joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14006d5a0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x14006d628
mov edx, 0x40
call fcn.14006e960
test al, al
jne 0x14006d628
mov eax, 0x5a4d
cmp word [rbx], ax
jne 0x14006d628
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x14006d628
lea rdi, [rbx + rax]
mov edx, 0xf8
mov rcx, rdi
call fcn.14006e960
test al, al
jne 0x14006d628
cmp dword [rdi], 0x4550
jne 0x14006d628
mov rcx, rbx
call fcn.14006e150
test al, al
mov ecx, 0x78
mov edx, 0x88
cmovne ecx, edx
lea rax, [rcx + rdi]
mov ecx, dword [rcx + rdi]
test ecx, ecx
je 0x14006d628
test rax, rax
je 0x14006d628
lea rax, [rbx + rcx]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rdi
ret

Function at 0x14006d6b0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x14006d769
mov edx, 0x40
call fcn.14006e960
mov esi, 0x5a4d
test al, al
jne 0x14006d718
cmp word [rbx], si
jne 0x14006d718
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x14006d718
lea rdi, [rbx + rax]
mov edx, 0xf8
mov rcx, rdi
call fcn.14006e960
test al, al
jne 0x14006d718
cmp dword [rdi], 0x4550
jne 0x14006d718
mov edx, 0xf8
mov rcx, rdi
call fcn.14006e960
mov edx, 0x40
mov rcx, rbx
call fcn.14006e960
test al, al
jne 0x14006d769
cmp word [rbx], si
jne 0x14006d769
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x14006d769
lea rdi, [rbx + rax]
mov edx, 0xf8
mov rcx, rdi
call fcn.14006e960
test al, al
jne 0x14006d769
cmp dword [rdi], 0x4550
jne 0x14006d769
mov eax, dword [rdi + 0x54]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
xor eax, eax
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14006d780
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
test rcx, rcx
je 0x14006d877
mov edx, 0x40
call fcn.14006e960
mov esi, 0x5a4d
test al, al
je 0x14006d7b2
xor ebx, ebx
jmp 0x14006d808
cmp word [rdi], si
je 0x14006d7bb
xor ebx, ebx
jmp 0x14006d808
movsxd rax, dword [rdi + 0x3c]
cmp eax, 0x400
jle 0x14006d7ca
xor ebx, ebx
jmp 0x14006d808
lea rbx, [rdi + rax]
mov edx, 0xf8
mov rcx, rbx
call fcn.14006e960
test al, al
je 0x14006d7e3
xor ebx, ebx
jmp 0x14006d808
cmp dword [rbx], 0x4550
je 0x14006d7ef
xor ebx, ebx
jmp 0x14006d808
mov edx, 0xf8
mov rcx, rbx
call fcn.14006e960
test al, al
je 0x14006d804
xor ebx, ebx
jmp 0x14006d808
movzx ebx, word [rbx + 0x18]
mov edx, 0x40
mov rcx, rdi
call fcn.14006e960
test al, al
jne 0x14006d877
cmp word [rdi], si
jne 0x14006d877
movsxd rax, dword [rdi + 0x3c]
cmp eax, 0x400
jg 0x14006d877
lea rsi, [rdi + rax]
mov edx, 0xf8
mov rcx, rsi
call fcn.14006e960
test al, al
jne 0x14006d877
cmp dword [rsi], 0x4550
jne 0x14006d877
mov eax, 0x20b
cmp bx, ax
jne 0x14006d864
mov rax, qword [rsi + 0x30]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov eax, dword [rsi + 0x34]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
xor eax, eax
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x14006d890
