joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001f2e0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x14005fba4], 0
jne 0x14001f3da
xchg rbx, rbx
xor edx, edx
lea r8, [0x14005fba0]
nop word [rax + rax]
mov ecx, edx
mov r10, r10
lea r8, [r8 + 4]
and ecx, 1
mov eax, edx
xchg rdi, rdi
shr eax, 1
neg ecx
and ecx, 0xedb88320
mov dword [rsp - 0x1c], 0x502c6072
inc edx
xor ecx, eax
mov eax, ecx
mov dword [rsp - 0x1c], ebx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
mov dword [rsp - 0x24], ebx
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
mov r14, r14
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov dword [rsp - 0x44], ebx
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
mov dword [rsp - 0xc], ebx
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
mov rdi, rdi
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
xchg rsp, rsp
mov eax, ecx
shr ecx, 1
and eax, 1
mov r11, r11
neg eax
and eax, 0xedb88320
xor eax, ecx
mov rsp, rsp
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
mov dword [rsp - 0x44], ebx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
mov dword [rsp - 0x34], ecx
shr ecx, 1
and eax, 1
neg eax
xchg rdx, rdx
and eax, 0xedb88320
xor eax, ecx
mov dword [r8 - 4], eax
cmp edx, 0x100
xchg r15, r15
jb 0x14001f303
ret
Function at 0x14001f3e0
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
xchg rsi, rdi
mov qword [rsp + 0x18], rdi
xchg rsi, rdi
mov qword [rsp + 0x20], rdi
mov dword [rsp - 0x40], 0x62dd8c1a
nop
mov qword [rsp - 8], r14
sub rsp, 8
movsxd rbx, dword [rcx + 0x3c]
mov dword [rsp - 0x14], 0x29387d2f
xor ebp, ebp
add rbx, rcx
xchg rdi, rsi
mov rsi, rdx
xchg rsi, rdi
xchg r14, r15
mov r15, rcx
xchg r14, r15
movzx r9d, bp
movzx eax, word [rbx + 0x14]
mov dword [rsp - 0xc], 0x541233ca
lea r8, [rbx + 0x18]
movzx r11d, word [rbx + 6]
add r8, rax
xchg r15, r15
mov r10d, dword [rbx + 0xb0]
cmp bp, r11w
jae 0x14001f4b1
mov eax, dword [r8 + 8]
mov r15, r15
test eax, eax
jne 0x14001f472
mov eax, dword [r8 + 0x10]
mov edx, dword [r8 + 0xc]
mov dword [rsp - 0x18], edi
cmp r10d, edx
jb 0x14001f496
add eax, edx
mov dword [rsp - 0x38], 0x3f96abb2
cmp r10d, eax
jb 0x14001f5e3
inc r9w
neg r8
add r8, 0xffffffffffffffd8
neg r8
cmp r9w, r11w
mov rsi, rsi
jb 0x14001f45f
xchg r10, rbx
mov rbx, rbp
xchg rbx, r10
sub rdi, qword [rbx + 0x30]
xchg rsp, rsp
mov esi, dword [rbx + 0xb4]
mov ebx, ebp
test esi, esi
je 0x14001f645
mov dword [rsp - 0x40], ecx
nop dword [rax + rax]
movsxd rcx, dword [r14 + 0x3c]
lea rdx, [r14 + 0x18]
xchg r14, r14
mov r11d, dword [r10]
add rdx, rcx
movzx r8d, bp
movzx eax, word [rcx + r14 + 0x14]
mov dword [rsp - 0x18], ecx
movzx ecx, word [rcx + r14 + 6]
add rdx, rax
cmp bp, cx
mov dword [rsp - 0x44], 0x44d1094b
jae 0x14001f566
mov eax, dword [rdx + 8]
test eax, eax
jne 0x14001f525
mov dword [rsp - 0x14], esi
mov eax, dword [rdx + 0x10]
mov r9d, dword [rdx + 0xc]
cmp r11d, r9d
mov dword [rsp - 0x24], esi
jb 0x14001f546
add eax, r9d
cmp r11d, eax
mov dword [rsp - 0x34], edi
jb 0x14001f5f8
inc r8w
nop
add rdx, 0x2f307012
sub rdx, 0x2f306fea
cmp r8w, cx
xchg r8, r8
jb 0x14001f513
xchg rbp, rdx
mov rbp, rdx
xchg rbp, rdx
mov eax, dword [r10 + 4]
lea r9, [r10 + 4]
add rax, 0xfffffffffffffff8
mov dword [rsp - 0x18], esi
nop
add r10, 0xffe6055
sub r10, 0xffe604d
shr rax, 1
xchg rdx, rdx
test eax, eax
je 0x14001f632
mov r8d, eax
nop dword [rax]
mov dword [rsp - 0x44], 0x215f0687
movzx eax, word [r10]
mov ecx, eax
shr ecx, 2
shr ecx, 2
shr ecx, 7
shr ecx, 1
cmp ecx, 3
mov dword [rsp - 0x38], esp
je 0x14001f614
cmp ecx, 0xa
jne 0x14001f624
xchg rbx, rbx
and eax, 0xfff
add qword [rax + rdx], rdi
jmp 0x14001f624
mov eax, dword [r8 + 0x14]
sub rax, rdx
add rax, r14
xchg rsi, rsi
add r10, rax
jmp 0x14001f4ba
mov edx, dword [rdx + 0x14]
xchg r13, r13
sub rdx, r9
add rdx, r14
add rdx, r11
mov dword [rsp - 0x30], 0x546fa435
jmp 0x14001f56f
and eax, 0xfff
add dword [rax + rdx], edi
mov dword [rsp - 0x30], 0x74a2d6f3
add r10, 2
sub r8, 1
jne 0x14001f5ab
add ebx, dword [r9]
mov dword [rsp - 0x40], 0x3694513d
cmp ebx, esi
jb 0x14001f4da
