joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14005fa60
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x14005fb0f
push rbp
mov rbp, rsp
sub rsp, 0x58
mov qword [rsp + 0x70], rbx
lea rdx, [rsp + 0x68]
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rsi, [0x14005fb60]
mov qword [rsp + 0x10], rsi
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdx
mov rdx, r14
mov qword [rsp + 0x28], rdx
lea rdx, [rsp + 8]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.1400694c0
xorps xmm15, xmm15
mov r14, qword [0x1402fb580]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
add rsp, 0x58
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.1400695e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp fcn.14005fa60
Function at 0x14006b3e0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x140004aa3
push rbp
mov rbp, rsp
sub rsp, 0x18
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
mov rax, rdx
call fcn.14000ab40
add rsp, 0x18
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.1400695e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x140004a80
cmp byte [0x1402fb34c], 0
je 0x14006b3f5
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp 0x140068620
jmp 0x140004a80

Function at 0x14006b400
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
nop
mov eax, dword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x1402fb6e0]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d124b
mul rcx
xor rax, rdx
nop
nop
ret
cmp byte [0x1402fb34c], 0
je 0x14006b435
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x1402fbae0]
aesenc xmm0, xmmword [0x1402fbaf0]
aesenc xmm0, xmmword [0x1402fbb00]
movq rax, xmm0
ret
jmp 0x14000ad60

Function at 0x14006b440
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
nop
mov rax, qword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x1402fb6e0]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
xor rax, rdx
nop
nop
ret
cmp byte [0x1402fb34c], 0
je 0x14006b476
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x1402fbae0]
aesenc xmm0, xmmword [0x1402fbaf0]
aesenc xmm0, xmmword [0x1402fbb00]
movq rax, xmm0
ret
jmp 0x14000adc0
Function at 0x14007b0e0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x14007b1aa
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call fcn.140003f80
xorps xmm15, xmm15
mov r14, qword [0x1402fb580]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x14007b18f
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x14011cde0]
xor ebx, ebx
mov rcx, rdx
call fcn.14004f320
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call fcn.14007c080
inc rbx
cmp rcx, rbx
jae 0x14007b17e
mov edi, 1
lea rsi, [0x14011cde0]
call fcn.14004f400
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x14017d228]
lea rsi, [0x14017c4b8]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.1400695e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.14007b0e0
Function at 0x140090920
Capabilities:
Hash data using fnv