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x14006d9ea
mov edx, 0x40
call fcn.14006e960
test al, al
jne 0x14006d9ea
mov esi, 0x5a4d
cmp word [rbx], si
jne 0x14006d9ea
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x14006d9ea
lea rdi, [rbx + rax]
mov edx, 0xf8
mov rcx, rdi
call fcn.14006e960
test al, al
jne 0x14006d9ea
cmp dword [rdi], 0x4550
jne 0x14006d9ea
mov rcx, rbx
call fcn.14006e150
mov edx, 0x40
mov rcx, rbx
test al, al
je 0x14006d97c
call fcn.14006e960
test al, al
jne 0x14006d9d5
cmp word [rbx], si
jne 0x14006d9d5
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x14006d9d5
lea rdi, [rbx + rax]
mov edx, 0xf8
mov rcx, rdi
call fcn.14006e960
test al, al
jne 0x14006d9d5
cmp dword [rdi], 0x4550
jne 0x14006d9d5
mov rcx, rbx
call fcn.14006e150
xor ecx, ecx
test al, al
cmovne rcx, rdi
mov eax, dword [rcx + 0x50]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
call fcn.14006e960
test al, al
jne 0x14006d9d5
cmp word [rbx], si
jne 0x14006d9d5
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x14006d9d5
lea rdi, [rbx + rax]
mov edx, 0xf8
mov rcx, rdi
call fcn.14006e960
test al, al
jne 0x14006d9d5
cmp dword [rdi], 0x4550
jne 0x14006d9d5
mov rcx, rbx
call fcn.14006e150
xor ecx, ecx
test al, al
cmove rcx, rdi
mov eax, dword [rcx + 0x50]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
xor ecx, ecx
mov eax, dword [rcx + 0x50]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
xor eax, eax
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14006db00
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x14006db72
mov edx, 0x40
call fcn.14006e960
test al, al
jne 0x14006db72
mov eax, 0x5a4d
cmp word [rbx], ax
jne 0x14006db72
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x14006db72
lea rdi, [rbx + rax]
mov edx, 0xf8
mov rcx, rdi
call fcn.14006e960
test al, al
jne 0x14006db72
cmp dword [rdi], 0x4550
jne 0x14006db72
mov edx, 0xf8
mov rcx, rdi
call fcn.14006e960
test al, al
jne 0x14006db72
movzx eax, word [rdi + 0x18]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rdi
ret

Function at 0x14006db80
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rdx
mov rbx, rcx
test rcx, rcx
je 0x14006dbb1
test rdx, rdx
je 0x14006dbc3
mov r9d, 0x40
mov r8, rcx
call fcn.14006b540
test al, al
jne 0x14006dbd1
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov edx, 0x40
call fcn.14006e960
test al, al
jne 0x14006dbb1
mov eax, 0x5a4d
cmp word [rbx], ax
jne 0x14006dbb1
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x14006dbb1
lea rdi, [rbx + rax]
test rsi, rsi
je 0x14006dc19
mov r9d, 0xf8
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
call fcn.14006b540
test al, al
jne 0x14006dc2a
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov edx, 0xf8
mov rcx, rdi
call fcn.14006e960
test al, al
jne 0x14006dbb1
cmp dword [rdi], 0x4550
jne 0x14006dbb1
mov rbx, qword [rsp + 0x30]
