r9d, r9d
jmp 0x4666f7
mov r8d, 1
mov r9d, edx
and edx, 1
neg edx
shr r9d, 1
xor edx, r9d
add dword [rsi], edx
nop dword [rax]
cmp rbx, r8
jb 0x4666e5
sub rbx, r8
sub rcx, r8
mov rdx, rcx
neg rdx
sar rdx, 0x3f
and r8, rdx
lea rdx, [rax + r8]
test rbx, rbx
jbe 0x4666d7
movzx esi, byte [rax + r8]
bt esi, 7
jae 0x46665d
xor eax, eax
xor esi, esi
xor r8d, r8d
jmp 0x4666a0
mov eax, 1
cmp rax, rbx
ja 0x46668b
add qword [rdi], rsi
sub rcx, rax
sub rbx, rax
mov rsi, rcx
neg rsi
sar rsi, 0x3f
and rax, rsi
add rax, rdx
mov edi, 1
add rsp, 0x10
pop rbp
ret
mov rcx, rbx
call fcn.0046b6e0
lea r8d, [rcx + 7]
mov rcx, r11
mov eax, r12d
nop dword [rax]
cmp rax, rbx
jae 0x4666cf
movzx r9d, byte [rax + rdx]
mov r10d, r9d
and r9d, 0x7f
mov r11, rcx
mov ecx, r8d
shl r9d, cl
lea r12d, [rax + 1]
or esi, r9d
test r10b, 0x80
jne 0x466693
mov rcx, r11
mov eax, r12d
jmp 0x466662
mov rcx, rbx
call fcn.0046b620
xor eax, eax
mov rcx, rax
nop dword [rax]
call fcn.0046b620
mov eax, r8d
mov rcx, rbx
call fcn.0046b6e0
lea r9d, [rcx + 7]
mov rcx, r12
cmp rbx, rdx
jbe 0x46672d
movzx r10d, byte [rdx + rax]
mov r11d, r10d
and r10d, 0x7f
mov r12, rcx
mov ecx, r9d
shl r10d, cl
inc edx
or r8d, r10d
test r11b, 0x80
jne 0x4666f0
mov rcx, r12
mov r9d, edx
mov edx, r8d
mov r8d, r9d
jmp 0x46660d
mov eax, edx
mov rcx, rbx
call fcn.0046b620
xor eax, eax
mov rcx, rax
nop dword [rax]
call fcn.0046b620
nop
int3

Function at 0x467c40
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x467cef
push rbp
mov rbp, rsp
sub rsp, 0x58
mov qword [rsp + 0x70], rbx
lea rdx, [rsp + 0x68]
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rsi, [0x004551e0]
mov qword [rsp + 0x10], rsi
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdx
mov rdx, r14
mov qword [rsp + 0x28], rdx
lea rdx, [rsp + 8]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.00469240
xorps xmm15, xmm15
mov r14, qword [0x0057bc88]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
add rsp, 0x58
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00469360
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp fcn.00467c40
Function at 0x46b160
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x403a23
push rbp
mov rbp, rsp
sub rsp, 0x18
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
mov rax, rdx
call fcn.00409480
add rsp, 0x18
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00469360
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x403a00
cmp byte [0x0057ba6b], 0
je 0x46b175
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp 0x4683a0
jmp 0x403a00

Function at 0x46b180
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [0x0057bd48]
mov eax, dword [rax]
xor rcx, rax
xor rax, rbx
xor rax, qword [0x0057bd40]
mul rcx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d124b
mul rcx
xor rax, rdx
nop
nop
ret
cmp byte [0x0057ba6b], 0
je 0x46b1b5
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x0057c080]
aesenc xmm0, xmmword [0x0057c090]
aesenc xmm0, xmmword [0x0057c0a0]
movq rax, xmm0
ret
jmp 0x409660

Function at 0x46b1c0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [0x0057bd48]
mov rax, qword [rax]
xor rcx, rax
xor rax, rbx
xor rax, qword [0x0057bd40]
mul rcx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
xor rax, rdx
nop
nop
ret
cmp byte [0x0057ba6b], 0
je 0x46b1f6
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x0057c080]
aesenc xmm0, xmmword [0x0057c090]
aesenc xmm0, xmmword [0x0057c0a0]
movq rax, xmm0
ret
jmp 0x4096a0