mov rbx, qword [rsp + 0x10]
xchg rcx, rcx
xchg rdx, rbp
mov rdx, qword [rsp + 0x18]
xchg rdx, rbp
mov rsi, qword [rsp + 0x20]
xchg r9, rdi
mov r9, qword [rsp + 0x28]
xchg r9, rdi
nop
add rsp, 8
mov r14, qword [rsp - 8]
ret
Function at 0x140026460
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
nop
push r12
mov qword [rsp], rbp
nop
mov qword [rsp - 8], rsi
sub rsp, 8
nop
mov qword [rsp - 8], rdi
sub rsp, 8
nop
sub rsp, 8
mov qword [rsp], r12
push r13
nop
mov qword [rsp - 8], r14
sub rsp, 8
nop
mov qword [rsp - 8], r15
sub rsp, 8
sub rsp, 0x20
movzx eax, word [rcx]
mov dword [rsp - 0x18], 0x344511b2
mov r15d, edx
xor eax, 0x3cd17157
xchg rsi, rcx
mov rcx, rsi
xchg rcx, rsi
cmp eax, 0x3cd12b1a
xchg rcx, rcx
jne 0x140026615
movsxd rcx, dword [rcx + 0x3c]
mov eax, dword [rcx + rsi]
xor eax, 0x3cd17157
mov r8, r8
cmp eax, 0x3cd13407
jne 0x140026615
mov edx, dword [rcx + rsi + 0x88]
xchg r11, r11
mov rcx, rsi
call fcn.1400262c0
xchg rcx, r13
mov r13, rsi
xchg rcx, r13
mov r14, rax
mov edx, dword [rax + 0x20]
call fcn.1400262c0
mov dword [rsp - 0x18], 0x14019538
mov edx, dword [r14 + 0x24]
xchg rdx, rcx
mov rdx, rsi
xchg rcx, rdx
xchg r11, rax
mov r12, r11
xchg r11, rax
call fcn.1400262c0
mov edx, dword [r14 + 0x1c]
mov dword [rsp - 0x2c], 0x6a062630
mov rcx, rsi
mov r13, rax
call fcn.1400262c0
xor edi, edi
xchg r8, r8
xchg rbp, rax
mov qword [rsp + 0x70], rbp
xchg rbp, rax
cmp dword [r14 + 0x18], edi
jbe 0x140026615
mov dword [rsp - 0x20], 0x7019b607
nop dword [rax]
mov edx, dword [r12 + rdi*4]
xchg rsi, rcx
mov rsi, rcx
xchg rcx, rsi
call fcn.1400262c0
mov dword [rsp - 0x10], 0x6bcf120d
mov ecx, 0x19425ac3
xor ecx, 0x290a6bdf
add ecx, 0x2e75f9ca
xor ecx, 0xa141d519
xchg r12, rbx
mov r12, rax
xchg r12, rbx
mov dword [rsp + 0x60], ecx
xchg r14, r14
cmp byte [rax], 0
je 0x1400265f7
nop dword [rax]
xchg rbx, rdx
mov rbx, rdx
xchg rbx, rdx
lea rcx, [rsp + 0x60]
mov r8d, 0x22670234
xor r8d, 0xe9986b8
xor r8d, 0x2ee94bc
sub r8d, 0x2e10102f
inc rbx
call fcn.14001ef60
cmp byte [rbx], 0
xchg r9, r9
jne 0x1400265b6
mov ecx, dword [rsp + 0x60]
not ecx
cmp ecx, r15d
xchg rbp, rbp
je 0x140026667
inc edi
cmp edi, dword [r14 + 0x18]
mov dword [rsp - 0x44], edi
jb 0x140026569
xor eax, eax
xchg r13, rbx
mov r13, qword [rsp + 0x68]
xchg rbx, r13
nop
sub rsp, 0x4fe6b8cc
add rsp, 0x4fe6b8ec
pop r15
pop r14
mov r8, r8
nop
mov r13, qword [rsp]
add rsp, 8
nop
add rsp, 8
mov r12, qword [rsp - 8]
nop
mov rdi, qword [rsp]
add rsp, 8
nop
mov rsi, qword [rsp]
add rsp, 8
nop
mov rbp, qword [rsp]
add rsp, 8
ret
movzx eax, word [r13 + rdi*2]
mov rcx, qword [rsp + 0x70]
mov edx, dword [rcx + rax*4]
mov dword [rsp - 0x2c], edx
xchg rcx, rdx
mov rdx, rsi
xchg rcx, rdx
call fcn.1400262c0
jmp 0x140026617
Function at 0x140032140
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
xchg r8, rbx
mov qword [rsp + 8], r8
xchg rbx, r8
mov dword [rsp + 0x18], r8d
nop
mov qword [rsp - 8], rdi
sub rsp, 8
add rsp, 0xfffffffffffffdc0
xchg r14, r14
xchg rdx, rbx
mov rdx, rbx
xchg rbx, rdx
xchg rdx, rdi
mov rdx, rcx
xchg rdi, rdx
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x69bb68ba
xor r8d, 0x14097745
sub r8d, 0x256d2b87
sub r8d, 0x5844f270
call fcn.14004d990
mov dword [rsp - 0x14], 0x2db9ff92
mov rax, qword gs:[0x60]
mov r8, qword [rax + 0x18]
mov rax, qword [r8 + 0x10]
xchg rbx, r8
mov rbx, qword [rax]
xchg r8, rbx
test r8, r8
mov rdi, rdi
je 0x1400323d6
mov r8, qword [r8 + 0x50]
test r8, r8
mov dword [rsp - 0x3c], ebx
je 0x1400323d6
mov edx, 0x7f591a43
xor edx, 0x2574fef3
add edx, 0x1d64819b
xor edx, 0x52e75c02
xor edx, 0x25753b4d
lea rcx, [rsp + 0x30]
mov r8, r8
lea r9d, [rdx - 1]
call fcn.140053c40
mov edx, 0x62f51a95
xor edx, 0x45fae545
xor edx, 0x11024bf6
add edx, 0x319ace57
sub edx, 0x67a88221
lea rcx, [rsp + 0x30]
xchg rbp, rbp
call fcn.140053d60
test rax, rax
je 0x140032398
mov dword [rsp - 0x30], edi
xor ecx, ecx
xchg r12, rdx
mov r12, rdi
xchg rdx, r12
mov word [rax], cx
mov r10, r10
movabs rcx, 0x3460a1ff0ecc1fb8
add rcx, 0x48333118
xor rcx, 0x17e2f4e8
add rcx, 0x7fffffff
sub rcx, 0xb6cb826
add rcx, qword [0x14005f440]
xchg r10, r10
