joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800b3040
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x80
mov rdi, rdx
mov r14, rcx
mov r8d, dword [rdx + 0xfb0]
mov rdx, qword [rdx + 0xfa8]
lea rcx, [rsp + 0x30]
call fcn.1800b87d0
mov rdx, rdi
lea rcx, [rsp + 0x60]
call fcn.1800b1b40
mov r8, qword gs:[0x58]
mov eax, dword [0x180e82938]
mov ecx, 4
mov rax, qword [r8 + rax*8]
mov eax, dword [rcx + rax]
cmp dword [0x180e74d18], eax
jg 0x1800b31f2
cmp byte [rdi + 0xfa4], 0
je 0x1800b31b6
lea rcx, [rsp + 0x60]
call fcn.1800c70e0
cmp rax, 5
jb 0x1800b31b6
xor edx, edx
lea rcx, [rsp + 0x60]
call fcn.1800c7010
cmp al, 0xe8
jne 0x1800b31b6
lea rcx, [rsp + 0x60]
call fcn.1800c7060
mov ecx, dword [rax + 1]
add ecx, 5
movsxd r8, ecx
add r8, qword [rsp + 0x70]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x30]
call fcn.1800c70f0
lea rdx, [0x180e74d00]
mov rcx, rax
call fcn.1800c7180
test al, al
je 0x1800b31b6
mov rbx, qword [rdi + 0x30]
mov rbp, qword [rdi + 0x38]
cmp rbx, rbp
je 0x1800b31b6
lea rsi, [rbx + 0x10]
cmp dword [rsi - 8], 5
je 0x1800b31a9
movups xmm0, xmmword [rsi]
movaps xmmword [rsp + 0x40], xmm0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x50]
call fcn.1800c6f00
mov r8d, 0x1100
lea rdx, [rsp + 0x20]
mov rcx, rax
call fcn.1800c7080
lea rcx, [rsp + 0x20]
call fcn.1800c7070
mov rdi, rax
lea rcx, [rsp + 0x20]
call fcn.1800c7060
lea r9, [0x1802bbe58]
lea r8, [0x1802bbe54]
mov rdx, rdi
mov rcx, rax
call fcn.1800b1ab0
mov rdi, rax
lea rcx, [rsp + 0x20]
call fcn.1800c7070
cmp rax, rdi
jne 0x1800b31e1
add rbx, 0x48
add rsi, 0x48
cmp rbx, rbp
jne 0x1800b3137
mov rax, qword [0x1802b7668]
mov qword [r14], rax
mov rax, r14
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
mov dword [r14], 3
mov dword [r14 + 4], 9
jmp 0x1800b31c0
lea rcx, [0x180e74d18]
call fcn.18024b360
cmp dword [0x180e74d18], 0xffffffff
jne 0x1800b30af
lea rax, str.558bec83ec..a1........8365....8365....5357bf........3bc7bb........74..85c374..f7d0
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0x52
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
lea rcx, [0x180e74d00]
call fcn.1800c7590
lea rcx, [0x1802a7ef0]
call fcn.18024b160
nop
lea rcx, [0x180e74d18]
call fcn.18024b2f0
jmp 0x1800b30af
Function at 0x1800d1b10
Capabilities:
Enumerate pe sections

Disassembly:
mov rax, qword [rcx]
mov rdx, qword [rax + 0xfb8]
test rdx, rdx
je 0x1800d1d78
movzx eax, word [rdx + 2]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
movsd qword [rcx + 0x3a88], xmm0
movzx eax, word [rdx + 4]
movd xmm1, eax
cvtdq2pd xmm1, xmm1
movsd qword [rcx + 0x3a90], xmm1
movzx eax, word [rdx + 6]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
movsd qword [rcx + 0x3a98], xmm0
movzx eax, word [rdx + 8]
movd xmm1, eax
cvtdq2pd xmm1, xmm1
movsd qword [rcx + 0x3aa0], xmm1
movzx eax, word [rdx + 0xa]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
