joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140019490
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x140081040]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x1400a8710]
mov edi, ecx
cmp byte [rbx + 0x427d], 0
jne 0x1400194f1
cmp byte [rbx + 0x427e], 0
jne 0x1400194f1
movsx r9d, word [rbx + 0x5362]
lea r8, str.Tooltip__02d
mov edx, 0x10
lea rcx, [rsp + 0x20]
call fcn.140009510
test dil, 1
je 0x140019618
jmp 0x14001957a
movss xmm1, dword [rbx + 0x38b0]
lea r8, str.Tooltip__02d
movsx r9d, word [rbx + 0x5362]
lea rcx, [rsp + 0x20]
movaps xmm0, xmm1
xor eax, eax
mulss xmm0, dword [0x1400775f8]
mulss xmm1, dword [0x1400775e4]
lea edx, [rax + 0x10]
addss xmm0, dword [rbx + 0xd94]
addss xmm1, dword [rbx + 0xd98]
mov qword [rbx + 0x3ff8], rax
mov dword [rbx + 0x3fe4], 1
movss dword [rbx + 0x3ff0], xmm0
movss dword [rbx + 0x3ff4], xmm1
movss xmm0, dword [rbx + 0x3918]
mulss xmm0, dword [0x140077484]
or dword [rbx + 0x3fe0], 0x41
movss dword [rbx + 0x4040], xmm0
call fcn.140009510
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x1400195d0
lea r11, [0x1400701d0]
nop word [rax + rax]
cmp r9b, 0x23
jne 0x1400195b3
cmp byte [r8], r9b
jne 0x1400195b3
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x1400195a0
not ecx
call fcn.1400121d0
test rax, rax
je 0x140019618
cmp byte [rax + 0x96], 0
je 0x140019618
mov byte [rax + 0x9d], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xb8], 1
lea rcx, [rsp + 0x20]
inc word [rbx + 0x5362]
mov edx, 0x10
movsx r9d, word [rbx + 0x5362]
call fcn.140009510
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x20c0347
call fcn.140014a10
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14006b800
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x14001e580
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x5410], 0
lea rbx, [rcx + 0x5418]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x14001e627
mov r9d, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test r9d, r9d
jns 0x14001e5da
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.140020720
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.140009fc0
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x5410]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rdi + 0x5420]
cmove ecx, r14d
test rax, rax
movsxd r8, ecx
lea rcx, [0x1400a8708]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x14001e62f
mov rcx, rbx
call fcn.140009fc0
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x14001eba0
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 8
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10, qword [0x1400a8710]
mov r11d, 0xffffffff
mov eax, r11d
test r9b, r9b
je 0x14001ec03
mov qword [rsp], rbx
lea rbx, [0x1400701d0]
nop dword [rax]
cmp r9b, 0x23
jne 0x14001ebe3
cmp byte [r8], r9b
jne 0x14001ebe3
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rbx + rdx*4]
test r9b, r9b
jne 0x14001ebd0
mov rbx, qword [rsp]
movsxd rcx, dword [r10 + 0x53c0]
xor r8d, r8d
not eax
test ecx, ecx
jle 0x14001ec37
mov r10, qword [r10 + 0x53c8]
mov r9, rcx
mov edx, r8d
lea rcx, [r10 + 8]
cmp dword [rcx], eax
je 0x14001ec3e
inc r8d
inc rdx
add rcx, 0x48
cmp rdx, r9
jl 0x14001ec24
xor eax, eax
add rsp, 8
ret
movsxd rax, r8d
lea rcx, [rax + rax*8]
lea rax, [r10 + rcx*8]
add rsp, 8
ret
Function at 0x1400532c0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x270