movabs rax, 0xc472cb3e1d4bcc8f
xor rax, 0x23a86fcc
sub rax, 0x63dcb71
add rax, 0x7fffffff
add rax, 0x3cd619ed
ror rcx, 0x17
ror rcx, 8
ror rcx, 2
ror rcx, 3
ror rcx, 2
ror rcx, 1
add rax, rcx
lea rcx, [rsp + 0x20]
not rax
mov dword [rsp - 0x44], 0x5d471db
call rax
mov rax, qword [0x14005f430]
lea r8, [rsp + 0x20]
xchg rsi, rsi
ror rax, 0x16
ror rax, 2
ror rax, 4
ror rax, 4
ror rax, 1
lea rdx, [rsp + 0x260]
movabs rcx, 0xbe046f61890190a
xor rcx, 0x40d643ba
xor rcx, 0x22f9ef0f
xor rcx, 0x5eb4445c
add rcx, 0x7fffffff
add rcx, 0x57e3b34e
xchg r15, r9
mov r15, rbx
xchg r9, r15
sub rax, rcx
movabs rcx, 0x72b815890d663a5d
xor rcx, 0xe2adae8
xor rcx, 0x29023b19
add rcx, 0x6411fd77
ror rax, 0xa
ror rax, 3
ror rax, 1
ror rax, 1
xor rax, rcx
mov dword [rsp - 0x2c], 0x246b47ad
lea rcx, [rsp + 0x30]
call rax
xchg rbx, rcx
mov rcx, qword [rsp + 0x250]
xchg rcx, rbx
neg rsp
add rsp, 0xfffffffffffffdc0
neg rsp
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
mov eax, 0x6fcd643f
sub eax, 0x33a7627
xor eax, 0x2f30fc41
add eax, 0x34f5b811
add eax, 0x47683597
xchg rbx, r10
mov r10, qword [rsp + 0x250]
xchg rbx, r10
neg rsp
add rsp, 0xfffffffffffffdc0
neg rsp
nop
mov rdi, qword [rsp]
add rsp, 8
ret
xchg rdx, rbx
mov rdx, qword [rsp + 0x250]
xchg rbx, rdx
mov eax, 0x413d7d2d
sub eax, 0x12de05eb
xor eax, 0x5705b716
xor eax, 0xb95ac161
add rsp, 0x240
nop
mov rdi, qword [rsp]
add rsp, 8
ret
Function at 0x140034ebf
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov dword [rsp - 0x44], esp
xchg r11, rsi
mov qword [rsp + 0x20], r11
xchg rsi, r11
nop
mov qword [rsp - 8], r14
sub rsp, 8
nop
sub rsp, 0x268b31af
add rsp, 0x268b314f
mov rbx, rcx
xchg rsi, rdx
mov rdx, rsi
xchg rsi, rdx
add rcx, 8
mov dword [rsp - 0x38], edi
xor edx, edx
mov r8d, 0xdfb0c43
add r8d, 0x6463ce8a
xor r8d, 0x4c6275c2
sub r8d, 0x3e3cae0f
mov qword [rbx], rcx
call fcn.14004d990
mov r11, r11
xchg r12, rdx
mov r12, qword [rsi + 0x38]
xchg rdx, r12
xchg rbx, rcx
mov rbx, rcx
xchg rbx, rcx
xchg r10, rdx
mov qword [rbx + 0x108], r10
xchg rdx, r10
inc rdx
mov r11, r11
call fcn.140035150
mov r14, rax
test rax, rax
je 0x14003507b
mov dword [rsp - 0x28], esi
xorps xmm0, xmm0
mov qword [rsp + 0x70], rbp
xchg rsp, rbp
mov rsp, qword [rsi + 0x38]
xchg rbp, rsp
lea rax, [rsp + 0x28]
mov rsi, qword [rsi]
mov dword [rsp - 0x14], edi
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x20], rax
lea rdx, [rbp + 1]
mov dword [rsp - 0x2c], esi
xchg rsp, r8
movups xmmword [r8 + 0x28], xmm0
xchg r8, rsp
xchg r12, rsp
movups xmmword [r12 + 0x38], xmm0
xchg r12, rsp
xchg rsp, r12
movups xmmword [r12 + 0x48], xmm0
xchg rsp, r12
call fcn.14002ecb0
mov dword [rsp - 0x3c], ebx
mov edx, 0x1040aba3
add edx, 0x135d6411
xor edx, 0x4eae3844
sub edx, 0x5f5fff93
test rbp, rbp
je 0x140034ff2
mov r12, r12
mov rdi, rax
sub rsi, rax
xchg r8, r13
mov r13, rbp
xchg r8, r13
mov r9d, 0x244dfc0a
add r9d, 0x2d37f907
sub r9d, 0x1281f94a
sub r9d, 0x3f03fac8
movzx ecx, dx
xchg rdi, rdi
lea rdi, [rdi + 2]
and cx, r9w
ror edx, 3
ror edx, 4
ror edx, 1
xor cx, word [rsi + rdi - 2]
mov dword [rsp - 0x2c], ecx
mov word [rdi - 2], cx
sub r8, 1
jne 0x140034fc2
xchg rbx, rbx
xor ecx, ecx
mov word [rax + rbp*2], cx
xchg rcx, rdx
mov rdx, r14
xchg rdx, rcx
xchg r10, rdx
mov r10, qword [rbx + 0x108]
xchg r10, rdx
mov r8, qword [rsp + 0x20]
mov dword [rsp - 0x24], ebp
inc rdx
call fcn.140053980
xchg r8, rcx
mov r8, qword [rsp + 0x20]
xchg r8, rcx
lea rax, [rsp + 0x28]
mov rbp, qword [rsp + 0x70]
mov dword [rsp - 0x38], edi
cmp rcx, rax
jne 0x140035071
lea rdi, [rsp + 0x28]
xor eax, eax
xchg r12, r12
mov ecx, 0x38fe8694
sub ecx, 0x17c11473
add ecx, 0x36e0b6e8
sub ecx, 0x581e28d9
rep stosb byte [rdi], al
mov dword [rsp - 0x34], 0x245d8966
jmp 0x140035076
call fcn.14004d3c0
mov rdi, qword [rsp + 0x78]
lea r11, [rsp + 0x60]
mov dword [rsp - 0x1c], 0x645d5019
xchg rbx, rax
mov rbx, rax
xchg rbx, rax
mov rbx, qword [r11 + 0x20]
xchg r11, r11
mov rsi, qword [r11 + 0x28]
xchg rsp, r11
mov r11, rsp
xchg r11, rsp
nop
mov r14, qword [rsp]
add rsp, 8
ret
Function at 0x140037380
Capabilities:
Hash data using murmur3