Function at 0x46cf60
Capabilities:
Allocate thread local storage

Disassembly:
push rbp
mov rbp, rsp
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x46cf94
mov rcx, 0x28
jmp 0x46cf9f
shl rcx, 3
add rcx, 0x1480
mov qword [0x0057bc88], rcx
pop rbp
ret

Function at 0x4752c0
Capabilities:
Hash data using fnv

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4759ff
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
movabs rcx, 0xcbf29ce484222325
jmp 0x4752ed
lea rax, [rdx + 0x10]
dec rbx
mov rcx, rsi
test rbx, rbx
jle 0x475571
mov rdx, rax
mov rsi, qword [rax]
nop dword [rax]
test rsi, rsi
je 0x47559d
mov edi, dword [rsi + 0x10]
shr edi, 1
mov r8, qword [rax + 8]
and edi, 0x3f
lea rax, [0x004c2c00]
jmp qword [rax + rdi*8]
mov rax, rcx
add rsp, 0x10
pop rbp
ret
lea rax, [0x0048b060]
lea rbx, [0x004c1fe0]
call fcn.00463d00
inc rax
cmp rax, r8
jge 0x4755c2
mov r9, qword [rsi + rax*8]
xor r10d, r10d
nop
jmp 0x4755f7
lea rdi, [0x0048b0e0]
mov rsi, rcx
movabs rcx, 0x100000001b3
jmp 0x4752e3
movzx r11d, r9b
xor rcx, r11
inc r10
shr r9, 8
movabs r11, 0x100000001b3
imul rcx, r11
cmp r10, 8
jl 0x4755db
jmp 0x4755b0
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.00469360
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.004752c0
Function at 0x475ba0
Capabilities:
Hash data using fnv

Disassembly:
test byte [rax], al
mov rcx, rbx
and ebx, 0x7f
shl rbx, 5
lea rdx, [rax + rbx]
xor eax, eax
jmp 0x475bb7
inc rax
cmp rax, 4
jge 0x475bcf
lea rbx, [rdx + rax*8]
mov rbx, qword [rbx]
cmp rbx, rcx
jne 0x475bb4
mov eax, 1
ret
xor eax, eax
movabs rbx, 0xcbf29ce484222325
jmp 0x475be0
inc rax
cmp rax, 4
jge 0x475bee
mov rsi, qword [rdx + rax*8]
xor edi, edi
jmp 0x475c17
and ebx, 3
lea rdx, [rdx + rbx*8]
xchg qword [rdx], rcx
xor eax, eax
ret
movzx r8d, sil
xor rbx, r8
inc rdi
shr rsi, 8
movabs r8, 0x100000001b3
imul rbx, r8
cmp rdi, 8
jl 0x475bfb
jmp 0x475bdd

Function at 0x479ce0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x479daa
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call fcn.00402ae0
xorps xmm15, xmm15
mov r14, qword [0x0057bc88]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x479d8f
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x0048b160]
xor ebx, ebx
mov rcx, rdx
call fcn.00464e80
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call fcn.0047a2c0
inc rbx
cmp rcx, rbx
jae 0x479d7e
mov edi, 1
lea rsi, [0x0048b160]
call fcn.00464f60
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x004c2088]
lea rsi, [0x004c1c60]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00469360
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00479ce0
Function at 0x140001050
Capabilities:
Query or enumerate registry value

