joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400097d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
movsxd rax, dword [rcx + 0x3c]
mov r12, rdx
mov rdx, rcx
mov ecx, dword [rax + rcx + 0x88]
xor eax, eax
add rcx, rdx
mov dword [rbp - 0x2c], eax
mov qword [rbp - 0x28], rcx
mov r8d, dword [rcx + 0x1c]
mov r9d, dword [rcx + 0x20]
add r8, rdx
mov r10d, dword [rcx + 0x24]
add r9, rdx
add r10, rdx
mov qword [rbp - 0x20], r8
mov qword [rbp - 0x18], r9
mov qword [rbp - 0x10], r10
cmp dword [rcx + 0x18], eax
jbe 0x1400099fe
mov word [rbp + 0x50], 0x6f69
mov word [rbp + 0x58], 0x6f69
nop
mov esi, dword [r9 + rax*4]
lea rcx, [rbp + 0x50]
movzx eax, word [r10 + rax*2]
add rsi, rdx
xor edi, edi
mov r15d, dword [r8 + rax*4]
add r15, rdx
mov qword [rbp - 8], r15
call fcn.140001850
movzx ecx, byte [rax]
cmp byte [rsi], cl
je 0x140009884
nop dword [rax]
lea rcx, [rbp + 0x50]
inc rdi
call fcn.140001850
movzx ecx, byte [rax]
cmp byte [rdi + rsi], cl
jne 0x140009870
lea rcx, [rbp + 0x58]
xor ebx, ebx
call fcn.140001850
movzx ecx, byte [rax]
cmp byte [r12], cl
je 0x1400098b5
nop dword [rax + rax]
lea rcx, [rbp + 0x58]
inc rbx
call fcn.140001850
movzx ecx, byte [rax]
cmp byte [rbx + r12], cl
jne 0x1400098a0
cmp rdi, rbx
jne 0x1400099d2
mov r13, rsi
mov word [rbp - 0x50], 0x6f69
sub r13, r12
mov r14, r12
nop dword [rax]
lea rcx, [rbp - 0x50]
xor ebx, ebx
call fcn.140001850
movzx ecx, byte [rax]
cmp byte [rsi], cl
je 0x1400098f6
lea rcx, [rbp - 0x50]
inc rbx
call fcn.140001850
movzx ecx, byte [rax]
cmp byte [rbx + rsi], cl
jne 0x1400098e2
mov rax, r14
sub rax, r12
dec rbx
cmp rax, rbx
jae 0x1400099f8
movsx r15d, byte [r14 + r13]
lea rcx, [rbp - 0x4e]
mov dword [rbp - 0x4e], 0x6f0008
call fcn.140002520
movzx eax, word [rax]
cmp r15d, eax
jl 0x140009968
lea rcx, [rbp - 0x4a]
mov dword [rbp - 0x4a], 0x6f0013
call fcn.140002520
movzx ecx, word [rax]
cmp r15d, ecx
jg 0x140009968
lea rcx, [rbp - 0x46]
mov dword [rbp - 0x46], 0x6f0008
mov dword [rbp - 0x42], 0x6f0028
call fcn.140002520
lea rcx, [rbp - 0x42]
movzx ebx, byte [rax]
call fcn.140002520
movzx ecx, byte [rax]
sub cl, bl
add r15b, cl
movsx edi, byte [r14]
lea rcx, [rbp - 0x3e]
mov dword [rbp - 0x3e], 0x6f0008
call fcn.140002520
movzx eax, word [rax]
cmp edi, eax
jl 0x1400099c5
lea rcx, [rbp - 0x3a]
mov dword [rbp - 0x3a], 0x6f0013
call fcn.140002520
movzx ecx, word [rax]
cmp edi, ecx
jg 0x1400099c5
lea rcx, [rbp - 0x36]
mov dword [rbp - 0x36], 0x6f0008
mov dword [rbp - 0x32], 0x6f0028
call fcn.140002520
lea rcx, [rbp - 0x32]
movzx ebx, byte [rax]
call fcn.140002520
movzx ecx, byte [rax]
sub cl, bl
add dil, cl
cmp r15b, dil
jne 0x1400099d2
inc r14
jmp 0x1400098d0
mov eax, dword [rbp - 0x2c]
mov rcx, qword [rbp - 0x28]
inc eax
mov dword [rbp - 0x2c], eax
cmp eax, dword [rcx + 0x18]
jae 0x1400099fe
mov rdx, qword [rbp + 0x40]
mov r8, qword [rbp - 0x20]
mov r9, qword [rbp - 0x18]
mov r10, qword [rbp - 0x10]
jmp 0x140009840
mov rax, qword [rbp - 8]
jmp 0x140009a00
xor eax, eax
mov rbx, qword [rsp + 0xb8]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000afc0
