joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140003d30
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
mov edi, 0x5a4d
test rcx, rcx
je 0x140003da7
mov edx, 0x40
call fcn.140004f00
test al, al
jne 0x140003da7
cmp word [rbx], di
jne 0x140003da7
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x140003da7
lea rsi, [rbx + rax]
mov edx, 0xf8
mov rcx, rsi
call fcn.140004f00
test al, al
jne 0x140003da7
cmp dword [rsi], 0x4550
jne 0x140003da7
test rsi, rsi
je 0x140003da7
mov edx, 0xf8
mov rcx, rsi
call fcn.140004f00
test al, al
je 0x140003da1
xor esi, esi
jmp 0x140003dae
movzx esi, word [rsi + 0x18]
jmp 0x140003dae
xor esi, esi
test rbx, rbx
je 0x140003e22
mov edx, 0x40
mov rcx, rbx
call fcn.140004f00
test al, al
jne 0x140003e22
cmp word [rbx], di
jne 0x140003e22
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x140003e22
lea rdi, [rbx + rax]
mov edx, 0xf8
mov rcx, rdi
call fcn.140004f00
test al, al
jne 0x140003e22
cmp dword [rdi], 0x4550
jne 0x140003e22
test rdi, rdi
je 0x140003e22
mov eax, 0x20b
cmp si, ax
jne 0x140003e0f
mov rax, qword [rdi + 0x30]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov eax, dword [rdi + 0x34]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
xor eax, eax
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x140003e40
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x140003f44
mov edx, 0x40
call fcn.140004f00
test al, al
jne 0x140003f44
mov esi, 0x5a4d
cmp word [rbx], si
jne 0x140003f44
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x140003f44
lea rdi, [rbx + rax]
mov edx, 0xf8
mov rcx, rdi
call fcn.140004f00
test al, al
jne 0x140003f44
cmp dword [rdi], 0x4550
jne 0x140003f44
mov edx, 0x40
mov rcx, rbx
call fcn.140004f00
test al, al
jne 0x140003f29
cmp word [rbx], si
jne 0x140003f29
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x140003f29
lea rdi, [rbx + rax]
mov edx, 0xf8
mov rcx, rdi
call fcn.140004f00
test al, al
jne 0x140003f29
cmp dword [rdi], 0x4550
jne 0x140003f29
test rdi, rdi
je 0x140003f29
mov edx, 0xf8
mov rcx, rdi
call fcn.140004f00
test al, al
jne 0x140003f29
mov eax, 0x20b
cmp word [rdi + 0x18], ax
jne 0x140003f29
mov rcx, rbx
call fcn.140003b20
mov eax, dword [rax + 0x50]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rcx, rbx
call fcn.140003a10
mov eax, dword [rax + 0x50]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
xor eax, eax
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140003f60
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
sub rsp, 0x20
mov rbp, rdx
mov rbx, rcx
test rcx, rcx
je 0x140004031
call fcn.140003950
mov rsi, rax
test rax, rax
je 0x140004031
mov edx, 0x40
mov qword [rsp + 0x30], rdi
mov rcx, rbx
call fcn.140004f00
test al, al
jne 0x140003ff2
