joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1503a8528
Capabilities:
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x50
mov rbx, r8
mov rsi, rdx
mov rbp, rcx
lea rdx, [rax - 0x28]
mov rcx, r8
call fcn.15038385c
movsxd r9, dword [rax + 8]
imul r14, r9, 0x1000193
imul rax, qword [rax], 0x100011b
xor r14, rax
mov r9, r14
mov r8, rbx
lea rdx, [rsp + 0x20]
mov rcx, rbp
call fcn.1503ac688
mov rax, qword [rsp + 0x28]
test rax, rax
je 0x1503a8598
mov qword [rsi], rax
mov byte [rsi + 8], 0
jmp 0x1503a871a
movabs rax, 0xaaaaaaaaaaaaaaa
cmp qword [rbp + 0x10], rax
je 0x1503a873c
lea r12, [rbp + 8]
mov qword [rsp + 0x30], r12
and qword [rsp + 0x38], 0
mov ecx, 0x18
call fcn.15040af44
mov rdi, rax
mov qword [rsp + 0x38], rax
mov rcx, qword [rbx]
mov qword [rax + 0x10], rcx
mov rcx, qword [rbp + 0x10]
add rcx, 1
xorps xmm0, xmm0
js 0x1503a85e8
cvtsi2ss xmm0, rcx
jmp 0x1503a85fd
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
mov rbx, qword [rbp + 0x38]
xorps xmm2, xmm2
test rbx, rbx
js 0x1503a8610
cvtsi2ss xmm2, rbx
jmp 0x1503a8628
mov rcx, rbx
shr rcx, 1
mov rax, rbx
and eax, 1
or rcx, rax
cvtsi2ss xmm2, rcx
addss xmm2, xmm2
movaps xmm1, xmm0
divss xmm1, xmm2
comiss xmm1, dword [rbp]
seta al
test al, al
je 0x1503a86c3
divss xmm0, dword [rbp]
call fcn.1504413bc
xor ecx, ecx
movss xmm1, dword [0x1502703c8]
comiss xmm0, xmm1
jb 0x1503a866d
subss xmm0, xmm1
comiss xmm0, xmm1
jae 0x1503a866d
movabs rax, 0x8000000000000000
mov rcx, rax
cvttss2si rax, xmm0
add rax, rcx
mov ecx, 8
cmp rax, rcx
cmova rcx, rax
cmp rbx, rcx
jae 0x1503a869b
cmp rbx, 0x200
jae 0x1503a8698
shl rbx, 3
cmp rbx, rcx
jae 0x1503a869b
mov rbx, rcx
mov rdx, rbx
mov rcx, rbp
call fcn.1503a9204
mov r9, r14
lea r8, [rdi + 0x10]
lea rdx, [rsp + 0x20]
mov rcx, rbp
call fcn.1503ac688
movups xmm0, xmmword [rax]
movdqu xmmword [rsp + 0x20], xmm0
mov rdx, qword [rsp + 0x20]
mov r8, qword [rdx + 8]
inc qword [rbp + 0x10]
mov qword [rdi], rdx
mov qword [rdi + 8], r8
mov qword [r8], rdi
mov qword [rdx + 8], rdi
mov rcx, qword [rbp + 0x18]
mov rax, qword [rbp + 0x30]
and rax, r14
add rax, rax
mov r9, qword [rcx + rax*8]
cmp r9, qword [r12]
jne 0x1503a86fc
mov qword [rcx + rax*8], rdi
jmp 0x1503a870e
cmp r9, rdx
jne 0x1503a8707
mov qword [rcx + rax*8], rdi
jmp 0x1503a8713
cmp qword [rcx + rax*8 + 8], r8
jne 0x1503a8713
mov qword [rcx + rax*8 + 8], rdi
mov qword [rsi], rdi
mov byte [rsi + 8], 1
mov rax, rsi
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
lea rcx, [0x1501755e8]
call fcn.15040822c
int3
Function at 0x1503a874c
Capabilities:
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x60
mov rbx, r8
mov rsi, rdx
mov rbp, rcx
lea rdx, [rax - 0x38]
mov rcx, r8
call fcn.150383584
mov rcx, rax
xor edx, edx
mov r10, qword [rax + 8]
mov r11, qword [rax + 0x10]
add r11, r10
jmp 0x1503a879e
lea rdx, [rdx + rdx*4]
movsx rax, byte [r10]
add rdx, rax
inc r10
cmp r10, r11
jb 0x1503a8790
imul r14, qword [rcx], 0x1000193
xor r14, rdx
mov r9, r14
mov r8, rbx
lea rdx, [rsp + 0x20]
mov rcx, rbp
