joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400156a0
Capabilities:
Parse credit card information

Disassembly:
push rbp
push rbx
mov eax, 0xfc8
call fcn.14001ebb0
sub rsp, rax
lea rbp, [rsp + 0x80]
lea rax, [rbp + 0x1a0]
add rax, 0x1e
mov qword [rbp + 0x9b0], rax
mov rax, qword [rbp + 0x9b0]
movzx eax, byte [rax]
movsx eax, al
cmp eax, 0x7d
je 0x1400156ed
cmp eax, 0x7d
jg 0x1400156f0
cmp eax, 0x75
je 0x140015666
cmp eax, 0x75
jg 0x1400156f0
cmp eax, 0x6c
je 0x1400155e6
cmp eax, 0x6c
jg 0x1400156f0
cmp eax, 0x61
je 0x1400156f3
cmp eax, 0x61
jg 0x1400156f0
cmp eax, 0x57
je 0x140015652
cmp eax, 0x57
jg 0x1400156f0
cmp eax, 0x51
je 0x1400156f6
cmp eax, 0x51
jg 0x1400156f0
cmp eax, 0x41
je 0x1400155d2
cmp eax, 0x41
jg 0x1400156f0
cmp eax, 0x3e
je 0x14001567a
cmp eax, 0x3e
jg 0x1400156f0
cmp eax, 0x33
je 0x1400156f9
cmp eax, 0x33
jg 0x1400156f0
cmp eax, 0xc
je 0x14001568b
cmp eax, 0x2d
je 0x1400156fc
jmp 0x1400156eb
mov rax, qword [rbp + 0x9b0]
mov rcx, rax
call fcn.1400016c0
jmp 0x1400156fd
mov rax, qword [rbp + 0x9b0]
mov qword [rbp + 0x9a8], rax
mov rax, qword [rbp + 0x9a8]
movzx eax, byte [rax]
movsx eax, al
cmp eax, 0x67
je 0x14001563a
cmp eax, 0x67
jg 0x140015640
cmp eax, 0x37
je 0x140015646
cmp eax, 0x37
jg 0x140015640
cmp eax, 0x23
je 0x140015629
cmp eax, 0x23
jg 0x140015640
cmp eax, 0xa
je 0x14001564c
cmp eax, 0x1c
jmp 0x140015640
mov rax, qword [rbp + 0x9a8]
mov rcx, rax
call fcn.14000154c
jmp 0x14001564d
nop
jmp 0x1400156fd
nop
jmp 0x1400156fd
nop
jmp 0x1400156fd
nop
jmp 0x1400156fd
mov rax, qword [rbp + 0x9b0]
mov rcx, rax
call fcn.140002b66
jmp 0x1400156fd
mov rax, qword [rbp + 0x9b0]
mov rcx, rax
call fcn.14000191e
jmp 0x1400156fd
mov rax, qword [rbp + 0x9b0]
mov rcx, rax
call fcn.140002b66
jmp 0x1400156fd
mov rax, qword [rbp + 0x9b0]
mov qword [rbp + 0x9a0], rax
mov rax, qword [rbp + 0x9a0]
movzx eax, byte [rax]
movsx eax, al
cmp eax, 0x67
je 0x1400156df
cmp eax, 0x67
jg 0x1400156e2
cmp eax, 0x37
je 0x1400156e5
cmp eax, 0x37
jg 0x1400156e2
cmp eax, 0x23
je 0x1400156ce
cmp eax, 0x23
jg 0x1400156e2
cmp eax, 0xa
je 0x1400156e8
cmp eax, 0x1c
jmp 0x1400156e2
mov rax, qword [rbp + 0x9a0]
mov rcx, rax
call fcn.14000154c
jmp 0x1400156e9
nop
jmp 0x1400156fd
nop
jmp 0x1400156fd
nop
jmp 0x1400156fd
nop
jmp 0x1400156fd
jmp 0x1400156f0
nop
jmp 0x1400156fd
nop
jmp 0x1400156fd
nop
jmp 0x1400156fd
nop
jmp 0x1400156fd
nop
jmp 0x1400156fd
nop
lea rax, [rbp + 0x1a0]
add rax, 0x31
mov rcx, rax
call fcn.1400051b7
lea rax, [rbp + 0x1a0]
mov rcx, rax
call fcn.14000ab0d
lea rax, [rbp + 0x1a0]
mov qword [rbp + 0x9f8], rax
mov dword [rbp + 0x9f4], 0
Function at 0x140015710
Capabilities:
Parse credit card information

Disassembly:
push rbp
push rbx
mov eax, 0xfc8
call fcn.14001ebb0
sub rsp, rax
lea rbp, [rsp + 0x80]
lea rax, [rbp + 0x1a0]
