joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140005950
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x140020040]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x14000597d
xor eax, eax
jmp 0x140005ae9
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x1400059b7
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x1400059b7
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x140005ae9
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x140005adc
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x1400059fa
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140005a25
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140005ae1
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140005a94
sub eax, 1
je 0x140005a94
cmp eax, 2
jne 0x140005adc
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140005ae1
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x140005ac2
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x140005adc
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x140005ae1
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140006f20
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x140006010
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140020040]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x1400060e3
cmp byte [rcx + 0x71], 0
je 0x1400060e3
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x1400060df
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1400060a4
sub eax, 1
je 0x1400060a8
cmp eax, 2
jne 0x1400060df
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140006f20
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x1400060d6
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x1400060df
cmp byte [rbx + 0x71], 0
sete al
jmp 0x14000608c
xor al, al
jmp 0x14000608c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140006f20
add rsp, 0x60
pop rbx
ret

Function at 0x1400078a0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400078ea
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400078ea
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400078ea
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400078ea
cmp dword [rcx + 0x84], 0xe
jbe 0x1400078ea
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400078ec
xor al, al
add rsp, 0x28
ret
Function at 0x10022e0
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
lea rdi, [0x010013f0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
test rax, rax
jne 0x100231b
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
jne 0x100231b
or eax, 0xffffffff
jmp 0x10024e8
lea rdx, [0x01001400]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x01007ff0], rax
test rax, rax
jne 0x100236f
lea rdx, [0x01001418]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x01007ff0], rax
test rax, rax
jne 0x100236f
lea rdx, [0x01001430]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x01007ff0], rax
test rax, rax
je 0x10023e5
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
test rax, rax
jne 0x1002391
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
je 0x1002313
lea rdx, [0x01001448]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x01007ff8], rax
test rax, rax
jne 0x10023ef
lea rdx, [0x01001460]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x01007ff8], rax
test rax, rax
jne 0x10023ef
lea rdx, [0x01001478]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x01007ff8], rax
test rax, rax
jne 0x10023ef
mov eax, 0xfffffff4
jmp 0x10024e8
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
test rax, rax
jne 0x1002415
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
je 0x1002313
lea rdx, [0x01001490]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x01008000], rax
test rax, rax
jne 0x100246d
lea rdx, [0x010014a8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x01008000], rax
test rax, rax
jne 0x100246d
lea rdx, [0x010014c0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x01008000], rax
test rax, rax
je 0x10023e5
lea rcx, [0x010014d8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
test rax, rax
jne 0x1002497
lea rcx, [0x010014d8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
je 0x10024e6
lea rdx, [0x010014e8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x01008008], rax
test rax, rax
jne 0x10024e6
lea rdx, [0x010014f8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x01008008], rax
test rax, rax
jne 0x10024e6
lea rdx, [0x01001508]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x01008008], rax
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x10024fc
Capabilities:
Write file on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rcx
mov qword [r11 + 0x10], rdx
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x20], r9
sub rsp, 0x158
mov rax, qword [0x01007100]
xor rax, rsp
mov qword [rsp + 0x140], rax
or r8, 0xffffffffffffffff
lea rax, [r11 + 0x10]
cmp qword [0x01007420], r8
je 0x1002587
mov r9, rcx
lea rcx, [rsp + 0x41]
mov edx, 0xff
mov byte [rsp + 0x40], 0
mov qword [rsp + 0x20], rax
call fcn.01004220
test eax, eax
jns 0x1002566
mov byte [rsp + 0x13f], 0
mov eax, 0xfe
mov rcx, qword [0x01007420]
and qword [rsp + 0x20], 0
lea r8d, [rax + 2]
lea r9, [rsp + 0x30]
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.010040a0
add rsp, 0x158
ret

Function at 0x10025a8
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov byte [rax + 8], cl
sub rsp, 0x38
mov rcx, qword [0x01007420]
and qword [rax - 0x18], 0
lea r9, [rax + 0x10]
lea rdx, [rax + 8]
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_WriteFile]
add rsp, 0x38
ret