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x140090b5b
push rbp
mov rbp, rsp
sub rsp, 0x78
mov ebx, dword [rax + 0x2c]
test ebx, ebx
jne 0x1400909ba
mov qword [rsp + 0x88], rax
lea rbx, [0x140141d20]
mov rcx, rax
lea rax, [0x1402766a0]
call fcn.140071220
test cl, cl
jne 0x1400909a3
mov rax, qword [rsp + 0x88]
call fcn.14008f9c0
mov ecx, 1
mov rdi, rax
mov rsi, rbx
lea rax, [rsp + 0x28]
lea rbx, [0x14017b500]
call fcn.1400530e0
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rbx
call fcn.140091d80
mov rcx, qword [rsp + 0x88]
xor edx, edx
jmp 0x1400909d7
lea rdx, [0x14013eea0]
cmp rax, rdx
jne 0x1400909c5
test byte [rbx], al
mov rax, rbx
add rsp, 0x78
pop rbp
ret
call fcn.140066e40
add rsp, 0x78
pop rbp
ret
mov rbx, rdx
lea rcx, [0x140122380]
call fcn.14000bbc0
inc rdx
cmp rbx, rdx
jle 0x140090a21
mov rsi, qword [rax + rdx*8]
cmp qword [rsi + 0x30], rcx
jne 0x1400909d4
lea rax, [0x1402766a0]
lea rbx, [0x140141d20]
lea rdi, [0x14013eea0]
nop dword [rax + rax]
call fcn.1400713e0
lea rdx, [0x14013eea0]
cmp rax, rdx
jne 0x140090b4b
test byte [rbx], al
mov rax, rbx
add rsp, 0x78
pop rbp
nop
ret
lea rcx, [0x140118620]
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x68], 0
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x58], rcx
lea rax, [0x140128da0]
call fcn.14000ef40
mov qword [rsp + 0x70], rax
mov rcx, qword [rsp + 0x58]
test byte [rcx], al
cmp dword [0x1402fb600], 0
nop
je 0x140090a7b
mov rbx, rax
lea rax, [0x140128da0]
call fcn.140014b20
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rcx]
mov qword [rax], rdx
movups xmm0, xmmword [rcx + 8]
movups xmmword [rax + 8], xmm0
movups xmm0, xmmword [rcx + 0x18]
movups xmmword [rax + 0x18], xmm0
movups xmm0, xmmword [rcx + 0x28]
movups xmmword [rax + 0x28], xmm0
mov rbx, qword [rsp + 0x48]
xor ecx, ecx
xor edi, edi
xor esi, esi
mov r8d, esi
mov rax, qword [rsp + 0x50]
call fcn.1400019a0
call fcn.140066f00
mov rsi, qword [rsp + 0x70]
mov dword [rsi + 0x28], eax
mov dword [rsi + 0x2c], 0
mov rcx, qword [rsp + 0x88]
mov edx, dword [rcx + 0x10]
xor eax, eax
jmp 0x140090ae2
imul edx, edx, 0x1000193
xor edx, 0x2a
mov eax, 1
test rax, rax
jle 0x140090ad4
mov dword [rsi + 0x10], edx
cmp dword [0x1402fb600], 0
je 0x140090b03
call fcn.14006b540
mov qword [r11], rcx
mov rdx, qword [rsi + 0x30]
mov qword [r11 + 8], rdx
mov qword [rsi + 0x30], rcx
lea rax, [0x1402766a0]
lea rbx, [0x140141d20]
lea rdi, [0x14013eea0]
nop dword [rax]
call fcn.1400713e0
lea rdx, [0x14013eea0]
cmp rax, rdx
jne 0x140090b3c
test byte [rbx], al
mov rax, rbx
add rsp, 0x78
pop rbp
ret
mov rbx, rdx
lea rcx, [0x140122380]
call fcn.14000bbc0
mov rbx, rdx
lea rcx, [0x140122380]
call fcn.14000bbc0
nop
mov qword [rsp + 8], rax
call fcn.1400695e0
mov rax, qword [rsp + 8]
jmp fcn.140090920
Function at 0x1400e5f60
Capabilities:
Hash data using fnv

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x1400e669f
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
movabs rcx, 0xcbf29ce484222325
jmp 0x1400e5f8d
lea rax, [rdx + 0x10]
dec rbx
mov rcx, rsi
test rbx, rbx
jle 0x1400e6211
mov rdx, rax
mov rsi, qword [rax]
nop dword [rax]
test rsi, rsi
je 0x1400e623d
mov edi, dword [rsi + 0x10]
shr edi, 1
mov r8, qword [rax + 8]
and edi, 0x3f
lea rax, [0x14017f740]
jmp qword [rax + rdi*8]
mov rax, rcx
add rsp, 0x10
pop rbp
ret
lea rax, [0x14011cce0]
lea rbx, [0x14017d030]
call fcn.140038660
inc rax
cmp rax, r8
jge 0x1400e6262
mov r9, qword [rsi + rax*8]
xor r10d, r10d
nop
jmp 0x1400e6297
lea rdi, [0x14011cd60]
mov rsi, rcx
movabs rcx, 0x100000001b3
jmp 0x1400e5f83
movzx r11d, r9b
xor rcx, r11
inc r10
shr r9, 8
movabs r11, 0x100000001b3
imul rcx, r11
cmp r10, 8
jl 0x1400e627b
jmp 0x1400e6250
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.1400695e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.1400e5f60