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov eax, 0x69
mov dword [rbp - 0x20], 0x2a0022
lea rcx, [rbp - 0x20]
mov word [rbp - 0xc], ax
mov dword [rbp - 0x1c], 0x3b001d
mov dword [rbp - 0x18], 0x3c0013
mov dword [rbp - 0x14], 0x18003b
mov dword [rbp - 0x10], 0x33001e
call fcn.140004d70
mov rcx, rax
call 0x14000afc0
mov qword [0x1400101b8], rax
lea rcx, [rbp - 0x20]
mov eax, 0x4d
mov dword [rbp - 0x20], 0x2a0022
mov word [rbp - 0x10], ax
mov dword [rbp - 0x1c], 0x3b001d
mov dword [rbp - 0x18], 0x3c0013
mov dword [rbp - 0x14], 0x6b004a
call fcn.140002330
mov rcx, rax
call 0x14000afc0
lea rcx, [rbp - 0x20]
mov qword [0x1400101a8], rax
mov dword [rbp - 0x20], 0x1b0007
mov dword [rbp - 0x1c], 0x19002b
mov dword [rbp - 0x18], 0x70003a
call fcn.140004c00
mov rcx, rax
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov r12, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rbp
jmp 0x14000afc0
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov rsi, rcx
mov rdi, qword [rax + 0x18]
add rdi, 0x20
mov rbx, qword [rdi]
cmp rbx, rdi
je 0x14000b022
nop dword [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
mov r8d, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, qword [rbx + 0x40]
mov rdx, rsi
mov r8, rax
call fcn.140009000
test al, al
jne 0x14000b034
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x14000aff0
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rax, qword [rbx + 0x20]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14002ad90
Capabilities:
Read pipe
Write file on windows
Write pipe

Disassembly:
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x30]
sub rsp, 0x130
cmp qword [rcx + 0x40], 0
mov rdi, rcx
je 0x14002adbf
mov al, 1
mov rdi, qword [rsp + 0x158]
add rsp, 0x130
pop rbp
ret
mov qword [rsp + 0x150], rsi
call fcn.14002aca0
mov rsi, rax
test rax, rax
je 0x14002af22
mov qword [rsp + 0x148], rbx
mov ebx, dword [rdi + 0x38]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
movups xmm0, xmmword [rdi + 0x28]
mov dword [rbp - 0x6c], eax
lea r9, [rsp + 0x40]
lea rax, [rdi + 0x5c]
mov dword [rbp - 0x68], ebx
xor ebx, ebx
mov qword [rbp - 0x60], rax
lea rax, [rdi + 0x60]
mov qword [rsp + 0x30], rbx
mov qword [rbp - 0x58], rax
lea rdx, [rbp - 0x70]
lea rax, [rdi + 0x68]
mov dword [rbp - 0x70], 1
mov qword [rbp - 0x50], rax
lea r8d, [rbx + 0x50]
lea rax, [rbp + 0x40]
mov qword [rbp - 0x38], rbx
movups xmmword [rbp - 0x48], xmm0
mov qword [rsp + 0x28], rax
mov rcx, rsi
xorps xmm0, xmm0
mov dword [rsp + 0x20], 0x50
xorps xmm1, xmm1
movdqa xmmword [rbp - 0x30], xmm0
mov qword [rsp + 0x40], rbx
mov dword [rsp + 0x48], ebx
movdqa xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], rbx
movups xmmword [rsp + 0x68], xmm1
mov qword [rsp + 0x78], rbx
movdqa xmmword [rbp - 0x80], xmm0
mov dword [rbp + 0x40], ebx
call qword [sym.imp.KERNEL32.dll_TransactNamedPipe]
test eax, eax
je 0x14002af0e
cmp dword [rsp + 0x40], 2
jne 0x14002af0e
cmp dword [rsp + 0x44], ebx
je 0x14002af0e
cmp qword [rsp + 0x78], rbx
je 0x14002af0e
cmp qword [rbp - 0x80], rbx
je 0x14002af0e
cmp qword [rbp - 0x78], rbx
je 0x14002af0e
xorps xmm0, xmm0