movsd qword [rcx + 0x3aa8], xmm0
movzx eax, word [rdx + 0xc]
movd xmm1, eax
cvtdq2pd xmm1, xmm1
movsd qword [rcx + 0x3ab0], xmm1
movzx eax, word [rdx + 0xe]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
movsd qword [rcx + 0x3ab8], xmm0
movzx eax, word [rdx + 0x10]
movd xmm1, eax
cvtdq2pd xmm1, xmm1
movsd qword [rcx + 0x3ac0], xmm1
movzx eax, word [rdx + 0x12]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
movsd qword [rcx + 0x3ac8], xmm0
movzx eax, word [rdx + 0x14]
movd xmm1, eax
cvtdq2pd xmm1, xmm1
movsd qword [rcx + 0x3ad0], xmm1
movzx eax, word [rdx + 0x16]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
movsd qword [rcx + 0x3ad8], xmm0
movzx eax, word [rdx + 0x18]
movd xmm1, eax
cvtdq2pd xmm1, xmm1
movsd qword [rcx + 0x3ae0], xmm1
movzx eax, word [rdx + 0x1a]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
movsd qword [rcx + 0x3ae8], xmm0
movzx eax, word [rdx + 0x1c]
movd xmm1, eax
cvtdq2pd xmm1, xmm1
movsd qword [rcx + 0x3af0], xmm1
movzx eax, word [rdx + 0x1e]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
movsd qword [rcx + 0x3af8], xmm0
movzx eax, word [rdx + 0x20]
movd xmm1, eax
cvtdq2pd xmm1, xmm1
movsd qword [rcx + 0x3b00], xmm1
movzx eax, word [rdx + 0x22]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
movsd qword [rcx + 0x3b08], xmm0
movzx eax, word [rdx + 0x24]
movd xmm1, eax
cvtdq2pd xmm1, xmm1
movsd qword [rcx + 0x3b10], xmm1
movzx eax, word [rdx + 0x26]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
movsd qword [rcx + 0x3b18], xmm0
movzx eax, word [rdx + 0x28]
movd xmm1, eax
cvtdq2pd xmm1, xmm1
movsd qword [rcx + 0x3b20], xmm1
movzx eax, word [rdx + 0x2a]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
movsd qword [rcx + 0x3b28], xmm0
movzx eax, word [rdx + 0x2c]
movd xmm1, eax
cvtdq2pd xmm1, xmm1
movsd qword [rcx + 0x3b30], xmm1
movzx eax, word [rdx + 0x2e]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
movsd qword [rcx + 0x3b38], xmm0
movzx eax, word [rdx + 0x30]
movd xmm1, eax
cvtdq2pd xmm1, xmm1
movsd qword [rcx + 0x3b40], xmm1
movzx eax, word [rdx + 0x32]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
movsd qword [rcx + 0x3b48], xmm0
movzx eax, word [rdx + 0x34]
movd xmm1, eax
cvtdq2pd xmm1, xmm1
movsd qword [rcx + 0x3b50], xmm1
movzx eax, word [rdx + 0x36]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
movsd qword [rcx + 0x3b58], xmm0
movzx eax, word [rdx + 0x38]
movd xmm1, eax
cvtdq2pd xmm1, xmm1
movsd qword [rcx + 0x3b60], xmm1
movzx eax, word [rdx + 0x3a]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
movsd qword [rcx + 0x3b68], xmm0
movd xmm1, dword [rdx + 0x3c]
cvtdq2pd xmm1, xmm1
movsd qword [rcx + 0x3b70], xmm1
ret
Function at 0x1800d6c60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbp
push r12
push r14
sub rsp, 0x30
mov rdx, qword [rcx + 0xfe8]
