joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18000fd00
Capabilities:
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push r12
push r14
push r15
sub rsp, 0x50
mov qword [rax - 0x28], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rsi, rdx
mov r14, rcx
movabs r9, 0xcbf29ce484222325
mov qword [rax - 0x48], r9
xor r10d, r10d
movabs rcx, 0x100000001b3
mov qword [rsp + 0x28], r10
cmp r10, 8
jae 0x18000fd6c
movzx eax, byte [r10 + r8]
xor r9, rax
mov qword [rsp + 0x20], r9
imul r9, rcx
mov qword [rsp + 0x20], r9
inc r10
jmp 0x18000fd46
mov r15, qword [r14 + 0x30]
and r15, r9
mov qword [rsp + 0x48], r15
mov rbx, qword [r14 + 8]
shl r15, 4
mov rcx, qword [r14 + 0x18]
cmp qword [rcx + r15], rbx
je 0x18000fd92
mov rbx, qword [rcx + r15 + 8]
mov rbx, qword [rbx]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbx
nop dword [rax]
cmp rbx, qword [rcx + r15]
je 0x18000fdc9
mov rbx, qword [rbx + 8]
mov qword [rsp + 0x38], rbx
mov rax, qword [rbx + 0x10]
cmp qword [r8], rax
je 0x18000fdba
jmp 0x18000fda0
mov qword [rdx], rbx
mov byte [rdx + 8], 0
mov rax, rsi
jmp 0x18000feba
mov rax, qword [r14 + 8]
mov rdi, qword [rax]
mov r9, r8
mov r8, qword [rdi + 8]
mov rdx, rdi
lea rcx, [r14 + 8]
call fcn.18000fc60
mov rdx, rax
mov rax, qword [r14 + 0x10]
movabs rcx, 0xaaaaaaaaaaaaaa9
sub rcx, rax
cmp rcx, 1
jae 0x18000fe0a
lea rcx, str.list_T__too_long
call fcn.1800175c8
int3
inc rax
mov qword [r14 + 0x10], rax
mov qword [rdi + 8], rdx
mov rax, qword [rdx + 8]
mov qword [rax], rdx
mov rdi, qword [r14 + 8]
mov rdi, qword [rdi]
mov qword [rsp + 0x30], rdi
mov rax, qword [rdi]
cmp rbx, rax
je 0x18000fe5d
mov rcx, qword [rdi + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rbx
mov rcx, qword [rbx + 8]
mov qword [rcx], rdi
mov rdx, qword [rbx + 8]
mov rcx, qword [rax + 8]
mov qword [rbx + 8], rcx
mov rcx, qword [rdi + 8]
mov qword [rax + 8], rcx
mov qword [rdi + 8], rdx
mov rdx, qword [r14 + 0x18]
add rdx, r15
mov rax, qword [rdx]
cmp rax, qword [r14 + 8]
jne 0x18000fe7b
mov qword [rdx], rdi
mov rax, qword [r14 + 0x18]
mov qword [r15 + rax + 8], rdi
jmp 0x18000fea7
cmp rax, rbx
jne 0x18000fe85
mov qword [rdx], rdi
jmp 0x18000fea7
mov rax, qword [rdx + 8]
mov rcx, qword [rax]
mov qword [rdx + 8], rcx
cmp rcx, rdi
je 0x18000fea7
mov rdx, qword [r14 + 0x18]
mov rax, qword [rdx + r15 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r15 + 8], rcx
mov rcx, r14
call fcn.180011fd0
nop
mov qword [rsi], rdi
mov byte [rsi + 8], 1
mov rax, rsi
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
Function at 0x18000fee0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x50
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rsi
mov rsi, rdx
mov r11, rcx
movabs r9, 0xcbf29ce484222325
mov qword [rsp + 0x20], r9
xor r10d, r10d
movabs rcx, 0x100000001b3
mov qword [rsp + 0x28], r10
cmp r10, 8
jae 0x18000ff4a
movzx eax, byte [r10 + r8]
xor r9, rax
mov qword [rsp + 0x20], r9
imul r9, rcx
mov qword [rsp + 0x20], r9
inc r10
jmp 0x18000ff24
mov r10, qword [r11 + 0x30]
and r10, r9
mov qword [rsp + 0x48], r10
mov rbx, qword [r11 + 8]
shl r10, 4
mov rcx, qword [r11 + 0x18]
cmp qword [rcx + r10], rbx
je 0x18000ff70
mov rbx, qword [rcx + r10 + 8]