mov qword [rbp - 0x1c], rbx
xorps xmm1, xmm1
movdqa xmmword [rbp - 0x10], xmm0
xor eax, eax
movaps xmmword [rbp], xmm1
lea r9, [rbp + 0x40]
mov qword [rbp + 0x10], rax
lea r8d, [rbx + 0x50]
movdqa xmmword [rbp + 0x20], xmm0
lea rdx, [rbp - 0x20]
mov qword [rbp + 0x18], rbx
mov rcx, rsi
mov dword [rbp - 0x20], 3
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14002af0e
mov rax, qword [rsp + 0x78]
mov bl, 1
mov qword [rdi + 0x40], rax
mov rax, qword [rbp - 0x80]
mov qword [rdi + 0x48], rax
mov rax, qword [rbp - 0x78]
mov qword [rdi + 0x50], rax
mov eax, dword [rsp + 0x44]
mov dword [rdi + 0x58], eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, bl
mov rbx, qword [rsp + 0x148]
mov rsi, qword [rsp + 0x150]
mov rdi, qword [rsp + 0x158]
add rsp, 0x130
pop rbp
ret
Function at 0x14003d5f0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
mov r15, rdx
lea r14, [rdx - 1]
mov rdi, rcx
xor r12d, r12d
nop word [rax + rax]
mov rsi, r12
mov rbp, r12
test r14, r14
je 0x14003d806
mov rdx, qword [rdi + 8]
nop dword [rax]
nop word [rax + rax]
lea ecx, [rdx + 0xff]
shl rsi, cl
add rsi, rsi
nop dword [rax]
mov r10, qword [rdi]
mov ecx, dword [r10]
cmp ecx, 0x270
jne 0x14003d6b4
lea rax, [r10 + 8]
mov r9d, ecx
nop word [rax + rax]
mov r8d, dword [rax - 4]
xor r8d, dword [rax]
lea rax, [rax + 4]
btr r8d, 0x1f
xor r8d, dword [rax - 8]
mov ecx, r8d
and cl, 1
neg cl
sbb edx, edx
shr r8d, 1
and edx, 0x9908b0df
xor edx, dword [rax + 0x62c]
xor edx, r8d
mov dword [rax + 0x9b8], edx
sub r9, 1
jne 0x14003d670
mov ecx, dword [r10]
jmp 0x14003d797
cmp ecx, 0x4e0
jb 0x14003d797
lea r11, [r10 + 0x9c4]
mov ebx, 0xe3
mov eax, dword [r11]
nop
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, edx
xor ecx, dword [r11 + 0x634]
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x14003d6d0
lea r11, [r10 + 0xd50]
mov ebx, 0x18c
mov eax, dword [r11]
nop word [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x14003d720
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
mov ecx, r12d
mov dword [r10], r12d
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r10], eax
mov ecx, edx
mov eax, dword [r10 + 0x1384]
mov r8, qword [rdi + 0x10]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and edx, 0xffffdf8c
shl edx, 0xf
mov ecx, edx
xor rcx, rax
mov rax, rcx
shr rax, 0x12
xor rax, rcx
cmp rax, r8
ja 0x14003d650
mov rdx, qword [rdi + 8]
or rsi, rax
lea ecx, [rdx + 0xff]
shl rbp, cl
add rbp, rbp
or rbp, r8
cmp rbp, r14
jb 0x14003d640
xor edx, edx
mov rax, rbp
div r15
mov rcx, rax
mov r8, rdx
xor edx, edx
mov rax, rsi
div r15
cmp rax, rcx
jb 0x14003d82a
cmp r8, r14
jne 0x14003d620
mov rbx, qword [rsp + 0x20]
mov rax, rsi
mov rbp, qword [rsp + 0x28]
xor edx, edx
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
div r15
mov rax, rdx
pop r15
pop r14
pop r12
ret
Function at 0x14003d850
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
mov rax, qword [rcx + 8]
xor r14d, r14d
mov edi, r14d
mov ebp, r14d
mov rsi, rcx
nop word [rax + rax]
lea ecx, [rax + 0xff]
shl rdi, cl
add rdi, rdi
nop dword [rax]
mov r10, qword [rsi]
mov ecx, dword [r10]
cmp ecx, 0x270