Disassembly:
and al, 0x34
mov bh, al
jle 0x140001057
mov r10d, r8d
add r10d, 0x19e8b5c2
mov dword [rsp + 0x3c], r10d
push rsp
and al, 0x3c
push rsp
and al, 0x3c
mov rdx, qword [sym.imp.SETUPAPI.dll_CM_Get_Sibling_Ex]
add byte [r8], r8b
call rdx
sub dword [rdx + 0x41], ebx
pop rax
mov edx, 0x28eaaa5e
js 0x1400010b0
jp 0x14000103e
xchg rcx, rax
movabs eax, dword [0x9133b2890c2bf9c2]
or al, 0x89
mov dl, 0x33
xchg ecx, eax
sub r10d, esi
mov byte [rsp + 0x4f], 0x3e
and r11d, r10d
mov rdx, rcx
add rdx, 0x5757ebcd
mov qword [rsp + 0x40], rdx
mov r10d, dword [rsp + 0x34]
mov qword [rsp + 0x40], 0x7b07d483
mov dil, bl
add dil, 0xde
add r10d, 0xec813878
mov byte [rsp + 0x4f], dil
mov esi, dword [rsp + 0x34]
xor esi, 0xec813876
mov word [rsp + 0x3a], r9w
mov dword [rsp + 0x30], esi
cmp r11d, r10d
mov word [rsp + 0x22], r9w
mov qword [rsp + 0x18], rcx
mov dword [rsp + 0x14], r8d
mov qword [rsp + 8], rax
mov byte [rsp + 7], bl
jne 0x14000125c

Function at 0x1400011d4
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [rsp + 0x34]
add ecx, 0xec813878
mov dword [rsp + 0x3c], 0xa5f8a0f
sub eax, edx
mov r8, qword [sym.imp.SETUPAPI.dll_CM_Get_Sibling_Ex]
add byte [rax], al
call r8
sub dword [rdx + 0x41], ebx
pop rax
mov edx, 0x28eaaa5e
js 0x14000122d
jp 0x1400011bb
xchg rcx, rax
movabs eax, dword [0x9133b2890c2bf9c2]
invalid
mov dword [rsp + 0x3c], r10d
mov r10d, dword [rsp + 0x28]
mov r8, qword [rsp + 0x18]
sub r8, r8
and r10d, edx
mov qword [rsp + 0x40], r8
mov dword [rsp + 0x30], eax
imul r11w, r9w, 0x5ae8
mov word [rsp + 0x3a], r11w
cmp r10d, ecx
je 0x14000126d

Function at 0x1400011dc
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [rsp + 0x34]
add ecx, 0xec813878
mov dword [rsp + 0x3c], 0xa5f8a0f
sub eax, edx
mov r8, qword [sym.imp.SETUPAPI.dll_CM_Get_Sibling_Ex]
add byte [rax], al
call r8
sub dword [rdx + 0x41], ebx
pop rax
mov edx, 0x28eaaa5e
js 0x14000122d
jp 0x1400011bb
xchg rcx, rax
movabs eax, dword [0x9133b2890c2bf9c2]
invalid
mov dword [rsp + 0x3c], r10d
mov r10d, dword [rsp + 0x28]
mov r8, qword [rsp + 0x18]
sub r8, r8
and r10d, edx
mov qword [rsp + 0x40], r8
mov dword [rsp + 0x30], eax
imul r11w, r9w, 0x5ae8
mov word [rsp + 0x3a], r11w
cmp r10d, ecx
je 0x14000126d
Function at 0x140001400
Capabilities:
Query or enumerate registry value