Function at 0x10025e0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov dword [rsp + 0x18], r8d
mov byte [rsp + 8], cl
push rbx
sub rsp, 0x50
mov rbx, rdx
test rdx, rdx
je 0x100272d
xor edx, edx
lea rcx, [rsp + 0x30]
lea r8d, [rdx + 0x20]
call sub.msvcrt.dll_memset
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [rsp + 0x48], rax
test rax, rax
jne 0x1002637
lea rcx, [0x01001518]
call fcn.010024fc
jmp 0x100272d
mov rcx, qword [0x01007420]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x70]
mov r8d, 0x200
mov rdx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x100266c
lea rcx, [0x01001538]
jmp 0x1002707
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x100268b
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x01001558]
jmp 0x100271b
mov rcx, qword [0x01007420]
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x68]
lea rdx, [rsp + 0x60]
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rsp + 0x48]
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x68], eax
test eax, eax
jne 0x10026f9
mov rcx, qword [0x01007420]
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0x30]
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
je 0x10026f5
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x70]
jmp 0x1002730
mov eax, dword [rsp + 0x68]
cmp eax, 0x102
jne 0x100270e
lea rcx, [0x01001578]
call fcn.010024fc
jmp 0x1002722
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x01001598]
mov edx, eax
call fcn.010024fc
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
or eax, 0xffffffff
add rsp, 0x50
pop rbx
ret
Function at 0x1003dec
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rsi
mov qword [rsp + 0x10], rdi
mov qword [rsp + 0x18], r12
push r13
sub rsp, 0x30
mov rax, qword gs:[0x30]
mov rdi, qword [rax + 8]
xor r12d, r12d
xor eax, eax
lock cmpxchg qword [0x01008030], rdi
je 0x1003e3a
cmp rax, rdi
jne 0x1003e2d
mov edi, 1
mov r12d, edi
jmp 0x1003e3f
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1003e11
mov edi, 1
mov eax, dword [0x01008028]
cmp eax, edi
jne 0x1003e55
mov ecx, 0x1f
call sub.msvcrt.dll__amsg_exit
jmp 0x1003eb2
mov eax, dword [0x01008028]
test eax, eax
jne 0x1003eac
mov dword [0x01008028], edi
lea r13, [0x01001300]
lea rsi, [0x010012e8]
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], eax
cmp rsi, r13
jae 0x1003e9e
test eax, eax
jne 0x1003e9e
mov rcx, qword [rsi]
test rcx, rcx
je 0x1003e93
call rcx
mov dword [rsp + 0x20], eax
add rsi, 8
mov qword [rsp + 0x28], rsi
jmp 0x1003e7c
test eax, eax
je 0x1003eb2
mov eax, 0xff
jmp 0x1003f84
mov dword [0x0100746c], edi
mov eax, dword [0x01008028]
cmp eax, edi
jne 0x1003ed9
lea rdx, [0x010012e0]
lea rcx, [0x010012d0]
call sub.msvcrt.dll__initterm
mov dword [0x01008028], 2
test r12d, r12d
jne 0x1003ee7
xor eax, eax
xchg qword [0x01008030], rax
cmp qword [0x01008038], 0
je 0x1003f10
lea rcx, [0x01008038]
call fcn.010043ec
test eax, eax
je 0x1003f10
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
call qword [0x01008038]
mov r8, qword [0x01007450]
mov rdx, qword [0x01007458]
mov ecx, dword [0x01007448]
call fcn.010036e4
mov dword [0x01007468], eax
cmp dword [0x0100744c], 0
jne 0x1003f40
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x0100746c], 0
jne 0x1003f55
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x01007468]
jmp 0x1003f84
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov r12, qword [rsp + 0x50]
add rsp, 0x30
pop r13
ret
sub rsp, 0x28
call fcn.01177000
add rsp, 0x28
jmp 0x1003dec
Function at 0x10040a0
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x01007100]
jne 0x10040bb
rol rcx, 0x10
test cx, 0xffff
jne 0x10040b7
ret 0
ror rcx, 0x10
jmp 0x10045bc
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x01007520]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x01007618]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x1004641
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x01007520]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x1004663
mov rax, qword [rsp + 0x88]
mov qword [0x01007618], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x010075b8], rax
mov rax, qword [0x01007618]
mov qword [0x01007490], rax
mov rax, qword [rsp + 0x90]
mov qword [0x010075a0], rax
mov dword [0x01007480], 0xc0000409
mov dword [0x01007484], 1
mov rax, qword [0x01007100]
mov qword [rsp + 0x68], rax
mov rax, qword [0x01007108]
mov qword [rsp + 0x70], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x01001368]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret

Function at 0x10040c8
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x530
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rbx, qword [rsp + 0x158]
lea rdx, [rsp + 0x40]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_RtlLookupFunctionEntry]
test rax, rax
je 0x1004133
and qword [rsp + 0x38], 0
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x50]
mov r9, rax
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x60]
mov r8, rbx
mov qword [rsp + 0x20], rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RtlVirtualUnwind]
jmp 0x1004153
mov rax, qword [rsp + 0x538]
mov qword [rsp + 0x158], rax
lea rax, [rsp + 0x538]
mov qword [rsp + 0xf8], rax
lea rcx, [0x01001330]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add rsp, 0x530
pop rbx
ret

Function at 0x1004458
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
cmp rcx, rdx
je 0x10044a5
cmp rcx, 0xffffffffffffffff
je 0x10044a5
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x100449d
cmp dword [rcx + 0x3c], edx
jl 0x100449d
cmp dword [rcx + 0x3c], 0x10000000
jae 0x100449d
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x10044a5
mov rax, rdx
add rsp, 0x18
ret
Function at 0x140006a98
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140006ae2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140006ae2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140006ae2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140006ae2
cmp dword [rcx + 0x84], 0xe
jbe 0x140006ae2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140006ae4
xor al, al
add rsp, 0x28
ret
Function at 0x29b151050
Capabilities:
Encode data using xor

Disassembly:
shl rcx, 4
xor eax, eax
and ecx, 0xff0
add r8, rcx
lea r9, [rdx + rax]
lea r10, [rax + r8]
xor ecx, ecx
mov r11b, byte [r10 + rcx]
inc rcx
xor byte [r9], r11b
inc r9
cmp rcx, 4
jne 0x29b151069
add rax, 4
cmp rax, 0x10
jne 0x29b15105f
ret

Function at 0x29b1510d0
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push rbp
lea rax, [rdx + r8]
mov rbp, rsp
push r15
push r14
push r13
push r12
lea r12, str.cw
push rdi
mov dil, 0x1b
push rsi
mov rsi, rdx
push rbx
mov rbx, rcx
and rsp, 0xfffffffffffffff0
sub rsp, 0x40
mov qword [rsp + 0x28], rax
mov eax, 0x10
cmp qword [rsp + 0x28], rsi
je 0x29b1512e0
cmp eax, 0x10
jne 0x29b1512cd
lea rdx, [rsp + 0x30]
mov r8, rbx
xor ecx, ecx
mov r14d, 1
movups xmm0, xmmword [rbx + 0xf0]
lea r13, [rsp + 0x34]
movaps xmmword [rsp + 0x30], xmm0
call fcn.29b151050
lea rdx, [rsp + 0x30]
mov rcx, rdx
mov rax, rcx
xor r8d, r8d
movzx r9d, byte [rax]
inc r8d
add rax, 4
mov r9b, byte [r12 + r9]
mov byte [rax - 4], r9b
cmp r8b, 4
jne 0x29b15114d
inc rcx
cmp r13, rcx
jne 0x29b151147
mov cl, byte [rsp + 0x35]
mov al, byte [rsp + 0x31]
mov byte [rsp + 0x31], cl
mov cl, byte [rsp + 0x39]
mov byte [rsp + 0x35], cl
mov cl, byte [rsp + 0x3d]
mov byte [rsp + 0x3d], al
mov al, byte [rsp + 0x32]
mov byte [rsp + 0x39], cl
mov cl, byte [rsp + 0x3a]
mov byte [rsp + 0x3a], al
mov al, byte [rsp + 0x36]
mov byte [rsp + 0x32], cl
mov cl, byte [rsp + 0x3e]
mov byte [rsp + 0x3e], al
mov al, byte [rsp + 0x33]
mov byte [rsp + 0x36], cl
mov cl, byte [rsp + 0x3f]
mov byte [rsp + 0x33], cl
mov cl, byte [rsp + 0x3b]
mov byte [rsp + 0x3f], cl
mov cl, byte [rsp + 0x37]
mov byte [rsp + 0x37], al
mov byte [rsp + 0x3b], cl
cmp r14d, 0xe
je 0x29b151292
lea r11, [rdx + 0x10]
mov cl, byte [rdx]
mov r9b, byte [rdx + 1]
add rdx, 4
mov r8b, byte [rdx - 2]
xor r8b, byte [rdx - 1]
xor r9d, ecx
mov r15d, ecx
xor cl, byte [rdx - 1]
mov eax, r9d
mov r10d, r9d
add r9d, r9d
shr al, 7
xor r10d, r8d
imul eax, edi
xor r15d, r10d
xor r15d, eax
xor r9d, r15d
mov r15b, byte [rdx - 3]
xor r15b, byte [rdx - 2]
mov eax, r15d
mov byte [rdx - 4], r9b
mov r9b, byte [rdx - 3]
add r15d, r15d
shr al, 7
imul eax, edi
xor r9d, r10d
xor r9d, eax
mov eax, r8d
add r8d, r8d
shr al, 7
xor r15d, r9d
mov r9b, byte [rdx - 2]
imul eax, edi
mov byte [rdx - 3], r15b
xor r9d, r10d
xor r10b, byte [rdx - 1]
xor r9d, eax
mov eax, ecx
add ecx, ecx
shr al, 7
xor r8d, r9d
imul eax, edi
mov byte [rdx - 2], r8b
mov r8d, r10d
xor eax, r8d
xor ecx, eax
mov byte [rdx - 1], cl
cmp r11, rdx
jne 0x29b1511dc
mov ecx, r14d
lea rdx, [rsp + 0x30]
mov r8, rbx
inc r14d
call fcn.29b151050
jmp 0x29b15113f
mov r8, rbx
mov ecx, 0xe
call fcn.29b151050
mov eax, 0xf
mov dl, byte [rbx + rax + 0xf0]
cmp dl, 0xff
jne 0x29b1512c0
mov byte [rbx + rax + 0xf0], 0
sub rax, 1
jae 0x29b1512a4
jmp 0x29b1512cb
cdqe
inc edx
mov byte [rbx + rax + 0xf0], dl
xor eax, eax
movsxd rdx, eax
inc eax
mov dl, byte [rsp + rdx + 0x30]
xor byte [rsi], dl
inc rsi
jmp 0x29b151105
lea rsp, [rbp - 0x38]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x29b152210
Capabilities:
Resolve function by djb2 hash