Function at 0x1400e6840
Capabilities:
Hash data using fnv

Disassembly:
test byte [rax], al
mov rcx, rbx
and ebx, 0x7f
shl rbx, 5
lea rdx, [rax + rbx]
xor eax, eax
jmp 0x1400e6857
inc rax
cmp rax, 4
jge 0x1400e686f
lea rbx, [rdx + rax*8]
mov rbx, qword [rbx]
cmp rbx, rcx
jne 0x1400e6854
mov eax, 1
ret
xor eax, eax
movabs rbx, 0xcbf29ce484222325
jmp 0x1400e6880
inc rax
cmp rax, 4
jge 0x1400e688e
mov rsi, qword [rdx + rax*8]
xor edi, edi
jmp 0x1400e68b7
and ebx, 3
lea rdx, [rdx + rbx*8]
xchg qword [rdx], rcx
xor eax, eax
ret
movzx r8d, sil
xor rbx, r8
inc rdi
shr rsi, 8
movabs r8, 0x100000001b3
imul rbx, r8
cmp rdi, 8
jl 0x1400e689b
jmp 0x1400e687d
Function at 0x140105c30
Capabilities:
Write file on windows

Disassembly:
push rsi
sub rsp, 0x20
mfence
mov eax, dword [0x1402ff168]
test eax, eax
je 0x140105c48
add rsp, 0x20
pop rsi
ret
mov eax, 1
lock xadd dword [0x1402ff16c], eax
test eax, eax
je 0x140105c93
lock dec dword [0x1402ff16c]
mfence
mov eax, dword [0x1402ff168]
test eax, eax
jne 0x140105c42
mov rsi, qword [sym.imp.KERNEL32.dll_Sleep]
nop word cs:[rax + rax]
xor ecx, ecx
call rsi
mfence
mov eax, dword [0x1402ff168]
test eax, eax
je 0x140105c80
jmp 0x140105c42
xor ecx, ecx
mov edx, 1
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [0x1402ff138], rax
test rax, rax
je 0x140105ccb
lea rcx, [0x1402ff140]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lock inc dword [0x1402ff168]
jmp 0x140105c42
mov ecx, 2
call qword [fcn.140106a60]
lea rcx, str.runtime:_failed_to_create_runtime_initialization_wait_event._n
mov edx, 0x3d
mov r8d, 1
mov r9, rax
call sub.msvcrt.dll_fwrite
call sub.msvcrt.dll_abort
int3

Function at 0x140106830
Capabilities:
Write file on windows

Disassembly:
push rsi
sub rsp, 0x30
mov rsi, rcx
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], r8
mov qword [rsp + 0x58], r9
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov ecx, 2
call fcn.140106a60
lea rcx, str.Mingw_w64_runtime_failure:_n
mov edx, 0x1b
mov r8d, 1
mov r9, rax
call sub.msvcrt.dll_fwrite
mov ecx, 2
call fcn.140106a60
mov r8, qword [rsp + 0x28]
mov rcx, rax
mov rdx, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
int3

Function at 0x140109500
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rax, qword [0x14010d008]
movzx edx, word [rax]
cmp edx, 0x5a4d
jne 0x14010956c
movsxd rdx, dword [rax + 0x3c]
cmp dword [rax + rdx], 0x4550
jne 0x14010956c
add rax, rdx
movzx edx, word [rax + 0x18]
cmp edx, 0x20b
jne 0x14010956c
movzx edx, word [rax + 6]
test edx, edx
je 0x14010956c
sub rcx, qword [0x14010d008]
movzx r8d, word [rax + 0x14]
add rax, r8
add rax, 0x18
jmp 0x140109558
add rax, 0x28
dec edx
je 0x14010956c
mov r8d, dword [rax + 0xc]
cmp rcx, r8
jb 0x140109550
add r8d, dword [rax + 8]
cmp rcx, r8
jae 0x140109550
jmp 0x14010956e
xor eax, eax
ret

Function at 0x140109570
Capabilities:
Parse pe header

Disassembly:
mov rcx, qword [0x14010d008]
movzx edx, word [rcx]
xor eax, eax
cmp edx, 0x5a4d
jne 0x1401095a5
movsxd rdx, dword [rcx + 0x3c]
cmp dword [rcx + rdx], 0x4550
jne 0x1401095a5
movzx r8d, word [rcx + rdx + 0x18]
cmp r8d, 0x20b
jne 0x1401095a5
movzx eax, word [rcx + rdx + 6]
ret