Disassembly:
sub rsp, 0x28
mov dword [rcx + 8], edx
test edx, edx
mov dword [rsp - 0x2c], ecx
jns 0x1400374a2
mov rax, qword [0x14005f480]
movabs rcx, 0x525db2f60a4ab3ed
xor rcx, 0x35f81b0f
sub rcx, 0x22ed718d
add rcx, 0x7fffffff
add rcx, 0x201b7ed8
rol rax, 3
rol rax, 6
sub rax, rcx
movabs rcx, 0xb1545a976c5df40a
xor rcx, 0x98c6fc
sub rcx, 0x22b6f244
sub rcx, 0x2d35134a
add rcx, 0x49c59c4a
ror rax, 5
ror rax, 2
add rax, rcx
mov dword [rsp - 0x14], 0x6f27c6ef
mov ecx, edx
call rax
mov rdx, qword [0x14005f128]
mov dword [rsp - 0x40], esi
movabs rcx, 0x7dde8fb32e3236b6
add rcx, 0x17e73ef9
xor rcx, 0x3e7b6d29
add rcx, 0x7fffffff
add rcx, 0x2415bfe
rol rdx, 8
rol rdx, 4
rol rdx, 0x14
rol rdx, 1
rol rdx, 1
sub rdx, rcx
mov rsi, rsi
movabs rcx, 0x2720db537a08ba66
sub rcx, 0x1e09a4ce
sub rcx, 0x4b95cbe6
add rcx, 0x494f19ae
add rcx, 0x7fffffff
sub rcx, 0x449bb028
rol rdx, 0xf
rol rdx, 0xd
rol rdx, 0x15
rol rdx, 1
rol rdx, 1
xor rdx, rcx
mov ecx, eax
not rdx
mov r11, r11
add rsp, 0x28
jmp rdx
neg rsp
add rsp, 0xffffffffffffffd8
neg rsp
ret
Function at 0x14003b150
Capabilities:
Encode data using xor