Disassembly:
push r13
xor eax, eax
xor r8d, r8d
xor edx, edx
push r12
mov r12, rcx
mov ecx, 0xfc
push rbp
lea rbp, [r12 + 6]
push rdi
push rsi
mov rsi, r12
push rbx
sub rsp, 0x448
mov qword [rsp + 0x40], 0
lea rdi, [rsp + 0x50]
rep stosd dword [rdi], eax
mov rcx, rbp
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x28], 0
call fcn.29b15a8b0
mov edx, 0xc
xor r8d, r8d
mov rcx, r12
mov rbx, rax
call fcn.29b15a8b0
mov rcx, r12
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
mov r13, rax
call fcn.29b15da90
lea rdx, [rsp + 0x40]
lea rcx, [rax + 1]
mov rdi, rdx
rep movsb byte [rdi], byte [rsi]
cmp r13d, 0xd0a409b0
je 0x29b1522cf
cmp ebx, 0x59fcf3cf
je 0x29b1522cf
cmp ebx, 0xcf31bb1f
je 0x29b1522cf
cmp ebx, 0x5fbff0fb
je 0x29b1522cf
cmp ebx, 0x5a153f58
je 0x29b1522cf
cmp ebx, 0x30eece3c
jne 0x29b152307
xor r13d, r13d
mov ebx, r13d
shl rbx, 4
add rbx, qword [0x29b1612e0]
cmp qword [rbx], 0
je 0x29b152392
mov rcx, rbp
call fcn.29b15a900
mov eax, eax
cmp rax, qword [rbx]
jne 0x29b152302
mov rax, qword [rbx + 8]
jmp 0x29b1523d4
inc r13d
jmp 0x29b1522d2
xor r8d, r8d
mov edx, 6
mov rcx, r12
call fcn.29b15a8b0
mov r8, rax
mov eax, 0xec6ba2a8
cmp r8, rax
jne 0x29b152392
lea rdx, [0x29b1612c0]
lea rcx, [rsp + 0x46]
call fcn.29b15dad0
mov rbx, rax
mov rcx, rax
call fcn.29b15da90
mov rcx, rbx
mov rbp, rax
call fcn.29b15b6d0
mov r13, rax
test rax, rax
je 0x29b152392
lea rbx, [rbx + rbp + 1]
mov rcx, rbx
call fcn.29b15da90
xor r8d, r8d
mov qword [rsp + 0x38], rbx
mov rcx, r13
mov word [rsp + 0x30], ax
inc eax
lea rdx, [rsp + 0x30]
lea r9, [rsp + 0x28]
mov word [rsp + 0x32], ax
mov rax, qword [0x29b1612f0]
call qword [rax + 0x26e]
test eax, eax
jns 0x29b1523cf
mov ecx, 0x14
call fcn.29b15bc70
mov edx, 0x99
mov rcx, rax
mov r13, rax
call fcn.29b15bb50
mov rcx, r12
call fcn.29b15da90
mov rdx, r12
mov rcx, r13
mov r8, rax
call fcn.29b15bad0
xor r8d, r8d
xor edx, edx
mov rcx, r13
call fcn.29b15bde0
mov rax, qword [rsp + 0x28]
add rsp, 0x448
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
Function at 0x29b15a7d0
Capabilities:
Enumerate pe sections
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