mov rbx, qword [rbx]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbx
nop word [rax + rax]
cmp rbx, qword [rcx + r10]
je 0x18000ffcc
mov rbx, qword [rbx + 8]
mov qword [rsp + 0x38], rbx
mov rax, qword [rbx + 0x10]
cmp qword [r8], rax
je 0x18000ff9a
jmp 0x18000ff80
mov rcx, qword [rsp + 0x78]
mov rdx, qword [rcx]
mov rax, qword [rcx + 8]
mov qword [rax], rdx
mov rdx, qword [rcx + 8]
mov rax, qword [rcx]
mov qword [rax + 8], rdx
dec qword [r11 + 0x10]
call fcn.180018a9c
mov qword [rsi], rbx
mov byte [rsi + 8], 0
mov rax, rsi
jmp 0x180010068
mov rdi, qword [rsp + 0x78]
mov qword [rsp + 0x30], rdi
mov rax, qword [rdi]
cmp rbx, rax
je 0x18001000b
mov rcx, qword [rdi + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rbx
mov rcx, qword [rbx + 8]
mov qword [rcx], rdi
mov rdx, qword [rbx + 8]
mov rcx, qword [rax + 8]
mov qword [rbx + 8], rcx
mov rcx, qword [rdi + 8]
mov qword [rax + 8], rcx
mov qword [rdi + 8], rdx
mov rdx, qword [r11 + 0x18]
add rdx, r10
mov rax, qword [rdx]
cmp rax, qword [r11 + 8]
jne 0x180010029
mov qword [rdx], rdi
mov rax, qword [r11 + 0x18]
mov qword [r10 + rax + 8], rdi
jmp 0x180010055
cmp rax, rbx
jne 0x180010033
mov qword [rdx], rdi
jmp 0x180010055
mov rax, qword [rdx + 8]
mov rcx, qword [rax]
mov qword [rdx + 8], rcx
cmp rcx, rdi
je 0x180010055
mov rdx, qword [r11 + 0x18]
mov rax, qword [rdx + r10 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r10 + 8], rcx
mov rcx, r11
call fcn.180011fd0
nop
mov qword [rsi], rdi
mov byte [rsi + 8], 1
mov rax, rsi
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x180012aa0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x50
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rsi
mov rsi, rdx
mov r11, rcx
movabs r9, 0xcbf29ce484222325
mov qword [rsp + 0x20], r9
xor r10d, r10d
movabs rcx, 0x100000001b3
mov qword [rsp + 0x28], r10
cmp r10, 8
jae 0x180012b0a
movzx eax, byte [r10 + r8]
xor r9, rax
mov qword [rsp + 0x20], r9
imul r9, rcx
mov qword [rsp + 0x20], r9
inc r10
jmp 0x180012ae4
mov r10, qword [r11 + 0x30]
and r10, r9
mov qword [rsp + 0x48], r10
mov rbx, qword [r11 + 8]
shl r10, 4
mov rcx, qword [r11 + 0x18]
cmp qword [rcx + r10], rbx
je 0x180012b35
mov rbx, qword [rcx + r10 + 8]
mov rbx, qword [rbx]
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
nop word [rax + rax]
cmp rbx, qword [rcx + r10]
je 0x180012b8c
mov rbx, qword [rbx + 8]
mov qword [rsp + 0x30], rbx
mov rax, qword [rbx + 0x10]
cmp qword [r8], rax
je 0x180012b5a
jmp 0x180012b40
mov rcx, qword [rsp + 0x78]
mov rdx, qword [rcx]
mov rax, qword [rcx + 8]
mov qword [rax], rdx
mov rdx, qword [rcx + 8]
mov rax, qword [rcx]
mov qword [rax + 8], rdx
dec qword [r11 + 0x10]
call fcn.180018a9c
mov qword [rsi], rbx
mov byte [rsi + 8], 0
mov rax, rsi
jmp 0x180012c28
mov rdi, qword [rsp + 0x78]
mov qword [rsp + 0x38], rdi
mov rax, qword [rdi]
cmp rbx, rax
je 0x180012bcb
mov rcx, qword [rdi + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rbx
mov rcx, qword [rbx + 8]
mov qword [rcx], rdi
mov rdx, qword [rbx + 8]
mov rcx, qword [rax + 8]
mov qword [rbx + 8], rcx
mov rcx, qword [rdi + 8]
mov qword [rax + 8], rcx
mov qword [rdi + 8], rdx
mov rdx, qword [r11 + 0x18]
add rdx, r10
mov rax, qword [rdx]
cmp rax, qword [r11 + 8]