Function at 0x140109620
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x14010d008]
movzx ecx, word [rax]
cmp ecx, 0x5a4d
jne 0x14010964c
movsxd rcx, dword [rax + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x14010964c
movzx ecx, word [rax + rcx + 0x18]
cmp ecx, 0x20b
je 0x14010964e
xor eax, eax
ret
Function at 0x180013474
Capabilities:
Log keystrokes via polling

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], r8
push rdi
sub rsp, 0x20
and dword [rax + 0x18], 0
lea rcx, str.Press_Key
and dword [rax + 0x1c], 0
mov rdi, rdx
movsxd rax, dword [rdx]
lea rdx, [rsp + 0x40]
mov rcx, qword [rcx + rax*8]
call fcn.18005056c
xor esi, esi
test al, al
je 0x1800134ce
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x1800134b1
mov dword [rdi], esi
cmp dword [rdi], esi
jne 0x1800134ff
mov ebx, esi
mov ecx, 0x1b
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x1800134ff
mov ecx, ebx
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x1800134fd
inc ebx
cmp ebx, 0x100
jl 0x1800134d4
jmp 0x1800134ff
mov dword [rdi], ebx
mov rbx, qword [rsp + 0x30]
mov al, 1
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x180013aac
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
xor esi, esi
cmp qword [0x1800c32b8], rsi
je 0x180013b27
mov ecx, dword [0x1800c0cac]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x180013af0
and dword [0x1800c3478], esi
and dword [0x1800c347c], esi
and dword [0x1800c3480], esi
mov qword [0x1800c3488], rsi
mov ecx, dword [0x1800c0cac]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x180013b27
mov rdi, qword [0x1800c3438]
mov rbx, qword [0x1800c3430]
jmp 0x180013b22
mov rcx, qword [rbx]
test rcx, rcx
je 0x180013b1e
call fcn.1800135d8
add rbx, 8
cmp rbx, rdi
jne 0x180013b11
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x18001d8cc
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov rax, qword gs:[0x60]
xor edi, edi
mov rdx, rcx
test rax, rax
je 0x18001d989
mov rbx, qword [rax + 0x18]
add rbx, 0x20
mov r8, qword [rbx]
cmp r8, rbx
je 0x18001d989
lea rsi, str.GameAssembly.dll
mov r9, qword [r8 + 0x50]
test r9, r9
je 0x18001d981
mov rax, r9
mov ecx, edi
cmp word [r9], di
je 0x18001d92c
inc ecx
lea rax, [rax + 2]
cmp word [rax], di
jne 0x18001d921
mov rax, rsi
mov r10d, edi
inc r10d
lea rax, [rax + 2]
cmp word [rax], di
jne 0x18001d932
cmp ecx, r10d
jne 0x18001d981
mov r11d, ecx
mov r10, rdi
test ecx, ecx
je 0x18001d96c
movzx ecx, word [r9 + r10*2]
movzx eax, word [rsi + r10*2]
or cx, 0x20
or ax, 0x20
cmp cx, ax
jne 0x18001d981
inc r10
cmp r10, r11
jb 0x18001d94d
mov rax, qword [r8 + 0x20]
mov qword [rdx], rax
mov eax, dword [r8 + 0x30]
mov qword [rdx + 0x10], rax
mov qword [rdx + 8], r9
jmp 0x18001d99b
mov r8, qword [r8]
cmp r8, rbx
jne 0x18001d90d
lea rax, [0x1800ab788]
mov qword [rdx], rdi
mov qword [rdx + 8], rax
mov qword [rdx + 0x10], rdi
mov rbx, qword [rsp + 8]
mov rax, rdx
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret

Function at 0x18001d9b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
mov r8, qword [rcx]
mov r10, rdx
test r8, r8
je 0x18001da5c
movsxd rax, dword [r8 + 0x3c]
xor r11d, r11d
mov r9d, dword [rax + r8 + 0x88]
add r9, r8
mov ebx, dword [r9 + 0x24]
add rbx, r8
cmp dword [r9 + 0x18], r11d
jbe 0x18001da5c
mov r14d, dword [r9 + 0x20]
mov ebp, 0xffffffff
lea rax, [r14 + r11*4]
mov edx, dword [rax + r8]
add rdx, r8
cmp rdx, rbp
je 0x18001da53
cmp r10, rbp
je 0x18001da53
cmp rdx, 0x7d
je 0x18001da53
cmp r10, 0x7d
je 0x18001da53
test rdx, rdx
je 0x18001da4e
test r10, r10
je 0x18001da53
movzx eax, byte [r10]
movzx ecx, byte [rdx]
sub ecx, eax
jne 0x18001da4a
mov rdi, r10
sub rdi, rdx
test al, al
je 0x18001da4a
inc rdx
movzx eax, byte [rdi + rdx]
movzx ecx, byte [rdx]
sub ecx, eax
je 0x18001da38
test ecx, ecx
jmp 0x18001da51
test r10, r10
je 0x18001da75
inc r11d
cmp r11d, dword [r9 + 0x18]
jb 0x18001d9fc
xor eax, eax
mov rbx, qword [rsp + 0x10]
mov rbp, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
pop r14
ret
mov ecx, dword [r9 + 0x1c]
movzx edx, word [rbx + r11*2]
add rcx, r8
mov eax, dword [rcx + rdx*4]
add rax, r8
jmp 0x18001da5e
Function at 0x18002e34c
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rsi, qword [rcx + 0x18]
add rsi, 0x20
mov rbx, qword [rsi]
cmp rbx, rsi
je 0x18002e3c2
lea rbp, str.tier0_s64.dll
cmp rbp, 1
jbe 0x18002e39e
mov rdx, qword [rbx + 0x50]
mov rcx, rbp
call fcn.1800695a4
test eax, eax
je 0x18002e3d9
cmp rbp, 1
jne 0x18002e3ba
cmp word [rbx + 0x48], 0x12
jne 0x18002e3ba
mov rax, qword [rbx + 0x50]
movabs rcx, 0x6c00640074006e
cmp qword [rax], rcx
je 0x18002e3d9
mov rbx, qword [rbx]
cmp rbx, rsi
jne 0x18002e384
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rax, qword [rbx + 0x20]
jmp 0x18002e3c4

Function at 0x180033a00
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
not r8d
mov r9d, 4
movzx eax, byte [rcx]
inc rcx
movzx edx, r8b
xor rdx, rax
shr r8d, 8
lea rax, [0x1800aca50]
xor r8d, dword [rax + rdx*4]
sub r9, 1
jne 0x180033a09
not r8d
mov eax, r8d
ret

Function at 0x180033a34
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
not r8d
mov r10, rcx
mov r9d, r8d
test rdx, rdx
je 0x180033a8e
mov r11b, 0x23
lea rdi, [0x1800aca50]
movzx ebx, byte [r10]
dec rdx
inc r10
cmp bl, r11b
jne 0x180033a78
cmp rdx, 2
jb 0x180033a78
cmp byte [r10], r11b
jne 0x180033a78
cmp byte [r10 + 1], r11b
cmove r9d, r8d
movzx ecx, r9b
xor rcx, rbx
shr r9d, 8
xor r9d, dword [rdi + rcx*4]
test rdx, rdx
jne 0x180033a56
jmp 0x180033acf
mov dl, byte [rcx]
inc r10
test dl, dl
je 0x180033acf
mov r11b, 0x23
lea rdi, [0x1800aca50]
cmp dl, r11b
jne 0x180033ab3
cmp byte [r10], r11b
jne 0x180033ab3
cmp byte [r10 + 1], r11b
cmove r9d, r8d
movzx ecx, r9b
movzx eax, dl
mov dl, byte [r10]
xor rcx, rax
shr r9d, 8
inc r10
xor r9d, dword [rdi + rcx*4]
test dl, dl
jne 0x180033aa1
mov rbx, qword [rsp + 8]
not r9d
mov rdi, qword [rsp + 0x10]
mov eax, r9d
ret
Function at 0x180033bc4
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rsi, r8
test r8, r8
je 0x180033be4
and qword [r8], 0
lea rdx, [0x1800b0b48]
call fcn.180033ae0
mov rbx, rax
test rax, rax
je 0x180033ccb
mov rcx, rax
call fcn.18006da34
mov ebp, eax
cmp eax, 0xffffffff
je 0x180033cc3
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call fcn.18006e380
test eax, eax
jne 0x180033cc3
mov rcx, rbx
call fcn.18006da34
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x180033cc3
xor r8d, r8d
mov edx, ebp
mov rcx, rbx
call fcn.18006e380
test eax, eax
jne 0x180033cc3
mov rbp, rdi
cmp rdi, 0xffffffffffffffff
je 0x180033cc3
mov rax, qword [0x1800c3390]
test rax, rax
je 0x180033c65
inc dword [rax + 0x3bc]
mov rcx, rbp
call fcn.180074750
mov rdi, rax
test rax, rax
je 0x180033cc3
mov r9, rbx
mov r8, rbp
mov edx, 1
mov rcx, rax
call fcn.18006f0f0
mov rcx, rbx
cmp rax, rbp
je 0x180033cb1
call fcn.18006dfe0
mov rax, qword [0x1800c3390]
test rax, rax
je 0x180033ca7
dec dword [rax + 0x3bc]
mov rcx, rdi
call fcn.18006cee4
jmp 0x180033ccb
call fcn.18006dfe0
test rsi, rsi
je 0x180033cbe
mov qword [rsi], rbp
mov rax, rdi
jmp 0x180033ccd
mov rcx, rbx
call fcn.18006dfe0
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x18005b470
Capabilities:
Access peb ldr_data