test rdx, rdx
je 0x1800d6c7b
mov ebp, dword [rdx + 0x24]
jmp 0x1800d6c85
mov rax, qword [rcx + 0xff0]
mov ebp, dword [rax + 0x24]
lea eax, [rbp - 0x200]
cmp eax, 0xfe00
jbe 0x1800d6c9e
mov byte [rcx + 0xf88], 1
mov ebp, 0x200
test rdx, rdx
je 0x1800d6ca9
mov r14d, dword [rdx + 0x20]
jmp 0x1800d6cb4
mov rax, qword [rcx + 0xff0]
mov r14d, dword [rax + 0x20]
cmp r14d, ebp
jae 0x1800d6cc3
mov byte [rcx + 0xf88], 1
mov r14d, ebp
xor r8d, r8d
mov r12d, r8d
cmp dword [rcx + 0x80], r8d
jle 0x1800d6e1f
mov qword [rsp + 0x50], rbx
neg r14d
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x28], r13
mov r13d, ebp
mov qword [rsp + 0x20], r15
neg r13d
mov r15d, r8d
nop dword [rax + rax]
mov rdi, qword [rcx + 0xfd8]
mov rax, qword [rcx + 0xfe8]
add rdi, r15
mov esi, dword [rdi + 0xc]
and esi, r14d
test rax, rax
jne 0x1800d6d23
mov rax, qword [rcx + 0xff0]
mov rbx, qword [rcx + 0xfa8]
mov edx, dword [rax + 0x3c]
cmp esi, edx
mov r10d, dword [rdi + 0x14]
cmovb esi, r8d
and r10d, 0xfffffe00
mov r9d, r10d
add r9, rbx
cmp r9, rbx
ja 0x1800d6d56
mov r9, r8
mov byte [rcx + 0xf89], 1
mov r10d, r8d
mov eax, dword [rdi + 0x10]
lea edx, [rax - 1]
add edx, ebp
and edx, r13d
cmp edx, eax
je 0x1800d6d6c
mov byte [rcx + 0xf8a], 1
mov r11d, dword [rcx + 0xfb0]
cmp r11d, r10d
ja 0x1800d6d7d
mov edx, r8d
jmp 0x1800d6da4
test edx, edx
je 0x1800d6dab
cmp r9, rbx
jb 0x1800d6d9e
mov eax, edx
add rax, r9
cmp rax, r9
jb 0x1800d6d9e
lea r8, [rbx + r11]
cmp r8, rbx
jb 0x1800d6d9e
cmp r8, rax
jae 0x1800d6dab
mov edx, r11d
sub edx, r10d
mov byte [rcx + 0xf89], 1
mov dword [r15 + rcx + 0x94], esi
inc r12d
mov qword [r15 + rcx + 0x88], r9
mov r8d, 0
mov dword [r15 + rcx + 0x98], edx
mov eax, dword [rdi + 0x10]
mov dword [r15 + rcx + 0x9c], eax
mov dword [r15 + rcx + 0x90], r10d
mov eax, dword [rdi + 0x24]
mov dword [r15 + rcx + 0xa0], eax
mov rax, qword [rdi]
mov qword [r15 + rcx + 0xa4], rax
add r15, 0x28
cmp r12d, dword [rcx + 0x80]
jl 0x1800d6d00
mov r15, qword [rsp + 0x20]
mov r13, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
call fcn.1800d4d50
xor eax, eax
add rsp, 0x30
pop r14
pop r12
pop rbp
ret

Function at 0x1800e7ac0
Capabilities:
Hash data using fnv

Disassembly:
movzx eax, byte [rdx + 1]
movabs r9, 0x100000001b3
movzx r8d, byte [rdx]
xor r8, rcx
movzx ecx, byte [rdx + 6]
imul r8, r9
xor r8, rax
movzx eax, byte [rdx + 2]
imul r8, r9
xor r8, rax
movzx eax, byte [rdx + 3]
imul r8, r9
xor r8, rax
movzx eax, byte [rdx + 4]
imul r8, r9
xor r8, rax
movzx eax, byte [rdx + 5]
imul r8, r9
xor rax, r8
imul rax, r9
xor rax, rcx
movzx ecx, byte [rdx + 7]
imul rax, r9
xor rax, rcx
imul rax, r9
ret
mov rdx, rcx
movabs rcx, 0xcbf29ce484222325
jmp 0x1800e7a50
Function at 0x1800fd9a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [rdx]
xorps xmm0, xmm0
cvtsi2sd xmm0, rax
movsd qword [rcx + 0x20], xmm0
movzx eax, word [rdx + 6]