add rax, 0x1e
mov qword [rbp + 0x9b0], rax
mov rax, qword [rbp + 0x9b0]
movzx eax, byte [rax]
movsx eax, al
cmp eax, 0x7d
je 0x1400156ed
cmp eax, 0x7d
jg 0x1400156f0
cmp eax, 0x75
je 0x140015666
cmp eax, 0x75
jg 0x1400156f0
cmp eax, 0x6c
je 0x1400155e6
cmp eax, 0x6c
jg 0x1400156f0
cmp eax, 0x61
je 0x1400156f3
cmp eax, 0x61
jg 0x1400156f0
cmp eax, 0x57
je 0x140015652
cmp eax, 0x57
jg 0x1400156f0
cmp eax, 0x51
je 0x1400156f6
cmp eax, 0x51
jg 0x1400156f0
cmp eax, 0x41
je 0x1400155d2
cmp eax, 0x41
jg 0x1400156f0
cmp eax, 0x3e
je 0x14001567a
cmp eax, 0x3e
jg 0x1400156f0
cmp eax, 0x33
je 0x1400156f9
cmp eax, 0x33
jg 0x1400156f0
cmp eax, 0xc
je 0x14001568b
cmp eax, 0x2d
je 0x1400156fc
jmp 0x1400156eb
mov rax, qword [rbp + 0x9b0]
mov rcx, rax
call fcn.1400016c0
jmp 0x1400156fd
mov rax, qword [rbp + 0x9b0]
mov qword [rbp + 0x9a8], rax
mov rax, qword [rbp + 0x9a8]
movzx eax, byte [rax]
movsx eax, al
cmp eax, 0x67
je 0x14001563a
cmp eax, 0x67
jg 0x140015640
cmp eax, 0x37
je 0x140015646
cmp eax, 0x37
jg 0x140015640
cmp eax, 0x23
je 0x140015629
cmp eax, 0x23
jg 0x140015640
cmp eax, 0xa
je 0x14001564c
cmp eax, 0x1c
jmp 0x140015640
mov rax, qword [rbp + 0x9a8]
mov rcx, rax
call fcn.14000154c
jmp 0x14001564d
nop
jmp 0x1400156fd
nop
jmp 0x1400156fd
nop
jmp 0x1400156fd
nop
jmp 0x1400156fd
mov rax, qword [rbp + 0x9b0]
mov rcx, rax
call fcn.140002b66
jmp 0x1400156fd
mov rax, qword [rbp + 0x9b0]
mov rcx, rax
call fcn.14000191e
jmp 0x1400156fd
mov rax, qword [rbp + 0x9b0]
mov rcx, rax
call fcn.140002b66
jmp 0x1400156fd
mov rax, qword [rbp + 0x9b0]
mov qword [rbp + 0x9a0], rax
mov rax, qword [rbp + 0x9a0]
movzx eax, byte [rax]
movsx eax, al
cmp eax, 0x67
je 0x1400156df
cmp eax, 0x67
jg 0x1400156e2
cmp eax, 0x37
je 0x1400156e5
cmp eax, 0x37
jg 0x1400156e2
cmp eax, 0x23
je 0x1400156ce
cmp eax, 0x23
jg 0x1400156e2
cmp eax, 0xa
je 0x1400156e8
cmp eax, 0x1c
jmp 0x1400156e2
mov rax, qword [rbp + 0x9a0]
mov rcx, rax
call fcn.14000154c
jmp 0x1400156e9
nop
jmp 0x1400156fd
nop
jmp 0x1400156fd
nop
jmp 0x1400156fd
nop
jmp 0x1400156fd
jmp 0x1400156f0
nop
jmp 0x1400156fd
nop
jmp 0x1400156fd
nop
jmp 0x1400156fd
nop
jmp 0x1400156fd
nop
jmp 0x1400156fd
nop
lea rax, [rbp + 0x1a0]
add rax, 0x31
mov rcx, rax
call fcn.1400051b7
lea rax, [rbp + 0x1a0]
mov rcx, rax
call fcn.14000ab0d
lea rax, [rbp + 0x1a0]
mov qword [rbp + 0x9f8], rax
mov dword [rbp + 0x9f4], 0
Function at 0x140016a30
Capabilities:
Parse credit card information

Disassembly:
je 0x140016a5a
cmp eax, 0x1c
jmp 0x140016a4e
nop
jmp 0x140016f35
nop
jmp 0x140016f35
jmp 0x140017426
Function at 0x140017220
Capabilities:
Parse credit card information

Disassembly:
cmp eax, 0x7d
jg 0x1400173ea
cmp eax, 0x75
je 0x140017360
cmp eax, 0x75
jg 0x1400173ea
cmp eax, 0x6c
je 0x1400172e0
cmp eax, 0x6c
jg 0x1400173ea
cmp eax, 0x61