mov eax, 0x5a4d
cmp word [rbx], ax
jne 0x140003ff2
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x140003ff2
lea rdi, [rbx + rax]
mov edx, 0xf8
mov rcx, rdi
call fcn.140004f00
test al, al
jne 0x140003ff2
cmp dword [rdi], 0x4550
jne 0x140003ff2
test rdi, rdi
je 0x140003ff2
mov edx, 0xf8
mov rcx, rdi
call fcn.140004f00
test al, al
jne 0x140003ff2
mov eax, 0x20b
lea rax, [rsi + 4]
test rax, rax
je 0x14000401a
cmp rax, rbx
jb 0x14000401a
mov rcx, rax
sub rcx, rbx
lea rdx, [rcx + 0x14]
cmp rdx, rbp
ja 0x14000401a
cmp rdx, 0x14
jb 0x14000401a
cmp rdx, rcx
jae 0x14000401c
xor eax, eax
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
mov rbx, qword [rsp + 0x38]
xor eax, eax
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
Function at 0x140004350
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov rsi, r9
mov r12, r8
mov r13, rdx
mov rdi, rcx
test rcx, rcx
je 0x14000455c
test r8, r8
je 0x14000455c
call fcn.140003950
mov r15, rax
test rax, rax
je 0x14000455c
mov edx, 0x40
mov rcx, rdi
call fcn.140004f00
test al, al
jne 0x1400043f9
mov eax, 0x5a4d
cmp word [rdi], ax
jne 0x1400043f9
movsxd rax, dword [rdi + 0x3c]
cmp eax, 0x400
jg 0x1400043f9
lea rbx, [rdi + rax]
mov edx, 0xf8
mov rcx, rbx
call fcn.140004f00
test al, al
jne 0x1400043f9
cmp dword [rbx], 0x4550
jne 0x1400043f9
test rbx, rbx
je 0x1400043f9
mov edx, 0xf8
mov rcx, rbx
call fcn.140004f00
test al, al
jne 0x1400043f9
mov eax, 0x20b
movzx eax, word [r15 + 0x14]
xor r11d, r11d
add rax, r15
mov r14d, r11d
movzx ebp, r11w
lea rdx, [rax + 0x18]
mov eax, dword [r15 + 0x54]
mov qword [rsp + 0x20], rdx
mov dword [rsp + 0x60], eax
cmp r11w, word [r15 + 6]
jae 0x14000453f
nop word [rax + rax]
movzx eax, bp
lea rcx, [rax + rax*4]
lea rbx, [rdx + rcx*8]
test rbx, rbx
je 0x14000455c
cmp rbx, rdi
jb 0x14000455c
mov rcx, rbx
sub rcx, rdi
lea rax, [rcx + 0x28]
cmp rax, r13
ja 0x14000455c
cmp rax, 0x28
jb 0x14000455c
cmp rax, rcx
jb 0x14000455c
cmp rax, rsi
ja 0x14000455c
mov ecx, dword [rbx + 0x14]
test ecx, ecx
je 0x14000452d
mov eax, dword [rbx + 0x10]
test eax, eax
je 0x14000452d
mov r9d, dword [rbx + 0xc]
mov edx, ecx
mov r8d, eax
add rcx, rdi
add rax, r9
lea r10, [r9 + r12]
cmp rax, rsi
jbe 0x1400044ba
mov rax, rsi
mov r8, r11
sub rax, r9
cmp rsi, r9
cmova r8, rax
cmp r9, rsi
jb 0x1400044c8
test r8, r8
jne 0x14000455c
lea rax, [rdx + r8]
cmp rax, rsi
ja 0x14000455c
test rcx, rcx
je 0x140004528
cmp rcx, rdi
jb 0x140004528
cmp rax, r13
ja 0x140004528
cmp rax, r8
jb 0x140004528
cmp rax, rdx
jb 0x140004528
test r10, r10
je 0x140004528
cmp r10, r12
jb 0x140004528
lea rax, [r9 + r8]
cmp rax, rsi
ja 0x140004528
cmp rax, r8
jb 0x140004528
cmp rax, r9
jb 0x140004528
mov rdx, rcx
mov rcx, r10
call fcn.1400374c0