call fcn.1503ac738
mov rax, qword [rsp + 0x28]
test rax, rax
je 0x1503a87d6
mov qword [rsi], rax
mov byte [rsi + 8], 0
jmp 0x1503a8958
movabs rax, 0xaaaaaaaaaaaaaaa
cmp qword [rbp + 0x10], rax
je 0x1503a897a
lea r12, [rbp + 8]
mov qword [rsp + 0x30], r12
and qword [rsp + 0x38], 0
mov ecx, 0x18
call fcn.15040af44
mov rdi, rax
mov qword [rsp + 0x38], rax
mov rcx, qword [rbx]
mov qword [rax + 0x10], rcx
mov rcx, qword [rbp + 0x10]
add rcx, 1
xorps xmm0, xmm0
js 0x1503a8826
cvtsi2ss xmm0, rcx
jmp 0x1503a883b
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
mov rbx, qword [rbp + 0x38]
xorps xmm2, xmm2
test rbx, rbx
js 0x1503a884e
cvtsi2ss xmm2, rbx
jmp 0x1503a8866
mov rcx, rbx
shr rcx, 1
mov rax, rbx
and eax, 1
or rcx, rax
cvtsi2ss xmm2, rcx
addss xmm2, xmm2
movaps xmm1, xmm0
divss xmm1, xmm2
comiss xmm1, dword [rbp]
seta al
test al, al
je 0x1503a8901
divss xmm0, dword [rbp]
call fcn.1504413bc
xor ecx, ecx
movss xmm1, dword [0x1502703c8]
comiss xmm0, xmm1
jb 0x1503a88ab
subss xmm0, xmm1
comiss xmm0, xmm1
jae 0x1503a88ab
movabs rax, 0x8000000000000000
mov rcx, rax
cvttss2si rax, xmm0
add rax, rcx
mov ecx, 8
cmp rax, rcx
cmova rcx, rax
cmp rbx, rcx
jae 0x1503a88d9
cmp rbx, 0x200
jae 0x1503a88d6
shl rbx, 3
cmp rbx, rcx
jae 0x1503a88d9
mov rbx, rcx
mov rdx, rbx
mov rcx, rbp
call fcn.1503a9428
mov r9, r14
lea r8, [rdi + 0x10]
lea rdx, [rsp + 0x20]
mov rcx, rbp
call fcn.1503ac738
movups xmm0, xmmword [rax]
movdqu xmmword [rsp + 0x20], xmm0
mov rdx, qword [rsp + 0x20]
mov r8, qword [rdx + 8]
inc qword [rbp + 0x10]
mov qword [rdi], rdx
mov qword [rdi + 8], r8
mov qword [r8], rdi
mov qword [rdx + 8], rdi
mov rcx, qword [rbp + 0x18]
mov rax, qword [rbp + 0x30]
and rax, r14
add rax, rax
mov r9, qword [rcx + rax*8]
cmp r9, qword [r12]
jne 0x1503a893a
mov qword [rcx + rax*8], rdi
jmp 0x1503a894c
cmp r9, rdx
jne 0x1503a8945
mov qword [rcx + rax*8], rdi
jmp 0x1503a8951
cmp qword [rcx + rax*8 + 8], r8
jne 0x1503a8951
mov qword [rcx + rax*8 + 8], rdi
mov qword [rsi], rdi
mov byte [rsi + 8], 1
mov rax, rsi
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
lea rcx, [0x1501755e8]
call fcn.15040822c
int3
Function at 0x1503a8d80
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov r13, rcx
bsr rcx, rax
mov eax, 1
shl rax, cl
cmp rdx, rax
ja 0x1503a8f7f
mov rbp, qword [r13 + 8]
lea rax, [rdx - 1]
or rax, 1
lea rdi, [r13 + 0x18]
bsr rcx, rax
mov ebx, 1
mov r8, rbp
inc ecx
shl rbx, cl
mov rcx, rdi
lea rdx, [rbx + rbx]
call fcn.1502ae44c
lea rax, [rbx - 1]
mov qword [r13 + 0x38], rbx
mov qword [r13 + 0x30], rax
mov rbx, qword [r13 + 8]
mov rbx, qword [rbx]
mov rsi, rbx
cmp rbx, rbp
je 0x1503a8f62
mov rcx, qword [rbx + 0x18]
xor edx, edx
mov r8, qword [rbx + 0x20]
mov rsi, qword [rsi]
add r8, rcx
jmp 0x1503a8e2a
movsx rax, byte [rcx]
lea rdx, [rdx + rdx*4]
add rdx, rax
inc rcx
cmp rcx, r8
jb 0x1503a8e1c
mov r12, qword [rbx + 0x10]
mov r15, qword [rdi]
imul r14, r12, 0x1000193
xor r14, rdx
and r14, qword [r13 + 0x30]
add r14, r14
cmp qword [r15 + r14*8], rbp
jne 0x1503a8e5b