Disassembly:
xchg r14, rbx
mov qword [rsp + 8], r14
xchg rbx, r14
nop
sub rsp, 8
mov qword [rsp], rdi
add rsp, 0xffffffffffffffe0
mov dword [rsp - 0x24], esp
mov rbx, rdx
mov rdi, rcx
nop
movabs rdx, 0xffffffff7321e68b
sub rdx, 0x6592121d
xor rdx, 0x16210eae
add rdx, 0x7fffffff
add rdx, 0x64512540
nop word [rax + rax]
inc rdx
cmp word [rbx + rdx*2], 0
mov dword [rsp - 0x40], ebp
jne 0x14003b1a2
xchg rsp, rdx
mov qword [rcx + 0x38], rsp
xchg rdx, rsp
call fcn.14002ecb0
mov r12, r12
xor r8d, r8d
mov edx, 0x1ee9ff2d
sub edx, 0x871d9ea
add edx, 0x17e32b61
add edx, 0x14d1579e
sub edx, 0x355c6fe5
cmp qword [rdi + 0x38], r8
mov rdx, rdx
jbe 0x14003b24f
sub rbx, rax
mov r9d, 0xc4904ef
xor r9d, 0x6fbe62fe
sub r9d, 0x42279936
add r9d, 0x4ffcadfd
xor r9d, 0x71cc7a27
nop word [rax + rax]
mov rdi, rdi
movzx ecx, dx
lea rax, [rax + 2]
and cx, r9w
mov r11, r11
ror edx, 6
ror edx, 1
ror edx, 1
xor cx, word [rbx + rax - 2]
inc r8
xchg r15, r15
mov word [rax - 2], cx
cmp r8, qword [rdi + 0x38]
jb 0x14003b221
xchg r12, rbx
mov r12, qword [rsp + 0x30]
xchg rbx, r12
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
nop
add rsp, 0xc238f0
sub rsp, 0xc238d0
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
Function at 0x14003c7f0
Capabilities:
Encode data using xor