Disassembly:
jmp 0x14000126d
mov eax, 0x137ec789
mov ecx, 0x137ec790
mov dx, word [rsp + 0x22]
add dx, 0xcad4
mov word [rsp + 0x3a], dx
mov r8d, dword [rsp + 0x34]
mov r9d, dword [rsp + 0x24]
mov byte [rsp + 0x4f], 0xc1
mov r10b, byte [rsp + 7]
or r10b, 0x62
sub ecx, r8d
mov r8d, dword [rsp + 0x34]
mov byte [rsp + 0x4f], r10b
mov r11d, dword [rsp + 0x34]
mov dx, word [rsp + 0x22]
mov word [rsp + 0x3a], dx
mov esi, dword [rsp + 0x34]
add r11d, 0x7294cc91
mov qword [rsp + 0x40], 0x30235020
add r8d, 0xec813878
mov edi, dword [rsp + 0x14]
xor edi, 0xc8368af
sub eax, esi
and r9d, eax
mov dword [rsp + 0x3c], edi
cmp r9d, r8d
cmove ecx, r11d
mov dword [rsp + 0x30], ecx
jmp 0x14000125c
mov eax, dword [rsp + 0x30]
mov byte [rsp + 0x4f], 0x2a
add rsp, 0x50
pop rdi
pop rbx
pop rsi
ret
mov eax, 0x137ec788
jle 0x140001285
mov cx, word [rsp + 0x22]
and cx, 0x6e7d
mov word [rsp + 0x3a], cx
sub eax, dword [rsp + 0x34]
mov rdx, qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
call rdx
sub dword [rdx + 0x41], ebx
pop rax
mov edx, 0x28eaaa5e
js 0x1400012e2
jp 0x140001270
xchg rcx, rax
movabs eax, dword [0x9133b2890c2bf9c2]
invalid
xor ebp, dword [rcx]
enter 0xffffffffffff8966, 0x54
and al, 0x3a
mov ecx, dword [rsp + 0x34]
and al, 0x34
mov r8d, dword [rsp + 0x34]
xor ecx, 0x137ec788
add r8d, 0xec813874
mov r9, qword [sym.imp.ADVAPI32.dll_SaferCreateLevel]
call r9
sub dword [rdx + 0x41], ebx
pop rax
mov edx, 0x28eaaa5e
js 0x14000135e
jp 0x1400012ec
xchg rcx, rax
movabs eax, dword [0x9133b2890c2bf9c2]
invalid
xor byte [rcx], bh
enter 0xffffffffffff850f, 0xfffffffffffffff5
invalid
jle 0x1400013f0
sbb dh, bh
mov ah, 0x8c
jbe 0x1400013ad
mov ch, 0x89
and al, 0x28
mov cl, byte [rsp + 7]
xor cl, 0xff
mov byte [rsp + 0x4f], cl
mov rax, qword [sym.imp.COMDLG32.dll_GetSaveFileNameW]
mov rax, qword [sym.imp.COMDLG32.dll_GetSaveFileNameW]
call rax
sub dword [rdx + 0x41], ebx
pop rax
mov edx, 0x28eaaa5e
js 0x14000140b
jp 0x140001399
xchg rcx, rax
movabs eax, dword [0x9133b2890c2bf9c2]
invalid
or al, byte [rbx + rcx*4 + 0x44]
and al, 0x14
sub edx, r8d
mov r9d, dword [rsp + 0x28]
mov dword [rsp + 0x3c], edx
and al, 0x3c
mov r10b, byte [rsp + 0x39]
mov r11w, word [rsp + 0x22]
and al, 0x22
mov word [rsp + 0x3a], r11w
xor r10b, 0x28
mov byte [rsp + 0x4f], 0x18
mov bl, byte [rsp + 0x39]
mov rax, qword [rsp + 0x18]
xor rax, 0xffffffffffffffff
mov qword [rsp + 0x40], rax
sub cl, bl
mov qword [rsp + 0x40], 0x653db2c4
mov dword [rsp + 0x24], r9d
mov byte [rsp + 0x2f], cl
mov cl, byte [rsp + 0x2f]
add r8d, 0x35fa766d
shr byte [rbp + 0x76], 0xfa
xor eax, 0x24448944
cmp al, 0x41
cmp dl, cl
je 0x140001122
jmp 0x140001127

Function at 0x140001c68
Capabilities:
Encode data using xor

Disassembly:
add byte [rax], al
add byte [rax - 0x77], cl
mov ah, 0x24
rol byte [rax], 1
add byte [rax], al

Function at 0x1400029c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rdi
push rbx
push rsi
sub rsp, 0x120
mov eax, 0x835c3300
mov r8w, word [rsp + 0x11e]
mov qword [rsp + 0x108], 0x2e385974
mov r9, qword [rsp + 0x110]
mov r10, r9
xor r10, r10
mov qword [rsp + 0x110], r10
mov word [rsp + 0x102], 0x5e46
Function at 0x140005990
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbp
push rsi
push rbx
push rdi
push r14
sub rsp, 0x90
mov al, 0xae
mov r9b, byte [rsp + 0x8f]
or r9b, 0xe1
mov byte [rsp + 0x8f], r9b
mov dword [rsp + 0x88], 0x38cf644d
mov r10, qword [rsp + 0x80]
mov r11, r10
or r11, 0x3f99e541
mov qword [rsp + 0x80], r11
mov qword [rsp + 0x70], 0x2fdc4654
mov byte [rsp + 0x6f], 0xc8
mov si, word [rsp + 0x8c]
mov r9b, byte [rsp + 0x6f]
add r9b, 0x9c
mov edi, dword [rsp + 0x7c]
mov ebx, edi
or ebx, 0x7fad6b24
mov dword [rsp + 0x7c], ebx
mov byte [rsp + 0x6e], r9b