mov qword [r15 + r14*8], rbx
mov qword [r15 + r14*8 + 8], rbx
jmp 0x1503a8f56
mov rdi, qword [r15 + r14*8 + 8]
cmp r12, qword [rdi + 0x10]
jne 0x1503a8ec8
mov r8, qword [rbx + 0x20]
movups xmm2, xmmword [rdi + 0x18]
movups xmm3, xmmword [rbx + 0x18]
cmp r8, qword [rdi + 0x20]
jne 0x1503a8ec8
movq rcx, xmm3
movq rdx, xmm2
cmp rcx, rdx
je 0x1503a8e95
test r8, r8
je 0x1503a8e95
call fcn.15040e0e0
test eax, eax
jne 0x1503a8ec8
mov r8, qword [rdi]
cmp r8, rbx
je 0x1503a8ebe
mov rdx, qword [rbx + 8]
mov qword [rdx], rsi
mov rcx, qword [rsi + 8]
mov qword [rcx], r8
mov rax, qword [r8 + 8]
mov qword [rax], rbx
mov qword [r8 + 8], rcx
mov qword [rsi + 8], rdx
mov qword [rbx + 8], rax
mov qword [r15 + r14*8 + 8], rbx
jmp 0x1503a8f52
cmp qword [r15 + r14*8], rdi
je 0x1503a8f2d
mov rdi, qword [rdi + 8]
cmp r12, qword [rdi + 0x10]
jne 0x1503a8ec8
mov r8, qword [rbx + 0x20]
movups xmm2, xmmword [rdi + 0x18]
movups xmm3, xmmword [rbx + 0x18]
cmp r8, qword [rdi + 0x20]
jne 0x1503a8ec8
movq rcx, xmm3
movq rdx, xmm2
cmp rcx, rdx
je 0x1503a8f07
test r8, r8
je 0x1503a8f07
call fcn.15040e0e0
test eax, eax
jne 0x1503a8ec8
mov r8, qword [rdi]
mov rdx, qword [rbx + 8]
mov qword [rdx], rsi
mov rcx, qword [rsi + 8]
mov qword [rcx], r8
mov rax, qword [r8 + 8]
mov qword [rax], rbx
mov qword [r8 + 8], rcx
mov qword [rsi + 8], rdx
mov qword [rbx + 8], rax
jmp 0x1503a8f52
mov rdx, qword [rbx + 8]
mov qword [rdx], rsi
mov rcx, qword [rsi + 8]
mov qword [rcx], rdi
mov rax, qword [rdi + 8]
mov qword [rax], rbx
mov qword [rdi + 8], rcx
mov qword [rsi + 8], rdx
mov qword [rbx + 8], rax
mov qword [r15 + r14*8], rbx
lea rdi, [r13 + 0x18]
mov rbx, rsi
cmp rsi, rbp
jne 0x1503a8e0a
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
lea rcx, [0x150175640]
call fcn.15040822c
int3
Function at 0x1503a9204
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x78
mov rsi, rcx
movabs rax, 0xfffffffffffffff
bsr rcx, rax
mov ebx, 1
mov eax, ebx
shl rax, cl
cmp rdx, rax
ja 0x1503a941a
lea rax, [rdx - 1]
or rax, rbx
bsr rcx, rax
inc ecx
shl rbx, cl
mov r12, qword [rsi + 8]
mov qword [rsp + 0xd0], r12
lea r15, [rsi + 0x18]
mov qword [rsp + 0xc8], r15
lea rdx, [rbx + rbx]
mov r8, r12
mov rcx, r15
call fcn.1502ae44c
lea rax, [rbx - 1]
mov qword [rsi + 0x30], rax
mov qword [rsi + 0x38], rbx
mov qword [rsp + 0xd8], rsi
mov rdi, qword [rsi + 8]
mov rdi, qword [rdi]
cmp rdi, r12
je 0x1503a93db
mov rbx, rdi
mov rdi, qword [rdi]
lea r13, [rbx + 0x10]
lea rdx, [rsp + 0x20]
mov rcx, r13
call fcn.15038385c
movsxd rcx, dword [rax + 8]
imul r14, rcx, 0x1000193
imul rax, qword [rax], 0x100011b
xor r14, rax
and r14, qword [rsi + 0x30]
add r14, r14
mov rbp, qword [r15]
cmp qword [rbp + r14*8], r12
jne 0x1503a92e4
mov qword [rbp + r14*8], rbx
mov qword [rbp + r14*8 + 8], rbx
jmp 0x1503a93cf
mov rsi, qword [rbp + r14*8 + 8]
lea rcx, [rsi + 0x10]
lea rdx, [rsp + 0x30]
call fcn.15038385c
mov r15, rax
lea rdx, [rsp + 0x40]
mov rcx, r13
call fcn.15038385c
mov rcx, qword [r15]
cmp qword [rax], rcx
jne 0x1503a9348