movd xmm1, eax
cvtdq2pd xmm1, xmm1
movsd qword [rcx + 0x30], xmm1
xorps xmm1, xmm1
movzx eax, word [rdx + 4]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
movsd qword [rcx + 0x28], xmm0
xorps xmm0, xmm0
mov eax, dword [rdx + 0x10]
cvtsi2sd xmm1, rax
movsd qword [rcx + 0x48], xmm1
xorps xmm1, xmm1
mov eax, dword [rdx + 0x14]
cvtsi2sd xmm0, rax
movsd qword [rcx + 0x50], xmm0
xorps xmm0, xmm0
mov eax, dword [rdx + 8]
cvtsi2sd xmm1, rax
movsd qword [rcx + 0x38], xmm1
xorps xmm1, xmm1
mov eax, dword [rdx + 0xc]
cvtsi2sd xmm0, rax
movsd qword [rcx + 0x40], xmm0
xorps xmm0, xmm0
mov eax, dword [rdx + 0x18]
cvtsi2sd xmm1, rax
movsd qword [rcx + 0x58], xmm1
xorps xmm1, xmm1
mov eax, dword [rdx + 0x1c]
cvtsi2sd xmm0, rax
movsd qword [rcx + 0x60], xmm0
xorps xmm0, xmm0
mov eax, dword [rdx + 0x20]
cvtsi2sd xmm1, rax
movsd qword [rcx + 0x68], xmm1
xorps xmm1, xmm1
mov eax, dword [rdx + 0x24]
cvtsi2sd xmm0, rax
movsd qword [rcx + 0x70], xmm0
xorps xmm0, xmm0
mov eax, dword [rdx + 0x28]
cvtsi2sd xmm1, rax
movsd qword [rcx + 0x78], xmm1
xorps xmm1, xmm1
mov eax, dword [rdx + 0x2c]
cvtsi2sd xmm0, rax
movsd qword [rcx + 0x80], xmm0
xorps xmm0, xmm0
mov eax, dword [rdx + 0x30]
cvtsi2sd xmm1, rax
movsd qword [rcx + 0x88], xmm1
xorps xmm1, xmm1
mov eax, dword [rdx + 0x34]
cvtsi2sd xmm0, rax
movsd qword [rcx + 0x90], xmm0
xorps xmm0, xmm0
mov eax, dword [rdx + 0x38]
cvtsi2sd xmm1, rax
movsd qword [rcx + 0x98], xmm1
xorps xmm1, xmm1
mov eax, dword [rdx + 0x3c]
cvtsi2sd xmm0, rax
movsd qword [rcx + 0xa0], xmm0
xorps xmm0, xmm0
mov eax, dword [rdx + 0x40]
cvtsi2sd xmm1, rax
movsd qword [rcx + 0xa8], xmm1
mov eax, dword [rdx + 0x44]
cvtsi2sd xmm0, rax
movsd qword [rcx + 0xb0], xmm0
ret

Function at 0x180101080
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x28
mov rax, qword [0x180e681c0]
xor rax, rsp
mov qword [rsp + 0x10], rax
mov dword [rsp], 0x3e3c2928
lea rax, [rsp]
mov dword [rsp + 4], 0x7d7b5d5b
mov word [rsp + 8], 0x252f
nop dword [rax]
cmp byte [rax], dl
je 0x1801010d5
inc rax
lea rcx, [rsp + 0xa]
cmp rax, rcx
jne 0x1801010b0
xor al, al
mov rcx, qword [rsp + 0x10]
xor rcx, rsp
call fcn.18024b290
add rsp, 0x28
ret
mov al, 1
mov rcx, qword [rsp + 0x10]
xor rcx, rsp
call fcn.18024b290
add rsp, 0x28
ret
Function at 0x18012ee40
Capabilities:
Allocate thread local storage

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
xor ecx, ecx
mov edx, 0x1f
cmp eax, 0xffffffff
mov dword [rbx], eax
cmove ecx, edx
mov eax, ecx
add rsp, 0x20
pop rbx
ret
Function at 0x180147740
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
xor r10d, r10d
mov rdi, r9
lea r9, [0x180dbc710]
mov rbp, r8
mov r15, rdx
mov r12, rcx
mov r11, rdx
test r8, r8
je 0x1801477b4
lea rdx, [r8 - 1]
test rdx, rdx
je 0x1801477ac
nop word [rax + rax]
movzx eax, byte [r11]
movzx ecx, dl
and cl, 0x1f
inc r11
mov eax, dword [r9 + rax*4]