mov rax, rdi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x14006dc50
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x30], rbx
mov rbx, rcx
mov qword [rsp + 0x38], rsi
movzx esi, dl
mov qword [rsp + 0x20], rdi
test rcx, rcx
je 0x14006dcd8
mov edx, 0x40
call fcn.14006e960
test al, al
jne 0x14006dcd8
mov eax, 0x5a4d
cmp word [rbx], ax
jne 0x14006dcd8
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x14006dcd8
lea rdi, [rbx + rax]
mov edx, 0xf8
mov rcx, rdi
call fcn.14006e960
test al, al
jne 0x14006dcd8
cmp dword [rdi], 0x4550
jne 0x14006dcd8
mov edx, 0xf8
mov rcx, rdi
call fcn.14006e960
test al, al
jne 0x14006dcd8
mov eax, 0x20b
cmp word [rdi + 0x18], ax
jne 0x14006dcd8
movzx edx, sil
mov rcx, rbx
call fcn.14006d2d0
jmp 0x14006dce4
movzx edx, sil
mov rcx, rbx
call fcn.14006d2d0
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
test rax, rax
jne 0x14006dcfd
add rsp, 0x28
ret
mov eax, dword [rax]
add rsp, 0x28
ret
Function at 0x14006def0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rbx, rcx
test rcx, rcx
je 0x14006e09e
test rdx, rdx
je 0x14006e09e
test r8b, r8b
jne 0x14006df25
mov eax, dword [rdx + 8]
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
xor edx, edx
mov qword [rsp + 0x38], rsi
call fcn.14006dc50
mov esi, dword [rdi + 8]
mov r8d, eax
test eax, eax
je 0x14006df4f
mov eax, esi
xor edx, edx
div r8d
mov ecx, esi
sub ecx, edx
cmp ecx, esi
lea esi, [rcx + r8]
cmovae esi, ecx
mov qword [rsp + 0x30], rbp
mov edx, 0x40
mov rcx, rbx
mov qword [rsp + 0x40], r14
call fcn.14006e960
test al, al
jne 0x14006e074
mov r14d, 0x5a4d
cmp word [rbx], r14w
jne 0x14006e074
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x14006e074
lea rbp, [rbx + rax]
mov edx, 0xf8
mov rcx, rbp
call fcn.14006e960
test al, al
jne 0x14006e074
cmp dword [rbp], 0x4550
jne 0x14006e074
mov rcx, rbx
call fcn.14006e150
mov edx, 0x40
mov rcx, rbx
test al, al
je 0x14006e020
call fcn.14006e960
test al, al
jne 0x14006e06d
cmp word [rbx], r14w
jne 0x14006e06d
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x14006e06d
lea rbp, [rbx + rax]
mov edx, 0xf8
mov rcx, rbp
call fcn.14006e960
test al, al
jne 0x14006e06d
cmp dword [rbp], 0x4550
jne 0x14006e06d
mov rcx, rbx
call fcn.14006e150
xor edx, edx
test al, al
cmovne rdx, rbp
mov edx, dword [rdx + 0x50]
jmp 0x14006e076
call fcn.14006e960
test al, al
jne 0x14006e06d
cmp word [rbx], r14w
jne 0x14006e06d
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x14006e06d
lea rbp, [rbx + rax]
mov edx, 0xf8
mov rcx, rbp
call fcn.14006e960
test al, al
jne 0x14006e06d
cmp dword [rbp], 0x4550
jne 0x14006e06d
mov rcx, rbx
call fcn.14006e150
xor edx, edx
test al, al
cmove rdx, rbp
mov edx, dword [rdx + 0x50]
jmp 0x14006e076
xor edx, edx
mov edx, dword [rdx + 0x50]
jmp 0x14006e076
xor edx, edx
mov ecx, dword [rdi + 0xc]
mov r14, qword [rsp + 0x40]
add ecx, esi
mov rbp, qword [rsp + 0x30]