test r14d, r14d
je 0x140004521
cmp dword [rbx + 0x14], r14d
jae 0x140004525
mov r14d, dword [rbx + 0x14]
xor r11d, r11d
mov rdx, qword [rsp + 0x20]
inc bp
cmp bp, word [r15 + 6]
jb 0x140004430
mov eax, dword [rsp + 0x60]
test eax, eax
cmove eax, r14d
mov r8d, eax
cmp r8, rsi
ja 0x14000455c
mov rdx, rdi
mov rcx, r12
call fcn.1400374c0
mov al, 1
jmp 0x14000455e
xor al, al
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1400045a0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r14, rdx
mov r12, r8
mov edx, 5
mov rsi, rcx
call fcn.140003c20
test rax, rax
je 0x140004812
test rsi, rsi
je 0x140004812
cmp rax, rsi
jb 0x140004812
mov rcx, rax
sub rcx, rsi
lea rdx, [rcx + 8]
cmp rdx, r14
ja 0x140004812
cmp rdx, 8
jb 0x140004812
cmp rdx, rcx
jb 0x140004812
mov ecx, dword [rax + 4]
mov edx, 0x40
mov ebx, dword [rax]
mov dword [rsp + 0x20], ecx
mov rcx, rsi
mov dword [rsp + 0x78], ebx
call fcn.140004f00
test al, al
jne 0x140004676
mov eax, 0x5a4d
cmp word [rsi], ax
jne 0x140004676
movsxd rax, dword [rsi + 0x3c]
cmp eax, 0x400
jg 0x140004676
lea rbx, [rsi + rax]
mov edx, 0xf8
mov rcx, rbx
call fcn.140004f00
test al, al
jne 0x140004672
cmp dword [rbx], 0x4550
jne 0x140004672
test rbx, rbx
je 0x140004672
mov edx, 0xf8
mov rcx, rbx
call fcn.140004f00
mov ebx, dword [rsp + 0x78]
mov r10d, dword [rsp + 0x20]
xor r13d, r13d
test r10d, r10d
je 0x14000480e
mov r11d, 0x1000
nop dword [rax]
lea eax, [rbx + r13]
lea r15, [rax + rsi]
mov ecx, eax
test r15, r15
je 0x140004812
cmp r15, rsi
jb 0x140004812
add rax, 8
cmp rax, r14
ja 0x140004812
cmp rax, 8
jb 0x140004812
cmp rax, rcx
jb 0x140004812
mov eax, dword [r15 + 4]
test eax, eax
je 0x14000480e
mov r9d, dword [r15]
lea rbp, [rax - 8]
shr rbp, 1
lea rax, [r15 + 8]
mov dword [rsp + 0x24], r9d
test rax, rax
je 0x140004812
cmp rax, rsi
jb 0x140004812
sub rax, rsi
lea rbx, [rax + 2]
cmp rbx, r14
ja 0x140004812
cmp rbx, 2
jb 0x140004812
cmp rbx, rax
jb 0x140004812
test rbp, rbp
je 0x1400047fd
xor r8d, r8d
test rbp, rbp
je 0x1400047fd
mov rax, rbx
nop dword [rax + rax]
lea rdx, [rsi - 2]
add rdx, rax
je 0x140004779
cmp rdx, rsi
jb 0x140004779
cmp rax, r14
ja 0x140004779
cmp rax, 2
jb 0x140004779
lea rcx, [rax - 2]
cmp rax, rcx
jb 0x140004779
cmp word [rdx], r11w
jae 0x140004779
add rax, 2
inc r8
cmp r8, rbp
jb 0x140004740
jmp 0x1400047fd
xor edi, edi
nop dword [rax + rax]
lea rcx, [rsi - 2]
add rcx, rbx
je 0x1400047ed
cmp rcx, rsi
jb 0x1400047ed
cmp rbx, r14
ja 0x1400047ed
cmp rbx, 2
jb 0x1400047ed
lea rax, [rbx - 2]
cmp rbx, rax
jb 0x1400047ed
movzx eax, word [rcx]
mov ecx, eax
shr eax, 0xc
and ecx, 0xfff
test eax, eax
je 0x1400047ed
cmp eax, 3
je 0x1400047be
cmp eax, 0xa
jne 0x140004812
add ecx, r9d
cmp rcx, r14
jae 0x140004812
test r12, r12