mov ecx, dword [r15 + 8]
cmp dword [rax + 8], ecx
jne 0x1503a9348
mov r8, qword [rsi]
cmp r8, rbx
je 0x1503a9341
mov rdx, qword [rbx + 8]
mov qword [rdx], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], r8
mov rax, qword [r8 + 8]
mov qword [rax], rbx
mov qword [r8 + 8], rcx
mov qword [rdi + 8], rdx
mov qword [rbx + 8], rax
mov qword [rbp + r14*8 + 8], rbx
jmp 0x1503a93bf
mov r15, rsi
cmp qword [rbp + r14*8], rsi
je 0x1503a9399
mov rsi, qword [rsi + 8]
mov r15, rsi
lea rcx, [rsi + 0x10]
lea rdx, [rsp + 0x50]
call fcn.15038385c
mov r12, rax
lea rdx, [rsp + 0x60]
mov rcx, r13
call fcn.15038385c
mov rcx, qword [r12]
cmp qword [rax], rcx
jne 0x1503a938a
mov ecx, dword [r12 + 8]
cmp dword [rax + 8], ecx
je 0x1503a93ec
cmp qword [rbp + r14*8], rsi
jne 0x1503a9352
mov r12, qword [rsp + 0xd0]
mov rdx, qword [rbx + 8]
mov qword [rdx], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], r15
mov rax, qword [r15 + 8]
mov qword [rax], rbx
mov qword [r15 + 8], rcx
mov qword [rdi + 8], rdx
mov qword [rbx + 8], rax
mov qword [rbp + r14*8], rbx
mov rsi, qword [rsp + 0xc0]
mov r15, qword [rsp + 0xc8]
mov rbx, rdi
cmp rdi, r12
jne 0x1503a929b
add rsp, 0x78
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov r8, qword [rsi]
mov rdx, qword [rbx + 8]
mov qword [rdx], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], r8
mov rax, qword [r8 + 8]
mov qword [rax], rbx
mov qword [r8 + 8], rcx
mov qword [rdi + 8], rdx
mov qword [rbx + 8], rax
mov r12, qword [rsp + 0xd0]
jmp 0x1503a93bf
lea rcx, [0x150175640]
call fcn.15040822c
int3
Function at 0x1503c5938
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r12, r8
mov rsi, rdx
mov r14, rcx
xor edx, edx
movabs r15, 0xcbf29ce484222325
movzx eax, byte [rdx + r8]
xor r15, rax
movabs rcx, 0x100000001b3
imul r15, rcx
inc rdx
cmp rdx, 8
jb 0x1503c5969
mov rax, qword [r14 + 0x30]
and rax, r15
add rax, rax
mov rcx, qword [r14 + 0x18]
mov rbx, qword [rcx + rax*8 + 8]
lea r13, [r14 + 8]
mov rbp, qword [r13]
cmp rbx, rbp
jne 0x1503c59ff
mov rbx, rbp
movabs rax, 0x7ffffffffffffff
cmp qword [r14 + 0x10], rax
je 0x1503c5b4a
mov qword [rsp + 0x20], r13
and qword [rsp + 0x28], 0
mov ecx, 0x20
call fcn.15040af44
mov rdi, rax
mov qword [rsp + 0x28], rax
mov rcx, qword [r12]
mov qword [rax + 0x10], rcx
xor r12d, r12d
mov qword [rax + 0x18], r12
mov rcx, qword [r14 + 0x10]
add rcx, 1
xorps xmm0, xmm0
js 0x1503c5a38
cvtsi2ss xmm0, rcx
jmp 0x1503c5a4d
mov rdx, qword [rcx + rax*8]
mov rax, qword [r8]
jmp 0x1503c5a11
cmp rbx, rdx
je 0x1503c5a31
mov rbx, qword [rbx + 8]
cmp rax, qword [rbx + 0x10]
jne 0x1503c5a08
mov rbp, qword [rbx]
mov rax, rbx
mov rbx, rbp
test rax, rax
je 0x1503c59ab
mov qword [rsi], rax
mov byte [rsi + 8], 0
jmp 0x1503c5b2a
mov rbp, rbx
xor eax, eax
jmp 0x1503c5a20
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
mov rcx, qword [r14 + 0x38]
xorps xmm1, xmm1
test rcx, rcx
js 0x1503c5a60
cvtsi2ss xmm1, rcx
jmp 0x1503c5a75
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
divss xmm0, xmm1
comiss xmm0, dword [r14]