Disassembly:
xchg r11, rbx
mov qword [rsp + 0x10], r11
xchg r11, rbx
mov qword [rsp + 0x18], rbp
nop
mov qword [rsp - 8], rsi
sub rsp, 8
nop
sub rsp, 8
mov qword [rsp], rdi
push r14
xchg r11, r11
nop
add rsp, 0x41fe93cd
sub rsp, 0x41fe93ed
lea rsi, [rdx + 8]
xorps xmm0, xmm0
mov dword [rsp - 0xc], ecx
mov qword [rdx], rsi
xor edi, edi
xchg rsp, rsi
movups xmmword [rsp], xmm0
xchg rsi, rsp
xchg r14, r9
mov r9, r14
xchg r9, r14
xchg rbp, r8
mov r8, rbp
xchg rbp, r8
movups xmmword [rsi + 0x10], xmm0
mov rsi, rsi
xchg r10, rbx
mov r10, rdx
xchg rbx, r10
movups xmmword [rsi + 0x20], xmm0
xchg r8, r8
xchg rdi, r12
mov qword [rdx + 0x38], r12
xchg r12, rdi
mov rax, qword [rcx + 0x38]
cmp r8, rax
mov dword [rsp - 0x38], 0x263b7971
jae 0x14003ca2f
sub rax, r8
mov qword [rsp + 0x40], r15
cmp rax, r9
xchg rsp, rsp
cmovb r14, rax
xchg r14, r13
mov qword [rdx + 0x38], r13
xchg r14, r13
mov rax, qword [rcx]
xchg rbx, rcx
mov rbx, qword [rdx]
xchg rcx, rbx
lea r15, [rax + r8*2]
mov dword [rsp - 0x20], ebx
cmp rcx, rsi
je 0x14003c8ca
call fcn.14004d3c0
xchg rcx, rcx
cmp r14, 0x18
jbe 0x14003c904
lea rcx, [r14 + r14]
xchg rcx, rcx
call fcn.14004d6a0
xchg r10, rax
mov qword [rbx], r10
xchg r10, rax
test rax, rax
mov rdx, rdx
jne 0x14003c916
mov qword [rbx], rsi
xchg rsi, r8
mov rsi, rdi
xchg r8, rsi
jmp 0x14003c93f
xchg rsi, r15
mov qword [rbx], r15
xchg r15, rsi
xchg r9, rsi
mov rax, r9
xchg rsi, r9
xorps xmm0, xmm0
mov dword [rsp - 0x14], ecx
xchg rbp, rax
movups xmmword [rbp], xmm0
xchg rbp, rax
xchg rbx, rax
movups xmmword [rbx + 0x10], xmm0
xchg rbx, rax
xchg r13, rax
movups xmmword [r13 + 0x20], xmm0
xchg r13, rax
xchg r8, rdx
mov rdx, qword [rbx]
xchg rdx, r8
and ebp, 3
mov r9d, 0xc63cfd0
add r9d, 0x6565cb0a
xor r9d, 0xb73badf
sub r9d, 0x6ce9e7a8
shl ebp, 2
shl ebp, 1
mov edx, r9d
mov dword [rsp - 0x44], edi
movzx ecx, bpl
ror edx, cl
cmp qword [rbx + 0x38], rdi
jbe 0x14003c9ed
mov dword [rsp - 0x14], esp
sub r15, r8
mov ecx, 0x3f687536
xor ecx, 0x576ef77d
xor ecx, 0xf2f5378
sub ecx, 0x543a1995
sub ecx, 0x12efb69f
nop dword [rax]
xchg r10, r10
nop word [rax + rax]
movzx eax, r9w
lea r8, [r8 + 2]
mov r14, r14
xor ax, dx
ror r9d, 7
ror r9d, 1
and ax, cx
ror edx, 1
ror edx, 2
ror edx, 3
ror edx, 1
ror edx, 1
xor ax, word [r15 + r8 - 2]
inc rdi
mov word [r8 - 2], ax
mov dword [rsp - 0x24], esp
cmp rdi, qword [rbx + 0x38]
jb 0x14003c9ad
mov r15, qword [rsp + 0x40]
xchg rsp, rsp
xchg rbx, rdi
mov rax, rdi
xchg rbx, rdi
mov rbx, qword [rsp + 0x48]
mov rbp, rbp
xchg rsi, rbp
mov rsi, qword [rsp + 0x50]
xchg rsi, rbp
add rsp, 0x20
mov dword [rsp - 0x10], ebp
pop r14
nop
add rsp, 8
mov rdi, qword [rsp - 8]
nop
mov rsi, qword [rsp]
add rsp, 8
ret
xchg rbx, r9
mov rax, r9
xchg rbx, r9
jmp 0x14003c9fe