rol eax, cl
xor r10d, eax
sub rdx, 1
jne 0x180147790
movzx eax, byte [r11]
xor r10d, dword [r9 + rax*4]
test rdi, rdi
je 0x180147804
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rdi + rax], 0
jne 0x1801477c0
mov r8, rdi
test rax, rax
je 0x180147804
lea rdx, [rax - 1]
test rdx, rdx
je 0x1801477fc
nop word [rax + rax]
movzx eax, byte [r8]
movzx ecx, dl
and cl, 0x1f
inc r8
mov eax, dword [r9 + rax*4]
rol eax, cl
xor r10d, eax
sub rdx, 1
jne 0x1801477e0
movzx ecx, byte [r8]
xor r10d, dword [r9 + rcx*4]
xor edx, edx
mov eax, r10d
div dword [r12]
xor esi, esi
mov r14d, edx
mov rbx, qword [r12 + rdx*8 + 8]
test rbx, rbx
je 0x180147895
nop dword [rax]
cmp qword [rbx + 8], rbp
jne 0x18014783e
mov rcx, qword [rbx]
mov r8, rbp
mov rdx, r15
call fcn.180281950
test eax, eax
jne 0x18014783e
lea r9d, [rax + 1]
jmp 0x180147841
xor r9d, r9d
mov rax, qword [rbx + 0x10]
cmp rax, rdi
je 0x18014787b
test rax, rax
je 0x180147877
test rdi, rdi
je 0x180147877
mov r8, rdi
sub r8, rax
nop word [rax + rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x180147873
inc rax
test ecx, ecx
jne 0x180147860
test edx, edx
je 0x18014787b
xor eax, eax
jmp 0x180147880
mov eax, 1
test r9d, r9d
je 0x180147889
test eax, eax
jne 0x1801478b6
mov rsi, rbx
mov rbx, qword [rbx + 0x20]
test rbx, rbx
jne 0x180147820
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
cmp dword [rsp + 0x60], 0
mov rdi, qword [rbx + 0x18]
je 0x1801478f3
mov rcx, qword [rbx + 0x20]
test rsi, rsi
jne 0x1801478d1
mov qword [r12 + r14*8 + 8], rcx
jmp 0x1801478d5
mov qword [rsi + 0x20], rcx
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x1801478e3
call fcn.18012eeb0
mov rcx, qword [rbx]
call fcn.18012eeb0
mov rcx, rbx
call fcn.18012eeb0
mov rax, rdi
jmp 0x180147897
Function at 0x180147930
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov r15, rcx
mov rdi, r9
mov ecx, 0x28
mov r14, r8
mov rbp, rdx
call fcn.18012ef30
mov rsi, rax
test rax, rax
je 0x180147979
mov rcx, r14
call fcn.18012ef30
mov qword [rsi], rax
test rax, rax
jne 0x180147983
mov rcx, rsi
call fcn.18012eeb0
mov eax, 1
jmp 0x180147a7d
mov qword [rsp + 0x40], rbx
xor ebx, ebx
test rdi, rdi
je 0x1801479b8
mov rcx, rdi
call fcn.18012ef90
mov qword [rsi + 0x10], rax
test rax, rax
jne 0x1801479bc
mov rcx, qword [rsi]
call fcn.18012eeb0
mov rcx, rsi
call fcn.18012eeb0
lea eax, [rbx + 1]
jmp 0x180147a78
mov qword [rsi + 0x10], rbx
mov rax, qword [rsp + 0x60]
mov r8, r14
mov rcx, qword [rsi]
mov rdx, rbp
mov qword [rsi + 0x18], rax
mov qword [rsi + 8], r14
call fcn.180280e70
lea r8, [0x180dbc710]
test r14, r14
je 0x180147a13
lea rdx, [r14 - 1]
test rdx, rdx
je 0x180147a0b
nop dword [rax]
movzx eax, byte [rbp]
movzx ecx, dl
and cl, 0x1f
inc rbp
mov eax, dword [r8 + rax*4]
rol eax, cl
xor ebx, eax
sub rdx, 1
jne 0x1801479f0
movzx eax, byte [rbp]
xor ebx, dword [r8 + rax*4]
test rdi, rdi