Function at 0x140005a0c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov word [rsp + 0x8c], si
mov r9b, byte [rsp + 0x6f]
mov bp, si
imul bp, bp
mov r14b, byte [rsp + 0x6e]
mov word [rsp + 0x8c], bp
sub al, r9b
mov ebx, edi
add ebx, ebx
mov dword [rsp + 0x7c], ebx
mov qword [rsp + 0x80], r10
cmp al, r14b
mov qword [rsp + 0x28], rdx

Function at 0x140005a48
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [rsp + 0x24], r8d
mov qword [rsp + 0x18], rcx
mov dword [rsp + 0x14], edi
mov qword [rsp + 8], r10
mov word [rsp + 6], si
ja 0x140005db3
mov eax, 0x38cf646d
mov ecx, dword [rsp + 0x88]
invalid
invalid

Function at 0x140005a8c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [rsp + 0x7c], r10d
sub eax, ecx
mov r11b, byte [rsp + 0x45]
mov ecx, dword [rsp + 0x14]
add ecx, 0x20a4cf69
mov dword [rsp + 0x7c], ecx
sub r9b, r11b
mov rdx, qword [rsp + 8]
mov qword [rsp + 0x80], rdx
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x18]
mov byte [rdi + rsi], r9b
mov ecx, dword [rsp + 0x68]
mov bx, word [rsp + 6]
sub bx, 0xae7d
mov word [rsp + 0x8c], bx
add ecx, eax
mov dword [rsp + 0x7c], 0xdfb89062
mov dword [rsp + 0x3c], ecx
mov eax, dword [rsp + 0x24]
cmp ecx, eax
jb 0x140005b4c
jmp 0x140005d8c
Function at 0x140005b34
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add rsp, 0x90
pop r14
pop rdi
pop rbx
pop rsi
pop rbp
ret
mov eax, 0x2fdc4655
mov ecx, eax
mov rdx, qword [rsp + 0x70]
mov r8, qword [rsp + 0x58]
sub rcx, qword [rsp + 0x70]
xor rdx, 0x2fdc4674
mov word [rsp + 0x8c], 0x54f2
add r8, rcx
mov dword [rsp + 0x7c], 0x6cce6847
insb byte [rdi], dx
mov qword [rsp + 0x60], r8
mov eax, dword [rsp + 0x14]
mov dword [rsp + 0x7c], eax
cmp r8, rdx
je 0x140005af5
jmp 0x140005c64
mov eax, 0x3da982dd
lea rcx, str.C_f
mov dl, 0x78
mov r8d, 0x58943981
mov r9d, dword [rsp + 0x14]
or r9d, 0x72d5c78b
mov eax, edi
invalid
jb 0x140005bb1
mov edx, dword [rsp + 0x88]
xor r10d, 0x38cf6452
mov dword [rsp + 0x7c], r9d
mov r9d, dword [rsp + 0x14]
sub r8d, r9d
mov r11d, dword [rsp + 0x3c]
mov dword [rsp + 0x7c], r8d
mov dword [rsp + 0x68], r11d
pop rsp
and al, 0x68
mov rsi, qword [rsp + 8]
and rsi, 0x630db303
mov qword [rsp + 0x80], rsi
and r10d, dword [rsp + 0x68]
mov rsi, qword [rsp + 8]
xor rsi, 0xffffffffffffffff
mov qword [rsp + 0x80], rsi
mov rsi, qword [rsp + 8]
imul rdi, rsi, 0x7a874292
sub dl, byte [rsp + 0x6f]
mov r8d, r10d
mov ebx, r8d
mov r8d, dword [rsp + 0x88]
add r8d, 0xf654ef32
mov qword [rsp + 0x80], rdi
mov byte [rsp + 0x46], dl
mov dl, byte [rsp + 0x46]
mov word [rsp + 0x8c], 0x6bfd