Function at 0x14003d3d0
Capabilities:
Execute syscall

Disassembly:
movzx eax, byte [rsp + 0x28]
mov byte [rsp + 0x28], al
xchg r10, r10
jmp 0x14004c33a
mov r10, rcx
mov eax, dword [0x14005fb28]
mov rbp, rbp
cmp qword [0x14005fb80], 0
jne 0x14004ba90
syscall
ret
Function at 0x14003d3f0
Capabilities:
Execute syscall

Disassembly:
jmp 0x14004bb05
xchg rsp, r10
mov rsp, rcx
xchg rsp, r10
mov eax, dword [0x14005fa60]
cmp qword [0x14005fb80], 0
mov dword [rsp - 0xc], esi
jne 0x14004ba90
syscall
ret

Function at 0x14003d450
Capabilities:
Execute syscall

Disassembly:
jmp 0x14004bf3d
xchg r10, rcx
mov rcx, r10
xchg rcx, r10
mov eax, dword [0x14005fac8]
cmp qword [0x14005fb80], 0
mov dword [rsp - 0x24], 0x3141a0c0
jne 0x14004ba90
syscall
ret

Function at 0x14003d470
Capabilities:
Execute syscall

Disassembly:
jmp 0x14004bb61
xchg r10, rcx
mov rcx, r10
xchg r10, rcx
mov eax, dword [0x14005fa68]
cmp qword [0x14005fb80], 0
mov dword [rsp - 0x24], esi
jne 0x14004ba90
syscall
ret

Function at 0x14003d520
Capabilities:
Execute syscall

Disassembly:
jmp 0x14004bb33
xchg rcx, r10
mov rcx, r10
xchg rcx, r10
mov eax, dword [0x14005fa64]
mov dword [rsp - 0x40], esp
cmp qword [0x14005fb80], 0
jne 0x14004ba90
syscall
ret

Function at 0x14003d540
Capabilities:
Execute syscall

Disassembly:
jmp 0x14004bee3
mov r10, rcx
mov eax, dword [0x14005fac0]
cmp qword [0x14005fb80], 0
mov dword [rsp - 0x38], ebx
jne 0x14004ba90
syscall
ret

Function at 0x14003d550
Capabilities:
Execute syscall

Disassembly:
jmp 0x14004bf07
xchg r10, rcx
mov rcx, r10
xchg rcx, r10
mov eax, dword [0x14005fac4]
mov dword [rsp - 0x1c], 0x3db8bd5f
cmp qword [0x14005fb80], 0
jne 0x14004ba90
syscall
mov dword [rsp - 0x20], 0x64ecf0b9
ret

Function at 0x14003d560
Capabilities:
Execute syscall

Disassembly:
jmp 0x14004bda3
mov r10, rcx
mov eax, dword [0x14005faa0]
mov dword [rsp - 0x38], esp
cmp qword [0x14005fb80], 0
jne 0x14004ba90
syscall
ret

Function at 0x14003d570
Capabilities:
Execute syscall

Disassembly:
movzx eax, byte [rsp + 0x58]
mov byte [rsp + 0x58], al
mov dword [rsp - 0x24], 0x7404df12
movzx eax, byte [rsp + 0x48]
mov byte [rsp + 0x48], al
jmp 0x14004c311
xchg r11, r10
mov r11, rcx
xchg r10, r11
mov eax, dword [0x14005fb24]
mov r10, r10
cmp qword [0x14005fb80], 0
jne 0x14004ba90
syscall
ret