je 0x180147a61
mov rax, 0xffffffffffffffff
nop
inc rax
cmp byte [rdi + rax], 0
jne 0x180147a20
test rax, rax
je 0x180147a61
lea rdx, [rax - 1]
test rdx, rdx
je 0x180147a5a
nop word [rax + rax]
movzx eax, byte [rdi]
movzx ecx, dl
and cl, 0x1f
inc rdi
mov eax, dword [r8 + rax*4]
rol eax, cl
xor ebx, eax
sub rdx, 1
jne 0x180147a40
movzx ecx, byte [rdi]
xor ebx, dword [r8 + rcx*4]
xor edx, edx
mov eax, ebx
div dword [r15]
mov rax, qword [r15 + rdx*8 + 8]
mov qword [rsi + 0x20], rax
xor eax, eax
mov qword [r15 + rdx*8 + 8], rsi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x18014dc50
Capabilities:
Parse pe header

Disassembly:
mov r10, r8
mov r9, rdx
cmp rdx, 0x40
jb 0x18014dcbd
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x18014dcc3
movsxd rax, dword [rcx + 0x3c]
test eax, eax
js 0x18014dcc3
lea rdx, [rax + 0x18]
cmp r9, rdx
jb 0x18014dcc3
add rax, rcx
add rdx, 0xe0
cmp dword [rax], 0x4550
jne 0x18014dcc3
movzx r8d, word [rax + 4]
mov r11d, 0x14c
cmp r8w, r11w
je 0x18014dca6
mov r11d, 0x8664
cmp r8w, r11w
jne 0x18014dcc3
cmp r9, rdx
jbe 0x18014dcc3
mov edx, 0x2000
test word [rax + 0x16], dx
jne 0x18014dcc3
mov eax, dword [rax + 0x28]
add rax, r10
ret
cmp r9, 0x10
jb 0x18014dce4
cmp dword [rcx], 0x464c457f
jne 0x18014dce4
movzx edx, byte [rcx + 4]
mov r8d, edx
sub r8d, 1
je 0x18014dcef
cmp r8d, 1
jne 0x18014dce4
cmp r9, 0x40
jae 0x18014dcf5
movabs rax, 0xfffabadafabadaff
ret
cmp r9, 0x34
jb 0x18014dce4
sub edx, 1
je 0x18014dd0b
cmp edx, 1
jne 0x18014dce4
cmp word [rcx + 0x10], 2
jne 0x18014dce4
mov rax, qword [rcx + 0x18]
ret
cmp word [rcx + 0x10], 2
jne 0x18014dce4
mov eax, dword [rcx + 0x18]
ret
Function at 0x180151de0
Capabilities:
Parse pe header

Disassembly:
cmp rdx, 0x40
jb 0x180151e40
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x180151e40
movsxd rax, dword [rcx + 0x3c]
test eax, eax
js 0x180151e40
lea r8, [rax + 0x18]
cmp rdx, r8
jb 0x180151e40
add rax, rcx
cmp dword [rax], 0x4550
jne 0x180151e40
lea rcx, [r8 + 0xe0]
cmp rdx, rcx
jb 0x180151e40
mov r10d, 0x20b
mov ecx, 0xf0
cmp word [rax + 0x18], r10w
mov r9d, 0xe0
cmovne ecx, r9d
add rcx, r8
xor r8d, r8d
cmp rdx, rcx
cmovb rax, r8
ret
xor eax, eax
ret

Function at 0x180157140
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r13
push r14
push r15
mov r14, rcx
lea r12, [rcx + 0x33abc]
xor r15d, r15d
lea r13, [0x180e770a0]
mov ebp, dword [r14 + 0x28d1c]
lea r12, [r12 + 4]
mov r8d, r15d
mov r11d, r15d
and r8d, 1
shr r11d, 1
sub ebp, r8d
mov ebx, r8d
or r8d, 2
mov edx, r11d
and edx, 1
shr r11d, 1
mov r10d, edx
neg ebx
xor rbp, rbx
neg r10d
mov esi, dword [r14 + r8*4 + 0x28d18]
inc r15d
sub esi, edx
shr rbp, 2
add r8d, r8d
xor rsi, r10
or r8d, edx
shr rsi, 2
mov edx, r11d
and ebp, 0x1ff
and edx, 1
shr r11d, 1
and r11d, 1
mov r9d, edx
mov edi, dword [r14 + r8*4 + 0x28d18]
lea eax, [r8 + r8]
or eax, edx
sub edi, edx