mov byte [rsp + 0x47], dl
mov bp, word [rsp + 6]
and bp, 0xac53
mov word [rsp + 0x8c], bp
mov dl, byte [rcx + rbx]
mov byte [rsp + 0x45], dl
mov bp, word [rsp + 6]
imul r14w, bp, 0x6424
mov word [rsp + 0x8c], r14w
mov r10d, dword [rsp + 0x88]
mov byte [rsp + 0x8f], 0xdc
sub eax, r10d
mov dword [rsp + 0x40], r8d
add r9d, r9d
mov r8d, dword [rsp + 0x40]
mov dword [rsp + 0x7c], r9d
cmp eax, r8d
jae 0x140005af5
jmp 0x140005d19
mov r8, qword [rsp + 8]
imul r9, r8, 0x368fec9b
mov qword [rsp + 0x80], r9
mov cx, word [rsp + 6]
xor cx, 0xffff
mov word [rsp + 0x8c], cx
mov r10d, dword [rax + rdx*4]
mov dword [rsp + 0x54], r10d
mov cx, word [rsp + 6]
or cx, cx
mov r10d, dword [rsp + 0x54]
mov word [rsp + 0x8c], cx
mov r11d, dword [rsp + 0x24]
cmp r10d, r11d
jae 0x140005d8c
invalid
mov ax, word [rsp + 6]
mov word [rsp + 0x8c], ax
mov ecx, dword [rsp + 0x54]
mov dword [rsp + 0x3c], ecx
mov ecx, dword [rsp + 0x14]
or ecx, 0x14748706
mov dword [rsp + 0x7c], ecx
jmp 0x140005b4c
mov dword [rsp + 0x7c], 0x4841ef93
mov eax, dword [rsp + 0x68]
mov byte [rsp + 0x8f], 8
mov ecx, dword [rsp + 0x88]
mov edx, dword [rsp + 0x14]
xor edx, 0xffffffff
mov dword [rsp + 0x7c], edx
add ecx, 0x3ce76703
mov r8w, word [rsp + 6]
sub r8w, 0x749
mov word [rsp + 0x8c], r8w
mov r9b, byte [rsp + 0x6f]
xor r9b, 0x8b
mov eax, eax
mov r10d, eax
mov byte [rsp + 0x8f], 0xa8
mov qword [rsp + 0x48], r10
mov r11b, byte [rsp + 0x47]
mov dword [rsp + 0x3c], ecx
cmp r11b, r9b
je 0x140005b4c
jmp 0x140005a66
mov eax, 0x39c818e7
mov ecx, eax
sub rcx, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x30]
mov qword [rsp + 0x80], 0x4114949
cmp rdx, rcx
jb 0x140005d8c
jmp 0x140005b03
Function at 0x140005ca0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add rsp, 0x90
pop r14
pop rdi
pop rbx
pop rsi
pop rbp
ret
mov eax, 0x2fdc4655
mov ecx, eax
mov rdx, qword [rsp + 0x70]
mov r8, qword [rsp + 0x58]
sub rcx, qword [rsp + 0x70]
xor rdx, 0x2fdc4674
mov word [rsp + 0x8c], 0x54f2
add r8, rcx
mov dword [rsp + 0x7c], 0x6cce6847
insb byte [rdi], dx
mov qword [rsp + 0x60], r8
mov eax, dword [rsp + 0x14]
mov dword [rsp + 0x7c], eax
cmp r8, rdx
je 0x140005af5
jmp 0x140005c64
mov eax, 0x3da982dd
lea rcx, str.C_f
mov dl, 0x78
mov r8d, 0x58943981
mov r9d, dword [rsp + 0x14]
or r9d, 0x72d5c78b
mov eax, edi
invalid
jb 0x140005bb1
mov edx, dword [rsp + 0x88]
xor r10d, 0x38cf6452
mov dword [rsp + 0x7c], r9d
mov r9d, dword [rsp + 0x14]
sub r8d, r9d
mov r11d, dword [rsp + 0x3c]
mov dword [rsp + 0x7c], r8d
mov dword [rsp + 0x68], r11d
pop rsp
and al, 0x68