jne 0x180012be9
mov qword [rdx], rdi
mov rax, qword [r11 + 0x18]
mov qword [r10 + rax + 8], rdi
jmp 0x180012c15
cmp rax, rbx
jne 0x180012bf3
mov qword [rdx], rdi
jmp 0x180012c15
mov rax, qword [rdx + 8]
mov rcx, qword [rax]
mov qword [rdx + 8], rcx
cmp rcx, rdi
je 0x180012c15
mov rdx, qword [r11 + 0x18]
mov rax, qword [rdx + r10 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r10 + 8], rcx
mov rcx, r11
call fcn.1800147a0
nop
mov qword [rsi], rdi
mov byte [rsi + 8], 1
mov rax, rsi
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x180012c40
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x50
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rsi
mov rsi, rdx
mov r11, rcx
movabs r9, 0xcbf29ce484222325
mov qword [rsp + 0x20], r9
xor r10d, r10d
movabs rcx, 0x100000001b3
mov qword [rsp + 0x28], r10
cmp r10, 8
jae 0x180012caa
movzx eax, byte [r10 + r8]
xor r9, rax
mov qword [rsp + 0x20], r9
imul r9, rcx
mov qword [rsp + 0x20], r9
inc r10
jmp 0x180012c84
mov r10, qword [r11 + 0x30]
and r10, r9
mov qword [rsp + 0x48], r10
mov rbx, qword [r11 + 8]
shl r10, 4
mov rcx, qword [r11 + 0x18]
cmp qword [rcx + r10], rbx
je 0x180012cd0
mov rbx, qword [rcx + r10 + 8]
mov rbx, qword [rbx]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbx
nop word [rax + rax]
cmp rbx, qword [rcx + r10]
je 0x180012d2c
mov rbx, qword [rbx + 8]
mov qword [rsp + 0x38], rbx
mov rax, qword [rbx + 0x10]
cmp qword [r8], rax
je 0x180012cfa
jmp 0x180012ce0
mov rcx, qword [rsp + 0x78]
mov rdx, qword [rcx]
mov rax, qword [rcx + 8]
mov qword [rax], rdx
mov rdx, qword [rcx + 8]
mov rax, qword [rcx]
mov qword [rax + 8], rdx
dec qword [r11 + 0x10]
call fcn.180018a9c
mov qword [rsi], rbx
mov byte [rsi + 8], 0
mov rax, rsi
jmp 0x180012dc8
mov rdi, qword [rsp + 0x78]
mov qword [rsp + 0x30], rdi
mov rax, qword [rdi]
cmp rbx, rax
je 0x180012d6b
mov rcx, qword [rdi + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rbx
mov rcx, qword [rbx + 8]
mov qword [rcx], rdi
mov rdx, qword [rbx + 8]
mov rcx, qword [rax + 8]
mov qword [rbx + 8], rcx
mov rcx, qword [rdi + 8]
mov qword [rax + 8], rcx
mov qword [rdi + 8], rdx
mov rdx, qword [r11 + 0x18]
add rdx, r10
mov rax, qword [rdx]
cmp rax, qword [r11 + 8]
jne 0x180012d89
mov qword [rdx], rdi
mov rax, qword [r11 + 0x18]
mov qword [r10 + rax + 8], rdi
jmp 0x180012db5
cmp rax, rbx
jne 0x180012d93
mov qword [rdx], rdi
jmp 0x180012db5
mov rax, qword [rdx + 8]
mov rcx, qword [rax]
mov qword [rdx + 8], rcx
cmp rcx, rdi
je 0x180012db5
mov rdx, qword [r11 + 0x18]
mov rax, qword [rdx + r10 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r10 + 8], rcx
mov rcx, r11
call fcn.180014860
nop
mov qword [rsi], rdi
mov byte [rsi + 8], 1
mov rax, rsi
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x180012de0
Capabilities:
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push r12
push r14
push r15
sub rsp, 0x50
mov qword [rax - 0x28], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rsi, rdx
mov r14, rcx
movabs r9, 0xcbf29ce484222325
mov qword [rax - 0x48], r9
xor r10d, r10d
movabs rcx, 0x100000001b3
mov qword [rsp + 0x28], r10
cmp r10, 8
jae 0x180012e4c
movzx eax, byte [r10 + r8]
xor r9, rax
mov qword [rsp + 0x20], r9
imul r9, rcx