neg r9d
and esi, 0x1ff
xor rdi, r9
shr rdi, 2
mov ecx, dword [r14 + rax*4 + 0x28d18]
and edi, 0x1ff
sub ecx, r11d
mov eax, r11d
neg eax
xor rcx, rax
shr rcx, 2
and ecx, 0x1ff
mov eax, dword [r13 + rcx*4]
add eax, dword [r13 + rbp*4]
add eax, dword [r13 + rsi*4]
add eax, dword [r13 + rdi*4]
mov dword [r12 - 4], eax
cmp r15d, 0x10
jb 0x180157170
mov rbx, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov dword [r14 + 0x33afc], 0
pop r15
pop r14
pop r13
pop r12
ret
Function at 0x18015c570
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
mov r10d, dword [rcx]
mov r11d, 0x800
mov eax, r10d
mov esi, edx
shr rax, 2
mov r12, r9
mov edi, r8d
mov r14, rcx
mov ecx, dword [rcx + 4]
lea r8, [0x180e770a0]
mov rbx, r12
mov ebp, dword [r8 + rax*4]
mov eax, r11d
sub eax, r10d
sub r11d, ecx
mov r10d, eax
mov eax, ecx
shr rax, 2
shr r10, 2
mov r15d, dword [r8 + rax*4]
add r15d, dword [r8 + r10*4]
mov eax, r11d
shr rax, 2
mov r13d, dword [r8 + rax*4]
add r13d, dword [r8 + r10*4]
mov dword [rsp + 0x30], r13d
xor r9d, r9d
nop dword [rax]
cmp r9d, edi
jae 0x18015c755
mov r11, rsi
lea r13, [0x180e770a0]
shl r11, 5
mov r8d, r9d
add r11, r14
or r8d, 8
xor r10d, r10d
nop dword [rax]
nop dword [rax + rax]
mov eax, r8d
mov ecx, r8d
shr rax, 1
and ecx, 1
shr r8d, 1
mov edx, dword [r11 + rax*4 + 8]
mov eax, ecx
sub edx, ecx
neg eax
xor rdx, rax
shr rdx, 2
and edx, 0x1ff
add r10d, dword [r13 + rdx*4]
cmp r8d, 1
jne 0x18015c620
mov r13d, dword [rsp + 0x30]
lea eax, [r10 + rbp]
mov dword [rbx], eax
inc r9d
add rbx, 4
cmp r9d, 8
jb 0x18015c5f0
cmp r9d, 0x10
jae 0x18015c6e9
mov rbx, rsi
lea r11, [r12 + r9*4]
shl rbx, 5
lea rsi, [0x180e770a0]
add rbx, r14
cmp r9d, edi
jae 0x18015c755
lea r8d, [r9 - 8]
or r8d, 8
xor r10d, r10d
nop dword [rax]
mov eax, r8d
mov ecx, r8d
shr rax, 1
and ecx, 1
shr r8d, 1
mov edx, dword [rbx + rax*4 + 0x208]
mov eax, ecx
sub edx, ecx
neg eax
xor rdx, rax
shr rdx, 2
and edx, 0x1ff
add r10d, dword [rsi + rdx*4]
cmp r8d, 1
jne 0x18015c6a0
lea eax, [r10 + r15]
inc r9d
mov dword [r11], eax
add r11, 4
cmp r9d, 0x10
jb 0x18015c685
jmp 0x18015c6f0
lea rsi, [0x180e770a0]
cmp r9d, edi
jae 0x18015c755
lea r11, [r12 + r9*4]
nop dword [rax]
lea eax, [r9 - 0x10]
bts eax, 8
xor r10d, r10d
nop dword [rax + rax]
mov ecx, eax
mov edx, eax
shr rcx, 1
and edx, 1
shr eax, 1
mov r8d, dword [r14 + rcx*4 + 0x408]
mov ecx, edx
sub r8d, edx
neg ecx
xor r8, rcx
shr r8, 2
and r8d, 0x1ff
add r10d, dword [rsi + r8*4]
cmp eax, 1
jne 0x18015c710
lea eax, [r10 + r13]
inc r9d
mov dword [r11], eax
add r11, 4
cmp r9d, edi
jb 0x18015c700
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x180167010
Capabilities:
Encode data using xor

Disassembly:
push rdi
sub rsp, 0x20
mov rax, qword [0x180dcd1c8]
mov rdi, rcx
cmp byte [rax + 0x54], 0
je 0x180167031
mov eax, 0x1020304
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 0x30], rbx