cmp ecx, edx
jbe 0x14006e08c
mov esi, dword [rdi + 8]
mov eax, esi
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x48]
xor eax, eax
add rsp, 0x20
pop rdi
ret

Function at 0x14006e0b0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x14006e135
mov edx, 0x40
call fcn.14006e960
test al, al
jne 0x14006e135
mov eax, 0x5a4d
cmp word [rbx], ax
jne 0x14006e135
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x14006e135
lea rdi, [rbx + rax]
mov edx, 0xf8
mov rcx, rdi
call fcn.14006e960
test al, al
jne 0x14006e135
cmp dword [rdi], 0x4550
jne 0x14006e135
mov rcx, rbx
call fcn.14006e150
test al, al
mov ecx, 0xa0
mov edx, 0xb0
cmovne ecx, edx
cmp dword [rcx + rdi], 0
lea rax, [rcx + rdi]
je 0x14006e135
test rax, rax
je 0x14006e135
mov al, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
xor al, al
add rsp, 0x20
pop rdi
ret
Function at 0x14006e150
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x14006e1cb
mov edx, 0x40
call fcn.14006e960
test al, al
jne 0x14006e1cb
mov eax, 0x5a4d
cmp word [rbx], ax
jne 0x14006e1cb
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x14006e1cb
lea rdi, [rbx + rax]
mov edx, 0xf8
mov rcx, rdi
call fcn.14006e960
test al, al
jne 0x14006e1cb
cmp dword [rdi], 0x4550
jne 0x14006e1cb
mov edx, 0xf8
mov rcx, rdi
call fcn.14006e960
test al, al
jne 0x14006e1cb
mov eax, 0x20b
cmp word [rdi + 0x18], ax
jne 0x14006e1cb
mov al, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
xor al, al
add rsp, 0x20
pop rdi
ret

Function at 0x14006e1e0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rsi, rdx
mov rbx, rcx
test rcx, rcx
je 0x14006e2b5
mov edx, 0x40
call fcn.14006e960
test al, al
jne 0x14006e2b5
mov eax, 0x5a4d
cmp word [rbx], ax
jne 0x14006e2b5
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x14006e2b5
lea rdi, [rbx + rax]
mov ebp, 0xf8
mov edx, ebp
mov rcx, rdi
call fcn.14006e960
test al, al
jne 0x14006e2b5
cmp dword [rdi], 0x4550
jne 0x14006e2b5
mov rcx, rbx
call fcn.14006e150
test al, al
mov edx, 0xe8
cmovne edx, ebp
add rdx, rdi
mov eax, dword [rdx]
test eax, eax
je 0x14006e2b5
test rdx, rdx
je 0x14006e2b5
mov r9d, dword [rdx + 4]
lea rdi, [rbx + rax]
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
call fcn.14006b540
test al, al
je 0x14006e2b5
mov r8d, dword [rdi + 8]
mov rdx, rsi
mov r9d, dword [rdi + 0xc]
add r8, rbx
mov rcx, rbx
call fcn.14006b540
test al, al
je 0x14006e2b5
mov eax, dword [rdi + 8]
cmp dword [rax + rbx], 0x424a5342
jne 0x14006e2b5
mov al, 1
jmp 0x14006e2b7
xor al, al
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x14006e470
Capabilities:
Parse pe header

Disassembly:
push rbp
sub rsp, 0x20
mov qword [rsp + 0x30], rbx
mov ebp, r8d
mov qword [rsp + 0x38], rsi
movzx esi, dl
mov qword [rsp + 0x40], rdi
mov rbx, rcx
test rcx, rcx
je 0x14006e4fd
mov edx, 0x40
call fcn.14006e960
test al, al
jne 0x14006e4fd
mov eax, 0x5a4d
cmp word [rbx], ax
jne 0x14006e4fd