jne 0x14003d8f4
lea rax, [r10 + 8]
mov r9d, ecx
nop word [rax + rax]
mov r8d, dword [rax - 4]
xor r8d, dword [rax]
lea rax, [rax + 4]
btr r8d, 0x1f
xor r8d, dword [rax - 8]
mov ecx, r8d
and cl, 1
neg cl
sbb edx, edx
shr r8d, 1
and edx, 0x9908b0df
xor edx, dword [rax + 0x62c]
xor edx, r8d
mov dword [rax + 0x9b8], edx
sub r9, 1
jne 0x14003d8b0
mov ecx, dword [r10]
jmp 0x14003d9d7
cmp ecx, 0x4e0
jb 0x14003d9d7
lea r11, [r10 + 0x9c4]
mov ebx, 0xe3
mov eax, dword [r11]
nop
mov edx, dword [r11 + 4]
lea r8, [r11 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x14003d910
lea r11, [r10 + 0xd50]
mov ebx, 0x18c
mov eax, dword [r11]
nop dword [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x14003d960
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
mov ecx, r14d
mov dword [r10], r14d
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov ecx, edx
mov dword [r10], eax
mov eax, dword [r10 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and edx, 0xffffdf8c
shl edx, 0xf
mov ecx, edx
xor rcx, rax
mov rdx, rcx
shr rdx, 0x12
xor rdx, rcx
cmp rdx, qword [rsi + 0x10]
ja 0x14003d890
mov rax, qword [rsi + 8]
or rdi, rdx
add rbp, rax
cmp rbp, 0x40
jb 0x14003d880
mov rbx, qword [rsp + 0x10]
mov rax, rdi
mov rdi, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
pop r14
ret
Function at 0x14003da60
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister
Resolve dns

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x1350]
mov eax, 0x1450
call fcn.140044580
sub rsp, rax
mov rax, qword [0x140065738]
xor rax, rsp
mov qword [rbp + 0x1340], rax
mov rdi, r8
mov rsi, rdx
mov rcx, qword [rcx]
call fcn.14003d010
test al, al
jne 0x14003dc3f
movdqa xmm0, xmmword [0x140050400]
movdqu xmmword [rsp + 0x40], xmm0
xor ebx, ebx
mov qword [rsp + 0x50], rbx
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], rbx
cmp qword [rdi + 0x18], 0x10
jb 0x14003dad1
mov rdi, qword [rdi]
lea r9, [rsp + 0x38]
lea r8, [rsp + 0x40]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
jne 0x14003dbff
mov rax, qword [rsp + 0x38]
test rax, rax
je 0x14003db0c
nop dword [rax + rax]
inc rbx
mov rax, qword [rax + 0x28]
test rax, rax
jne 0x14003db00
call sub.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_
mov r8d, 0xffffffff
mov dword [rbp + 0x1334], r8d
mov dword [rbp - 0x4c], eax
mov edx, 1
nop word [rax + rax]
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [rbp + rdx*4 - 0x4c], eax
inc rdx
cmp rdx, 0x270
jb 0x14003db30
mov dword [rbp - 0x50], 0x270
lea rax, [rbp - 0x50]
mov qword [rsp + 0x20], rax
mov ecx, 0x40
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
dec rcx
shr rax, 1
cmp rax, r8
ja 0x14003db70
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x20]
test rbx, rbx
jne 0x14003db96
call fcn.14003d850
jmp 0x14003db9e
mov rdx, rbx
call fcn.14003d5f0
mov rbx, qword [rsp + 0x38]
test rax, rax
je 0x14003dbba
nop dword [rax + rax]
mov rbx, qword [rbx + 0x28]
sub rax, 1
jne 0x14003dbb0
mov rcx, qword [rbx + 0x20]
mov ecx, dword [rcx + 4]
call qword [sym.imp.WS2_32.dll_ntohl]
mov edx, eax
mov rcx, rsi
call fcn.14003f620