je 0x1400173ed
cmp eax, 0x61
jg 0x1400173ea
cmp eax, 0x57
je 0x14001734c
cmp eax, 0x57
jg 0x1400173ea
cmp eax, 0x51
je 0x1400173f0
cmp eax, 0x51
jg 0x1400173ea
cmp eax, 0x41
je 0x1400172cc
cmp eax, 0x41
jg 0x1400173ea
cmp eax, 0x3e
je 0x140017374
cmp eax, 0x3e
jg 0x1400173ea
cmp eax, 0x33
je 0x1400173f3
cmp eax, 0x33
jg 0x1400173ea
cmp eax, 0xc
je 0x140017385
cmp eax, 0x2d
je 0x1400173f6
jmp 0x1400173e5
mov rax, qword [rbp + 0xa10]
mov rcx, rax
call fcn.1400016c0
jmp 0x1400173f7
mov rax, qword [rbp + 0xa10]
mov qword [rbp + 0xa08], rax
mov rax, qword [rbp + 0xa08]
movzx eax, byte [rax]
movsx eax, al
cmp eax, 0x67
je 0x140017334
cmp eax, 0x67
jg 0x14001733a
cmp eax, 0x37
je 0x140017340
cmp eax, 0x37
jg 0x14001733a
cmp eax, 0x23
je 0x140017323
cmp eax, 0x23
jg 0x14001733a
cmp eax, 0xa
je 0x140017346
invalid
clc

Function at 0x1400191a0
Capabilities:
Parse credit card information

Disassembly:
je 0x140019370
cmp eax, 0x7d
jg 0x140019376
cmp eax, 0x75
je 0x1400192e6
cmp eax, 0x75
jg 0x140019376
cmp eax, 0x6c
je 0x140019266
cmp eax, 0x6c
jg 0x140019376
cmp eax, 0x61
je 0x14001937c
cmp eax, 0x61
invalid

Function at 0x140019280
Capabilities:
Parse credit card information

Disassembly:
rol byte [rbx + 0x347467f8], 0x83
clc
jg 0x1400192c0

Function at 0x140019870
Capabilities:
Parse credit card information

Disassembly:
test dword [rax + 0x4800000c], edx
mov dword [rbp + 0xc70], eax
Function at 0x14001d550
Capabilities:
Parse credit card information

Disassembly:
cmp dword [rbp + 0xefc], 0x41
jg 0x14001d5ce
mov eax, dword [rbp + 0xefc]
cdqe
cwde
mov rdx, qword [rbp + 0xf00]
add rax, rdx
movzx eax, byte [rax]
cmp al, 0x3f
je 0x14001d5b9
mov eax, dword [rbp + 0xefc]
cdqe
mov rdx, qword [rbp + 0xf00]
add rax, rdx
movzx eax, byte [rax]
movsx ebx, al
mov eax, dword [rbp + 0xefc]
cdqe
mov rdx, qword [rbp + 0xf00]
add rax, rdx
mov rcx, rax
call fcn.14000662f
cmp ebx, eax
je 0x14001d5bc
mov eax, dword [rbp + 0xefc]
cdqe
mov rdx, qword [rbp + 0xf00]
add rax, rdx
movzx eax, byte [rax]
movsx ebx, al
mov eax, dword [rbp + 0xefc]
cdqe
mov rdx, qword [rbp + 0xf00]
add rax, rdx
mov rcx, rax
call fcn.1400051b7
cmp ebx, eax
je 0x14001d5bf
mov eax, dword [rbp + 0xefc]
cdqe
mov rdx, qword [rbp + 0xf00]
add rax, rdx
movzx eax, byte [rax]
cmp al, 0x14
je 0x14001d5c2
mov eax, dword [rbp + 0xefc]
cdqe
mov rdx, qword [rbp + 0xf00]
add rax, rdx
movzx eax, byte [rax]
movsx ebx, al
mov eax, dword [rbp + 0xefc]
cdqe
mov rdx, qword [rbp + 0xf00]
add rax, rdx
mov rcx, rax
call fcn.140001450
cmp ebx, eax
je 0x14001d5c5
mov eax, dword [rbp + 0xefc]
cdqe
mov rdx, qword [rbp + 0xf00]
add rax, rdx
movzx eax, byte [rax]
movsx ebx, al
mov eax, dword [rbp + 0xefc]
cdqe
mov rdx, qword [rbp + 0xf00]
add rax, rdx
mov rcx, rax
call fcn.140002035
cmp ebx, eax
je 0x14001d5c8
mov eax, dword [rbp + 0xefc]