je 0x1400047e1
mov rax, qword [r12]
lea rdx, [rcx + rsi]
mov rcx, r12
call qword [rax]
test al, al
je 0x140004812
mov r9d, dword [rsp + 0x24]
add rbx, 2
inc rdi
cmp rdi, rbp
jb 0x140004780
test rdi, rdi
je 0x140004812
mov r10d, dword [rsp + 0x20]
mov r11d, 0x1000
add r13d, dword [r15 + 4]
mov ebx, dword [rsp + 0x78]
cmp r13d, r10d
jb 0x140004690
mov al, 1
jmp 0x140004814
xor al, al
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140004840
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rsi, r8
mov rbp, rdx
mov r14, rcx
call fcn.140003e40
mov edi, eax
test eax, eax
je 0x140004aca
test rbp, rbp
jne 0x140004871
mov ebp, edi
mov edx, 9
mov rcx, r14
call fcn.140003c20
test rax, rax
je 0x140004aca
mov eax, dword [rax]
test eax, eax
je 0x140004aca
mov ebx, eax
add rbx, r14
je 0x140004aca
mov rbx, qword [rbx + 0x18]
test rbx, rbx
je 0x140004aca
cmp rbx, r14
jb 0x1400048cc
lea rax, [r14 + rdi]
cmp rbx, rax
jae 0x1400048cc
mov rax, rbx
mov ecx, 0xffffffff
sub rax, r14
cmp rax, rcx
jae 0x1400048e0
sub ebx, r14d
jmp 0x1400048e2
cmp rbx, rdi
jae 0x140004aca
mov ecx, 0xffffffff
cmp rbx, rcx
cmovb ecx, ebx
mov ebx, ecx
test r14, r14
je 0x140004a2a
mov edx, 0x40
mov rcx, r14
call fcn.140004f00
test al, al
jne 0x140004a2a
mov eax, 0x5a4d
cmp word [r14], ax
jne 0x140004a2a
movsxd rax, dword [r14 + 0x3c]
cmp eax, 0x400
jg 0x140004a2a
lea rdi, [r14 + rax]
mov edx, 0xf8
mov rcx, rdi
call fcn.140004f00
test al, al
jne 0x140004a2a
cmp dword [rdi], 0x4550
jne 0x140004a2a
test rdi, rdi
je 0x140004a2a
mov edx, 0xf8
mov rcx, rdi
call fcn.140004f00
test al, al
mov eax, ebx
lea rcx, [rax + r14]
jne 0x140004a39
mov edx, 0x20b
cmp word [rdi + 0x18], dx
jne 0x140004a30
test rcx, rcx
je 0x140004ac3
cmp rcx, r14
jb 0x140004ac3
lea rbx, [rax + 8]
cmp rbx, rbp
ja 0x140004ac3
cmp rbx, 8
jb 0x140004ac3
cmp rbx, rax
jb 0x140004ac3
mov rcx, r14
call fcn.140003e40
xor edi, edi
lea rcx, [r14 - 8]
add rcx, rbx
je 0x140004ac5
cmp rcx, r14
jb 0x140004ac5
cmp rbx, rbp
ja 0x140004ac5
cmp rbx, 8
jb 0x140004ac5
lea rax, [rbx - 8]
cmp rbx, rax
jb 0x140004ac5
mov rax, qword [rcx]
mov qword [rsp + 0x40], rax
test rax, rax
je 0x140004ac5
mov rdx, qword [rsi + 8]
cmp rdx, qword [rsi + 0x10]
je 0x140004a14
mov qword [rdx], rax
inc rdi
add qword [rsi + 8], 8
add rbx, 8
jmp 0x1400049b2
lea r8, [rsp + 0x40]
mov rcx, rsi
call fcn.140004d30
inc rdi
add rbx, 8
jmp 0x1400049b2
mov eax, ebx
lea rcx, [r14 + rax]
test r14, r14
je 0x140004ac3
test rcx, rcx
je 0x140004ac3
cmp rcx, r14
jb 0x140004ac3
lea rbx, [rax + 4]
cmp rbx, rbp
ja 0x140004ac3
cmp rbx, 4
jb 0x140004ac3
cmp rbx, rax
jb 0x140004ac3
mov rcx, r14
call fcn.140003e40
xor edi, edi
lea rcx, [r14 - 4]
add rcx, rbx
je 0x140004ac5
cmp rcx, r14
jb 0x140004ac5
cmp rbx, rbp