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
mov rax, rsi
mov rcx, qword [rbp + 0x1340]
xor rcx, rsp
call fcn.1400441e0
mov rbx, qword [rsp + 0x1488]
add rsp, 0x1450
pop rdi
pop rsi
pop rbp
ret
mov edx, eax
lea rcx, [rsp + 0x70]
call fcn.14003f200
nop
mov r8, rax
lea rdx, str.Ipv4Resolver::resolve__getaddrinfo_failed_
lea rcx, [rbp - 0x70]
call fcn.14001db90
nop
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.14003af60
lea rdx, [0x140060e00]
lea rcx, [rsp + 0x20]
call sub.VCRUNTIME140.dll__CxxThrowException
nop
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x20]
call fcn.14003d5c0
lea rdx, [0x140061910]
lea rcx, [rsp + 0x20]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x1800024a0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov r9d, dword [0x180027a98]
mov rdi, rdx
mov eax, 0x2aaaaaab
mov esi, r8d
mov rbx, rcx
imul r9d, r9d
imul r9d
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 2
sub r9d, eax
cmp r9d, 2
jne 0x1800024ee
call fcn.1800088d4
mov dword [0x180027a98], eax
xor r8d, r8d
test esi, esi
jle 0x18000254a
mov r9, rbx
sub rdi, rbx
lea r10, str._God_said__Let_the_earth_bring_forth_the_living_creature_after_his_kind__cattle__and_creeping_thing__and_beast_of_the_earth_after_his_kind:_and_it_was_so.
nop word [rax + rax]
mov eax, 0x3531dec1
lea r9, [r9 + 1]
imul r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, r8d
inc r8d
imul edx, edx, 0x9a
sub eax, edx
movsxd rcx, eax
movzx eax, byte [rcx + r10]
xor al, byte [rdi + r9 - 1]
mov byte [r9 - 1], al
cmp r8d, esi
jl 0x180002510
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x180004510
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
cmp edx, 1
jne 0x180004548
xor eax, eax
mov qword [0x180027ad0], rcx
lea r8, [0x180002560]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x55
add rsp, 0x38
ret
Function at 0x180004560
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x118
mov eax, 0x5a4d
cmp word [rcx], ax
je 0x1800045a9
call fcn.180001900
test al, al
jne 0x18000459e
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov ecx, dword [0x180027a98]
mov edx, 7
test rax, rax
cmove ecx, edx
mov dword [0x180027a98], ecx
or eax, 0xffffffff
add rsp, 0x118
ret
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x18000459e
add rdx, 0x18
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x110], rbx
mov rax, rdx
lea r9, [rsp + 0x20]
mov ebx, 1
or rax, rcx
and eax, 0xf
jne 0x18000466b
mov eax, ebx
movaps xmm0, xmmword [rdx]
movaps xmm1, xmmword [rdx + 0x10]
sub rcx, 0xffffffffffffff80
lea rdx, [rdx + 0x80]
movaps xmmword [rcx - 0x80], xmm0
movaps xmm0, xmmword [rdx - 0x60]
movaps xmmword [rcx - 0x70], xmm1
movaps xmm1, xmmword [rdx - 0x50]
movaps xmmword [rcx - 0x60], xmm0
movaps xmm0, xmmword [rdx - 0x40]
movaps xmmword [rcx - 0x50], xmm1
movaps xmm1, xmmword [rdx - 0x30]
movaps xmmword [rcx - 0x40], xmm0
movaps xmm0, xmmword [rdx - 0x20]
movaps xmmword [rcx - 0x30], xmm1
movaps xmm1, xmmword [rdx - 0x10]
movaps xmmword [rcx - 0x20], xmm0
movaps xmmword [rcx - 0x10], xmm1
dec rax
jne 0x1800045e4
movaps xmm0, xmmword [rdx]
movaps xmm1, xmmword [rdx + 0x10]