cdqe
mov rdx, qword [rbp + 0xf00]
add rax, rdx
movzx eax, byte [rax]
movsx ebx, al
mov eax, dword [rbp + 0xefc]
cdqe
mov rdx, qword [rbp + 0xf00]
add rax, rdx
mov rcx, rax
call fcn.1400071d5
cmp ebx, eax
je 0x14001d5cb
add dword [rbp + 0xefc], 1
jmp 0x14001d44c
nop
jmp 0x14001d5cf
nop
jmp 0x14001d5cf
nop
jmp 0x14001d5cf
nop
jmp 0x14001d5cf
nop
jmp 0x14001d5cf
nop
jmp 0x14001d5cf
nop
jmp 0x14001d5cf
nop
lea rax, [rbp + 0x1a0]
mov qword [rbp + 0xf10], rax
mov dword [rbp + 0xf0c], 0
Function at 0x14000ae20
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14000ac1c
Function at 0x140010168
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x140010198
xor eax, eax
jmp 0x14001025b
mov rbp, rbx
cmp word [rax], si
je 0x1400101bd
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x1400101a4
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x1400101a0
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.140010088
movsxd r14, eax
test eax, eax
jne 0x1400101fb
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x140010191
mov rcx, r14
call fcn.14000c91c
mov rdi, rax
test rax, rax
jne 0x140010214
xor ecx, ecx
call fcn.14000bca4
jmp 0x1400101f0
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.140010088
test eax, eax
jne 0x140010245
mov rcx, rdi
call fcn.14000bca4
jmp 0x14001024f
xor ecx, ecx
call fcn.14000bca4
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x14001457c
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x140014592
mov al, 1
jmp 0x1400145f2
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x1400145a3
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x1400145f0
mov ecx, dword [rcx + 0x18]
nop
call fcn.140010a88
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400145f0
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x1400145f0
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1400145f0
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x1400145f2
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x140015630
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.14000f158
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x1400156ba
cmp byte [rbp - 0x21], r15b
je 0x1400156b5
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x1400156f0
call fcn.14000bef4
test eax, eax
jne 0x1400156dc
cmp byte [rbp - 0x21], r15b
je 0x1400156d4
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x1400156f0
cmp byte [rbp - 0x21], r15b
je 0x1400156ed
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.14000e738
test eax, eax
jne 0x140015790
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.14000f158
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x14001572f
cmp byte [rbp - 0x21], r15b
je 0x140015764
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x140015764
call fcn.14000bef4