ja 0x140004ac5
cmp rbx, 4
jb 0x140004ac5
lea rax, [rbx - 4]
cmp rbx, rax
jb 0x140004ac5
mov eax, dword [rcx]
test eax, eax
je 0x140004ac5
mov rdx, qword [rsi + 8]
mov qword [rsp + 0x40], rax
cmp rdx, qword [rsi + 0x10]
je 0x140004aad
mov qword [rdx], rax
inc rdi
add qword [rsi + 8], 8
add rbx, 4
jmp 0x140004a65
lea r8, [rsp + 0x40]
mov rcx, rsi
call fcn.140004d30
inc rdi
add rbx, 4
jmp 0x140004a65
xor edi, edi
mov rax, rdi
jmp 0x140004acc
xor eax, eax
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x140006ba0
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
mov dword [rcx], 0x61707865
mov r10, rcx
mov dword [rcx + 4], 0x3320646e
mov dword [rcx + 8], 0x79622d32
mov dword [rcx + 0xc], 0x6b206574
movzx eax, byte [rdx + 2]
movzx r9d, byte [rdx + 3]
shl r9d, 8
or r9d, eax
movzx eax, byte [rdx + 1]
shl r9d, 8
or r9d, eax
movzx eax, byte [rdx]
shl r9d, 8
or r9d, eax
mov dword [rcx + 0x10], r9d
movzx eax, byte [rdx + 6]
movzx ecx, byte [rdx + 7]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 5]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 4]
shl ecx, 8
or ecx, eax
mov dword [r10 + 0x14], ecx
movzx eax, byte [rdx + 0xa]
movzx ecx, byte [rdx + 0xb]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 9]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 8]
shl ecx, 8
or ecx, eax
mov dword [r10 + 0x18], ecx
movzx eax, byte [rdx + 0xe]
movzx ecx, byte [rdx + 0xf]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0xd]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0xc]
shl ecx, 8
or ecx, eax
mov dword [r10 + 0x1c], ecx
movzx eax, byte [rdx + 0x12]
movzx ecx, byte [rdx + 0x13]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0x11]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0x10]
shl ecx, 8
or ecx, eax
mov dword [r10 + 0x20], ecx
movzx eax, byte [rdx + 0x16]
movzx ecx, byte [rdx + 0x17]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0x15]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0x14]
shl ecx, 8
or ecx, eax
mov dword [r10 + 0x24], ecx
movzx eax, byte [rdx + 0x1a]
movzx ecx, byte [rdx + 0x1b]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0x19]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0x18]
shl ecx, 8
or ecx, eax
mov dword [r10 + 0x28], ecx
movzx eax, byte [rdx + 0x1e]
movzx ecx, byte [rdx + 0x1f]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0x1d]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0x1c]
shl ecx, 8
or ecx, eax
xor eax, eax
mov dword [r10 + 0x2c], ecx
mov qword [r10 + 0x30], rax
movzx eax, byte [r8 + 2]
movzx ecx, byte [r8 + 3]
shl ecx, 8
or ecx, eax
movzx eax, byte [r8 + 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [r8]
shl ecx, 8
or ecx, eax
mov dword [r10 + 0x38], ecx