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x14006e4fd
lea rdi, [rbx + rax]
mov edx, 0xf8
mov rcx, rdi
call fcn.14006e960
test al, al
jne 0x14006e4fd
cmp dword [rdi], 0x4550
jne 0x14006e4fd
mov edx, 0xf8
mov rcx, rdi
call fcn.14006e960
test al, al
jne 0x14006e4fd
mov eax, 0x20b
cmp word [rdi + 0x18], ax
jne 0x14006e4fd
movzx edx, sil
mov rcx, rbx
call fcn.14006d2d0
jmp 0x14006e509
movzx edx, sil
mov rcx, rbx
call fcn.14006d2d0
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
test rax, rax
jne 0x14006e523
add rsp, 0x20
pop rbp
ret
mov dword [rax], ebp
mov al, 1
add rsp, 0x20
pop rbp
ret
Function at 0x14006e530
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov rbx, rcx
test rcx, rcx
je 0x14006e5e4
mov edx, 0x40
call fcn.14006e960
mov ebp, 0x5a4d
test al, al
jne 0x14006e59f
cmp word [rbx], bp
jne 0x14006e59f
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x14006e59f
lea rdi, [rbx + rax]
mov edx, 0xf8
mov rcx, rdi
call fcn.14006e960
test al, al
jne 0x14006e59f
cmp dword [rdi], 0x4550
jne 0x14006e59f
mov edx, 0xf8
mov rcx, rdi
call fcn.14006e960
mov edx, 0x40
mov rcx, rbx
call fcn.14006e960
test al, al
jne 0x14006e5e4
cmp word [rbx], bp
jne 0x14006e5e4
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x14006e5e4
lea rdi, [rbx + rax]
mov edx, 0xf8
mov rcx, rdi
call fcn.14006e960
test al, al
jne 0x14006e5e4
cmp dword [rdi], 0x4550
jne 0x14006e5e4
mov dword [rdi + 0x28], esi
mov al, 1
jmp 0x14006e5e6
xor al, al
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x14006e600
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, rdx
mov rdi, rcx
test rcx, rcx
je 0x14006e6e7
mov edx, 0x40
call fcn.14006e960
mov esi, 0x5a4d
test al, al
je 0x14006e63a
xor ebx, ebx
jmp 0x14006e690
cmp word [rdi], si
je 0x14006e643
xor ebx, ebx
jmp 0x14006e690
movsxd rax, dword [rdi + 0x3c]
cmp eax, 0x400
jle 0x14006e652
xor ebx, ebx
jmp 0x14006e690
lea rbx, [rdi + rax]
mov edx, 0xf8
mov rcx, rbx
call fcn.14006e960
test al, al
je 0x14006e66b
xor ebx, ebx
jmp 0x14006e690
cmp dword [rbx], 0x4550
je 0x14006e677
xor ebx, ebx
jmp 0x14006e690
mov edx, 0xf8
mov rcx, rbx
call fcn.14006e960
test al, al
je 0x14006e68c
xor ebx, ebx
jmp 0x14006e690
movzx ebx, word [rbx + 0x18]
mov edx, 0x40
mov rcx, rdi
call fcn.14006e960
test al, al
jne 0x14006e6e7
cmp word [rdi], si
jne 0x14006e6e7
movsxd rax, dword [rdi + 0x3c]
cmp eax, 0x400
jg 0x14006e6e7
lea rsi, [rdi + rax]
mov edx, 0xf8
mov rcx, rsi
call fcn.14006e960
test al, al
jne 0x14006e6e7
cmp dword [rsi], 0x4550
jne 0x14006e6e7
mov eax, 0x20b
cmp bx, ax
jne 0x14006e6e0
mov qword [rsi + 0x30], rbp
mov al, 1
jmp 0x14006e6e9
mov dword [rsi + 0x34], ebp
mov al, 1
jmp 0x14006e6e9
xor al, al
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14006e700
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov rbx, rcx
test rcx, rcx
je 0x14006e839
mov edx, 0x40
call fcn.14006e960