movaps xmmword [rcx], xmm0
movaps xmm0, xmmword [rdx + 0x20]
movaps xmmword [rcx + 0x10], xmm1
movaps xmm1, xmmword [rdx + 0x30]
movaps xmmword [rcx + 0x20], xmm0
movaps xmm0, xmmword [rdx + 0x40]
movaps xmmword [rcx + 0x30], xmm1
movaps xmm1, xmmword [rdx + 0x50]
movaps xmmword [rcx + 0x40], xmm0
movaps xmm0, xmmword [rdx + 0x60]
movaps xmmword [rcx + 0x50], xmm1
movaps xmmword [rcx + 0x60], xmm0
jmp 0x180004679
mov r8d, 0xf0
mov rcx, r9
call fcn.180007f20
movzx ecx, word [rsp + 0x20]
mov eax, 0x10b
cmp cx, ax
jne 0x18000469a
xor eax, eax
mov rbx, qword [rsp + 0x110]
add rsp, 0x118
ret
or eax, 0xffffffff
mov edx, 0x20b
cmp cx, dx
cmove eax, ebx
mov rbx, qword [rsp + 0x110]
add rsp, 0x118
ret
Function at 0x1800046c0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov r9d, dword [0x180027a98]
movsxd rbx, dword [rcx + 0x3c]
mov rdi, rcx
lea eax, [r9 + 1]
lea r8d, [r9 + 2]
add rbx, rcx
imul r8d, eax
mov eax, 0x66666667
imul r8d, r9d
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
add eax, eax
sub r8d, eax
cmp r8d, 7
jne 0x180004732
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r9d, eax
mov eax, 0xcccccccd
mul r9d
shr edx, 6
lea ecx, [rdx + rdx*4]
shl ecx, 4
sub r9d, ecx
inc r9d
mov dword [0x180027a98], r9d
mov eax, 0x5a4d
cmp word [rdi], ax
jne 0x18000483c
cmp dword [rbx], 0x4550
jne 0x18000483c
movzx eax, word [rbx + 0x18]
mov ecx, 0x10b
cmp ax, cx
jne 0x180004784
cmp dword [rbx + 0x84], 0
je 0x18000476d
mov eax, dword [rbx + 0x80]
test eax, eax
jne 0x1800047a9
mov dword [0x180027aa4], 0xcb
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov ecx, 0x20b
cmp ax, cx
jne 0x1800047b7
cmp dword [rbx + 0x94], 0
je 0x180004846
mov eax, dword [rbx + 0x90]
test eax, eax
je 0x180004846
add rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
lea eax, [r9 + 1]
lea ecx, [r9 + 2]
mov dword [0x180027aa4], 0xcc
imul ecx, eax
mov eax, 0x92492493
imul ecx, r9d
imul ecx
add edx, ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xe
sub ecx, edx
cmp ecx, 9
jne 0x180004846
mov eax, 0x51eb851f
imul r9d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, 4
imul edx, edx, 0x64
sub r9d, edx
add r9d, 0x63
movsxd rcx, r9d
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.180007ecc
mov rcx, rax
call fcn.1800088cc
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov dword [0x180027aa4], 0xca
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1800062d0
Capabilities:
Hash data using fnv

Disassembly:
movzx r8d, byte [rdx]
movabs r9, 0x100000001b3
movabs rax, 0xcbf29ce484222325
xor r8, rax
movzx eax, byte [rdx + 1]
imul r8, r9
xor r8, rax
movzx eax, byte [rdx + 2]
imul r8, r9
xor r8, rax
movzx eax, byte [rdx + 3]
imul r8, r9
xor r8, rax
movzx eax, byte [rdx + 4]
imul r8, r9
xor r8, rax
movzx eax, byte [rdx + 5]
imul r8, r9
xor r8, rax
movzx eax, byte [rdx + 6]
imul r8, r9
xor r8, rax
movzx eax, byte [rdx + 7]
mov rdx, qword [rcx + 0x28]
imul r8, r9
xor r8, rax
imul r8, r9
mov rax, r8
shr rax, 0x20
xor rax, r8
and rax, rdx
cmp qword [rcx + 0x30], rax
ja 0x180006360
shr rdx, 1
or rcx, 0xffffffffffffffff
sub rcx, rdx
add rax, rcx
repz ret