xor ebx, ebx
xor ecx, ecx
call fcn.180260d90
xor ebx, eax
call fcn.1802657c4
shl eax, 0xc
xor ebx, eax
mov rax, qword [rdi + 0x10]
movzx ecx, word [rax + 0x2c]
xor ecx, dword [rax + 0x40]
xor ebx, ecx
call fcn.180260d40
xor ebx, eax
je 0x180167038
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x180174fd0
Capabilities:
Encode data using xor

Disassembly:
mov r8, rcx
xor eax, eax
movzx ecx, byte [rcx]
test cl, cl
je 0x180175009
nop dword [rax]
shl eax, 4
lea r8, [r8 + 1]
movzx edx, cl
add eax, edx
mov edx, eax
mov ecx, eax
and edx, 0xf0000000
mov eax, edx
shr edx, 0x18
not eax
and eax, ecx
movzx ecx, byte [r8]
xor eax, edx
test cl, cl
jne 0x180174fe0
ret
Function at 0x1801a4a70
Capabilities:
Compute adler32 checksum

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov ebx, r8d
mov esi, edx
mov rdi, rcx
test edx, edx
jne 0x1801a4a9d
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
test rdi, rdi
jne 0x1801a4ab9
lea r8d, [rdi + 0x2a]
lea rdx, str.C:work_staticengineexternalsupx_srccompress.cpp
lea rcx, str.buf___NULL
call fcn.18026498c
mov r8d, ebx
mov edx, esi
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x1801b80c0
mov eax, r8d
mov r8d, edx
mov rdx, rcx
mov ecx, eax
jmp 0x1801be610
movzx r9d, cx
mov r11d, r8d
shr ecx, 0x10
mov r10, rdx
test rdx, rdx
jne 0x1801be626
lea eax, [rdx + 1]
ret
test r8d, r8d
je 0x1801be763
nop
mov edx, 0x15b0
cmp r11d, edx
cmovb edx, r11d
sub r11d, edx
cmp edx, 0x10
jl 0x1801be71d
mov r8d, edx
shr r8, 4
mov eax, r8d
neg eax
shl eax, 4
add edx, eax
nop dword [rax]
movzx eax, byte [r10]
add r9d, eax
movzx eax, byte [r10 + 1]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 2]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 3]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 4]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 5]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 6]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 7]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 8]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 9]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 0xa]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 0xb]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 0xc]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 0xd]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 0xe]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 0xf]
add ecx, r9d
add r10, 0x10
add r9d, eax
add ecx, r9d
sub r8, 1
jne 0x1801be660
test edx, edx
je 0x1801be734
movzx eax, byte [r10]
dec edx
add r9d, eax
inc r10
add ecx, r9d
test edx, edx
jg 0x1801be721
mov eax, 0x80078071
mul r9d
shr edx, 0xf
imul eax, edx, 0xffff000f
add r9d, eax
mov eax, 0x80078071
mul ecx
shr edx, 0xf
imul eax, edx, 0xffff000f
add ecx, eax
test r11d, r11d
jne 0x1801be630
shl ecx, 0x10
or ecx, r9d
mov eax, ecx
ret