test al, al
jne 0x14006e839
mov ebp, 0x5a4d
cmp word [rbx], bp
jne 0x14006e839
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x14006e839
lea rdi, [rbx + rax]
mov edx, 0xf8
mov rcx, rdi
call fcn.14006e960
test al, al
jne 0x14006e839
cmp dword [rdi], 0x4550
jne 0x14006e839
mov rcx, rbx
call fcn.14006e150
mov edx, 0x40
mov rcx, rbx
test al, al
je 0x14006e7e3
call fcn.14006e960
test al, al
jne 0x14006e830
cmp word [rbx], bp
jne 0x14006e830
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x14006e830
lea rdi, [rbx + rax]
mov edx, 0xf8
mov rcx, rdi
call fcn.14006e960
test al, al
jne 0x14006e830
cmp dword [rdi], 0x4550
jne 0x14006e830
mov rcx, rbx
call fcn.14006e150
xor ecx, ecx
test al, al
mov al, 1
cmovne rcx, rdi
mov dword [rcx + 0x50], esi
jmp 0x14006e83b
call fcn.14006e960
test al, al
jne 0x14006e830
cmp word [rbx], bp
jne 0x14006e830
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x14006e830
lea rdi, [rbx + rax]
mov edx, 0xf8
mov rcx, rdi
call fcn.14006e960
test al, al
jne 0x14006e830
cmp dword [rdi], 0x4550
jne 0x14006e830
mov rcx, rbx
call fcn.14006e150
xor ecx, ecx
test al, al
mov al, 1
cmove rcx, rdi
mov dword [rcx + 0x50], esi
jmp 0x14006e83b
xor ecx, ecx
mov al, 1
mov dword [rcx + 0x50], esi
jmp 0x14006e83b
xor al, al
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140077e00
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x420
mov rax, qword [0x1400fe3f8]
xor rax, rsp
mov qword [rsp + 0x410], rax
cmp qword [rcx + 0x28], 0
mov rbx, rcx
jne 0x140077e2c
xor al, al
jmp 0x140077fba
xor r9d, r9d
lea r10, [rsp]
mov dword [rsp + 0x400], r9d
mov r8d, r9d
nop
mov eax, r8d
lea r10, [r10 + 4]
mov ecx, r8d
shr ecx, 1
mov edx, ecx
xor edx, 0xedb88320
and al, 1
cmove edx, ecx
mov eax, edx
shr eax, 1
mov ecx, eax
xor ecx, 0xedb88320
and dl, 1
cmove ecx, eax
mov eax, ecx
shr eax, 1
mov edx, eax
xor edx, 0xedb88320
and cl, 1
cmove edx, eax
mov eax, edx
shr eax, 1
mov ecx, eax
xor ecx, 0xedb88320
and dl, 1
cmove ecx, eax
mov eax, ecx
shr eax, 1
mov edx, eax
xor edx, 0xedb88320
and cl, 1
cmove edx, eax
mov eax, edx
shr eax, 1
mov ecx, eax
xor ecx, 0xedb88320
and dl, 1
cmove ecx, eax
mov eax, ecx
shr eax, 1
mov edx, eax
xor edx, 0xedb88320
and cl, 1
cmove edx, eax
mov ecx, edx
shr ecx, 1
mov eax, ecx
xor eax, 0xedb88320
and dl, 1
cmove eax, ecx
inc r8d
mov dword [r10 - 4], eax
cmp r8d, 0x100
jb 0x140077e40
mov r11, qword [rbx + 0x28]
mov rax, qword [rbx + 0x20]
test r11, r11
je 0x140077f3b
test rax, rax
je 0x140077f3b
mov r8d, dword [rsp + 0x400]
mov r10, r9
not r8d
nop word [rax + rax]
movzx edx, byte [r11 + r10]
mov ecx, r8d
xor rdx, rcx
shr r8d, 8
movzx ecx, dl
inc r10
xor r8d, dword [rsp + rcx*4]
cmp r10, rax
jb 0x140077f10
not r8d
mov dword [rsp + 0x400], r8d
jmp 0x140077f43
mov r8d, dword [rsp + 0x400]
mov r10, qword [rbx + 0x30]
test r10, r10
je 0x140077f83
test rax, rax
je 0x140077fb4
not r8d