mov rsi, qword [rsp + 8]
and rsi, 0x630db303
mov qword [rsp + 0x80], rsi
and r10d, dword [rsp + 0x68]
mov rsi, qword [rsp + 8]
xor rsi, 0xffffffffffffffff
mov qword [rsp + 0x80], rsi
mov rsi, qword [rsp + 8]
imul rdi, rsi, 0x7a874292
sub dl, byte [rsp + 0x6f]
mov r8d, r10d
mov ebx, r8d
mov r8d, dword [rsp + 0x88]
add r8d, 0xf654ef32
mov qword [rsp + 0x80], rdi
mov byte [rsp + 0x46], dl
mov dl, byte [rsp + 0x46]
mov word [rsp + 0x8c], 0x6bfd
mov byte [rsp + 0x47], dl
mov bp, word [rsp + 6]
and bp, 0xac53
mov word [rsp + 0x8c], bp
mov dl, byte [rcx + rbx]
mov byte [rsp + 0x45], dl
mov bp, word [rsp + 6]
imul r14w, bp, 0x6424
mov word [rsp + 0x8c], r14w
mov r10d, dword [rsp + 0x88]
mov byte [rsp + 0x8f], 0xdc
sub eax, r10d
mov dword [rsp + 0x40], r8d
add r9d, r9d
mov r8d, dword [rsp + 0x40]
mov dword [rsp + 0x7c], r9d
cmp eax, r8d
jae 0x140005af5
jmp 0x140005d19
mov r8, qword [rsp + 8]
imul r9, r8, 0x368fec9b
mov qword [rsp + 0x80], r9
mov cx, word [rsp + 6]
xor cx, 0xffff
mov word [rsp + 0x8c], cx
mov r10d, dword [rax + rdx*4]
mov dword [rsp + 0x54], r10d
mov cx, word [rsp + 6]
or cx, cx
mov r10d, dword [rsp + 0x54]
mov word [rsp + 0x8c], cx
mov r11d, dword [rsp + 0x24]
cmp r10d, r11d
jae 0x140005d8c
invalid
mov ax, word [rsp + 6]
mov word [rsp + 0x8c], ax
mov ecx, dword [rsp + 0x54]
mov dword [rsp + 0x3c], ecx
mov ecx, dword [rsp + 0x14]
or ecx, 0x14748706
mov dword [rsp + 0x7c], ecx
jmp 0x140005b4c
mov dword [rsp + 0x7c], 0x4841ef93
mov eax, dword [rsp + 0x68]
mov byte [rsp + 0x8f], 8
mov ecx, dword [rsp + 0x88]
mov edx, dword [rsp + 0x14]
xor edx, 0xffffffff
mov dword [rsp + 0x7c], edx
add ecx, 0x3ce76703
mov r8w, word [rsp + 6]
sub r8w, 0x749
mov word [rsp + 0x8c], r8w
mov r9b, byte [rsp + 0x6f]
xor r9b, 0x8b
mov eax, eax
mov r10d, eax
mov byte [rsp + 0x8f], 0xa8
mov qword [rsp + 0x48], r10
mov r11b, byte [rsp + 0x47]
mov dword [rsp + 0x3c], ecx
cmp r11b, r9b
je 0x140005b4c
jmp 0x140005a66
mov eax, 0x39c818e7
mov ecx, eax
sub rcx, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x30]
mov qword [rsp + 0x80], 0x4114949
cmp rdx, rcx
jb 0x140005d8c
jmp 0x140005b03
Function at 0x140005cf0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add rsp, 0x90
pop r14
pop rdi
pop rbx
pop rsi
pop rbp
ret
mov eax, 0x2fdc4655
mov ecx, eax
mov rdx, qword [rsp + 0x70]
mov r8, qword [rsp + 0x58]
sub rcx, qword [rsp + 0x70]
xor rdx, 0x2fdc4674
mov word [rsp + 0x8c], 0x54f2
add r8, rcx
mov dword [rsp + 0x7c], 0x6cce6847
insb byte [rdi], dx
mov qword [rsp + 0x60], r8
mov eax, dword [rsp + 0x14]
mov dword [rsp + 0x7c], eax