test eax, eax
jne 0x140015750
cmp byte [rbp - 0x21], r15b
je 0x140015749
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x140015764
cmp byte [rbp - 0x21], r15b
je 0x140015761
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.14000e738
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x140015790
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x140015793
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x1400157a1
mov rcx, rdi
call fcn.14000bca4
cmp byte [rbp + 0x3f], r15b
je 0x1400157b0
mov rcx, qword [rbp + 0x27]
call fcn.14000bca4
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x180001800
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
sub rsp, 0xc8
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x98], rax
cmp edx, 1
jne 0x180001a4e
mov qword [r11 - 8], rbx
lea rcx, [r11 - 0x38]
xor ebx, ebx
mov qword [r11 - 0x38], rbx
call qword [sym.imp.KERNEL32.dll_Wow64DisableWow64FsRedirection]
cmp dword [0x180005050], 2
movups xmm0, xmmword [str.__AF_r]
movups xmm1, xmmword [0x180003290]
movzx eax, word [0x1800032e0]
movups xmmword [rsp + 0x20], xmm0
movups xmm0, xmmword [0x1800032a0]
movups xmmword [rsp + 0x30], xmm1
movups xmm1, xmmword [0x1800032b0]
movups xmmword [rsp + 0x40], xmm0
movups xmm0, xmmword [0x1800032c0]
movups xmmword [rsp + 0x50], xmm1
movups xmm1, xmmword [0x1800032d0]
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm1
mov word [rsp + 0x80], ax
jl 0x1800019e6
movdqa xmm5, xmmword [0x180003340]
lea rcx, [rsp + 0x20]
movdqa xmm4, xmmword [0x180003380]
movaps xmmword [rsp + 0xb0], xmm6
movdqa xmm6, xmmword [0x180003360]
movaps xmmword [rsp + 0xa0], xmm7
movdqa xmm7, xmmword [0x180003370]
nop dword [rax]
nop word [rax + rax]
movd xmm2, ebx
lea eax, [rbx + 4]
pshufd xmm2, xmm2, 0
lea rcx, [rcx + 0x10]
paddd xmm2, xmm5
add ebx, 8
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
movq xmm2, xmm7
pshufhw xmm1, xmm0, 0xd8
movq xmm0, qword [rcx - 0x10]
pshufd xmm3, xmm1, 0xd8
paddw xmm3, xmm2
movd xmm2, eax
pshufd xmm2, xmm2, 0
xorps xmm3, xmm0
movq qword [rcx - 0x10], xmm3
paddd xmm2, xmm5
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
mov eax, ebx
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
movq xmm2, xmm7
pshufhw xmm1, xmm0, 0xd8
movq xmm0, qword [rcx - 8]
pshufd xmm3, xmm1, 0xd8
paddw xmm3, xmm2
xorps xmm3, xmm0
movq qword [rcx - 8], xmm3
cmp ebx, 0x30
jl 0x1800018e0
movaps xmm7, xmmword [rsp + 0xa0]
movaps xmm6, xmmword [rsp + 0xb0]
cmp eax, 0x31
jge 0x180001a34
movsxd rax, ebx
lea r8, [rsp + 0x20]
lea r8, [r8 + rax*2]
nop dword [rax]
nop word [rax + rax]
mov eax, 0xa0a0a0a1
lea r8, [r8 + 2]
imul ebx
add edx, ebx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, 1
sub ax, dx
movzx ecx, ax
imul edx, ecx, 0x33
add dx, bx
inc ebx
xor word [r8 - 2], dx
cmp ebx, 0x31
jl 0x180001a00