nop dword [rax]
nop dword [rax + rax]
movzx edx, byte [r9 + r10]
mov ecx, r8d
xor rdx, rcx
shr r8d, 8
movzx ecx, dl
inc r9
xor r8d, dword [rsp + rcx*4]
cmp r9, rax
jb 0x140077f60
not r8d
jmp 0x140077fb4
test rax, rax
je 0x140077fb4
nop dword [rax + rax]
not r8d
mov ecx, r8d
shr r8d, 8
not ecx
movzx edx, cl
xor r8d, dword [rsp + rdx*4]
not r8d
mov dword [rsp + 0x400], r8d
sub rax, 1
jne 0x140077f90
mov dword [rbx + 0x38], r8d
mov al, 1
mov rcx, qword [rsp + 0x410]
xor rcx, rsp
call fcn.14009c8a0
add rsp, 0x420
pop rbx
ret

Function at 0x140093094
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
lea r9, [rdx + rdx]
movabs r8, 0xcbf29ce484222325
xor edx, edx
test r9, r9
je 0x14007e2ca
movzx eax, byte [rdx + rcx]
movabs r10, 0x100000001b3
xor r8, rax
inc rdx
imul r8, r10
cmp rdx, r9
jb 0x14007e2ad
mov rax, r8
ret
sub r8, rdx
mov rcx, rdx
sar r8, 1
mov rdx, r8
jmp 0x14007e298

Function at 0x1400b544c
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1400b523c
Function at 0x1400bb3c0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov rsi, rcx
test rcx, rcx
jne 0x1400bb3f2
call fcn.1400a3920
mov dword [rax], 0x16
call fcn.1400a3528
jmp 0x1400bb511
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x1400bb511
mov eax, dword [rcx + 0x14]
shr eax, 0xc
test al, 1
jne 0x1400bb511
mov eax, dword [rcx + 0x14]
shr eax, 1
test al, 1
je 0x1400bb421
lock or dword [rcx + 0x14], 0x10
jmp 0x1400bb511
lock or dword [rcx + 0x14], 1
mov eax, dword [rcx + 0x14]
test eax, 0x4c0
jne 0x1400bb435
call fcn.1400bb92c
mov rdi, qword [rsi + 8]
mov rcx, rsi
mov ebx, dword [rsi + 0x20]
mov qword [rsi], rdi
call fcn.1400baa2c
mov r8d, ebx
mov rdx, rdi
mov ecx, eax
call fcn.1400bff40
mov dword [rsi + 0x10], eax
lea ecx, [rax + 1]
cmp ecx, 1
jbe 0x1400bb4ff
mov eax, dword [rsi + 0x14]
or edi, 0xffffffff
test al, 6
jne 0x1400bb4ca
mov rcx, rsi
call fcn.1400baa2c
cmp eax, edi
je 0x1400bb4b5
mov rcx, rsi
call fcn.1400baa2c
cmp eax, 0xfffffffe
je 0x1400bb4b5
mov rcx, rsi
call fcn.1400baa2c
movsxd rbx, eax
lea r14, [0x140383a90]
mov rcx, rsi
sar rbx, 6
call fcn.1400baa2c
and eax, 0x3f
lea rcx, [rax + rax*8]
mov rax, qword [r14 + rbx*8]
lea rdx, [rax + rcx*8]
jmp 0x1400bb4bc
lea rdx, [0x1400fe7c0]
mov al, byte [rdx + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x1400bb4ca
lock or dword [rsi + 0x14], 0x20
cmp dword [rsi + 0x20], 0x200
jne 0x1400bb4ee
mov eax, dword [rsi + 0x14]
shr eax, 6
test al, 1
je 0x1400bb4ee
mov eax, dword [rsi + 0x14]
shr eax, 8
test al, 1
jne 0x1400bb4ee
mov dword [rsi + 0x20], 0x1000
mov rax, qword [rsi]
add dword [rsi + 0x10], edi
movzx edi, byte [rax]
inc rax
mov qword [rsi], rax
jmp 0x1400bb514
neg eax
sbb eax, eax
and eax, 8
add eax, 8
lock or dword [rsi + 0x14], eax
and dword [rsi + 0x10], 0
or edi, 0xffffffff
mov rbx, qword [rsp + 0x30]
mov eax, edi
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop r14
ret