mov qword [rsp + 0x20], r9
inc r10
jmp 0x180012e26
mov r15, qword [r14 + 0x30]
and r15, r9
mov qword [rsp + 0x48], r15
mov rbx, qword [r14 + 8]
shl r15, 4
mov rcx, qword [r14 + 0x18]
cmp qword [rcx + r15], rbx
je 0x180012e72
mov rbx, qword [rcx + r15 + 8]
mov rbx, qword [rbx]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbx
nop dword [rax]
cmp rbx, qword [rcx + r15]
je 0x180012ea9
mov rbx, qword [rbx + 8]
mov qword [rsp + 0x38], rbx
mov rax, qword [rbx + 0x10]
cmp qword [r8], rax
je 0x180012e9a
jmp 0x180012e80
mov qword [rdx], rbx
mov byte [rdx + 8], 0
mov rax, rsi
jmp 0x180012f9a
mov rax, qword [r14 + 8]
mov rdi, qword [rax]
mov r9, r8
mov r8, qword [rdi + 8]
mov rdx, rdi
lea rcx, [r14 + 8]
call fcn.180012a10
mov rdx, rax
mov rax, qword [r14 + 0x10]
movabs rcx, 0xaaaaaaaaaaaaaa9
sub rcx, rax
cmp rcx, 1
jae 0x180012eea
lea rcx, str.list_T__too_long
call fcn.1800175c8
int3
inc rax
mov qword [r14 + 0x10], rax
mov qword [rdi + 8], rdx
mov rax, qword [rdx + 8]
mov qword [rax], rdx
mov rdi, qword [r14 + 8]
mov rdi, qword [rdi]
mov qword [rsp + 0x30], rdi
mov rax, qword [rdi]
cmp rbx, rax
je 0x180012f3d
mov rcx, qword [rdi + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rbx
mov rcx, qword [rbx + 8]
mov qword [rcx], rdi
mov rdx, qword [rbx + 8]
mov rcx, qword [rax + 8]
mov qword [rbx + 8], rcx
mov rcx, qword [rdi + 8]
mov qword [rax + 8], rcx
mov qword [rdi + 8], rdx
mov rdx, qword [r14 + 0x18]
add rdx, r15
mov rax, qword [rdx]
cmp rax, qword [r14 + 8]
jne 0x180012f5b
mov qword [rdx], rdi
mov rax, qword [r14 + 0x18]
mov qword [r15 + rax + 8], rdi
jmp 0x180012f87
cmp rax, rbx
jne 0x180012f65
mov qword [rdx], rdi
jmp 0x180012f87
mov rax, qword [rdx + 8]
mov rcx, qword [rax]
mov qword [rdx + 8], rcx
cmp rcx, rdi
je 0x180012f87
mov rdx, qword [r14 + 0x18]
mov rax, qword [rdx + r15 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r15 + 8], rcx
mov rcx, r14
call fcn.180014860
nop
mov qword [rsi], rdi
mov byte [rsi + 8], 1
mov rax, rsi
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
Function at 0x180015270
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
movzx r9d, byte [r8]
mov r11, rdx
mov rdx, rcx
movabs rax, 0xcbf29ce484222325
xor r9, rax
movabs rcx, 0x100000001b3
movzx eax, byte [r8 + 1]
mov rbx, r8
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 2]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 3]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 4]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 5]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 6]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 7]
mov r8, qword [rdx + 0x18]
imul r9, rcx
xor r9, rax
imul r9, rcx
mov rcx, qword [rdx + 0x30]
mov rdx, qword [rdx + 8]
and rcx, r9
mov rax, rcx
add rax, rax
add rcx, rcx
mov rax, qword [r8 + rax*8]
mov r9, qword [r8 + rcx*8]
lea r10, [r8 + rcx*8]
cmp r9, rdx
jne 0x18001531f
mov rcx, rdx
jmp 0x180015326
mov rcx, qword [r10 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x180015376
mov rcx, qword [rbx]
cmp qword [rax + 0x10], rcx
je 0x180015339
mov rax, qword [rax]
jmp 0x180015315
mov rbx, qword [rbx]
mov rcx, rax
nop
cmp r9, rdx
jne 0x18001534a
mov r8, rdx
jmp 0x180015351
mov r8, qword [r10 + 8]