movzx eax, byte [r8 + 6]
movzx ecx, byte [r8 + 7]
shl ecx, 8
or ecx, eax
movzx eax, byte [r8 + 5]
shl ecx, 8
or ecx, eax
movzx eax, byte [r8 + 4]
shl ecx, 8
or ecx, eax
mov rax, r10
mov dword [r10 + 0x3c], ecx
ret
Function at 0x140007aa0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x140282a80]
xor rax, rsp
mov qword [rsp + 0x48], rax
movzx r15d, r8b
mov rbp, rdx
mov rdi, rcx
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x40], 0
xor ebx, ebx
mov qword [rsp + 0x40], rbx
xor esi, esi
xor r14d, r14d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0x30]
mov edx, 8
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x140007b50
mov rbx, qword [rsp + 0x30]
mov qword [rsp + 0x40], rbx
mov r14, rbx
mov dword [rsp + 0x38], 4
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [rsp + 0x3c]
mov edx, SafeArrayUnaccessData
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x140007b50
cmp dword [rsp + 0x3c], esi
setne sil
test r14, r14
je 0x140007b61
mov rcx, rbx
mov rax, qword [0x140078280]
call rax
test esi, esi
je 0x140007b93
mov rsi, qword gs:[0x60]
test rsi, rsi
je 0x140007b93
mov rbx, qword [rsi + 0x38]
mov qword [rsp + 0x40], rbx
mov rcx, rbx
call qword [sym.imp.ntdll.dll_RtlEnterCriticalSection]
nop
mov qword [rsi + 0x10], rdi
mov rcx, rbx
call qword [sym.imp.ntdll.dll_RtlLeaveCriticalSection]
mov rdx, rdi
mov rcx, rdi
call fcn.140001070
mov eax, ebp
test rbp, rbp
jne 0x140007bb1
mov rcx, rdi
call fcn.140003e40
test eax, eax
je 0x140007bbb
mov edx, eax
mov rcx, rdi
call fcn.1400019a0
mov rdx, rbp
mov rcx, rdi
call fcn.140004ae0
test rdi, rdi
je 0x140007c95
mov edx, 0x40
mov rcx, rdi
call fcn.140004f00
test al, al
jne 0x140007c95
mov ebx, 0x5a4d
cmp word [rdi], bx
jne 0x140007c95
movsxd rax, dword [rdi + 0x3c]
cmp eax, 0x400
jg 0x140007c95
lea rsi, [rdi + rax]
mov edx, 0xf8
mov rcx, rsi
call fcn.140004f00
test al, al
jne 0x140007c95
cmp dword [rsi], 0x4550
jne 0x140007c95
test rsi, rsi
je 0x140007c95
mov edx, 0x40
mov rcx, rdi
call fcn.140004f00
test al, al
jne 0x140007c73
cmp word [rdi], bx
jne 0x140007c73
movsxd rax, dword [rdi + 0x3c]
cmp eax, 0x400
jg 0x140007c73
lea rbx, [rdi + rax]
mov edx, 0xf8
mov rcx, rbx
call fcn.140004f00
test al, al
jne 0x140007c73
cmp dword [rbx], 0x4550
jne 0x140007c73
test rbx, rbx
je 0x140007c73
mov edx, 0xf8
mov rcx, rbx
call fcn.140004f00
mov eax, dword [rsi + 0x28]
test eax, eax
je 0x140007c95
add rax, rdi
test r15b, r15b
je 0x140007c91
xor r8d, r8d
mov edx, 1
mov rcx, rdi
call rax
jmp 0x140007c9a
call rax
jmp 0x140007c9a
mov eax, 0xfffffffe
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14002e100
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x14001cf30
Capabilities:
Compute adler32 checksum

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
movaps xmmword [rsp + 0x40], xmm6
mov ebx, ecx
movaps xmmword [rsp + 0x30], xmm7
mov r10, rdx
movdqa xmm7, xmmword [0x140042f90]
mov edi, 0x15b0
movaps xmmword [rsp + 0x20], xmm8
movdqa xmm8, xmmword [0x140042fa0]
movaps xmmword [rsp + 0x10], xmm9
movaps xmmword [rsp], xmm10
movdqa xmm10, xmmword [0x140042fb0]
shr ebx, 0x10
movzx r11d, cx
cmp r9, 0x10
jb 0x14001d105
xorps xmm5, xmm5
nop dword [rax]
cmp r9, rdi
movd xmm3, r11d
mov rax, r9
movd xmm9, ebx
cmova rax, rdi
movdqa xmm6, xmm5
and rax, 0xfffffffffffffff0
movdqa xmm4, xmm5
sub r9, rax
cmp rax, 0x20
jb 0x14001d02d
mov rdx, rax
shr rdx, 5
imul rcx, rdx, 0xffffffffffffffe0
add rax, rcx
nop word [rax + rax]
movdqu xmm1, xmmword [r8]
movdqu xmm2, xmmword [r8 + 0x10]
add r8, 0x20
movdqa xmm0, xmm1
paddd xmm6, xmm3
psadbw xmm0, xmm5
movdqu xmmword [r10], xmm1
movdqu xmmword [r10 + 0x10], xmm2
add r10, 0x20
pmaddubsw xmm1, xmm10
paddd xmm3, xmm0
movdqa xmm0, xmm2
pmaddubsw xmm2, xmm8
psadbw xmm0, xmm5
pmaddwd xmm1, xmm7
pmaddwd xmm2, xmm7
paddd xmm3, xmm0
paddd xmm9, xmm1
paddd xmm4, xmm2
sub rdx, 1
jne 0x14001cfd0
pslld xmm6, 5
paddd xmm4, xmm9
paddd xmm4, xmm6
movdqa xmm6, xmm5
cmp rax, 0x10
jb 0x14001d08e
movdqa xmm2, xmm3
shr rax, 4
nop dword [rax]
movdqu xmm1, xmmword [r8]
add r8, 0x10
paddd xmm6, xmm2
movdqa xmm0, xmm1
psadbw xmm0, xmm5
movdqu xmmword [r10], xmm1
add r10, 0x10
paddd xmm3, xmm0
movdqa xmm0, xmm1
pmaddubsw xmm0, xmm8
movdqa xmm2, xmm3
pmaddwd xmm0, xmm7
paddd xmm4, xmm0
sub rax, 1
jne 0x14001d050
movdqa xmm0, xmm3
pslld xmm6, 4
psrldq xmm0, 8
paddd xmm6, xmm4
paddd xmm0, xmm3
mov eax, 0x80078071
movd r11d, xmm0
movdqa xmm1, xmm6
punpckhqdq xmm1, xmm6
paddd xmm1, xmm6
mul r11d
pshufd xmm0, xmm1, 1
paddd xmm0, xmm1
movd ebx, xmm0
shr edx, 0xf
imul eax, edx, 0xfff1
sub r11d, eax
mov eax, 0x80078071
mul ebx
shr edx, 0xf
imul eax, edx, 0xfff1
sub ebx, eax
cmp r9, 0x10
jae 0x14001cf90
test r9, r9
jne 0x14001cf80
shl ebx, 0x10
or ebx, r11d
mov eax, ebx
jmp 0x14001d151
test r9, r9
je 0x14001d128
sub r8, r10
nop dword [rax]
movzx eax, byte [r8 + r10]
mov byte [r10], al
lea r10, [r10 + 1]
add r11d, eax
add ebx, r11d
sub r9, 1
jne 0x14001d110
mov eax, 0x80078071
mul r11d
mov eax, 0x80078071
shr edx, 0xf
imul ecx, edx, 0xfff1
mul ebx
sub r11d, ecx
shr edx, 0xf
imul eax, edx, 0xf
add eax, ebx
shl eax, 0x10
or eax, r11d
mov rbx, qword [rsp + 0x60]
movaps xmm6, xmmword [rsp + 0x40]
movaps xmm7, xmmword [rsp + 0x30]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x10]
movaps xmm10, xmmword [rsp]
add rsp, 0x50
pop rdi
ret
Function at 0x14001d1c0
Capabilities:
Compute adler32 checksum

Disassembly:
sub rsp, 0x68
mov r11, r8
mov r10, rdx
mov eax, ecx
test r8, r8
jne 0x14001d1de
mov eax, 1
vzeroupper
add rsp, 0x68
ret
test r9, r9
je 0x14001d41f
mov qword [rsp + 0x70], rbx
mov ebx, ecx
mov qword [rsp + 0x60], rdi
mov edi, 0x15b0
vmovaps xmmword [rsp + 0x50], xmm6
vmovaps xmmword [rsp + 0x40], xmm7
vmovdqu ymm7, ymmword [0x140043380]
vmovaps xmmword [rsp + 0x30], xmm8
vmovdqu ymm8, ymmword [0x140043360]
vmovaps xmmword [rsp + 0x20], xmm9
vmovdqu ymm9, ymmword [0x140043340]
movzx r8d, cx
mov ecx, dword [rsp + 0x90]
shr ebx, 0x10
cmp r9, 0x10
jb 0x14001d36f
cmp r9, 0x20
jb 0x14001d343
vpxor xmm6, xmm6, xmm6
nop
cmp r9, rdi
mov rax, r9
vmovd xmm2, r8d
cmova rax, rdi
and rax, 0xffffffffffffffe0
sub r9, rax
vmovd xmm3, ebx
vmovdqu ymm5, ymm2
vmovdqu ymm4, ymm6
cmp rax, 0x20
jb 0x14001d2ba
shr rax, 5
nop dword [rax]
vmovdqu ymm0, ymmword [r11]
add r11, 0x20
vpsadbw ymm1, ymm0, ymm6
test ecx, ecx
je 0x14001d29a
vmovdqu ymmword [r10], ymm0
add r10, 0x20
vpaddd ymm2, ymm1, ymm2
vpmaddubsw ymm0, ymm0, ymm7
vpmaddwd ymm1, ymm0, ymm8
vpaddd ymm4, ymm4, ymm5
vpaddd ymm3, ymm1, ymm3
vmovdqu ymm5, ymm2
sub rax, 1
jne 0x14001d280
vpermd ymm1, ymm9, ymm2
vpunpckhqdq xmm0, xmm1, xmm1
vpaddd xmm2, xmm0, xmm1
vpshufd xmm1, xmm2, 1
vpaddd xmm0, xmm1, xmm2
vmovd r8d, xmm0
vpslld ymm0, ymm4, 5
vpaddd ymm2, ymm0, ymm3
vextracti128 xmm1, ymm2, 1
vpaddd xmm1, xmm1, xmm2
vpunpckhqdq xmm0, xmm1, xmm1
vpaddd xmm2, xmm0, xmm1
mov eax, 0x80078071
mul r8d
vpshufd xmm1, xmm2, 1
shr edx, 0xf
imul eax, edx, 0xfff1
vpaddd xmm0, xmm1, xmm2
vmovd ebx, xmm0
sub r8d, eax
mov eax, 0x80078071
mul ebx
shr edx, 0xf
imul eax, edx, 0xfff1
sub ebx, eax
cmp r9, 0x20
jae 0x14001d250
mov eax, ebx
shl eax, 0x10
or eax, r8d
test r9, r9
jne 0x14001d236
jmp 0x14001d3fd
test ecx, ecx
mov ecx, eax
je 0x14001d35c
mov r8, r11
mov rdx, r10
vzeroupper
call fcn.14001cf30
jmp 0x14001d3fd
mov r8, r9
mov rdx, r11
vzeroupper
call fcn.14001c450
jmp 0x14001d3fd
test ecx, ecx
je 0x14001d3ae
test r9, r9
je 0x14001d398
sub r11, r10
nop dword [rax + rax]
movzx eax, byte [r11 + r10]
mov byte [r10], al
lea r10, [r10 + 1]
add r8d, eax
add ebx, r8d
sub r9, 1
jne 0x14001d380
mov eax, 0x80078071
mul r8d
shr edx, 0xf
imul ecx, edx, 0xfff1
sub r8d, ecx
jmp 0x14001d3e8
test r9, r9
je 0x14001d3d4
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r11]
lea r11, [r11 + 1]
add r8d, eax
add ebx, r8d
sub r9, 1
jne 0x14001d3c0
mov eax, 0x80078071
mul r8d
shr edx, 0xf
imul eax, edx, 0xfff1
sub r8d, eax
mov eax, 0x80078071
mul ebx
shr edx, 0xf
imul eax, edx, 0xf
add eax, ebx
shl eax, 0x10
or eax, r8d
vmovaps xmm8, xmmword [rsp + 0x30]
vmovaps xmm7, xmmword [rsp + 0x40]
vmovaps xmm6, xmmword [rsp + 0x50]
mov rdi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x70]
vmovaps xmm9, xmmword [rsp + 0x20]
vzeroupper
add rsp, 0x68
ret