seta al
test al, al
je 0x1503c5ad1
mov rcx, r14
call fcn.15032be84
mov rcx, qword [r14 + 0x30]
and rcx, r15
add rcx, rcx
mov rdx, qword [r14 + 0x18]
mov rax, qword [rdx + rcx*8 + 8]
mov rbx, qword [r13]
cmp rax, rbx
je 0x1503c5ac7
mov rdx, qword [rdx + rcx*8]
mov rcx, qword [rdi + 0x10]
jmp 0x1503c5abe
mov rbx, rax
cmp rax, rdx
je 0x1503c5b05
mov rax, qword [rax + 8]
cmp rcx, qword [rax + 0x10]
jne 0x1503c5ab2
mov rbx, qword [rax]
mov qword [rsp + 0x20], rbx
mov rbp, qword [rsp + 0x20]
mov rdx, qword [rbx + 8]
inc qword [r14 + 0x10]
mov qword [rdi], rbp
mov qword [rdi + 8], rdx
mov qword [rdx], rdi
mov qword [rbx + 8], rdi
mov rcx, qword [r14 + 0x18]
mov rax, qword [r14 + 0x30]
and rax, r15
add rax, rax
mov r8, qword [rcx + rax*8]
cmp r8, qword [r13]
jne 0x1503c5b0c
mov qword [rcx + rax*8], rdi
jmp 0x1503c5b1e
mov qword [rsp + 0x20], rax
jmp 0x1503c5acc
cmp r8, rbp
jne 0x1503c5b17
mov qword [rcx + rax*8], rdi
jmp 0x1503c5b23
cmp qword [rcx + rax*8 + 8], rdx
jne 0x1503c5b23
mov qword [rcx + rax*8 + 8], rdi
mov qword [rsi], rdi
mov byte [rsi + 8], 1
mov rax, rsi
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
lea rcx, [0x1501755e8]
call fcn.15040822c
int3
Function at 0x1503d0c9c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
lea rbp, [r8 - 1]
mov rsi, rcx
sar rbp, 1
mov r12, r9
mov r14, r8
mov rdi, rdx
mov r15, rdx
mov rcx, rdx
cmp rdx, rbp
jge 0x1503d0d08
lea rbx, [rcx + rcx]
mov r8, qword [rsi + rbx*8 + 8]
mov rdx, qword [rsi + rbx*8 + 0x10]
call fcn.1503cd7b8
movzx r11d, al
lea rcx, [rbx + 1]
xor r11, 1
add rcx, r11
mov rax, qword [rsi + rcx*8]
mov qword [rsi + rdi*8], rax
mov rdi, rcx
cmp rcx, rbp
jl 0x1503d0cd6
cmp rcx, rbp
jne 0x1503d0d20
test r14b, 1
jne 0x1503d0d20
mov rax, qword [rsi + r14*8 - 8]
mov qword [rsi + rdi*8], rax
lea rdi, [r14 - 1]
cmp r15, rdi
jge 0x1503d0d4d
mov r8, qword [r12]
lea r11, [rdi - 1]
sar r11, 1
mov rdx, qword [rsi + r11*8]
call fcn.1503cd7b8
test al, al
je 0x1503d0d4d
mov rax, qword [rsi + r11*8]
mov qword [rsi + rdi*8], rax
mov rdi, r11
cmp r15, r11
jl 0x1503d0d25
mov rax, qword [r12]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov qword [rsi + rdi*8], rax
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret

Function at 0x1503d3c1c
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
and dword [rsp + 0x40], 0
lea r9, [rsp + 0x40]
mov r8d, 0x40
mov rbx, rdx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r8, rbx
mov edx, 0x90
mov rcx, rdi
call fcn.15040dca0
mov r8d, dword [rsp + 0x40]
lea r9, [rsp + 0x40]
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8, rbx
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1503d3c88
Capabilities:
Allocate or change rwx memory

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
push rdi
sub rsp, 0x20
and dword [rax + 0x20], 0
lea r9, [rax + 0x20]
mov rsi, r8
mov rbx, rdx
mov rdx, rsi
mov r8d, 0x40
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r8, rsi
mov rdx, rbx
mov rcx, rdi
call fcn.15040d600
mov r8d, dword [rsp + 0x48]
lea r9, [rsp + 0x48]
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8, rsi
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1503d48f8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rdi, rcx
mov ebx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
movzx edx, bx
mov r8d, 0xa
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rbx, rax
test rax, rax
jne 0x1503d494b
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
and qword [rdi + 0x10], 0
and qword [rdi + 0x10], 0
mov qword [rdi + 0x18], reloc.OLEAUT32.dll_SafeArrayDestroy
mov byte [rdi], 0
jmp 0x1503d4992
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
test rax, rax
je 0x1503d492e
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_LockResource]
xorps xmm0, xmm0
mov r8d, ebx
movups xmmword [rdi], xmm0
and qword [rdi + 0x10], 0
mov rdx, rax
and qword [rdi + 0x18], 0
mov rcx, rdi
call fcn.1502a75e8
mov rbx, qword [rsp + 0x40]
mov rax, rdi
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x1503d4ed0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x150012098]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbx, rcx
mov qword [rsp + 0x28], rcx
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
xorps xmm0, xmm0
test eax, eax
je 0x1503d4f76
movups xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [0x150270450]
movdqu xmmword [rsp + 0x40], xmm1
mov byte [rsp + 0x30], 0
mov ecx, 1
call qword [sym.imp.USER32.dll_GetClipboardData]
mov rdi, rax
test rax, rax
je 0x1503d4f5d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
test rax, rax
je 0x1503d4f5d
or r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x1503d4f3d
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.1502a9928
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
call qword [sym.imp.USER32.dll_CloseClipboard]
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rsp + 0x40]
movups xmmword [rbx + 0x10], xmm1
jmp 0x1503d4f8e
movups xmmword [rbx], xmm0
and qword [rbx + 0x10], 0
and qword [rbx + 0x10], 0
mov qword [rbx + 0x18], reloc.OLEAUT32.dll_SafeArrayDestroy
mov byte [rbx], 0
mov rax, rbx
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.15040aca0
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
Function at 0x1503d5444
Capabilities:
Get system firmware table

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov qword [rax + 8], rcx
push rdi
sub rsp, 0x30
mov rbx, rcx
xor eax, eax
mov dword [rsp + 0x20], eax
mov qword [rcx], rax
mov qword [rcx + 8], rax
mov qword [rcx + 0x10], rax
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0x52534d42
call qword [sym.imp.KERNEL32.dll_GetSystemFirmwareTable]
mov ebp, eax
mov edi, eax
mov rsi, qword [rbx + 8]
mov rdx, qword [rbx]
mov rcx, rsi
sub rcx, rdx
cmp rbp, rcx
jae 0x1503d54ab
lea rcx, [rdx + rbp]
mov qword [rbx + 8], rcx
jmp 0x1503d54de
jbe 0x1503d54de
mov rax, qword [rbx + 0x10]
sub rax, rdx
cmp rdi, rax
jbe 0x1503d54c6
mov rdx, rdi
mov rcx, rbx
call fcn.1503328f0
jmp 0x1503d54de
sub rdi, rcx
mov r8, rdi
xor edx, edx
mov rcx, rsi
call fcn.15040dca0
lea rax, [rdi + rsi]
mov qword [rbx + 8], rax
mov r9d, ebp
mov r8, qword [rbx]
xor edx, edx
mov ecx, 0x52534d42
call qword [sym.imp.KERNEL32.dll_GetSystemFirmwareTable]
mov rax, rbx
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret

Function at 0x1503d6410
Capabilities:
Encode data using xor

Disassembly:
cmp qword [rcx + 0x18], 0x10
mov r8, qword [rcx + 0x10]
jb 0x1503d641e
mov rcx, qword [rcx]
xor edx, edx
mov r9d, edx
test r8, r8
je 0x1503d6448
mov eax, edx
movsx eax, byte [rax + rcx]
inc r9d
add eax, edx
imul edx, eax, 0x401
mov eax, edx
shr eax, 6
xor edx, eax
mov eax, r9d
cmp rax, r8
jb 0x1503d642a
lea eax, [rdx + rdx*8]
mov ecx, eax
shr ecx, 0xb
xor ecx, eax
imul eax, ecx, 0x8001
ret
Function at 0x1503eb874
Capabilities:
Hash data using tiger

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
xor qword [r8], r9
lea rdi, [0x150163110]
mov r11, qword [r8]
mov rbx, rdx
mov r10, rcx
mov rax, r11
shr rax, 0x30
movzx r9d, al
mov rax, r11
shr rax, 0x20
movzx r8d, al
mov rax, r11
shr rax, 0x10
mov rdx, qword [rdi + r9*8 + 0x1800]
movzx ecx, al
xor rdx, qword [rdi + r8*8 + 0x1000]
movzx eax, r11b
xor rdx, qword [rdi + rcx*8 + 0x800]
xor rdx, qword [rdi + rax*8]
mov rax, r11
sub qword [r10], rdx
shr rax, 0x28
movzx edx, al
mov rax, r11
shr rax, 0x18
movzx ecx, al
mov rax, r11
shr rax, 8
mov r8, qword [rdi + rdx*8 + 0x800]
shr r11, 0x38
xor r8, qword [rdi + rcx*8 + 0x1000]
movzx ecx, al
xor r8, qword [rdi + rcx*8 + 0x1800]
xor r8, qword [rdi + r11*8]
add qword [rbx], r8
mov ecx, dword [rsp + 0x28]
mov rax, qword [rbx]
cmp ecx, 5
je 0x1503eb937
cmp ecx, 7
je 0x1503eb931
cmp ecx, 9
jne 0x1503eb93e
lea rax, [rax + rax*8]
jmp 0x1503eb93b
imul rax, rax, 7
jmp 0x1503eb93b
lea rax, [rax + rax*4]
mov qword [rbx], rax
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
ret

Function at 0x1503eba30
Capabilities:
Hash data using tiger

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
mov r14, rcx
movabs rcx, 0xa5a5a5a5a5a5a5a5
mov rax, qword [r14 + 0x38]
mov r9, qword [r14]
xor rax, rcx
mov rbx, qword [r14 + 0x10]
sub r9, rax
mov r8, qword [r14 + 0x18]
mov rsi, r9
xor rsi, qword [r14 + 8]
mov r11, qword [r14 + 0x28]
add rbx, rsi
mov rdx, qword [r14 + 0x30]
mov rax, rsi
not rax
shl rax, 0x13
xor rax, rbx
sub r8, rax
mov rdi, r8
xor rdi, qword [r14 + 0x20]
mov rax, rdi
add r11, rdi
not rax
shr rax, 0x17
xor rax, r11
sub rdx, rax
mov r10, rdx
xor r10, qword [r14 + 0x38]
mov rcx, r10
not rcx
shl rcx, 0x13
lea rax, [r10 + r9]
xor rcx, rax
mov qword [r14], rax
sub rsi, rcx
movabs rcx, 0x123456789abcdef
mov qword [r14 + 8], rsi
xor rsi, rbx
mov rbx, qword [rsp + 8]
mov qword [r14 + 0x10], rsi
lea rax, [rsi + r8]
not rsi
mov qword [r14 + 0x18], rax
shr rsi, 0x17
xor rsi, rax
sub rdi, rsi
mov rsi, qword [rsp + 0x10]
mov qword [r14 + 0x20], rdi
xor rdi, r11
mov qword [r14 + 0x28], rdi
lea rax, [rdi + rdx]
mov rdi, qword [rsp + 0x18]
mov qword [r14 + 0x30], rax
xor rax, rcx
sub r10, rax
mov qword [r14 + 0x38], r10
mov r14, qword [rsp + 0x20]
ret