mov r8, qword [r8]
cmp rax, r8
je 0x180015361
cmp rbx, qword [rax + 0x10]
jne 0x180015361
mov rax, qword [rax]
jmp 0x180015340
cmp rcx, rax
je 0x180015376
mov qword [r11 + 8], rax
mov rax, r11
mov qword [r11], rcx
mov rbx, qword [rsp + 8]
ret
mov rbx, qword [rsp + 8]
mov rax, r11
mov qword [r11], rdx
mov qword [r11 + 8], rdx
ret

Function at 0x180015430
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], r8
push rdi
sub rsp, 0x20
mov r9, r8
mov r10, rcx
movzx r8d, byte [r8 + 0x10]
movabs rcx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
mov rdi, rdx
xor r8, rax
movzx eax, byte [r9 + 0x11]
mov rdx, qword [r10 + 0x30]
imul r8, rcx
xor r8, rax
movzx eax, byte [r9 + 0x12]
imul r8, rcx
xor r8, rax
movzx eax, byte [r9 + 0x13]
imul r8, rcx
xor r8, rax
movzx eax, byte [r9 + 0x14]
imul r8, rcx
xor r8, rax
movzx eax, byte [r9 + 0x15]
imul r8, rcx
xor r8, rax
movzx eax, byte [r9 + 0x16]
imul r8, rcx
xor r8, rax
movzx eax, byte [r9 + 0x17]
imul r8, rcx
xor r8, rax
imul r8, rcx
mov rcx, qword [r10 + 0x18]
and rdx, r8
shl rdx, 4
add rcx, rdx
cmp qword [rcx + 8], r9
jne 0x1800154f9
cmp qword [rcx], r9
jne 0x1800154ef
mov rax, qword [r10 + 8]
mov qword [rcx], rax
mov rcx, qword [r10 + 0x18]
mov rax, qword [r10 + 8]
mov qword [rdx + rcx + 8], rax
jmp 0x180015504
mov rax, qword [r9 + 8]
mov qword [rcx + 8], rax
jmp 0x180015504
cmp qword [rcx], r9
jne 0x180015509
mov rax, qword [r9]
mov qword [rcx], rax
mov r9, qword [rsp + 0x40]
mov rax, qword [r9 + 8]
mov rcx, r9
mov rbx, qword [r9]
mov qword [rax], rbx
mov rdx, qword [r9]
mov rax, qword [r9 + 8]
mov qword [rdx + 8], rax
dec qword [r10 + 0x10]
call fcn.180018a9c
mov qword [rdi], rbx
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x180015540
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
movzx r9d, byte [r8]
mov r10, rcx
movabs rcx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
xor r9, rax
mov rbx, rdx
movzx eax, byte [r8 + 1]
mov r11, r8
mov rdx, qword [r10 + 0x18]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 2]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 3]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 4]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 5]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 6]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 7]
mov r8, qword [r10 + 8]
imul r9, rcx
xor r9, rax
imul r9, rcx
mov rcx, qword [r10 + 0x30]
and rcx, r9
mov rax, rcx
add rax, rax
add rcx, rcx
mov rax, qword [rdx + rax*8]
mov r9, qword [rdx + rcx*8]
lea r10, [rdx + rcx*8]
cmp r9, r8
jne 0x1800155ef
mov rcx, r8
jmp 0x1800155f6
mov rcx, qword [r10 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x180015620
mov rcx, qword [r11]
cmp qword [rax + 0x10], rcx
je 0x180015609
mov rax, qword [rax]
jmp 0x1800155e5
mov rcx, qword [rax + 0x10]
cmp qword [r11], rcx
cmovne rax, r8
mov qword [rbx], rax
mov rax, rbx
mov rbx, qword [rsp + 8]
ret
mov qword [rbx], r8
mov rax, rbx
mov rbx, qword [rsp + 8]
ret
Function at 0x180015fc0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x58
mov r8d, 0x30
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x18001600e
mov ecx, 0x5a4d
mov rax, qword [rsp + 0x28]
cmp word [rax], cx
je 0x180015fed
xor eax, eax