Disassembly:
cmp qword [rcx + 0x30], 0
jne 0x18005b48e
mov rax, qword gs:[0x30]
mov rdx, qword [rax + 0x60]
mov rax, qword [rdx + 0x18]
mov rdx, qword [rax + 0x20]
jmp 0x18005b492
mov rdx, qword [rcx + 0x10]
movups xmm0, xmmword [rdx - 0x10]
movaps xmmword [rcx], xmm0
movups xmm1, xmmword [rdx]
movaps xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rdx + 0x10]
movaps xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rdx + 0x20]
movaps xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rdx + 0x30]
movaps xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rdx + 0x40]
movaps xmmword [rcx + 0x50], xmm1
movsd xmm0, qword [rdx + 0x50]
movsd qword [rcx + 0x60], xmm0
mov rax, qword [rcx + 0x30]
ret

Function at 0x18005b4d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, 1
call fcn.18005b380
mov rcx, rax
call fcn.18005b550
mov rcx, rax
mov rdx, rbx
call fcn.18005b5e0
test rax, rax
jne 0x18005b53b
lea ecx, [rax + 3]
call fcn.18005b380
mov rcx, rax
call fcn.18005b550
mov rcx, rax
mov rdx, rbx
call fcn.18005b5e0
test rax, rax
jne 0x18005b53b
lea ecx, [rax + 2]
call fcn.18005b380
mov rcx, rax
call fcn.18005b550
mov rcx, rax
mov rdx, rbx
add rsp, 0x20
pop rbx
jmp fcn.18005b5e0
add rsp, 0x20
pop rbx
ret

Function at 0x18005b5e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
movsxd rax, dword [rcx + 0x3c]
mov r11, rcx
mov rbx, rdx
mov ecx, dword [rax + rcx + 0x88]
add rcx, r11
mov esi, dword [rcx + 0x1c]
mov ebp, dword [rcx + 0x24]
add rsi, r11
add rbp, r11
cmp rdx, 0xffff
ja 0x18005b634
sub bx, word [rcx + 0x10]
movzx eax, bx
cmp eax, dword [rcx + 0x14]
jae 0x18005b66e
movzx eax, bx
mov eax, dword [rsi + rax*4]
add rax, r11
jmp 0x18005b670
mov r10d, dword [rcx + 0x20]
xor r9d, r9d
mov edi, dword [rcx + 0x18]
add r10, r11
test edi, edi
je 0x18005b66e
nop word [rax + rax]
mov edx, dword [r10]
mov rcx, rbx
add rdx, r11
call 0x18005bd40
test eax, eax
je 0x18005b685
inc r9d
add r10, 4
cmp r9d, edi
jb 0x18005b650
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
movzx ecx, word [rbp + r9*2]
mov eax, dword [rsi + rcx*4]
add rax, r11
jmp 0x18005b670