lea rcx, [rsp + 0x20]
call fcn.180001070
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Wow64RevertWow64FsRedirection]
mov rbx, qword [rsp + 0xc0]
mov eax, 1
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.180001a80
add rsp, 0xc8
ret
Function at 0x140020a00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov r14d, dword [rcx + 0x80]
movsxd rax, edx
mov r13, rcx
mov rcx, qword [rcx + 0x78]
lea rdx, [rax*8]
mov rsi, rax
sub rdx, rax
shl rdx, 3
call fcn.1400203c0
mov rdi, rax
test rax, rax
je 0x140020b95
movsxd rdx, r14d
lea rbp, [0x1401b01c0]
xor r12d, r12d
lea rax, [rdx*8]
sub rax, rdx
xor edx, edx
lea rbx, [rdi + rax*8]
mov eax, esi
sub eax, r14d
mov rcx, rbx
cdqe
lea r8, [rax*8]
sub r8, rax
shl r8, 3
call sub.msvcrt.dll_memset
mov qword [r13 + 0x78], rdi
cmp r14d, esi
jl 0x140020b3c
jmp 0x140020bc0
mov rcx, qword [0x1401f5360]
test rcx, rcx
je 0x140020aaa
call qword [0x1401b0240]
mov ecx, 0x200
call fcn.14000bed0
mov rdx, rax
test rdx, rdx
je 0x140020b86
lea rdi, [rdx + 8]
mov rcx, rdx
mov rax, r12
mov qword [rdx], 0
mov qword [rdx + 0x1f8], 0
and rdi, 0xfffffffffffffff8
sub rcx, rdi
add ecx, 0x200
shr ecx, 3
rep stosq qword [rdi], rax
mov dword [rdx], r15d
mov qword [rbx + 0x10], rdx
mov dword [rbx + 0x20], 1
mov rax, qword [r13 + 0x128]
test rax, rax
je 0x140020b24
mov edx, dword [rax + 0x58]
mov dword [rbx + 0x24], edx
mov edx, dword [rax + 0x60]
mov dword [rbx + 0x28], edx
mov edx, dword [rax + 0x64]
mov dword [rbx + 0x2c], edx
mov eax, dword [rax + 0x88]
mov dword [rbx + 0x30], eax
add r14d, 1
add rbx, 0x38
mov dword [r13 + 0x80], r14d
cmp r14d, esi
je 0x140020bc0
mov eax, dword [r13 + 0x20]
mov dword [rbx + 0x18], eax
mov rax, qword [r13 + 0x50]
cmp qword [rax], 0
je 0x140020bb0
mov rax, qword [r13 + 0x60]
test rax, rax
jle 0x140020bb0
mov qword [rbx], rax
mov eax, dword [r13 + 0x3c]
mov dword [rbx + 0x1c], eax
mov eax, dword [rbp]
mov r15d, dword [r13 + 0x20]
test eax, eax
jne 0x140020a98
mov ecx, 0x200
call qword [0x1401b01e0]
mov rdx, rax
test rdx, rdx
jne 0x140020ac0
mov qword [rbx + 0x10], 0
mov dword [rbx + 0x20], 1
mov eax, 7
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov eax, dword [r13 + 0xb8]
jmp 0x140020b56
xor eax, eax
jmp 0x140020b9a
Function at 0x14003a960
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0xc0
mov r10, rdx
mov rax, rcx
movzx edx, byte [r8 + 8]
mov rsi, r8
mov rdi, r9
cmp byte [rcx + 0x16], dl
jne 0x14003a9b0
mov edx, dword [rcx + 0x10]
mov rcx, qword [r8 + 0x10]
mov r8, qword [r10 + 8]
mov r9d, dword [r10 + 0x10]
mov qword [rsp + 0x20], r8
mov r8, qword [rax + 8]
call qword [rsi + 0x18]
add rsp, 0xc0
pop rbx
pop rsi
pop rdi
ret
mov rcx, qword [rcx + 0x18]
movdqu xmm0, xmmword [rax]
mov dword [rsp + 0x60], 0
mov dword [rsp + 0xa0], 0
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x98], rcx