jmp 0x18001600e
movsxd rcx, dword [rax + 0x3c]
cmp dword [rcx + rax], 0x4550
je 0x180015ffe
xor eax, eax
jmp 0x18001600e
cmp word [rcx + rax + 0x14], 0
jne 0x18001600a
xor eax, eax
jmp 0x18001600e
jmp 0x18001600e
add rsp, 0x58
ret

Function at 0x180016060
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x50
mov rbx, rdx
mov r8d, 0x30
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
nop
mov eax, 0x5a4d
mov rcx, qword [rsp + 0x28]
cmp word [rcx], ax
je 0x18001608e
xor al, al
jmp 0x1800160cc
movsxd rdx, dword [rcx + 0x3c]
cmp dword [rdx + rcx], 0x4550
je 0x18001609f
xor al, al
jmp 0x1800160cc
mov r8d, dword [rdx + rcx + 0xe8]
lea rax, [r8 + rcx]
cmp rbx, rax
jb 0x1800160c6
mov eax, dword [rdx + rcx + 0xec]
add rax, r8
add rax, rcx
cmp rbx, rax
jae 0x1800160c6
mov al, 1
jmp 0x1800160cc
xor al, al
jmp 0x1800160cc
add rsp, 0x50
pop rbx
ret
Function at 0x1800164e0
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbx
push rsi
sub rsp, 0x28
mov rbx, rdx
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x180058120], eax
je 0x180016507
mov eax, 0x10dd
add rsp, 0x28
pop rsi
pop rbx
ret
mov eax, dword [0x180058138]
test eax, eax
jne 0x18001666b
test rsi, rsi
je 0x180016531
cmp qword [rsi], 0
jne 0x18001653d
mov dword [0x180058138], 6
mov qword [0x180058140], rsi
mov eax, 6
add rsp, 0x28
pop rsi
pop rbx
ret
mov qword [rsp + 0x40], rbp
mov ecx, 0x30
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x20], r14
call fcn.180018b64
mov rdi, rax
test rax, rax
jne 0x180016566
lea ebx, [rax + 8]
jmp 0x18001663b
mov rbp, qword [rsi]
test rbx, rbx
je 0x1800165b9
movzx eax, byte [rbx]
cmp al, 0xff
jne 0x180016599
cmp byte [rbx + 1], 0x25
jne 0x180016599
movsxd r14, dword [rbx + 2]
lea rdx, [rbx + 6]
add rdx, r14
mov rcx, rbx
call fcn.180016060
test al, al
je 0x1800165b9
mov rbx, qword [r14 + rbx + 6]
jmp 0x1800165b9
cmp al, 0xeb
jne 0x1800165b9
movsx rax, byte [rbx + 1]
add rbx, 2
add rbx, rax
cmp byte [rbx], 0xe9
jne 0x1800165b9
movsxd rax, dword [rbx + 1]
add rbx, 5
add rbx, rax
movzx ecx, byte [rbp + 0x1f]
mov r14, qword [rbp + 0x20]
sub r14, rcx
lea eax, [rcx - 1]
cmp eax, 0x1e
ja 0x18001662d
cmp qword [rbp + 0x28], rbx
jne 0x18001662d
mov edx, ecx
mov dword [rsp + 0x50], 0
mov rcx, r14
lea r9, [rsp + 0x50]
mov r8d, 0x40
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1800165fe
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x18001663b
mov dword [rdi + 8], 1
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x20], rbp
mov qword [rdi + 0x18], r14
mov eax, dword [rsp + 0x50]
mov dword [rdi + 0x28], eax
mov rax, qword [0x180058150]
mov qword [rdi], rax
xor eax, eax
mov qword [0x180058150], rdi
jmp 0x18001665c
cmp dword [0x180058124], 0
mov ebx, 9
jne 0x180016641
mov dword [0x180058138], ebx
test rdi, rdi
je 0x180016653
mov edx, 0x30
mov rcx, rdi
call fcn.180018aa4
mov qword [0x180058140], rsi
mov eax, ebx
mov rdi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x40]
mov r14, qword [rsp + 0x20]
add rsp, 0x28
pop rsi
pop rbx
ret
Function at 0x180016680
Capabilities:
Resume thread

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x180058120], eax
je 0x18001669c
mov eax, 0x10dd
add rsp, 0x28
ret
mov qword [rsp + 0x40], rbx