mov rax, qword [0x140081040]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor eax, eax
mov rsi, rdx
mov qword [rcx], rax
mov rdi, rcx
mov qword [rcx + 8], rax
xor edx, edx
lea rcx, [rsp + 0x24]
mov r8d, 0x234
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov dword [rsp + 0x20], 0x238
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rcx, rax
lea rdx, [rsp + 0x20]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14005336f
nop dword [rax]
mov rdx, rsi
lea rcx, [rsp + 0x4c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x140053356
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140053330
jmp 0x14005336f
mov r8d, dword [rsp + 0x28]
xor edx, edx
mov ecx, 0x1fffff
mov qword [rdi], r8
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rdi + 8], rax
test rbx, rbx
je 0x14005337d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rdi
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.14006b800
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140055510
Capabilities:
Hash data using fnv

Disassembly:
push rsi
push rdi
sub rsp, 0x28
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
jbe 0x140055545
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x50], rbx
mov rbx, qword [rsi + 8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
mov qword [rsp + 0x20], r14
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.1400526b0
lea rax, [rdi - 1]
mov qword [rsi + 0x38], rdi
mov qword [rsi + 0x30], rax
mov rax, qword [rsi + 8]
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x140055686
mov qword [rsp + 0x58], rbp
movabs rdi, 0x100000001b3
movabs rbp, 0xcbf29ce484222325
nop dword [rax + rax]
movzx edx, byte [rax + 0x11]
movzx r9d, byte [rax + 0x10]
mov r11, qword [rsi + 0x30]
xor r9, rbp
mov rcx, qword [rcx]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x12]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x13]
imul r9, rdi
xor r9, rdx
imul r9, rdi
and r11, r9
shl r11, 4
add r11, qword [rsi + 0x18]
mov r9, qword [r11]
cmp r9, rbx
jne 0x140055600
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x140055675
mov rdx, qword [r11 + 8]
mov r8d, dword [rax + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x14005563d
mov r10, qword [rdx]
cmp r10, rax
je 0x140055637
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x140055675
cmp r9, rdx
je 0x140055651
mov rdx, qword [rdx + 8]
cmp r8d, dword [rdx + 0x10]
je 0x140055697
cmp r9, rdx
jne 0x140055642
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
jne 0x1400555b0
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov r14, qword [rsp + 0x20]
add rsp, 0x28
pop rdi
pop rsi
ret
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x140055675
Function at 0x1400560f0
Capabilities:
Hash data using fnv

Disassembly:
mov r11, rsp
movzx edx, cl
mov r8, rcx
movabs rax, 0xcbf29ce484222325
xor rdx, rax
mov qword [r11 + 8], rcx
movabs rcx, 0x100000001b3
movzx eax, byte [r11 + 9]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [r11 + 0xa]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [r11 + 0xb]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [r11 + 0xc]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [r11 + 0xd]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [r11 + 0xe]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [r11 + 0xf]
imul rdx, rcx
xor rdx, rax
imul rdx, rcx
mov rcx, qword [0x1400a7f70]
and rcx, rdx
mov rdx, qword [0x1400a7f48]
shl rcx, 4
add rcx, qword [0x1400a7f58]
mov rax, qword [rcx + 8]
cmp rax, rdx
je 0x1400561c0
mov rcx, qword [rcx]
cmp r8, qword [rax + 0x10]
je 0x1400561c2
nop word [rax + rax]
cmp rax, rcx
je 0x1400561c0
mov rax, qword [rax + 8]
cmp r8, qword [rax + 0x10]
jne 0x1400561a0
test rax, rax
mov rcx, rdx
cmovne rcx, rax
cmp rcx, rdx
setne al
ret
xor eax, eax
test rax, rax
mov rcx, rdx
cmovne rcx, rax
cmp rcx, rdx
setne al
ret
Function at 0x1400576b0
Capabilities:
Hash data using fnv

Disassembly:
push rsi
push rdi
sub rsp, 0x28
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
jbe 0x1400576e5
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x50], rbx
mov rbx, qword [rsi + 8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
mov qword [rsp + 0x20], r14
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.1400526b0
lea rax, [rdi - 1]
mov qword [rsi + 0x38], rdi
mov qword [rsi + 0x30], rax
mov rax, qword [rsi + 8]
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x140057854
mov qword [rsp + 0x58], rbp
movabs rdi, 0x100000001b3
movabs rbp, 0xcbf29ce484222325
nop dword [rax + rax]
movzx edx, byte [rax + 0x11]
movzx r9d, byte [rax + 0x10]
mov r11, qword [rsi + 0x30]
xor r9, rbp
mov rcx, qword [rcx]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x12]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x13]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x14]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x15]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x16]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x17]
imul r9, rdi
xor r9, rdx
imul r9, rdi
and r11, r9
shl r11, 4
add r11, qword [rsi + 0x18]
mov r9, qword [r11]
cmp r9, rbx
jne 0x1400577cc
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x140057843
mov rdx, qword [r11 + 8]
mov r8, qword [rax + 0x10]
cmp r8, qword [rdx + 0x10]
jne 0x140057809
mov r10, qword [rdx]
cmp r10, rax
je 0x140057803
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x140057843
cmp r9, rdx
je 0x14005781f
nop
mov rdx, qword [rdx + 8]
cmp r8, qword [rdx + 0x10]
je 0x140057865
cmp r9, rdx
jne 0x140057810
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
jne 0x140057750
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov r14, qword [rsp + 0x20]
add rsp, 0x28
pop rdi
pop rsi
ret
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x140057843
Function at 0x140059be0
Capabilities:
Hash data using fnv

Disassembly:
mov r9, rcx
movzx r8d, cl
movabs r10, 0x100000001b3
movabs rax, 0xcbf29ce484222325
xor r8, rax
mov rax, rcx
imul r8, r10
shr rax, 8
movzx edx, al
mov rax, rcx
xor r8, rdx
shr rax, 0x10
mov rdx, qword [0x1400a7f70]
imul r8, r10
movzx ecx, al
mov rax, r9
xor r8, rcx
shr rax, 0x18
imul r8, r10
movzx ecx, al
mov rax, r9
xor r8, rcx
shr rax, 0x20
imul r8, r10
movzx ecx, al
mov rax, r9
xor r8, rcx
shr rax, 0x28
imul r8, r10
movzx ecx, al
mov rax, r9
xor r8, rcx
shr rax, 0x30
imul r8, r10
movzx ecx, al
mov rax, r9
xor r8, rcx
shr rax, 0x38
imul r8, r10
xor r8, rax
imul r8, r10
and rdx, r8
mov r8, qword [0x1400a7f48]
shl rdx, 4
add rdx, qword [0x1400a7f58]
mov rcx, qword [rdx + 8]
cmp rcx, r8
je 0x140059cb5
mov rax, qword [rdx]
cmp r9, qword [rcx + 0x10]
je 0x140059cb7
cmp rcx, rax
je 0x140059cb5
mov rcx, qword [rcx + 8]
cmp r9, qword [rcx + 0x10]
jne 0x140059ca4
jmp 0x140059cb7
xor ecx, ecx
test rcx, rcx
je 0x140059d0b
mov rax, qword [rdx]
cmp qword [rdx + 8], rcx
jne 0x140059cdd
cmp rax, rcx
jne 0x140059cd3
mov qword [rdx], r8
mov qword [rdx + 8], r8
jmp 0x140059ce8
mov r8, qword [rcx + 8]
mov qword [rdx + 8], r8
jmp 0x140059ce8
cmp rax, rcx
jne 0x140059ce8
mov rax, qword [rcx]
mov qword [rdx], rax
mov rdx, qword [rcx]
dec qword [0x1400a7f50]
mov rax, qword [rcx + 8]
mov qword [rax], rdx
mov rax, qword [rcx + 8]
mov qword [rdx + 8], rax
mov edx, 0x18
jmp fcn.14006b8f0
ret
Function at 0x14005ad40
Capabilities:
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov ebx, 1
bsr rcx, rax
mov eax, ebx
shl rax, cl
cmp rdx, rax
jbe 0x14005ad71
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x40], rdi
mov rdi, qword [0x1400a7f48]
or rax, rbx
bsr rcx, rax
mov r8, rdi
inc ecx
shl rbx, cl
lea rcx, [0x1400a7f58]
lea rdx, [rbx + rbx]
call fcn.1400526b0
mov rcx, qword [0x1400a7f48]
lea r9, [rbx - 1]
mov qword [0x1400a7f70], r9
mov qword [0x1400a7f78], rbx
mov rcx, qword [rcx]
cmp rcx, rdi
je 0x14005af12
mov qword [rsp + 0x30], rsi
mov rax, rcx
movabs rsi, 0xcbf29ce484222325
movabs rbx, 0x100000001b3
movzx edx, byte [rax + 0x11]
movzx r11d, byte [rax + 0x10]
mov rcx, qword [rcx]
xor r11, rsi
imul r11, rbx
xor r11, rdx
movzx edx, byte [rax + 0x12]
imul r11, rbx
xor r11, rdx
movzx edx, byte [rax + 0x13]
imul r11, rbx
xor r11, rdx
movzx edx, byte [rax + 0x14]
imul r11, rbx
xor r11, rdx
movzx edx, byte [rax + 0x15]
imul r11, rbx
xor r11, rdx
movzx edx, byte [rax + 0x16]
imul r11, rbx
xor r11, rdx
movzx edx, byte [rax + 0x17]
imul r11, rbx
xor r11, rdx
imul r11, rbx
and r11, r9
shl r11, 4
add r11, qword [0x1400a7f58]
mov r9, qword [r11]
cmp r9, rdi
jne 0x14005ae5c
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x14005aed3
mov rdx, qword [r11 + 8]
mov r8, qword [rax + 0x10]
cmp r8, qword [rdx + 0x10]
jne 0x14005ae99
mov r10, qword [rdx]
cmp r10, rax
je 0x14005ae93
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x14005aed3
cmp r9, rdx
je 0x14005aeaf
nop
mov rdx, qword [rdx + 8]
cmp r8, qword [rdx + 0x10]
je 0x14005aee7
cmp r9, rdx
jne 0x14005aea0
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rdi
je 0x14005af0d
mov r9, qword [0x1400a7f70]
jmp 0x14005ade1
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x14005aed3
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop rbx
ret
Function at 0x14006ae50
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x68
mov rax, qword [0x1400a8710]
xor ecx, ecx
or dword [rax + 0x3fe0], 2
mov dword [rax + 0x4000], 0x44518000
mov dword [rax + 0x4004], 0x4405c000
mov dword [rax + 0x3fe8], 1
movss xmm1, dword [0x140081114]
call fcn.14000ae30
mov eax, dword [0x140077320]
xor r8d, r8d
cmp dword [0x140081088], 2
movups xmm0, xmmword [str.iQQ_rVO_JA_v]
mov dword [rsp + 0x40], eax
movzx eax, word [0x140077324]
mov word [rsp + 0x44], ax
movzx eax, byte [0x140077326]
mov byte [rsp + 0x46], al
movups xmmword [rsp + 0x30], xmm0
jl 0x14006b00c
movdqa xmm0, xmmword [str.1111111111111111]
lea rcx, [rsp + 0x34]
movdqa xmm5, xmmword [0x140077a80]
movdqa xmm4, xmmword [0x140077cb0]
movdqa xmmword [rsp + 0x20], xmm0
mov edx, dword [rsp + 0x20]
movaps xmmword [rsp + 0x50], xmm6
movdqa xmm6, xmmword [0x140077b10]
movd xmm2, r8d
lea eax, [r8 + 4]
pshufd xmm2, xmm2, 0
lea rcx, [rcx + 8]
paddd xmm2, xmm5
movd xmm3, eax
movdqa xmm1, xmm2
pshufd xmm3, xmm3, 0
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
paddd xmm3, xmm5
pmuldq xmm0, xmm4
add r8d, 8
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x140077b40]
packuswb xmm2, xmm2
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx - 0xc]
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rcx - 0xc], xmm2
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, edx
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x140077b40]
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rcx - 8]
xorps xmm2, xmm0
movd dword [rcx - 8], xmm2
cmp r8d, 0x10
jl 0x14006af00
movaps xmm6, xmmword [rsp + 0x50]
cmp r8d, 0x17
jge 0x14006b051
movsxd rax, r8d
lea r9, [rsp + 0x30]
add r9, rax
nop word [rax + rax]
mov eax, 0x4ec4ec4f
lea r9, [r9 + 1]
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x34
movzx eax, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9 - 1], al
cmp r8d, 0x17
jl 0x14006b020
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x1ab
call fcn.140014a10
call fcn.14006ab10
call fcn.14006a0b0
call fcn.14005e090
call fcn.140016d50
mov rcx, qword [0x1400a8710]
movsxd rax, dword [rcx + 0x4060]
mov r8, qword [rcx + 0x4068]
lea rdx, [rax + rax*2]
movsxd rax, dword [r8 + rdx*4 - 0xc]
lea r10, [rax + rax*2]
lea rax, [0x140070030]
cmp dword [rax + r10*4], 8
mov r9d, dword [rax + r10*4 + 8]
jne 0x14006b0ed
mov eax, dword [rax + r10*4 + 4]
cmp eax, 1
jne 0x14006b0ce
mov eax, dword [r8 + rdx*4 - 8]
mov dword [r9 + rcx + 0x37f8], eax
dec dword [rcx + 0x4060]
add rsp, 0x68
ret
cmp eax, 2
jne 0x14006b0ed
mov eax, dword [r8 + rdx*4 - 8]
mov dword [r9 + rcx + 0x37f8], eax
mov eax, dword [r8 + rdx*4 - 4]
mov dword [r9 + rcx + 0x37fc], eax
dec dword [rcx + 0x4060]
add rsp, 0x68
ret
Function at 0x14006c478
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14006c4c2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14006c4c2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14006c4c2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14006c4c2
cmp dword [rcx + 0x84], 0xe
jbe 0x14006c4c2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14006c4c4
xor al, al
add rsp, 0x28
ret
Function at 0x180002df0
Capabilities:
Access peb ldr_data

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
cmp dword [0x180020a94], 0xa
jl 0x180002e22
mov eax, dword [0x180020a98]
lea edx, [rax - 1]
imul edx, eax
and edx, 1
je 0x180002e22
nop word cs:[rax + rax]
jmp 0x180002e20
mov rax, qword gs:[0x60]
mov r10, qword [rax + 0x18]
add r10, 0x10
mov eax, dword [0x180020a80]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete al
cmp dword [0x180020a7c], 0xa
setl r8b
or r8b, al
mov eax, dword [0x180020a9c]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete al
cmp dword [0x180020aa0], 0xa
setl r9b
or r9b, al
lea r11, [rcx - 1]
xor eax, eax
mov r14, r10
mov r14, qword [r14]
cmp r14, r10
je 0x180002f1b
mov rsi, r11
test r8b, r8b
je 0x180002f00
cmp byte [rsi + 1], 0
lea rsi, [rsi + 1]
jne 0x180002e90
sub rsi, rcx
je 0x180002f12
test r9b, r9b
je 0x180002f10
mov r15, qword [r14 + 0x60]
xor ebx, ebx
nop word [rax + rax]
movzx r13d, word [r15 + rbx*2]
lea edi, [r13 - 0x41]
lea ebp, [r13 + 0x20]
cmp di, 0x1a
cmovae ebp, r13d
movsx edi, byte [rcx + rbx]
lea r12d, [rdi - 0x41]
lea edx, [rdi + 0x20]
cmp r12b, 0x1a
cmovae edx, edi
sub ebp, edx
test r13d, r13d
je 0x180002ef0
test ebp, ebp
jne 0x180002ef0
add rbx, 1
cmp rsi, rbx
jne 0x180002eb0
jmp 0x180002f17
test ebp, ebp
jne 0x180002e7c
jmp 0x180002f17
jmp 0x180002f00
jmp 0x180002f10
test r9b, r9b
je 0x180002f30
mov rax, qword [r14 + 0x30]
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
jmp 0x180002f30
Function at 0x180001dd0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
movsxd rax, dword [rcx + 0x3c]
cmp dword [rcx + rax + 0x8c], 0
je 0x180001e52
mov eax, dword [rcx + rax + 0x88]
cmp dword [rcx + rax + 0x14], 0
je 0x180001e52
mov ebp, dword [0x180020a84]
mov r8d, dword [0x180020a88]
lea r11d, [rbp - 1]
imul r11d, ebp
and r11d, 1
cmp r8d, 0xa
jl 0x180001e22
test r11d, r11d
je 0x180001e22
nop dword [rax + rax]
jmp 0x180001e20
mov r9d, dword [rcx + rax + 0x18]
test r9d, r9d
je 0x180001e52
mov r10d, dword [rcx + rax + 0x1c]
cmp dword [0x180020a8c], 0xa
jl 0x180001e82
mov esi, dword [0x180020a90]
lea edi, [rsi - 1]
imul edi, esi
and edi, 1
je 0x180001e82
nop dword [rax + rax]
jmp 0x180001e50
mov eax, dword [0x180020a84]
mov r8d, dword [0x180020a88]
lea r11d, [rax - 1]
imul r11d, eax
and r11d, 1
xor ecx, ecx
cmp r8d, 0xa
jl 0x180001eef
test r11d, r11d
je 0x180001eef
nop dword [rax + rax]
jmp 0x180001e80
add r10, rcx
mov r15d, dword [rcx + rax + 0x20]
mov r14d, dword [rcx + rax + 0x24]
add r15, rcx
add r14, rcx
xor edi, edi
nop word [rax + rax]
mov esi, dword [r15]
add rsi, rcx
xor eax, eax
nop dword [rax + rax]
movzx ebx, byte [rdx + rax]
movzx ebp, byte [rsi + rax]
test bl, bl
je 0x180001ec5
add rax, 1
cmp bl, bpl
je 0x180001eb0
cmp bl, bpl
je 0x180001ee4
add edi, 1
add r15, 4
add r14, 2
cmp edi, r9d
jne 0x180001ea0
xor ecx, ecx
cmp r8d, 0xa
jge 0x180001ef5
jmp 0x180001f02
movzx eax, word [r14]
mov eax, dword [r10 + rax*4]
add rcx, rax
cmp r8d, 0xa
jl 0x180001f02
test r11d, r11d
je 0x180001f02
nop word [rax + rax]
jmp 0x180001f00
mov rax, rcx
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x180001f10
Capabilities:
Access peb ldr_data

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
mov rax, qword gs:[0x60]
mov r10, qword [rax + 0x18]
add r10, 0x10
mov eax, dword [0x180020a94]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete al
cmp dword [0x180020a98], 0xa
setl r8b
or r8b, al
mov eax, dword [0x180020a80]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete al
cmp dword [0x180020a7c], 0xa
setl r9b
or r9b, al
mov eax, dword [0x180020a9c]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete al
cmp dword [0x180020aa0], 0xa
setl r14b
or r14b, al
lea rax, [rcx - 1]
mov r15, r10
test r8b, r8b
je 0x180002040
mov r15, qword [r15]
cmp r15, r10
je 0x180002062
mov rdi, rax
test r9b, r9b
je 0x180002050
nop word cs:[rax + rax]
nop
cmp byte [rdi + 1], 0
lea rdi, [rdi + 1]
jne 0x180001fc0
test r14b, r14b
je 0x180002060
sub rdi, rcx
je 0x180002028
mov r12, qword [r15 + 0x60]
xor edx, edx
nop
movzx esi, word [r12 + rdx*2]
lea ebx, [rsi - 0x41]
lea ebp, [rsi + 0x20]
cmp bx, 0x1a
cmovae ebp, esi
movsx ebx, byte [rcx + rdx]
lea r13d, [rbx - 0x41]
lea r11d, [rbx + 0x20]
cmp r13b, 0x1a
cmovae r11d, ebx
sub ebp, r11d
test esi, esi
je 0x180002020
test ebp, ebp
jne 0x180002020
add rdx, 1
cmp rdi, rdx
jne 0x180001fe0
jmp 0x180002028
test ebp, ebp
jne 0x180001f94
mov rax, qword [r15 + 0x30]
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
jmp 0x180002040
jmp 0x180002050
jmp 0x180002060
xor eax, eax
jmp 0x18000202c