cmp r8, rdx
je 0x140005af5
jmp 0x140005c64
mov eax, 0x3da982dd
lea rcx, str.C_f
mov dl, 0x78
mov r8d, 0x58943981
mov r9d, dword [rsp + 0x14]
or r9d, 0x72d5c78b
mov eax, edi
invalid
jb 0x140005bb1
mov edx, dword [rsp + 0x88]
xor r10d, 0x38cf6452
mov dword [rsp + 0x7c], r9d
mov r9d, dword [rsp + 0x14]
sub r8d, r9d
mov r11d, dword [rsp + 0x3c]
mov dword [rsp + 0x7c], r8d
mov dword [rsp + 0x68], r11d
pop rsp
and al, 0x68
mov rsi, qword [rsp + 8]
and rsi, 0x630db303
mov qword [rsp + 0x80], rsi
and r10d, dword [rsp + 0x68]
mov rsi, qword [rsp + 8]
xor rsi, 0xffffffffffffffff
mov qword [rsp + 0x80], rsi
mov rsi, qword [rsp + 8]
imul rdi, rsi, 0x7a874292
sub dl, byte [rsp + 0x6f]
mov r8d, r10d
mov ebx, r8d
mov r8d, dword [rsp + 0x88]
add r8d, 0xf654ef32
mov qword [rsp + 0x80], rdi
mov byte [rsp + 0x46], dl
mov dl, byte [rsp + 0x46]
mov word [rsp + 0x8c], 0x6bfd
mov byte [rsp + 0x47], dl
mov bp, word [rsp + 6]
and bp, 0xac53
mov word [rsp + 0x8c], bp
mov dl, byte [rcx + rbx]
mov byte [rsp + 0x45], dl
mov bp, word [rsp + 6]
imul r14w, bp, 0x6424
mov word [rsp + 0x8c], r14w
mov r10d, dword [rsp + 0x88]
mov byte [rsp + 0x8f], 0xdc
sub eax, r10d
mov dword [rsp + 0x40], r8d
add r9d, r9d
mov r8d, dword [rsp + 0x40]
mov dword [rsp + 0x7c], r9d
cmp eax, r8d
jae 0x140005af5
jmp 0x140005d19
mov r8, qword [rsp + 8]
imul r9, r8, 0x368fec9b
mov qword [rsp + 0x80], r9
mov cx, word [rsp + 6]
xor cx, 0xffff
mov word [rsp + 0x8c], cx
mov r10d, dword [rax + rdx*4]
mov dword [rsp + 0x54], r10d
mov cx, word [rsp + 6]
or cx, cx
mov r10d, dword [rsp + 0x54]
mov word [rsp + 0x8c], cx
mov r11d, dword [rsp + 0x24]
cmp r10d, r11d
jae 0x140005d8c
invalid
mov ax, word [rsp + 6]
mov word [rsp + 0x8c], ax
mov ecx, dword [rsp + 0x54]
mov dword [rsp + 0x3c], ecx
mov ecx, dword [rsp + 0x14]
or ecx, 0x14748706
mov dword [rsp + 0x7c], ecx
jmp 0x140005b4c
mov dword [rsp + 0x7c], 0x4841ef93
mov eax, dword [rsp + 0x68]
mov byte [rsp + 0x8f], 8
mov ecx, dword [rsp + 0x88]
mov edx, dword [rsp + 0x14]
xor edx, 0xffffffff
mov dword [rsp + 0x7c], edx
add ecx, 0x3ce76703
mov r8w, word [rsp + 6]
sub r8w, 0x749
mov word [rsp + 0x8c], r8w
mov r9b, byte [rsp + 0x6f]
xor r9b, 0x8b
mov eax, eax
mov r10d, eax
mov byte [rsp + 0x8f], 0xa8
mov qword [rsp + 0x48], r10
mov r11b, byte [rsp + 0x47]
mov dword [rsp + 0x3c], ecx
cmp r11b, r9b
je 0x140005b4c
jmp 0x140005a66
mov eax, 0x39c818e7
mov ecx, eax
sub rcx, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x30]
mov qword [rsp + 0x80], 0x4114949
cmp rdx, rcx
jb 0x140005d8c
jmp 0x140005b03