mov rbx, qword [0x180058150]
mov qword [rsp + 0x48], rsi
xor esi, esi
mov qword [rsp + 0x20], rdi
test rbx, rbx
je 0x180016738
nop dword [rax]
mov rax, qword [rbx + 0x20]
lea r9, [rsp + 0x30]
mov r8d, dword [rbx + 0x28]
mov rcx, qword [rbx + 0x18]
movzx edx, byte [rax + 0x1f]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp dword [rbx + 8], esi
jne 0x180016720
mov rdx, qword [rbx + 0x20]
test rdx, rdx
je 0x180016720
mov rcx, rdx
and rcx, 0xffffffffffff0000
xor eax, eax
mov qword [rdx], rax
mov qword [rdx + 8], rax
mov qword [rdx + 0x10], rax
mov qword [rdx + 0x18], rax
mov qword [rdx + 0x20], rax
mov qword [rdx + 0x28], rax
mov qword [rdx + 0x30], rax
mov rax, qword [rcx + 0x10]
mov qword [rdx + 0x20], rax
mov qword [rcx + 0x10], rdx
mov qword [rbx + 0x20], rsi
mov rdi, qword [rbx]
mov edx, 0x30
mov rcx, rbx
call fcn.180018aa4
mov rbx, rdi
test rdi, rdi
jne 0x1800166c0
mov rbx, qword [0x180058128]
mov qword [0x180058150], rsi
test rbx, rbx
je 0x180016772
nop dword [rax + rax]
lea r9, [rsp + 0x38]
mov edx, 0x10000
mov r8d, 0x20
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rbx, qword [rbx + 8]
test rbx, rbx
jne 0x180016750
mov rdi, qword [0x180058148]
test rdi, rdi
je 0x1800167a2
nop
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rbx, qword [rdi]
mov edx, 0x10
mov rcx, rdi
call fcn.180018aa4
mov rdi, rbx
test rbx, rbx
jne 0x180016780
mov rdi, qword [rsp + 0x20]
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov qword [0x180058148], rsi
mov dword [0x180058120], esi
mov rsi, qword [rsp + 0x48]
add rsp, 0x28
ret

Function at 0x1800167d0
Capabilities:
Allocate or change rwx memory

Disassembly:
sub rsp, 0x28
cmp dword [0x180058120], 0
je 0x1800167e7
mov eax, 0x10dd
add rsp, 0x28
ret
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, eax
xor eax, eax
lock cmpxchg dword [0x180058120], ecx
jne 0x1800167dd
xor eax, eax
mov qword [rsp + 0x20], rbx
mov rbx, qword [0x180058128]
mov dword [0x180058124], eax
mov qword [0x180058150], rax
mov qword [0x180058148], rax
mov dword [0x180058138], eax
mov qword [0x180058140], rax
test rbx, rbx
je 0x180016852
nop
lea r9, [rsp + 0x30]
mov edx, 0x10000
mov r8d, 0x40
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rbx, qword [rbx + 8]
test rbx, rbx
jne 0x180016830
xor eax, eax
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret
Function at 0x180016c40
Capabilities:
Suspend thread

Disassembly:
push rdi
sub rsp, 0x20
mov eax, dword [0x180058138]
mov rdi, rcx
test eax, eax
jne 0x180016ce3
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp rdi, rax
jne 0x180016c6a
xor eax, eax
add rsp, 0x20
pop rdi
ret
mov ecx, 0x10
mov qword [rsp + 0x30], rbx
call fcn.180018b64
mov rbx, rax
test rax, rax
jne 0x180016c86
lea edi, [rax + 8]
jmp 0x180016ca9
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x180016cc7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov edx, 0x10
mov rcx, rbx
call fcn.180018aa4
mov rbx, qword [rsp + 0x30]
mov eax, edi
mov dword [0x180058138], edi
mov qword [0x180058140], 0
add rsp, 0x20
pop rdi
ret
mov rax, qword [0x180058148]
mov qword [rbx], rax
xor eax, eax
mov qword [rbx + 8], rdi
mov qword [0x180058148], rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret