joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18035ab00
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], r9
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x30
call fcn.1802e6db0
sub rsp, rax
mov r10, r9
mov rbx, r8
mov r9, qword [rsp + 0xa0]
mov r14, rdx
mov rbp, rcx
mov edi, dword [r9]
mov dword [rsp + 0x80], edi
test edi, edi
je 0x18035ab78
mov rdx, qword [rsp + 0x98]
nop dword [rax]
test rbx, rbx
je 0x18035ab71
mov eax, edi
dec rbx
movzx ecx, byte [rax + rdx]
xor cl, byte [rbp]
inc rbp
mov byte [r14], cl
inc r14
inc edi
and edi, 0xf
jne 0x18035ab50
mov dword [rsp + 0x80], edi
mov r8, qword [rsp + 0x90]
mov esi, 1
movzx r12d, byte [r8 + 0xc]
lea r15, [r8 + 0xc]
mov r11, qword [rsp + 0xa8]
shl r12d, 8
movzx eax, byte [r8 + 0xd]
lea r13d, [rsi + 0xb]
or r12d, eax
movzx eax, byte [r8 + 0xe]
shl r12d, 8
or r12d, eax
movzx eax, byte [r8 + 0xf]
shl r12d, 8
or r12d, eax
cmp rbx, 0x10
jb 0x18035acae
mov eax, 0x10000000
mov edi, r13d
mov qword [rsp + 0x20], r8
mov rdx, rbx
shr rdx, 4
mov r9, r10
cmp rdx, rax
cmova rdx, rax
add r12d, edx
mov r13, rdx
mov eax, r12d
mov ecx, r12d
sub r13, rax
cmp rax, rdx
cmovae r13, rdx
xor r12d, r12d
cmp rax, rdx
mov r8, r13
mov rdx, r14
cmovae r12d, ecx
mov rcx, rbp
call r11
mov r8, qword [rsp + 0x90]
mov eax, r12d
shr eax, 0x18
mov byte [r15], al
mov eax, r12d
shr eax, 0x10
mov byte [r8 + 0xd], al
mov eax, r12d
shr eax, 8
mov byte [r8 + 0xe], al
mov byte [r8 + 0xf], r12b
test r12d, r12d
jne 0x18035ac6d
mov r8d, edi
mov eax, esi
mov rdx, r15
nop dword [rax + rax]
movzx ecx, byte [rdx - 1]
lea rdx, [rdx - 1]
add eax, ecx
mov byte [rdx], al
shr eax, 8
add r8d, 0xffffffff
jne 0x18035ac50
mov r8, qword [rsp + 0x90]
mov r10, qword [rsp + 0x88]
mov eax, 0x10000000
mov r11, qword [rsp + 0xa8]
shl r13, 4
sub rbx, r13
add r14, r13
add rbp, r13
cmp rbx, 0x10
jae 0x18035abd0
mov edi, dword [rsp + 0x80]
mov r13d, 0xc
mov r9, qword [rsp + 0xa0]
test rbx, rbx
je 0x18035ad51
mov rax, qword [rsp + 0x98]
xor ecx, ecx
mov qword [rsp + 0x20], r8
mov r9, r10
mov r8, rsi
mov rdx, rax
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov rcx, rax
call r11
mov rcx, qword [rsp + 0x90]
inc r12d
mov eax, r12d
shr eax, 0x18
mov byte [r15], al
mov eax, r12d
shr eax, 0x10
mov byte [rcx + 0xd], al
mov eax, r12d
shr eax, 8
mov byte [rcx + 0xe], al
mov byte [rcx + 0xf], r12b
test r12d, r12d
jne 0x18035ad27
nop dword [rax + rax]
movzx eax, byte [r15 - 1]
lea r15, [r15 - 1]
add esi, eax
mov byte [r15], sil
shr esi, 8
add r13d, 0xffffffff
jne 0x18035ad10
mov rdx, qword [rsp + 0x98]
nop
mov ecx, edi
inc edi
movzx eax, byte [rcx + rbp]
xor al, byte [rcx + rdx]
mov byte [rcx + r14], al
sub rbx, 1
jne 0x18035ad30
mov rax, qword [rsp + 0xa0]
mov dword [rax], edi
jmp 0x18035ad54
mov dword [r9], edi
mov rbx, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x18035bb80
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rdi
push r14
mov eax, 0x20
call fcn.1802e6db0
sub rsp, rax
cmp qword [rcx + 0x38], 0
mov rdi, r8
mov r14, rdx
mov rbp, rcx
je 0x18035bbb0
mov eax, 0xfffffffe
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
mov rcx, qword [rcx + 0x30]
movabs rax, 0x2000000000000000
add rcx, r8
cmp rcx, rax
ja 0x18035bcb2
cmp rcx, r8
jb 0x18035bcb2
mov qword [rsp + 0x40], rbx
lea rbx, [rbp + 0x40]
mov qword [rsp + 0x48], rsi
mov esi, dword [rbp + 0x174]
mov qword [rsp + 0x50], r12
mov qword [rbp + 0x30], rcx
test esi, esi
je 0x18035bc39
test rdi, rdi
je 0x18035bc24
movzx eax, byte [r14]
lea rbx, [rbp + 0x40]
mov ecx, esi
inc r14
dec rdi
xor byte [rcx + rbx], al
inc esi
and esi, 0xf
jne 0x18035bbf4
lea r12, [rbp + 0x60]
mov rcx, rbx
mov rdx, r12
call fcn.18035cdc0
jmp 0x18035bc3d
test esi, esi
jne 0x18035bc92
lea r12, [rbp + 0x60]
mov rcx, rbx
mov rdx, r12
call fcn.18035cdc0
jmp 0x18035bc3d
lea r12, [rbp + 0x60]
mov qword [rsp + 0x58], r15
mov r15, rdi
and r15, 0xfffffffffffffff0
je 0x18035bc62
mov r9, r15
mov r8, r14
mov rdx, r12
mov rcx, rbx
call fcn.18035cf40
add r14, r15
sub rdi, r15
mov r15, qword [rsp + 0x58]
test rdi, rdi
je 0x18035bc92
mov esi, edi
sub r14, rbp
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r14 + rbx - 0x40]
xor byte [rbx], al
lea rbx, [rbx + 1]
sub rdi, 1
jne 0x18035bc80
mov rbx, qword [rsp + 0x40]
xor eax, eax
mov r12, qword [rsp + 0x50]
mov dword [rbp + 0x174], esi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
mov eax, 0xffffffff
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
Function at 0x18035cdc0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
movzx eax, byte [rcx + 0xf]
lea r14, [0x18048eaf0]
mov r8d, eax
mov rdi, rdx
and eax, 0xf
mov r11, rcx
add rax, rax
and r8, 0xfffffffffffffff0
mov esi, 0xe
mov r9, qword [rdx + rax*8]
mov rax, qword [rdx + rax*8 + 8]
mov rcx, r9
mov rdx, rax
shr rcx, 4
and edx, 0xf
shr rax, 4
shl r9, 0x3c
or rax, r9
mov rbx, qword [r14 + rdx*8]
xor rbx, rcx
xor rbx, qword [r8 + rdi]
xor rax, qword [r8 + rdi + 8]
nop dword [rax + rax]
movzx ecx, byte [rsi + r11]
mov rdx, rax
shr rax, 4
mov r9d, ecx
and ecx, 0xf
and edx, 0xf
add rcx, rcx
and r9, 0xfffffffffffffff0
lea r8, [rdi + rcx*8]
mov rcx, rbx
shl rbx, 0x3c
mov r10, qword [r14 + rdx*8]
or rbx, rax
xor rbx, qword [r8 + 8]
shr rcx, 4
mov rdx, rbx
xor r10, rcx
shr rdx, 4
xor r10, qword [r8]
mov rcx, rbx
and ecx, 0xf
mov rax, r10
shr rax, 4
mov rbx, qword [r14 + rcx*8]
xor rbx, rax
mov rax, r10
xor rbx, qword [r9 + rdi]
shl rax, 0x3c
or rax, rdx
xor rax, qword [r9 + rdi + 8]
sub rsi, 1
jns 0x18035ce30
mov rsi, qword [rsp + 0x10]
mov rdx, rbx
mov rdi, qword [rsp + 0x18]
mov r14, qword [rsp + 0x20]
shr rdx, 0x20
mov ecx, edx
mov byte [r11 + 3], dl
shr ecx, 0x18
mov byte [r11], cl
mov ecx, edx
shr ecx, 0x10
mov byte [r11 + 1], cl
mov ecx, edx
shr ecx, 8
mov rdx, rax
mov byte [r11 + 2], cl
mov ecx, ebx
shr ecx, 0x18
mov byte [r11 + 4], cl
mov ecx, ebx
shr ecx, 0x10
mov byte [r11 + 5], cl
mov ecx, ebx
shr ecx, 8
mov byte [r11 + 6], cl
shr rdx, 0x20
mov ecx, edx
mov byte [r11 + 7], bl
mov rbx, qword [rsp + 8]
shr ecx, 0x18
mov byte [r11 + 8], cl
mov ecx, edx
shr ecx, 0x10
mov byte [r11 + 9], cl
mov ecx, edx
shr ecx, 8
mov byte [r11 + 0xa], cl
mov ecx, eax
shr ecx, 0x18
mov byte [r11 + 0xc], cl
mov ecx, eax
shr ecx, 0x10
mov byte [r11 + 0xd], cl
mov ecx, eax
shr ecx, 8
mov byte [r11 + 0xe], cl
mov byte [r11 + 0xb], dl
mov byte [r11 + 0xf], al
ret
Function at 0x18035cf40
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r13
push r14
push r15
movzx eax, byte [rcx + 0xf]
lea r14, [r8 + 0xe]
mov rsi, rcx
lea r13, [0x18048eaf0]
sub rsi, r8
mov r12, r9
mov rbp, rdx
mov rbx, rcx
nop word [rax + rax]
movzx edx, byte [r14 + 1]
mov rdi, r14
movzx ecx, al
mov r15d, 0xf
xor rdx, rcx
mov r8, rdx
and edx, 0xf
add rdx, rdx
and r8, 0xfffffffffffffff0
mov r9, qword [rbp + rdx*8]
mov rax, qword [rbp + rdx*8 + 8]
mov rcx, r9
mov rdx, rax
shr rcx, 4
and edx, 0xf
shr rax, 4
shl r9, 0x3c
or rax, r9
mov r11, qword [r13 + rdx*8]
xor r11, rcx
xor r11, qword [r8 + rbp]
xor rax, qword [r8 + rbp + 8]
nop dword [rax]
nop dword [rax + rax]
movzx ecx, byte [rdi]
movzx edx, byte [rsi + rdi]
lea rdi, [rdi - 1]
xor rdx, rcx
mov rcx, r11
mov r9, rdx
shl r11, 0x3c
and edx, 0xf
shr rcx, 4
add rdx, rdx
and r9, 0xfffffffffffffff0
lea r8, [rdx*8]
mov rdx, rax
shr rax, 4
and edx, 0xf
or r11, rax
xor r11, qword [r8 + rbp + 8]
mov r10, qword [r13 + rdx*8]
mov rdx, r11
xor r10, rcx
shr rdx, 4
xor r10, qword [r8 + rbp]
mov rcx, r11
and ecx, 0xf
mov rax, r10
shr rax, 4
mov r11, qword [r13 + rcx*8]
xor r11, rax
mov rax, r10
xor r11, qword [r9 + rbp]
shl rax, 0x3c
or rax, rdx
xor rax, qword [r9 + rbp + 8]
sub r15, 1
jne 0x18035cfe0
mov rdx, r11
mov byte [rbx + 7], r11b
shr rdx, 0x20
add r14, 0x10
mov ecx, edx
mov byte [rbx + 3], dl
shr ecx, 0x18
sub rsi, 0x10
mov byte [rbx], cl
mov ecx, edx
shr ecx, 0x10
mov byte [rbx + 1], cl
mov ecx, edx
shr ecx, 8
mov rdx, rax
mov byte [rbx + 2], cl
mov ecx, r11d
shr ecx, 0x18
mov byte [rbx + 4], cl
mov ecx, r11d
shr ecx, 0x10
mov byte [rbx + 5], cl
mov ecx, r11d
shr ecx, 8
mov byte [rbx + 6], cl
shr rdx, 0x20
mov ecx, edx
mov byte [rbx + 0xb], dl
shr ecx, 0x18
mov byte [rbx + 8], cl
mov ecx, edx
shr ecx, 0x10
mov byte [rbx + 9], cl
mov ecx, edx
shr ecx, 8
mov byte [rbx + 0xa], cl
mov ecx, eax
shr ecx, 0x18
mov byte [rbx + 0xc], cl
mov ecx, eax
shr ecx, 0x10
mov byte [rbx + 0xd], cl
mov ecx, eax
shr ecx, 8
mov byte [rbx + 0xe], cl
mov byte [rbx + 0xf], al
sub r12, 0x10
jne 0x18035cf80
mov rbx, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
pop r15
pop r14
pop r13
pop r12
ret
Function at 0x18036db7c
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x18036dc60
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x18036dcc7
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x18036dcc7
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x18036dcc7
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x18036dcc7
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x18036dcc7
cmp dword [rcx + 0x84], 0xe
jbe 0x18036dcc7
cmp dword [rcx + 0xf8], 0
je 0x18036dcc7
mov ecx, ebx
call fcn.18036dbac
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.18036dde0
cmp dword [rbp + 0x20], 0
je 0x18036dd14
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.18036dc08
int3
Function at 0x140003170
Capabilities:
Access pe header

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
cmp qword [rsp + 0x50], 0
jne 0x140003185
xor eax, eax
jmp 0x1400031f1
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x1400031a1
xor eax, eax
jmp 0x1400031f1
mov rcx, qword [rsp + 0x50]
call fcn.140003110
mov dword [rsp + 0x20], eax
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x50]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
movabs rcx, 0xaabbcc11ffee00
cmp qword [rax], rcx
jne 0x1400031e8
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x50]
cmp qword [rax + 0x10], rcx
je 0x1400031ec
xor eax, eax
jmp 0x1400031f1
mov rax, qword [rsp + 0x28]
add rsp, 0x48
ret
Function at 0x14000edb0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
cmp qword [rsp + 0x50], 0
jne 0x14000edcd
xor eax, eax
jmp 0x14000eeca
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x58], 0
jbe 0x14000ee09
mov r9d, 0x40
mov r8, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
call fcn.140002610
movzx eax, al
test eax, eax
jne 0x14000ee07
xor eax, eax
jmp 0x14000eeca
jmp 0x14000ee26
mov edx, 0x40
mov rcx, qword [rsp + 0x28]
call fcn.140011770
movzx eax, al
test eax, eax
je 0x14000ee26
xor eax, eax
jmp 0x14000eeca
mov rax, qword [rsp + 0x28]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x14000ee3c
xor eax, eax
jmp 0x14000eeca
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0x3c]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0x400
jle 0x14000ee56
xor eax, eax
jmp 0x14000eeca
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x50]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x58], 0
jbe 0x14000ee9a
mov r9d, 0xf8
mov r8, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
call fcn.140002610
movzx eax, al
test eax, eax
jne 0x14000ee98
xor eax, eax
jmp 0x14000eeca
jmp 0x14000eeb4
mov edx, 0xf8
mov rcx, qword [rsp + 0x30]
call fcn.140011770
movzx eax, al
test eax, eax
je 0x14000eeb4
xor eax, eax
jmp 0x14000eeca
mov rax, qword [rsp + 0x30]
cmp dword [rax], 0x4550
je 0x14000eec5
xor eax, eax
jmp 0x14000eeca
mov rax, qword [rsp + 0x30]
add rsp, 0x48
ret
Function at 0x140016480
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
lea rax, str.expand_32_byte_k
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x20]
call fcn.1400163a0
mov ecx, 4
imul rcx, rcx, 0
mov rdx, qword [rsp + 0x40]
mov dword [rdx + rcx], eax
mov rax, qword [rsp + 0x20]
add rax, 4
mov rcx, rax
call fcn.1400163a0
mov ecx, 4
imul rcx, rcx, 1
mov rdx, qword [rsp + 0x40]
mov dword [rdx + rcx], eax
mov rax, qword [rsp + 0x20]
add rax, 8
mov rcx, rax
call fcn.1400163a0
mov ecx, 4
imul rcx, rcx, 2
mov rdx, qword [rsp + 0x40]
mov dword [rdx + rcx], eax
mov rax, qword [rsp + 0x20]
add rax, 0xc
mov rcx, rax
call fcn.1400163a0
mov ecx, 4
imul rcx, rcx, 3
mov rdx, qword [rsp + 0x40]
mov dword [rdx + rcx], eax
mov rcx, qword [rsp + 0x48]
call fcn.1400163a0
mov ecx, 4
imul rcx, rcx, 4
mov rdx, qword [rsp + 0x40]
mov dword [rdx + rcx], eax
mov rax, qword [rsp + 0x48]
add rax, 4
mov rcx, rax
call fcn.1400163a0
mov ecx, 4
imul rcx, rcx, 5
mov rdx, qword [rsp + 0x40]
mov dword [rdx + rcx], eax
mov rax, qword [rsp + 0x48]
add rax, 8
mov rcx, rax
call fcn.1400163a0
mov ecx, 4
imul rcx, rcx, 6
mov rdx, qword [rsp + 0x40]
mov dword [rdx + rcx], eax
mov rax, qword [rsp + 0x48]
add rax, 0xc
mov rcx, rax
call fcn.1400163a0
mov ecx, 4
imul rcx, rcx, 7
mov rdx, qword [rsp + 0x40]
mov dword [rdx + rcx], eax
mov rax, qword [rsp + 0x48]
add rax, 0x10
mov rcx, rax
call fcn.1400163a0
mov ecx, 4
imul rcx, rcx, 8
mov rdx, qword [rsp + 0x40]
mov dword [rdx + rcx], eax
mov rax, qword [rsp + 0x48]
add rax, 0x14
mov rcx, rax
call fcn.1400163a0
mov ecx, 4
imul rcx, rcx, 9
mov rdx, qword [rsp + 0x40]
mov dword [rdx + rcx], eax
mov rax, qword [rsp + 0x48]
add rax, 0x18
mov rcx, rax
call fcn.1400163a0
mov ecx, 4
imul rcx, rcx, 0xa
mov rdx, qword [rsp + 0x40]
mov dword [rdx + rcx], eax
mov rax, qword [rsp + 0x48]
add rax, 0x1c
mov rcx, rax
call fcn.1400163a0
mov ecx, 4
imul rcx, rcx, 0xb
mov rdx, qword [rsp + 0x40]
mov dword [rdx + rcx], eax
mov eax, 4
imul rax, rax, 0xc
mov rcx, qword [rsp + 0x40]
mov dword [rcx + rax], 0
mov eax, 4
imul rax, rax, 0xd
mov rcx, qword [rsp + 0x40]
mov dword [rcx + rax], 0
mov rcx, qword [rsp + 0x50]
call fcn.1400163a0
mov ecx, 4
imul rcx, rcx, 0xe
mov rdx, qword [rsp + 0x40]
mov dword [rdx + rcx], eax
mov rax, qword [rsp + 0x50]
add rax, 4
mov rcx, rax
call fcn.1400163a0
mov ecx, 4
imul rcx, rcx, 0xf
mov rdx, qword [rsp + 0x40]
mov dword [rdx + rcx], eax
mov rax, qword [rsp + 0x40]
add rsp, 0x38
ret
Function at 0x14003a6f0
Capabilities:
Compute adler32 checksum

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
movaps xmmword [rsp + 0x40], xmm6
mov ebx, ecx
movaps xmmword [rsp + 0x30], xmm7
mov r10, rdx
movdqa xmm7, xmmword [0x140073fd0]
mov edi, 0x15b0
movaps xmmword [rsp + 0x20], xmm8
movdqa xmm8, xmmword [0x140073fe0]
movaps xmmword [rsp + 0x10], xmm9
movaps xmmword [rsp], xmm10
movdqa xmm10, xmmword [0x140073ff0]
shr ebx, 0x10
movzx r11d, cx
cmp r9, 0x10
jb 0x14003a8c5
xorps xmm5, xmm5
nop dword [rax]
cmp r9, rdi
movd xmm3, r11d
mov rax, r9
movd xmm9, ebx
cmova rax, rdi
movdqa xmm6, xmm5
and rax, 0xfffffffffffffff0
movdqa xmm4, xmm5
sub r9, rax
cmp rax, 0x20
jb 0x14003a7ed
mov rdx, rax
shr rdx, 5
imul rcx, rdx, 0xffffffffffffffe0
add rax, rcx
nop word [rax + rax]
movdqu xmm1, xmmword [r8]
movdqu xmm2, xmmword [r8 + 0x10]
add r8, 0x20
movdqa xmm0, xmm1
paddd xmm6, xmm3
psadbw xmm0, xmm5
movdqu xmmword [r10], xmm1
movdqu xmmword [r10 + 0x10], xmm2
add r10, 0x20
pmaddubsw xmm1, xmm10
paddd xmm3, xmm0
movdqa xmm0, xmm2
pmaddubsw xmm2, xmm8
psadbw xmm0, xmm5
pmaddwd xmm1, xmm7
pmaddwd xmm2, xmm7
paddd xmm3, xmm0
paddd xmm9, xmm1
paddd xmm4, xmm2
sub rdx, 1
jne 0x14003a790
pslld xmm6, 5
paddd xmm4, xmm9
paddd xmm4, xmm6
movdqa xmm6, xmm5
cmp rax, 0x10
jb 0x14003a84e
movdqa xmm2, xmm3
shr rax, 4
nop dword [rax]
movdqu xmm1, xmmword [r8]
add r8, 0x10
paddd xmm6, xmm2
movdqa xmm0, xmm1
psadbw xmm0, xmm5
movdqu xmmword [r10], xmm1
add r10, 0x10
paddd xmm3, xmm0
movdqa xmm0, xmm1
pmaddubsw xmm0, xmm8
movdqa xmm2, xmm3
pmaddwd xmm0, xmm7
paddd xmm4, xmm0
sub rax, 1
jne 0x14003a810
movdqa xmm0, xmm3
pslld xmm6, 4
psrldq xmm0, 8
paddd xmm6, xmm4
paddd xmm0, xmm3
mov eax, 0x80078071
movd r11d, xmm0
movdqa xmm1, xmm6
punpckhqdq xmm1, xmm6
paddd xmm1, xmm6
mul r11d
pshufd xmm0, xmm1, 1
paddd xmm0, xmm1
movd ebx, xmm0
shr edx, 0xf
imul eax, edx, 0xfff1
sub r11d, eax
mov eax, 0x80078071
mul ebx
shr edx, 0xf
imul eax, edx, 0xfff1
sub ebx, eax
cmp r9, 0x10
jae 0x14003a750
test r9, r9
jne 0x14003a740
shl ebx, 0x10
or ebx, r11d
mov eax, ebx
jmp 0x14003a911
test r9, r9
je 0x14003a8e8
sub r8, r10
nop dword [rax]
movzx eax, byte [r8 + r10]
mov byte [r10], al
lea r10, [r10 + 1]
add r11d, eax
add ebx, r11d
sub r9, 1
jne 0x14003a8d0
mov eax, 0x80078071
mul r11d
mov eax, 0x80078071
shr edx, 0xf
imul ecx, edx, 0xfff1
mul ebx
sub r11d, ecx
shr edx, 0xf
imul eax, edx, 0xf
add eax, ebx
shl eax, 0x10
or eax, r11d
mov rbx, qword [rsp + 0x60]
movaps xmm6, xmmword [rsp + 0x40]
movaps xmm7, xmmword [rsp + 0x30]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x10]
movaps xmm10, xmmword [rsp]
add rsp, 0x50
pop rdi
ret
Function at 0x14003a980
Capabilities:
Compute adler32 checksum

Disassembly:
sub rsp, 0x68
mov r11, r8
mov r10, rdx
mov eax, ecx
test r8, r8
jne 0x14003a99e
mov eax, 1
vzeroupper
add rsp, 0x68
ret
test r9, r9
je 0x14003abdf
mov qword [rsp + 0x70], rbx
mov ebx, ecx
mov qword [rsp + 0x60], rdi
mov edi, 0x15b0
vmovaps xmmword [rsp + 0x50], xmm6
vmovaps xmmword [rsp + 0x40], xmm7
vmovdqu ymm7, ymmword [0x1400743c0]
vmovaps xmmword [rsp + 0x30], xmm8
vmovdqu ymm8, ymmword [0x1400743a0]
vmovaps xmmword [rsp + 0x20], xmm9
vmovdqu ymm9, ymmword [0x140074380]
movzx r8d, cx
mov ecx, dword [rsp + 0x90]
shr ebx, 0x10
cmp r9, 0x10
jb 0x14003ab2f
cmp r9, 0x20
jb 0x14003ab03
vpxor xmm6, xmm6, xmm6
nop
cmp r9, rdi
mov rax, r9
vmovd xmm2, r8d
cmova rax, rdi
and rax, 0xffffffffffffffe0
sub r9, rax
vmovd xmm3, ebx
vmovdqu ymm5, ymm2
vmovdqu ymm4, ymm6
cmp rax, 0x20
jb 0x14003aa7a
shr rax, 5
nop dword [rax]
vmovdqu ymm0, ymmword [r11]
add r11, 0x20
vpsadbw ymm1, ymm0, ymm6
test ecx, ecx
je 0x14003aa5a
vmovdqu ymmword [r10], ymm0
add r10, 0x20
vpaddd ymm2, ymm1, ymm2
vpmaddubsw ymm0, ymm0, ymm7
vpmaddwd ymm1, ymm0, ymm8
vpaddd ymm4, ymm4, ymm5
vpaddd ymm3, ymm1, ymm3
vmovdqu ymm5, ymm2
sub rax, 1
jne 0x14003aa40
vpermd ymm1, ymm9, ymm2
vpunpckhqdq xmm0, xmm1, xmm1
vpaddd xmm2, xmm0, xmm1
vpshufd xmm1, xmm2, 1
vpaddd xmm0, xmm1, xmm2
vmovd r8d, xmm0
vpslld ymm0, ymm4, 5
vpaddd ymm2, ymm0, ymm3
vextracti128 xmm1, ymm2, 1
vpaddd xmm1, xmm1, xmm2
vpunpckhqdq xmm0, xmm1, xmm1
vpaddd xmm2, xmm0, xmm1
mov eax, 0x80078071
mul r8d
vpshufd xmm1, xmm2, 1
shr edx, 0xf
imul eax, edx, 0xfff1
vpaddd xmm0, xmm1, xmm2
vmovd ebx, xmm0
sub r8d, eax
mov eax, 0x80078071
mul ebx
shr edx, 0xf
imul eax, edx, 0xfff1
sub ebx, eax
cmp r9, 0x20
jae 0x14003aa10
mov eax, ebx
shl eax, 0x10
or eax, r8d
test r9, r9
jne 0x14003a9f6
jmp 0x14003abbd
test ecx, ecx
mov ecx, eax
je 0x14003ab1c
mov r8, r11
mov rdx, r10
vzeroupper
call fcn.14003a6f0
jmp 0x14003abbd
mov r8, r9
mov rdx, r11
vzeroupper
call fcn.140039c10
jmp 0x14003abbd
test ecx, ecx
je 0x14003ab6e
test r9, r9
je 0x14003ab58
sub r11, r10
nop dword [rax + rax]
movzx eax, byte [r11 + r10]
mov byte [r10], al
lea r10, [r10 + 1]
add r8d, eax
add ebx, r8d
sub r9, 1
jne 0x14003ab40
mov eax, 0x80078071
mul r8d
shr edx, 0xf
imul ecx, edx, 0xfff1
sub r8d, ecx
jmp 0x14003aba8
test r9, r9
je 0x14003ab94
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r11]
lea r11, [r11 + 1]
add r8d, eax
add ebx, r8d
sub r9, 1
jne 0x14003ab80
mov eax, 0x80078071
mul r8d
shr edx, 0xf
imul eax, edx, 0xfff1
sub r8d, eax
mov eax, 0x80078071
mul ebx
shr edx, 0xf
imul eax, edx, 0xf
add eax, ebx
shl eax, 0x10
or eax, r8d
vmovaps xmm8, xmmword [rsp + 0x30]
vmovaps xmm7, xmmword [rsp + 0x40]
vmovaps xmm6, xmmword [rsp + 0x50]
mov rdi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x70]
vmovaps xmm9, xmmword [rsp + 0x20]
vzeroupper
add rsp, 0x68
ret
Function at 0x14004d758
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov ebx, ecx
call fcn.140045cb8
mov ecx, ebx
lea r8, [rsp + 0x30]
and ecx, 0x3ff
mov r9d, 2
bts ecx, 0xa
mov edx, 0x20000001
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor edx, edx
test eax, eax
je 0x14004d7f9
cmp ebx, dword [rsp + 0x30]
je 0x14004d7f2
test esi, esi
je 0x14004d7f2
mov r10, qword [rdi + 0x98]
mov r9d, edx
movzx r8d, word [r10]
lea rcx, [r10 + 2]
lea eax, [r8 - 0x41]
cmp ax, 0x19
jbe 0x14004d7cd
sub r8w, 0x61
cmp r8w, 0x19
ja 0x14004d7da
movzx r8d, word [rcx]
inc r9d
add rcx, 2
jmp 0x14004d7b7
or rax, 0xffffffffffffffff
inc rax
cmp word [r10 + rax*2], dx
jne 0x14004d7de
cmp r9d, eax
setne dl
mov eax, edx
jmp 0x14004d7fb
mov eax, 1
jmp 0x14004d7fb
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x14004dcf4
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14004dd63
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14004dd63
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14004dd63
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14004dd63
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14004dd63
cmp dword [rcx + 0x84], 0xe
jbe 0x14004dd63
cmp dword [rcx + 0xf8], 0
je 0x14004dd63
mov ecx, ebx
call fcn.14004de14
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.14004dbf0
nop
cmp dword [rbp + 0x20], 0
je 0x14004ddb1
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14004ddbc
int3
xor r8d, r8d
lea edx, [r8 + 2]
jmp 0x14004dcf4

Function at 0x14004def8
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14004dcf4