mov r12, rcx
push rbp
mov rdx, r12
push rdi
push rsi
xor esi, esi
push rbx
sub rsp, 0x28
movsxd rax, dword [rcx + 0x3c]
mov ecx, dword [rcx + rax + 0x88]
call 0x29b15cce0
mov rdx, r12
mov ebx, eax
add rbx, r12
mov ecx, dword [rbx + 0x20]
call 0x29b15cce0
mov ecx, dword [rbx + 0x24]
mov rdx, r12
mov ebp, eax
call 0x29b15cce0
mov r15d, dword [rbx + 0x18]
add rbp, r12
mov edi, eax
add rdi, r12
lea r14, [rsi + rsi]
add r14, rdi
cmp r15, rsi
je 0x29b15a891
mov ecx, dword [rbp + rsi*4]
mov rdx, r12
call 0x29b15cce0
mov r13d, eax
add r13, r12
mov rcx, r13
call fcn.29b15a900
cmp eax, 0xa6caa1c5
jne 0x29b15a87d
mov ecx, dword [rbx + 0x1c]
mov rdx, r12
call 0x29b15cce0
movzx edx, word [r14]
mov eax, eax
add rax, r12
mov ecx, dword [rax + rdx*4]
add rsp, 0x28
mov rdx, r12
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp 0x29b15cce0
mov rcx, r13
inc rsi
call fcn.29b15a900
cmp eax, 0xffe885ef
jne 0x29b15a821
jmp 0x29b15a84e
add rsp, 0x28
xor eax, eax
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov eax, ecx
movsxd rcx, dword [rdx + 0x3c]
add rcx, rdx
movzx edx, word [rcx + 0x14]
lea rdx, [rcx + rdx + 0x18]
cmp dword [rdx + 0x14], eax
ja 0x29b15cd2a
mov r9w, word [rcx + 6]
xor ecx, ecx
cmp r9w, cx
je 0x29b15cd28
mov r8d, dword [rdx + 0xc]
cmp eax, r8d
jb 0x29b15cd20
mov r10d, dword [rdx + 0x10]
add r10d, r8d
cmp r10d, eax
jbe 0x29b15cd20
add eax, dword [rdx + 0x14]
sub eax, r8d
ret
inc ecx
add rdx, 0x28
jmp 0x29b15ccfe
xor eax, eax
ret

Function at 0x29b15a8b0
Capabilities:
Hash data using djb2

Disassembly:
xor eax, eax
test rcx, rcx
je 0x29b15a8fe
mov r10, rcx
mov eax, 0x1505
mov r9b, byte [r10]
test rdx, rdx
jne 0x29b15a8cd
test r9b, r9b
jne 0x29b15a8e0
ret
mov r11d, r10d
sub r11d, ecx
cmp rdx, r11
jbe 0x29b15a8fe
cmp r9b, 1
adc r10, 0
cmp r9b, 0x60
jbe 0x29b15a8ef
test r8d, r8d
je 0x29b15a8ef
sub r9d, 0x20
imul eax, eax, 0x21
movzx r9d, r9b
inc r10
add eax, r9d
jmp 0x29b15a8bf
ret

Function at 0x29b15a900
Capabilities:
Hash data using djb2

Disassembly:
mov eax, 0x1505
movsx edx, byte [rcx]
inc rcx
test dl, dl
je 0x29b15a916
imul eax, eax, 0x21
add eax, edx
jmp 0x29b15a905
ret