Function at 0x14003d590
Capabilities:
Execute syscall

Disassembly:
jmp 0x14004bc32
xchg rcx, r10
mov rcx, r10
xchg r10, rcx
mov eax, dword [0x14005fa7c]
cmp qword [0x14005fb80], 0
mov rsi, rsi
jne 0x14004ba90
syscall
ret

Function at 0x14003d5a0
Capabilities:
Execute syscall

Disassembly:
jmp 0x14004bc5b
sub rsp, 0x120
lea rcx, [0x14004baf8]
nop
push 0x3c8328a1
mov qword [rsp], rcx
nop
mov qword [rsp - 8], rbp
sub rsp, 8
push rsi
nop
sub rsp, 8
mov qword [rsp], rdi
push qword [0x14005fb88]
mov r12, r12
lea rsi, [rsp + 0x170]
lea rdi, [rsp + 0x28]
mov ecx, 0x4316c19a
xor ecx, 0x9ad52a6
add ecx, 0x329bb124
xor ecx, 0xbe6479e
sub ecx, 0x76b103ee
rep movsq qword [rdi], qword [rsi]
jmp qword [0x14005fb80]
xchg r12, rcx
mov r10, r12
xchg rcx, r12
mov eax, dword [0x14005fa80]
cmp qword [0x14005fb80], 0
mov dword [rsp - 0x18], 0x51b44e62
jne 0x14004ba90
syscall
ret

Function at 0x14003d5b0
Capabilities:
Execute syscall

Disassembly:
jmp 0x14004bc89
xchg r8, rcx
mov r10, r8
xchg r8, rcx
mov eax, dword [0x14005fa84]
mov r14, r14
cmp qword [0x14005fb80], 0
jne 0x14004ba90
syscall
mov dword [rsp - 0x14], edx
ret
Function at 0x14003d5f0
Capabilities:
Execute syscall

Disassembly:
jmp 0x14004bc08
xchg r10, rcx
mov rcx, r10
xchg rcx, r10
mov eax, dword [0x14005fa78]
mov dword [rsp - 0x3c], ebp
cmp qword [0x14005fb80], 0
jne 0x14004ba90
syscall
ret

Function at 0x14003d620
Capabilities:
Execute syscall

Disassembly:
jmp 0x14004bb8b
mov r10, rcx
mov r15, r15
mov eax, dword [0x14005fa6c]
cmp qword [0x14005fb80], 0
jne 0x14004ba90
syscall
mov dword [rsp - 0xc], 0x496aa805
ret

Function at 0x14003d630
Capabilities:
Execute syscall

Disassembly:
jmp 0x14004bd57
xchg r8, rcx
mov r10, r8
xchg r8, rcx
mov eax, dword [0x14005fa98]
xchg rdx, rdx
cmp qword [0x14005fb80], 0
jne 0x14004ba90
syscall
ret

Function at 0x14003d680
Capabilities:
Execute syscall

Disassembly:
jmp 0x14004c35d
xchg r10, r11
mov r11, rcx
xchg r10, r11
mov eax, dword [0x14005fb2c]
cmp qword [0x14005fb80], 0
xchg r14, r14
jne 0x14004ba90
syscall
ret

Function at 0x14003d690
Capabilities:
Execute syscall

Disassembly:
jmp 0x14004bbde
xchg rcx, rbx
mov r10, rbx
xchg rcx, rbx
mov eax, dword [0x14005fa74]
mov dword [rsp - 0x40], esp
cmp qword [0x14005fb80], 0
jne 0x14004ba90
syscall
ret

Function at 0x14003d730
Capabilities:
Execute syscall

Disassembly:
jmp 0x14004c2b5
xchg rsp, rcx
mov r10, rsp
xchg rsp, rcx
mov eax, dword [0x14005fb1c]
cmp qword [0x14005fb80], 0
mov dword [rsp - 0x30], 0x3bce57d7
jne 0x14004ba90
syscall
ret

Function at 0x14003d740
Capabilities:
Execute syscall

Disassembly:
jmp 0x14004bbb6
mov r10, rcx
mov eax, dword [0x14005fa70]
cmp qword [0x14005fb80], 0
mov dword [rsp - 0x18], 0x606fab20
jne 0x14004ba90
syscall
ret

Function at 0x14003d750
Capabilities:
Execute syscall

Disassembly:
jmp 0x14004bd80
mov r10, rcx
mov eax, dword [0x14005fa9c]
xchg r11, r11
cmp qword [0x14005fb80], 0
jne 0x14004ba90
syscall
ret