mov rcx, qword [rax + 0x10]
movaps xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rcx
movzx ecx, word [rax + 0x14]
test ch, 0x20
jne 0x14003a9fa
and ch, 0x8f
or ch, 0x40
mov word [rsp + 0x54], cx
mov rax, qword [r10 + 0x10]
movdqu xmm1, xmmword [r10]
mov qword [rsp + 0x90], rax
movzx eax, word [r10 + 0x14]
movaps xmmword [rsp + 0x80], xmm1
test ah, 0x20
jne 0x14003aa2b
and ah, 0x8f
or ah, 0x40
mov word [rsp + 0x94], ax
xor ebx, ebx
and ecx, 1
jne 0x14003aa43
lea rcx, [rsp + 0x40]
call fcn.14003a290
movzx edx, byte [rsi + 8]
mov rbx, rax
movzx eax, word [rsp + 0x94]
mov ecx, eax
not ecx
test cx, 0x202
je 0x14003ab00
test al, 1
jne 0x14003aad0
lea rcx, [rsp + 0x80]
call fcn.14003a290
test rbx, rbx
je 0x14003aad0
test rax, rax
je 0x14003aad0
mov rcx, qword [rsi + 0x10]
mov edx, dword [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r8, rbx
mov r9d, dword [rsp + 0x90]
call qword [rsi + 0x18]
mov ecx, dword [rsp + 0x60]
test ecx, ecx
jne 0x14003aae2
mov edx, dword [rsp + 0xa0]
test edx, edx
je 0x14003a99b
lea rcx, [rsp + 0x80]
mov dword [rsp + 0x3c], eax
call fcn.140011e80
mov eax, dword [rsp + 0x3c]
add rsp, 0xc0
pop rbx
pop rsi
pop rdi
ret
test rdi, rdi
je 0x14003aad8
mov byte [rdi], 7
mov ecx, dword [rsp + 0x60]
xor eax, eax
test ecx, ecx
je 0x14003aa98
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x3c], eax
call fcn.140011e80
mov eax, dword [rsp + 0x3c]
jmp 0x14003aa98
cmp dl, byte [rsp + 0x96]
jne 0x14003aa5a
mov rax, qword [rsp + 0x88]
jmp 0x14003aa6b
Function at 0x14003ab20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
movzx r9d, word [rcx + 0x14]
movzx r10d, word [rdx + 0x14]
mov eax, r9d
or eax, r10d
test al, 1
jne 0x14003ab90
test al, 0x2c
je 0x14003ab70
mov eax, r9d
and eax, r10d
test al, 0x24
jne 0x14003aba0
test al, 8
je 0x14003abb0
movsd xmm1, qword [rcx]
movsd xmm0, qword [rdx]
comisd xmm0, xmm1
ja 0x14003abfc
xor eax, eax
comisd xmm1, xmm0
seta al
jmp 0x14003ab6d
fstp st(0)
fstp st(0)
jmp 0x14003ab6d
fstp st(0)
fstp st(0)
ret
test al, 2
je 0x14003ab89
and r9d, 2
je 0x14003abe0
and r10d, 2
je 0x14003abfc
test r8, r8
jne 0x14003ac08
jmp fcn.140007150
and r10d, 1
and r9d, 1
mov eax, r10d
sub eax, r9d
ret
mov rax, qword [rdx]
cmp qword [rcx], rax
jl 0x14003abfc
setg al
movzx eax, al
ret
test r9b, 0x24
jne 0x14003abf0
and r9d, 8
mov eax, 1
je 0x14003ab6d
and r10d, 0x24
je 0x14003abfc
fild qword [rdx]
fld qword [rcx]
fcomi st(1)
ja 0x14003ab63
fxch st(1)
xor eax, eax
fcompi st(1)
fstp st(0)
seta al
neg eax
ret
mov eax, 1
ret
test r10b, 8
jne 0x14003ac10
and r10d, 0x24
jne 0x14003aba0
mov eax, 0xffffffff
ret
xor r9d, r9d
jmp fcn.14003a960
fild qword [rcx]
fld qword [rdx]
mov eax, 0xffffffff
fcomi st(1)
ja 0x14003ab69
fxch st(1)
xor eax, eax
fcompi st(1)
fstp st(0)
seta al
ret